November 2017 - Freeradius-Users - lists.freeradius.org

SQL Logging wont expand filename
by Dean Smith 13 Nov '17

13 Nov '17

Using FreeRADIUS Version 3.0.15 from the packages at https://launchpad.net/~freeradius/+archive/ubuntu/stable-3.0 on Ubuntu 16.04 <https://launchpad.net/~freeradius/+archive/ubuntu/stable-3.0%20on%20Ubuntu% 2016.04> Using the SQL Module to create a log of SQL queries for access-accept/reject and accounting packets. However, the filename used is the un-expanded version (sql-log-%Y%m%d). The queries are logged as expected, and all the expansion of the content is fine. The expansion of the ${logdir} works - and the debug shows the date being expanded, however the file written is without the expansion Other modules (detail) are correctly writing to similar filenames in the same directory Config :- mods-enabled/sql-log :- sql sql_log { driver="rlm_sql_null" dialect="mysql" logfile = ${logdir}/sql-relay-%Y%m%d $INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries-relay.conf } mods-config/sql/main/mysql/queries-relay.conf post-auth { log_table = "radlog" query = "INSERT INTO ${log_table} set \ stamp=%l, \ nas='%{Client-IP-Address}/%{NAS-IP-Address}', \ port='%{NAS-Port}', \ type='%{reply:Packet-Type}', \ username='%{User-Name}', \ clid='%{Calling-Station-Id}', \ hg='%{Huntgroup-Name}', \ info='%{Connect-Info}', \ tun='%{reply:Tunnel-Server-Endpoint[0]}-%{reply:Tunnel-Server-Endpoint[1]}' \ " } sites-enabled/n3server.cfg postauth { sql_log Post-Auth-Type REJECT { sql_log } } Debug :- 0) sql_log: EXPAND .query (0) sql_log: --> .query (0) sql_log: Using query template 'query' rlm_sql (sql_log): Reserved connection (0) (0) sql_log: EXPAND %{User-Name} (0) sql_log: --> testsql (0) sql_log: SQL-User-Name set to 'testsql' (0) sql_log: EXPAND INSERT INTO radlog set stamp=%l, n as='%{Client-IP-Address}/%{NAS-IP-Address}', port='%{NAS-Port}', t ype='%{reply:Packet-Type}', username='%{User-Name}', c lid='%{Calling-Station-Id}', hg='%{Huntgroup-Name}', i nfo='%{Connect-Info}', tun='%{reply:Tunnel-Server-Endpoint[0]}-%{reply: Tunnel-Server-Endpoint[1]}' (0) sql_log: --> INSERT INTO radlog set stamp=1510527623, n as='10.1.1.30/10.1.1.30', port='0', type='Access-Acc ept', username='testsql', clid='', hg='', i nfo='', tun='-' (0) sql_log: EXPAND /space/radmin/log/sql-relay-%Y%m%d (0) sql_log: --> /space/radmin/log/sql-relay-20171112 (0) sql_log: Executing query: INSERT INTO radlog set stamp=1510527623 , nas='10.1.1.30/10.1.1.30', port='0', t ype='Access-Accept', username='testsql', clid='', h g='', info='', tun='-' (0) sql_log: SQL query returned: success (0) sql_log: 1 record(s) updated rlm_sql (sql_log): Released connection (0) (0) [sql_log] = ok FileListing :- -rw-rw---- 1 n3radius n3radius 43373 Nov 12 23:00 sql-relay-%Y%m%d -rw--w---- 1 n3radius n3radius 879393 Nov 12 23:00 detail-20171112 Any suggestions ?

2 3

Adding realm to username
by Dariusz Nowak 13 Nov '17

13 Nov '17

Hello, I'm looking for guidance how to configure following scenario: If user came from host XXX (client IP) without specifying realm/domain (so ex. bob instead of bob(a)mydomain.com) I need to add it to the request. I've found many example how to do that in otherway around - so if stripping domain from incoming request. Can somebody give me some guidance how I can achieve that? I've had a quick look on config/Proxy and correct me if I'm wrong but I believe this is what I need to use to configure it? It's just getting little bit blurry when I'm going to "What Happens" section and it mentioning hints. I'm using FreeRadius 3.0.4-6 on Centos7. Many thanks Dariusz

2 2

Re: key_expiration variable not defined anywhere (in trustrouter.c in rlm_realm)
by Alejandro Pérez Méndez 12 Nov '17

12 Nov '17

I messed up with git. This is the actual PR (https://github.com/FreeRADIUS/freeradius-server/pull/2114) El 09/11/17 a las 08:32, Alejandro Pérez Méndez escribió: > Hi Stefan, > > you are right. Sadly the first line of my original commit > (https://github.com/FreeRADIUS/freeradius-server/pull/2059/commits/c5cebd2e9…) > was lost. Nothing too serious. > The following PR should fix it > (https://github.com/FreeRADIUS/freeradius-server/pull/2113) > > Regards, > Alejandro > > > > El 09/11/17 a las 00:29, Stefan Paetow escribió: >> Hi Alan, >> >> During the build to make this all work with OpenSSL, I noticed that >> 'key_expiration' is used for the first time in line 422 of >> trustrouter.c in the rlm_realm module. According to Github this was a >> manual merge? Did something go missing (the declaration of >> key_expiration perhaps)? >> >> Build output snippet: >> >> -- begin -- >> >> CC src/modules/rlm_realm/trustrouter.c >> src/modules/rlm_realm/trustrouter.c: In function >> ‘srvr_blk_to_home_server’: >> src/modules/rlm_realm/trustrouter.c:422:36: error: ‘key_expiration’ >> undeclared (first use in this function); did you mean >> ‘get_realm_expiration’? >> tid_srvr_get_key_expiration(blk, &key_expiration); >> ^~~~~~~~~~~~~~ >> get_realm_expiration >> src/modules/rlm_realm/trustrouter.c:422:36: note: each undeclared >> identifier is reported only once for each function it appears in >> make: *** [scripts/boiler.mk:635: >> build/objs/src/modules/rlm_realm/trustrouter.lo] Error 1 >> >> -- end -- >> >> Could you have a look? I've copied Alex in, just in case. >> >> Thank you very much! >> >> With Regards >> >> Stefan Paetow >> Moonshot Industry & Research Liaison Coordinator >> >> t: +44 (0)1235 822 125 >> gpg: 0x3FCE5142 >> xmpp: stefanp(a)jabber.dev.ja.net >> skype: stefan.paetow.janet >> >> jisc.ac.uk >> >> Jisc is a registered charity (number 1149740) and a company limited >> by guarantee which is registered in England under Company No. >> 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One >> Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. >> >

