From tfagart@brozs.net Wed Apr  8 01:50:05 2009
From: Thomas Fagart <tfagart@brozs.net>
To: freeradius-users@lists.freeradius.org
Subject: EAP/TTLS : Issue while trying to proxy inner request and to use post
	proxy filter
Date: Wed, 08 Apr 2009 01:49:54 +0200
Message-ID: <49DBE6A2.60407@brozs.net>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============8013489874205858779=="

--===============8013489874205858779==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit

Hello,

Sorry to post again for the same subject, but I guess I haven't been 
very clear in my last question to the list, so I'm trying to ask it 
differently.

I've done some drawing that illustrate the settings I've tried and also 
provide the whole log, that could be seen here

http://www.brozs.net/wimax/wimax-freeradius.png

In Setup 1 (one radius with local authentication) everything is fine

http://www.brozs.net/wimax/wimax.log

In setup 2 (inner request proxy to ISP radius that will answer with 
Wimax Attribute)

-> In that case Wholesale Radius will discard Wimax attributes contains 
in the access accept from the ISP radius during the proxification, so 
that the access accept does not have all the wanted access acccept.
I'm trying to understand why.

http://www.brozs.net/wimax/wimax-proxy1.log

In setup 3 (which is the solution I would like to use, ie inner request 
proxy to ISP radius, and Wimax attributes are being added after 
receiving the access accept from ISP Radius)
-> In that case Wholesale Radius will add some of the wanted attribute 
but not all the one that are in  attrs
I'm also trying to know why.

http://www.brozs.net/wimax/wimax-proxy2.log

Regards

Thomas


   



--===============8013489874205858779==
Content-Type: text/html
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="attachment.html"
MIME-Version: 1.0

