On 11/02/16 14:28, Jonathan Gazeley wrote:
On 11/02/16 09:51, A.L.M.Buxey@lboro.ac.uk wrote:
Hi,
Is there are a way to fabricate EAP/MSCHAPv2 packets such that we can reliably provoke the server into using session resumption or not? This way we would be able able to test->capture->debug->fix->repeat much more quickly.
use eapol_test from the wpa_supplicant system
its likely that you have some policy or unlang corner-case that isnt matching the cache...or you arent querying the existing cache entry and adding other stuff based on the new NAS id - possibly roaming events between 2 seperate controllers etc etc
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I've captured a debug log which contains two authentications, both of which are successful. I have disabled the TLS cache so session resumption shouldn't occur.
However, something seems odd with the EAP session state expiry. The attached log came from a single AP connected to a single WISM in our lab (so this rules out roaming events between controllers and/or APs).
From what I can tell, the server is trying to repeatedly expire EAP session with state 0x6fc3095a6cc610be. This session is first mentioned on line 3805 but e.g. on line 4012 it is expired but mentioned alongside another session. From then onwards, every packet that is handled tries to expire 0x6fc3095a6cc610be but mentions finishing a different session (e.g. line 4013)
Is this normal?
Thanks, Jonathan
Oops, the attachment was stripped. Here's the debug log: Copyright (C) 1999-2015 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including files in directory /etc/raddb/clients.d/ including configuration file /etc/raddb/clients.d/WISM12.conf including configuration file /etc/raddb/clients.d/WISM3.conf including configuration file /etc/raddb/clients.d/WISM1.conf including configuration file /etc/raddb/clients.d/monitor.conf including configuration file /etc/raddb/clients.d/WISM5-HA.conf including configuration file /etc/raddb/clients.d/WISM2.conf including configuration file /etc/raddb/clients.d/WISM4.conf including configuration file /etc/raddb/clients.d/WISM1-HA.conf including configuration file /etc/raddb/clients.d/WISM4-HA.conf including configuration file /etc/raddb/clients.d/WISM7.conf including configuration file /etc/raddb/clients.d/WISM6-HA.conf including configuration file /etc/raddb/clients.d/WISM9.conf including configuration file /etc/raddb/clients.d/WISM6.conf including configuration file /etc/raddb/clients.d/WISM5.conf including configuration file /etc/raddb/clients.d/WISM7-HA.conf including configuration file /etc/raddb/clients.d/WISM2-HA.conf including configuration file /etc/raddb/clients.d/WISM3-HA.conf including configuration file /etc/raddb/clients.d/WISM8.conf including configuration file /etc/raddb/clients.d/localhost.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/eduroaminfo including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/uobdetail including configuration file /etc/raddb/mods-enabled/uobsql-write including configuration file /etc/raddb/mods-config/uobsql-write-queries.conf including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/logtofile including configuration file /etc/raddb/mods-enabled/eduroamlioneap including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/eduroamvlan including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/uobsql including configuration file /etc/raddb/mods-config/uobsql-queries.conf including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/cache-vlan including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/files-eduroam including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/cache-ntlm including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/eduroameap including configuration file /etc/raddb/mods-enabled/eduroamlioneap-old including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/eduroammschap including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/logtosyslog including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/templates.conf including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/policies including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/operator-name including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/get-ssid including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/eduroam-realm-checks.conf including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/logchecker including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/eduroam-inner including configuration file /etc/raddb/sites-enabled/eduroamlocal-auth including configuration file /etc/raddb/sites-enabled/status including files in directory /etc/raddb/statusclients.d/ including configuration file /etc/raddb/statusclients.d/monitor.conf including configuration file /etc/raddb/statusclients.d/monitorv6.conf including configuration file /etc/raddb/statusclients.d/localhost.conf including configuration file /etc/raddb/sites-enabled/eduroamlion-inner main { security { user = "radiusd" group = "radiusd" allow_core_dumps = no } name = "radiusd" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" } main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 4096 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### home_server jrs0 { ipaddr = 194.82.174.185 port = 1812 type = "auth+acct" proto = "udp" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server jrs0v6 { ipv6addr = 2001:630:1:128::185 port = 1812 type = "auth+acct" proto = "udp" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server jrs1 { ipaddr = 194.83.56.233 port = 1812 type = "auth+acct" proto = "udp" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server jrs1v6 { ipv6addr = 2001:630:1:12a::233 port = 1812 type = "auth+acct" proto = "udp" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server jrs2 { ipaddr = 194.83.56.249 port = 1812 type = "auth+acct" proto = "udp" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server jrs2v6 { ipv6addr = 2001:630:1:129::249 port = 1812 type = "auth+acct" proto = "udp" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server radius-dev { ipaddr = 137.222.7.119 port = 16006 type = "auth+acct" proto = "udp" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server radius-dev-v6 { ipv6addr = 2001:630:e4:81:137:222:7:119 port = 16006 type = "auth+acct" proto = "udp" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } realm LOCAL { } realm bris.ac.uk { } realm bristol.ac.uk { } home_server_pool dev { type = fail-over home_server = radius-dev home_server = radius-dev-v6 } realm dev { pool = dev } home_server_pool jrs { type = fail-over home_server = jrs1v6 home_server = jrs2v6 home_server = jrs1 home_server = jrs0v6 home_server = jrs2 home_server = jrs0 } realm jrs { pool = jrs nostrip } realm lion.bristol.ac.uk { } realm my.bristol.ac.uk { } radiusd: #### Loading Clients #### client WISM12 { ipaddr = 172.17.107.212 require_message_authenticator = no secret = <<< secret >>> shortname = "WISM12" nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client WISM3 { ipaddr = 172.17.107.203 require_message_authenticator = no secret = <<< secret >>> shortname = "WISM3" nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client WISM1 { ipaddr = 172.17.107.201 require_message_authenticator = no secret = <<< secret >>> shortname = "WISM1" nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client monitor { ipaddr = 137.222.7.147 require_message_authenticator = no secret = <<< secret >>> shortname = "monitor" nas_type = "other" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client WISM5-HA { ipaddr = 172.17.107.105 require_message_authenticator = no secret = <<< secret >>> shortname = "WISM5-HA" nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client WISM2 { ipaddr = 172.17.107.202 require_message_authenticator = no secret = <<< secret >>> shortname = "WISM2" nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client WISM4 { ipaddr = 172.17.107.204 require_message_authenticator = no secret = <<< secret >>> shortname = "WISM4" nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client WISM1-HA { ipaddr = 172.17.107.101 require_message_authenticator = no secret = <<< secret >>> shortname = "WISM1-HA" nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client WISM4-HA { ipaddr = 172.17.107.104 require_message_authenticator = no secret = <<< secret >>> shortname = "WISM4-HA" nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client WISM7 { ipaddr = 172.17.107.207 require_message_authenticator = no secret = <<< secret >>> shortname = "WISM7" nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client WISM6-HA { ipaddr = 172.17.107.106 require_message_authenticator = no secret = <<< secret >>> shortname = "WISM6-HA" nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client WISM9 { ipaddr = 172.17.107.209 require_message_authenticator = no secret = <<< secret >>> shortname = "WISM9" nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client WISM6 { ipaddr = 172.17.107.206 require_message_authenticator = no secret = <<< secret >>> shortname = "WISM6" nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client WISM5 { ipaddr = 172.17.107.205 require_message_authenticator = no secret = <<< secret >>> shortname = "WISM5" nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client WISM7-HA { ipaddr = 172.17.107.107 require_message_authenticator = no secret = <<< secret >>> shortname = "WISM7-HA" nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client WISM2-HA { ipaddr = 172.17.107.102 require_message_authenticator = no secret = <<< secret >>> shortname = "WISM2-HA" nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client WISM3-HA { ipaddr = 172.17.107.103 require_message_authenticator = no secret = <<< secret >>> shortname = "WISM3-HA" nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client WISM8 { ipaddr = 172.17.107.208 require_message_authenticator = no secret = <<< secret >>> shortname = "WISM8" nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> shortname = "localhost" nas_type = "other" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = files-eduroam # Creating Auth-Type = eduroameap # Creating Autz-Type = Status-Server # Creating Acct-Type = Status-Server # Creating Auth-Type = eduroamlioneap # Creating Auth-Type = eduroamlioneap-old radiusd: #### Instantiating modules #### # Loaded module rlm_unpack # Loading module "unpack" from file /etc/raddb/mods-enabled/unpack # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/raddb/mods-enabled/utf8 # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_linelog # Loading module "eduroaminfo" from file /etc/raddb/mods-enabled/eduroaminfo linelog eduroaminfo { filename = "syslog" escape_filenames = no syslog_facility = "user" syslog_severity = "info" permissions = 384 format = "X,%{User-Name},%{Calling-Station-Id},%{Module-Failure-Message},%{reply:MS-CHAP-Error},%{config:Auth-Type},%{Virtual-Server}[%{Virtual-Server}.%{%{UOB-Info-Type}:-UNKN}}]" reference = "%{Virtual-Server}.%{%{UOB-Info-Type}:-UNKN}" } # Loaded module rlm_unix # Loading module "unix" from file /etc/raddb/mods-enabled/unix unix { radwtmp = "/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_detail # Loading module "uob_detail" from file /etc/raddb/mods-enabled/uobdetail detail uob_detail { filename = "/var/log/radius/radacct/%{%{Virtual-Server}:-UNKNOWN}/detail.log" header = "%t" permissions = 416 locking = no escape_filenames = no log_packet_header = no } # Loading module "uob_auth_log" from file /etc/raddb/mods-enabled/uobdetail detail uob_auth_log { filename = "/var/log/radius/radacct/%{%{Virtual-Server}:-UNKNOWN}/auth-detail.log" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = yes } # Loading module "uob_auth_log_password" from file /etc/raddb/mods-enabled/uobdetail detail uob_auth_log_password { filename = "/var/log/radius/radacct/%{%{Virtual-Server}:-UNKNOWN}/auth-detail.log" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "uob_reply_log" from file /etc/raddb/mods-enabled/uobdetail detail uob_reply_log { filename = "/var/log/radius/radacct/%{%{Virtual-Server}:-UNKNOWN}/reply-detail.log" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "uob_pre_proxy_log" from file /etc/raddb/mods-enabled/uobdetail detail uob_pre_proxy_log { filename = "/var/log/radius/radacct/%{%{Virtual-Server}:-DEFAULT}/pre-proxy-detail.log" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "uob_post_proxy_log" from file /etc/raddb/mods-enabled/uobdetail detail uob_post_proxy_log { filename = "/var/log/radius/radacct/%{%{Virtual-Server}:-DEFAULT}/post-proxy-detail.log" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_sql # Loading module "uobsql-write" from file /etc/raddb/mods-enabled/uobsql-write sql uobsql-write { driver = "rlm_sql_mysql" server = "db-write.nomadic-core.bris.ac.uk" port = 3306 login = "radiusd" password = <<< secret >>> radius_db = "radius" read_groups = yes read_profiles = yes read_clients = no delete_stale_sessions = yes sql_user_name = "%{%{Stripped-User-Name}:-%{User-Name}}" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{uobsql-write-sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{uobsql-write-sql-Group}' ORDER BY id" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" accounting { reference = "%{tolower:type.%{Acct-Status-Type}.query}" type { accounting-on { query = "UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" } accounting-off { query = "UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" } start { query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, virtual_server, radius_server, vlan, strippedusername) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', '%S', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Virtual-Server}', '%{Packet-Dst-IP-Address}', '%{Tunnel-Private-Group-Id}', SUBSTRING_INDEX('%{SQL-User-Name}', '@', 1))" } interim-update { query = "UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = '%S', acctinterval = %{integer:Event-Timestamp} - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '%{Framed-IP-Address}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } stop { query = "UPDATE radacct SET acctstoptime = '%S', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } } } post-auth { reference = ".query" query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" } } rlm_sql (uobsql-write): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Creating attribute uobsql-write-SQL-Group # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_exec # Loading module "exec" from file /etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_always # Loading module "reject" from file /etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups" hints = "/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_radutmp # Loading module "sradutmp" from file /etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loading module "radutmp" from file /etc/raddb/mods-enabled/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loading module "logtofile" from file /etc/raddb/mods-enabled/logtofile linelog logtofile { filename = "/var/log/radius/radiusd-%{%{Virtual-Server}:-DEFAULT}.log" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "logtofile.%{%{reply:Packet-Type}:-format}" } # Loaded module rlm_eap # Loading module "eduroamlioneap" from file /etc/raddb/mods-enabled/eduroamlioneap eap eduroamlioneap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes } # Loading module "ntlm_auth" from file /etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loading module "eduroamvlan" from file /etc/raddb/mods-enabled/eduroamvlan cache eduroamvlan { driver = "rlm_cache_rbtree" key = "%{Calling-Station-Id}" ttl = 600 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } # Loading module "uobsql" from file /etc/raddb/mods-enabled/uobsql sql uobsql { driver = "rlm_sql_mysql" server = "db.nomadic-core.bris.ac.uk" port = 3306 login = "radiusd" password = <<< secret >>> radius_db = "radius" read_groups = yes read_profiles = yes read_clients = no delete_stale_sessions = yes sql_user_name = "%{%{Stripped-User-Name}:-%{User-Name}}" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{uobsql-sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{uobsql-sql-Group}' ORDER BY id" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" accounting { reference = "%{tolower:type.%{Acct-Status-Type}.query}" type { accounting-on { query = "UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" } accounting-off { query = "UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" } start { query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, virtual_server, radius_server, vlan, strippedusername) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', '%S', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Virtual-Server}', '%{Packet-Dst-IP-Address}', '%{Tunnel-Private-Group-Id}', SUBSTRING_INDEX('%{SQL-User-Name}', '@', 1))" } interim-update { query = "UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = '%S', acctinterval = %{integer:Event-Timestamp} - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '%{Framed-IP-Address}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } stop { query = "UPDATE radacct SET acctstoptime = '%S', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } } } post-auth { reference = ".query" query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" } } rlm_sql (uobsql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Creating attribute uobsql-SQL-Group # Loaded module rlm_files # Loading module "files" from file /etc/raddb/mods-enabled/files files { filename = "/etc/raddb/mods-config/files/authorize" acctusersfile = "/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_dhcp # Loading module "dhcp" from file /etc/raddb/mods-enabled/dhcp # Loaded module rlm_digest # Loading module "digest" from file /etc/raddb/mods-enabled/digest # Loaded module rlm_soh # Loading module "soh" from file /etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loading module "echo" from file /etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loading module "cache-vlan" from file /etc/raddb/mods-enabled/cache-vlan cache cache-vlan { driver = "rlm_cache_rbtree" key = "%{Calling-Station-Id}" ttl = 3600 max_entries = 0 epoch = 0 add_stats = no } # Loading module "auth_log" from file /etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "files-eduroam" from file /etc/raddb/mods-enabled/files-eduroam files files-eduroam { usersfile = "/etc/raddb/users.d/users-eduroam" } # Loaded module rlm_chap # Loading module "chap" from file /etc/raddb/mods-enabled/chap # Loaded module rlm_replicate # Loading module "replicate" from file /etc/raddb/mods-enabled/replicate # Loading module "cache-ntlm" from file /etc/raddb/mods-enabled/cache-ntlm cache cache-ntlm { driver = "rlm_cache_rbtree" key = "%{User-Name}" ttl = 3600 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_expr # Loading module "expr" from file /etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loading module "eduroameap" from file /etc/raddb/mods-enabled/eduroameap eap eduroameap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } # Loading module "eduroamlioneap-old" from file /etc/raddb/mods-enabled/eduroamlioneap-old eap eduroamlioneap-old { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/raddb/mods-enabled/expiration # Loading module "eduroammschap" from file /etc/raddb/mods-enabled/eduroammschap mschap eduroammschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{eduroammschap:User-Name}} --challenge=%{eduroammschap:Challenge} --nt-response=%{eduroammschap:NT-Response} " passchange { } allow_retry = no retry_msg = "Verify username and re-enter your password" } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loading module "filter.attrs.accounting_response" from file /etc/raddb/mods-enabled/attr_filter attr_filter filter.attrs.accounting_response { filename = "/etc/raddb/mods-config/attr_filter/attrs.accounting_response" key = "%{User-Name}" relaxed = no } # Loading module "filter.eduroamlocal-a_accept" from file /etc/raddb/mods-enabled/attr_filter attr_filter filter.eduroamlocal-a_accept { filename = "/etc/raddb/mods-config/attr_filter/eduroamlocal-a_accept" key = "%{User-Name}" relaxed = no } # Loading module "filter.eduroamlocal-a_challenge" from file /etc/raddb/mods-enabled/attr_filter attr_filter filter.eduroamlocal-a_challenge { filename = "/etc/raddb/mods-config/attr_filter/eduroamlocal-a_challenge" key = "%{User-Name}" relaxed = no } # Loading module "filter.eduroamlocal-a_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter filter.eduroamlocal-a_reject { filename = "/etc/raddb/mods-config/attr_filter/eduroamlocal-a_reject" key = "%{User-Name}" relaxed = no } # Loading module "filter.eduroamlocal-post_proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter filter.eduroamlocal-post_proxy { filename = "/etc/raddb/mods-config/attr_filter/eduroamlocal-post_proxy" key = "%{User-Name}" relaxed = no } # Loading module "filter.eduroamlocal-pre_proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter filter.eduroamlocal-pre_proxy { filename = "/etc/raddb/mods-config/attr_filter/eduroamlocal-pre_proxy" key = "%{User-Name}" relaxed = no } # Loading module "logtosyslog" from file /etc/raddb/mods-enabled/logtosyslog linelog logtosyslog { filename = "syslog" escape_filenames = no syslog_facility = "local5" syslog_severity = "info" permissions = 384 format = "" reference = "logtosyslog.%{%{reply:Packet-Type}:-format}" } # Loaded module rlm_pap # Loading module "pap" from file /etc/raddb/mods-enabled/pap pap { normalise = yes } # Loading module "detail" from file /etc/raddb/mods-enabled/detail detail { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "linelog" from file /etc/raddb/mods-enabled/linelog linelog { filename = "/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } instantiate { } modules { # Instantiating module "etc_passwd" from file /etc/raddb/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "eduroaminfo" from file /etc/raddb/mods-enabled/eduroaminfo # Instantiating module "uob_detail" from file /etc/raddb/mods-enabled/uobdetail rlm_detail (uob_detail): 'User-Password' suppressed, will not appear in detail output # Instantiating module "uob_auth_log" from file /etc/raddb/mods-enabled/uobdetail rlm_detail (uob_auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "uob_auth_log_password" from file /etc/raddb/mods-enabled/uobdetail # Instantiating module "uob_reply_log" from file /etc/raddb/mods-enabled/uobdetail # Instantiating module "uob_pre_proxy_log" from file /etc/raddb/mods-enabled/uobdetail # Instantiating module "uob_post_proxy_log" from file /etc/raddb/mods-enabled/uobdetail # Instantiating module "uobsql-write" from file /etc/raddb/mods-enabled/uobsql-write rlm_sql_mysql: libmysql version: 5.5.44-MariaDB mysql { tls { } warnings = "auto" } rlm_sql (uobsql-write): Attempting to connect to database "radius" rlm_sql (uobsql-write): Initialising connection pool pool { start = 1 min = 1 max = 2 spare = 1 uses = 10000 lifetime = 300 cleanup_interval = 30 idle_timeout = 60 retry_delay = 60 spread = no } rlm_sql (uobsql-write): Opening additional connection (0), 1 of 2 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on db-write.nomadic-core.bris.ac.uk via TCP/IP, server version 5.5.47-MariaDB-wsrep-log, protocol version 10 # Instantiating module "reject" from file /etc/raddb/mods-enabled/always # Instantiating module "fail" from file /etc/raddb/mods-enabled/always # Instantiating module "ok" from file /etc/raddb/mods-enabled/always # Instantiating module "handled" from file /etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /etc/raddb/mods-enabled/always # Instantiating module "noop" from file /etc/raddb/mods-enabled/always # Instantiating module "updated" from file /etc/raddb/mods-enabled/always # Instantiating module "preprocess" from file /etc/raddb/mods-enabled/preprocess reading pairlist file /etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /etc/raddb/mods-config/preprocess/hints # Instantiating module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "logtofile" from file /etc/raddb/mods-enabled/logtofile # Instantiating module "eduroamlioneap" from file /etc/raddb/mods-enabled/eduroamlioneap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 ca_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/eduroam.wireless.bris.ac.uk.key" certificate_file = "/etc/raddb/certs/eduroam.wireless.bris.ac.uk-cert.pem" ca_file = "/etc/raddb/certs/uob-net-ca.pem" dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 name = "elln" max_entries = 20000 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "eduroamlion-inner" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes virtual_server = "eduroamlion-inner" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "mschap" from file /etc/raddb/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "eduroamvlan" from file /etc/raddb/mods-enabled/eduroamvlan rlm_cache (eduroamvlan): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "IPASS" from file /etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/raddb/mods-enabled/realm # Instantiating module "uobsql" from file /etc/raddb/mods-enabled/uobsql mysql { tls { } warnings = "auto" } rlm_sql (uobsql): Attempting to connect to database "radius" rlm_sql (uobsql): Initialising connection pool pool { start = 1 min = 1 max = 8 spare = 1 uses = 10000 lifetime = 300 cleanup_interval = 30 idle_timeout = 60 retry_delay = 60 spread = no } rlm_sql (uobsql): Opening additional connection (0), 1 of 8 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on db.nomadic-core.bris.ac.uk via TCP/IP, server version 5.5.47-MariaDB-wsrep-log, protocol version 10 # Instantiating module "files" from file /etc/raddb/mods-enabled/files reading pairlist file /etc/raddb/mods-config/files/authorize reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy # Instantiating module "cache-vlan" from file /etc/raddb/mods-enabled/cache-vlan rlm_cache (cache-vlan): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "auth_log" from file /etc/raddb/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "files-eduroam" from file /etc/raddb/mods-enabled/files-eduroam reading pairlist file /etc/raddb/users.d/users-eduroam # Instantiating module "cache-ntlm" from file /etc/raddb/mods-enabled/cache-ntlm rlm_cache (cache-ntlm): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "eduroameap" from file /etc/raddb/mods-enabled/eduroameap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 ca_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/eduroam.wireless.bris.ac.uk.key" certificate_file = "/etc/raddb/certs/eduroam.wireless.bris.ac.uk-cert.pem" ca_file = "/etc/raddb/certs/uob-net-ca.pem" dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT:!ADH:!SSLv2" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 name = "eduroamshaca" max_entries = 20000 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "eduroam-inner" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes virtual_server = "eduroam-inner" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = yes } # Instantiating module "eduroamlioneap-old" from file /etc/raddb/mods-enabled/eduroamlioneap-old # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 ca_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/eduroam.wireless.key" certificate_file = "/etc/raddb/certs/eduroam.wireless-cert.pem" ca_file = "/etc/raddb/certs/uob-net-ca.pem" dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 name = "elln" max_entries = 20000 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "eduroamlion-inner" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes virtual_server = "eduroamlion-inner" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Instantiating module "eduroammschap" from file /etc/raddb/mods-enabled/eduroammschap rlm_mschap (eduroammschap): authenticating by calling 'ntlm_auth' # Instantiating module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_reject [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/accounting_response # Instantiating module "filter.attrs.accounting_response" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/attrs.accounting_response # Instantiating module "filter.eduroamlocal-a_accept" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/eduroamlocal-a_accept # Instantiating module "filter.eduroamlocal-a_challenge" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/eduroamlocal-a_challenge # Instantiating module "filter.eduroamlocal-a_reject" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/eduroamlocal-a_reject # Instantiating module "filter.eduroamlocal-post_proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/eduroamlocal-post_proxy # Instantiating module "filter.eduroamlocal-pre_proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/eduroamlocal-pre_proxy # Instantiating module "logtosyslog" from file /etc/raddb/mods-enabled/logtosyslog # Instantiating module "pap" from file /etc/raddb/mods-enabled/pap # Instantiating module "detail" from file /etc/raddb/mods-enabled/detail # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf } # server server eduroam-inner { # from file /etc/raddb/sites-enabled/eduroam-inner # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server eduroam-inner server eduroamlocal-auth { # from file /etc/raddb/sites-enabled/eduroamlocal-auth # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading pre-proxy {...