2 3

Re: Proxy / reply translation
by Richard J Palmer 12 Nov '17

12 Nov '17

HI Alan In this case the data is from an upstream proxy (I am trying to edit one reply attribute from logins that are received from the proxy). This isn't data from a NAS. During the testing the upstream radius is another freeradius instance grabbing data from our SQL server. Moving forward it will be another radius server we don't control. However after reading a little more it seems the answer is to use if (&proxy-reply:Cisco-AVPair =~ /ip:route=([^ ]+) ([^ ]+)/) { Which now finds the data - and the rest of the example just works Thanks for the pointers Richard On Sunday 12/11/2017 at 1:07 pm, Alan DeKok wrote: > On Nov 12, 2017, at 6:16 AM, Richard J Palmer <richard(a)merula.net> > wrote: >> >> >> (1) if (&Cisco-AVPair =~ /ip:route=([^ ]+) ([^ ]+)/) { >> (1) ERROR: Failed retrieving values required to evaluate >> condition > > That's because the incoming packet doesn't contain Cisco-AVPair. > > Again... read the debug output. ALL of it. You'll see the server > isn't receiving a Cisco-AVPair attribute from the NAS. > >> >> I am reasonably certain there is a issue somewhere with if >> (&Cisco-AVPair =~ /ip:route=([^ ]+) ([^ ]+)/) > > Yes. You can only match a Cisco-AVPair against a regex... if the > packet contains Cisco-AVPiar. > >> >> Using an online Regex testing tool and using the above as a basis I >> can see that >> Cisco-AVPair = \"ip:route=([^ ]+) ([^ ]+)\" >> >> This retrieves the data I need - However that is not accepted by the >> freeradius config (understandably as it's not quote the same thing). > > Really? The format of the configuration files is documented. See > "man unlang". > > There should be *no* surprise that random text isn't accepted by > FreeRADIUS. > > Alan DeKok. > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

