July 2019 - Freeradius-Users - lists.freeradius.org

Please tell me about rewrite_called_station_id.
by Yuya Yanagi 19 Jul '19

19 Jul '19

Hi,All Please tell me about rewrite_called_station_id. The description of rewrite_called_station_id was written to the authorize section of sites-available / default and sites-available / inner-tunnel to obtain a Called-Station-SSID to control the approval process. However, although the default file side could obtain the value of Called-Station-SSID, the process of rewrite_called_station_id became FALSE in the internal tunnel file, and the value of Called-Station-SSID could not be obtained. Since I am using EAP-TTLS authentication, I want to set the inner tunnel to branch control, but I can not use it. If you have any advice, please let me know. y.y ------------Debug log--------- Fri Jul 19 15:52:16 2019 : Debug: (0) Using Post-Auth-Type Challenge Fri Jul 19 15:52:16 2019 : Debug: (0) # Executing group from file /etc/raddb/sites-enabled/default Fri Jul 19 15:52:16 2019 : Debug: (0) Challenge { ... } # empty sub-section is ignored Fri Jul 19 15:52:16 2019 : Debug: (0) session-state: Nothing to cache Fri Jul 19 15:52:16 2019 : Debug: (0) Sent Access-Challenge Id 68 from 133.15.18.14:1812 to 133.15.250.241:60211 length 0 Fri Jul 19 15:52:16 2019 : Debug: (0) EAP-Message = 0x010200061520 Fri Jul 19 15:52:16 2019 : Debug: (0) Message-Authenticator = 0x00000000000000000000000000000000 Fri Jul 19 15:52:16 2019 : Debug: (0) State = 0x68f31ff968f10ae77b5c26c718e1463c Fri Jul 19 15:52:16 2019 : Debug: (0) Finished request Fri Jul 19 15:52:16 2019 : Debug: Waking up in 4.9 seconds. Fri Jul 19 15:52:16 2019 : Debug: (1) Received Access-Request Id 70 from 133.15.250.241:60211 to 133.15.18.14:1812 length 279 Fri Jul 19 15:52:16 2019 : Debug: (1) User-Name = "anonymous" Fri Jul 19 15:52:16 2019 : Debug: (1) NAS-IP-Address = 10.254.0.241 Fri Jul 19 15:52:16 2019 : Debug: (1) NAS-Port = 12289 Fri Jul 19 15:52:16 2019 : Debug: (1) Called-Station-Id = "08-35-71-F2-CE-05:authtest" Fri Jul 19 15:52:16 2019 : Debug: (1) Calling-Station-Id = "50-3E-AA-6D-ED-7E" Fri Jul 19 15:52:16 2019 : Debug: (1) Framed-MTU = 1250 Fri Jul 19 15:52:16 2019 : Debug: (1) NAS-Port-Type = Wireless-802.11 Fri Jul 19 15:52:16 2019 : Debug: (1) Framed-Compression = None Fri Jul 19 15:52:16 2019 : Debug: (1) Connect-Info = "CONNECT 802.11g" Fri Jul 19 15:52:16 2019 : Debug: (1) Chargeable-User-Identity = 0x00 Fri Jul 19 15:52:16 2019 : Debug: (1) EAP-Message = 0x0202007115800000006716030100620100005e03015d31689fbadf8aadd98de6c61bd2a31c53b8b1185935160dd336d01fa44c5e86000018c014c0130035002fc00ac00900380032000a0013000500040100001d000a0006000400170018000b000201000023000000170000ff01000100 Fri Jul 19 15:52:16 2019 : Debug: (1) State = 0x68f31ff968f10ae77b5c26c718e1463c Fri Jul 19 15:52:16 2019 : Debug: (1) Message-Authenticator = 0x9047a006c6a06a8e05c854228e8a472e Fri Jul 19 15:52:16 2019 : Debug: (1) session-state: No cached attributes Fri Jul 19 15:52:16 2019 : Debug: (1) # Executing section authorize from file /etc/raddb/sites-enabled/default Fri Jul 19 15:52:16 2019 : Debug: (1) authorize { Fri Jul 19 15:52:16 2019 : Debug: (1) policy rewrite_called_station_id { Fri Jul 19 15:52:16 2019 : Debug: (1) if (&Called-Station-Id && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/i)) { Fri Jul 19 15:52:16 2019 : Debug: No matches Fri Jul 19 15:52:16 2019 : Debug: Adding 9 matches Fri Jul 19 15:52:16 2019 : Debug: (1) if (&Called-Station-Id && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/i)) -> TRUE Fri Jul 19 15:52:16 2019 : Debug: (1) if (&Called-Station-Id && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/i)) { Fri Jul 19 15:52:16 2019 : Debug: (1) update request { Fri Jul 19 15:52:16 2019 : Debug: (1) 1/9 Found: 08 (3) Fri Jul 19 15:52:16 2019 : Debug: (1) 2/9 Found: 35 (3) Fri Jul 19 15:52:16 2019 : Debug: (1) 3/9 Found: 71 (3) Fri Jul 19 15:52:16 2019 : Debug: (1) 4/9 Found: F2 (3) Fri Jul 19 15:52:16 2019 : Debug: (1) 5/9 Found: CE (3) Fri Jul 19 15:52:16 2019 : Debug: (1) 6/9 Found: 05 (3) Fri Jul 19 15:52:16 2019 : Debug: (1) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} Fri Jul 19 15:52:16 2019 : Debug: (1) --> 08-35-71-F2-CE-05 Fri Jul 19 15:52:16 2019 : Debug: (1) &Called-Station-Id := 08-35-71-F2-CE-05 Fri Jul 19 15:52:16 2019 : Debug: (1) Overwriting value "08-35-71-F2-CE-05:authtest" with "08-35-71-F2-CE-05" Fri Jul 19 15:52:16 2019 : Debug: (1) } # update request = noop Fri Jul 19 15:52:16 2019 : Debug: (1) if ("%{8}") { Fri Jul 19 15:52:16 2019 : Debug: (1) EXPAND TMPL XLAT STRUCT Fri Jul 19 15:52:16 2019 : Debug: (1) 8/9 Found: authtest (9) Fri Jul 19 15:52:16 2019 : Debug: (1) EXPAND %{8} Fri Jul 19 15:52:16 2019 : Debug: (1) --> authtest Fri Jul 19 15:52:16 2019 : Debug: (1) if ("%{8}") -> TRUE Fri Jul 19 15:52:16 2019 : Debug: (1) if ("%{8}") { Fri Jul 19 15:52:16 2019 : Debug: (1) update request { Fri Jul 19 15:52:16 2019 : Debug: (1) 8/9 Found: authtest (9) Fri Jul 19 15:52:16 2019 : Debug: (1) EXPAND %{8} Fri Jul 19 15:52:16 2019 : Debug: (1) --> authtest Fri Jul 19 15:52:16 2019 : Debug: (1) &Called-Station-SSID := authtest Fri Jul 19 15:52:16 2019 : Debug: (1) } # update request = noop Fri Jul 19 15:52:16 2019 : Debug: (1) } # if ("%{8}") = noop Fri Jul 19 15:52:16 2019 : Debug: (1) modsingle[authorize]: calling updated (rlm_always) Fri Jul 19 15:52:16 2019 : Debug: (1) modsingle[authorize]: returned from updated (rlm_always) Fri Jul 19 15:52:16 2019 : Debug: (1) [updated] = updated Fri Jul 19 15:52:16 2019 : Debug: (1) } # if (&Called-Station-Id && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/i)) = updated Fri Jul 19 15:52:16 2019 : Debug: (1) ... skipping else: Preceding "if" was taken Fri Jul 19 15:52:16 2019 : Debug: (1) } # policy rewrite_called_station_id = updated ...... Fri Jul 19 15:52:16 2019 : Debug: (5) session-state: No State attribute Fri Jul 19 15:52:16 2019 : Debug: (5) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel Fri Jul 19 15:52:16 2019 : Debug: (5) authorize { Fri Jul 19 15:52:16 2019 : Debug: (5) policy rewrite_called_station_id { Fri Jul 19 15:52:16 2019 : Debug: (5) if (&Called-Station-Id && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/i)) { Fri Jul 19 15:52:16 2019 : Debug: (5) if (&Called-Station-Id && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/i)) -> FALSE Fri Jul 19 15:52:16 2019 : Debug: (5) else { Fri Jul 19 15:52:16 2019 : Debug: (5) modsingle[authorize]: calling noop (rlm_always) Fri Jul 19 15:52:16 2019 : Debug: (5) modsingle[authorize]: returned from noop (rlm_always) Fri Jul 19 15:52:16 2019 : Debug: (5) [noop] = noop Fri Jul 19 15:52:16 2019 : Debug: (5) } # else = noop Fri Jul 19 15:52:16 2019 : Debug: (5) } # policy rewrite_called_station_id = noop Fri Jul 19 15:52:16 2019 : Debug: (5) modsingle[authorize]: calling mschap (rlm_mschap) Fri Jul 19 15:52:16 2019 : Debug: (5) modsingle[authorize]: returned from mschap (rlm_mschap) Fri Jul 19 15:52:16 2019 : Debug: (5) [mschap] = noop Fri Jul 19 15:52:16 2019 : Debug: (5) modsingle[authorize]: calling suffix (rlm_realm) Fri Jul 19 15:52:16 2019 : Debug: (5) suffix: Checking for suffix after "@" Fri Jul 19 15:52:16 2019 : Debug: (5) suffix: No '@' in User-Name = "rt015", looking up realm NULL Fri Jul 19 15:52:16 2019 : Debug: (5) suffix: Found realm "NULL" Fri Jul 19 15:52:16 2019 : Debug: (5) suffix: Adding Stripped-User-Name = "rt015" Fri Jul 19 15:52:16 2019 : Debug: (5) suffix: Adding Realm = "NULL" Fri Jul 19 15:52:16 2019 : Debug: (5) suffix: Authentication realm is LOCAL Fri Jul 19 15:52:16 2019 : Debug: (5) modsingle[authorize]: returned from suffix (rlm_realm) Fri Jul 19 15:52:16 2019 : Debug: (5) [suffix] = ok Fri Jul 19 15:52:16 2019 : Debug: (5) update control { Fri Jul 19 15:52:16 2019 : Debug: (5) &Proxy-To-Realm := LOCAL Fri Jul 19 15:52:16 2019 : Debug: (5) } # update control = noop Fri Jul 19 15:52:16 2019 : Debug: (5) modsingle[authorize]: calling eap (rlm_eap) Fri Jul 19 15:52:16 2019 : Debug: (5) eap: No EAP-Message, not doing EAP Fri Jul 19 15:52:16 2019 : Debug: (5) modsingle[authorize]: returned from eap (rlm_eap) Fri Jul 19 15:52:16 2019 : Debug: (5) [eap] = noop

