June 2009 - Freeradius-Devel - lists.freeradius.org

Missing TLS Change Cipher Spec and TLS Finished in EAP-TLS exchanges
by arno＠natisbad.org 09 Jul '11

09 Jul '11

Hi, I upgraded an internal freeradius server (Linux, Debian unstable, libssl 0.9.8) used for EAP-TLS (802.11 WPA2 access) from 2.0.5 to 2.1.3. With 2.1.3, client authentication fails in the following way (wpasupplicant on Debian unstable, working with 2.0.5): - the TLS exchange is completed from freeradius point of view. It even sends the Access-Accept message to the NAS. - from the clients point of view, the TLS exchange is not over, it expects some more data from the server which are never sent. I took two pcap traces (sent to you privately, Alan), one with 2.0.5, one with 2.1.3. It looks like the TLS Change Cipher and TLS Tinished elements of the TLS exchange are not in the EAP encapsulated TLS packets sent by the server. Compare packet #23 of 2.1.3 trace with packet #27 of 2.0.5 trace. If you use wireshark, you will notice that the SSL layer is dissected; this is because #27 has a small brother: #29. It is not sent by 2.1.3. Alan, if you have an idea or a patch, I can test it on monday. Cheers, a+

5 15

eap2 in freeradius
by Chanthearith HUON 04 Apr '11

04 Apr '11

Hi everyone, I am testing eap2 in freeradius. I run "radiusd -X", I got following error message " radiusd: symbol lookup error: /usr/lib/rlm_eap2-2.1.0.so: undefined symbol: eap_server_register_methods " Anyone, have any idea what might be wrong with the configuration? Thank in advance, Thierry

5 10

make_passwd(), rlm_perl and double quotes in the password
by Niko Tyni 28 Jan '10

28 Jan '10

Hi, we're seeing failed logins when proxying authentication requests through to another RADIUS server if the password contains a double quote ("). I've debugged the issue a bit, and what happens is that when the password does a roundtrip through the rlm_perl module, the value pair structure ends up with extra bytes at the end so that strlen(vp->data.strvalue) > vp->length. These extra bytes are the result of escaping the double quote before entering the Perl code and then unescaping it afterwards. For instance, the password abcdef" is passed as abcdef\" to the Perl code, and afterwards it becomes abcdef"" with length 7 (so the extra byte is not supposed to hurt AIUI.) Unfortunately make_passwd() rounds 'inlen' up to a multiple of 16 before copying the input string, so the extra bytes end up in the message authenticator of the proxied request. It seems to me that the escaping and unescaping done in rlm_perl via perl_store_vps() -> vp_prints_value() -> librad_safeprint() and get_hv_content() -> pairadd_sv() -> pairmake() -> pairparsevalue() is a bit unnecessary, and that the unescaping could zero out the extra bytes, but the main bug is in make_passwd() IMO. I have reproduced this with a Debian 2.0.4 freeradius package, a Fedora 2.1.3 package, and a current git.freeradius.org checkout (commit ef2a7db5e). I'm attaching a proposed patch to make_passwd(). Please let me know if you need more information, I can easily produce stack traces and the like. Thanks for your work on FreeRADIUS, -- Niko Tyni ntyni(a)cc.helsinki.fi

3 5

Re: vmps request: long attribute VQP-Ethernet-Frame
by Hermann Lauer 05 Jan '10

05 Jan '10

Alan DeKok wrote: > > 0x0c05 is VQP-Ethernet-Frame, which can of course be longer than 253 bytes, > > so there is a design issue here. One idea would be to cut the attribute to > > 253 bytes in vqp_recv(). Could this be done there without memory issues ? > > Yes, if you're not interested in the rest of the data. appended is a patch which implemeted the cutting. Seems to work. Please tell me if anybody sees any pitfall in it. Otherwise it should be cleaned up, which I probably will do in a week or so. Thanks, Hermann -- Netzwerkadministration/Zentrale Dienste, Interdiziplinaeres Zentrum fuer wissenschaftliches Rechnen der Universitaet Heidelberg IWR; INF 368; 69120 Heidelberg; Tel: (06221)54-8236 Fax: -5224 Email: Hermann.Lauer(a)iwr.uni-heidelberg.de

