rlm_sql post-auth variable bug?
Hi, (Haven't had any reply on the users mailing list, so I'm giving it a try here, please excuse if this is OT). In my AAA chain I have a module that *sometimes* adds a custom attribute (defined in my dictionary as ipaddr) called Auth-NAS. This module is called in the authorize section. Later on, in the post-auth session I have a SQL-module that has: postauth_query = "INSERT INTO ${postauth_table} (...) \ VALUES (.... \ '%{check:Auth-NAS:-0.0.0.0}', ...)" When run, and Auth-NAS is not present, it outputs: rlm_sql (sql-xxx) in sql_postauth: query is INSERT INTO table (...) ??VALUES (..., '=01', ...); Sometimes the '=01' is replaced by '255.255.255.255'. Is this a bug in some place or am I doing something wrong? Any ideas? I'm using 1.0.4 (also seen on 1.0.2). Thanks in advance. Fernando.
Fernando Schapachnik <fernando@mecon.gov.ar> wrote:
When run, and Auth-NAS is not present, it outputs:
rlm_sql (sql-xxx) in sql_postauth: query is INSERT INTO table (...) ??VALUES (..., '=01', ...);
Sometimes the '=01' is replaced by '255.255.255.255'.
I think it's a bug in src/main/xlat.c, valuepair2str(). It tries to do something "special" when an attribute isn't found. The code is left over from before we hade the ":-" syntax in dynamic string expansion. This is fixed in the CVS head, and I'm not sure what to suggest for 1.0.x. I'll take a look, but I can't promise anything. Alan DeKok.
En un mensaje anterior, Alan DeKok escribió:
Fernando Schapachnik <fernando@mecon.gov.ar> wrote:
When run, and Auth-NAS is not present, it outputs:
rlm_sql (sql-xxx) in sql_postauth: query is INSERT INTO table (...) ??VALUES (..., '=01', ...);
Sometimes the '=01' is replaced by '255.255.255.255'.
I think it's a bug in src/main/xlat.c, valuepair2str(). It tries to do something "special" when an attribute isn't found. The code is left over from before we hade the ":-" syntax in dynamic string expansion.
This is fixed in the CVS head, and I'm not sure what to suggest for 1.0.x. I'll take a look, but I can't promise anything.
Thanks for the reply. I'm guessing that head!=1.0, right? Is there a release schedule for head -> production ready? Regards. Fernando.
En un mensaje anterior, Alan DeKok escribió:
Fernando Schapachnik <fernando@mecon.gov.ar> wrote:
Thanks for the reply. I'm guessing that head!=1.0, right? Is there a release schedule for head -> production ready?
No. 1.0.5 will be out soon, and the CVS head will probably end up being 2.0.
I see. Would it be easy for you to give me an idea of what needs to be done so I could kind of back port the changes? From what I saw at CVS, the function itself is unchanged. Regards. Fernando.
Fernando Schapachnik <fernando@mecon.gov.ar> wrote:
I see. Would it be easy for you to give me an idea of what needs to be done so I could kind of back port the changes? From what I saw at CVS, the function itself is unchanged.
I took a further look at it, and I don't see what's wrong. Alan DeKok.
En un mensaje anterior, Alan DeKok escribió:
Fernando Schapachnik <fernando@mecon.gov.ar> wrote:
I see. Would it be easy for you to give me an idea of what needs to be done so I could kind of back port the changes? From what I saw at CVS, the function itself is unchanged.
I took a further look at it, and I don't see what's wrong.
Any idea on how I can debug it?
En un mensaje anterior, Alan DeKok escribió:
Fernando Schapachnik <fernando@mecon.gov.ar> wrote:
Any idea on how I can debug it?
Source code mods, and watch what it's doing, and why.
Ok, I found more details. Recalling, I have: postauth_query = "INSERT INTO ${postauth_table} (...) \ VALUES (.... \ '%{check:Auth-NAS:-0.0.0.0}', ...)" which gets translates to garbage or 255.255.255.255 when the attribute wasn't present. Debugging, I found that ':-' was innocent: the attribute was there at the time of the translation, although it was not clear who generated it. Digging further, we instrumented valuepair2str() so after: da = dict_attrbyname(fmt); if (!da) return 0; we added: search = vps; while (search) { printf("name: %s attr: %d value: %s\n", search->name, search->attribute, search->strvalue); search = search->next; } A (now) relevant detail is that the query has other optional (and also non-present) attribute: '%{check:Auth-NAS:-0.0.0.0}', %{check:Used-Port:-0, ...)" So the debug output is: do_xlat for attr Auth-NAS: ... <my other check attributes here, OK> name: Auth-NAS attr: 3005 value: ... do_xlat for attr Used-Port: ... <my other check attributes here, OK> name: Auth-NAS attr: 3005 value: 255.255.255.255 ... Why this is, I don't know, but it is strange enough that the attribute appears first without value and then with some. Thanks. Fernando.
Never mind, the problem was in one of my modules. Sorry for bothering.
participants (2)
-
Alan DeKok -
Fernando Schapachnik