Routing and Remote Access Blog : Admin dll

Limit one connection to the VPN server per user

rrasblog — Thu, 17 Jul 2008 14:30:00 GMT

Hello all,

I thought it would be worthwhile to blog a post specifically on this topic. I've seen quite a number of people having this requirement to limit the number of VPN connections that can be made to the VPN server using a particular username to just one. And I did take this one as the example program in my earlier post about developing a RAS administration DLL. However, I thought it would be good to elaborate a little more on what the DLL actually does.

You can refer to the code (attached as a rtf file) in this post --> http://blogs.technet.com/rrasblog/archive/2007/12/20/steps-to-develop-a-ras-administration-dll-using-visual-studio.aspx

Among all the callback functions that we have implemented, the two important ones to consider are MprAdminConnectionHangupNotification2 and MprAdminAcceptNewConnection2. These are the functions where we do processing when there is a client connection/disconnection coming.

Let's the take MprAdminAcceptNewConnection2 first. This function has the below prototype

BOOL WINAPI

MprAdminAcceptNewConnection2(RAS_CONNECTION_0 * pRasConnection0,

RAS_CONNECTION_1 * pRasConnection1,

RAS_CONNECTION_2 * pRasConnection2)

When there is a connection coming from the client, this callback is called with the parameters populated. Let's use the pRasConnection2 parameter for our processing. This structure RAS_CONNECTION_2 has the following format:

typedef struct _RAS_CONNECTION_2 {
HANDLE hConnection;
WCHAR wszUserName[UNLEN + 1];
ROUTER_INTERFACE_TYPE dwInterfaceType;
GUID guid;
PPP_INFO_2 PppInfo2;

} RAS_CONNECTION_2,
*PRAS_CONNECTION_2;

The wszUserName parameter here is the one that is of interest to us here. This contains the name of the user who is connecting. We want to ensure that if there is already an active connection on this server from this user, this connection should be refused. So we need to do some book-keeping to keep track of the users who have an active connection on the server currently.

For this we maintain a linked list in this example. When a client connects, we check if the username already exists in the list. If yes, we reject the connection, else we allow the connection to go through and add the username to the list.

When a connection is disconnected, the callback MprAdminConnectionHangupNotification2 is called. This function's prototype is as below:

VOID WINAPI

MprAdminConnectionHangupNotification2(RAS_CONNECTION_0 * pRasConnection0,

RAS_CONNECTION_1 * pRasConnection1,

RAS_CONNECTION_2 * pRasConnection2)

Again here, we get the username from the pRasConnection2 structure and delete that user from the list.

Coming to the implementation in detail, you can see that we are keeping track of the user's security identifiers (SID) rather than the name itself. This is because a username can be represented in many ways - DOMAIN\USER, USER@DOMAIN etc. However, the SID is the same across. So we convert the username to user SID and store it in the list that we maintain.

Apart from this, during the DLL initialization, we also create a log file for debugging.

The linked list is just to explain the logic of how this is accomplished using administration DLL. However, we can use better ways of storing this information so that a look up is easy thereby ensuring lesser delay during connection.

Hope this helps.

Let us know if you would like to hear about something specific. Drop us a line at rrasblog@online.microsoft.com **

** Remove the online from the email ID to actually mail us.

Janani Vasudevan
Software Design Engineer/Test
RRAS, Windows Enterprise Networking

[This posting is provided "AS IS" with no warranties, and confers no rights.]

Steps to develop a RAS administration DLL using Visual Studio

rrasblog — Thu, 20 Dec 2007 14:39:00 GMT

Hello folks! We saw how useful a RAS administration DLL can be to admins who want to control what the RRAS server does. In this post, let us see how we can develop a RAS administration DLL using Visual Studio.

I have often seen requirements from admins to control the VPN server such that only one VPN connection can be made to a server using a single user name. This is basically to prevent users from distributing their usernames and hence resulting in lot of connections with the same username. So let us design and write a RAS administration DLL for this purpose.

Let us call it RestrictOneConnPerUser.dll.

Pre-requisites:

Microsoft Visual Studio 2005

Start building the RAS administration DLL

1) Create New Project: Open Microsoft Visual Studio and create a new project.

2) Select Project type: When you are asked to select the type of project, select Visual ++ --> Win32 --> Win32 Project. Type the name of the project as 'RestrictOneConnPerUser' and click on 'OK'.

Note down the location that is given in the 'Location' drop down. Your project would be created at this location. So the source files for your project will have to be copied to the C:\Users\User1\Documents\Visual Studio 2005\Projects\RestrictOneConnPerUser

3) Choose Project Options: In the Win32 project type selection wizard that follows, select 'DLL' as the project type and choose 'Empty project'. Click on 'Finish'.

4) Write code: Now, we have created a DLL project. The next step to add the code. Let's do that now. Download the file which is provided as attachment to this post. The file has the code for three files - the header file, the C source and the exports definition file - for the DLL.

