ERROR: Condition evaluation failed
(Sorry - lots of little things now I'm able to spend time looking at 3.x again) I'm seeing errors like: (10) ERROR: Condition evaluation failed because the value of an operand could not be determined: Unknown value 'Challenge' for attribute 'Post-Auth-Type' These are annoying for a couple of reasons. First they're popping up in the middle processing authorize, inside a policy item i.e. policy { foo.authorize { ... } foo.post-auth { ... } } server X { authorize { ... foo } post-auth { foo } } ...so as far as I'm concerned I'm not triggering them and shouldn't be seeing them. Second, they're apparently being copied to Module-Failure-Message. We've logged this for a while to look for errors, and now I'm having to throw away this irrelevant junk. Does this really constitute a Module-Failure-Message?
Phil Mayers wrote:
I'm seeing errors like:
(10) ERROR: Condition evaluation failed because the value of an operand could not be determined: Unknown value 'Challenge' for attribute 'Post-Auth-Type'
That's only in git "master" from what I can see. It shouldn't be an error, only a debug message.
Second, they're apparently being copied to Module-Failure-Message. We've logged this for a while to look for errors, and now I'm having to throw away this irrelevant junk. Does this really constitute a Module-Failure-Message?
No. They should just be debugging messages. Alan DeKok.
On 15 May 2014, at 17:10, Alan DeKok <aland@deployingradius.com> wrote:
Phil Mayers wrote:
I'm seeing errors like:
(10) ERROR: Condition evaluation failed because the value of an operand could not be determined: Unknown value 'Challenge' for attribute 'Post-Auth-Type'
That's only in git "master" from what I can see. It shouldn't be an error, only a debug message.
Second, they're apparently being copied to Module-Failure-Message. We've logged this for a while to look for errors, and now I'm having to throw away this irrelevant junk. Does this really constitute a Module-Failure-Message?
What's evaluating Post-Auth-Type == Challenge? Whatever it is remove it... If it's a policy the server ships with we'll remove it...
No. They should just be debugging messages.
Anything that calls REDEBUG creates a Module-Failure-Message now. It's a sensible design choice given how patchely applied the previous code to log Module-Failure-Message was. Now you're guaranteed to have a complete history of the various failures for those requests which get rejected. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
On 15/05/14 17:17, Arran Cudbard-Bell wrote:
What's evaluating Post-Auth-Type == Challenge? Whatever it is remove it...
Nothing. That's the point I'm making. I've got a bunch of policy {} blocks with .authorize and .post-auth "methods" and mid-way through evaluating one of them - with no reference to Post-Auth-Type in sight - that error message gets logged.
Now you're guaranteed to have a complete history of the various failures for those requests which get rejected.
I don't agree that these are useful errors to have in Module-Failure-Message, given they're apparently completely spurious ;o)
On 15 May 2014, at 17:27, Phil Mayers <p.mayers@IMPERIAL.AC.UK> wrote:
On 15/05/14 17:17, Arran Cudbard-Bell wrote:
What's evaluating Post-Auth-Type == Challenge? Whatever it is remove it...
Nothing. That's the point I'm making. I've got a bunch of policy {} blocks with .authorize and .post-auth "methods" and mid-way through evaluating one of them - with no reference to Post-Auth-Type in sight - that error message gets logged.
Bizarre.
Now you're guaranteed to have a complete history of the various failures for those requests which get rejected.
I don't agree that these are useful errors to have in Module-Failure-Message, given they're apparently completely spurious ;o)
Well yes, but they probably shouldn't be occurring in the first place. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
On 15/05/14 17:39, Arran Cudbard-Bell wrote:
On 15 May 2014, at 17:27, Phil Mayers <p.mayers@IMPERIAL.AC.UK> wrote:
On 15/05/14 17:17, Arran Cudbard-Bell wrote:
What's evaluating Post-Auth-Type == Challenge? Whatever it is remove it...
Nothing. That's the point I'm making. I've got a bunch of policy {} blocks with .authorize and .post-auth "methods" and mid-way through evaluating one of them - with no reference to Post-Auth-Type in sight - that error message gets logged.
Bizarre.
The actual error message is: (1) elsif (Cisco-AVPair =~ /^audit-session-id=(.+)$/) (1) ERROR: Condition evaluation failed because the value of an operand could not be determined: Unknown value 'Challenge' for attribute 'Post-Auth-Type' (1) elsif (State =~ /^0x(.{8}).{6}(.{18})$/) (1) elsif (State =~ /^0x(.{8}).{6}(.{18})$/) -> FALSE Which variable is the ERROR: referring to? Cisco-AVPair or State? The former is absent, the latter present.
On 15/05/14 18:05, Alan DeKok wrote:
Phil Mayers wrote:
The actual error message is:
... wrong.
The radius_evaluate_cond() function is returning -1, but isn't calling fr_strerror_printf(). So the error string is whatever happens to be left in the error buffer.
Ah. So presumably it should be complaining about Cisco-AVPair not being present, but is complaining about something from earlier (maybe previous packet)? (I've already updated the config to have: if (Attr && Attr =~ //) ...so I'll stop seeing the "not present" complaint too :o)
On 15/05/14 17:10, Alan DeKok wrote:
Phil Mayers wrote:
I'm seeing errors like:
(10) ERROR: Condition evaluation failed because the value of an operand could not be determined: Unknown value 'Challenge' for attribute 'Post-Auth-Type'
That's only in git "master" from what I can see. It shouldn't be an error, only a debug message.
Drat sorry I keep forgetting the difference between 3.x and master.
Second, they're apparently being copied to Module-Failure-Message. We've logged this for a while to look for errors, and now I'm having to throw away this irrelevant junk. Does this really constitute a Module-Failure-Message?
No. They should just be debugging messages.
I think they're using REDEBUG macro?
participants (3)
-
Alan DeKok -
Arran Cudbard-Bell -
Phil Mayers