2 5

FreeRadius + EAP-AKA support
by Kumar, Sunil 26 Nov '09

26 Nov '09

Hi, We are trying to use FreeRadius1.1.4 as authentication server for EAP-AKA implementation with our product toolkit. As per the RFC 4187 AT_RES The value field of this attribute begins with the 2-byte RES Length, which identifies the exact length of the RES in bits. The RES length is followed by the AKA RES parameter. According to [TS33.105], the length of the AKA RES can vary between 32 and 128 bits. Because the length of the AT_RES attribute must be a multiple of 4 bytes, the sender pads the RES with zero bits where necessary. In the freeradius1.1.4 implementation, for EAP-AKA the value of RES length is always considered as constant EAPSIM_RES_SIZE (16). It doesn't take care of the values other than 16 bytes. We in our toolkit needs to support all the variable length of RES values from 32 bits (4 bytes) to 128 bits (16 bytes). So I have modified the FreeRadius implementation for the same support. The intention of writing such mail is to get the information that if somebody has already noticed and fixed this issue in the latest releases, so please share that information as well. In case it's not been fixed as yet, then may be I could contribute my patch for freeradius 1.1.4 version to support all variable length RES value varying from 32 bits to 128 bits. Thanks. Warm regards. Sunil Kumar The information contained in this electronic mail transmission may be privileged and confidential, and therefore, protected from disclosure. If you have received this communication in error, please notify us immediately by replying to this message and deleting it from your computer without copying or disclosing it.

4 5

ChangeLog for 2.1.6 question: Make rlm_perl keep tags for tagged attributes in more situations
by Alexandr Kovalenko 18 Aug '09

18 Aug '09

Hello, I've read ChangeLog for FreeRADIUS 2.1.6 and found there: # Make rlm_perl keep tags for tagged attributes in more situations Could anyone please point me to exact commits/diffs so I can see if this will fix my issue with tagged attributes, which I experienced - tagged attributes ERX-Service-Activate, ERX-Service-Statistics and similar were sent back to NAS without tags. I had to switch to rlm_python because of this, which is workaround for me, as long as everything here works using perl, and only this module uses python. Thanks in advance. -- Alexandr Kovalenko http://uafug.org.ua/

2 3

GIT Log for 2009-06-30 23:33 GMT
by aland＠deployingradius.com 30 Jun '09

30 Jun '09

commit 2c21995a4d9c467a050ddb997b3df675f6590e8f Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Jun 30 16:57:42 2009 +0200 If the previous evaluation failed, don't process '!' This catches the case of ((expr1) && !(expr2)), where it would still process expr2 if expr1 failed. src/main/evaluate.c | 24 +++++++++++++++--------- 1 files changed, 15 insertions(+), 9 deletions(-)

1 0

libeap/eap_tls.c eaptls_process details
by Carolin Latze 29 Jun '09

29 Jun '09

Hi, I have a question about the following code fragment found in eaptls_process in rlm_eap/libeap/eap_tls.c: /* * Decrypt the complete record. */ BIO_write(tls_session->into_ssl, tls_session->dirty_in.data, tls_session->dirty_in.used); /* * Clear the dirty buffer now that we are done with it * and init the clean_out buffer to store decrypted data */ (tls_session->record_init)(&tls_session->dirty_in); (tls_session->record_init)(&tls_session->clean_out); /* * Read (and decrypt) the tunneled data from the * SSL session, and put it into the decrypted * data buffer. */ err = SSL_read(tls_session->ssl, tls_session->clean_out.data, sizeof(tls_session->clean_out.data)); I think, BIO_write sends data out to the peer and SSL_read receives data from the peer here, but the comments suggest something else (like piping the data through decryption within the server). Which version is correct? ;-) Thanks in advance Carolin

2 1

GIT Log for 2009-06-25 23:33 GMT
by aland＠deployingradius.com 25 Jun '09

25 Jun '09

commit e7604da5bb9a805842927ef3eb4f97568e7d4900 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Jun 25 20:57:00 2009 +0200 Remove bad assertion src/main/event.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-)

1 0

Multiple authendication from client using freeRadius server
by kpani 23 Jun '09

23 Jun '09

Hi, I am using freeRadius server and JRadius client for my java application user authentication. I have a scenario for multiple authentication by user. 1) User will provide username 2) Radius server will authenticate and response access-challenge 3) The user will be prompted to enter password. This will continue for few more steps. I was advised to develop a custom authentication protocol. I am not sure if this is the only way. Please suggest me an idea or reference to implement this. Regards, Dhandapani -- View this message in context: http://www.nabble.com/Multiple-authendication-from-client-using-freeRadius-… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

