- Freeradius-Users - lists.freeradius.org

Re: rlm_sqlippool Question
by Richard J Palmer 06 Apr '19

06 Apr '19

Hi Alan That fixes it - thank you as ever for your help It is appreciated Richard > --- Original message --- > Subject: Re: rlm_sqlippool Question > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Date: Saturday, 06/04/2019 10:53 PM > > On Apr 6, 2019, at 5:40 PM, Richard J Palmer <richard(a)merula.net> > wrote: >> >> >> Going back more (sorry I am talking to myself ..... >> >> The config works file with 3.0.15 >> BUT breaks with that error with 3.0.16 onwards > > Use the v3.0.x branch from GitHub. It has a fix. We're releasing > 3.0.19 next week. > > Alan DeKok. > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

1 0

Re: rlm_sqlippool Question
by Richard J Palmer 06 Apr '19

06 Apr '19

OK Going back more (sorry I am talking to myself ..... The config works file with 3.0.15 BUT breaks with that error with 3.0.16 onwards I am running temporarily with 3.0.15 but if anyone can help locate / find the problem with the later version it would be nice. Just to confirm - If I install an 3.0.15 compiled from source (same config) it just works 3.0.16 onwards gives the crash I sent earlier Richard On Saturday 06/04/2019 at 10:06 pm, Richard J Palmer wrote: > > OK Further to this - it's not due to the config changes > > I removed them - but it is something from the upgrade between 3.0.15 > that was on this server and 3.0.18 which I am now using > > Logins are working fine using sql - it is only the sqlippool that is > crashing here > > > Happy to provide any details needed here / make any changes ... > > Richard > > On Saturday 06/04/2019 at 9:55 pm, Richard J Palmer wrote: >> >> >> Hmmmm >> >> OK Now I am getting a little stuck... >> >> I created a version on my 'test' server - and reverted the hard coded >> config and added: >> >> start_begin = "BEGIN TRANSACTION" >> allocate_begin = "BEGIN TRANSACTION" >> stop_begin = "BEGIN TRANSACTION" >> on_begin = "BEGIN TRANSACTION" >> off_begin = "BEGIN TRANSACTION" >> >> >> To the config file .. >> >> And during a login that uses ippool - I get: >> >> -- >> rlm_sql (sql1): Reserved connection (2) >> (0) sqlippool: EXPAND %{User-Name} >> (0) sqlippool: --> cgnattest(a)adsl.merula.net >> (0) sqlippool: SQL-User-Name set to 'cgnattest(a)adsl.merula.net' >> (0) sqlippool: EXPAND BEGIN TRANSACTION >> (0) sqlippool: --> BEGIN TRANSACTION >> (0) sqlippool: Executing query: BEGIN TRANSACTION >> src/modules/rlm_sql/rlm_sql.c:381: Type mismatch: name[rlm_sql_t] >> expected[rlm_sql_handle_t] >> >> talloc abort: src/modules/rlm_sql/rlm_sql.c:381: Type mismatch: >> name[rlm_sql_t] expected[rlm_sql_handle_t] >> ---- >> >> >> Have I done something silly here ? >> >> This is using a newly upgraded 3.0.18 install >> >> Thanks in advance >> >> Richard >> >> >> On Saturday 06/04/2019 at 9:10 pm, Alan DeKok wrote: >>> >>> >>> On Apr 6, 2019, at 3:54 PM, Richard J Palmer <richard(a)merula.net> >>> wrote: >>>> >>>> >>>> >>>> I am getting somewhere >>> >>> Sounds good. >>> >>>> >>>> >>>> >>>> There's actually a couple of other changes - One in the source code - >>>> one for the queries. >>>> >>>> I have it running in theory and will test and come back on this one >>>> soon.... >>>> >>>> With the source code - the issue I found was the Transaction code was >>>> different in Mssql to mysql - The start / end transaction calls seem >>>> to be hard coded - so for now I have tweaked the code to send the MS >>>> SQL commit functions - BUT I suspect that may be better as a config >>>> setting ? >>> >>> The transaction code should be pretty common: start >>> transaction, do >>> work, end transaction. And all of those SQL statements can go into >>> the configuration files. >>> >>> e.g. having "allocate_commit = COMMIT" in the source is >>> just a >>> default. If you need a different statement for commit, just put >>> "allocate_commit = whatever" into the configuration files. No source >>> code changes required. >>> >>> What's different about the MS-SQL commit functions? >>> >>>> >>>> >>>> >>>> I am going to test this 'in anger' now so we get accounting data for a >>>> few test accounts and make sure things look OK... >>>> >>>> Once working would you like a copy of the code changes / working >>>> queries to apply to the code ? >>> >>> Yes. Probably only one file with the queries is >>> needed. >>> >>> Alan DeKok. >>> >>> >>> - >>> List info/subscribe/unsubscribe? See >>> http://www.freeradius.org/list/users.html >> >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

