Patch for rlm_attr_filters
Hello All, My VPN3005 NASes are sending several accounting attributes (Tunnel-Client-Endpoint with Client-IP-Address) causing problems for RADIUS-based billing software I'm using. This patch is created to allow rlm_filter to remove a specific list of attributes from accounting packets. Of course one can specify all the attributes required in usual way, but that's too unconvenient since there are too many of them in the accounting phase. :) Tested with FreeRADIUS-1.0.5 Example: In module section: (radius.conf) ... attr_filter acct { attrsfile = ${confdir}/acct passother = yes } ... ${confdir}/acct DEFAULT Tunnel-Client-Endpoint !* ANY -- cut here -- --- rlm_attr_filter.c.orig Tue Nov 1 13:44:07 2005 +++ rlm_attr_filter.c Tue Nov 1 13:56:40 2005 @@ -46,6 +46,7 @@ struct attr_filter_instance { /* autz */ char *attrsfile; + int passother; PAIR_LIST *attrs; }; @@ -177,6 +178,8 @@ static CONF_PARSER module_config[] = { { "attrsfile", PW_TYPE_STRING_PTR, offsetof(struct attr_filter_instance,attrsfile), NULL, "${raddbdir}/at trs" }, + { "passother", PW_TYPE_BOOLEAN, + offsetof(struct attr_filter_instance,passother), NULL, "no" }, { NULL, -1, 0, NULL, NULL } }; @@ -380,6 +383,13 @@ } } + /* only if not found and passother is true */ + if ( fail == 0 && pass == 0 && inst->passother ) { + if ( mypairappend(reply_item, &reply_tmp) < 0 ) { + return RLM_MODULE_FAIL; + } + } + } /* If we shouldn't fall through, break */ @@ -510,6 +520,12 @@ return RLM_MODULE_FAIL; } } + /* only if not found and passother is true */ + if ( fail == 0 && pass == 0 && inst->passother ) { + if ( mypairappend(send_item, &send_tmp) < 0 ) { + return RLM_MODULE_FAIL; + } + } } if (!fallthrough(pl->check)) break; @@ -629,6 +645,12 @@ return RLM_MODULE_FAIL; } } + /* only if not found and passother is true */ + if ( fail == 0 && pass == 0 && inst->passother ) { + if ( mypairappend(send_item, &send_tmp) < 0 ) { + return RLM_MODULE_FAIL; + } + } } if (!fallthrough(pl->check)) break; @@ -761,7 +783,12 @@ return RLM_MODULE_FAIL; } } - + /* only if not found and passother is true */ + if ( fail == 0 && pass == 0 && inst->passother ) { + if ( mypairappend( reply_item, &reply_tmp) < 0 ) { + return RLM_MODULE_FAIL; + } + } } /* If we shouldn't fall through, break */ -- Best regards, Nikolay P. Romanyuk, NR42-RIPE mailto:mag@vtelecom.ru
On Oct 31, 2005, at 10:53 PM, Nikolay P. Romanyuk wrote:
Hello All,
My VPN3005 NASes are sending several accounting attributes (Tunnel-Client-Endpoint with Client-IP-Address) causing problems for RADIUS-based billing software I'm using. This patch is created to allow rlm_filter to remove a specific list of attributes from accounting packets. Of course one can specify all the attributes required in usual way, but that's too unconvenient since there are too many of them in the accounting phase. :) Tested with FreeRADIUS-1.0.5
Example: In module section: (radius.conf) ... attr_filter acct { attrsfile = ${confdir}/acct passother = yes } ...
Makes sense to me. I've thought about doing the same, when I look at my attrs files that have 30 attributes listed, most of which are *= ANY values. I'd make one change, and that's make it more obvious what the config argument is doing: defaultaction = drop | allow With the default being drop so that it maintains backwards compatibility. -Chris -- Chris Parker Director, Engineering StarNet A Service of US LEC (888)212-0099 Fax (847)963-1302 Wholesale Internet Services http://www.megapop.net VoiceEclipse, The Fresh Alternative http://www.voiceeclipse.com NOTICE: Message is sent IN CONFIDENCE to addressees. It may contain information that is privileged, proprietary or confidential.
Chris Parker <cparker@starnetusa.net> wrote:
I'd make one change, and that's make it more obvious what the config argument is doing:
defaultaction = drop | allow
Please see also attr_filter in the CVS head. As part of my work in cleaning up the server internals, I'm removing a function used only by attr_filter & policy. As part of that work, I re-wrote much of attr_filter. It *should* do the same thing, but there's less duplicated code. Alan DeKok.
On Nov 1, 2005, at 12:15 PM, Alan DeKok wrote:
Chris Parker <cparker@starnetusa.net> wrote:
I'd make one change, and that's make it more obvious what the config argument is doing:
defaultaction = drop | allow
Please see also attr_filter in the CVS head. As part of my work in cleaning up the server internals, I'm removing a function used only by attr_filter & policy. As part of that work, I re-wrote much of attr_filter. It *should* do the same thing, but there's less duplicated code.
Yeah, I noted that. Have looked at it, and it makes sense. I'll run it through some tests here, as with all the craziness we do with attrs, I'm pretty sure any bugs would be poke their heads up pretty quickly. -Chris -- Chris Parker Director, Engineering StarNet A Service of US LEC (888)212-0099 Fax (847)963-1302 Wholesale Internet Services http://www.megapop.net VoiceEclipse, The Fresh Alternative http://www.voiceeclipse.com NOTICE: Message is sent IN CONFIDENCE to addressees. It may contain information that is privileged, proprietary or confidential.
Hi All! For your consideration. I wrote small module 'rlm_accept' for post-proxy section. If home RADIUS return Access-Reject this module change it to Access-Accept and add attributes from huntgroup/hint/users files. ftp://barby1.vtelecom.ru/pub/mag/FreeRADIUS/rlm_accept.tar.gz The code is actually a quick hack, so I will gladly accept any suggestions or improvements from anyone who cares. Example: My NAS has local pool 192.168.0.0/24. Every user has valid fixed IP address. If users have a negativ account balance, my home RADIUS return me Access-Reject, rlm_access change it to Access-Accept, add Framed-IP-Address == 255.255.255.254 (use local NAS pool) and Session-Time. Framed-Filter-Id... As a result user may connect to billing system and add money to his account. In addition, it is possible redirect all external www-requests for local pool via WCCP on border gateway to ISP billing www-page. -- Best regards, Nikolay P. Romanyuk, NR42-RIPE mailto:mag@vtelecom.ru
On November 2, 2005 2:10:22 PM +1000 "Nikolay P. Romanyuk" <mag@vtelecom.ru> wrote:
Hi All!
For your consideration. I wrote small module 'rlm_accept' for post-proxy section. If home RADIUS return Access-Reject this module change it to Access-Accept and add attributes from huntgroup/hint/users files.
Neat. But isn't that what rlm_attr_rewrite already does? Or do I misunderstand that module. (I've never used it.) -frank
participants (4)
-
Alan DeKok -
Chris Parker -
Frank Cusack -
Nikolay P. Romanyuk