2 1

GIT Log for 2009-06-19 23:33 GMT
by aland＠deployingradius.com 19 Jun '09

19 Jun '09

commit 321c0ae58641f709d115526bb564cbd8c4dab71d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Jun 19 16:02:24 2009 +0200 Fix typos Files changed: src/modules/frs_dhcp/dhcp.c | 7 +------ 1 files changed, 1 insertions(+), 6 deletions(-) ====================================================================== commit 79ffcee03efc9e11294e2ac40af58e9be4886554 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Jun 19 11:57:44 2009 +0200 A number of fixes for the DHCP code. - send server identifier in siaddr field, too - find message-type option anywhere in the packet, not just at the start - respond to unicast packets that have yiaddr == giaddr == 0 Files changed: src/modules/frs_dhcp/dhcp.c | 150 +++++++++++++++++++++++++++++-------------- 1 files changed, 101 insertions(+), 49 deletions(-) ======================================================================

1 0

GIT Log for 2009-06-17 23:33 GMT
by aland＠deployingradius.com 17 Jun '09

17 Jun '09

commit 23948db29b02fce17c78deb5951d08988b95e116 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Jun 17 12:35:04 2009 +0200 Sort attributes, and print times as offsets Files changed: src/main/radsniff.c | 80 +++++++++++++++++++++++++++++++++++++++++++++++++-- 1 files changed, 77 insertions(+), 3 deletions(-) ====================================================================== commit 07c292fe351839471687c64ef6345f12e6394d72 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Jun 17 07:35:43 2009 +0200 Document Cleartext-Password Files changed: man/man5/users.5 | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) ====================================================================== commit 023a7839ec622afbe6dd584cc76c9b44fd0dde71 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Jun 17 07:34:18 2009 +0200 Allow for overload, to read packets as fast as possible Files changed: src/modules/frs_detail/frs_detail.c | 11 ++++++++++- 1 files changed, 10 insertions(+), 1 deletions(-) ======================================================================

1 0

GIT Log for 2009-06-16 23:33 GMT
by aland＠deployingradius.com 16 Jun '09

16 Jun '09

commit 86e6a1cba83015ccdf2c4236227e460a3f9e814f Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Jun 16 16:39:57 2009 +0200 Removed requirement for DHCP to have clients Files changed: raddb/sites-available/dhcp | 21 ------------ src/main/listen.c | 11 ++++-- src/modules/frs_dhcp/frs_dhcp.c | 69 +++++++++++++++++++++++++++++++++------ 3 files changed, 66 insertions(+), 35 deletions(-) ====================================================================== commit 53ef0b2ddcb3e888bca120f62560305524582028 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Jun 16 16:38:02 2009 +0200 Added udpfromto support for sending, too Files changed: src/modules/frs_dhcp/dhcp.c | 20 +++++++++++++------- 1 files changed, 13 insertions(+), 7 deletions(-) ====================================================================== commit 4932587583ff6c085a373c55b0bdf5dd028da655 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Jun 16 15:55:08 2009 +0200 Added the ability to selectively mark a module as alive/dead This is useful for when you KNOW that a server is down for a long time, but you don't want to edit your configuration. Files changed: src/include/modpriv.h | 1 + src/main/modcall.c | 8 +++++++ src/modules/frs_control/frs_control.c | 38 +++++++++++++++++++++++++++++++++ 3 files changed, 47 insertions(+), 0 deletions(-) ====================================================================== commit 240d07c2c9fb8d7d196e2dbb59f33dbea91ce713 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Jun 16 14:52:40 2009 +0200 Option to suppress packet contents Files changed: src/main/radsniff.c | 14 ++++++++++---- 1 files changed, 10 insertions(+), 4 deletions(-) ====================================================================== commit e30c2b8d5e17fb967ed888cefdd117dcd5926db7 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Jun 16 14:22:47 2009 +0200 Make radsniff more useful. It now prints out LESS information, like the RADIUS filters && secret. That information can be printed out using '-X' (should be -x) Fixed pointer type for IP, to catch alignment issues. use data + size, NOT ethernet + size Cleaned up output so it's easier to read, and includes timestamps. Added packet tree for filters. IF there's a filter, AND it matches a request packet, THEN also print out the reply packet for that request Files changed: src/main/radsniff.c | 179 +++++++++++++++++++++++++++++---------------------- 1 files changed, 103 insertions(+), 76 deletions(-) ======================================================================

