rlm_python clears reply if rejecting
Hello, Freeradius developers! There is one feature or bug in algorhytm in rlm_python module. If rlm_python receives RLM_MODULE_REJECT as python script return code it cleans all attributes from reply message. But, as far as I know, it is allowed to return some attributes to NAS in reject message. I would like to send h323-return-code in authorization reject message to explain to NAS why particular message was rejected. I found code in rlm_python.c which is responsible about this "feature" and removed it. You can find patch in attachment of this e-mail. It would be really kind from your side if you applied it in further releases. Regards, Valts Mazurs.
Valts Mazurs wrote:
There is one feature or bug in algorhytm in rlm_python module. If rlm_python receives RLM_MODULE_REJECT as python script return code it cleans all attributes from reply message.
This was already reported on the bugzilla under bug #279. http://bugs.freeradius.org/show_bug.cgi?id=279
But, as far as I know, it is allowed to return some attributes to NAS in reject message. I would like to send h323-return-code in authorization reject message to explain to NAS why particular message was rejected.
Even if the pairfree() is removed from the module, I think the server core will delete the attribute later. -- Nicolas Baradakis
Nicolas Baradakis wrote:
Valts Mazurs wrote:
There is one feature or bug in algorhytm in rlm_python module. If rlm_python receives RLM_MODULE_REJECT as python script return code it cleans all attributes from reply message.
This was already reported on the bugzilla under bug #279. http://bugs.freeradius.org/show_bug.cgi?id=279
But, as far as I know, it is allowed to return some attributes to NAS in reject message. I would like to send h323-return-code in authorization reject message to explain to NAS why particular message was rejected.
Even if the pairfree() is removed from the module, I think the server core will delete the attribute later.
Usually it does not :) If python script exits with other code than RLM_MODULE_REJECT (RLM_MODULE_INVALID, for example) then no attributes are removed. I use rlm_perl for a while and have not seen any attribute removed on RLM_MODULE_REJECT. The only case when reply message attributes are removed is when (any) module exits with RLM_MODULE_FAIL.
Valts Mazurs wrote:
Even if the pairfree() is removed from the module, I think the server core will delete the attribute later.
Usually it does not :)
However, I think it's the case in version 1.0.5.
I use rlm_perl for a while and have not seen any attribute removed on RLM_MODULE_REJECT.
RFC 2865, section 5.44, says vendor specific are not allowed in Access-Reject packets. -- Nicolas Baradakis
Nicolas Baradakis wrote:
Valts Mazurs wrote:
Even if the pairfree() is removed from the module, I think the server core will delete the attribute later.
Usually it does not :)
However, I think it's the case in version 1.0.5.
So, in further releases server core will remove all attributes in reject message (except reply-message and proxy-state according to RFC 2865)?
I use rlm_perl for a while and have not seen any attribute removed on RLM_MODULE_REJECT.
RFC 2865, section 5.44, says vendor specific are not allowed in Access-Reject packets.
I'm sure that there are more than one difference between RFC's and Freeradius RADIUS protocol implementation. Is there any serious reason to avoid returning vendor specific (and maybe other) attributes in reject message? I think that such vendor specific attribute as h323-return-code is very useful for explaining to NAS why message was rejected. Reply-message attribute may serve for diffrent needs when it is neccessary to display custom text message from radius server.
participants (2)
-
Nicolas Baradakis -
Valts Mazurs