1 0

Re: Proxy / reply translation
by Richard J Palmer 12 Nov '17

12 Nov '17

HI Again I have now set this login to proxy via another freeradius server and I have moved the code to post_proxy. I am now seeing: (1) Starting proxy to home server 10.0.25.5 port 1645 (1) Proxying request to home server 10.0.25.5 port 1645 timeout 14.000000 (1) Sent Access-Request Id 9 from 0.0.0.0:53508 to 10.0.25.5:1645 length 104 (1) User-Name = "richard2(a)test.login" (1) User-Password = "12345" (1) NAS-IP-Address = 10.0.25.8 (1) NAS-Port = 1 (1) Message-Authenticator = 0x369545d0fafed5ff1a2b52ca10bfadd5 (1) Event-Timestamp = "Nov 12 2017 10:16:42 GMT" (1) Proxy-State = 0x3836 Waking up in 0.3 seconds. (1) Clearing existing &reply: attributes (1) Received Access-Accept Id 9 from 10.0.25.5:1645 to 10.0.25.8:53508 length 101 (1) Framed-IP-Address = 1.2.108.10 (1) Framed-IP-Netmask = 255.255.255.248 (1) Cisco-AVPair = "ip:route=1.2.108.8 255.255.255.248" (1) Filter-Id = "P" (1) Chargeable-User-Identity = "richard2" (1) Acct-Interim-Interval = 60 (1) Proxy-State = 0x3836 (1) # Executing section post-proxy from file /usr/local/etc/raddb/sites-enabled/default (1) post-proxy { (1) post_proxy_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d (1) post_proxy_log: --> /usr/local/var/log/radius/radacct/127.0.0.1/post-proxy-detail-20171112 (1) post_proxy_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/127.0.0.1/post-proxy-detail-20171112 (1) post_proxy_log: EXPAND %t (1) post_proxy_log: --> Sun Nov 12 10:16:42 2017 (1) [post_proxy_log] = ok (1) policy rewrite_routes { (1) if (&Cisco-AVPair =~ /ip:route=([^ ]+) ([^ ]+)/) { (1) ERROR: Failed retrieving values required to evaluate condition (1) } # policy rewrite_routes = ok (1) eap: No pre-existing handler found (1) [eap] = noop (1) } # post-proxy = ok (1) Found Auth-Type = Accept (1) Auth-Type = Accept, accepting the user post Proxy log shows: Sun Nov 12 10:16:42 2017 Packet-Type = Access-Accept Framed-IP-Address = 1.2.108.10 Framed-IP-Netmask = 255.255.255.248 Cisco-AVPair = "ip:route=1.2.108.8 255.255.255.248" Filter-Id = "P" Chargeable-User-Identity = "richard2" Acct-Interim-Interval = 60 Proxy-State = 0x3836 Timestamp = 1510481802 I am reasonably certain there is a issue somewhere with if (&Cisco-AVPair =~ /ip:route=([^ ]+) ([^ ]+)/) Using an online Regex testing tool and using the above as a basis I can see that Cisco-AVPair = \"ip:route=([^ ]+) ([^ ]+)\" This retrieves the data I need - However that is not accepted by the freeradius config (understandably as it's not quote the same thing). My initial thought is the issue could be the quotes - but I am clutching at straws here. I have looked at the documents - but with Regex not being my strong point I am not sure what I have missed on the FR config... Could I please have one last pointer here ? Thanks! Richard On Saturday 11/11/2017 at 8:42 pm, Alan Buxey wrote: > Not that remote server, just spin up another server that this one > talks to, > replying back with such results. > > Run in full debug mode, you should see contents of packets, since this > isn't in the post-proxy or post-auth (as you are putting things in > during > Auth stage and checking/changing them there - which isn't how the real > server would behave or be configured) the check you make will be > different > too > > alan > > On 11 Nov 2017 8:17 pm, "Richard J Palmer" <richard(a)merula.net> wrote: > >> >> Hi >> >> I can almost certainly test this with the remote radius server - I am >> just >> waiting for the remote server to be configured to allow me access - >> and in >> the mean time was trying to test my config locally. >> >> From the log >> >> if (&Cisco-AVPair =~ /ip:route=([^ ]+) ([^ ]+)/) { >> >> ERROR: Failed retrieving values required to evaluate condition >> >> I assume that &Cisco-AVPair is not available here and I should be >> using >> something else (or I could have totally the wrong reason). >> >> Ultimately the aim was to check if what had written worked before I >> had >> access to the upstream server. If it's easier just to wait I shall. >> >> Thanks in advance >> >> Richard >> >> >> >> >> On Saturday 11/11/2017 at 7:39 pm, Alan Buxey wrote: >> >>> >>> Best test would be to have a remote radius server sending back replies >>> like >>> you will have as using some local stuff added via SQL isn't going to >>> be >>> the >>> same , goes through different sections, >>> >>> alan >>> >>> On 11 Nov 2017 7:33 pm, "Richard J Palmer" <richard(a)merula.net> wrote: >>> >>> >>>> >>>> HI Alan >>>> >>>> I will be using it for Proxy. However I was trying to test / use this >>>> locally as well while debugging the server / code. >>>> >>>> Ideally it would be nice to allow both options to work but I am >>>> flexible >>>> if it's easier just to use this for requests that are proxied >>>> >>>> Thanks >>>> >>>> Richard >>>> >>>> >>>> >>>> >>>> On Saturday 11/11/2017 at 7:14 pm, Alan Buxey wrote: >>>> >>>> >>>>> >>>>> You say you need to modify a reply from their radius server - this >>>>> will >>>>> be >>>>> in the post-proxy section? >>>>> >>>>> Also if (&reply:Cisco-AVPair ... ? >>>>> >>>>> alan >>>>> >>>>> >>>>> On 11 Nov 2017 6:37 pm, "Richard J Palmer" <richard(a)merula.net> wrote: >>>>> >>>>> Hi >>>>> >>>>> Sorry for the delay. I am getting close with this I think... BUT >>>>> something >>>>> seems to be slightly wrong. >>>>> >>>>> Happy to post a full log as needed - BUT I hope the bit I need is >>>>> here: >>>>> >>>>> (2) sql1: Framed-Route = "" >>>>> (2) sql1: Framed-IP-Address = 1.2.3.1 >>>>> (2) sql1: Framed-IP-Netmask = 255.255.255.248 >>>>> (2) sql1: Cisco-AVPair += "ip:route=1.2.3.0 255.255.255.248" >>>>> (2) sql1: Filter-Id = "P" >>>>> (2) sql1: Chargeable-User-Identity = "richard2" >>>>> >>>>> <group SQL statements> >>>>> >>>>> (2) sql1: Group "Hotspot": Merging reply items >>>>> (2) sql1: Acct-Interim-Interval = 600 >>>>> >>>>> (2) [sql1] = ok >>>>> (2) } # redundant = ok >>>>> (2) policy rewrite_routes { >>>>> (2) if (&Cisco-AVPair =~ /ip:route=([^ ]+) ([^ ]+)/) { >>>>> (2) ERROR: Failed retrieving values required to evaluate >>>>> condition >>>>> (2) } # policy rewrite_routes = ok >>>>> >>>>> (2) Login OK: [richard2] (from client local port 1) >>>>> (2) Sent Access-Accept Id 69 from 127.0.0.1:1645 to 127.0.0.1:48919 >>>>> length 0 >>>>> (2) Framed-IP-Address = 1.2.3.1 >>>>> (2) Framed-IP-Netmask = 255.255.255.248 >>>>> (2) Cisco-AVPair = "ip:route=1.2.3.0 255.255.255.248" >>>>> (2) Filter-Id = "P" >>>>> (2) Chargeable-User-Identity = "richard2" >>>>> (2) Acct-Interim-Interval = 600 >>>>> (2) Finished request >>>>> >>>>> >>>>> In my authorise section I have placed: >>>>> >>>>> redundant { >>>>> sql1 >>>>> sql2 >>>>> handled >>>>> } >>>>> # -sql >>>>> rewrite_routes >>>>> >>>>> (The other sections are there - this is just to show where what I hope >>>>> is >>>>> relevant. The code itself is based on the code provided below >>>>> >>>>> rewrite_routes { >>>>> >>>>> if (&Cisco-AVPair =~ /ip:route=([^ ]+) ([^ ]+)/) { >>>>> switch "%{2}" { >>>>> case "255.255.255.255" { >>>>> update reply { >>>>> Framed-Route = >>>>> "%{1}/32" >>>>> } >>>>> } >>>>> case "255.255.255.254" { >>>>> update reply { >>>>> Framed-Route = >>>>> "%{1}/31" >>>>> } >>>>> } >>>>> >>>>> >>>>> and so on (it is in the policy.d folder) >>>>> >>>>> I am aware the key to this is the error >>>>> >>>>> (2) ERROR: Failed retrieving values required to evaluate >>>>> condition >>>>> >>>>> What I am unclear about is why this is failing / and what I have done >>>>> wrong >>>>> here to cause this. If you can give me one more pointer here I'd >>>>> appreciate >>>>> it >>>>> >>>>> More than happy to send any of the extra config or log as needed >>>>> >>>>> Thanks in advance >>>>> >>>>> Richard >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> On Thursday 09/11/2017 at 1:35 pm, Alan DeKok wrote: >>>>> >>>>> >>>>> >>>>>> >>>>>> On Nov 9, 2017, at 8:19 AM, Richard J Palmer <richard(a)merula.net> >>>>>> wrote: >>>>>> >>>>>> >>>>>> >>>>>>> >>>>>>> >>>>>>> This is where my skills are not great (regex) most other areas I can >>>>>>> work >>>>>>> with. Ultimately I am happy to pay someone to help write the little >>>>>>> bit >>>>>>> of >>>>>>> code that does this. I do need to cope with Netmasks from /32 to /24 >>>>>>> so a >>>>>>> few switch cases. >>>>>>> >>>>>>> >>>>>>> It shouldn't be difficult. >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>> >>>>>>> Alternatively if someone can provide a few pointers on that bit I can >>>>>>> probably build from there. >>>>>>> >>>>>>> >>>>>>> If you have: >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> Cisco-AVPair = "ip:route=1.2.3.1 >>>>>>>>> 255.255.255.240" >>>>>>>>> >>>>>>>>> >>>>>>>>> Step 1, split it into pieces: >>>>>>>> >>>>>>> >>>>>> if (&Cisco-AVPair =~ /ip:route=([^ ]+) ([^ ]+)/) { >>>>>> >>>>>> This matches the "ip:route" prefix. It >>>>>> then matches >>>>>> non-space >>>>>> data, >>>>>> then a space, and more non-space data. As per the FR documentation, >>>>>> the >>>>>> first match goes into %{1}, and the second into %{2}. >>>>>> >>>>>> As there are only a limited number of >>>>>> net masks, you >>>>>> can expand >>>>>> the net >>>>>> mask, and switch over it (inside of the "if" block from above) >>>>>> >>>>>> switch "%{2}" { >>>>>> case "255.255.255.255" { >>>>>> update reply { >>>>>> Framed-Route = "%{1}/32" >>>>>> } >>>>>> } >>>>>> >>>>>> case "255.255.255.254" { >>>>>> update reply { >>>>>> Framed-Route = "%{1}/31" >>>>>> } >>>>>> } >>>>>> >>>>>> case "255.255.255.252" { >>>>>> update reply { >>>>>> Framed-Route = "%{1}/30" >>>>>> } >>>>>> } >>>>>> >>>>>> ... etc... >>>>>> >>>>>> # and the "catch all" case, just mash it to /28 >>>>>> case { >>>>>> update reply { >>>>>> Framed-Route = "%{1}/28" >>>>>> } >>>>>> } >>>>>> } >>>>>> >>>>>> A little verbose, but it should work. >>>>>> >>>>>> Alan DeKok. >>>>>> >>>>>> >>>>>> - >>>>>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list >>>>>> /users.html >>>>>> >>>>>> >>>>>> - >>>>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list >>>>> /users.html >>>>> - >>>>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list >>>>> /users.html >>>>> >>>>> >>>> - >>>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list >>>> /users.html >>>> >>> - >>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list >>> /users.html >>> >> >> - >> List info/subscribe/unsubscribe? See http://www.freeradius.org/list >> /users.html > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