1 0

GIT Log for 2009-06-15 23:33 GMT
by aland＠deployingradius.com 15 Jun '09

15 Jun '09

commit 0c0e44e33873f37f0c0b601485e3f83db8ca61ad Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Jun 15 16:50:12 2009 +0200 Updated to apply packet src/dst rules BEFORE printing header out Otherwise, debugging mode prints out the wrong information Files changed: src/modules/frs_dhcp/dhcp.c | 138 +++++++++++++++++++++++++------------------ 1 files changed, 80 insertions(+), 58 deletions(-) ====================================================================== commit 6559e2a631d1053929272528fa3a9ef18f8024f7 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Jun 15 16:39:39 2009 +0200 Make it work on Mac OS X Files changed: src/lib/udpfromto.c | 14 +++++++------- 1 files changed, 7 insertions(+), 7 deletions(-) ====================================================================== commit a90c429f280bbda33d940e8b3163e6d7e027245d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Jun 15 14:23:12 2009 +0200 Fix stupid typo Files changed: src/main/event.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit bc93366d39fcf6b673d84228b872bfa710fa58c2 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Jun 15 11:41:15 2009 +0200 Fixed typo Files changed: raddb/sites-available/default | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 0b624311e86459590a1d5c63ddc833a8557f4403 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Jun 15 10:48:51 2009 +0200 Document how to filter access-challenges Files changed: raddb/sites-available/default | 16 ++++++++++++++++ 1 files changed, 16 insertions(+), 0 deletions(-) ====================================================================== commit b7a19ae6f7b477a832d3bc8fa30647633d95324d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Jun 15 09:51:38 2009 +0200 Run packet through processing ONLY if we have a reply Files changed: src/main/event.c | 34 ++++++++++++++++++++++------------ 1 files changed, 22 insertions(+), 12 deletions(-) ======================================================================

1 0

GIT Log for 2009-06-14 23:33 GMT
by aland＠deployingradius.com 14 Jun '09

14 Jun '09

commit 981a4d5cac1a96ed0238c31e100722c4e35609fe Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Jun 14 08:25:52 2009 +0200 Hack the dhcp offset The dictionary files don't agree with the code, so we've got to fix the code src/modules/frs_dhcp/frs_dhcp.c | 5 ++++- 1 files changed, 4 insertions(+), 1 deletions(-)

1 0

Re: Hack way to compile freeradius causing freeradius to hang under multithread mode
by Ming-Ching Tiew 14 Jun '09

14 Jun '09

--- On Sun, 6/14/09, Ming-Ching Tiew <mctiew(a)yahoo.com> wrote: > radiusd: #### Opening IP addresses and Ports #### > listen { > type = "auth" > ipaddr = * > port = 0 > Thread 4 waiting to be assigned a request > Thread 5 waiting to be assigned a request > Re-wait 3 > Re-wait 1 > Re-wait 2 > > And nothing after that. netstat -naut still does not have > anything listening to 1812. > > Regards. > Apparently the program was stucked at function fr_suid_up(), inside which it calls setrersuid(-1, suid, -1 ) with suid = 0. The blocks there forever and never return. I think I will try to compile without HAVE_SETUID to see what happens. Regards.

1 0

Re: Hack way to compile freeradius causing freeradius to hang under multithread mode
by Ming-Ching Tiew 14 Jun '09

14 Jun '09

--- On Sun, 6/14/09, A.L.M.Buxey(a)lboro.ac.uk <A.L.M.Buxey(a)lboro.ac.uk> wrote: > > umm, have you checked the output of radiusd.log etc to > ensure you > dnt have a simple problem - such as access rights to a > directory, > path or log file? > This would be very likely. When I run it as 'radiusd -xx', the log file says :- Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 cleanup_delay = 5 max_queue_size = 65536 } Thread spawned new child 1. Total threads in pool: 1 Thread spawned new child 2. Total threads in pool: 2 Thread spawned new child 3. Total threads in pool: 3 Thread 1 waiting to be assigned a request Thread 2 waiting to be assigned a request Thread 3 waiting to be assigned a request Thread spawned new child 4. Total threads in pool: 4 Thread spawned new child 5. Total threads in pool: 5 Thread pool initialized radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 Thread 4 waiting to be assigned a request Thread 5 waiting to be assigned a request Re-wait 3 Re-wait 1 Re-wait 2 And nothing after that. netstat -naut still does not have anything listening to 1812. Regards.