} # Loading post-proxy {...} # Loading post-auth {...} } # server eduroamlocal-auth server status { # from file /etc/raddb/sites-enabled/status # Loading authorize {...} } # server status server eduroamlion-inner { # from file /etc/raddb/sites-enabled/eduroamlion-inner # Loading authenticate {...} # Loading authorize {...} # Loading post-proxy {...} # Loading post-auth {...} } # server eduroamlion-inner radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 16006 } listen { type = "status" ipaddr = * port = 18120 client monitor { ipaddr = 137.222.7.147 require_message_authenticator = no secret = <<< secret >>> shortname = "monitor" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client monitorv6 { ipv6addr = 2001:630:e4:81:137:222:7:147 require_message_authenticator = no secret = <<< secret >>> shortname = "monitorv6" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> shortname = "localhost" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } } Listening on auth address * port 16006 bound to server eduroamlocal-auth Listening on status address * port 18120 bound to server status Listening on proxy address * port 36699 Ready to process requests (0) Received Access-Request Id 117 from 172.17.107.208:32770 to 137.222.8.128:16006 length 298 (0) User-Name = "rh13054@my.bristol.ac.uk" (0) Chargeable-User-Identity = 0x00 (0) Location-Capable = Civix-Location (0) Calling-Station-Id = "cc:20:e8:94:41:5a" (0) Called-Station-Id = "1c:6a:7a:bb:a4:40:eduroam" (0) NAS-Port = 13 (0) Cisco-AVPair = "audit-session-id=ac116bd00000245356bc96f8" (0) Acct-Session-Id = "56bc96f8/cc:20:e8:94:41:5a/8989" (0) NAS-IP-Address = 172.17.107.208 (0) NAS-Identifier = "wism8" (0) Airespace-Wlan-Id = 1 (0) Service-Type = Framed-User (0) Framed-MTU = 1300 (0) NAS-Port-Type = Wireless-802.11 (0) Tunnel-Type:0 = VLAN (0) Tunnel-Medium-Type:0 = IEEE-802 (0) Tunnel-Private-Group-Id:0 = "448" (0) EAP-Message = 0x0201001d0172683133303534406d792e62726973746f6c2e61632e756b (0) Message-Authenticator = 0x8bbcfcc5458efc4cd1a6b79c564eb077 (0) # Executing section authorize from file /etc/raddb/sites-enabled/eduroamlocal-auth (0) authorize { (0) policy rewrite_calling_station_id { (0) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (0) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (0) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (0) update request { (0) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (0) --> CC-20-E8-94-41-5A (0) &Calling-Station-Id := CC-20-E8-94-41-5A (0) } # update request = noop (0) [updated] = updated (0) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (0) ... skipping else for request 0: Preceding "if" was taken (0) } # policy rewrite_calling_station_id = updated (0) policy wism-checks { (0) if (Service-Type == "NAS-Prompt-User") { (0) if (Service-Type == "NAS-Prompt-User") -> FALSE (0) } # policy wism-checks = updated (0) [preprocess] = ok (0) if (User-Name =~ /@bris\\.ac\\.uk$/) { (0) if (User-Name =~ /@bris\\.ac\\.uk$/) -> FALSE (0) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) { (0) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) -> FALSE (0) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (0) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) -> TRUE (0) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (0) suffix: Checking for suffix after "@" (0) suffix: Looking up realm "my.bristol.ac.uk" for User-Name = "rh13054@my.bristol.ac.uk" (0) suffix: Found realm "my.bristol.ac.uk" (0) suffix: Adding Stripped-User-Name = "rh13054" (0) suffix: Adding Realm = "my.bristol.ac.uk" (0) suffix: Authentication realm is LOCAL (0) [suffix] = ok (0) update request { (0) Realm := "my.bristol.ac.uk" (0) } # update request = noop (0) } # elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) = ok (0) ... skipping elsif for request 0: Preceding "if" was taken (0) ... skipping else for request 0: Preceding "if" was taken (0) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) { (0) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (0) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) { (0) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (0) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) { (0) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) -> FALSE (0) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) { (0) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) -> FALSE (0) else { (0) eduroameap: Peer sent EAP Response (code 2) ID 1 length 29 (0) eduroameap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eduroameap] = ok (0) } # else = ok (0) } # authorize = updated (0) Found Auth-Type = eduroameap (0) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (0) Auth-Type eduroameap { (0) eduroameap: Peer sent packet with method EAP Identity (1) (0) eduroameap: Calling submodule eap_peap to process data (0) eap_peap: Initiating new EAP-TLS session (0) eap_peap: [eaptls start] = request (0) eduroameap: Sending EAP Request (code 1) ID 2 length 6 (0) eduroameap: EAP session adding &reply:State = 0x981efa54981ce373 (0) [eduroameap] = handled (0) if (handled && (Response-Packet-Type == Access-Challenge)) { (0) EXPAND Response-Packet-Type (0) --> Access-Challenge (0) if (handled && (Response-Packet-Type == Access-Challenge)) -> TRUE (0) if (handled && (Response-Packet-Type == Access-Challenge)) { (0) filter.eduroamlocal-a_challenge: EXPAND %{User-Name} (0) filter.eduroamlocal-a_challenge: --> rh13054@my.bristol.ac.uk (0) filter.eduroamlocal-a_challenge: Matched entry DEFAULT at line 1 (0) [filter.eduroamlocal-a_challenge.post-auth] = updated (0) [handled] = handled (0) } # if (handled && (Response-Packet-Type == Access-Challenge)) = handled (0) } # Auth-Type eduroameap = handled (0) Using Post-Auth-Type Challenge (0) Post-Auth-Type sub-section not found. Ignoring. (0) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (0) Sent Access-Challenge Id 117 from 137.222.8.128:16006 to 172.17.107.208:32770 length 0 (0) EAP-Message = 0x010200061920 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0x981efa54981ce373e1f53dd3e32d7728 (0) Finished request Waking up in 4.9 seconds. (1) Received Access-Request Id 118 from 172.17.107.208:32770 to 137.222.8.128:16006 length 462 (1) User-Name = "rh13054@my.bristol.ac.uk" (1) Chargeable-User-Identity = 0x00 (1) Location-Capable = Civix-Location (1) Calling-Station-Id = "cc:20:e8:94:41:5a" (1) Called-Station-Id = "1c:6a:7a:bb:a4:40:eduroam" (1) NAS-Port = 13 (1) Cisco-AVPair = "audit-session-id=ac116bd00000245356bc96f8" (1) Acct-Session-Id = "56bc96f8/cc:20:e8:94:41:5a/8989" (1) NAS-IP-Address = 172.17.107.208 (1) NAS-Identifier = "wism8" (1) Airespace-Wlan-Id = 1 (1) Service-Type = Framed-User (1) Framed-MTU = 1300 (1) NAS-Port-Type = Wireless-802.11 (1) Tunnel-Type:0 = VLAN (1) Tunnel-Medium-Type:0 = IEEE-802 (1) Tunnel-Private-Group-Id:0 = "448" (1) EAP-Message = 0x020200af1980000000a516030100a00100009c030156bc96f86353775ba32ac8684dd6a78bf8769a0bc7baa4e732b0f1b15f630332204cce26d6a08c5a4411626708a5a75ea642868be8ed3aea79c0836e810b7a51f6003400ffc02cc02bc024c023c00ac009c008c030c02fc028c027c014c013c01200 (1) State = 0x981efa54981ce373e1f53dd3e32d7728 (1) Message-Authenticator = 0xeff71ac975525ab1aefc4b3bbf9f6ffd (1) session-state: No cached attributes (1) # Executing section authorize from file /etc/raddb/sites-enabled/eduroamlocal-auth (1) authorize { (1) policy rewrite_calling_station_id { (1) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (1) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (1) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (1) update request { (1) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (1) --> CC-20-E8-94-41-5A (1) &Calling-Station-Id := CC-20-E8-94-41-5A (1) } # update request = noop (1) [updated] = updated (1) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (1) ... skipping else for request 1: Preceding "if" was taken (1) } # policy rewrite_calling_station_id = updated (1) policy wism-checks { (1) if (Service-Type == "NAS-Prompt-User") { (1) if (Service-Type == "NAS-Prompt-User") -> FALSE (1) } # policy wism-checks = updated (1) [preprocess] = ok (1) if (User-Name =~ /@bris\\.ac\\.uk$/) { (1) if (User-Name =~ /@bris\\.ac\\.uk$/) -> FALSE (1) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) { (1) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) -> FALSE (1) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (1) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) -> TRUE (1) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (1) suffix: Checking for suffix after "@" (1) suffix: Looking up realm "my.bristol.ac.uk" for User-Name = "rh13054@my.bristol.ac.uk" (1) suffix: Found realm "my.bristol.ac.uk" (1) suffix: Adding Stripped-User-Name = "rh13054" (1) suffix: Adding Realm = "my.bristol.ac.uk" (1) suffix: Authentication realm is LOCAL (1) [suffix] = ok (1) update request { (1) Realm := "my.bristol.ac.uk" (1) } # update request = noop (1) } # elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) = ok (1) ... skipping elsif for request 1: Preceding "if" was taken (1) ... skipping else for request 1: Preceding "if" was taken (1) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) { (1) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (1) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) { (1) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (1) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) { (1) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) -> FALSE (1) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) { (1) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) -> FALSE (1) else { (1) eduroameap: Peer sent EAP Response (code 2) ID 2 length 175 (1) eduroameap: Continuing tunnel setup (1) [eduroameap] = ok (1) } # else = ok (1) } # authorize = updated (1) Found Auth-Type = eduroameap (1) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (1) Auth-Type eduroameap { (1) eduroameap: Expiring EAP session with state 0x981efa54981ce373 (1) eduroameap: Finished EAP session with state 0x981efa54981ce373 (1) eduroameap: Previous EAP request found for state 0x981efa54981ce373, released from the list (1) eduroameap: Peer sent packet with method EAP PEAP (25) (1) eduroameap: Calling submodule eap_peap to process data (1) eap_peap: Continuing EAP-TLS (1) eap_peap: Peer indicated complete TLS record size will be 165 bytes (1) eap_peap: Got complete TLS record (165 bytes) (1) eap_peap: [eaptls verify] = length included (1) eap_peap: (other): before/accept initialization (1) eap_peap: TLS_accept: before/accept initialization (1) eap_peap: <<< TLS 1.0 Handshake [length 00a0], ClientHello (1) eap_peap: TLS_accept: SSLv3 read client hello A (1) eap_peap: >>> TLS 1.0 Handshake [length 0039], ServerHello (1) eap_peap: TLS_accept: SSLv3 write server hello A (1) eap_peap: >>> TLS 1.0 Handshake [length 0962], Certificate (1) eap_peap: TLS_accept: SSLv3 write certificate A (1) eap_peap: >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange (1) eap_peap: TLS_accept: SSLv3 write key exchange A (1) eap_peap: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone (1) eap_peap: TLS_accept: SSLv3 write server done A (1) eap_peap: TLS_accept: SSLv3 flush data (1) eap_peap: TLS_accept: Need to read more data: SSLv3 read client certificate A (1) eap_peap: TLS_accept: Need to read more data: SSLv3 read client certificate A (1) eap_peap: In SSL Handshake Phase (1) eap_peap: In SSL Accept mode (1) eap_peap: [eaptls process] = handled (1) eduroameap: Sending EAP Request (code 1) ID 3 length 1004 (1) eduroameap: EAP session adding &reply:State = 0x981efa54991de373 (1) [eduroameap] = handled (1) if (handled && (Response-Packet-Type == Access-Challenge)) { (1) EXPAND Response-Packet-Type (1) --> Access-Challenge (1) if (handled && (Response-Packet-Type == Access-Challenge)) -> TRUE (1) if (handled && (Response-Packet-Type == Access-Challenge)) { (1) filter.eduroamlocal-a_challenge: EXPAND %{User-Name} (1) filter.eduroamlocal-a_challenge: --> rh13054@my.bristol.ac.uk (1) filter.eduroamlocal-a_challenge: Matched entry DEFAULT at line 1 (1) [filter.eduroamlocal-a_challenge.post-auth] = updated (1) [handled] = handled (1) } # if (handled && (Response-Packet-Type == Access-Challenge)) = handled (1) } # Auth-Type eduroameap = handled (1) Using Post-Auth-Type Challenge (1) Post-Auth-Type sub-section not found. Ignoring. (1) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (1) Sent Access-Challenge Id 118 from 137.222.8.128:16006 to 172.17.107.208:32770 length 0 (1) EAP-Message = 0x010303ec19c000000afe160301003902000035030156bc96f869b38bfaa2d1a13e658b3d86aa4d87f742918f290b268daaae3af28200c01400000dff01000100000b00040300010216030109620b00095e00095b00041e3082041a30820302a0030201020203100018300d06092a864886f70d01010505 (1) Message-Authenticator = 0x00000000000000000000000000000000 (1) State = 0x981efa54991de373e1f53dd3e32d7728 (1) Finished request Waking up in 4.9 seconds. (2) Received Access-Request Id 119 from 172.17.107.208:32770 to 137.222.8.128:16006 length 293 (2) User-Name = "rh13054@my.bristol.ac.uk" (2) Chargeable-User-Identity = 0x00 (2) Location-Capable = Civix-Location (2) Calling-Station-Id = "cc:20:e8:94:41:5a" (2) Called-Station-Id = "1c:6a:7a:bb:a4:40:eduroam" (2) NAS-Port = 13 (2) Cisco-AVPair = "audit-session-id=ac116bd00000245356bc96f8" (2) Acct-Session-Id = "56bc96f8/cc:20:e8:94:41:5a/8989" (2) NAS-IP-Address = 172.17.107.208 (2) NAS-Identifier = "wism8" (2) Airespace-Wlan-Id = 1 (2) Service-Type = Framed-User (2) Framed-MTU = 1300 (2) NAS-Port-Type = Wireless-802.11 (2) Tunnel-Type:0 = VLAN (2) Tunnel-Medium-Type:0 = IEEE-802 (2) Tunnel-Private-Group-Id:0 = "448" (2) EAP-Message = 0x020300061900 (2) State = 0x981efa54991de373e1f53dd3e32d7728 (2) Message-Authenticator = 0x1e63c92959288648d0e1fdc5e20b953d (2) session-state: No cached attributes (2) # Executing section authorize from file /etc/raddb/sites-enabled/eduroamlocal-auth (2) authorize { (2) policy rewrite_calling_station_id { (2) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (2) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (2) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (2) update request { (2) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (2) --> CC-20-E8-94-41-5A (2) &Calling-Station-Id := CC-20-E8-94-41-5A (2) } # update request = noop (2) [updated] = updated (2) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (2) ... skipping else for request 2: Preceding "if" was taken (2) } # policy rewrite_calling_station_id = updated (2) policy wism-checks { (2) if (Service-Type == "NAS-Prompt-User") { (2) if (Service-Type == "NAS-Prompt-User") -> FALSE (2) } # policy wism-checks = updated (2) [preprocess] = ok (2) if (User-Name =~ /@bris\\.ac\\.uk$/) { (2) if (User-Name =~ /@bris\\.ac\\.uk$/) -> FALSE (2) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) { (2) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) -> FALSE (2) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (2) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) -> TRUE (2) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (2) suffix: Checking for suffix after "@" (2) suffix: Looking up realm "my.bristol.ac.uk" for User-Name = "rh13054@my.bristol.ac.uk" (2) suffix: Found realm "my.bristol.ac.uk" (2) suffix: Adding Stripped-User-Name = "rh13054" (2) suffix: Adding Realm = "my.bristol.ac.uk" (2) suffix: Authentication realm is LOCAL (2) [suffix] = ok (2) update request { (2) Realm := "my.bristol.ac.uk" (2) } # update request = noop (2) } # elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) = ok (2) ... skipping elsif for request 2: Preceding "if" was taken (2) ... skipping else for request 2: Preceding "if" was taken (2) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) { (2) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (2) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) { (2) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (2) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) { (2) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) -> FALSE (2) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) { (2) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) -> FALSE (2) else { (2) eduroameap: Peer sent EAP Response (code 2) ID 3 length 6 (2) eduroameap: Continuing tunnel setup (2) [eduroameap] = ok (2) } # else = ok (2) } # authorize = updated (2) Found Auth-Type = eduroameap (2) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (2) Auth-Type eduroameap { (2) eduroameap: Expiring EAP session with state 0x981efa54991de373 (2) eduroameap: Finished EAP session with state 0x981efa54991de373 (2) eduroameap: Previous EAP request found for state 0x981efa54991de373, released from the list (2) eduroameap: Peer sent packet with method EAP PEAP (25) (2) eduroameap: Calling submodule eap_peap to process data (2) eap_peap: Continuing EAP-TLS (2) eap_peap: Peer ACKed our handshake fragment (2) eap_peap: [eaptls verify] = request (2) eap_peap: [eaptls process] = handled (2) eduroameap: Sending EAP Request (code 1) ID 4 length 1000 (2) eduroameap: EAP session adding &reply:State = 0x981efa549a1ae373 (2) [eduroameap] = handled (2) if (handled && (Response-Packet-Type == Access-Challenge)) { (2) EXPAND Response-Packet-Type (2) --> Access-Challenge (2) if (handled && (Response-Packet-Type == Access-Challenge)) -> TRUE (2) if (handled && (Response-Packet-Type == Access-Challenge)) { (2) filter.eduroamlocal-a_challenge: EXPAND %{User-Name} (2) filter.eduroamlocal-a_challenge: --> rh13054@my.bristol.ac.uk (2) filter.eduroamlocal-a_challenge: Matched entry DEFAULT at line 1 (2) [filter.eduroamlocal-a_challenge.post-auth] = updated (2) [handled] = handled (2) } # if (handled && (Response-Packet-Type == Access-Challenge)) = handled (2) } # Auth-Type eduroameap = handled (2) Using Post-Auth-Type Challenge (2) Post-Auth-Type sub-section not found. Ignoring. (2) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (2) Sent Access-Challenge Id 119 from 137.222.8.128:16006 to 172.17.107.208:32770 length 0 (2) EAP-Message = 0x010403e819401d2cf1d58f4dba2bd1120d6bedf8276592c881c781799b8f10ae54cb4827b40eb2cf8e47257082cc86b3a2942093f979c9fcd6717ee8896d352f6646c54e584c3a798453deeaf94dbe01ea370644beb43f63b6834155f52416c1c5262706477100b872f8c00c2c836a82b31c164acf9482 (2) Message-Authenticator = 0x00000000000000000000000000000000 (2) State = 0x981efa549a1ae373e1f53dd3e32d7728 (2) Finished request Waking up in 4.9 seconds. (3) Received Access-Request Id 120 from 172.17.107.208:32770 to 137.222.8.128:16006 length 293 (3) User-Name = "rh13054@my.bristol.ac.uk" (3) Chargeable-User-Identity = 0x00 (3) Location-Capable = Civix-Location (3) Calling-Station-Id = "cc:20:e8:94:41:5a" (3) Called-Station-Id = "1c:6a:7a:bb:a4:40:eduroam" (3) NAS-Port = 13 (3) Cisco-AVPair = "audit-session-id=ac116bd00000245356bc96f8" (3) Acct-Session-Id = "56bc96f8/cc:20:e8:94:41:5a/8989" (3) NAS-IP-Address = 172.17.107.208 (3) NAS-Identifier = "wism8" (3) Airespace-Wlan-Id = 1 (3) Service-Type = Framed-User (3) Framed-MTU = 1300 (3) NAS-Port-Type = Wireless-802.11 (3) Tunnel-Type:0 = VLAN (3) Tunnel-Medium-Type:0 = IEEE-802 (3) Tunnel-Private-Group-Id:0 = "448" (3) EAP-Message = 0x020400061900 (3) State = 0x981efa549a1ae373e1f53dd3e32d7728 (3) Message-Authenticator = 0x0de50fe04d0fed307db9b2d6849ca955 (3) session-state: No cached attributes (3) # Executing section authorize from file /etc/raddb/sites-enabled/eduroamlocal-auth (3) authorize { (3) policy rewrite_calling_station_id { (3) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (3) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (3) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (3) update request { (3) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (3) --> CC-20-E8-94-41-5A (3) &Calling-Station-Id := CC-20-E8-94-41-5A (3) } # update request = noop (3) [updated] = updated (3) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (3) ... skipping else for request 3: Preceding "if" was taken (3) } # policy rewrite_calling_station_id = updated (3) policy wism-checks { (3) if (Service-Type == "NAS-Prompt-User") { (3) if (Service-Type == "NAS-Prompt-User") -> FALSE (3) } # policy wism-checks = updated (3) [preprocess] = ok (3) if (User-Name =~ /@bris\\.ac\\.uk$/) { (3) if (User-Name =~ /@bris\\.ac\\.uk$/) -> FALSE (3) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) { (3) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) -> FALSE (3) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (3) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) -> TRUE (3) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (3) suffix: Checking for suffix after "@" (3) suffix: Looking up realm "my.bristol.ac.uk" for User-Name = "rh13054@my.bristol.ac.uk" (3) suffix: Found realm "my.bristol.ac.uk" (3) suffix: Adding Stripped-User-Name = "rh13054" (3) suffix: Adding Realm = "my.bristol.ac.uk" (3) suffix: Authentication realm is LOCAL (3) [suffix] = ok (3) update request { (3) Realm := "my.bristol.ac.uk" (3) } # update request = noop (3) } # elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) = ok (3) ... skipping elsif for request 3: Preceding "if" was taken (3) ... skipping else for request 3: Preceding "if" was taken (3) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) { (3) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (3) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) { (3) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (3) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) { (3) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) -> FALSE (3) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) { (3) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) -> FALSE (3) else { (3) eduroameap: Peer sent EAP Response (code 2) ID 4 length 6 (3) eduroameap: Continuing tunnel setup (3) [eduroameap] = ok (3) } # else = ok (3) } # authorize = updated (3) Found Auth-Type = eduroameap (3) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (3) Auth-Type eduroameap { (3) eduroameap: Expiring EAP session with state 0x981efa549a1ae373 (3) eduroameap: Finished EAP session with state 0x981efa549a1ae373 (3) eduroameap: Previous EAP request found for state 0x981efa549a1ae373, released from the list (3) eduroameap: Peer sent packet with method EAP PEAP (25) (3) eduroameap: Calling submodule eap_peap to process data (3) eap_peap: Continuing EAP-TLS (3) eap_peap: Peer ACKed our handshake fragment (3) eap_peap: [eaptls verify] = request (3) eap_peap: [eaptls process] = handled (3) eduroameap: Sending EAP Request (code 1) ID 5 length 832 (3) eduroameap: EAP session adding &reply:State = 0x981efa549b1be373 (3) [eduroameap] = handled (3) if (handled && (Response-Packet-Type == Access-Challenge)) { (3) EXPAND Response-Packet-Type (3) --> Access-Challenge (3) if (handled && (Response-Packet-Type == Access-Challenge)) -> TRUE (3) if (handled && (Response-Packet-Type == Access-Challenge)) { (3) filter.eduroamlocal-a_challenge: EXPAND %{User-Name} (3) filter.eduroamlocal-a_challenge: --> rh13054@my.bristol.ac.uk (3) filter.eduroamlocal-a_challenge: Matched entry DEFAULT at line 1 (3) [filter.eduroamlocal-a_challenge.post-auth] = updated (3) [handled] = handled (3) } # if (handled && (Response-Packet-Type == Access-Challenge)) = handled (3) } # Auth-Type eduroameap = handled (3) Using Post-Auth-Type Challenge (3) Post-Auth-Type sub-section not found. Ignoring. (3) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (3) Sent Access-Challenge Id 120 from 137.222.8.128:16006 to 172.17.107.208:32770 length 0 (3) EAP-Message = 0x010503401900c1311e301c060355040a1315556e6976657273697479206f662042726973746f6c311f301d060355040b1316495420536572766963657320284e6574776f726b73293129302706092a864886f70d010901161a736572766963652d6465736b4062726973746f6c2e61632e756b3110300e (3) Message-Authenticator = 0x00000000000000000000000000000000 (3) State = 0x981efa549b1be373e1f53dd3e32d7728 (3) Finished request Waking up in 4.9 seconds. (4) Received Access-Request Id 121 from 172.17.107.208:32770 to 137.222.8.128:16006 length 431 (4) User-Name = "rh13054@my.bristol.ac.uk" (4) Chargeable-User-Identity = 0x00 (4) Location-Capable = Civix-Location (4) Calling-Station-Id = "cc:20:e8:94:41:5a" (4) Called-Station-Id = "1c:6a:7a:bb:a4:40:eduroam" (4) NAS-Port = 13 (4) Cisco-AVPair = "audit-session-id=ac116bd00000245356bc96f8" (4) Acct-Session-Id = "56bc96f8/cc:20:e8:94:41:5a/8989" (4) NAS-IP-Address = 172.17.107.208 (4) NAS-Identifier = "wism8" (4) Airespace-Wlan-Id = 1 (4) Service-Type = Framed-User (4) Framed-MTU = 1300 (4) NAS-Port-Type = Wireless-802.11 (4) Tunnel-Type:0 = VLAN (4) Tunnel-Medium-Type:0 = IEEE-802 (4) Tunnel-Private-Group-Id:0 = "448" (4) EAP-Message = 0x020500901980000000861603010046100000424104071ffe5365c1f3368d2a2cac0d32bb3a3110dba5129d45d1064aa9dc76e2c123a3ca7156fe2a8911580f7871a57edece0eedfdc099d135c841c0cd4ad8222df614030100010116030100300546a6f2702bb054f409567ff99a0496c6a86d4b876a26 (4) State = 0x981efa549b1be373e1f53dd3e32d7728 (4) Message-Authenticator = 0x07e74609a90f6701d8699f514c3e6546 (4) session-state: No cached attributes (4) # Executing section authorize from file /etc/raddb/sites-enabled/eduroamlocal-auth (4) authorize { (4) policy rewrite_calling_station_id { (4) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (4) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (4) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (4) update request { (4) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (4) --> CC-20-E8-94-41-5A (4) &Calling-Station-Id := CC-20-E8-94-41-5A (4) } # update request = noop (4) [updated] = updated (4) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (4) ... skipping else for request 4: Preceding "if" was taken (4) } # policy rewrite_calling_station_id = updated (4) policy wism-checks { (4) if (Service-Type == "NAS-Prompt-User") { (4) if (Service-Type == "NAS-Prompt-User") -> FALSE (4) } # policy wism-checks = updated (4) [preprocess] = ok (4) if (User-Name =~ /@bris\\.ac\\.uk$/) { (4) if (User-Name =~ /@bris\\.ac\\.uk$/) -> FALSE (4) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) { (4) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) -> FALSE (4) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (4) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) -> TRUE (4) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (4) suffix: Checking for suffix after "@" (4) suffix: Looking up realm "my.bristol.ac.uk" for User-Name = "rh13054@my.bristol.ac.uk" (4) suffix: Found realm "my.bristol.ac.uk" (4) suffix: Adding Stripped-User-Name = "rh13054" (4) suffix: Adding Realm = "my.bristol.ac.uk" (4) suffix: Authentication realm is LOCAL (4) [suffix] = ok (4) update request { (4) Realm := "my.bristol.ac.uk" (4) } # update request = noop (4) } # elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) = ok (4) ... skipping elsif for request 4: Preceding "if" was taken (4) ... skipping else for request 4: Preceding "if" was taken (4) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) { (4) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (4) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) { (4) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (4) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) { (4) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) -> FALSE (4) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) { (4) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) -> FALSE (4) else { (4) eduroameap: Peer sent EAP Response (code 2) ID 5 length 144 (4) eduroameap: Continuing tunnel setup (4) [eduroameap] = ok (4) } # else = ok (4) } # authorize = updated (4) Found Auth-Type = eduroameap (4) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (4) Auth-Type eduroameap { (4) eduroameap: Expiring EAP session with state 0x981efa549b1be373 (4) eduroameap: Finished EAP session with state 0x981efa549b1be373 (4) eduroameap: Previous EAP request found for state 0x981efa549b1be373, released from the list (4) eduroameap: Peer sent packet with method EAP PEAP (25) (4) eduroameap: Calling submodule eap_peap to process data (4) eap_peap: Continuing EAP-TLS (4) eap_peap: Peer indicated complete TLS record size will be 134 bytes (4) eap_peap: Got complete TLS record (134 bytes) (4) eap_peap: [eaptls verify] = length included (4) eap_peap: <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange (4) eap_peap: TLS_accept: SSLv3 read client key exchange A (4) eap_peap: <<< TLS 1.0 ChangeCipherSpec [length 0001] (4) eap_peap: <<< TLS 1.0 Handshake [length 0010], Finished (4) eap_peap: TLS_accept: SSLv3 read finished A (4) eap_peap: >>> TLS 1.0 ChangeCipherSpec [length 0001] (4) eap_peap: TLS_accept: SSLv3 write change cipher spec A (4) eap_peap: >>> TLS 1.0 Handshake [length 0010], Finished (4) eap_peap: TLS_accept: SSLv3 write finished A (4) eap_peap: TLS_accept: SSLv3 flush data (4) eap_peap: (other): SSL negotiation finished successfully (4) eap_peap: SSL Connection Established (4) eap_peap: [eaptls process] = handled (4) eduroameap: Sending EAP Request (code 1) ID 6 length 65 (4) eduroameap: EAP session adding &reply:State = 0x981efa549c18e373 (4) [eduroameap] = handled (4) if (handled && (Response-Packet-Type == Access-Challenge)) { (4) EXPAND Response-Packet-Type (4) --> Access-Challenge (4) if (handled && (Response-Packet-Type == Access-Challenge)) -> TRUE (4) if (handled && (Response-Packet-Type == Access-Challenge)) { (4) filter.eduroamlocal-a_challenge: EXPAND %{User-Name} (4) filter.eduroamlocal-a_challenge: --> rh13054@my.bristol.ac.uk (4) filter.eduroamlocal-a_challenge: Matched entry DEFAULT at line 1 (4) [filter.eduroamlocal-a_challenge.post-auth] = updated (4) [handled] = handled (4) } # if (handled && (Response-Packet-Type == Access-Challenge)) = handled (4) } # Auth-Type eduroameap = handled (4) Using Post-Auth-Type Challenge (4) Post-Auth-Type sub-section not found. Ignoring. (4) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (4) Sent Access-Challenge Id 121 from 137.222.8.128:16006 to 172.17.107.208:32770 length 0 (4) EAP-Message = 0x0106004119001403010001011603010030fb8c87ae43555ceef1162d1400c0885cd27b9d9ba6b6213dd22e2a864d873531a93a32c87593af7f4226e61dbe8cfd40 (4) Message-Authenticator = 0x00000000000000000000000000000000 (4) State = 0x981efa549c18e373e1f53dd3e32d7728 (4) Finished request Waking up in 4.8 seconds. (5) Received Access-Request Id 122 from 172.17.107.208:32770 to 137.222.8.128:16006 length 293 (5) User-Name = "rh13054@my.bristol.ac.uk" (5) Chargeable-User-Identity = 0x00 (5) Location-Capable = Civix-Location (5) Calling-Station-Id = "cc:20:e8:94:41:5a" (5) Called-Station-Id = "1c:6a:7a:bb:a4:40:eduroam" (5) NAS-Port = 13 (5) Cisco-AVPair = "audit-session-id=ac116bd00000245356bc96f8" (5) Acct-Session-Id = "56bc96f8/cc:20:e8:94:41:5a/8989" (5) NAS-IP-Address = 172.17.107.208 (5) NAS-Identifier = "wism8" (5) Airespace-Wlan-Id = 1 (5) Service-Type = Framed-User (5) Framed-MTU = 1300 (5) NAS-Port-Type = Wireless-802.11 (5) Tunnel-Type:0 = VLAN (5) Tunnel-Medium-Type:0 = IEEE-802 (5) Tunnel-Private-Group-Id:0 = "448" (5) EAP-Message = 0x020600061900 (5) State = 0x981efa549c18e373e1f53dd3e32d7728 (5) Message-Authenticator = 0xbe5923b1e2f0b41fb535cd11788c0709 (5) session-state: No cached attributes (5) # Executing section authorize from file /etc/raddb/sites-enabled/eduroamlocal-auth (5) authorize { (5) policy rewrite_calling_station_id { (5) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (5) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (5) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (5) update request { (5) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (5) --> CC-20-E8-94-41-5A (5) &Calling-Station-Id := CC-20-E8-94-41-5A (5) } # update request = noop (5) [updated] = updated (5) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (5) ... skipping else for request 5: Preceding "if" was taken (5) } # policy rewrite_calling_station_id = updated (5) policy wism-checks { (5) if (Service-Type == "NAS-Prompt-User") { (5) if (Service-Type == "NAS-Prompt-User") -> FALSE (5) } # policy wism-checks = updated (5) [preprocess] = ok (5) if (User-Name =~ /@bris\\.ac\\.uk$/) { (5) if (User-Name =~ /@bris\\.ac\\.uk$/) -> FALSE (5) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) { (5) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) -> FALSE (5) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (5) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) -> TRUE (5) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (5) suffix: Checking for suffix after "@" (5) suffix: Looking up realm "my.bristol.ac.uk" for User-Name = "rh13054@my.bristol.ac.uk" (5) suffix: Found realm "my.bristol.ac.uk" (5) suffix: Adding Stripped-User-Name = "rh13054" (5) suffix: Adding Realm = "my.bristol.ac.uk" (5) suffix: Authentication realm is LOCAL (5) [suffix] = ok (5) update request { (5) Realm := "my.bristol.ac.uk" (5) } # update request = noop (5) } # elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) = ok (5) ... skipping elsif for request 5: Preceding "if" was taken (5) ... skipping else for request 5: Preceding "if" was taken (5) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) { (5) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (5) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) { (5) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (5) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) { (5) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) -> FALSE (5) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) { (5) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) -> FALSE (5) else { (5) eduroameap: Peer sent EAP Response (code 2) ID 6 length 6 (5) eduroameap: Continuing tunnel setup (5) [eduroameap] = ok (5) } # else = ok (5) } # authorize = updated (5) Found Auth-Type = eduroameap (5) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (5) Auth-Type eduroameap { (5) eduroameap: Expiring EAP session with state 0x981efa549c18e373 (5) eduroameap: Finished EAP session with state 0x981efa549c18e373 (5) eduroameap: Previous EAP request found for state 0x981efa549c18e373, released from the list (5) eduroameap: Peer sent packet with method EAP PEAP (25) (5) eduroameap: Calling submodule eap_peap to process data (5) eap_peap: Continuing EAP-TLS (5) eap_peap: Peer ACKed our handshake fragment. handshake is finished (5) eap_peap: [eaptls verify] = success (5) eap_peap: [eaptls process] = success (5) eap_peap: Session established. Decoding tunneled attributes (5) eap_peap: PEAP state TUNNEL ESTABLISHED (5) eduroameap: Sending EAP Request (code 1) ID 7 length 43 (5) eduroameap: EAP session adding &reply:State = 0x981efa549d19e373 (5) [eduroameap] = handled (5) if (handled && (Response-Packet-Type == Access-Challenge)) { (5) EXPAND Response-Packet-Type (5) --> Access-Challenge (5) if (handled && (Response-Packet-Type == Access-Challenge)) -> TRUE (5) if (handled && (Response-Packet-Type == Access-Challenge)) { (5) filter.eduroamlocal-a_challenge: EXPAND %{User-Name} (5) filter.eduroamlocal-a_challenge: --> rh13054@my.bristol.ac.uk (5) filter.eduroamlocal-a_challenge: Matched entry DEFAULT at line 1 (5) [filter.eduroamlocal-a_challenge.post-auth] = updated (5) [handled] = handled (5) } # if (handled && (Response-Packet-Type == Access-Challenge)) = handled (5) } # Auth-Type eduroameap = handled (5) Using Post-Auth-Type Challenge (5) Post-Auth-Type sub-section not found. Ignoring. (5) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (5) Sent Access-Challenge Id 122 from 137.222.8.128:16006 to 172.17.107.208:32770 length 0 (5) EAP-Message = 0x0107002b190017030100206cf97756d79cb2b86784ccbe440a0656afd972de26868be461ee174eed4d57d4 (5) Message-Authenticator = 0x00000000000000000000000000000000 (5) State = 0x981efa549d19e373e1f53dd3e32d7728 (5) Finished request Waking up in 4.8 seconds. (6) Received Access-Request Id 123 from 172.17.107.208:32770 to 137.222.8.128:16006 length 346 (6) User-Name = "rh13054@my.bristol.ac.uk" (6) Chargeable-User-Identity = 0x00 (6) Location-Capable = Civix-Location (6) Calling-Station-Id = "cc:20:e8:94:41:5a" (6) Called-Station-Id = "1c:6a:7a:bb:a4:40:eduroam" (6) NAS-Port = 13 (6) Cisco-AVPair = "audit-session-id=ac116bd00000245356bc96f8" (6) Acct-Session-Id = "56bc96f8/cc:20:e8:94:41:5a/8989" (6) NAS-IP-Address = 172.17.107.208 (6) NAS-Identifier = "wism8" (6) Airespace-Wlan-Id = 1 (6) Service-Type = Framed-User (6) Framed-MTU = 1300 (6) NAS-Port-Type = Wireless-802.11 (6) Tunnel-Type:0 = VLAN (6) Tunnel-Medium-Type:0 = IEEE-802 (6) Tunnel-Private-Group-Id:0 = "448" (6) EAP-Message = 0x0207003b190017030100301233d05d6d8e6580fa58af09e273fdc701024a107ed1123308800faed5432384e90366259726f392fa1385e2bce77e50 (6) State = 0x981efa549d19e373e1f53dd3e32d7728 (6) Message-Authenticator = 0x7ae184660efe3838d1beadbceb1b8e52 (6) session-state: No cached attributes (6) # Executing section authorize from file /etc/raddb/sites-enabled/eduroamlocal-auth (6) authorize { (6) policy rewrite_calling_station_id { (6) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (6) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (6) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (6) update request { (6) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (6) --> CC-20-E8-94-41-5A (6) &Calling-Station-Id := CC-20-E8-94-41-5A (6) } # update request = noop (6) [updated] = updated (6) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (6) ... skipping else for request 6: Preceding "if" was taken (6) } # policy rewrite_calling_station_id = updated (6) policy wism-checks { (6) if (Service-Type == "NAS-Prompt-User") { (6) if (Service-Type == "NAS-Prompt-User") -> FALSE (6) } # policy wism-checks = updated (6) [preprocess] = ok (6) if (User-Name =~ /@bris\\.ac\\.uk$/) { (6) if (User-Name =~ /@bris\\.ac\\.uk$/) -> FALSE (6) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) { (6) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) -> FALSE (6) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (6) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) -> TRUE (6) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (6) suffix: Checking for suffix after "@" (6) suffix: Looking up realm "my.bristol.ac.uk" for User-Name = "rh13054@my.bristol.ac.uk" (6) suffix: Found realm "my.bristol.ac.uk" (6) suffix: Adding Stripped-User-Name = "rh13054" (6) suffix: Adding Realm = "my.bristol.ac.uk" (6) suffix: Authentication realm is LOCAL (6) [suffix] = ok (6) update request { (6) Realm := "my.bristol.ac.uk" (6) } # update request = noop (6) } # elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) = ok (6) ... skipping elsif for request 6: Preceding "if" was taken (6) ... skipping else for request 6: Preceding "if" was taken (6) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) { (6) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (6) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) { (6) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (6) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) { (6) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) -> FALSE (6) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) { (6) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) -> FALSE (6) else { (6) eduroameap: Peer sent EAP Response (code 2) ID 7 length 59 (6) eduroameap: Continuing tunnel setup (6) [eduroameap] = ok (6) } # else = ok (6) } # authorize = updated (6) Found Auth-Type = eduroameap (6) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (6) Auth-Type eduroameap { (6) eduroameap: Expiring EAP session with state 0x981efa549d19e373 (6) eduroameap: Finished EAP session with state 0x981efa549d19e373 (6) eduroameap: Previous EAP request found for state 0x981efa549d19e373, released from the list (6) eduroameap: Peer sent packet with method EAP PEAP (25) (6) eduroameap: Calling submodule eap_peap to process data (6) eap_peap: Continuing EAP-TLS (6) eap_peap: [eaptls verify] = ok (6) eap_peap: Done initial handshake (6) eap_peap: [eaptls process] = ok (6) eap_peap: Session established. Decoding tunneled attributes (6) eap_peap: PEAP state WAITING FOR INNER IDENTITY (6) eap_peap: Identity - rh13054@my.bristol.ac.uk (6) eap_peap: Got inner identity 'rh13054@my.bristol.ac.uk' (6) eap_peap: Setting default EAP type for tunneled EAP session (6) eap_peap: Got tunneled request (6) eap_peap: EAP-Message = 0x0207001d0172683133303534406d792e62726973746f6c2e61632e756b (6) eap_peap: Setting User-Name to rh13054@my.bristol.ac.uk (6) eap_peap: Sending tunneled request to eduroam-inner (6) eap_peap: EAP-Message = 0x0207001d0172683133303534406d792e62726973746f6c2e61632e756b (6) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (6) eap_peap: User-Name = "rh13054@my.bristol.ac.uk" (6) eap_peap: Chargeable-User-Identity = 0x00 (6) eap_peap: Location-Capable = Civix-Location (6) eap_peap: Calling-Station-Id := "CC-20-E8-94-41-5A" (6) eap_peap: Called-Station-Id = "1c:6a:7a:bb:a4:40:eduroam" (6) eap_peap: NAS-Port = 13 (6) eap_peap: Acct-Session-Id = "56bc96f8/cc:20:e8:94:41:5a/8989" (6) eap_peap: NAS-IP-Address = 172.17.107.208 (6) eap_peap: NAS-Identifier = "wism8" (6) eap_peap: Service-Type = Framed-User (6) eap_peap: Framed-MTU = 1300 (6) eap_peap: NAS-Port-Type = Wireless-802.11 (6) eap_peap: Tunnel-Type:0 = VLAN (6) eap_peap: Tunnel-Medium-Type:0 = IEEE-802 (6) eap_peap: Tunnel-Private-Group-Id:0 = "448" (6) eap_peap: Event-Timestamp = "Feb 11 2016 14:13:13 UTC" (6) Virtual server eduroam-inner received request (6) EAP-Message = 0x0207001d0172683133303534406d792e62726973746f6c2e61632e756b (6) FreeRADIUS-Proxied-To = 127.0.0.1 (6) User-Name = "rh13054@my.bristol.ac.uk" (6) Chargeable-User-Identity = 0x00 (6) Location-Capable = Civix-Location (6) Calling-Station-Id := "CC-20-E8-94-41-5A" (6) Called-Station-Id = "1c:6a:7a:bb:a4:40:eduroam" (6) NAS-Port = 13 (6) Acct-Session-Id = "56bc96f8/cc:20:e8:94:41:5a/8989" (6) NAS-IP-Address = 172.17.107.208 (6) NAS-Identifier = "wism8" (6) Service-Type = Framed-User (6) Framed-MTU = 1300 (6) NAS-Port-Type = Wireless-802.11 (6) Tunnel-Type:0 = VLAN (6) Tunnel-Medium-Type:0 = IEEE-802 (6) Tunnel-Private-Group-Id:0 = "448" (6) Event-Timestamp = "Feb 11 2016 14:13:13 UTC" (6) server eduroam-inner { (6) # Executing section authorize from file /etc/raddb/sites-enabled/eduroam-inner (6) authorize { (6) policy rewrite_calling_station_id { (6) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (6) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (6) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (6) update request { (6) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (6) --> CC-20-E8-94-41-5A (6) &Calling-Station-Id := CC-20-E8-94-41-5A (6) } # update request = noop (6) [updated] = updated (6) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (6) ... skipping else for request 6: Preceding "if" was taken (6) } # policy rewrite_calling_station_id = updated (6) [preprocess] = ok (6) uob_auth_log: EXPAND /var/log/radius/radacct/%{%{Virtual-Server}:-UNKNOWN}/auth-detail.log (6) uob_auth_log: --> /var/log/radius/radacct/eduroam-inner/auth-detail.log (6) uob_auth_log: /var/log/radius/radacct/%{%{Virtual-Server}:-UNKNOWN}/auth-detail.log expands to /var/log/radius/radacct/eduroam-inner/auth-detail.log (6) uob_auth_log: EXPAND %t (6) uob_auth_log: --> Thu Feb 11 14:13:13 2016 (6) [uob_auth_log] = ok (6) suffix: Checking for suffix after "@" (6) suffix: Looking up realm "my.bristol.ac.uk" for User-Name = "rh13054@my.bristol.ac.uk" (6) suffix: Found realm "my.bristol.ac.uk" (6) suffix: Adding Stripped-User-Name = "rh13054" (6) suffix: Adding Realm = "my.bristol.ac.uk" (6) suffix: Authentication realm is LOCAL (6) [suffix] = ok (6) [files-eduroam] = noop (6) [eduroammschap] = noop (6) if (User-Name !~ /^iser-linauth(@bris\\.ac\\.uk|@bristol\\.ac\\.uk)?$/){ (6) if (User-Name !~ /^iser-linauth(@bris\\.ac\\.uk|@bristol\\.ac\\.uk)?$/) -> TRUE (6) if (User-Name !~ /^iser-linauth(@bris\\.ac\\.uk|@bristol\\.ac\\.uk)?$/) { (6) if (User-Name !~ /^((UOB|uob)\\\\\\\\?)?[[:lower:]]{2}[[:lower:][:digit:]-]{2,16}(@bris\\.ac\\.uk|@(my\\.)?bristol\\.ac\\.uk)?\\$?$/){ (6) if (User-Name !~ /^((UOB|uob)\\\\\\\\?)?[[:lower:]]{2}[[:lower:][:digit:]-]{2,16}(@bris\\.ac\\.uk|@(my\\.)?bristol\\.ac\\.uk)?\\$?$/) -> FALSE (6) } # if (User-Name !~ /^iser-linauth(@bris\\.ac\\.uk|@bristol\\.ac\\.uk)?$/) = updated (6) eduroameap: Peer sent EAP Response (code 2) ID 7 length 29 (6) eduroameap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (6) [eduroameap] = ok (6) } # authorize = ok (6) Found Auth-Type = eduroameap (6) # Executing group from file /etc/raddb/sites-enabled/eduroam-inner (6) Auth-Type eduroameap { (6) eduroameap: Peer sent packet with method EAP Identity (1) (6) eduroameap: Calling submodule eap_mschapv2 to process data (6) eap_mschapv2: Issuing Challenge (6) eduroameap: Sending EAP Request (code 1) ID 8 length 43 (6) eduroameap: EAP session adding &reply:State = 0x919d8f369195952f (6) [eduroameap] = handled (6) } # Auth-Type eduroameap = handled (6) } # server eduroam-inner (6) Virtual server sending reply (6) EAP-Message = 0x0108002b1a01080026103ff6e5c357de7914777777ca314634f1667265657261646975732d332e302e3130 (6) Message-Authenticator = 0x00000000000000000000000000000000 (6) State = 0x919d8f369195952f63fe725e61e48555 (6) eap_peap: Got tunneled reply code 11 (6) eap_peap: EAP-Message = 0x0108002b1a01080026103ff6e5c357de7914777777ca314634f1667265657261646975732d332e302e3130 (6) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (6) eap_peap: State = 0x919d8f369195952f63fe725e61e48555 (6) eap_peap: Got tunneled reply RADIUS code 11 (6) eap_peap: EAP-Message = 0x0108002b1a01080026103ff6e5c357de7914777777ca314634f1667265657261646975732d332e302e3130 (6) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (6) eap_peap: State = 0x919d8f369195952f63fe725e61e48555 (6) eap_peap: Got tunneled Access-Challenge (6) eduroameap: Sending EAP Request (code 1) ID 8 length 75 (6) eduroameap: EAP session adding &reply:State = 0x981efa549e16e373 (6) [eduroameap] = handled (6) if (handled && (Response-Packet-Type == Access-Challenge)) { (6) EXPAND Response-Packet-Type (6) --> Access-Challenge (6) if (handled && (Response-Packet-Type == Access-Challenge)) -> TRUE (6) if (handled && (Response-Packet-Type == Access-Challenge)) { (6) filter.eduroamlocal-a_challenge: EXPAND %{User-Name} (6) filter.eduroamlocal-a_challenge: --> rh13054@my.bristol.ac.uk (6) filter.eduroamlocal-a_challenge: Matched entry DEFAULT at line 1 (6) [filter.eduroamlocal-a_challenge.post-auth] = updated (6) [handled] = handled (6) } # if (handled && (Response-Packet-Type == Access-Challenge)) = handled (6) } # Auth-Type eduroameap = handled (6) Using Post-Auth-Type Challenge (6) Post-Auth-Type sub-section not found. Ignoring. (6) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (6) Sent Access-Challenge Id 123 from 137.222.8.128:16006 to 172.17.107.208:32770 length 0 (6) EAP-Message = 0x0108004b19001703010040ba882905412b3d92ccda457800ce66a2669d77c43c022e8c0b51c277caf9a7dde4e215fc2fc9d8926324ffe7978fa46a36238350a0e51ca9f919a0db781364f8 (6) Message-Authenticator = 0x00000000000000000000000000000000 (6) State = 0x981efa549e16e373e1f53dd3e32d7728 (6) Finished request Waking up in 4.8 seconds. (7) Received Access-Request Id 124 from 172.17.107.208:32770 to 137.222.8.128:16006 length 410 (7) User-Name = "rh13054@my.bristol.ac.uk" (7) Chargeable-User-Identity = 0x00 (7) Location-Capable = Civix-Location (7) Calling-Station-Id = "cc:20:e8:94:41:5a" (7) Called-Station-Id = "1c:6a:7a:bb:a4:40:eduroam" (7) NAS-Port = 13 (7) Cisco-AVPair = "audit-session-id=ac116bd00000245356bc96f8" (7) Acct-Session-Id = "56bc96f8/cc:20:e8:94:41:5a/8989" (7) NAS-IP-Address = 172.17.107.208 (7) NAS-Identifier = "wism8" (7) Airespace-Wlan-Id = 1 (7) Service-Type = Framed-User (7) Framed-MTU = 1300 (7) NAS-Port-Type = Wireless-802.11 (7) Tunnel-Type:0 = VLAN (7) Tunnel-Medium-Type:0 = IEEE-802 (7) Tunnel-Private-Group-Id:0 = "448" (7) EAP-Message = 0x0208007b190017030100704e4be0a34824500b96c26bb60b675383c8ba8b98794f451453751318a31172dda0900a844b61e7dcfecd5c4c4751f743789902077d2ab31ea0ca9dfb693fb95e0332fdae4831729cb8d4dd63ea8000299fc654b3b10687c0ddbadab3b5e6a3af7eca094c5752ac1060dc0c0b (7) State = 0x981efa549e16e373e1f53dd3e32d7728 (7) Message-Authenticator = 0xe98f5b5301e0c21c17162d2a96f0aaff (7) session-state: No cached attributes (7) # Executing section authorize from file /etc/raddb/sites-enabled/eduroamlocal-auth (7) authorize { (7) policy