Re: Proxy / reply translation
by Richard J Palmer 11 Nov '17

11 Nov '17

Hi I can almost certainly test this with the remote radius server - I am just waiting for the remote server to be configured to allow me access - and in the mean time was trying to test my config locally. >From the log if (&Cisco-AVPair =~ /ip:route=([^ ]+) ([^ ]+)/) { ERROR: Failed retrieving values required to evaluate condition I assume that &Cisco-AVPair is not available here and I should be using something else (or I could have totally the wrong reason). Ultimately the aim was to check if what had written worked before I had access to the upstream server. If it's easier just to wait I shall. Thanks in advance Richard On Saturday 11/11/2017 at 7:39 pm, Alan Buxey wrote: > Best test would be to have a remote radius server sending back replies > like > you will have as using some local stuff added via SQL isn't going to > be the > same , goes through different sections, > > alan > > On 11 Nov 2017 7:33 pm, "Richard J Palmer" <richard(a)merula.net> wrote: > >> >> HI Alan >> >> I will be using it for Proxy. However I was trying to test / use this >> locally as well while debugging the server / code. >> >> Ideally it would be nice to allow both options to work but I am >> flexible >> if it's easier just to use this for requests that are proxied >> >> Thanks >> >> Richard >> >> >> >> >> On Saturday 11/11/2017 at 7:14 pm, Alan Buxey wrote: >> >>> >>> You say you need to modify a reply from their radius server - this >>> will be >>> in the post-proxy section? >>> >>> Also if (&reply:Cisco-AVPair ... ? >>> >>> alan >>> >>> >>> On 11 Nov 2017 6:37 pm, "Richard J Palmer" <richard(a)merula.net> wrote: >>> >>> Hi >>> >>> Sorry for the delay. I am getting close with this I think... BUT >>> something >>> seems to be slightly wrong. >>> >>> Happy to post a full log as needed - BUT I hope the bit I need is >>> here: >>> >>> (2) sql1: Framed-Route = "" >>> (2) sql1: Framed-IP-Address = 1.2.3.1 >>> (2) sql1: Framed-IP-Netmask = 255.255.255.248 >>> (2) sql1: Cisco-AVPair += "ip:route=1.2.3.0 255.255.255.248" >>> (2) sql1: Filter-Id = "P" >>> (2) sql1: Chargeable-User-Identity = "richard2" >>> >>> <group SQL statements> >>> >>> (2) sql1: Group "Hotspot": Merging reply items >>> (2) sql1: Acct-Interim-Interval = 600 >>> >>> (2) [sql1] = ok >>> (2) } # redundant = ok >>> (2) policy rewrite_routes { >>> (2) if (&Cisco-AVPair =~ /ip:route=([^ ]+) ([^ ]+)/) { >>> (2) ERROR: Failed retrieving values required to evaluate >>> condition >>> (2) } # policy rewrite_routes = ok >>> >>> (2) Login OK: [richard2] (from client local port 1) >>> (2) Sent Access-Accept Id 69 from 127.0.0.1:1645 to 127.0.0.1:48919 >>> length 0 >>> (2) Framed-IP-Address = 1.2.3.1 >>> (2) Framed-IP-Netmask = 255.255.255.248 >>> (2) Cisco-AVPair = "ip:route=1.2.3.0 255.255.255.248" >>> (2) Filter-Id = "P" >>> (2) Chargeable-User-Identity = "richard2" >>> (2) Acct-Interim-Interval = 600 >>> (2) Finished request >>> >>> >>> In my authorise section I have placed: >>> >>> redundant { >>> sql1 >>> sql2 >>> handled >>> } >>> # -sql >>> rewrite_routes >>> >>> (The other sections are there - this is just to show where what I hope >>> is >>> relevant. The code itself is based on the code provided below >>> >>> rewrite_routes { >>> >>> if (&Cisco-AVPair =~ /ip:route=([^ ]+) ([^ ]+)/) { >>> switch "%{2}" { >>> case "255.255.255.255" { >>> update reply { >>> Framed-Route = "%{1}/32" >>> } >>> } >>> case "255.255.255.254" { >>> update reply { >>> Framed-Route = "%{1}/31" >>> } >>> } >>> >>> >>> and so on (it is in the policy.d folder) >>> >>> I am aware the key to this is the error >>> >>> (2) ERROR: Failed retrieving values required to evaluate >>> condition >>> >>> What I am unclear about is why this is failing / and what I have done >>> wrong >>> here to cause this. If you can give me one more pointer here I'd >>> appreciate >>> it >>> >>> More than happy to send any of the extra config or log as needed >>> >>> Thanks in advance >>> >>> Richard >>> >>> >>> >>> >>> >>> On Thursday 09/11/2017 at 1:35 pm, Alan DeKok wrote: >>> >>> >>>> >>>> On Nov 9, 2017, at 8:19 AM, Richard J Palmer <richard(a)merula.net> >>>> wrote: >>>> >>>> >>>>> >>>>> >>>>> This is where my skills are not great (regex) most other areas I can >>>>> work >>>>> with. Ultimately I am happy to pay someone to help write the little >>>>> bit >>>>> of >>>>> code that does this. I do need to cope with Netmasks from /32 to /24 >>>>> so a >>>>> few switch cases. >>>>> >>>>> >>>> It shouldn't be difficult. >>>> >>>> >>>> >>>>> >>>>> Alternatively if someone can provide a few pointers on that bit I can >>>>> probably build from there. >>>>> >>>>> >>>> If you have: >>>> >>>> >>>> >>>>> >>>>> >>>>> >>>>>> >>>>>> >>>>>> >>>>>>> >>>>>>> Cisco-AVPair = "ip:route=1.2.3.1 >>>>>>> 255.255.255.240" >>>>>>> >>>>>>> >>>>>> Step 1, split it into pieces: >>>> >>>> if (&Cisco-AVPair =~ /ip:route=([^ ]+) ([^ ]+)/) { >>>> >>>> This matches the "ip:route" prefix. It then matches >>>> non-space >>>> data, >>>> then a space, and more non-space data. As per the FR documentation, >>>> the >>>> first match goes into %{1}, and the second into %{2}. >>>> >>>> As there are only a limited number of net masks, you >>>> can expand >>>> the net >>>> mask, and switch over it (inside of the "if" block from above) >>>> >>>> switch "%{2}" { >>>> case "255.255.255.255" { >>>> update reply { >>>> Framed-Route = "%{1}/32" >>>> } >>>> } >>>> >>>> case "255.255.255.254" { >>>> update reply { >>>> Framed-Route = "%{1}/31" >>>> } >>>> } >>>> >>>> case "255.255.255.252" { >>>> update reply { >>>> Framed-Route = "%{1}/30" >>>> } >>>> } >>>> >>>> ... etc... >>>> >>>> # and the "catch all" case, just mash it to /28 >>>> case { >>>> update reply { >>>> Framed-Route = "%{1}/28" >>>> } >>>> } >>>> } >>>> >>>> A little verbose, but it should work. >>>> >>>> Alan DeKok. >>>> >>>> >>>> - >>>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list >>>> /users.html >>>> >>>> >>> - >>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list >>> /users.html >>> - >>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list >>> /users.html >>> >> >> - >> List info/subscribe/unsubscribe? See http://www.freeradius.org/list >> /users.html > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