2 1

FreeRadius replaces characters in '%{User-Password}' after upgrade 3.0.16->3.0.19
by belyj＠belyj.eu 18 Jul '19

18 Jul '19

Hello. After upgrade from 3.0.16 to 3.0.19 freeradius is replacing characters in mysql queries. (76475085) Tue Jul 16 16:16:06 2019: Debug: Received Access-Request Id 54 from length 126 (76475085) Tue Jul 16 16:16:06 2019: Debug: NAS-Identifier = "XXXX" (76475085) Tue Jul 16 16:16:06 2019: Debug: User-Password = "p6suf+FyNBebQgLMTdAXD4q0U/yZVIaxSN/w8LzVMlw=" query ... xxx.value = '%{User-Password}' AND ... (76475085) Tue Jul 16 16:16:06 2019: Debug: sql3: Executing select query: SELECT ... xxx.value = 'p6suf=2BFyNBebQgLMTdAXD4q0U/yZVIaxSN/w8LzVMlw=3D' AND ... \+ is replaced and =3D added at the end. `p6suf+FyNBebQgLMTdAXD4q0U/yZVIaxSN/w8LzVMlw=` `p6suf=2BFyNBebQgLMTdAXD4q0U/yZVIaxSN/w8LzVMlw=3D` radiusd: FreeRADIUS Version 3.0.19 (git #1156b5361), for host x86_64-pc-linux-gnu FreeRADIUS Version 3.0.19 On 3.0.16 same config, same query, password is not changed. Any help would be appreciated. Andrzej