rewrite_calling_station_id { (7) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (7) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (7) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (7) update request { (7) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (7) --> CC-20-E8-94-41-5A (7) &Calling-Station-Id := CC-20-E8-94-41-5A (7) } # update request = noop (7) [updated] = updated (7) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (7) ... skipping else for request 7: Preceding "if" was taken (7) } # policy rewrite_calling_station_id = updated (7) policy wism-checks { (7) if (Service-Type == "NAS-Prompt-User") { (7) if (Service-Type == "NAS-Prompt-User") -> FALSE (7) } # policy wism-checks = updated (7) [preprocess] = ok (7) if (User-Name =~ /@bris\\.ac\\.uk$/) { (7) if (User-Name =~ /@bris\\.ac\\.uk$/) -> FALSE (7) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) { (7) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) -> FALSE (7) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (7) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) -> TRUE (7) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (7) suffix: Checking for suffix after "@" (7) suffix: Looking up realm "my.bristol.ac.uk" for User-Name = "rh13054@my.bristol.ac.uk" (7) suffix: Found realm "my.bristol.ac.uk" (7) suffix: Adding Stripped-User-Name = "rh13054" (7) suffix: Adding Realm = "my.bristol.ac.uk" (7) suffix: Authentication realm is LOCAL (7) [suffix] = ok (7) update request { (7) Realm := "my.bristol.ac.uk" (7) } # update request = noop (7) } # elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) = ok (7) ... skipping elsif for request 7: Preceding "if" was taken (7) ... skipping else for request 7: Preceding "if" was taken (7) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) { (7) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (7) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) { (7) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (7) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) { (7) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) -> FALSE (7) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) { (7) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) -> FALSE (7) else { (7) eduroameap: Peer sent EAP Response (code 2) ID 8 length 123 (7) eduroameap: Continuing tunnel setup (7) [eduroameap] = ok (7) } # else = ok (7) } # authorize = updated (7) Found Auth-Type = eduroameap (7) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (7) Auth-Type eduroameap { (7) eduroameap: Expiring EAP session with state 0x919d8f369195952f (7) eduroameap: Finished EAP session with state 0x981efa549e16e373 (7) eduroameap: Previous EAP request found for state 0x981efa549e16e373, released from the list (7) eduroameap: Peer sent packet with method EAP PEAP (25) (7) eduroameap: Calling submodule eap_peap to process data (7) eap_peap: Continuing EAP-TLS (7) eap_peap: [eaptls verify] = ok (7) eap_peap: Done initial handshake (7) eap_peap: [eaptls process] = ok (7) eap_peap: Session established. Decoding tunneled attributes (7) eap_peap: PEAP state phase2 (7) eap_peap: EAP method MSCHAPv2 (26) (7) eap_peap: Got tunneled request (7) eap_peap: EAP-Message = 0x020800531a0208004e31c7cbbb991ce348f1ff1866ef40bea17e00000000000000009ea229ea1709d1b8a5d828c7555340f6d22d6a5896e282520072683133303534406d792e62726973746f6c2e61632e756b (7) eap_peap: Setting User-Name to rh13054@my.bristol.ac.uk (7) eap_peap: Sending tunneled request to eduroam-inner (7) eap_peap: EAP-Message = 0x020800531a0208004e31c7cbbb991ce348f1ff1866ef40bea17e00000000000000009ea229ea1709d1b8a5d828c7555340f6d22d6a5896e282520072683133303534406d792e62726973746f6c2e61632e756b (7) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (7) eap_peap: User-Name = "rh13054@my.bristol.ac.uk" (7) eap_peap: State = 0x919d8f369195952f63fe725e61e48555 (7) eap_peap: Chargeable-User-Identity = 0x00 (7) eap_peap: Location-Capable = Civix-Location (7) eap_peap: Calling-Station-Id := "CC-20-E8-94-41-5A" (7) eap_peap: Called-Station-Id = "1c:6a:7a:bb:a4:40:eduroam" (7) eap_peap: NAS-Port = 13 (7) eap_peap: Acct-Session-Id = "56bc96f8/cc:20:e8:94:41:5a/8989" (7) eap_peap: NAS-IP-Address = 172.17.107.208 (7) eap_peap: NAS-Identifier = "wism8" (7) eap_peap: Service-Type = Framed-User (7) eap_peap: Framed-MTU = 1300 (7) eap_peap: NAS-Port-Type = Wireless-802.11 (7) eap_peap: Tunnel-Type:0 = VLAN (7) eap_peap: Tunnel-Medium-Type:0 = IEEE-802 (7) eap_peap: Tunnel-Private-Group-Id:0 = "448" (7) eap_peap: Event-Timestamp = "Feb 11 2016 14:13:13 UTC" (7) Virtual server eduroam-inner received request (7) EAP-Message = 0x020800531a0208004e31c7cbbb991ce348f1ff1866ef40bea17e00000000000000009ea229ea1709d1b8a5d828c7555340f6d22d6a5896e282520072683133303534406d792e62726973746f6c2e61632e756b (7) FreeRADIUS-Proxied-To = 127.0.0.1 (7) User-Name = "rh13054@my.bristol.ac.uk" (7) State = 0x919d8f369195952f63fe725e61e48555 (7) Chargeable-User-Identity = 0x00 (7) Location-Capable = Civix-Location (7) Calling-Station-Id := "CC-20-E8-94-41-5A" (7) Called-Station-Id = "1c:6a:7a:bb:a4:40:eduroam" (7) NAS-Port = 13 (7) Acct-Session-Id = "56bc96f8/cc:20:e8:94:41:5a/8989" (7) NAS-IP-Address = 172.17.107.208 (7) NAS-Identifier = "wism8" (7) Service-Type = Framed-User (7) Framed-MTU = 1300 (7) NAS-Port-Type = Wireless-802.11 (7) Tunnel-Type:0 = VLAN (7) Tunnel-Medium-Type:0 = IEEE-802 (7) Tunnel-Private-Group-Id:0 = "448" (7) Event-Timestamp = "Feb 11 2016 14:13:13 UTC" (7) server eduroam-inner { (7) session-state: No cached attributes (7) # Executing section authorize from file /etc/raddb/sites-enabled/eduroam-inner (7) authorize { (7) policy rewrite_calling_station_id { (7) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (7) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (7) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (7) update request { (7) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (7) --> CC-20-E8-94-41-5A (7) &Calling-Station-Id := CC-20-E8-94-41-5A (7) } # update request = noop (7) [updated] = updated (7) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (7) ... skipping else for request 7: Preceding "if" was taken (7) } # policy rewrite_calling_station_id = updated (7) [preprocess] = ok (7) uob_auth_log: EXPAND /var/log/radius/radacct/%{%{Virtual-Server}:-UNKNOWN}/auth-detail.log (7) uob_auth_log: --> /var/log/radius/radacct/eduroam-inner/auth-detail.log (7) uob_auth_log: /var/log/radius/radacct/%{%{Virtual-Server}:-UNKNOWN}/auth-detail.log expands to /var/log/radius/radacct/eduroam-inner/auth-detail.log (7) uob_auth_log: EXPAND %t (7) uob_auth_log: --> Thu Feb 11 14:13:13 2016 (7) [uob_auth_log] = ok (7) suffix: Checking for suffix after "@" (7) suffix: Looking up realm "my.bristol.ac.uk" for User-Name = "rh13054@my.bristol.ac.uk" (7) suffix: Found realm "my.bristol.ac.uk" (7) suffix: Adding Stripped-User-Name = "rh13054" (7) suffix: Adding Realm = "my.bristol.ac.uk" (7) suffix: Authentication realm is LOCAL (7) [suffix] = ok (7) [files-eduroam] = noop (7) [eduroammschap] = noop (7) if (User-Name !~ /^iser-linauth(@bris\\.ac\\.uk|@bristol\\.ac\\.uk)?$/){ (7) if (User-Name !~ /^iser-linauth(@bris\\.ac\\.uk|@bristol\\.ac\\.uk)?$/) -> TRUE (7) if (User-Name !~ /^iser-linauth(@bris\\.ac\\.uk|@bristol\\.ac\\.uk)?$/) { (7) if (User-Name !~ /^((UOB|uob)\\\\\\\\?)?[[:lower:]]{2}[[:lower:][:digit:]-]{2,16}(@bris\\.ac\\.uk|@(my\\.)?bristol\\.ac\\.uk)?\\$?$/){ (7) if (User-Name !~ /^((UOB|uob)\\\\\\\\?)?[[:lower:]]{2}[[:lower:][:digit:]-]{2,16}(@bris\\.ac\\.uk|@(my\\.)?bristol\\.ac\\.uk)?\\$?$/) -> FALSE (7) } # if (User-Name !~ /^iser-linauth(@bris\\.ac\\.uk|@bristol\\.ac\\.uk)?$/) = updated (7) eduroameap: Peer sent EAP Response (code 2) ID 8 length 83 (7) eduroameap: No EAP Start, assuming it's an on-going EAP conversation (7) [eduroameap] = updated (7) } # authorize = updated (7) Found Auth-Type = eduroameap (7) # Executing group from file /etc/raddb/sites-enabled/eduroam-inner (7) Auth-Type eduroameap { (7) eduroameap: Expiring EAP session with state 0x919d8f369195952f (7) eduroameap: Finished EAP session with state 0x919d8f369195952f (7) eduroameap: Previous EAP request found for state 0x919d8f369195952f, released from the list (7) eduroameap: Peer sent packet with method EAP MSCHAPv2 (26) (7) eduroameap: Calling submodule eap_mschapv2 to process data (7) eap_mschapv2: # Executing group from file /etc/raddb/sites-enabled/eduroam-inner (7) eap_mschapv2: Auth-Type MS-CHAP { (7) eduroammschap: Creating challenge hash with username: rh13054@my.bristol.ac.uk (7) eduroammschap: Client is using MS-CHAPv2 (7) eduroammschap: Executing: /usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{eduroammschap:User-Name}} --challenge=%{eduroammschap:Challenge} --nt-response=%{eduroammschap:NT-Response} : (7) eduroammschap: EXPAND --username=%{%{Stripped-User-Name}:-%{eduroammschap:User-Name}} (7) eduroammschap: --> --username=rh13054 (7) eduroammschap: Creating challenge hash with username: rh13054@my.bristol.ac.uk (7) eduroammschap: EXPAND --challenge=%{eduroammschap:Challenge} (7) eduroammschap: --> --challenge=14803cbc058dde66 (7) eduroammschap: EXPAND --nt-response=%{eduroammschap:NT-Response} (7) eduroammschap: --> --nt-response=9ea229ea1709d1b8a5d828c7555340f6d22d6a5896e28252 (7) eduroammschap: Program returned code (0) and output 'NT_KEY: 252E89FC8DE92B6AE425EDECD096F0AD' (7) eduroammschap: Adding MS-CHAPv2 MPPE keys (7) [eduroammschap] = ok (7) if (reject) { (7) if (reject) -> FALSE (7) } # Auth-Type MS-CHAP = ok (7) MSCHAP Success (7) eduroameap: Sending EAP Request (code 1) ID 9 length 51 (7) eduroameap: EAP session adding &reply:State = 0x919d8f369094952f (7) [eduroameap] = handled (7) } # Auth-Type eduroameap = handled (7) } # server eduroam-inner (7) Virtual server sending reply (7) EAP-Message = 0x010900331a0308002e533d44344142343543313042303538324336433436324532444242393636353136424545344246464137 (7) Message-Authenticator = 0x00000000000000000000000000000000 (7) State = 0x919d8f369094952f63fe725e61e48555 (7) eap_peap: Got tunneled reply code 11 (7) eap_peap: EAP-Message = 0x010900331a0308002e533d44344142343543313042303538324336433436324532444242393636353136424545344246464137 (7) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (7) eap_peap: State = 0x919d8f369094952f63fe725e61e48555 (7) eap_peap: Got tunneled reply RADIUS code 11 (7) eap_peap: EAP-Message = 0x010900331a0308002e533d44344142343543313042303538324336433436324532444242393636353136424545344246464137 (7) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (7) eap_peap: State = 0x919d8f369094952f63fe725e61e48555 (7) eap_peap: Got tunneled Access-Challenge (7) eduroameap: Sending EAP Request (code 1) ID 9 length 91 (7) eduroameap: EAP session adding &reply:State = 0x981efa549f17e373 (7) [eduroameap] = handled (7) if (handled && (Response-Packet-Type == Access-Challenge)) { (7) EXPAND Response-Packet-Type (7) --> Access-Challenge (7) if (handled && (Response-Packet-Type == Access-Challenge)) -> TRUE (7) if (handled && (Response-Packet-Type == Access-Challenge)) { (7) filter.eduroamlocal-a_challenge: EXPAND %{User-Name} (7) filter.eduroamlocal-a_challenge: --> rh13054@my.bristol.ac.uk (7) filter.eduroamlocal-a_challenge: Matched entry DEFAULT at line 1 (7) [filter.eduroamlocal-a_challenge.post-auth] = updated (7) [handled] = handled (7) } # if (handled && (Response-Packet-Type == Access-Challenge)) = handled (7) } # Auth-Type eduroameap = handled (7) Using Post-Auth-Type Challenge (7) Post-Auth-Type sub-section not found. Ignoring. (7) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (7) Sent Access-Challenge Id 124 from 137.222.8.128:16006 to 172.17.107.208:32770 length 0 (7) EAP-Message = 0x0109005b19001703010050144e8cce642b12a0d27a5884f1d6d58cfb21ab1c255ba9f846888593d8dcc354a20e911f3e365cf415aae07f34ff8f452f62f1749bcfdef3d9ec341fa4b8a12e8c8ee6e047e716b8ca8519ba802c4be5 (7) Message-Authenticator = 0x00000000000000000000000000000000 (7) State = 0x981efa549f17e373e1f53dd3e32d7728 (7) Finished request Waking up in 4.7 seconds. (8) Received Access-Request Id 125 from 172.17.107.208:32770 to 137.222.8.128:16006 length 330 (8) User-Name = "rh13054@my.bristol.ac.uk" (8) Chargeable-User-Identity = 0x00 (8) Location-Capable = Civix-Location (8) Calling-Station-Id = "cc:20:e8:94:41:5a" (8) Called-Station-Id = "1c:6a:7a:bb:a4:40:eduroam" (8) NAS-Port = 13 (8) Cisco-AVPair = "audit-session-id=ac116bd00000245356bc96f8" (8) Acct-Session-Id = "56bc96f8/cc:20:e8:94:41:5a/8989" (8) NAS-IP-Address = 172.17.107.208 (8) NAS-Identifier = "wism8" (8) Airespace-Wlan-Id = 1 (8) Service-Type = Framed-User (8) Framed-MTU = 1300 (8) NAS-Port-Type = Wireless-802.11 (8) Tunnel-Type:0 = VLAN (8) Tunnel-Medium-Type:0 = IEEE-802 (8) Tunnel-Private-Group-Id:0 = "448" (8) EAP-Message = 0x0209002b19001703010020e1dbd0fd5d8179f5e1c3679ab3448cd3a755787a38727b83ef72a23a9dca761a (8) State = 0x981efa549f17e373e1f53dd3e32d7728 (8) Message-Authenticator = 0x04ed0520a1e86e807fe67ae52136ca65 (8) session-state: No cached attributes (8) # Executing section authorize from file /etc/raddb/sites-enabled/eduroamlocal-auth (8) authorize { (8) policy rewrite_calling_station_id { (8) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (8) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (8) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (8) update request { (8) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (8) --> CC-20-E8-94-41-5A (8) &Calling-Station-Id := CC-20-E8-94-41-5A (8) } # update request = noop (8) [updated] = updated (8) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (8) ... skipping else for request 8: Preceding "if" was taken (8) } # policy rewrite_calling_station_id = updated (8) policy wism-checks { (8) if (Service-Type == "NAS-Prompt-User") { (8) if (Service-Type == "NAS-Prompt-User") -> FALSE (8) } # policy wism-checks = updated (8) [preprocess] = ok (8) if (User-Name =~ /@bris\\.ac\\.uk$/) { (8) if (User-Name =~ /@bris\\.ac\\.uk$/) -> FALSE (8) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) { (8) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) -> FALSE (8) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (8) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) -> TRUE (8) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (8) suffix: Checking for suffix after "@" (8) suffix: Looking up realm "my.bristol.ac.uk" for User-Name = "rh13054@my.bristol.ac.uk" (8) suffix: Found realm "my.bristol.ac.uk" (8) suffix: Adding Stripped-User-Name = "rh13054" (8) suffix: Adding Realm = "my.bristol.ac.uk" (8) suffix: Authentication realm is LOCAL (8) [suffix] = ok (8) update request { (8) Realm := "my.bristol.ac.uk" (8) } # update request = noop (8) } # elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) = ok (8) ... skipping elsif for request 8: Preceding "if" was taken (8) ... skipping else for request 8: Preceding "if" was taken (8) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) { (8) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (8) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) { (8) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (8) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) { (8) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) -> FALSE (8) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) { (8) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) -> FALSE (8) else { (8) eduroameap: Peer sent EAP Response (code 2) ID 9 length 43 (8) eduroameap: Continuing tunnel setup (8) [eduroameap] = ok (8) } # else = ok (8) } # authorize = updated (8) Found Auth-Type = eduroameap (8) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (8) Auth-Type eduroameap { (8) eduroameap: Expiring EAP session with state 0x919d8f369094952f (8) eduroameap: Finished EAP session with state 0x981efa549f17e373 (8) eduroameap: Previous EAP request found for state 0x981efa549f17e373, released from the list (8) eduroameap: Peer sent packet with method EAP PEAP (25) (8) eduroameap: Calling submodule eap_peap to process data (8) eap_peap: Continuing EAP-TLS (8) eap_peap: [eaptls verify] = ok (8) eap_peap: Done initial handshake (8) eap_peap: [eaptls process] = ok (8) eap_peap: Session established. Decoding tunneled attributes (8) eap_peap: PEAP state phase2 (8) eap_peap: EAP method MSCHAPv2 (26) (8) eap_peap: Got tunneled request (8) eap_peap: EAP-Message = 0x020900061a03 (8) eap_peap: Setting User-Name to rh13054@my.bristol.ac.uk (8) eap_peap: Sending tunneled request to eduroam-inner (8) eap_peap: EAP-Message = 0x020900061a03 (8) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (8) eap_peap: User-Name = "rh13054@my.bristol.ac.uk" (8) eap_peap: State = 0x919d8f369094952f63fe725e61e48555 (8) eap_peap: Chargeable-User-Identity = 0x00 (8) eap_peap: Location-Capable = Civix-Location (8) eap_peap: Calling-Station-Id := "CC-20-E8-94-41-5A" (8) eap_peap: Called-Station-Id = "1c:6a:7a:bb:a4:40:eduroam" (8) eap_peap: NAS-Port = 13 (8) eap_peap: Acct-Session-Id = "56bc96f8/cc:20:e8:94:41:5a/8989" (8) eap_peap: NAS-IP-Address = 172.17.107.208 (8) eap_peap: NAS-Identifier = "wism8" (8) eap_peap: Service-Type = Framed-User (8) eap_peap: Framed-MTU = 1300 (8) eap_peap: NAS-Port-Type = Wireless-802.11 (8) eap_peap: Tunnel-Type:0 = VLAN (8) eap_peap: Tunnel-Medium-Type:0 = IEEE-802 (8) eap_peap: Tunnel-Private-Group-Id:0 = "448" (8) eap_peap: Event-Timestamp = "Feb 11 2016 14:13:13 UTC" (8) Virtual server eduroam-inner received request (8) EAP-Message = 0x020900061a03 (8) FreeRADIUS-Proxied-To = 127.0.0.1 (8) User-Name = "rh13054@my.bristol.ac.uk" (8) State = 0x919d8f369094952f63fe725e61e48555 (8) Chargeable-User-Identity = 0x00 (8) Location-Capable = Civix-Location (8) Calling-Station-Id := "CC-20-E8-94-41-5A" (8) Called-Station-Id = "1c:6a:7a:bb:a4:40:eduroam" (8) NAS-Port = 13 (8) Acct-Session-Id = "56bc96f8/cc:20:e8:94:41:5a/8989" (8) NAS-IP-Address = 172.17.107.208 (8) NAS-Identifier = "wism8" (8) Service-Type = Framed-User (8) Framed-MTU = 1300 (8) NAS-Port-Type = Wireless-802.11 (8) Tunnel-Type:0 = VLAN (8) Tunnel-Medium-Type:0 = IEEE-802 (8) Tunnel-Private-Group-Id:0 = "448" (8) Event-Timestamp = "Feb 11 2016 14:13:13 UTC" (8) server eduroam-inner { (8) session-state: No cached attributes (8) # Executing section authorize from file /etc/raddb/sites-enabled/eduroam-inner (8) authorize { (8) policy rewrite_calling_station_id { (8) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (8) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (8) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (8) update request { (8) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (8) --> CC-20-E8-94-41-5A (8) &Calling-Station-Id := CC-20-E8-94-41-5A (8) } # update request = noop (8) [updated] = updated (8) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (8) ... skipping else for request 8: Preceding "if" was taken (8) } # policy rewrite_calling_station_id = updated (8) [preprocess] = ok (8) uob_auth_log: EXPAND /var/log/radius/radacct/%{%{Virtual-Server}:-UNKNOWN}/auth-detail.log (8) uob_auth_log: --> /var/log/radius/radacct/eduroam-inner/auth-detail.log (8) uob_auth_log: /var/log/radius/radacct/%{%{Virtual-Server}:-UNKNOWN}/auth-detail.log expands to /var/log/radius/radacct/eduroam-inner/auth-detail.log (8) uob_auth_log: EXPAND %t (8) uob_auth_log: --> Thu Feb 11 14:13:13 2016 (8) [uob_auth_log] = ok (8) suffix: Checking for suffix after "@" (8) suffix: Looking up realm "my.bristol.ac.uk" for User-Name = "rh13054@my.bristol.ac.uk" (8) suffix: Found realm "my.bristol.ac.uk" (8) suffix: Adding Stripped-User-Name = "rh13054" (8) suffix: Adding Realm = "my.bristol.ac.uk" (8) suffix: Authentication realm is LOCAL (8) [suffix] = ok (8) [files-eduroam] = noop (8) [eduroammschap] = noop (8) if (User-Name !~ /^iser-linauth(@bris\\.ac\\.uk|@bristol\\.ac\\.uk)?$/){ (8) if (User-Name !~ /^iser-linauth(@bris\\.ac\\.uk|@bristol\\.ac\\.uk)?$/) -> TRUE (8) if (User-Name !~ /^iser-linauth(@bris\\.ac\\.uk|@bristol\\.ac\\.uk)?$/) { (8) if (User-Name !~ /^((UOB|uob)\\\\\\\\?)?[[:lower:]]{2}[[:lower:][:digit:]-]{2,16}(@bris\\.ac\\.uk|@(my\\.)?bristol\\.ac\\.uk)?\\$?$/){ (8) if (User-Name !~ /^((UOB|uob)\\\\\\\\?)?[[:lower:]]{2}[[:lower:][:digit:]-]{2,16}(@bris\\.ac\\.uk|@(my\\.)?bristol\\.ac\\.uk)?\\$?$/) -> FALSE (8) } # if (User-Name !~ /^iser-linauth(@bris\\.ac\\.uk|@bristol\\.ac\\.uk)?$/) = updated (8) eduroameap: Peer sent EAP Response (code 2) ID 9 length 6 (8) eduroameap: No EAP Start, assuming it's an on-going EAP conversation (8) [eduroameap] = updated (8) } # authorize = updated (8) Found Auth-Type = eduroameap (8) # Executing group from file /etc/raddb/sites-enabled/eduroam-inner (8) Auth-Type eduroameap { (8) eduroameap: Expiring EAP session with state 0x919d8f369094952f (8) eduroameap: Finished EAP session with state 0x919d8f369094952f (8) eduroameap: Previous EAP request found for state 0x919d8f369094952f, released from the list (8) eduroameap: Peer sent packet with method EAP MSCHAPv2 (26) (8) eduroameap: Calling submodule eap_mschapv2 to process data (8) eduroameap: Sending EAP Success (code 3) ID 9 length 4 (8) eduroameap: Freeing handler (8) [eduroameap] = ok (8) } # Auth-Type eduroameap = ok (8) # Executing section post-auth from file /etc/raddb/sites-enabled/eduroam-inner (8) post-auth { (8) uob_reply_log: EXPAND /var/log/radius/radacct/%{%{Virtual-Server}:-UNKNOWN}/reply-detail.log (8) uob_reply_log: --> /var/log/radius/radacct/eduroam-inner/reply-detail.log (8) uob_reply_log: /var/log/radius/radacct/%{%{Virtual-Server}:-UNKNOWN}/reply-detail.log expands to /var/log/radius/radacct/eduroam-inner/reply-detail.log (8) uob_reply_log: EXPAND %t (8) uob_reply_log: --> Thu Feb 11 14:13:13 2016 (8) [uob_reply_log] = ok (8) logtofile: EXPAND logtofile.%{%{reply:Packet-Type}:-format} (8) logtofile: --> logtofile.Access-Accept (8) logtofile: EXPAND /var/log/radius/radiusd-%{%{Virtual-Server}:-DEFAULT}.log (8) logtofile: --> /var/log/radius/radiusd-eduroam-inner.log (8) logtofile: EXPAND %t : Login OK: [%{User-Name}] (from client %{Client-Shortname} op %{%{Operator-Name}:-NULL} cli %{Calling-Station-Id} port %{Packet-Dst-Port}) (8) logtofile: --> Thu Feb 11 14:13:13 2016 : Login OK: [rh13054@my.bristol.ac.uk] (from client WISM8 op NULL cli CC-20-E8-94-41-5A port 0) (8) [logtofile] = ok (8) logtosyslog: EXPAND logtosyslog.%{%{reply:Packet-Type}:-format} (8) logtosyslog: --> logtosyslog.Access-Accept (8) logtosyslog: EXPAND %{Virtual-Server}: Login OK: [%{User-Name}] (from client %S cli %{Calling-Station-Id}) (8) logtosyslog: --> eduroam-inner: Login OK: [rh13054@my.bristol.ac.uk] (from client 2016-02-11 14:13:13 cli CC-20-E8-94-41-5A) (8) [logtosyslog] = ok (8) if (User-Name =~ /\\\\\\\\?([^\\\\]+)$/i) { (8) if (User-Name =~ /\\\\\\\\?([^\\\\]+)$/i) -> FALSE (8) else { (8) if (User-Name =~ /^([[:alnum:]-]+)(@bris|@my\\.bris)?/){ (8) if (User-Name =~ /^([[:alnum:]-]+)(@bris|@my\\.bris)?/) -> TRUE (8) if (User-Name =~ /^([[:alnum:]-]+)(@bris|@my\\.bris)?/) { (8) update reply { (8) EXPAND %{1}@bristol.ac.uk (8) --> rh13054@bristol.ac.uk (8) User-Name := rh13054@bristol.ac.uk (8) } # update reply = noop (8) } # if (User-Name =~ /^([[:alnum:]-]+)(@bris|@my\\.bris)?