3 2

Re: Proxy / reply translation
by Richard J Palmer 11 Nov '17

11 Nov '17

HI Alan That makes a lot more sense - I have other servers here feeding from that SQL Database so I will proxy to them. Not sure why I didn't think of that option! Thanks again Richard On Saturday 11/11/2017 at 8:42 pm, Alan Buxey wrote: > Not that remote server, just spin up another server that this one > talks to, > replying back with such results. > > Run in full debug mode, you should see contents of packets, since this > isn't in the post-proxy or post-auth (as you are putting things in > during > Auth stage and checking/changing them there - which isn't how the real > server would behave or be configured) the check you make will be > different > too > > alan > > On 11 Nov 2017 8:17 pm, "Richard J Palmer" <richard(a)merula.net> wrote: > >> >> Hi >> >> I can almost certainly test this with the remote radius server - I am >> just >> waiting for the remote server to be configured to allow me access - >> and in >> the mean time was trying to test my config locally. >> >> From the log >> >> if (&Cisco-AVPair =~ /ip:route=([^ ]+) ([^ ]+)/) { >> >> ERROR: Failed retrieving values required to evaluate condition >> >> I assume that &Cisco-AVPair is not available here and I should be >> using >> something else (or I could have totally the wrong reason). >> >> Ultimately the aim was to check if what had written worked before I >> had >> access to the upstream server. If it's easier just to wait I shall. >> >> Thanks in advance >> >> Richard >> >> >> >> >> On Saturday 11/11/2017 at 7:39 pm, Alan Buxey wrote: >> >>> >>> Best test would be to have a remote radius server sending back replies >>> like >>> you will have as using some local stuff added via SQL isn't going to >>> be >>> the >>> same , goes through different sections, >>> >>> alan >>> >>> On 11 Nov 2017 7:33 pm, "Richard J Palmer" <richard(a)merula.net> wrote: >>> >>> >>>> >>>> HI Alan >>>> >>>> I will be using it for Proxy. However I was trying to test / use this >>>> locally as well while debugging the server / code. >>>> >>>> Ideally it would be nice to allow both options to work but I am >>>> flexible >>>> if it's easier just to use this for requests that are proxied >>>> >>>> Thanks >>>> >>>> Richard >>>> >>>> >>>> >>>> >>>> On Saturday 11/11/2017 at 7:14 pm, Alan Buxey wrote: >>>> >>>> >>>>> >>>>> You say you need to modify a reply from their radius server - this >>>>> will >>>>> be >>>>> in the post-proxy section? >>>>> >>>>> Also if (&reply:Cisco-AVPair ... ? >>>>> >>>>> alan >>>>> >>>>> >>>>> On 11 Nov 2017 6:37 pm, "Richard J Palmer" <richard(a)merula.net> wrote: >>>>> >>>>> Hi >>>>> >>>>> Sorry for the delay. I am getting close with this I think... BUT >>>>> something >>>>> seems to be slightly wrong. >>>>> >>>>> Happy to post a full log as needed - BUT I hope the bit I need is >>>>> here: >>>>> >>>>> (2) sql1: Framed-Route = "" >>>>> (2) sql1: Framed-IP-Address = 1.2.3.1 >>>>> (2) sql1: Framed-IP-Netmask = 255.255.255.248 >>>>> (2) sql1: Cisco-AVPair += "ip:route=1.2.3.0 255.255.255.248" >>>>> (2) sql1: Filter-Id = "P" >>>>> (2) sql1: Chargeable-User-Identity = "richard2" >>>>> >>>>> <group SQL statements> >>>>> >>>>> (2) sql1: Group "Hotspot": Merging reply items >>>>> (2) sql1: Acct-Interim-Interval = 600 >>>>> >>>>> (2) [sql1] = ok >>>>> (2) } # redundant = ok >>>>> (2) policy rewrite_routes { >>>>> (2) if (&Cisco-AVPair =~ /ip:route=([^ ]+) ([^ ]+)/) { >>>>> (2) ERROR: Failed retrieving values required to evaluate >>>>> condition >>>>> (2) } # policy rewrite_routes = ok >>>>> >>>>> (2) Login OK: [richard2] (from client local port 1) >>>>> (2) Sent Access-Accept Id 69 from 127.0.0.1:1645 to 127.0.0.1:48919 >>>>> length 0 >>>>> (2) Framed-IP-Address = 1.2.3.1 >>>>> (2) Framed-IP-Netmask = 255.255.255.248 >>>>> (2) Cisco-AVPair = "ip:route=1.2.3.0 255.255.255.248" >>>>> (2) Filter-Id = "P" >>>>> (2) Chargeable-User-Identity = "richard2" >>>>> (2) Acct-Interim-Interval = 600 >>>>> (2) Finished request >>>>> >>>>> >>>>> In my authorise section I have placed: >>>>> >>>>> redundant { >>>>> sql1 >>>>> sql2 >>>>> handled >>>>> } >>>>> # -sql >>>>> rewrite_routes >>>>> >>>>> (The other sections are there - this is just to show where what I hope >>>>> is >>>>> relevant. The code itself is based on the code provided below >>>>> >>>>> rewrite_routes { >>>>> >>>>> if (&Cisco-AVPair =~ /ip:route=([^ ]+) ([^ ]+)/) { >>>>> switch "%{2}" { >>>>> case "255.255.255.255" { >>>>> update reply { >>>>> Framed-Route = >>>>> "%{1}/32" >>>>> } >>>>> } >>>>> case "255.255.255.254" { >>>>> update reply { >>>>> Framed-Route = >>>>> "%{1}/31" >>>>> } >>>>> } >>>>> >>>>> >>>>> and so on (it is in the policy.d folder) >>>>> >>>>> I am aware the key to this is the error >>>>> >>>>> (2) ERROR: Failed retrieving values required to evaluate >>>>> condition >>>>> >>>>> What I am unclear about is why this is failing / and what I have done >>>>> wrong >>>>> here to cause this. If you can give me one more pointer here I'd >>>>> appreciate >>>>> it >>>>> >>>>> More than happy to send any of the extra config or log as needed >>>>> >>>>> Thanks in advance >>>>> >>>>> Richard >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> On Thursday 09/11/2017 at 1:35 pm, Alan DeKok wrote: >>>>> >>>>> >>>>> >>>>>> >>>>>> On Nov 9, 2017, at 8:19 AM, Richard J Palmer <richard(a)merula.net> >>>>>> wrote: >>>>>> >>>>>> >>>>>> >>>>>>> >>>>>>> >>>>>>> This is where my skills are not great (regex) most other areas I can >>>>>>> work >>>>>>> with. Ultimately I am happy to pay someone to help write the little >>>>>>> bit >>>>>>> of >>>>>>> code that does this. I do need to cope with Netmasks from /32 to /24 >>>>>>> so a >>>>>>> few switch cases. >>>>>>> >>>>>>> >>>>>>> It shouldn't be difficult. >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>> >>>>>>> Alternatively if someone can provide a few pointers on that bit I can >>>>>>> probably build from there. >>>>>>> >>>>>>> >>>>>>> If you have: >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> Cisco-AVPair = "ip:route=1.2.3.1 >>>>>>>>> 255.255.255.240" >>>>>>>>> >>>>>>>>> >>>>>>>>> Step 1, split it into pieces: >>>>>>>> >>>>>>> >>>>>> if (&Cisco-AVPair =~ /ip:route=([^ ]+) ([^ ]+)/) { >>>>>> >>>>>> This matches the "ip:route" prefix. It >>>>>> then matches >>>>>> non-space >>>>>> data, >>>>>> then a space, and more non-space data. As per the FR documentation, >>>>>> the >>>>>> first match goes into %{1}, and the second into %{2}. >>>>>> >>>>>> As there are only a limited number of >>>>>> net masks, you >>>>>> can expand >>>>>> the net >>>>>> mask, and switch over it (inside of the "if" block from above) >>>>>> >>>>>> switch "%{2}" { >>>>>> case "255.255.255.255" { >>>>>> update reply { >>>>>> Framed-Route = "%{1}/32" >>>>>> } >>>>>> } >>>>>> >>>>>> case "255.255.255.254" { >>>>>> update reply { >>>>>> Framed-Route = "%{1}/31" >>>>>> } >>>>>> } >>>>>> >>>>>> case "255.255.255.252" { >>>>>> update reply { >>>>>> Framed-Route = "%{1}/30" >>>>>> } >>>>>> } >>>>>> >>>>>> ... etc... >>>>>> >>>>>> # and the "catch all" case, just mash it to /28 >>>>>> case { >>>>>> update reply { >>>>>> Framed-Route = "%{1}/28" >>>>>> } >>>>>> } >>>>>> } >>>>>> >>>>>> A little verbose, but it should work. >>>>>> >>>>>> Alan DeKok. >>>>>> >>>>>> >>>>>> - >>>>>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list >>>>>> /users.html >>>>>> >>>>>> >>>>>> - >>>>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list >>>>> /users.html >>>>> - >>>>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list >>>>> /users.html >>>>> >>>>> >>>> - >>>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list >>>> /users.html >>>> >>> - >>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list >>> /users.html >>> >> >> - >> List info/subscribe/unsubscribe? See http://www.freeradius.org/list >> /users.html > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