5 9

linelog
by Bassem Mettichi 18 Jul '19

18 Jul '19

Hello, please could you tell me how to use linelog module to log accounting requets instead of detail module? i have enabled the module linelog on default file section accounting and disabled detail module but after sending packets i didn't see any log : accounting { # Update accounting packet by adding the CUI attribute # recorded from the corresponding Access-Accept # use it only if your NAS boxes do not support CUI themselves # cui # # Create a 'detail'ed log of the packets. # Note that accounting requests which are proxied # are also logged in the detail file. # detail # daily linelog Thanks Bassem

1 0

Error while trying to just accept user in inner tunnel
by Alberto Martínez Setién 18 Jul '19

18 Jul '19

Hi all, While doing EAP-TTLS-PAP I am trying to have an unknown user get accepted anyway in order to get him into a captive portal. Relevant config is: if (&User-Name && &User-Password) { > update control { > Tmp-String-0 := "%{sql_oracle_dscorp:SELECT > swi_wi.pkg_wifi.f_get_username_code('%{User-Name}') FROM DUAL}" > } > > if (&control:Tmp-String-0 != '') { > update control { > Password-With-Header := > &control:Tmp-String-0 > } > } > else { > update reply { > Filter-Id := 'rol-invitado-logon' > } > > accept > } > } > Unfortunately, I can't apparently accept the user in the authorize section. (7) Virtual server sending reply > (7) Filter-Id := "rol-invitado-logon" > (7) eap_ttls: Tunneled authentication will be proxied to LOCAL > (7) eap: WARNING: Tunneled session will be proxied. Not doing EAP > (7) [eap] = handled > (7) } # authenticate = handled > (7) WARNING: Cancelling proxy as no home pool exists > (7) There was no response configured: rejecting request > (7) Using Post-Auth-Type Reject > What I might be missing? Regards, Alberto

3 3

Confused about ssl caching
by Sven Hartge 18 Jul '19

18 Jul '19

Hello all! I am using freeradius 3.0.17 (waiting on .19 is on the testbed right now) and I am a bit confused about the ssl cache. I am authentication users in WiFi against LDAP (as a database, i.e. the correct way) and also assigning VLANs based on the UserClass, all working fine: if ( "%{toupper:%{control:GIFB-UserClass[*]}}" =~ /(M|P|A|R)/ ) { update reply { &Tunnel-Type = "VLAN" &Tunnel-Medium-Type = "IEEE-802" &Tunnel-Private-Group-id = "701" &Aruba-User-Vlan = 701 } updated } else { update reply { &Tunnel-Type = "VLAN" &Tunnel-Medium-Type = "IEEE-802" &Tunnel-Private-Group-id = "700" &Aruba-User-Vlan = 700 } updated } GIFB-UserClass is a local attribute pulled from LDAP. This works fine, no problems here. Now: in tls-common it says: # The "Cached-Session-Policy" is the name of a # policy which should be applied to the cached # session. This policy can be used to assign # VLANs, IP addresses, etc. It serves as a useful # way to re-apply the policy from the original # Access-Accept to the subsequent Access-Accept # for the cached session. Here is where my confusion starts and searching the web and the list archive only increased it. Do *I* need to do anything here to get the correct VLAN to the user on session resumption or is it just *magic* and will work automagically? Or do I need to add the Xeap.authenticate and Xeap.authorize policies somewhere? I'd like to understand the mechanism before playing with it. Grüße, Sven.