1 0

Re: Hack way to compile freeradius causing freeradius to hang under multithread mode
by Ming-Ching Tiew 14 Jun '09

14 Jun '09

OK I will try to debug and see :- As the first cut, 'netstat -naut' shows that there is no listening on port 1812, whereas when it's working there is something listening on port 1812. 'radiusd' will daemonized, but it must be blocking at thread creation or something.

2 1

Hack way to compile freeradius causing freeradius to hang under multithread mode
by Ming-Ching Tiew 14 Jun '09

14 Jun '09

When I run ./configure .... under uclibc, it can succcessful produce a Makefile. But with that makefile, compilation will fail because the lack of THREAD_TLS under uclibc. Then I went on to modify ( by hand ) src/include/autoconf.h to comment HAVE_THREAD_TLS, then compilation could be completed. However, the produced binary will not work under multithread mode, it will only work under these modes :- radiusd -X radiusd -s radiusd -t It will not work if it's run as :- radiusd Well, this behaviour is repeatable under gnu lib environment too ( tested under debian environment), ie run ./configure, edit src/include/autoconf.h by hand to comment HAVE_THREAD_TLS. Any suggest what's next best thing to do ? Regards.

2 1

Re: Hack way to compile freeradius causing freeradius to hang under multithread mode
by Ming-Ching Tiew 14 Jun '09

14 Jun '09

> > However, the produced binary will not work under > multithread mode, it will only work under these modes :- > > radiusd -X > radiusd -s > radiusd -t > > It will not work if it's run as :- > > radiusd > > Well, this behaviour is repeatable under gnu lib > environment too ( tested > under debian environment), ie run ./configure, edit > src/include/autoconf.h by hand to comment HAVE_THREAD_TLS. > Sorry to confuse you, after I posted, I found that without commenting HAVE_THREAD_TLS, it hangs too under under gnu libraries. I guess the right question to ask is whether running 'radiusd' alone without any parameters is an intended mode. Regards

1 0

GIT Log for 2009-06-11 23:33 GMT
by aland＠deployingradius.com 11 Jun '09

11 Jun '09

commit ed4770be765bd88c1dabcac7cdcb7c5194347b23 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Jun 11 10:38:24 2009 +0200 More debugging messages Files changed: src/modules/frs_detail/frs_detail.c | 13 ++++++++----- 1 files changed, 8 insertions(+), 5 deletions(-) ====================================================================== commit b6340d5536ca77d1169f868dd0e66c393dde2be7 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Jun 11 10:37:51 2009 +0200 More debugging messages Files changed: src/main/event.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) ====================================================================== commit 8c078deef7eee1d6e6475e77acf3535c058b68da Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Jun 11 09:55:48 2009 +0200 Include chillispot dictionary Files changed: share/dictionary | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) ======================================================================

1 0

PEAP Certificate path
by Harsha gowda 10 Jun '09

10 Jun '09

Hi, I want to know where is the private key file stored for the public key which is used to decrypt Client Key exchange, the same publick key which is Sent in Server-Hello message its private patr is stored in which location. i search in {raddb}/cers/? but could not. Thanks

2 1

GIT Log for 2009-06-09 23:33 GMT
by aland＠deployingradius.com 09 Jun '09

09 Jun '09

commit 4a5b18a653c5a35786f8a9dcfab8b4ebc0671101 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Jun 9 09:46:29 2009 +0200 Filter Access-Challenge packets, too raddb/attrs.access_challenge | 19 +++++++++++++++++++ raddb/modules/attr_filter | 10 ++++++++++ 2 files changed, 29 insertions(+), 0 deletions(-)

1 0

Bad advices in the documantation of rlm_ldap
by Németh Tamás 09 Jun '09

09 Jun '09

Sorry for sending anothe bugreport, but I found the following in the documentation of rlm_ldap (/usr/share/doc/packages/freeradius-server- doc/rlm_ldap for me): NOTE: As LDAP is case insensitive, you should probably also set "lower_user = yes" and "lower_time = before" in main section of radiusd.conf, to get limits on simultaneous logins working correctly. Otherwise, users will be able get large number of sessions, capitalizing parts of their login names. However, these options (e.g. lower_user) don't seem to exist in freeradius 2.x.x. You should replace this section with a description of how to emulate this behaviour with unlang. Regards, Németh Tamás

1 0

conditional variable syntax doesn't work in LDAP xlat strings
by Németh Tamás 09 Jun '09