1 0

Re: Proxy / reply translation
by Richard J Palmer 11 Nov '17

11 Nov '17

HI Alan I will be using it for Proxy. However I was trying to test / use this locally as well while debugging the server / code. Ideally it would be nice to allow both options to work but I am flexible if it's easier just to use this for requests that are proxied Thanks Richard On Saturday 11/11/2017 at 7:14 pm, Alan Buxey wrote: > You say you need to modify a reply from their radius server - this > will be > in the post-proxy section? > > Also if (&reply:Cisco-AVPair ... ? > > alan > > > On 11 Nov 2017 6:37 pm, "Richard J Palmer" <richard(a)merula.net> wrote: > > Hi > > Sorry for the delay. I am getting close with this I think... BUT > something > seems to be slightly wrong. > > Happy to post a full log as needed - BUT I hope the bit I need is > here: > > (2) sql1: Framed-Route = "" > (2) sql1: Framed-IP-Address = 1.2.3.1 > (2) sql1: Framed-IP-Netmask = 255.255.255.248 > (2) sql1: Cisco-AVPair += "ip:route=1.2.3.0 255.255.255.248" > (2) sql1: Filter-Id = "P" > (2) sql1: Chargeable-User-Identity = "richard2" > > <group SQL statements> > > (2) sql1: Group "Hotspot": Merging reply items > (2) sql1: Acct-Interim-Interval = 600 > > (2) [sql1] = ok > (2) } # redundant = ok > (2) policy rewrite_routes { > (2) if (&Cisco-AVPair =~ /ip:route=([^ ]+) ([^ ]+)/) { > (2) ERROR: Failed retrieving values required to evaluate > condition > (2) } # policy rewrite_routes = ok > > (2) Login OK: [richard2] (from client local port 1) > (2) Sent Access-Accept Id 69 from 127.0.0.1:1645 to 127.0.0.1:48919 > length 0 > (2) Framed-IP-Address = 1.2.3.1 > (2) Framed-IP-Netmask = 255.255.255.248 > (2) Cisco-AVPair = "ip:route=1.2.3.0 255.255.255.248" > (2) Filter-Id = "P" > (2) Chargeable-User-Identity = "richard2" > (2) Acct-Interim-Interval = 600 > (2) Finished request > > > In my authorise section I have placed: > > redundant { > sql1 > sql2 > handled > } > # -sql > rewrite_routes > > (The other sections are there - this is just to show where what I hope > is > relevant. The code itself is based on the code provided below > > rewrite_routes { > > if (&Cisco-AVPair =~ /ip:route=([^ ]+) ([^ ]+)/) { > switch "%{2}" { > case "255.255.255.255" { > update reply { > Framed-Route = "%{1}/32" > } > } > case "255.255.255.254" { > update reply { > Framed-Route = "%{1}/31" > } > } > > > and so on (it is in the policy.d folder) > > I am aware the key to this is the error > > (2) ERROR: Failed retrieving values required to evaluate > condition > > What I am unclear about is why this is failing / and what I have done > wrong > here to cause this. If you can give me one more pointer here I'd > appreciate > it > > More than happy to send any of the extra config or log as needed > > Thanks in advance > > Richard > > > > > > On Thursday 09/11/2017 at 1:35 pm, Alan DeKok wrote: > >> >> On Nov 9, 2017, at 8:19 AM, Richard J Palmer <richard(a)merula.net> >> wrote: >> >>> >>> >>> This is where my skills are not great (regex) most other areas I can >>> work >>> with. Ultimately I am happy to pay someone to help write the little >>> bit of >>> code that does this. I do need to cope with Netmasks from /32 to /24 >>> so a >>> few switch cases. >>> >> >> It shouldn't be difficult. >> >> >>> >>> Alternatively if someone can provide a few pointers on that bit I can >>> probably build from there. >>> >> >> If you have: >> >> >>> >>> >>>> >>>> >>>>> >>>>> Cisco-AVPair = "ip:route=1.2.3.1 255.255.255.240" >>>>> >>>> >> Step 1, split it into pieces: >> >> if (&Cisco-AVPair =~ /ip:route=([^ ]+) ([^ ]+)/) { >> >> This matches the "ip:route" prefix. It then matches non-space >> data, >> then a space, and more non-space data. As per the FR documentation, >> the >> first match goes into %{1}, and the second into %{2}. >> >> As there are only a limited number of net masks, you can expand >> the net >> mask, and switch over it (inside of the "if" block from above) >> >> switch "%{2}" { >> case "255.255.255.255" { >> update reply { >> Framed-Route = "%{1}/32" >> } >> } >> >> case "255.255.255.254" { >> update reply { >> Framed-Route = "%{1}/31" >> } >> } >> >> case "255.255.255.252" { >> update reply { >> Framed-Route = "%{1}/30" >> } >> } >> >> ... etc... >> >> # and the "catch all" case, just mash it to /28 >> case { >> update reply { >> Framed-Route = "%{1}/28" >> } >> } >> } >> >> A little verbose, but it should work. >> >> Alan DeKok. >> >> >> - >> List info/subscribe/unsubscribe? See http://www.freeradius.org/list >> /users.html >> > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list > /users.html > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