3 6

RE: Proxy issue - Failing proxied request for user error
by James Wood 17 Jul '19

17 Jul '19

There is no firewall on the box itself (all UDP to 1812/1813 open publicly) and the strange thing is that the majority of packets are handled fine by FreeRADIUS (the ones that reach the daemon). So, it appears although tcdump and radsniff shows the packet arriving, it never gets to FreeRADIUS for some reason. radsniff log (filtered for `norsp`) norsp,7798,2019-07-16 23:08:43.462979,,Accounting-Request,ens4,1.2.3.4,41060,10.11.12.13,1813,125,"2a19172c7fc7" norsp,7799,2019-07-16 23:08:43.463001,,Accounting-Request,ens4,1.2.3.4,36239,10.11.12.13,1813,13,"63b8136755ec" norsp,7800,2019-07-16 23:08:43.463112,,Accounting-Request,ens4,1.2.3.4,38841,10.11.12.13,1813,125,"033c1a03cbdd" norsp,7801,2019-07-16 23:08:43.463159,,Accounting-Request,ens4,1.2.3.4,38841,10.11.12.13,1813,241,"b9790286e557" norsp,7802,2019-07-16 23:08:43.463331,,Accounting-Request,ens4,1.2.3.4,39990,10.11.12.13,1813,66,"710250b69ee0" norsp,7803,2019-07-16 23:08:43.463454,,Accounting-Request,ens4,1.2.3.4,39990,10.11.12.13,1813,208,"b940c9c76e96" norsp,7804,2019-07-16 23:08:43.463632,,Accounting-Request,ens4,1.2.3.4,38841,10.11.12.13,1813,187,"5ca284fb563e" norsp,9042,2019-07-16 23:08:45.972261,,Accounting-Request,ens4,1.2.3.4,39990,10.11.12.13,1813,218,"2f5a67f71993" norsp,9043,2019-07-16 23:08:45.972353,,Accounting-Request,ens4,1.2.3.4,39990,10.11.12.13,1813,13,"5e26718c4442" norsp,9044,2019-07-16 23:08:45.972406,,Accounting-Request,ens4,1.2.3.4,39990,10.11.12.13,1813,15,"273bcbb553c8" norsp,9045,2019-07-16 23:08:45.972514,,Accounting-Request,ens4,1.2.3.4,36239,10.11.12.13,1813,113,"b84e7246b3e3" norsp,12595,2019-07-16 23:08:49.990914,,Accounting-Request,ens4,1.2.3.4,38841,10.11.12.13,1813,51,"51683f17d039" So they DO reach the server, but DONT get processed for some reason. Server is a Google Cloud compute VM instance utilising an Intel Xeon E5 v4 (Broadwell) @ 2.8GHz with 16GB RAM Thanks J