Re: rlm_sqlippool Question
by Richard J Palmer 06 Apr '19

06 Apr '19

OK Further to this - it's not due to the config changes I removed them - but it is something from the upgrade between 3.0.15 that was on this server and 3.0.18 which I am now using Logins are working fine using sql - it is only the sqlippool that is crashing here Happy to provide any details needed here / make any changes ... Richard On Saturday 06/04/2019 at 9:55 pm, Richard J Palmer wrote: > > Hmmmm > > OK Now I am getting a little stuck... > > I created a version on my 'test' server - and reverted the hard coded > config and added: > > start_begin = "BEGIN TRANSACTION" > allocate_begin = "BEGIN TRANSACTION" > stop_begin = "BEGIN TRANSACTION" > on_begin = "BEGIN TRANSACTION" > off_begin = "BEGIN TRANSACTION" > > > To the config file .. > > And during a login that uses ippool - I get: > > -- > rlm_sql (sql1): Reserved connection (2) > (0) sqlippool: EXPAND %{User-Name} > (0) sqlippool: --> cgnattest(a)adsl.merula.net > (0) sqlippool: SQL-User-Name set to 'cgnattest(a)adsl.merula.net' > (0) sqlippool: EXPAND BEGIN TRANSACTION > (0) sqlippool: --> BEGIN TRANSACTION > (0) sqlippool: Executing query: BEGIN TRANSACTION > src/modules/rlm_sql/rlm_sql.c:381: Type mismatch: name[rlm_sql_t] > expected[rlm_sql_handle_t] > > talloc abort: src/modules/rlm_sql/rlm_sql.c:381: Type mismatch: > name[rlm_sql_t] expected[rlm_sql_handle_t] > ---- > > > Have I done something silly here ? > > This is using a newly upgraded 3.0.18 install > > Thanks in advance > > Richard > > > On Saturday 06/04/2019 at 9:10 pm, Alan DeKok wrote: >> >> On Apr 6, 2019, at 3:54 PM, Richard J Palmer <richard(a)merula.net> >> wrote: >>> >>> >>> I am getting somewhere >> >> Sounds good. >> >>> >>> >>> There's actually a couple of other changes - One in the source code - >>> one for the queries. >>> >>> I have it running in theory and will test and come back on this one >>> soon.... >>> >>> With the source code - the issue I found was the Transaction code was >>> different in Mssql to mysql - The start / end transaction calls seem >>> to be hard coded - so for now I have tweaked the code to send the MS >>> SQL commit functions - BUT I suspect that may be better as a config >>> setting ? >> >> The transaction code should be pretty common: start >> transaction, do >> work, end transaction. And all of those SQL statements can go into >> the configuration files. >> >> e.g. having "allocate_commit = COMMIT" in the source is just a >> default. If you need a different statement for commit, just put >> "allocate_commit = whatever" into the configuration files. No source >> code changes required. >> >> What's different about the MS-SQL commit functions? >> >>> >>> >>> I am going to test this 'in anger' now so we get accounting data for a >>> few test accounts and make sure things look OK... >>> >>> Once working would you like a copy of the code changes / working >>> queries to apply to the code ? >> >> Yes. Probably only one file with the queries is needed. >> >> Alan DeKok. >> >> >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

1 0

Re: rlm_sqlippool Question
by Richard J Palmer 06 Apr '19

06 Apr '19

Hmmmm OK Now I am getting a little stuck... I created a version on my 'test' server - and reverted the hard coded config and added: start_begin = "BEGIN TRANSACTION" allocate_begin = "BEGIN TRANSACTION" stop_begin = "BEGIN TRANSACTION" on_begin = "BEGIN TRANSACTION" off_begin = "BEGIN TRANSACTION" To the config file .. And during a login that uses ippool - I get: -- rlm_sql (sql1): Reserved connection (2) (0) sqlippool: EXPAND %{User-Name} (0) sqlippool: --> cgnattest(a)adsl.merula.net (0) sqlippool: SQL-User-Name set to 'cgnattest(a)adsl.merula.net' (0) sqlippool: EXPAND BEGIN TRANSACTION (0) sqlippool: --> BEGIN TRANSACTION (0) sqlippool: Executing query: BEGIN TRANSACTION src/modules/rlm_sql/rlm_sql.c:381: Type mismatch: name[rlm_sql_t] expected[rlm_sql_handle_t] talloc abort: src/modules/rlm_sql/rlm_sql.c:381: Type mismatch: name[rlm_sql_t] expected[rlm_sql_handle_t] ---- Have I done something silly here ? This is using a newly upgraded 3.0.18 install Thanks in advance Richard On Saturday 06/04/2019 at 9:10 pm, Alan DeKok wrote: > On Apr 6, 2019, at 3:54 PM, Richard J Palmer <richard(a)merula.net> > wrote: >> >> I am getting somewhere > > Sounds good. > >> >> There's actually a couple of other changes - One in the source code - >> one for the queries. >> >> I have it running in theory and will test and come back on this one >> soon.... >> >> With the source code - the issue I found was the Transaction code was >> different in Mssql to mysql - The start / end transaction calls seem >> to be hard coded - so for now I have tweaked the code to send the MS >> SQL commit functions - BUT I suspect that may be better as a config >> setting ? > > The transaction code should be pretty common: start transaction, do > work, end transaction. And all of those SQL statements can go into > the configuration files. > > e.g. having "allocate_commit = COMMIT" in the source is just a > default. If you need a different statement for commit, just put > "allocate_commit = whatever" into the configuration files. No source > code changes required. > > What's different about the MS-SQL commit functions? > >> >> I am going to test this 'in anger' now so we get accounting data for a >> few test accounts and make sure things look OK... >> >> Once working would you like a copy of the code changes / working >> queries to apply to the code ? > > Yes. Probably only one file with the queries is needed. > > Alan DeKok. > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