09 Jun '09

Dear developers, Sorry for posting a a bugreport here, but http://bugs.freeradius.org is not working for several days (or is it intentionally and utterly down?). I wanted to evaluate this expression (in /etc/raddb/sites-enabled/default in the authorize section): if ( "%{%{Stripped-User-Name}:-%{User-Name}}" == "%{ldap:ldap:///ou=People,ou=sopron,o=nyme,dc=hu?cn?sub?(&(cn=%{%{Stripped-User-Name}:-%{User-Name}})(radiusCallingStationId=*))}" && "%{ldap:ldap:///ou=People,ou=sopron,o=nyme,dc=hu?radiusCallingStationId?sub?(&(cn=%{%{Stripped-User-Name}:-%{User-Name}})(radiusCallingStationId=%{request:Calling-Station-Id}))}" != "%{request:Calling-Station-Id}" ) { but freeradius 2.1.6 behaved like this: +++? if ("%{%{Stripped-User-Name}:-%{User-Name}}" == "%{ldap:ldap:///ou=People,ou=sopron,o=nyme,dc=hu?cn?sub?(&(cn=%{%{Stripped-User-Name}:-%{User-Name}})(radiusCallingStationId=*))}" && "%{ldap:ldap:///ou=People,ou=sopron,o=nyme,dc=hu?radiusCallingStationId?sub?(&(cn=%{%{Stripped-User-Name}:-%{User-Name}})(radiusCallingStationId=%{request:Calling-Station-Id}))}" != "%{request:Calling-Station-Id}" ) expand: %{Stripped-User-Name} -> expand: %{User-Name} -> nice expand: %{%{Stripped-User-Name}:-%{User-Name}} -> nice rlm_ldap: - ldap_xlat No trailing :- after variable at %{Stripped-User-Name} expand: ldap:///ou=People,ou=sopron,o=nyme,dc=hu?cn?sub?(&(cn=%{%{Stripped-User-Name} -> ldap:///ou=People,ou=sopron,o=nyme,dc=hu?cn?sub?(&(cn= rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=People,ou=sopron,o=nyme,dc=hu, with filter (&(cn= rlm_ldap: ldap_search() failed: Bad search filter: (&(cn= rlm_ldap: Search returned error rlm_ldap: ldap_release_conn: Release Id: 0 expand: %{ldap:ldap:///ou=People,ou=sopron,o=nyme,dc=hu?cn?sub?(&(cn=%{%{Stripped-User-Name}:-%{User-Name}})(radiusCallingStationId=*))} -> nice)(radiusCallingStationId=*)) That is, it expanded "%{ldap:ldap:///ou=People,ou=sopron,o=nyme,dc=hu?cn?sub?(&(cn=%{%{Stripped-User-Name}:-%{User-Name}})(radiusCallingStationId=*))}" as a mere "ldap:///ou=People,ou=sopron,o=nyme,dc=hu?cn?sub? (&(cn=%{%{Stripped-User-Name}" concatenated with "%{User-Name}})(radiusCallingStationId=*))", and thus it evaluated it as "nice)(radiusCallingStationId=*))" instead of "nice". However, it works if I'm using "%u" (or eventually %{control:Tmp-String-0}) instead of "%{%{Stripped-User-Name}:-%{User-Name}}" : +++? if ("%u" == "%{ldap:ldap:///ou=People,ou=sopron,o=nyme,dc=hu?cn?sub?(&(cn=%u)(radiusCallingStationId=*))}" && "%{ldap:ldap:///ou=People,ou=sopron,o=nyme,dc=hu?radiusCallingStationId?sub?(&(cn=%u) (radiusCallingStationId=%{request:Calling-Station-Id}))}" != "%{request:Calling-Station-Id}" ) expand: %u -> nice rlm_ldap: - ldap_xlat expand: ldap:///ou=People,ou=sopron,o=nyme,dc=hu?cn?sub?(&(cn=%u)(radiusCallingStationId=*)) -> ldap:///ou=People,ou=sopron,o=nyme,dc=hu?cn?sub?(&(cn=nice)(radiusCallingStationId=*)) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=People,ou=sopron,o=nyme,dc=hu, with filter (&(cn=nice)(radiusCallingStationId=*)) rlm_ldap: Adding attribute cn, value: nice rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: - ldap_xlat end expand: %{ldap:ldap:///ou=People,ou=sopron,o=nyme,dc=hu?cn?sub?(&(cn=%u)(radiusCallingStationId=*))} -> nice

1 0