/) = noop (8) } # else = noop (8) } # post-auth = ok (8) } # server eduroam-inner (8) Virtual server sending reply (8) MS-MPPE-Encryption-Policy = Encryption-Allowed (8) MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (8) MS-MPPE-Send-Key = 0x2e350d2d8dc43f08fa9621b5165b85d3 (8) MS-MPPE-Recv-Key = 0xaefb4ff611584aca7f1f34810296b266 (8) EAP-Message = 0x03090004 (8) Message-Authenticator = 0x00000000000000000000000000000000 (8) Stripped-User-Name = "rh13054" (8) User-Name := "rh13054@bristol.ac.uk" (8) eap_peap: Got tunneled reply code 2 (8) eap_peap: MS-MPPE-Encryption-Policy = Encryption-Allowed (8) eap_peap: MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (8) eap_peap: MS-MPPE-Send-Key = 0x2e350d2d8dc43f08fa9621b5165b85d3 (8) eap_peap: MS-MPPE-Recv-Key = 0xaefb4ff611584aca7f1f34810296b266 (8) eap_peap: EAP-Message = 0x03090004 (8) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (8) eap_peap: Stripped-User-Name = "rh13054" (8) eap_peap: User-Name := "rh13054@bristol.ac.uk" (8) eap_peap: Got tunneled reply RADIUS code 2 (8) eap_peap: MS-MPPE-Encryption-Policy = Encryption-Allowed (8) eap_peap: MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (8) eap_peap: MS-MPPE-Send-Key = 0x2e350d2d8dc43f08fa9621b5165b85d3 (8) eap_peap: MS-MPPE-Recv-Key = 0xaefb4ff611584aca7f1f34810296b266 (8) eap_peap: EAP-Message = 0x03090004 (8) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (8) eap_peap: Stripped-User-Name = "rh13054" (8) eap_peap: User-Name := "rh13054@bristol.ac.uk" (8) eap_peap: Tunneled authentication was successful (8) eap_peap: SUCCESS (8) eap_peap: Saving tunneled attributes for later (8) eduroameap: Sending EAP Request (code 1) ID 10 length 43 (8) eduroameap: EAP session adding &reply:State = 0x981efa549014e373 (8) [eduroameap] = handled (8) if (handled && (Response-Packet-Type == Access-Challenge)) { (8) EXPAND Response-Packet-Type (8) --> Access-Challenge (8) if (handled && (Response-Packet-Type == Access-Challenge)) -> TRUE (8) if (handled && (Response-Packet-Type == Access-Challenge)) { (8) filter.eduroamlocal-a_challenge: EXPAND %{User-Name} (8) filter.eduroamlocal-a_challenge: --> rh13054@my.bristol.ac.uk (8) filter.eduroamlocal-a_challenge: Matched entry DEFAULT at line 1 (8) [filter.eduroamlocal-a_challenge.post-auth] = updated (8) [handled] = handled (8) } # if (handled && (Response-Packet-Type == Access-Challenge)) = handled (8) } # Auth-Type eduroameap = handled (8) Using Post-Auth-Type Challenge (8) Post-Auth-Type sub-section not found. Ignoring. (8) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (8) Sent Access-Challenge Id 125 from 137.222.8.128:16006 to 172.17.107.208:32770 length 0 (8) EAP-Message = 0x010a002b19001703010020644bcee70a2e15c09f90c8989a2bb3c7377e7befd677f508e7af102a4c7e17cd (8) Message-Authenticator = 0x00000000000000000000000000000000 (8) State = 0x981efa549014e373e1f53dd3e32d7728 (8) Finished request Waking up in 4.7 seconds. (9) Received Access-Request Id 126 from 172.17.107.208:32770 to 137.222.8.128:16006 length 330 (9) User-Name = "rh13054@my.bristol.ac.uk" (9) Chargeable-User-Identity = 0x00 (9) Location-Capable = Civix-Location (9) Calling-Station-Id = "cc:20:e8:94:41:5a" (9) Called-Station-Id = "1c:6a:7a:bb:a4:40:eduroam" (9) NAS-Port = 13 (9) Cisco-AVPair = "audit-session-id=ac116bd00000245356bc96f8" (9) Acct-Session-Id = "56bc96f8/cc:20:e8:94:41:5a/8989" (9) NAS-IP-Address = 172.17.107.208 (9) NAS-Identifier = "wism8" (9) Airespace-Wlan-Id = 1 (9) Service-Type = Framed-User (9) Framed-MTU = 1300 (9) NAS-Port-Type = Wireless-802.11 (9) Tunnel-Type:0 = VLAN (9) Tunnel-Medium-Type:0 = IEEE-802 (9) Tunnel-Private-Group-Id:0 = "448" (9) EAP-Message = 0x020a002b190017030100206e9ba3848482639810407033735d6b25a9dd35a13bce020e7e8daf9060b68c0a (9) State = 0x981efa549014e373e1f53dd3e32d7728 (9) Message-Authenticator = 0x60ddafc5864bc9eb197d537a200cb56a (9) session-state: No cached attributes (9) # Executing section authorize from file /etc/raddb/sites-enabled/eduroamlocal-auth (9) authorize { (9) policy rewrite_calling_station_id { (9) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (9) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (9) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (9) update request { (9) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (9) --> CC-20-E8-94-41-5A (9) &Calling-Station-Id := CC-20-E8-94-41-5A (9) } # update request = noop (9) [updated] = updated (9) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (9) ... skipping else for request 9: Preceding "if" was taken (9) } # policy rewrite_calling_station_id = updated (9) policy wism-checks { (9) if (Service-Type == "NAS-Prompt-User") { (9) if (Service-Type == "NAS-Prompt-User") -> FALSE (9) } # policy wism-checks = updated (9) [preprocess] = ok (9) if (User-Name =~ /@bris\\.ac\\.uk$/) { (9) if (User-Name =~ /@bris\\.ac\\.uk$/) -> FALSE (9) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) { (9) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) -> FALSE (9) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (9) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) -> TRUE (9) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (9) suffix: Checking for suffix after "@" (9) suffix: Looking up realm "my.bristol.ac.uk" for User-Name = "rh13054@my.bristol.ac.uk" (9) suffix: Found realm "my.bristol.ac.uk" (9) suffix: Adding Stripped-User-Name = "rh13054" (9) suffix: Adding Realm = "my.bristol.ac.uk" (9) suffix: Authentication realm is LOCAL (9) [suffix] = ok (9) update request { (9) Realm := "my.bristol.ac.uk" (9) } # update request = noop (9) } # elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) = ok (9) ... skipping elsif for request 9: Preceding "if" was taken (9) ... skipping else for request 9: Preceding "if" was taken (9) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) { (9) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (9) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) { (9) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (9) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) { (9) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) -> FALSE (9) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) { (9) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) -> FALSE (9) else { (9) eduroameap: Peer sent EAP Response (code 2) ID 10 length 43 (9) eduroameap: Continuing tunnel setup (9) [eduroameap] = ok (9) } # else = ok (9) } # authorize = updated (9) Found Auth-Type = eduroameap (9) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (9) Auth-Type eduroameap { (9) eduroameap: Expiring EAP session with state 0x981efa549014e373 (9) eduroameap: Finished EAP session with state 0x981efa549014e373 (9) eduroameap: Previous EAP request found for state 0x981efa549014e373, released from the list (9) eduroameap: Peer sent packet with method EAP PEAP (25) (9) eduroameap: Calling submodule eap_peap to process data (9) eap_peap: Continuing EAP-TLS (9) eap_peap: [eaptls verify] = ok (9) eap_peap: Done initial handshake (9) eap_peap: [eaptls process] = ok (9) eap_peap: Session established. Decoding tunneled attributes (9) eap_peap: PEAP state send tlv success (9) eap_peap: Received EAP-TLV response (9) eap_peap: Success (9) eap_peap: Using saved attributes from the original Access-Accept (9) eap_peap: Stripped-User-Name = "rh13054" (9) eap_peap: User-Name := "rh13054@bristol.ac.uk" (9) eduroameap: Sending EAP Success (code 3) ID 10 length 4 (9) eduroameap: Freeing handler (9) [eduroameap] = ok (9) if (handled && (Response-Packet-Type == Access-Challenge)) { (9) if (handled && (Response-Packet-Type == Access-Challenge)) -> FALSE (9) if (invalid) { (9) if (invalid) -> FALSE (9) if (fail) { (9) if (fail) -> FALSE (9) } # Auth-Type eduroameap = ok (9) # Executing section post-auth from file /etc/raddb/sites-enabled/eduroamlocal-auth (9) post-auth { (9) policy split_username_nai { (9) if (&User-Name && (&User-Name =~ /^([^@]*)(@([-[:alnum:]]+.[-[:alnum:].]+))?$/)) { (9) if (&User-Name && (&User-Name =~ /^([^@]*)(@([-[:alnum:]]+.[-[:alnum:].]+))?$/)) -> TRUE (9) if (&User-Name && (&User-Name =~ /^([^@]*)(@([-[:alnum:]]+.[-[:alnum:].]+))?$/)) { (9) update request { (9) EXPAND %{1} (9) --> rh13054 (9) &Stripped-User-Name := rh13054 (9) EXPAND %{3} (9) --> my.bristol.ac.uk (9) &Stripped-User-Domain = my.bristol.ac.uk (9) } # update request = noop (9) [updated] = updated (9) } # if (&User-Name && (&User-Name =~ /^([^@]*)(@([-[:alnum:]]+.[-[:alnum:].]+))?$/)) = updated (9) ... skipping else for request 9: Preceding "if" was taken (9) } # policy split_username_nai = updated (9) update reply { (9) EXPAND %{expr:(26 - %H) * 3600} (9) --> 43200 (9) Session-Timeout := 43200 (9) Termination-Action := RADIUS-Request (9) Tunnel-Type := VLAN (9) Tunnel-Medium-Type := IEEE-802 (9) Tunnel-Private-Group-Id := "448" (9) } # update reply = noop (9) if (User-Name =~ /^host\/[a-z0-9\-]+\.[a-z]+\.bris.ac.uk$/) { (9) if (User-Name =~ /^host\/[a-z0-9\-]+\.[a-z]+\.bris.ac.uk$/) -> FALSE (9) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) { (9) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) -> FALSE (9) elsif (User-Name =~ /(@bris\\.ac\\.uk|@(my\\.)?bristol\\.ac\\.uk)$/) { (9) elsif (User-Name =~ /(@bris\\.ac\\.uk|@(my\\.)?bristol\\.ac\\.uk)$/) -> TRUE (9) elsif (User-Name =~ /(@bris\\.ac\\.uk|@(my\\.)?bristol\\.ac\\.uk)$/) { (9) if (reply:User-Name =~ /(^[[:alpha:]]+[[:digit:]]+v@|^[[:alnum:]]+-[[:alnum:]]+@)/) { (9) if (reply:User-Name =~ /(^[[:alpha:]]+[[:digit:]]+v@|^[[:alnum:]]+-[[:alnum:]]+@)/) -> FALSE (9) elsif (reply:User-Name =~ /(uob\\\\?)?([a-z0-9\\-\\.]+)(@bris(tol)?\\.ac\\.uk)/){ (9) elsif (reply:User-Name =~ /(uob\\\\?)?([a-z0-9\\-\\.]+)(@bris(tol)?\\.ac\\.uk)/) -> TRUE (9) elsif (reply:User-Name =~ /(uob\\\\?)?([a-z0-9\\-\\.]+)(@bris(tol)?\\.ac\\.uk)/) { (9) eduroamvlan: EXPAND %{Calling-Station-Id} (9) eduroamvlan: --> CC-20-E8-94-41-5A (9) eduroamvlan: No cache entry found for "CC-20-E8-94-41-5A" (9) eduroamvlan: Creating new cache entry (9) eduroamvlan: EXPAND %{%{Stripped-User-Name}:-%{User-Name}} (9) eduroamvlan: --> rh13054 (9) eduroamvlan: SQL-User-Name set to 'rh13054' rlm_sql (uobsql): Closing connection (0): Hit idle_timeout, was idle for 208 seconds rlm_sql (uobsql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (uobsql): 0 of 0 connections in use. You may need to increase "spare" rlm_sql (uobsql): Opening additional connection (1), 1 of 8 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on db.nomadic-core.bris.ac.uk via TCP/IP, server version 5.5.47-MariaDB-wsrep-log, protocol version 10 rlm_sql (uobsql): Reserved connection (1) (9) eduroamvlan: Executing select query: select if(count(common_username)>0,544,1100) from localprod.current_suspension where common_username = 'rh13054' rlm_sql (uobsql): Released connection (1) (9) eduroamvlan: EXPAND %{%{uobsql:select if(count(common_username)>0,544,1100) from localprod.current_suspension where common_username = '%{Stripped-User-Name}'}:-1100} (9) eduroamvlan: --> 1100 (9) eduroamvlan: Tunnel-Private-Group-Id := 1100 (9) eduroamvlan: Merging cache entry into request (9) eduroamvlan: &request:Tunnel-Private-Group-Id := "1100" (9) eduroamvlan: Committed entry, TTL 600 seconds (9) [eduroamvlan] = updated (9) update reply { (9) EXPAND %{Tunnel-Private-Group-Id} (9) --> 1100 (9) Tunnel-Private-Group-Id := 1100 (9) } # update reply = noop (9) } # elsif (reply:User-Name =~ /(uob\\\\?)?([a-z0-9\\-\\.]+)(@bris(tol)?\\.ac\\.uk)/) = updated (9) ... skipping else for request 9: Preceding "if" was taken (9) } # elsif (User-Name =~ /(@bris\\.ac\\.uk|@(my\\.)?bristol\\.ac\\.uk)$/) = updated (9) ... skipping else for request 9: Preceding "if" was taken (9) if (reply:Tunnel-Private-Group-Id != "666") { (9) if (reply:Tunnel-Private-Group-Id != "666") -> TRUE (9) if (reply:Tunnel-Private-Group-Id != "666") { (9) update request { (9) UOB-Info-Type := 'ACPT' (9) } # update request = noop (9) policy logchecker-acpt { (9) EXPAND %{%{Stripped-User-Name}:-%{User-Name}} (9) --> rh13054 (9) SQL-User-Name set to 'rh13054' rlm_sql (uobsql): Reserved connection (1) (9) Executing query: INSERT INTO logchecker.logs (date, error_code, calling_station_id, user_name, virtual_server, eap_session_resumed, called_station_id, vlan, inner_user_name, operator_name, nas_ip_address, nas_identifier, packet_src_ip, packet_dst_ip, eap_type, client_shortname) VALUES ('2016-02-11 14:13:13', 'ACPT', 'CC-20-E8-94-41-5A', 'rh13054@my.bristol.ac.uk', 'eduroamlocal-auth', 'no', '1c:6a:7a:bb:a4:40:eduroam', '1100', 'rh13054@bristol.ac.uk', '', '172.17.107.208', 'wism8', '137.222.8.128', '172.17.107.208', 'PEAP', 'WISM8') rlm_sql (uobsql): Released connection (1) (9) EXPAND %{uobsql:INSERT INTO logchecker.logs (date, error_code, calling_station_id, user_name, virtual_server, eap_session_resumed, called_station_id, vlan, inner_user_name, operator_name, nas_ip_address, nas_identifier, packet_src_ip, packet_dst_ip, eap_type, client_shortname) VALUES ('%S', 'ACPT', '%{Calling-Station-Id}', '%{User-Name}', '%{Virtual-Server}', '%{%{request:EAP-Session-Resumed}:-no}', '%{Called-Station-Id}', '%{reply:Tunnel-Private-Group-Id}', '%{reply:User-Name}', '%{Operator-Name}', '%{NAS-IP-Address}', '%{NAS-Identifier}', '%{%{reply:Packet-Src-IP-Address}:-%{reply:Packet-Src-IPv6-Address}}', '%{%{reply:Packet-Dst-IP-Address}:-%{reply:Packet-Dst-IPv6-Address}}', '%{request:EAP-Type}', '%{Client-Shortname}') } (9) --> 1 (9) } # policy logchecker-acpt = noop (9) } # if (reply:Tunnel-Private-Group-Id != "666") = noop (9) ... skipping else for request 9: Preceding "if" was taken (9) eduroaminfo: EXPAND %{Virtual-Server}.%{%{UOB-Info-Type}:-UNKN} (9) eduroaminfo: --> eduroamlocal-auth.ACPT (9) eduroaminfo: EXPAND ACPT, %{Calling-Station-Id}, LOGIN SUCCESSFUL [%{User-Name}] [%{Virtual-Server}], [TECH INFO: Resumed: %{%{request:EAP-Session-Resumed}:-no}, CdID: %{Called-Station-Id}, Vin: %{%{request:Tunnel-Private-Group-Id}:-'XXX'}, Vout: %{%{reply:Tunnel-Private-Group-Id}:-XXX}, EAP: %{request:EAP-Type}, Uin: %{request:User-Name}, Uout: %{reply:User-Name}] (9) eduroaminfo: --> ACPT, CC-20-E8-94-41-5A, LOGIN SUCCESSFUL [rh13054@my.bristol.ac.uk] [eduroamlocal-auth], [TECH INFO: Resumed: no, CdID: 1c:6a:7a:bb:a4:40:eduroam, Vin: 1100, Vout: 1100, EAP: PEAP, Uin: rh13054@my.bristol.ac.uk, Uout: rh13054@bristol.ac.uk] (9) [eduroaminfo] = ok (9) logtosyslog: EXPAND logtosyslog.%{%{reply:Packet-Type}:-format} (9) logtosyslog: --> logtosyslog.Access-Accept (9) logtosyslog: EXPAND %{Virtual-Server}: Login OK: [%{User-Name}] (from client %S cli %{Calling-Station-Id}) (9) logtosyslog: --> eduroamlocal-auth: Login OK: [rh13054@my.bristol.ac.uk] (from client 2016-02-11 14:13:13 cli CC-20-E8-94-41-5A) (9) [logtosyslog] = ok (9) logtofile: EXPAND logtofile.%{%{reply:Packet-Type}:-format} (9) logtofile: --> logtofile.Access-Accept (9) logtofile: EXPAND /var/log/radius/radiusd-%{%{Virtual-Server}:-DEFAULT}.log (9) logtofile: --> /var/log/radius/radiusd-eduroamlocal-auth.log (9) logtofile: EXPAND %t : Login OK: [%{User-Name}] (from client %{Client-Shortname} op %{%{Operator-Name}:-NULL} cli %{Calling-Station-Id} port %{Packet-Dst-Port}) (9) logtofile: --> Thu Feb 11 14:13:13 2016 : Login OK: [rh13054@my.bristol.ac.uk] (from client WISM8 op NULL cli CC-20-E8-94-41-5A port 16006) (9) [logtofile] = ok (9) uob_reply_log: EXPAND /var/log/radius/radacct/%{%{Virtual-Server}:-UNKNOWN}/reply-detail.log (9) uob_reply_log: --> /var/log/radius/radacct/eduroamlocal-auth/reply-detail.log (9) uob_reply_log: /var/log/radius/radacct/%{%{Virtual-Server}:-UNKNOWN}/reply-detail.log expands to /var/log/radius/radacct/eduroamlocal-auth/reply-detail.log (9) uob_reply_log: EXPAND %t (9) uob_reply_log: --> Thu Feb 11 14:13:13 2016 (9) [uob_reply_log] = ok (9) filter.eduroamlocal-a_accept: EXPAND %{User-Name} (9) filter.eduroamlocal-a_accept: --> rh13054@my.bristol.ac.uk (9) filter.eduroamlocal-a_accept: Matched entry DEFAULT at line 1 (9) [filter.eduroamlocal-a_accept] = updated (9) } # post-auth = updated (9) Sent Access-Accept Id 126 from 137.222.8.128:16006 to 172.17.107.208:32770 length 0 (9) User-Name := "rh13054@bristol.ac.uk" (9) MS-MPPE-Recv-Key = 0x7dea69fe1fd6363d900a7c146ef8b1fe35e0a062c4ab1257076347e1ccff809d (9) MS-MPPE-Send-Key = 0x07c2d6b664ebd989dae4be5a361c67fd5c4e834bf67ba621bc70fd0556e98d1f (9) EAP-Message = 0x030a0004 (9) Message-Authenticator = 0x00000000000000000000000000000000 (9) Session-Timeout := 43200 (9) Termination-Action := RADIUS-Request (9) Tunnel-Type := VLAN (9) Tunnel-Medium-Type := IEEE-802 (9) Tunnel-Private-Group-Id := "1100" (9) Finished request Waking up in 4.7 seconds. (0) Cleaning up request packet ID 117 with timestamp +207 (1) Cleaning up request packet ID 118 with timestamp +207 (2) Cleaning up request packet ID 119 with timestamp +207 (3) Cleaning up request packet ID 120 with timestamp +207 (4) Cleaning up request packet ID 121 with timestamp +207 (5) Cleaning up request packet ID 122 with timestamp +208 (6) Cleaning up request packet ID 123 with timestamp +208 (7) Cleaning up request packet ID 124 with timestamp +208 (8) Cleaning up request packet ID 125 with timestamp +208 (9) Cleaning up request packet ID 126 with timestamp +208 Ready to process requests (10) Received Access-Request Id 127 from 172.17.107.208:32770 to 137.222.8.128:16006 length 298 (10) User-Name = "rp12811@my.bristol.ac.uk" (10) Chargeable-User-Identity = 0x00 (10) Location-Capable = Civix-Location (10) Calling-Station-Id = "d8:d1:cb:c5:7d:70" (10) Called-Station-Id = "1c:6a:7a:bb:a4:40:eduroam" (10) NAS-Port = 13 (10) Cisco-AVPair = "audit-session-id=ac116bd00000245456bc9783" (10) Acct-Session-Id = "56bc9783/d8:d1:cb:c5:7d:70/8990" (10) NAS-IP-Address = 172.17.107.208 (10) NAS-Identifier = "wism8" (10) Airespace-Wlan-Id = 1 (10) Service-Type = Framed-User (10) Framed-MTU = 1300 (10) NAS-Port-Type = Wireless-802.11 (10) Tunnel-Type:0 = VLAN (10) Tunnel-Medium-Type:0 = IEEE-802 (10) Tunnel-Private-Group-Id:0 = "448" (10) EAP-Message = 0x0201001d0172703132383131406d792e62726973746f6c2e61632e756b (10) Message-Authenticator = 0x8ef1c663237fae19e0f89e348044df81 (10) # Executing section authorize from file /etc/raddb/sites-enabled/eduroamlocal-auth (10) authorize { (10) policy rewrite_calling_station_id { (10) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (10) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (10) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (10) update request { (10) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (10) --> D8-D1-CB-C5-7D-70 (10) &Calling-Station-Id := D8-D1-CB-C5-7D-70 (10) } # update request = noop (10) [updated] = updated (10) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (10) ... skipping else for request 10: Preceding "if" was taken (10) } # policy rewrite_calling_station_id = updated (10) policy wism-checks { (10) if (Service-Type == "NAS-Prompt-User") { (10) if (Service-Type == "NAS-Prompt-User") -> FALSE (10) } # policy wism-checks = updated (10) [preprocess] = ok (10) if (User-Name =~ /@bris\\.ac\\.uk$/) { (10) if (User-Name =~ /@bris\\.ac\\.uk$/) -> FALSE (10) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) { (10) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) -> FALSE (10) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (10) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) -> TRUE (10) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (10) suffix: Checking for suffix after "@" (10) suffix: Looking up realm "my.bristol.ac.uk" for User-Name = "rp12811@my.bristol.ac.uk" (10) suffix: Found realm "my.bristol.ac.uk" (10) suffix: Adding Stripped-User-Name = "rp12811" (10) suffix: Adding Realm = "my.bristol.ac.uk" (10) suffix: Authentication realm is LOCAL (10) [suffix] = ok (10) update request { (10) Realm := "my.bristol.ac.uk" (10) } # update request = noop (10) } # elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) = ok (10) ... skipping elsif for request 10: Preceding "if" was taken (10) ... skipping else for request 10: Preceding "if" was taken (10) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) { (10) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (10) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) { (10) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (10) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) { (10) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) -> FALSE (10) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) { (10) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) -> FALSE (10) else { (10) eduroameap: Peer sent EAP Response (code 2) ID 1 length 29 (10) eduroameap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (10) [eduroameap] = ok (10) } # else = ok (10) } # authorize = updated (10) Found Auth-Type = eduroameap (10) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (10) Auth-Type eduroameap { (10) eduroameap: Peer sent packet with method EAP Identity (1) (10) eduroameap: Calling submodule eap_peap to process data (10) eap_peap: Initiating new EAP-TLS session (10) eap_peap: [eaptls start] = request (10) eduroameap: Sending EAP Request (code 1) ID 2 length 6 (10) eduroameap: EAP session adding &reply:State = 0x6fc3095a6fc110be (10) [eduroameap] = handled (10) if (handled && (Response-Packet-Type == Access-Challenge)) { (10) EXPAND Response-Packet-Type (10) --> Access-Challenge (10) if (handled && (Response-Packet-Type == Access-Challenge)) -> TRUE (10) if (handled && (Response-Packet-Type == Access-Challenge)) { (10) filter.eduroamlocal-a_challenge: EXPAND %{User-Name} (10) filter.eduroamlocal-a_challenge: --> rp12811@my.bristol.ac.uk (10) filter.eduroamlocal-a_challenge: Matched entry DEFAULT at line 1 (10) [filter.eduroamlocal-a_challenge.post-auth] = updated (10) [handled] = handled (10) } # if (handled && (Response-Packet-Type == Access-Challenge)) = handled (10) } # Auth-Type eduroameap = handled (10) Using Post-Auth-Type Challenge (10) Post-Auth-Type sub-section not found. Ignoring. (10) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (10) Sent Access-Challenge Id 127 from 137.222.8.128:16006 to 172.17.107.208:32770 length 0 (10) EAP-Message = 0x010200061920 (10) Message-Authenticator = 0x00000000000000000000000000000000 (10) State = 0x6fc3095a6fc110bedb95671bc9796537 (10) Finished request Waking up in 4.9 seconds. (11) Received Access-Request Id 128 from 172.17.107.208:32770 to 137.222.8.128:16006 length 418 (11) User-Name = "rp12811@my.bristol.ac.uk" (11) Chargeable-User-Identity = 0x00 (11) Location-Capable = Civix-Location (11) Calling-Station-Id = "d8:d1:cb:c5:7d:70" (11) Called-Station-Id = "1c:6a:7a:bb:a4:40:eduroam" (11) NAS-Port = 13 (11) Cisco-AVPair = "audit-session-id=ac116bd00000245456bc9783" (11) Acct-Session-Id = "56bc9783/d8:d1:cb:c5:7d:70/8990" (11) NAS-IP-Address = 172.17.107.208 (11) NAS-Identifier = "wism8" (11) Airespace-Wlan-Id = 1 (11) Service-Type = Framed-User (11) Framed-MTU = 1300 (11) NAS-Port-Type = Wireless-802.11 (11) Tunnel-Type:0 = VLAN (11) Tunnel-Medium-Type:0 = IEEE-802 (11) Tunnel-Private-Group-Id:0 = "448" (11) EAP-Message = 0x02020083198000000079160301007401000070030156bc978240aa554f33a897e2dc8c9d57ef6a5df2432de6256f6cb2f0f3fb001500002800ffc024c023c00ac009c008c028c027c014c013c012003d003c0035002f000ac007c011000500040100001f000a00080006001700180019000b0002010000 (11) State = 0x6fc3095a6fc110bedb95671bc9796537 (11) Message-Authenticator = 0xc464bc7c52c5dde3b6dadb729b24f64b (11) session-state: No cached attributes (11) # Executing section authorize from file /etc/raddb/sites-enabled/eduroamlocal-auth (11) authorize { (11) policy rewrite_calling_station_id { (11) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (11) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (11) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (11) update request { (11) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (11) --> D8-D1-CB-C5-7D-70 (11) &Calling-Station-Id := D8-D1-CB-C5-7D-70 (11) } # update request = noop (11) [updated] = updated (11) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (11) ... skipping else for request 11: Preceding "if" was taken (11) } # policy rewrite_calling_station_id = updated (11) policy wism-checks { (11) if (Service-Type == "NAS-Prompt-User") { (11) if (Service-Type == "NAS-Prompt-User") -> FALSE (11) } # policy wism-checks = updated (11) [preprocess] = ok (11) if (User-Name =~ /@bris\\.ac\\.uk$/) { (11) if (User-Name =~ /@bris\\.ac\\.uk$/) -> FALSE (11) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) { (11) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) -> FALSE (11) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (11) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) -> TRUE (11) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (11) suffix: Checking for suffix after "@" (11) suffix: Looking up realm "my.bristol.ac.uk" for User-Name = "rp12811@my.bristol.ac.uk" (11) suffix: Found realm "my.bristol.ac.uk" (11) suffix: Adding Stripped-User-Name = "rp12811" (11) suffix: Adding Realm = "my.bristol.ac.uk" (11) suffix: Authentication realm is LOCAL (11) [suffix] = ok (11) update request { (11) Realm := "my.bristol.ac.uk" (11) } # update request = noop (11) } # elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) = ok (11) ... skipping elsif for request 11: Preceding "if" was taken (11) ... skipping else for request 11: Preceding "if" was taken (11) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) { (11) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (11) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) { (11) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (11) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) { (11) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) -> FALSE (11) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) { (11) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) -> FALSE (11) else { (11) eduroameap: Peer sent EAP Response (code 2) ID 2 length 131 (11) eduroameap: Continuing tunnel setup (11) [eduroameap] = ok (11) } # else = ok (11) } # authorize = updated (11) Found Auth-Type = eduroameap (11) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (11) Auth-Type eduroameap { (11) eduroameap: Expiring EAP session with state 0x6fc3095a6fc110be (11) eduroameap: Finished EAP session with state 0x6fc3095a6fc110be (11) eduroameap: Previous EAP request found for state 0x6fc3095a6fc110be, released from the list (11) eduroameap: Peer sent packet with method EAP PEAP (25) (11) eduroameap: Calling submodule eap_peap to process data (11) eap_peap: Continuing EAP-TLS (11) eap_peap: Peer indicated complete TLS record size will be 121 bytes (11) eap_peap: Got complete TLS record (121 bytes) (11) eap_peap: [eaptls verify] = length included (11) eap_peap: (other): before/accept initialization (11) eap_peap: TLS_accept: before/accept initialization (11) eap_peap: <<< TLS 1.0 Handshake [length 0074], ClientHello (11) eap_peap: TLS_accept: SSLv3 read client hello A (11) eap_peap: >>> TLS 1.0 Handshake [length 0039], ServerHello (11) eap_peap: TLS_accept: SSLv3 write server hello A (11) eap_peap: >>> TLS 1.0 Handshake [length 0962], Certificate (11) eap_peap: TLS_accept: SSLv3 write certificate A (11) eap_peap: >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange (11) eap_peap: TLS_accept: SSLv3 write key exchange A (11) eap_peap: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone (11) eap_peap: TLS_accept: SSLv3 write server done A (11) eap_peap: TLS_accept: SSLv3 flush data (11) eap_peap: TLS_accept: Need to read more data: SSLv3 read client certificate A (11) eap_peap: TLS_accept: Need to read more data: SSLv3 read client certificate A (11) eap_peap: In SSL Handshake Phase (11) eap_peap: In SSL Accept mode (11) eap_peap: [eaptls process] = handled (11) eduroameap: Sending EAP Request (code 1) ID 3 length 1004 (11) eduroameap: EAP session adding &reply:State = 0x6fc3095a6ec010be (11) [eduroameap] = handled (11) if (handled && (Response-Packet-Type == Access-Challenge)) { (11) EXPAND Response-Packet-Type (11) --> Access-Challenge (11) if (handled && (Response-Packet-Type == Access-Challenge)) -> TRUE (11) if (handled && (Response-Packet-Type == Access-Challenge)) { (11) filter.eduroamlocal-a_challenge: EXPAND %{User-Name} (11) filter.eduroamlocal-a_challenge: --> rp12811@my.bristol.ac.uk (11) filter.eduroamlocal-a_challenge: Matched entry DEFAULT at line 1 (11) [filter.eduroamlocal-a_challenge.post-auth] = updated (11) [handled] = handled (11) } # if (handled && (Response-Packet-Type == Access-Challenge)) = handled (11) } # Auth-Type eduroameap = handled (11) Using Post-Auth-Type Challenge (11) Post-Auth-Type sub-section not found. Ignoring. (11) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (11) Sent Access-Challenge Id 128 from 