1 0

Re: rlm_sqlippool Question
by Richard J Palmer 06 Apr '19

06 Apr '19

HI Alan The current code has 'START TRANSACTION' Microsoft chose to have 'BEGIN TRANSACTION' Thanks for the confirmation that this can be in the config - not needing to edit source that is much better - sorry I missed that bit - reading the code again it seems obvious ... I'll do some more testing but this seems to be working very well ... Thanks again Richard On Saturday 06/04/2019 at 9:10 pm, Alan DeKok wrote: > On Apr 6, 2019, at 3:54 PM, Richard J Palmer <richard(a)merula.net> > wrote: >> >> I am getting somewhere > > Sounds good. > >> >> There's actually a couple of other changes - One in the source code - >> one for the queries. >> >> I have it running in theory and will test and come back on this one >> soon.... >> >> With the source code - the issue I found was the Transaction code was >> different in Mssql to mysql - The start / end transaction calls seem >> to be hard coded - so for now I have tweaked the code to send the MS >> SQL commit functions - BUT I suspect that may be better as a config >> setting ? > > The transaction code should be pretty common: start transaction, do > work, end transaction. And all of those SQL statements can go into > the configuration files. > > e.g. having "allocate_commit = COMMIT" in the source is just a > default. If you need a different statement for commit, just put > "allocate_commit = whatever" into the configuration files. No source > code changes required. > > What's different about the MS-SQL commit functions? > >> >> I am going to test this 'in anger' now so we get accounting data for a >> few test accounts and make sure things look OK... >> >> Once working would you like a copy of the code changes / working >> queries to apply to the code ? > > Yes. Probably only one file with the queries is needed. > > Alan DeKok. > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

1 0

Re: rlm_sqlippool Question
by Richard J Palmer 06 Apr '19

06 Apr '19

OK I am getting somewhere There's actually a couple of other changes - One in the source code - one for the queries. I have it running in theory and will test and come back on this one soon.... With the source code - the issue I found was the Transaction code was different in Mssql to mysql - The start / end transaction calls seem to be hard coded - so for now I have tweaked the code to send the MS SQL commit functions - BUT I suspect that may be better as a config setting ? I am going to test this 'in anger' now so we get accounting data for a few test accounts and make sure things look OK... Once working would you like a copy of the code changes / working queries to apply to the code ? Thanks for the help so far ... Richard On Saturday 06/04/2019 at 7:28 pm, Arran Cudbard-Bell wrote: > > >> >> On Apr 6, 2019, at 8:18 AM, Richard J Palmer <richard(a)merula.net> >> wrote: >> >> >> HI >> >> I am looking at using this for some connections where a static IP >> address is not needed. >> >> Currently we use mssql for the SQL server for the main radius process. >> >> Looking at rlm_sqlippool there are queries for >> >> mysql >> oracle >> postgresql >> sqlite >> >> Before I start here - would this module support mssql if I create / >> tweak the queries - OR should I run a separate SQL server just for the >> IP Pools >> >> I was not 100% sure after reading the documentation. More than happy >> to adjust the SQL (Create a table / create the queries) Just wanted to >> consult here before doing that. >> >> Assuming it will work OK and I create a working config I am more than >> happy to provide it back to the project > > Yes it'll work, you just need to create the queries. > > -Arran > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

rlm_sqlippool Question
by Richard J Palmer 06 Apr '19

06 Apr '19

HI I am looking at using this for some connections where a static IP address is not needed. Currently we use mssql for the SQL server for the main radius process. Looking at rlm_sqlippool there are queries for mysql oracle postgresql sqlite Before I start here - would this module support mssql if I create / tweak the queries - OR should I run a separate SQL server just for the IP Pools I was not 100% sure after reading the documentation. More than happy to adjust the SQL (Create a table / create the queries) Just wanted to consult here before doing that. Assuming it will work OK and I create a working config I am more than happy to provide it back to the project Thanks in advance Richard