Re: Proxy / reply translation
by Richard J Palmer 11 Nov '17

11 Nov '17

Hi Sorry for the delay. I am getting close with this I think... BUT something seems to be slightly wrong. Happy to post a full log as needed - BUT I hope the bit I need is here: (2) sql1: Framed-Route = "" (2) sql1: Framed-IP-Address = 1.2.3.1 (2) sql1: Framed-IP-Netmask = 255.255.255.248 (2) sql1: Cisco-AVPair += "ip:route=1.2.3.0 255.255.255.248" (2) sql1: Filter-Id = "P" (2) sql1: Chargeable-User-Identity = "richard2" <group SQL statements> (2) sql1: Group "Hotspot": Merging reply items (2) sql1: Acct-Interim-Interval = 600 (2) [sql1] = ok (2) } # redundant = ok (2) policy rewrite_routes { (2) if (&Cisco-AVPair =~ /ip:route=([^ ]+) ([^ ]+)/) { (2) ERROR: Failed retrieving values required to evaluate condition (2) } # policy rewrite_routes = ok (2) Login OK: [richard2] (from client local port 1) (2) Sent Access-Accept Id 69 from 127.0.0.1:1645 to 127.0.0.1:48919 length 0 (2) Framed-IP-Address = 1.2.3.1 (2) Framed-IP-Netmask = 255.255.255.248 (2) Cisco-AVPair = "ip:route=1.2.3.0 255.255.255.248" (2) Filter-Id = "P" (2) Chargeable-User-Identity = "richard2" (2) Acct-Interim-Interval = 600 (2) Finished request In my authorise section I have placed: redundant { sql1 sql2 handled } # -sql rewrite_routes (The other sections are there - this is just to show where what I hope is relevant. The code itself is based on the code provided below rewrite_routes { if (&Cisco-AVPair =~ /ip:route=([^ ]+) ([^ ]+)/) { switch "%{2}" { case "255.255.255.255" { update reply { Framed-Route = "%{1}/32" } } case "255.255.255.254" { update reply { Framed-Route = "%{1}/31" } } and so on (it is in the policy.d folder) I am aware the key to this is the error (2) ERROR: Failed retrieving values required to evaluate condition What I am unclear about is why this is failing / and what I have done wrong here to cause this. If you can give me one more pointer here I'd appreciate it More than happy to send any of the extra config or log as needed Thanks in advance Richard On Thursday 09/11/2017 at 1:35 pm, Alan DeKok wrote: > On Nov 9, 2017, at 8:19 AM, Richard J Palmer <richard(a)merula.net> > wrote: >> >> This is where my skills are not great (regex) most other areas I can >> work with. Ultimately I am happy to pay someone to help write the >> little bit of code that does this. I do need to cope with Netmasks >> from /32 to /24 so a few switch cases. > > It shouldn't be difficult. > >> >> Alternatively if someone can provide a few pointers on that bit I can >> probably build from there. > > If you have: > >> >>> >>>> >>>> Cisco-AVPair = "ip:route=1.2.3.1 255.255.255.240" > > Step 1, split it into pieces: > > if (&Cisco-AVPair =~ /ip:route=([^ ]+) ([^ ]+)/) { > > This matches the "ip:route" prefix. It then matches non-space > data, then a space, and more non-space data. As per the FR > documentation, the first match goes into %{1}, and the second into > %{2}. > > As there are only a limited number of net masks, you can expand the > net mask, and switch over it (inside of the "if" block from above) > > switch "%{2}" { > case "255.255.255.255" { > update reply { > Framed-Route = "%{1}/32" > } > } > > case "255.255.255.254" { > update reply { > Framed-Route = "%{1}/31" > } > } > > case "255.255.255.252" { > update reply { > Framed-Route = "%{1}/30" > } > } > > ... etc... > > # and the "catch all" case, just mash it to /28 > case { > update reply { > Framed-Route = "%{1}/28" > } > } > } > > A little verbose, but it should work. > > Alan DeKok. > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

Radtest with "Sent too many packets" error messages
by Claudio Carvalho 11 Nov '17

11 Nov '17

Hello, I am testing the radtest application with 1000 users in CSV file using the parameters below, after 30 or 40 minutes of testing the radtest interrupts with the following message: “Received response ID 152, code 5, lengthradperf: Sent too many packets (13104 > 13103)” This is my radperf execution command: radperf -A600,3600 -s -4 -T test.rad -f test.csv x.x.x.x auth xxxx test.rad file: NAS-IP-Address = 192.168.1.1 NAS-Port = "" NAS-Port-Type = "Virtual" Called-Station-Id = "test.domain" test.csv file: 0001,”0001” 0002,”0002” . . 1000,”1000” Has anyone had this problem? Thanks, Claudio.

2 1