PCFET0NUWVBFIGh0bWwgUFVCTElDICItLy9XM0MvL0RURCBIVE1MIDQuMDEgVHJhbnNpdGlvbmFs
Ly9FTiI+CjxodG1sPgo8aGVhZD4KICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7Y2hhcnNldD1J
U08tODg1OS0xIiBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiPgo8L2hlYWQ+Cjxib2R5IGJnY29s
b3I9IiNmZmZmZmYiIHRleHQ9IiMwMDAwMDAiPgpIZWxsbyw8YnI+Cjxicj4KU29ycnkgdG8gcG9z
dCBhZ2FpbiBmb3IgdGhlIHNhbWUgc3ViamVjdCwgYnV0IEkgZ3Vlc3MgSSBoYXZlbid0IGJlZW4K
dmVyeSBjbGVhciBpbiBteSBsYXN0IHF1ZXN0aW9uIHRvIHRoZSBsaXN0LCBzbyBJJ20gdHJ5aW5n
IHRvIGFzayBpdApkaWZmZXJlbnRseS48YnI+Cjxicj4KSSd2ZSBkb25lIHNvbWUgZHJhd2luZyB0
aGF0IGlsbHVzdHJhdGUgdGhlIHNldHRpbmdzIEkndmUgdHJpZWQgYW5kIGFsc28KcHJvdmlkZSB0
aGUgd2hvbGUgbG9nLCB0aGF0IGNvdWxkIGJlIHNlZW4gaGVyZTxicj4KPGJyPgo8YSBjbGFzcz0i
bW96LXR4dC1saW5rLWZyZWV0ZXh0IiBocmVmPSJodHRwOi8vd3d3LmJyb3pzLm5ldC93aW1heC93
aW1heC1mcmVlcmFkaXVzLnBuZyI+aHR0cDovL3d3dy5icm96cy5uZXQvd2ltYXgvd2ltYXgtZnJl
ZXJhZGl1cy5wbmc8L2E+PGJyPgo8YnI+CkluIFNldHVwIDEgKG9uZSByYWRpdXMgd2l0aCBsb2Nh
bCBhdXRoZW50aWNhdGlvbikgZXZlcnl0aGluZyBpcyBmaW5lPGJyPgo8YnI+CjxhIGNsYXNzPSJt
b3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9Imh0dHA6Ly93d3cuYnJvenMubmV0L3dpbWF4L3dp
bWF4LmxvZyI+aHR0cDovL3d3dy5icm96cy5uZXQvd2ltYXgvd2ltYXgubG9nPC9hPjxicj4KPGJy
PgpJbiBzZXR1cCAyIChpbm5lciByZXF1ZXN0IHByb3h5IHRvIElTUCByYWRpdXMgdGhhdCB3aWxs
IGFuc3dlciB3aXRoCldpbWF4IEF0dHJpYnV0ZSk8YnI+Cjxicj4KLSZndDsgSW4gdGhhdCBjYXNl
IFdob2xlc2FsZSBSYWRpdXMgd2lsbCBkaXNjYXJkIFdpbWF4IGF0dHJpYnV0ZXMKY29udGFpbnMg
aW4gdGhlIGFjY2VzcyBhY2NlcHQgZnJvbSB0aGUgSVNQIHJhZGl1cyBkdXJpbmcgdGhlCnByb3hp
ZmljYXRpb24sIHNvIHRoYXQgdGhlIGFjY2VzcyBhY2NlcHQgZG9lcyBub3QgaGF2ZSBhbGwgdGhl
IHdhbnRlZAphY2Nlc3MgYWNjY2VwdC48YnI+CkknbSB0cnlpbmcgdG8gdW5kZXJzdGFuZCB3aHku
PGJyPgo8YnI+CjxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9Imh0dHA6Ly93
d3cuYnJvenMubmV0L3dpbWF4L3dpbWF4LXByb3h5MS5sb2ciPmh0dHA6Ly93d3cuYnJvenMubmV0
L3dpbWF4L3dpbWF4LXByb3h5MS5sb2c8L2E+PGJyPgo8YnI+CkluIHNldHVwIDMgKHdoaWNoIGlz
IHRoZSBzb2x1dGlvbiBJIHdvdWxkIGxpa2UgdG8gdXNlLCBpZSBpbm5lciByZXF1ZXN0CnByb3h5
IHRvIElTUCByYWRpdXMsIGFuZCBXaW1heCBhdHRyaWJ1dGVzIGFyZSBiZWluZyBhZGRlZCBhZnRl
cgpyZWNlaXZpbmcgdGhlIGFjY2VzcyBhY2NlcHQgZnJvbSBJU1AgUmFkaXVzKTxicj4KLSZndDsg
SW4gdGhhdCBjYXNlIFdob2xlc2FsZSBSYWRpdXMgd2lsbCBhZGQgc29tZSBvZiB0aGUgd2FudGVk
CmF0dHJpYnV0ZSBidXQgbm90IGFsbCB0aGUgb25lIHRoYXQgYXJlIGluJm5ic3A7IGF0dHJzPGJy
PgpJJ20gYWxzbyB0cnlpbmcgdG8ga25vdyB3aHkuPGJyPgo8YnI+CjxhIGNsYXNzPSJtb3otdHh0
LWxpbmstZnJlZXRleHQiIGhyZWY9Imh0dHA6Ly93d3cuYnJvenMubmV0L3dpbWF4L3dpbWF4LXBy
b3h5Mi5sb2ciPmh0dHA6Ly93d3cuYnJvenMubmV0L3dpbWF4L3dpbWF4LXByb3h5Mi5sb2c8L2E+
PGJyPgo8YnI+ClJlZ2FyZHM8YnI+Cjxicj4KVGhvbWFzPGJyPgo8YnI+Cjxicj4KJm5ic3A7Jm5i
c3A7Jm5ic3A7IDxicj4KPC9ib2R5Pgo8L2h0bWw+Cg==

--===============8013489874205858779==--


From tnt@kalik.net Wed Apr  8 08:52:50 2009
From: tnt@kalik.net
To: freeradius-users@lists.freeradius.org
Subject: Re: EAP/TTLS : Issue while trying to proxy inner request and to use
	postproxy filter
Date: Wed, 08 Apr 2009 07:52:47 +0100
Message-ID: <JCeeJayE.1239173567.0396760.tnt@kalik.net>
In-Reply-To: <49DBE6A2.60407@brozs.net>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============1402483804544691991=="

--===============1402483804544691991==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit

>In Setup 1 (one radius with local authentication) everything is fine
>
>http://www.brozs.net/wimax/wimax.log
>
>In setup 2 (inner request proxy to ISP radius that will answer with
>Wimax Attribute)
>
>I'm trying to understand why.
>

Compare attrs entries with users file entries. Then read what do
operators := and += do.