2 1

3.0.18: operator = not behaving as expected after proxying to virtual server
by stefan.winter＠restena.lu 06 Apr '19

06 Apr '19

Hello, I have a setup where a proxied-to virtual server sets the attribute Session-Timeout with := and then the calling server sets it subsidiary to a different value with = in post-proxy. The reply_log for both servers shows that the first value is set ok, but the second = operator *adds* the Session-Timeout attribute a second time. This effectively leads to FreeRADIUS sending back a malformed packet because it now contains two Session-Timeout attributes. The reply_log/post_proxy_log contents look like this: Sat Apr 6 12:17:25 2019 Packet-Type = Access-Reject Session-Timeout = 604800 <-- as set with := Timestamp = 1554545845 Sat Apr 6 12:17:25 2019 Packet-Type = Access-Reject Cisco-Account-Info = "ASERVICE_INTERNET-DEFAULT" Session-Timeout = 86400 <-- extra addition in post-proxy Idle-Timeout = 7200 Session-Timeout = 604800 <-- should prevail Timestamp = 1554545845 The post-proxy configuration of the caller is: post-proxy { update reply { Cisco-Account-Info = "ASERVICE_INTERNET-DEFAULT", Session-Timeout = 86400, Idle-Timeout = 7200 } post_proxy_log } This seems to be a bug: Session timeout is already set, and the = operator should refrain from changing the existing value. And also, it should detect that it is doing something non-RFC compliant by adding it twice. The actual reply as seen by radtest is: Received Access-Reject Id 196 from 127.0.0.1:1812 to 127.0.0.1:49664 length 71 Cisco-Account-Info = "ASERVICE_INTERNET-DEFAULT" Session-Timeout = 86400 Idle-Timeout = 7200 Session-Timeout = 604800 (0) -: Expected Access-Accept got Access-Reject So the incorrect attribute list actually made it onto the wire. Greetings, Stefan Winter

3 3

seeking info on max.rate supported by dhcp.relay in v3.0.0.19
by Katuri, Vikram 06 Apr '19

06 Apr '19

Hi Team, May I please know the max.supported rate for dhcp.relay(with load balancing) in version 3.0.19. I see its getting capped at 5000 incoming discovers and only 2500 of them are able to complete the 4 way DORA(via dhcp.relay). 3700 with discover and request alone handled by the dhcp.relay and request and ack directly sent by the dhcp server to the client bypassing the relay(by not filling in the gateway address, server sends to the ciaddr). Setup details: 5 clients running perfdhcp each trying dhcp transactions at a rate of 1000/sec. Dhcp.relay on v3.0.19 running on c4.2xlarge instance (8 CPUs) on AWS cloud, 3 v4 dhcp servers behind it running on t2.medium instances on AWS cloud. My Load balancing logic is as following: server dhcp.eth1 { listen { ipaddr = * port = 67 type = dhcp interface = eth1 } # Packets received on the socket will be processed through one # of the following sections, named after the DHCP packet type. # See dictionary.dhcp for the packet types. dhcp DHCP-Discover { redundant-load-balance { group { update config { &DHCP-Relay-To-IP-Address := 10.43.x.a } } group { update config { &DHCP-Relay-To-IP-Address := 10.43.x.b } } group { update config { &DHCP-Relay-To-IP-Address := 10.43.x.c } } } # update request { # IP Address of the DHCP relay (ourselves) # &DHCP-Gateway-IP-Address := 10.43.x.d # } ok } dhcp DHCP-Request { update config { &DHCP-Relay-To-IP-Address := &request:DHCP-DHCP-Server-Identifier } # update request { # &DHCP-Gateway-IP-Address := 10.43.x.d # } ok } } Please letme know if there are any benchmarking results from earlier tests. Thanks in advance, Vikram.

12 21

Limiting Max daily session
by myxmail1919＠yahoo.com 05 Apr '19

05 Apr '19

Hi Guys, its a long time that im busy withConfiguring Freeradius to limiting daily usage time for all users, would you please help me ? I tried a lot of things but did not getany result …. Im using freeradius 3.0.16and mysql There is more than 300.000 users and Iwant to set daily usage limit to 3 Hours ! There is MAC-based access control and allow everyone toconnect, so have no databases for users, I tried Max-daily-session withmysqlcounter so it was not successful, Cansomeone tell me step by step what should I do ? thank you

2 2