2 1

Proxy issue - Failing proxied request for user error
by James Wood 17 Jul '19

17 Jul '19

Dear Group, We have a proxy-based setup but need advice on dropped proxy requests. We were running on 3.0.12 and upgraded to 3.0.19 but not change in behaviour. It's a simple one to one proxy, so packets come in to an external RADIUS server (public IP) and traffic is proxied to an internal one. We are seeing random errors for accounting packets but I can't figure out why. I ran a tcpdump on both sides and can see the traffic is being sent from the master and received on the internal server. But, the internal server must not be handling it nicely it as the master server says: Fri Jul 12 07:38:01 2019 : ERROR: (259008189) ERROR: Failing proxied request for user "689c3148b5a04d73a931534f0dd46f35", due to lack of any response from home server 10.0.0.1 port 1813 Fri Jul 12 07:38:01 2019 : ERROR: (259008191) ERROR: Failing proxied request for user "f1680ea08fff4773b415a4a4a34b9365", due to lack of any response from home server 10.0.0.1 port 1813 Fri Jul 12 07:38:01 2019 : ERROR: (259008193) ERROR: Failing proxied request for user "3b710ab2b4b0497baadd543582b7afc6", due to lack of any response from home server 10.0.0.1 port 1813 Fri Jul 12 07:38:01 2019 : ERROR: (259008194) ERROR: Failing proxied request for user "0f2eec41a0b7488a88d6dc131913538d", due to lack of any response from home server 10.0.0.1 port 1813 Fri Jul 12 07:38:01 2019 : ERROR: (259008195) ERROR: Failing proxied request for user "0c02bd6c5fb2426ea981fa62c51099eb", due to lack of any response from home server 10.0.0.1 port 1813 Fri Jul 12 07:38:01 2019 : ERROR: (259008196) ERROR: Failing proxied request for user "6d6749a71aaf49ec97c472f85af18158", due to lack of any response from home server 10.0.0.1 port 1813 Fri Jul 12 07:38:01 2019 : ERROR: (259008197) ERROR: Failing proxied request for user "39fd72831dbd4236abc055f01bea0d5b", due to lack of any response from home server 10.0.0.1 port 1813 Fri Jul 12 07:38:01 2019 : ERROR: (259008198) ERROR: Failing proxied request for user "1c4c86da12054a099af44d4f0780b666", due to lack of any response from home server 10.0.0.1 port 1813 Notes: 1) The server handles around 50-100 auths/acct packets per second, so nothing major. The majority of requests are proxied without error and the failed ones are not from the same NAS client, spread out across many. 2) This only happens on accounting packets, never auths 3) It happens on Start, Stop and Interim packets 4) It seems to happen in chunks, i.e. i'll get a big block of 30 or so of these errors appear in the lock Any help on how to debug would be much appreciated. Thanks J

4 6

Problem with python module
by Denis Shipilov 16 Jul '19

16 Jul '19

Hello! Is there someone who can help me? Radiusd starting failed, google can not help me. FreeRADIUS Version 3.0.13 Centos 7.6.1810 radiusd -X output: ... Debugger not attached radiusd: #### Instantiating modules #### modules { # Loaded module rlm_python # Loading module "python" from file /etc/raddb/radiusd.conf python { <internal>[73]: Reference "${.module}" not found /etc/raddb/radiusd.conf[73]: Failed expanding variable mod_instantiate /etc/raddb/radiusd.conf[73]: Invalid configuration for module "python" radiusd.conf: ... modules { python { python_path = /usr/lib64/python2.7 mod_authorize = radius func_authorize = authorize mod_accounting = radius func_accounting = accounting mod_preacct = radius func_preacct = preacct mod_postauth = radius func_postauth = postauth } ... python file: /usr/lib64/python2.7/radius.py I can not understand what happened. Same conf works on other servers. I can not find difference. Any suggestions? Sorry if something wrong - I am not native speaker and first time with mailing lists.

2 2

rlm_cache filtering
by liran kessel 15 Jul '19

15 Jul '19

I have activated rlm_cache so as to reduce the amount of times the freeradius will query the DB. I made the Calling-Station-Id the cache key and have added this code to the accounting section: cache if (ok){ sql } else { if ("%{sql:select case when exists(select * from [TABLE_NAME] where ne_id='%{Calling-Station-Id}') then 1 else 0 end}" == 1){ sql } } However what happens is that all Calling-Station-Ids are stored to the cache and so the 2nd time I get a packet they execute the sql module. How can I configure filtering of the cache in the “else” section so as to decide which Calling-Station-Id to save in cache and which not? Thanks Liran

3 3

rlm_cache filtering
by liran kessel 15 Jul '19

15 Jul '19

I have activated rlm_cache so as to reduce the amount of times the freeradius will query the DB. I made the Calling-Station-Id the cache key and have added this code to the accounting section: cache if (ok){ sql } else { if ("%{sql:select case when exists(select * from [TABLE_NAME] where ne_id='%{Calling-Station-Id}') then 1 else 0 end}" == 1){ sql } } However what happens is that all Calling-Station-Ids are stored to the cache and so the 2nd time I get a packet they execute the sql module. How can I configure filtering of the cache in the “else” section so as to decide which Calling-Station-Id to save in cache and which not? Thanks Liran

1 0