Click on Start --> Run --> Type 'notepad' --> Copy all the contents from the attached doc under 'UserRestrict.h' to the notepad and Save the file as 'UserRestrict.h'

Similarly, open new notepad files, paste the contents of 'UserRestrict.c' and 'UserRestrict.def' and save them with the names 'UserRestrict.c' and 'UserRestrict.def'.

Now, copy all these three files to the project location, which would be C:\Users\User1\Documents\Visual Studio 2005\Projects\RestrictOneConnPerUser for us now.

5) Include code files in project: Once the code has been written, it then has to be included in the Project. The below snapshot will show you how to do it.

Right click on the project --> Add --> Existing Item --> Browse to the solution directory which is C:\Users\User1\Documents\Visual Studio 2005\Projects\RestrictOneConnPerUser. Select the file and add it to the project. Do this for the header and the C file.

6) Edit Project Properties: Now, we have created the project, added the code. The only thing left now is to build it and get our DLL! Ok, before that we would need to edit some project properties - to include additional libraries that this code needs, to specify that you want a C file like compilation (not C++) etc.

The steps that you would need to follow are outlined by the snapshots below:

Open the project properties by right clicking on the Project --> Select Properties.

This will open up a window as below. Browse to 'Linker' --> 'Input' in the left hand side tree. You will the options like 'Additional dependencies' , 'Ignore all default libraries' etc. on the right hand side. This is how it will look for the project we created.

We would be adding 'Additional dependencies' and the 'Module Definition File' for our project.

The below snapshot shows the additional dependency libraries that we need to add and the module definition file. The module definition file is nothing but the .DEF file that we created and copied to the solution folder in Step 4 above.

Once you have added the libraries and modified the module definition file, click on 'Apply' to save the settings.

There's just one more property that we would like to change i.e. to instruct the compiler to compile this as a C code. This is done by browsing to the 'Configuration Properties' --> C/C++ --> Advanced on the left pane. Then, edit the option 'Compile As' on the right pane and select 'Compile as C code (/TC)' from the dropdown list. Click on 'Apply' to save the settings.

We are done with editing the project properties. So you can click 'OK' to go back to the project.

The below snapshots will help illustrate this.

7) Build the code: We are all ready to build the code now. Right click on the Project --> click on 'Build Solution'. If everything goes well, you will see that the build succeeded and the DLL is present in the binaries location. For us, the binaries location would be C:\Users\User1\Documents\Visual Studio 2005\Projects\RestrictOneConnPerUser\Debug. You will find the DLL RestrictOneConnPerUser.dll here.

Here we are!! Our own admin DLL is ready. We just have to deploy this on the RRAS server as per the deployment guidelines in MSDN. You can refer to it here.

Folks - That's it for now. I'll come back with another post explaining what the code actually does to restrict only one connection per user. Feel free to post any comments/queries to rrasblog@online.microsoft.com**

**Remove the 'online.' from the mail ID above to actually mail us.

Janani Vasudevan
Software Design Engineer/Test
RRAS, Windows Enterprise Networking

[This posting is provided "AS IS" with no warranties, and confers no rights.]

RAS Administration DLL - Your customized solution to manage the server!

rrasblog — Sun, 16 Dec 2007 19:53:00 GMT

Hello everyone. I understand that all of you would be busy checking out Vista and its cool features. However, for this post I decided to write about something which is very powerful but is little known - RAS administration DLL. The post will outline the use of a RAS administration DLL and will touch upon the basics of how to start writing your own customized RAS administration DLL.

The admin DLL or the RAS administration DLL is loaded by RRAS during service startup. During service startup, the MprAdminInitializeDll function of the admin DLL is called. And during service shutdown, MprAdminTerminateDll is called.

When would you use a RAS administration DLL?

When you want to control the connection to the RRAS server based on either the user who connects, or the port on which the user connects or any other property of the connection or if you want to assign an IP address of your choice to the connecting client or if you just want to audit/log the connection information for your later reference, and if RRAS inherently doesn't support it, then it is time to write your own admin DLL to do what you require. Some typicaly scenarios which would require to have a RAS administration DLL are - to ensure that there can be only one VPN connection from a particular user, to ensure that particular users not be allowed to connect, to ensure that all connections of a particular media type be rejected etc.

How would you start writing your own RAS administration DLL?

A RAS administration DLL must implement and export all of the following functions:

MprAdminAcceptNewLink

MprAdminInitializeDll

MprAdminLinkHangupNotification

MprAdminTerminateDll

Typically, you will write three files, say, MyRasAdminDLL.h (which contains the #includes,#defines anddatastructures that you might use in the code), MyRasAdminDLL.cpp (which implements all these above functions) and MyRASAdminDLL.def (which is the module definition file for the DLL and would export all of the above functions and anything else that you would implement)

In case, you do not want to implement any these functions, just return TRUE or return as the function requires.

The complete list of Admin callback functions that you can implement is available here. (Be careful to note the operating system that supports the functions and use accordingly)

In the next post, we will see how to develop a RAS administration DLL using Visual Studio. See you soon!

Janani Vasudevan
Software Design Engineer/Test
RRAS, Windows Enterprise Networking

[This posting is provided "AS IS" with no warranties, and confers no rights.]