# aug/12/2014 11:50:23 by RouterOS 6.18
# software id = 18QF-P0PP
#
/interface bridge
add l2mtu=1600 name=BR-CAPS protocol-mode=none
/interface vlan
#Dunno if you really need these or not.. But Whatevs...
add interface=BR-CAPS name=default vlan-id=1208
add interface=BR-CAPS name=registration vlan-id=2000
add interface=BR-CAPS name=isolation vlan-id=2001
/caps-man datapath
add bridge=BR-CAPS client-to-client-forwarding=yes name=datapath1
/caps-man interface
# 
add arp=enabled configuration.mode=ap configuration.ssid=LOSERTEST datapath=datapath1 disabled=no l2mtu=1600 mac-address=MACOFAP master-interface=none mtu=1500 name=cap1 radio-mac=MACOFAP
/caps-man aaa
set interim-update=5m
/caps-man access-list
add action=query-radius radius-accounting=yes signal-range=-120..120 time=0s-1d,sun,mon,tue,wed,thu,fri,sat
/caps-man manager
set enabled=yes
/interface bridge port
add bridge=BR-CAPS interface=ether13
/ip address
add address=1.2.3.4/16 interface=ether12
/ip route
add distance=1 gateway=x.y.z
/radius
add address=pfip secret=yoursecret service=wireless src-address=1.2.3.4
/radius incoming
set accept=yes

--- Hostapd.pm	2014-06-26 15:03:13.000000000 -0400
+++ Mikrotik.pm	2014-08-12 11:46:13.305173223 -0400
@@ -1,17 +1,17 @@
-package pf::Switch::Hostapd;
+package pf::Switch::Mikrotik;
 
 
 =head1 NAME
 
-pf::Switch::hostapd
+pf::Switch::mikrotik
 
 =head1 SYNOPSIS
 
-The pf::Switch::hostapd module manages access to hostapd
+The pf::Switch::Mikrotik module manages access to mikrotik APs
 
 =head1 STATUS
 
-Should work on the hostapd version started 2.0
+Should work on CAPSMAN enabled APs, tested on v6.18
 
 =cut
 
@@ -25,7 +25,7 @@
 use base ('pf::Switch');
 
 use pf::config;
-sub description { 'Hostapd' }
+sub description { 'Mikrotik' }
 
 # importing switch constants
 use pf::Switch::constants;
@@ -192,7 +192,39 @@
     return;
 }
 
+sub returnRadiusAccessAccept {
+    my ($self, $vlan, $mac, $port, $connection_type, $user_name, $ssid, $wasInline, $user_role) = @_;
+    my $logger = Log::Log4perl::get_logger( ref($self) );
+
+    # Inline Vs. VLAN enforcement
+    my $radius_reply_ref = {};
+    my $role = "";
+    if ( (!$wasInline || ($wasInline && $vlan != 0) ) && isenabled($self->{_VlanMap})) {
+        $radius_reply_ref = {
+            'MIKROTIK_WIRELESS_VLANID' => $vlan,
+            'MIKROTIK_WIRELESS_VLANIDTYPE' => "0",
+        };
+    }
 
+    if ( isenabled($self->{_RoleMap}) && $self->supportsRoleBasedEnforcement()) {
+        $logger->debug("[$self->{'_id'}] Network device supports roles. Evaluating role to be returned");
+        if ( defined($user_role) && $user_role ne "" ) {
+            $role = $self->getRoleByName($user_role);
+        }
+	if ( defined($role) && $role ne "" ) {
+            $radius_reply_ref->{$self->returnRoleAttribute()} = $role;
+            $logger->info(
+                "[$self->{'_id'}] Added role $role to the returned RADIUS Access-Accept under attribute " . $self->returnRoleAttribute()
+            );
+	}
+	else {
+            $logger->debug("[$self->{'_id'}] Received undefined role. No Role added to RADIUS Access-Accept");
+        }
+    }
+
+    $logger->info("[$self->{'_id'}] Returning ACCEPT with VLAN $vlan and role $role");
+    return [$RADIUS::RLM_MODULE_OK, %$radius_reply_ref];
+}
 =back
 
 =head1 AUTHOR

ADIUS Request
Acct-Session-Id =  "
NAS-IP-Address = 192.168.70.81 "
Calling-Station-Id = D4-AE-52-B9-2B-FD",
RADIUS Reply
Code = Disconnect-NAK "
NAS-Identifier = cap_michalek "
Error-Cause = Unsupported-Extension