Ivan Kalik
Kalik Informatiika ISP


--===============1402483804544691991==--


From tfagart@brozs.net Thu Apr  9 00:08:02 2009
From: Thomas Fagart <tfagart@brozs.net>
To: freeradius-users@lists.freeradius.org
Subject: Re: EAP/TTLS : Issue while trying to proxy inner request and to use
	postproxy filter
Date: Thu, 09 Apr 2009 00:07:45 +0200
Message-ID: <49DD2031.3090206@brozs.net>
In-Reply-To: <JCeeJayE.1239173567.0396760.tnt@kalik.net>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============8600684844317248078=="

--===============8600684844317248078==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit


>
> Compare attrs entries with users file entries. Then read what do
> operators := and += do.
>
>   
I've read man unlang and I correct my configuration, and I finally 
succeed to do what I want but not as I thought.

I just notice the following :
In users file you can do

Attribute_A = foo
Attribute_A += bar


But I haven't found a way to do it in attrs file (syntax is ok, but the 
reply won't include both same attribute).

I've tried
Attribute_A = foo
Attribute_A += bar

and
Attribute_A: = foo
Attribute_A += bar

without success.

Finally I've used unlang in post-auth module to add the wanted 
attributes like that

post-auth {
        main_pool
        update reply {
                WiMAX-QoS-Id += 2
                WiMAX-Schedule-Type += 2
                WiMAX-Traffic-Priority += 0
                WiMAX-Maximum-Sustained-Traffic-Rate += 1024000
                WiMAX-Media-Flow-Type += 2
        }
        reply_log
#       sql
#       sql_log
        exec
        Post-Auth-Type REJECT {
                attr_filter.access_reject
        }

Any way to make things work is ok, just wanted to know if that one is 
"dirty" ?

Thanx again for your advise.

Thomas

--===============8600684844317248078==--


From tnt@kalik.net Thu Apr  9 08:37:58 2009
From: Ivan Kalik <tnt@kalik.net>
To: freeradius-users@lists.freeradius.org
Subject: RE: EAP/TTLS : Issue while trying to proxy inner request and to
	usepostproxy filter
Date: Thu, 09 Apr 2009 07:37:38 +0100
Message-ID: <16E6EFD36A1F421E809F48CD19D4A36E@novilaptop>
In-Reply-To: <49DD2031.3090206@brozs.net>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============6362701660510489774=="

--===============6362701660510489774==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit

>
> Compare attrs entries with users file entries. Then read what do 
> operators := and += do.
>
>   
I've read man unlang and I correct my configuration, and I finally 
succeed to do what I want but not as I thought.

I just notice the following :
In users file you can do

Attribute_A = foo
Attribute_A += bar


But I haven't found a way to do it in attrs file (syntax is ok, but the 
reply won't include both same attribute).

So use users file:

DEFAULT	Realm == whatever
		list WiMAX attributes as reply; just like you did for single
user

Ivan Kalik
Kalik Informatika ISP


--===============6362701660510489774==--


From tfagart@brozs.net Thu Apr  9 18:17:51 2009
From: Thomas Fagart <tfagart@brozs.net>
To: freeradius-users@lists.freeradius.org
Subject: RE: EAP/TTLS : Issue while trying to proxy inner request and to
	usepostproxy filter
Date: Thu, 09 Apr 2009 18:17:42 +0200
Message-ID: <677300ffb73d5a5fe8a88d06459a8af8@localhost>
In-Reply-To: <16E6EFD36A1F421E809F48CD19D4A36E@novilaptop>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============1992101500075022434=="

--===============1992101500075022434==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit




On Thu, 9 Apr 2009 07:37:38 +0100, "Ivan Kalik" <tnt@kalik.net> wrote:
>>
>> Compare attrs entries with users file entries. Then read what do 
>> operators := and += do.
>>
>>   
> I've read man unlang and I correct my configuration, and I finally 
> succeed to do what I want but not as I thought.
> 
> I just notice the following :
> In users file you can do
> 
> Attribute_A = foo
> Attribute_A += bar
> 
> 
> But I haven't found a way to do it in attrs file (syntax is ok, but the 
> reply won't include both same attribute).
> 
> So use users file:
> 
> DEFAULT	Realm == whatever
> 		list WiMAX attributes as reply; just like you did for single
> user

I didn't know you could use files module on proxy radius, where should I
add the files module, in post-auth, post-proxy ?


Thomas


--===============1992101500075022434==--