137.222.8.128:16006 to 172.17.107.208:32770 length 0 (11) EAP-Message = 0x010303ec19c000000afe160301003902000035030156bc9783b2e925c80bf839ebc5123bd5372d5499dc8f383b0ed76bd493f7661f00c01400000dff01000100000b00040300010216030109620b00095e00095b00041e3082041a30820302a0030201020203100018300d06092a864886f70d01010505 (11) Message-Authenticator = 0x00000000000000000000000000000000 (11) State = 0x6fc3095a6ec010bedb95671bc9796537 (11) Finished request Waking up in 4.9 seconds. (12) Received Access-Request Id 129 from 172.17.107.208:32770 to 137.222.8.128:16006 length 293 (12) User-Name = "rp12811@my.bristol.ac.uk" (12) Chargeable-User-Identity = 0x00 (12) Location-Capable = Civix-Location (12) Calling-Station-Id = "d8:d1:cb:c5:7d:70" (12) Called-Station-Id = "1c:6a:7a:bb:a4:40:eduroam" (12) NAS-Port = 13 (12) Cisco-AVPair = "audit-session-id=ac116bd00000245456bc9783" (12) Acct-Session-Id = "56bc9783/d8:d1:cb:c5:7d:70/8990" (12) NAS-IP-Address = 172.17.107.208 (12) NAS-Identifier = "wism8" (12) Airespace-Wlan-Id = 1 (12) Service-Type = Framed-User (12) Framed-MTU = 1300 (12) NAS-Port-Type = Wireless-802.11 (12) Tunnel-Type:0 = VLAN (12) Tunnel-Medium-Type:0 = IEEE-802 (12) Tunnel-Private-Group-Id:0 = "448" (12) EAP-Message = 0x020300061900 (12) State = 0x6fc3095a6ec010bedb95671bc9796537 (12) Message-Authenticator = 0x18fe78145d5c46ceeffe01ec719a606a (12) session-state: No cached attributes (12) # Executing section authorize from file /etc/raddb/sites-enabled/eduroamlocal-auth (12) authorize { (12) policy rewrite_calling_station_id { (12) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (12) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (12) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (12) update request { (12) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (12) --> D8-D1-CB-C5-7D-70 (12) &Calling-Station-Id := D8-D1-CB-C5-7D-70 (12) } # update request = noop (12) [updated] = updated (12) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (12) ... skipping else for request 12: Preceding "if" was taken (12) } # policy rewrite_calling_station_id = updated (12) policy wism-checks { (12) if (Service-Type == "NAS-Prompt-User") { (12) if (Service-Type == "NAS-Prompt-User") -> FALSE (12) } # policy wism-checks = updated (12) [preprocess] = ok (12) if (User-Name =~ /@bris\\.ac\\.uk$/) { (12) if (User-Name =~ /@bris\\.ac\\.uk$/) -> FALSE (12) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) { (12) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) -> FALSE (12) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (12) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) -> TRUE (12) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (12) suffix: Checking for suffix after "@" (12) suffix: Looking up realm "my.bristol.ac.uk" for User-Name = "rp12811@my.bristol.ac.uk" (12) suffix: Found realm "my.bristol.ac.uk" (12) suffix: Adding Stripped-User-Name = "rp12811" (12) suffix: Adding Realm = "my.bristol.ac.uk" (12) suffix: Authentication realm is LOCAL (12) [suffix] = ok (12) update request { (12) Realm := "my.bristol.ac.uk" (12) } # update request = noop (12) } # elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) = ok (12) ... skipping elsif for request 12: Preceding "if" was taken (12) ... skipping else for request 12: Preceding "if" was taken (12) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) { (12) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (12) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) { (12) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (12) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) { (12) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) -> FALSE (12) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) { (12) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) -> FALSE (12) else { (12) eduroameap: Peer sent EAP Response (code 2) ID 3 length 6 (12) eduroameap: Continuing tunnel setup (12) [eduroameap] = ok (12) } # else = ok (12) } # authorize = updated (12) Found Auth-Type = eduroameap (12) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (12) Auth-Type eduroameap { (12) eduroameap: Expiring EAP session with state 0x6fc3095a6ec010be (12) eduroameap: Finished EAP session with state 0x6fc3095a6ec010be (12) eduroameap: Previous EAP request found for state 0x6fc3095a6ec010be, released from the list (12) eduroameap: Peer sent packet with method EAP PEAP (25) (12) eduroameap: Calling submodule eap_peap to process data (12) eap_peap: Continuing EAP-TLS (12) eap_peap: Peer ACKed our handshake fragment (12) eap_peap: [eaptls verify] = request (12) eap_peap: [eaptls process] = handled (12) eduroameap: Sending EAP Request (code 1) ID 4 length 1000 (12) eduroameap: EAP session adding &reply:State = 0x6fc3095a6dc710be (12) [eduroameap] = handled (12) if (handled && (Response-Packet-Type == Access-Challenge)) { (12) EXPAND Response-Packet-Type (12) --> Access-Challenge (12) if (handled && (Response-Packet-Type == Access-Challenge)) -> TRUE (12) if (handled && (Response-Packet-Type == Access-Challenge)) { (12) filter.eduroamlocal-a_challenge: EXPAND %{User-Name} (12) filter.eduroamlocal-a_challenge: --> rp12811@my.bristol.ac.uk (12) filter.eduroamlocal-a_challenge: Matched entry DEFAULT at line 1 (12) [filter.eduroamlocal-a_challenge.post-auth] = updated (12) [handled] = handled (12) } # if (handled && (Response-Packet-Type == Access-Challenge)) = handled (12) } # Auth-Type eduroameap = handled (12) Using Post-Auth-Type Challenge (12) Post-Auth-Type sub-section not found. Ignoring. (12) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (12) Sent Access-Challenge Id 129 from 137.222.8.128:16006 to 172.17.107.208:32770 length 0 (12) EAP-Message = 0x010403e819401d2cf1d58f4dba2bd1120d6bedf8276592c881c781799b8f10ae54cb4827b40eb2cf8e47257082cc86b3a2942093f979c9fcd6717ee8896d352f6646c54e584c3a798453deeaf94dbe01ea370644beb43f63b6834155f52416c1c5262706477100b872f8c00c2c836a82b31c164acf9482 (12) Message-Authenticator = 0x00000000000000000000000000000000 (12) State = 0x6fc3095a6dc710bedb95671bc9796537 (12) Finished request Waking up in 4.9 seconds. (13) Received Access-Request Id 130 from 172.17.107.208:32770 to 137.222.8.128:16006 length 293 (13) User-Name = "rp12811@my.bristol.ac.uk" (13) Chargeable-User-Identity = 0x00 (13) Location-Capable = Civix-Location (13) Calling-Station-Id = "d8:d1:cb:c5:7d:70" (13) Called-Station-Id = "1c:6a:7a:bb:a4:40:eduroam" (13) NAS-Port = 13 (13) Cisco-AVPair = "audit-session-id=ac116bd00000245456bc9783" (13) Acct-Session-Id = "56bc9783/d8:d1:cb:c5:7d:70/8990" (13) NAS-IP-Address = 172.17.107.208 (13) NAS-Identifier = "wism8" (13) Airespace-Wlan-Id = 1 (13) Service-Type = Framed-User (13) Framed-MTU = 1300 (13) NAS-Port-Type = Wireless-802.11 (13) Tunnel-Type:0 = VLAN (13) Tunnel-Medium-Type:0 = IEEE-802 (13) Tunnel-Private-Group-Id:0 = "448" (13) EAP-Message = 0x020400061900 (13) State = 0x6fc3095a6dc710bedb95671bc9796537 (13) Message-Authenticator = 0xf7b8f7787579256f81c04348349f4d5b (13) session-state: No cached attributes (13) # Executing section authorize from file /etc/raddb/sites-enabled/eduroamlocal-auth (13) authorize { (13) policy rewrite_calling_station_id { (13) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (13) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (13) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (13) update request { (13) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (13) --> D8-D1-CB-C5-7D-70 (13) &Calling-Station-Id := D8-D1-CB-C5-7D-70 (13) } # update request = noop (13) [updated] = updated (13) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (13) ... skipping else for request 13: Preceding "if" was taken (13) } # policy rewrite_calling_station_id = updated (13) policy wism-checks { (13) if (Service-Type == "NAS-Prompt-User") { (13) if (Service-Type == "NAS-Prompt-User") -> FALSE (13) } # policy wism-checks = updated (13) [preprocess] = ok (13) if (User-Name =~ /@bris\\.ac\\.uk$/) { (13) if (User-Name =~ /@bris\\.ac\\.uk$/) -> FALSE (13) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) { (13) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) -> FALSE (13) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (13) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) -> TRUE (13) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (13) suffix: Checking for suffix after "@" (13) suffix: Looking up realm "my.bristol.ac.uk" for User-Name = "rp12811@my.bristol.ac.uk" (13) suffix: Found realm "my.bristol.ac.uk" (13) suffix: Adding Stripped-User-Name = "rp12811" (13) suffix: Adding Realm = "my.bristol.ac.uk" (13) suffix: Authentication realm is LOCAL (13) [suffix] = ok (13) update request { (13) Realm := "my.bristol.ac.uk" (13) } # update request = noop (13) } # elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) = ok (13) ... skipping elsif for request 13: Preceding "if" was taken (13) ... skipping else for request 13: Preceding "if" was taken (13) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) { (13) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (13) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) { (13) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (13) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) { (13) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) -> FALSE (13) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) { (13) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) -> FALSE (13) else { (13) eduroameap: Peer sent EAP Response (code 2) ID 4 length 6 (13) eduroameap: Continuing tunnel setup (13) [eduroameap] = ok (13) } # else = ok (13) } # authorize = updated (13) Found Auth-Type = eduroameap (13) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (13) Auth-Type eduroameap { (13) eduroameap: Expiring EAP session with state 0x6fc3095a6dc710be (13) eduroameap: Finished EAP session with state 0x6fc3095a6dc710be (13) eduroameap: Previous EAP request found for state 0x6fc3095a6dc710be, released from the list (13) eduroameap: Peer sent packet with method EAP PEAP (25) (13) eduroameap: Calling submodule eap_peap to process data (13) eap_peap: Continuing EAP-TLS (13) eap_peap: Peer ACKed our handshake fragment (13) eap_peap: [eaptls verify] = request (13) eap_peap: [eaptls process] = handled (13) eduroameap: Sending EAP Request (code 1) ID 5 length 832 (13) eduroameap: EAP session adding &reply:State = 0x6fc3095a6cc610be (13) [eduroameap] = handled (13) if (handled && (Response-Packet-Type == Access-Challenge)) { (13) EXPAND Response-Packet-Type (13) --> Access-Challenge (13) if (handled && (Response-Packet-Type == Access-Challenge)) -> TRUE (13) if (handled && (Response-Packet-Type == Access-Challenge)) { (13) filter.eduroamlocal-a_challenge: EXPAND %{User-Name} (13) filter.eduroamlocal-a_challenge: --> rp12811@my.bristol.ac.uk (13) filter.eduroamlocal-a_challenge: Matched entry DEFAULT at line 1 (13) [filter.eduroamlocal-a_challenge.post-auth] = updated (13) [handled] = handled (13) } # if (handled && (Response-Packet-Type == Access-Challenge)) = handled (13) } # Auth-Type eduroameap = handled (13) Using Post-Auth-Type Challenge (13) Post-Auth-Type sub-section not found. Ignoring. (13) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (13) Sent Access-Challenge Id 130 from 137.222.8.128:16006 to 172.17.107.208:32770 length 0 (13) EAP-Message = 0x010503401900c1311e301c060355040a1315556e6976657273697479206f662042726973746f6c311f301d060355040b1316495420536572766963657320284e6574776f726b73293129302706092a864886f70d010901161a736572766963652d6465736b4062726973746f6c2e61632e756b3110300e (13) Message-Authenticator = 0x00000000000000000000000000000000 (13) State = 0x6fc3095a6cc610bedb95671bc9796537 (13) Finished request Waking up in 4.9 seconds. (14) Received Access-Request Id 131 from 172.17.107.208:32770 to 137.222.8.128:16006 length 298 (14) User-Name = "rp12811@my.bristol.ac.uk" (14) Chargeable-User-Identity = 0x00 (14) Location-Capable = Civix-Location (14) Calling-Station-Id = "d8:d1:cb:c5:7d:70" (14) Called-Station-Id = "1c:6a:7a:bb:a4:40:eduroam" (14) NAS-Port = 13 (14) Cisco-AVPair = "audit-session-id=ac116bd00000245456bc9783" (14) Acct-Session-Id = "56bc9783/d8:d1:cb:c5:7d:70/8990" (14) NAS-IP-Address = 172.17.107.208 (14) NAS-Identifier = "wism8" (14) Airespace-Wlan-Id = 1 (14) Service-Type = Framed-User (14) Framed-MTU = 1300 (14) NAS-Port-Type = Wireless-802.11 (14) Tunnel-Type:0 = VLAN (14) Tunnel-Medium-Type:0 = IEEE-802 (14) Tunnel-Private-Group-Id:0 = "448" (14) EAP-Message = 0x0201001d0172703132383131406d792e62726973746f6c2e61632e756b (14) Message-Authenticator = 0x76c266bab5a23bab9e9878b7e226959f (14) # Executing section authorize from file /etc/raddb/sites-enabled/eduroamlocal-auth (14) authorize { (14) policy rewrite_calling_station_id { (14) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (14) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (14) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (14) update request { (14) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (14) --> D8-D1-CB-C5-7D-70 (14) &Calling-Station-Id := D8-D1-CB-C5-7D-70 (14) } # update request = noop (14) [updated] = updated (14) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (14) ... skipping else for request 14: Preceding "if" was taken (14) } # policy rewrite_calling_station_id = updated (14) policy wism-checks { (14) if (Service-Type == "NAS-Prompt-User") { (14) if (Service-Type == "NAS-Prompt-User") -> FALSE (14) } # policy wism-checks = updated (14) [preprocess] = ok (14) if (User-Name =~ /@bris\\.ac\\.uk$/) { (14) if (User-Name =~ /@bris\\.ac\\.uk$/) -> FALSE (14) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) { (14) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) -> FALSE (14) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (14) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) -> TRUE (14) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (14) suffix: Checking for suffix after "@" (14) suffix: Looking up realm "my.bristol.ac.uk" for User-Name = "rp12811@my.bristol.ac.uk" (14) suffix: Found realm "my.bristol.ac.uk" (14) suffix: Adding Stripped-User-Name = "rp12811" (14) suffix: Adding Realm = "my.bristol.ac.uk" (14) suffix: Authentication realm is LOCAL (14) [suffix] = ok (14) update request { (14) Realm := "my.bristol.ac.uk" (14) } # update request = noop (14) } # elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) = ok (14) ... skipping elsif for request 14: Preceding "if" was taken (14) ... skipping else for request 14: Preceding "if" was taken (14) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) { (14) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (14) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) { (14) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (14) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) { (14) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) -> FALSE (14) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) { (14) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) -> FALSE (14) else { (14) eduroameap: Peer sent EAP Response (code 2) ID 1 length 29 (14) eduroameap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (14) [eduroameap] = ok (14) } # else = ok (14) } # authorize = updated (14) Found Auth-Type = eduroameap (14) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (14) Auth-Type eduroameap { (14) eduroameap: Peer sent packet with method EAP Identity (1) (14) eduroameap: Calling submodule eap_peap to process data (14) eap_peap: Initiating new EAP-TLS session (14) eap_peap: [eaptls start] = request (14) eduroameap: Sending EAP Request (code 1) ID 2 length 6 (14) eduroameap: EAP session adding &reply:State = 0x50612e0f50633724 (14) [eduroameap] = handled (14) if (handled && (Response-Packet-Type == Access-Challenge)) { (14) EXPAND Response-Packet-Type (14) --> Access-Challenge (14) if (handled && (Response-Packet-Type == Access-Challenge)) -> TRUE (14) if (handled && (Response-Packet-Type == Access-Challenge)) { (14) filter.eduroamlocal-a_challenge: EXPAND %{User-Name} (14) filter.eduroamlocal-a_challenge: --> rp12811@my.bristol.ac.uk (14) filter.eduroamlocal-a_challenge: Matched entry DEFAULT at line 1 (14) [filter.eduroamlocal-a_challenge.post-auth] = updated (14) [handled] = handled (14) } # if (handled && (Response-Packet-Type == Access-Challenge)) = handled (14) } # Auth-Type eduroameap = handled (14) Using Post-Auth-Type Challenge (14) Post-Auth-Type sub-section not found. Ignoring. (14) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (14) Sent Access-Challenge Id 131 from 137.222.8.128:16006 to 172.17.107.208:32770 length 0 (14) EAP-Message = 0x010200061920 (14) Message-Authenticator = 0x00000000000000000000000000000000 (14) State = 0x50612e0f50633724a214eec3e36f5ee8 (14) Finished request Waking up in 3.9 seconds. (15) Received Access-Request Id 132 from 172.17.107.208:32770 to 137.222.8.128:16006 length 418 (15) User-Name = "rp12811@my.bristol.ac.uk" (15) Chargeable-User-Identity = 0x00 (15) Location-Capable = Civix-Location (15) Calling-Station-Id = "d8:d1:cb:c5:7d:70" (15) Called-Station-Id = "1c:6a:7a:bb:a4:40:eduroam" (15) NAS-Port = 13 (15) Cisco-AVPair = "audit-session-id=ac116bd00000245456bc9783" (15) Acct-Session-Id = "56bc9783/d8:d1:cb:c5:7d:70/8990" (15) NAS-IP-Address = 172.17.107.208 (15) NAS-Identifier = "wism8" (15) Airespace-Wlan-Id = 1 (15) Service-Type = Framed-User (15) Framed-MTU = 1300 (15) NAS-Port-Type = Wireless-802.11 (15) Tunnel-Type:0 = VLAN (15) Tunnel-Medium-Type:0 = IEEE-802 (15) Tunnel-Private-Group-Id:0 = "448" (15) EAP-Message = 0x02020083198000000079160301007401000070030156bc97835125e194a702cc80fc08813897923c4cedc48f45b786af7d1fd85be600002800ffc024c023c00ac009c008c028c027c014c013c012003d003c0035002f000ac007c011000500040100001f000a00080006001700180019000b0002010000 (15) State = 0x50612e0f50633724a214eec3e36f5ee8 (15) Message-Authenticator = 0xd8ea393995878445c9baa2148d1cd680 (15) session-state: No cached attributes (15) # Executing section authorize from file /etc/raddb/sites-enabled/eduroamlocal-auth (15) authorize { (15) policy rewrite_calling_station_id { (15) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (15) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (15) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (15) update request { (15) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (15) --> D8-D1-CB-C5-7D-70 (15) &Calling-Station-Id := D8-D1-CB-C5-7D-70 (15) } # update request = noop (15) [updated] = updated (15) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (15) ... skipping else for request 15: Preceding "if" was taken (15) } # policy rewrite_calling_station_id = updated (15) policy wism-checks { (15) if (Service-Type == "NAS-Prompt-User") { (15) if (Service-Type == "NAS-Prompt-User") -> FALSE (15) } # policy wism-checks = updated (15) [preprocess] = ok (15) if (User-Name =~ /@bris\\.ac\\.uk$/) { (15) if (User-Name =~ /@bris\\.ac\\.uk$/) -> FALSE (15) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) { (15) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) -> FALSE (15) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (15) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) -> TRUE (15) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (15) suffix: Checking for suffix after "@" (15) suffix: Looking up realm "my.bristol.ac.uk" for User-Name = "rp12811@my.bristol.ac.uk" (15) suffix: Found realm "my.bristol.ac.uk" (15) suffix: Adding Stripped-User-Name = "rp12811" (15) suffix: Adding Realm = "my.bristol.ac.uk" (15) suffix: Authentication realm is LOCAL (15) [suffix] = ok (15) update request { (15) Realm := "my.bristol.ac.uk" (15) } # update request = noop (15) } # elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) = ok (15) ... skipping elsif for request 15: Preceding "if" was taken (15) ... skipping else for request 15: Preceding "if" was taken (15) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) { (15) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (15) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) { (15) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (15) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) { (15) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) -> FALSE (15) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) { (15) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) -> FALSE (15) else { (15) eduroameap: Peer sent EAP Response (code 2) ID 2 length 131 (15) eduroameap: Continuing tunnel setup (15) [eduroameap] = ok (15) } # else = ok (15) } # authorize = updated (15) Found Auth-Type = eduroameap (15) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (15) Auth-Type eduroameap { (15) eduroameap: Expiring EAP session with state 0x6fc3095a6cc610be (15) eduroameap: Finished EAP session with state 0x50612e0f50633724 (15) eduroameap: Previous EAP request found for state 0x50612e0f50633724, released from the list (15) eduroameap: Peer sent packet with method EAP PEAP (25) (15) eduroameap: Calling submodule eap_peap to process data (15) eap_peap: Continuing EAP-TLS (15) eap_peap: Peer indicated complete TLS record size will be 121 bytes (15) eap_peap: Got complete TLS record (121 bytes) (15) eap_peap: [eaptls verify] = length included (15) eap_peap: (other): before/accept initialization (15) eap_peap: TLS_accept: before/accept initialization (15) eap_peap: <<< TLS 1.0 Handshake [length 0074], ClientHello (15) eap_peap: TLS_accept: SSLv3 read client hello A (15) eap_peap: >>> TLS 1.0 Handshake [length 0039], ServerHello (15) eap_peap: TLS_accept: SSLv3 write server hello A (15) eap_peap: >>> TLS 1.0 Handshake [length 0962], Certificate (15) eap_peap: TLS_accept: SSLv3 write certificate A (15) eap_peap: >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange (15) eap_peap: TLS_accept: SSLv3 write key exchange A (15) eap_peap: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone (15) eap_peap: TLS_accept: SSLv3 write server done A (15) eap_peap: TLS_accept: SSLv3 flush data (15) eap_peap: TLS_accept: Need to read more data: SSLv3 read client certificate A (15) eap_peap: TLS_accept: Need to read more data: SSLv3 read client certificate A (15) eap_peap: In SSL Handshake Phase (15) eap_peap: In SSL Accept mode (15) eap_peap: [eaptls process] = handled (15) eduroameap: Sending EAP Request (code 1) ID 3 length 1004 (15) eduroameap: EAP session adding &reply:State = 0x50612e0f51623724 (15) [eduroameap] = handled (15) if (handled && (Response-Packet-Type == Access-Challenge)) { (15) EXPAND Response-Packet-Type (15) --> Access-Challenge (15) if (handled && (Response-Packet-Type == Access-Challenge)) -> TRUE (15) if (handled && (Response-Packet-Type == Access-Challenge)) { (15) filter.eduroamlocal-a_challenge: EXPAND %{User-Name} (15) filter.eduroamlocal-a_challenge: --> rp12811@my.bristol.ac.uk (15) filter.eduroamlocal-a_challenge: Matched entry DEFAULT at line 1 (15) [filter.eduroamlocal-a_challenge.post-auth] = updated (15) [handled] = handled (15) } # if (handled && (Response-Packet-Type == Access-Challenge)) = handled (15) } # Auth-Type eduroameap = handled (15) Using Post-Auth-Type Challenge (15) Post-Auth-Type sub-section not found. Ignoring. (15) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (15) Sent Access-Challenge Id 132 from 137.222.8.128:16006 to 172.17.107.208:32770 length 0 (15) EAP-Message = 0x010303ec19c000000afe160301003902000035030156bc9784ddfc34d777c621bfa7c09ea7dba760caae6ca5d9671a5b798bc88e2300c01400000dff01000100000b00040300010216030109620b00095e00095b00041e3082041a30820302a0030201020203100018300d06092a864886f70d01010505 (15) Message-Authenticator = 0x00000000000000000000000000000000 (15) State = 0x50612e0f51623724a214eec3e36f5ee8 (15) Finished request Waking up in 3.8 seconds. (16) Received Access-Request Id 133 from 172.17.107.208:32770 to 137.222.8.128:16006 length 293 (16) User-Name = "rp12811@my.bristol.ac.uk" (16) Chargeable-User-Identity = 0x00 (16) Location-Capable = Civix-Location (16) Calling-Station-Id = "d8:d1:cb:c5:7d:70" (16) Called-Station-Id = "1c:6a:7a:bb:a4:40:eduroam" (16) NAS-Port = 13 (16) Cisco-AVPair = "audit-session-id=ac116bd00000245456bc9783" (16) Acct-Session-Id = "56bc9783/d8:d1:cb:c5:7d:70/8990" (16) NAS-IP-Address = 172.17.107.208 (16) NAS-Identifier = "wism8" (16) Airespace-Wlan-Id = 1 (16) Service-Type = Framed-User (16) Framed-MTU = 1300 (16) NAS-Port-Type = Wireless-802.11 (16) Tunnel-Type:0 = VLAN (16) Tunnel-Medium-Type:0 = IEEE-802 (16) Tunnel-Private-Group-Id:0 = "448" (16) EAP-Message = 0x020300061900 (16) State = 0x50612e0f51623724a214eec3e36f5ee8 (16) Message-Authenticator = 0x08237bdbd543ad1e728b2a5507dd8740 (16) session-state: No cached attributes (16) # Executing section authorize from file /etc/raddb/sites-enabled/eduroamlocal-auth (16) authorize { (16) policy rewrite_calling_station_id { (16) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (16) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (16) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (16) update request { (16) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (16) --> D8-D1-CB-C5-7D-70 (16) &Calling-Station-Id := D8-D1-CB-C5-7D-70 (16) } # update request = noop (16) [updated] = updated (16) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (16) ... skipping else for request 16: Preceding "if" was taken (16) } # policy rewrite_calling_station_id = updated (16) policy wism-checks { (16) if (Service-Type == "NAS-Prompt-User") { (16) if (Service-Type == "NAS-Prompt-User") -> FALSE (16) } # policy wism-checks = updated (16) [preprocess] = ok (16) if (User-Name =~ /@bris\\.ac\\.uk$/) { (16) if (User-Name =~ /@bris\\.ac\\.uk$/) -> FALSE (16) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) { (16) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) -> FALSE (16) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (16) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) -> TRUE (16) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (16) suffix: Checking for suffix after "@" (16) suffix: Looking up realm "my.bristol.ac.uk" for User-Name = "rp12811@my.bristol.ac.uk" (16) suffix: Found realm "my.bristol.ac.uk" (16) suffix: Adding Stripped-User-Name = "rp12811" (16) suffix: Adding Realm = "my.bristol.ac.uk" (16) suffix: Authentication realm is LOCAL (16) [suffix] = ok (16) update request { (16) Realm := "my.bristol.ac.uk" (16) } # update request = noop (16) } # elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) = ok (16) ... skipping elsif for request 16: Preceding "if" was taken (16) ... skipping else for request 16: Preceding "if" was taken (16) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) { (16) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (16) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) { (16) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (16) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) { (16) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) -> FALSE (16) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) { (16) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) -> FALSE (16) else { (16) eduroameap: Peer sent EAP Response (code 2) ID 3 length 6 (16) eduroameap: Continuing tunnel setup (16) [eduroameap] = ok (16) } # else = ok (16) } # authorize = updated (16) Found Auth-Type = eduroameap (16) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (16) Auth-Type eduroameap { (16) eduroameap: Expiring EAP session with state 0x6fc3095a6cc610be (16) eduroameap: Finished EAP session with state 0x50612e0f51623724 (16) eduroameap: Previous EAP request found for state 0x50612e0f51623724, released from the list (16) eduroameap: Peer sent packet with method EAP PEAP (25) (16) eduroameap: Calling submodule eap_peap to process data (16) eap_peap: Continuing EAP-TLS (16) eap_peap: Peer ACKed our handshake fragment (16) eap_peap: [eaptls verify] = request (16) eap_peap: [eaptls process] = handled (16) eduroameap: Sending EAP Request (code 1) ID 4 length 1000 (16) eduroameap: EAP session adding &reply:State = 0x50612e0f52653724 (16) [eduroameap] = handled (16) if (handled && (Response-Packet-Type == Access-Challenge)) { (16) EXPAND Response-Packet-Type (16) --> Access-Challenge (16) if (handled && (Response-Packet-Type == Access-Challenge)) -> TRUE (16) if (handled && (Response-Packet-Type == Access-Challenge)) { (16) filter.eduroamlocal-a_challenge: EXPAND %{User-Name} (16) filter.eduroamlocal-a_challenge: --> rp12811@my.bristol.ac.uk (16) filter.eduroamlocal-a_challenge: Matched entry DEFAULT at line 1 (16) [filter.eduroamlocal-a_challenge.post-auth] = updated (16) [handled] = handled (16) } # if (handled && (Response-Packet-Type == Access-Challenge)) = handled (16) } # Auth-Type eduroameap = handled (16) Using Post-Auth-Type Challenge (16) Post-Auth-Type sub-section not found. Ignoring. (16) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (16) Sent Access-Challenge Id 133 from 137.222.8.128:16006 to 172.17.107.208:32770 length 0 (16) EAP-Message = 0x010403e819401d2cf1d58f4dba2bd1120d6bedf8276592c881c781799b8f10ae54cb4827b40eb2cf8e47257082cc86b3a2942093f979c9fcd6717ee8896d352f6646c54e584c3a798453deeaf94dbe01ea370644beb43f63b6834155f52416c1c5262706477100b872f8c00c2c836a82b31c164acf9482 (16) Message-Authenticator = 0x00000000000000000000000000000000 (16) State = 0x50612e0f52653724a214eec3e36f5ee8 (16) Finished request Waking up in 3.8 seconds. (17) Received Access-Request Id 134 from 172.17.107.208:32770 to 137.222.8.128:16006 length 293 (17) User-Name = "rp12811@my.bristol.ac.uk" (17) Chargeable-User-Identity = 0x00 (17) Location-Capable = Civix-Location (17) Calling-Station-Id = "d8:d1:cb:c5:7d:70" (17) Called-Station-Id = "1c:6a:7a:bb:a4:40:eduroam" (17) NAS-Port = 13 (17) Cisco-AVPair = "audit-session-id=ac116bd00000245456bc9783" (17) Acct-Session-Id = "56bc9783/d8:d1:cb:c5:7d:70/8990" (17) NAS-IP-Address = 172.17.107.208 (17) NAS-Identifier = "wism8" (17) Airespace-Wlan-Id = 1 (17) Service-Type = Framed-User (17) Framed-MTU = 1300 (17) NAS-Port-Type = Wireless-802.11 (17) Tunnel-Type:0 = VLAN (17) Tunnel-Medium-Type:0 = IEEE-802 (17) Tunnel-Private-Group-Id:0 = "448" (17) EAP-Message = 0x020400061900 (17) State = 0x50612e0f52653724a214eec3e36f5ee8 (17) Message-Authenticator = 0xd3ee353bf8b4d26d0129fdb3473c635d (17) session-state: No cached attributes (17) # Executing section authorize from file /etc/raddb/sites-enabled/eduroamlocal-auth (17) authorize { (17) policy rewrite_calling_station_id { (17) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (17) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (17) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (17) update request { (17) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (17) --> D8-D1-CB-C5-7D-70 (17) &Calling-Station-Id := D8-D1-CB-C5-7D-70 (17) } # update request = noop (17) [updated] = updated (17) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (17) ... skipping else for request 17: Preceding "if" was taken (17) } # policy rewrite_calling_station_id = updated (17) policy wism-checks { (17) if (Service-Type == "NAS-Prompt-User") { (17) if (Service-Type == "NAS-Prompt-User") -> FALSE (17) } # policy wism-checks = updated (17) [preprocess] = ok (17) if (User-Name =~ /@bris\\.ac\\.uk$/) { (17) if (User-Name =~ /@bris\\.ac\\.uk$/) -> FALSE (17) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) { (17) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) -> FALSE (17) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (17) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) -> TRUE (17) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (17) suffix: Checking for suffix after "@" (17) suffix: Looking up realm "my.bristol.ac.uk" for User-Name = "rp12811@my.bristol.ac.uk" (17) suffix: Found realm "my.bristol.ac.uk" (17) suffix: Adding Stripped-User-Name = "rp12811" (17) suffix: Adding Realm = "my.bristol.ac.uk" (17) suffix: Authentication realm is LOCAL (17) [suffix] = ok (17) update request { (17) Realm := "my.bristol.ac.uk" (17) } # update request = noop (17) } # elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) = ok (17) ... skipping elsif for request 17: Preceding "if" was taken (17) ... skipping else for request 17: Preceding "if" was taken (17) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) { (17) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (17) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) { (17) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (17) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) { (17) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) -> FALSE (17) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) { (17) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) -> FALSE (17) else { (17) eduroameap: Peer sent EAP Response (code 2) ID 4 length 6 (17) eduroameap: Continuing tunnel setup (17) [eduroameap] = ok (17) } # else = ok (17) } # authorize = updated (17) Found Auth-Type = eduroameap (17) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (17) Auth-Type eduroameap { (17) eduroameap: Expiring EAP session with state 0x6fc3095a6cc610be (17) eduroameap: Finished EAP session with state 0x50612e0f52653724 (17) eduroameap: Previous EAP request found for state 0x50612e0f52653724, released from the list (17) eduroameap: Peer sent packet with method EAP PEAP (25) (17) eduroameap: Calling submodule eap_peap to process data (17) eap_peap: Continuing EAP-TLS (17) eap_peap: Peer ACKed our handshake fragment (17) eap_peap: [eaptls verify] = request (17) eap_peap: [eaptls process] = handled (17) eduroameap: Sending EAP Request (code 1) ID 5 length 832 (17) eduroameap: EAP session adding &reply:State = 0x50612e0f53643724 (17) [eduroameap] = handled (17) if (handled && (Response-Packet-Type == Access-Challenge)) { (17) EXPAND Response-Packet-Type (17) --> Access-Challenge (17) if (handled && (Response-Packet-Type == Access-Challenge)) -> TRUE (17) if (handled && (Response-Packet-Type == Access-Challenge)) { (17) filter.eduroamlocal-a_challenge: EXPAND %{User-Name} (17) filter.eduroamlocal-a_challenge: --> rp12811@my.bristol.ac.uk (17) filter.eduroamlocal-a_challenge: Matched entry DEFAULT at line 1 (17) [filter.eduroamlocal-a_challenge.post-auth] = updated (17) [handled] = handled (17) } # if (handled && (Response-Packet-Type == Access-Challenge)) = handled (17) } # Auth-Type eduroameap = handled (17) Using Post-Auth-Type Challenge (17) Post-Auth-Type sub-section not found. Ignoring. (17) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (17) Sent Access-Challenge Id 134 from 137.222.8.128:16006 to 172.17.107.208:32770 length 0 (17) EAP-Message = 0x010503401900c1311e301c060355040a1315556e6976657273697479206f662042726973746f6c311f301d060355040b1316495420536572766963657320284e6574776f726b73293129302706092a864886f70d010901161a736572766963652d6465736b4062726973746f6c2e61632e756b3110300e (17) Message-Authenticator = 0x00000000000000000000000000000000 (17) State = 0x50612e0f53643724a214eec3e36f5ee8 (17) Finished request Waking up in 3.8 seconds. (10) Cleaning up request packet ID 127 with timestamp +346 (11) Cleaning up request packet ID 128 with timestamp +346 (12) Cleaning up request packet ID 129 with timestamp +346 (13) Cleaning up request packet ID 130 with timestamp +346 Waking up in 1.0 seconds. (14) Cleaning up request packet ID 131 with timestamp +347 (15) Cleaning up request packet ID 132 with timestamp +347 (16) Cleaning up request packet ID 133 with timestamp +347 (17) Cleaning up request packet ID 134 with timestamp +347 Ready to process requests (18) Received Access-Request Id 135 from 172.17.107.208:32770 to 137.222.8.128:16006 length 298 (18) User-Name = "rp12811@my.bristol.ac.uk" (18) Chargeable-User-Identity = 0x00 (18) Location-Capable = Civix-Location (18) Calling-Station-Id = "d8:d1:cb:c5:7d:70" (18) Called-Station-Id = "1c:6a:7a:bb:a4:40:eduroam" (18) NAS-Port = 13 (18) Cisco-AVPair = "audit-session-id=ac116bd00000245456bc9783" (18) Acct-Session-Id = "56bc9783/d8:d1:cb:c5:7d:70/8990" (18) NAS-IP-Address = 172.17.107.208 (18) NAS-Identifier = "wism8" (18) Airespace-Wlan-Id = 1 (18) Service-Type = Framed-User (18) Framed-MTU = 1300 (18) NAS-Port-Type = Wireless-802.11 (18) Tunnel-Type:0 = VLAN (18) Tunnel-Medium-Type:0 = IEEE-802 (18) Tunnel-Private-Group-Id:0 = "448" (18) EAP-Message = 0x0201001d0172703132383131406d792e62726973746f6c2e61632e756b (18) Message-Authenticator = 0xcd6af9d132de4e3ac16596e6709f9803 (18) # Executing section authorize from file /etc/raddb/sites-enabled/eduroamlocal-auth (18) authorize { (18) policy rewrite_calling_station_id { (18) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (18) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (18) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (18) update request { (18) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (18) --> D8-D1-CB-C5-7D-70 (18) &Calling-Station-Id := D8-D1-CB-C5-7D-70 (18) } # update request = noop (18) [updated] = updated (18) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (18) ... skipping else for request 18: Preceding "if" was taken (18) } # policy rewrite_calling_station_id = updated (18) policy wism-checks { (18) if (Service-Type == "NAS-Prompt-User") { (18) if (Service-Type == "NAS-Prompt-User") -> FALSE (18) } # policy wism-checks = updated (18) [preprocess] = ok (18) if (User-Name =~ /@bris\\.ac\\.uk$/) { (18) if (User-Name =~ /@bris\\.ac\\.uk$/) -> FALSE (18) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) { (18) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) -> FALSE (18) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (18) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) -> TRUE (18) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (18) suffix: Checking for suffix after "@" (18) suffix: Looking up realm "my.bristol.ac.uk" for User-Name = "rp12811@my.bristol.ac.uk" (18) suffix: Found realm "my.bristol.ac.uk" (18) suffix: Adding Stripped-User-Name = "rp12811" (18) suffix: Adding Realm = "my.bristol.ac.uk" (18) suffix: Authentication realm is LOCAL (18) [suffix] = ok (18) update request { (18) Realm := "my.bristol.ac.uk" (18) } # update request = noop (18) } # elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) = ok (18) ... skipping elsif for request 18: Preceding "if" was taken (18) ... skipping else for request 18: Preceding "if" was taken (18) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) { (18) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (18) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) { (18) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (18) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) { (18) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) -> FALSE (18) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) { (18) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) -> FALSE (18) else { (18) eduroameap: Peer sent EAP Response (code 2) ID 1 length 29 (18) eduroameap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (18) [eduroameap] = ok (18) } # else = ok (18) } # authorize = updated (18) Found Auth-Type = eduroameap (18) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (18) Auth-Type eduroameap { (18) eduroameap: Peer sent packet with method EAP Identity (1) (18) eduroameap: Calling submodule eap_peap to process data (18) eap_peap: Initiating new EAP-TLS session (18) eap_peap: [eaptls start] = request (18) eduroameap: Sending EAP Request (code 1) ID 2 length 6 (18) eduroameap: EAP session adding &reply:State = 0x21f5426621f75bcd (18) [eduroameap] = handled (18) if (handled && (Response-Packet-Type == Access-Challenge)) { (18) EXPAND Response-Packet-Type (18) --> Access-Challenge (18) if (handled && (Response-Packet-Type == Access-Challenge)) -> TRUE (18) if (handled && (Response-Packet-Type == Access-Challenge)) { (18) filter.eduroamlocal-a_challenge: EXPAND %{User-Name} (18) filter.eduroamlocal-a_challenge: --> rp12811@my.bristol.ac.uk (18) filter.eduroamlocal-a_challenge: Matched entry DEFAULT at line 1 (18) [filter.eduroamlocal-a_challenge.post-auth] = updated (18) [handled] = handled (18) } # if (handled && (Response-Packet-Type == Access-Challenge)) = handled (18) } # Auth-Type eduroameap = handled (18) Using Post-Auth-Type Challenge (18) Post-Auth-Type sub-section not found. Ignoring. (18) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (18) Sent Access-Challenge Id 135 from 137.222.8.128:16006 to 172.17.107.208:32770 length 0 (18) EAP-Message = 0x010200061920 (18) Message-Authenticator = 0x00000000000000000000000000000000 (18) State = 0x21f5426621f75bcd6b9f3462aca485d2 (18) Finished request Waking up in 4.9 seconds. (19) Received Access-Request Id 136 from 172.17.107.208:32770 to 137.222.8.128:16006 length 418 (19) User-Name = "rp12811@my.bristol.ac.uk" (19) Chargeable-User-Identity = 0x00 (19) Location-Capable = Civix-Location (19) Calling-Station-Id = "d8:d1:cb:c5:7d:70" (19) Called-Station-Id = "1c:6a:7a:bb:a4:40:eduroam" (19) NAS-Port = 13 (19) Cisco-AVPair = "audit-session-id=ac116bd00000245456bc9783" (19) Acct-Session-Id = "56bc9783/d8:d1:cb:c5:7d:70/8990" (19) NAS-IP-Address = 172.17.107.208 (19) NAS-Identifier = "wism8" (19) Airespace-Wlan-Id = 1 (19) Service-Type = Framed-User (19) Framed-MTU = 1300 (19) NAS-Port-Type = Wireless-802.11 (19) Tunnel-Type:0 = VLAN (19) Tunnel-Medium-Type:0 = IEEE-802 (19) Tunnel-Private-Group-Id:0 = "448" (19) EAP-Message = 0x02020083198000000079160301007401000070030156bc978bf186a230ee80cf6ff5c1bb71824b07c187226de1df6a38a22772b10b00002800ffc024c023c00ac009c008c028c027c014c013c012003d003c0035002f000ac007c011000500040100001f000a00080006001700180019000b0002010000 (19) State = 0x21f5426621f75bcd6b9f3462aca485d2 (19) Message-Authenticator = 0x3b125a4b2a6a7b9e97eca1725710dfc1 (19) session-state: No cached attributes (19) # Executing section authorize from file /etc/raddb/sites-enabled/eduroamlocal-auth (19) authorize { (19) policy rewrite_calling_station_id { (19) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (19) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (19) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (19) update request { (19) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (19) --> D8-D1-CB-C5-7D-70 (19) &Calling-Station-Id := D8-D1-CB-C5-7D-70 (19) } # update request = noop (19) [updated] = updated (19) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (19) ... skipping else for request 19: Preceding "if" was taken (19) } # policy rewrite_calling_station_id = updated (19) policy wism-checks { (19) if (Service-Type == "NAS-Prompt-User") { (19) if (Service-Type == "NAS-Prompt-User") -> FALSE (19) } # policy wism-checks = updated (19) [preprocess] = ok (19) if (User-Name =~ /@bris\\.ac\\.uk$/) { (19) if (User-Name =~ /@bris\\.ac\\.uk$/) -> FALSE (19) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) { (19) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) -> FALSE (19) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (19) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) -> TRUE (19) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (19) suffix: Checking for suffix after "@" (19) suffix: Looking up realm "my.bristol.ac.uk" for User-Name = "rp12811@my.bristol.ac.uk" (19) suffix: Found realm "my.bristol.ac.uk" (19) suffix: Adding Stripped-User-Name = "rp12811" (19) suffix: Adding Realm = "my.bristol.ac.uk" (19) suffix: Authentication realm is LOCAL (19) [suffix] = ok (19) update request { (19) Realm := "my.bristol.ac.uk" (19) } # update request = noop (19) } # elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) = ok (19) ... skipping elsif for request 19: Preceding "if" was taken (19) ... skipping else for request 19: Preceding "if" was taken (19) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) { (19) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (19) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) { (19) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (19) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) { (19) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) -> FALSE (19) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) { (19) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) -> FALSE (19) else { (19) eduroameap: Peer sent EAP Response (code 2) ID 2 length 131 (19) eduroameap: Continuing tunnel setup (19) [eduroameap] = ok (19) } # else = ok (19) } # authorize = updated (19) Found Auth-Type = eduroameap (19) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (19) Auth-Type eduroameap { (19) eduroameap: Expiring EAP session with state 0x6fc3095a6cc610be (19) eduroameap: Finished EAP session with state 0x21f5426621f75bcd (19) eduroameap: Previous EAP request found for state 0x21f5426621f75bcd, released from the list (19) eduroameap: Peer sent packet with method EAP PEAP (25) (19) eduroameap: Calling submodule eap_peap to process data (19) eap_peap: Continuing EAP-TLS (19) eap_peap: Peer indicated complete TLS record size will be 121 bytes (19) eap_peap: Got complete TLS record (121 bytes) (19) eap_peap: [eaptls verify] = length included (19) eap_peap: (other): before/accept initialization (19) eap_peap: TLS_accept: before/accept initialization (19) eap_peap: <<< TLS 1.0 Handshake [length 0074], ClientHello (19) eap_peap: TLS_accept: SSLv3 read client hello A (19) eap_peap: >>> TLS 1.0 Handshake [length 0039], ServerHello (19) eap_peap: TLS_accept: SSLv3 write server hello A (19) eap_peap: >>> TLS 1.0 Handshake [length 0962], Certificate (19) eap_peap: TLS_accept: SSLv3 write certificate A (19) eap_peap: >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange (19) eap_peap: TLS_accept: SSLv3 write key exchange A (19) eap_peap: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone (19) eap_peap: TLS_accept: SSLv3 write server done A (19) eap_peap: TLS_accept: SSLv3 flush data (19) eap_peap: TLS_accept: Need to read more data: SSLv3 read client certificate A (19) eap_peap: TLS_accept: Need to read more data: SSLv3 read client certificate A (19) eap_peap: In SSL Handshake Phase (19) eap_peap: In SSL Accept mode (19) eap_peap: [eaptls process] = handled (19) eduroameap: Sending EAP Request (code 1) ID 3 length 1004 (19) eduroameap: EAP session adding &reply:State = 0x21f5426620f65bcd (19) [eduroameap] = handled (19) if (handled && (Response-Packet-Type == Access-Challenge)) { (19) EXPAND Response-Packet-Type (19) --> Access-Challenge (19) if (handled && (Response-Packet-Type == Access-Challenge)) -> TRUE (19) if (handled && (Response-Packet-Type == Access-Challenge)) { (19) filter.eduroamlocal-a_challenge: EXPAND %{User-Name} (19) filter.eduroamlocal-a_challenge: --> rp12811@my.bristol.ac.uk (19) filter.eduroamlocal-a_challenge: Matched entry DEFAULT at line 1 (19) [filter.eduroamlocal-a_challenge.post-auth] = updated (19) [handled] = handled (19) } # if (handled && (Response-Packet-Type == Access-Challenge)) = handled (19) } # Auth-Type eduroameap = handled (19) Using Post-Auth-Type Challenge (19) Post-Auth-Type sub-section not found. Ignoring. (19) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (19) Sent Access-Challenge Id 136 from 137.222.8.128:16006 to 172.17.107.208:32770 length 0 (19) EAP-Message = 0x010303ec19c000000afe160301003902000035030156bc978c24acb0f916813e20ccf627b8149e48b51ed351cd8b2161e84494441900c01400000dff01000100000b00040300010216030109620b00095e00095b00041e3082041a30820302a0030201020203100018300d06092a864886f70d01010505 (19) Message-Authenticator = 0x00000000000000000000000000000000 (19) State = 0x21f5426620f65bcd6b9f3462aca485d2 (19) Finished request Waking up in 4.9 seconds. (20) Received Access-Request Id 137 from 172.17.107.208:32770 to 137.222.8.128:16006 length 293 (20) User-Name = "rp12811@my.bristol.ac.uk" (20) Chargeable-User-Identity = 0x00 (20) Location-Capable = Civix-Location (20) Calling-Station-Id = "d8:d1:cb:c5:7d:70" (20) Called-Station-Id = "1c:6a:7a:bb:a4:40:eduroam" (20) NAS-Port = 13 (20) Cisco-AVPair = "audit-session-id=ac116bd00000245456bc9783" (20) Acct-Session-Id = "56bc9783/d8:d1:cb:c5:7d:70/8990" (20) NAS-IP-Address = 172.17.107.208 (20) NAS-Identifier = "wism8" (20) Airespace-Wlan-Id = 1 (20) Service-Type = Framed-User (20) Framed-MTU = 1300 (20) NAS-Port-Type = Wireless-802.11 (20) Tunnel-Type:0 = VLAN (20) Tunnel-Medium-Type:0 = IEEE-802 (20) Tunnel-Private-Group-Id:0 = "448" (20) EAP-Message = 0x020300061900 (20) State = 0x21f5426620f65bcd6b9f3462aca485d2 (20) Message-Authenticator = 0x00f086dddc165e975256eb5a64ee842c (20) session-state: No cached attributes (20) # Executing section authorize from file /etc/raddb/sites-enabled/eduroamlocal-auth (20) authorize { (20) policy rewrite_calling_station_id { (20) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (20) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (20) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (20) update request { (20) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (20) --> D8-D1-CB-C5-7D-70 (20) &Calling-Station-Id := D8-D1-CB-C5-7D-70 (20) } # update request = noop (20) [updated] = updated (20) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (20) ... skipping else for request 20: Preceding "if" was taken (20) } # policy rewrite_calling_station_id = updated (20) policy wism-checks { (20) if (Service-Type == "NAS-Prompt-User") { (20) if (Service-Type == "NAS-Prompt-User") -> FALSE (20) } # policy wism-checks = updated (20) [preprocess] = ok (20) if (User-Name =~ /@bris\\.ac\\.uk$/) { (20) if (User-Name =~ /@bris\\.ac\\.uk$/) -> FALSE (20) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) { (20) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) -> FALSE (20) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (20) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) -> TRUE (20) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (20) suffix: Checking for suffix after "@" (20) suffix: Looking up realm "my.bristol.ac.uk" for User-Name = "rp12811@my.bristol.ac.uk" (20) suffix: Found realm "my.bristol.ac.uk" (20) suffix: Adding Stripped-User-Name = "rp12811" (20) suffix: Adding Realm = "my.bristol.ac.uk" (20) suffix: Authentication realm is LOCAL (20) [suffix] = ok (20) update request { (20) Realm := "my.bristol.ac.uk" (20) } # update request = noop (20) } # elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) = ok (20) ... skipping elsif for request 20: Preceding "if" was taken (20) ... skipping else for request 20: Preceding "if" was taken (20) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) { (20) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (20) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) { (20) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (20) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) { (20) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) -> FALSE (20) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) { (20) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) -> FALSE (20) else { (20) eduroameap: Peer sent EAP Response (code 2) ID 3 length 6 (20) eduroameap: Continuing tunnel setup (20) [eduroameap] = ok (20) } # else = ok (20) } # authorize = updated (20) Found Auth-Type = eduroameap (20) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (20) Auth-Type eduroameap { (20) eduroameap: Expiring EAP session with state 0x6fc3095a6cc610be (20) eduroameap: Finished EAP session with state 0x21f5426620f65bcd (20) eduroameap: Previous EAP request found for state 0x21f5426620f65bcd, released from the list (20) eduroameap: Peer sent packet with method EAP PEAP (25) (20) eduroameap: Calling submodule eap_peap to process data (20) eap_peap: Continuing EAP-TLS (20) eap_peap: Peer ACKed our handshake fragment (20) eap_peap: [eaptls verify] = request (20) eap_peap: [eaptls process] = handled (20) eduroameap: Sending EAP Request (code 1) ID 4 length 1000 (20) eduroameap: EAP session adding &reply:State = 0x21f5426623f15bcd (20) [eduroameap] = handled (20) if (handled && (Response-Packet-Type == Access-Challenge)) { (20) EXPAND Response-Packet-Type (20) --> Access-Challenge (20) if (handled && (Response-Packet-Type == Access-Challenge)) -> TRUE (20) if (handled && (Response-Packet-Type == Access-Challenge)) { (20) filter.eduroamlocal-a_challenge: EXPAND %{User-Name} (20) filter.eduroamlocal-a_challenge: --> rp12811@my.bristol.ac.uk (20) filter.eduroamlocal-a_challenge: Matched entry DEFAULT at line 1 (20) [filter.eduroamlocal-a_challenge.post-auth] = updated (20) [handled] = handled (20) } # if (handled && (Response-Packet-Type == Access-Challenge)) = handled (20) } # Auth-Type eduroameap = handled (20) Using Post-Auth-Type Challenge (20) Post-Auth-Type sub-section not found. Ignoring. (20) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (20) Sent Access-Challenge Id 137 from 137.222.8.128:16006 to 172.17.107.208:32770 length 0 (20) EAP-Message = 0x010403e819401d2cf1d58f4dba2bd1120d6bedf8276592c881c781799b8f10ae54cb4827b40eb2cf8e47257082cc86b3a2942093f979c9fcd6717ee8896d352f6646c54e584c3a798453deeaf94dbe01ea370644beb43f63b6834155f52416c1c5262706477100b872f8c00c2c836a82b31c164acf9482 (20) Message-Authenticator = 0x00000000000000000000000000000000 (20) State = 0x21f5426623f15bcd6b9f3462aca485d2 (20) Finished request Waking up in 4.9 seconds. (21) Received Access-Request Id 138 from 172.17.107.208:32770 to 137.222.8.128:16006 length 293 (21) User-Name = "rp12811@my.bristol.ac.uk" (21) Chargeable-User-Identity = 0x00 (21) Location-Capable = Civix-Location (21) Calling-Station-Id = "d8:d1:cb:c5:7d:70" (21) Called-Station-Id = "1c:6a:7a:bb:a4:40:eduroam" (21) NAS-Port = 13 (21) Cisco-AVPair = "audit-session-id=ac116bd00000245456bc9783" (21) Acct-Session-Id = "56bc9783/d8:d1:cb:c5:7d:70/8990" (21) NAS-IP-Address = 172.17.107.208 (21) NAS-Identifier = "wism8" (21) Airespace-Wlan-Id = 1 (21) Service-Type = Framed-User (21) Framed-MTU = 1300 (21) NAS-Port-Type = Wireless-802.11 (21) Tunnel-Type:0 = VLAN (21) Tunnel-Medium-Type:0 = IEEE-802 (21) Tunnel-Private-Group-Id:0 = "448" (21) EAP-Message = 0x020400061900 (21) State = 0x21f5426623f15bcd6b9f3462aca485d2 (21) Message-Authenticator = 0x6b0b5f1a253cdc1b8697daa05f26d432 (21) session-state: No cached attributes (21) # Executing section authorize from file /etc/raddb/sites-enabled/eduroamlocal-auth (21) authorize { (21) policy rewrite_calling_station_id { (21) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (21) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (21) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (21) update request { (21) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (21) --> D8-D1-CB-C5-7D-70 (21) &Calling-Station-Id := D8-D1-CB-C5-7D-70 (21) } # update request = noop (21) [updated] = updated (21) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (21) ... skipping else for request 21: Preceding "if" was taken (21) } # policy rewrite_calling_station_id = updated (21) policy wism-checks { (21) if (Service-Type == "NAS-Prompt-User") { (21) if (Service-Type == "NAS-Prompt-User") -> FALSE (21) } # policy wism-checks = updated (21) [preprocess] = ok (21) if (User-Name =~ /@bris\\.ac\\.uk$/) { (21) if (User-Name =~ /@bris\\.ac\\.uk$/) -> FALSE (21) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) { (21) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) -> FALSE (21) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (21) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) -> TRUE (21) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (21) suffix: Checking for suffix after "@" (21) suffix: Looking up realm "my.bristol.ac.uk" for User-Name = "rp12811@my.bristol.ac.uk" (21) suffix: Found realm "my.bristol.ac.uk" (21) suffix: Adding Stripped-User-Name = "rp12811" (21) suffix: Adding Realm = "my.bristol.ac.uk" (21) suffix: Authentication realm is LOCAL (21) [suffix] = ok (21) update request { (21) Realm := "my.bristol.ac.uk" (21) } # update request = noop (21) } # elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) = ok (21) ... skipping elsif for request 21: Preceding "if" was taken (21) ... skipping else for request 21: Preceding "if" was taken (21) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) { (21) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (21) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) { (21) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (21) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) { (21) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) -> FALSE (21) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) { (21) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) -> FALSE (21) else { (21) eduroameap: Peer sent EAP Response (code 2) ID 4 length 6 (21) eduroameap: Continuing tunnel setup (21) [eduroameap] = ok (21) } # else = ok (21) } # authorize = updated (21) Found Auth-Type = eduroameap (21) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (21) Auth-Type eduroameap { (21) eduroameap: Expiring EAP session with state 0x6fc3095a6cc610be (21) eduroameap: Finished EAP session with state 0x21f5426623f15bcd (21) eduroameap: Previous EAP request found for state 0x21f5426623f15bcd, released from the list (21) eduroameap: Peer sent packet with method EAP PEAP (25) (21) eduroameap: Calling submodule eap_peap to process data (21) eap_peap: Continuing EAP-TLS (21) eap_peap: Peer ACKed our handshake fragment (21) eap_peap: [eaptls verify] = request (21) eap_peap: [eaptls process] = handled (21) eduroameap: Sending EAP Request (code 1) ID 5 length 832 (21) eduroameap: EAP session adding &reply:State = 0x21f5426622f05bcd (21) [eduroameap] = handled (21) if (handled && (Response-Packet-Type == Access-Challenge)) { (21) EXPAND Response-Packet-Type (21) --> Access-Challenge (21) if (handled && (Response-Packet-Type == Access-Challenge)) -> TRUE (21) if (handled && (Response-Packet-Type == Access-Challenge)) { (21) filter.eduroamlocal-a_challenge: EXPAND %{User-Name} (21) filter.eduroamlocal-a_challenge: --> rp12811@my.bristol.ac.uk (21) filter.eduroamlocal-a_challenge: Matched entry DEFAULT at line 1 (21) [filter.eduroamlocal-a_challenge.post-auth] = updated (21) [handled] = handled (21) } # if (handled && (Response-Packet-Type == Access-Challenge)) = handled (21) } # Auth-Type eduroameap = handled (21) Using Post-Auth-Type Challenge (21) Post-Auth-Type sub-section not found. Ignoring. (21) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (21) Sent Access-Challenge Id 138 from 137.222.8.128:16006 to 172.17.107.208:32770 length 0 (21) EAP-Message = 0x010503401900c1311e301c060355040a1315556e6976657273697479206f662042726973746f6c311f301d060355040b1316495420536572766963657320284e6574776f726b73293129302706092a864886f70d010901161a736572766963652d6465736b4062726973746f6c2e61632e756b3110300e (21) Message-Authenticator = 0x00000000000000000000000000000000 (21) State = 0x21f5426622f05bcd6b9f3462aca485d2 (21) Finished request Waking up in 4.9 seconds. (22) Received Access-Request Id 139 from 172.17.107.208:32770 to 137.222.8.128:16006 length 298 (22) User-Name = "rp12811@my.bristol.ac.uk" (22) Chargeable-User-Identity = 0x00 (22) Location-Capable = Civix-Location (22) Calling-Station-Id = "d8:d1:cb:c5:7d:70" (22) Called-Station-Id = "1c:6a:7a:bb:a4:40:eduroam" (22) NAS-Port = 13 (22) Cisco-AVPair = "audit-session-id=ac116bd00000245456bc9783" (22) Acct-Session-Id = "56bc9783/d8:d1:cb:c5:7d:70/8990" (22) NAS-IP-Address = 172.17.107.208 (22) NAS-Identifier = "wism8" (22) Airespace-Wlan-Id = 1 (22) Service-Type = Framed-User (22) Framed-MTU = 1300 (22) NAS-Port-Type = Wireless-802.11 (22) Tunnel-Type:0 = VLAN (22) Tunnel-Medium-Type:0 = IEEE-802 (22) Tunnel-Private-Group-Id:0 = "448" (22) EAP-Message = 0x0201001d0172703132383131406d792e62726973746f6c2e61632e756b (22) Message-Authenticator = 0x04afa7aec2b3079088f2a76f8e0a08e4 (22) # Executing section authorize from file /etc/raddb/sites-enabled/eduroamlocal-auth (22) authorize { (22) policy rewrite_calling_station_id { (22) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (22) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (22) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (22) update request { (22) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (22) --> D8-D1-CB-C5-7D-70 (22) &Calling-Station-Id := D8-D1-CB-C5-7D-70 (22) } # update request = noop (22) [updated] = updated (22) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (22) ... skipping else for request 22: Preceding "if" was taken (22) } # policy rewrite_calling_station_id = updated (22) policy wism-checks { (22) if (Service-Type == "NAS-Prompt-User") { (22) if (Service-Type == "NAS-Prompt-User") -> FALSE (22) } # policy wism-checks = updated (22) [preprocess] = ok (22) if (User-Name =~ /@bris\\.ac\\.uk$/) { (22) if (User-Name =~ /@bris\\.ac\\.uk$/) -> FALSE (22) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) { (22) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) -> FALSE (22) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (22) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) -> TRUE (22) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (22) suffix: Checking for suffix after "@" (22) suffix: Looking up realm "my.bristol.ac.uk" for User-Name = "rp12811@my.bristol.ac.uk" (22) suffix: Found realm "my.bristol.ac.uk" (22) suffix: Adding Stripped-User-Name = "rp12811" (22) suffix: Adding Realm = "my.bristol.ac.uk" (22) suffix: Authentication realm is LOCAL (22) [suffix] = ok (22) update request { (22) Realm := "my.bristol.ac.uk" (22) } # update request = noop (22) } # elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) = ok (22) ... skipping elsif for request 22: Preceding "if" was taken (22) ... skipping else for request 22: Preceding "if" was taken (22) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) { (22) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (22) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) { (22) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (22) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) { (22) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) -> FALSE (22) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) { (22) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) -> FALSE (22) else { (22) eduroameap: Peer sent EAP Response (code 2) ID 1 length 29 (22) eduroameap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (22) [eduroameap] = ok (22) } # else = ok (22) } # authorize = updated (22) Found Auth-Type = eduroameap (22) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (22) Auth-Type eduroameap { (22) eduroameap: Peer sent packet with method EAP Identity (1) (22) eduroameap: Calling submodule eap_peap to process data (22) eap_peap: Initiating new EAP-TLS session (22) eap_peap: [eaptls start] = request (22) eduroameap: Sending EAP Request (code 1) ID 2 length 6 (22) eduroameap: EAP session adding &reply:State = 0xc126606ec1247937 (22) [eduroameap] = handled (22) if (handled && (Response-Packet-Type == Access-Challenge)) { (22) EXPAND Response-Packet-Type (22) --> Access-Challenge (22) if (handled && (Response-Packet-Type == Access-Challenge)) -> TRUE (22) if (handled && (Response-Packet-Type == Access-Challenge)) { (22) filter.eduroamlocal-a_challenge: EXPAND %{User-Name} (22) filter.eduroamlocal-a_challenge: --> rp12811@my.bristol.ac.uk (22) filter.eduroamlocal-a_challenge: Matched entry DEFAULT at line 1 (22) [filter.eduroamlocal-a_challenge.post-auth] = updated (22) [handled] = handled (22) } # if (handled && (Response-Packet-Type == Access-Challenge)) = handled (22) } # Auth-Type eduroameap = handled (22) Using Post-Auth-Type Challenge (22) Post-Auth-Type sub-section not found. Ignoring. (22) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (22) Sent Access-Challenge Id 139 from 137.222.8.128:16006 to 172.17.107.208:32770 length 0 (22) EAP-Message = 0x010200061920 (22) Message-Authenticator = 0x00000000000000000000000000000000 (22) State = 0xc126606ec12479374752ac9f596ed690 (22) Finished request Waking up in 4.3 seconds. (23) Received Access-Request Id 140 from 172.17.107.208:32770 to 137.222.8.128:16006 length 418 (23) User-Name = "rp12811@my.bristol.ac.uk" (23) Chargeable-User-Identity = 0x00 (23) Location-Capable = Civix-Location (23) Calling-Station-Id = "d8:d1:cb:c5:7d:70" (23) Called-Station-Id = "1c:6a:7a:bb:a4:40:eduroam" (23) NAS-Port = 13 (23) Cisco-AVPair = "audit-session-id=ac116bd00000245456bc9783" (23) Acct-Session-Id = "56bc9783/d8:d1:cb:c5:7d:70/8990" (23) NAS-IP-Address = 172.17.107.208 (23) NAS-Identifier = "wism8" (23) Airespace-Wlan-Id = 1 (23) Service-Type = Framed-User (23) Framed-MTU = 1300 (23) NAS-Port-Type = Wireless-802.11 (23) Tunnel-Type:0 = VLAN (23) Tunnel-Medium-Type:0 = IEEE-802 (23) Tunnel-Private-Group-Id:0 = "448" (23) EAP-Message = 0x02020083198000000079160301007401000070030156bc978cdca20b8db314bc7fcb2dd8bbee06ac883b03e88ff6ba2f031d63b21d00002800ffc024c023c00ac009c008c028c027c014c013c012003d003c0035002f000ac007c011000500040100001f000a00080006001700180019000b0002010000 (23) State = 0xc126606ec12479374752ac9f596ed690 (23) Message-Authenticator = 0xb6c8c0221a5c92b9518880b8f0b7149e (23) session-state: No cached attributes (23) # Executing section authorize from file /etc/raddb/sites-enabled/eduroamlocal-auth (23) authorize { (23) policy rewrite_calling_station_id { (23) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (23) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (23) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (23) update request { (23) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (23) --> D8-D1-CB-C5-7D-70 (23) &Calling-Station-Id := D8-D1-CB-C5-7D-70 (23) } # update request = noop (23) [updated] = updated (23) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (23) ... skipping else for request 23: Preceding "if" was taken (23) } # policy rewrite_calling_station_id = updated (23) policy wism-checks { (23) if (Service-Type == "NAS-Prompt-User") { (23) if (Service-Type == "NAS-Prompt-User") -> FALSE (23) } # policy wism-checks = updated (23) [preprocess] = ok (23) if (User-Name =~ /@bris\\.ac\\.uk$/) { (23) if (User-Name =~ /@bris\\.ac\\.uk$/) -> FALSE (23) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) { (23) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) -> FALSE (23) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (23) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) -> TRUE (23) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (23) suffix: Checking for suffix after "@" (23) suffix: Looking up realm "my.bristol.ac.uk" for User-Name = "rp12811@my.bristol.ac.uk" (23) suffix: Found realm "my.bristol.ac.uk" (23) suffix: Adding Stripped-User-Name = "rp12811" (23) suffix: Adding Realm = "my.bristol.ac.uk" (23) suffix: Authentication realm is LOCAL (23) [suffix] = ok (23) update request { (23) Realm := "my.bristol.ac.uk" (23) } # update request = noop (23) } # elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) = ok (23) ... skipping elsif for request 23: Preceding "if" was taken (23) ... skipping else for request 23: Preceding "if" was taken (23) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) { (23) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (23) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) { (23) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (23) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) { (23) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) -> FALSE (23) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) { (23) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) -> FALSE (23) else { (23) eduroameap: Peer sent EAP Response (code 2) ID 2 length 131 (23) eduroameap: Continuing tunnel setup (23) [eduroameap] = ok (23) } # else = ok (23) } # authorize = updated (23) Found Auth-Type = eduroameap (23) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (23) Auth-Type eduroameap { (23) eduroameap: Expiring EAP session with state 0x6fc3095a6cc610be (23) eduroameap: Finished EAP session with state 0xc126606ec1247937 (23) eduroameap: Previous EAP request found for state 0xc126606ec1247937, released from the list (23) eduroameap: Peer sent packet with method EAP PEAP (25) (23) eduroameap: Calling submodule eap_peap to process data (23) eap_peap: Continuing EAP-TLS (23) eap_peap: Peer indicated complete TLS record size will be 121 bytes (23) eap_peap: Got complete TLS record (121 bytes) (23) eap_peap: [eaptls verify] = length included (23) eap_peap: (other): before/accept initialization (23) eap_peap: TLS_accept: before/accept initialization (23) eap_peap: <<< TLS 1.0 Handshake [length 0074], ClientHello (23) eap_peap: TLS_accept: SSLv3 read client hello A (23) eap_peap: >>> TLS 1.0 Handshake [length 0039], ServerHello (23) eap_peap: TLS_accept: SSLv3 write server hello A (23) eap_peap: >>> TLS 1.0 Handshake [length 0962], Certificate (23) eap_peap: TLS_accept: SSLv3 write certificate A (23) eap_peap: >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange (23) eap_peap: TLS_accept: SSLv3 write key exchange A (23) eap_peap: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone (23) eap_peap: TLS_accept: SSLv3 write server done A (23) eap_peap: TLS_accept: SSLv3 flush data (23) eap_peap: TLS_accept: Need to read more data: SSLv3 read client certificate A (23) eap_peap: TLS_accept: Need to read more data: SSLv3 read client certificate A (23) eap_peap: In SSL Handshake Phase (23) eap_peap: In SSL Accept mode (23) eap_peap: [eaptls process] = handled (23) eduroameap: Sending EAP Request (code 1) ID 3 length 1004 (23) eduroameap: EAP session adding &reply:State = 0xc126606ec0257937 (23) [eduroameap] = handled (23) if (handled && (Response-Packet-Type == Access-Challenge)) { (23) EXPAND Response-Packet-Type (23) --> Access-Challenge (23) if (handled && (Response-Packet-Type == Access-Challenge)) -> TRUE (23) if (handled && (Response-Packet-Type == Access-Challenge)) { (23) filter.eduroamlocal-a_challenge: EXPAND %{User-Name} (23) filter.eduroamlocal-a_challenge: --> rp12811@my.bristol.ac.uk (23) filter.eduroamlocal-a_challenge: Matched entry DEFAULT at line 1 (23) [filter.eduroamlocal-a_challenge.post-auth] = updated (23) [handled] = handled (23) } # if (handled && (Response-Packet-Type == Access-Challenge)) = handled (23) } # Auth-Type eduroameap = handled (23) Using Post-Auth-Type Challenge (23) Post-Auth-Type sub-section not found. Ignoring. (23) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (23) Sent Access-Challenge Id 140 from 137.222.8.128:16006 to 172.17.107.208:32770 length 0 (23) EAP-Message = 0x010303ec19c000000afe160301003902000035030156bc978c339b0c3dea73b84e0d18c4af9343a383bd199a7208920babcbd6dcd800c01400000dff01000100000b00040300010216030109620b00095e00095b00041e3082041a30820302a0030201020203100018300d06092a864886f70d01010505 (23) Message-Authenticator = 0x00000000000000000000000000000000 (23) State = 0xc126606ec02579374752ac9f596ed690 (23) Finished request Waking up in 4.3 seconds. (24) Received Access-Request Id 141 from 172.17.107.208:32770 to 137.222.8.128:16006 length 293 (24) User-Name = "rp12811@my.bristol.ac.uk" (24) Chargeable-User-Identity = 0x00 (24) Location-Capable = Civix-Location (24) Calling-Station-Id = "d8:d1:cb:c5:7d:70" (24) Called-Station-Id = "1c:6a:7a:bb:a4:40:eduroam" (24) NAS-Port = 13 (24) Cisco-AVPair = "audit-session-id=ac116bd00000245456bc9783" (24) Acct-Session-Id = "56bc9783/d8:d1:cb:c5:7d:70/8990" (24) NAS-IP-Address = 172.17.107.208 (24) NAS-Identifier = "wism8" (24) Airespace-Wlan-Id = 1 (24) Service-Type = Framed-User (24) Framed-MTU = 1300 (24) NAS-Port-Type = Wireless-802.11 (24) Tunnel-Type:0 = VLAN (24) Tunnel-Medium-Type:0 = IEEE-802 (24) Tunnel-Private-Group-Id:0 = "448" (24) EAP-Message = 0x020300061900 (24) State = 0xc126606ec02579374752ac9f596ed690 (24) Message-Authenticator = 0xd8d67171f368272e9ed3cb33b838548f (24) session-state: No cached attributes (24) # Executing section authorize from file /etc/raddb/sites-enabled/eduroamlocal-auth (24) authorize { (24) policy rewrite_calling_station_id { (24) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (24) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (24) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (24) update request { (24) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (24) --> D8-D1-CB-C5-7D-70 (24) &Calling-Station-Id := D8-D1-CB-C5-7D-70 (24) } # update request = noop (24) [updated] = updated (24) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (24) ... skipping else for request 24: Preceding "if" was taken (24) } # policy rewrite_calling_station_id = updated (24) policy wism-checks { (24) if (Service-Type == "NAS-Prompt-User") { (24) if (Service-Type == "NAS-Prompt-User") -> FALSE (24) } # policy wism-checks = updated (24) [preprocess] = ok (24) if (User-Name =~ /@bris\\.ac\\.uk$/) { (24) if (User-Name =~ /@bris\\.ac\\.uk$/) -> FALSE (24) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) { (24) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) -> FALSE (24) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (24) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) -> TRUE (24) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (24) suffix: Checking for suffix after "@" (24) suffix: Looking up realm "my.bristol.ac.uk" for User-Name = "rp12811@my.bristol.ac.uk" (24) suffix: Found realm "my.bristol.ac.uk" (24) suffix: Adding Stripped-User-Name = "rp12811" (24) suffix: Adding Realm = "my.bristol.ac.uk" (24) suffix: Authentication realm is LOCAL (24) [suffix] = ok (24) update request { (24) Realm := "my.bristol.ac.uk" (24) } # update request = noop (24) } # elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) = ok (24) ... skipping elsif for request 24: Preceding "if" was taken (24) ... skipping else for request 24: Preceding "if" was taken (24) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) { (24) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (24) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) { (24) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (24) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) { (24) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) -> FALSE (24) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) { (24) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) -> FALSE (24) else { (24) eduroameap: Peer sent EAP Response (code 2) ID 3 length 6 (24) eduroameap: Continuing tunnel setup (24) [eduroameap] = ok (24) } # else = ok (24) } # authorize = updated (24) Found Auth-Type = eduroameap (24) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (24) Auth-Type eduroameap { (24) eduroameap: Expiring EAP session with state 0x6fc3095a6cc610be (24) eduroameap: Finished EAP session with state 0xc126606ec0257937 (24) eduroameap: Previous EAP request found for state 0xc126606ec0257937, released from the list (24) eduroameap: Peer sent packet with method EAP PEAP (25) (24) eduroameap: Calling submodule eap_peap to process data (24) eap_peap: Continuing EAP-TLS (24) eap_peap: Peer ACKed our handshake fragment (24) eap_peap: [eaptls verify] = request (24) eap_peap: [eaptls process] = handled (24) eduroameap: Sending EAP Request (code 1) ID 4 length 1000 (24) eduroameap: EAP session adding &reply:State = 0xc126606ec3227937 (24) [eduroameap] = handled (24) if (handled && (Response-Packet-Type == Access-Challenge)) { (24) EXPAND Response-Packet-Type (24) --> Access-Challenge (24) if (handled && (Response-Packet-Type == Access-Challenge)) -> TRUE (24) if (handled && (Response-Packet-Type == Access-Challenge)) { (24) filter.eduroamlocal-a_challenge: EXPAND %{User-Name} (24) filter.eduroamlocal-a_challenge: --> rp12811@my.bristol.ac.uk (24) filter.eduroamlocal-a_challenge: Matched entry DEFAULT at line 1 (24) [filter.eduroamlocal-a_challenge.post-auth] = updated (24) [handled] = handled (24) } # if (handled && (Response-Packet-Type == Access-Challenge)) = handled (24) } # Auth-Type eduroameap = handled (24) Using Post-Auth-Type Challenge (24) Post-Auth-Type sub-section not found. Ignoring. (24) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (24) Sent Access-Challenge Id 141 from 137.222.8.128:16006 to 172.17.107.208:32770 length 0 (24) EAP-Message = 0x010403e819401d2cf1d58f4dba2bd1120d6bedf8276592c881c781799b8f10ae54cb4827b40eb2cf8e47257082cc86b3a2942093f979c9fcd6717ee8896d352f6646c54e584c3a798453deeaf94dbe01ea370644beb43f63b6834155f52416c1c5262706477100b872f8c00c2c836a82b31c164acf9482 (24) Message-Authenticator = 0x00000000000000000000000000000000 (24) State = 0xc126606ec32279374752ac9f596ed690 (24) Finished request Waking up in 4.3 seconds. (25) Received Access-Request Id 142 from 172.17.107.208:32770 to 137.222.8.128:16006 length 293 (25) User-Name = "rp12811@my.bristol.ac.uk" (25) Chargeable-User-Identity = 0x00 (25) Location-Capable = Civix-Location (25) Calling-Station-Id = "d8:d1:cb:c5:7d:70" (25) Called-Station-Id = "1c:6a:7a:bb:a4:40:eduroam" (25) NAS-Port = 13 (25) Cisco-AVPair = "audit-session-id=ac116bd00000245456bc9783" (25) Acct-Session-Id = "56bc9783/d8:d1:cb:c5:7d:70/8990" (25) NAS-IP-Address = 172.17.107.208 (25) NAS-Identifier = "wism8" (25) Airespace-Wlan-Id = 1 (25) Service-Type = Framed-User (25) Framed-MTU = 1300 (25) NAS-Port-Type = Wireless-802.11 (25) Tunnel-Type:0 = VLAN (25) Tunnel-Medium-Type:0 = IEEE-802 (25) Tunnel-Private-Group-Id:0 = "448" (25) EAP-Message = 0x020400061900 (25) State = 0xc126606ec32279374752ac9f596ed690 (25) Message-Authenticator = 0xe36bdc6e49aaea47cc5cc142178338f4 (25) session-state: No cached attributes (25) # Executing section authorize from file /etc/raddb/sites-enabled/eduroamlocal-auth (25) authorize { (25) policy rewrite_calling_station_id { (25) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (25) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (25) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (25) update request { (25) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (25) --> D8-D1-CB-C5-7D-70 (25) &Calling-Station-Id := D8-D1-CB-C5-7D-70 (25) } # update request = noop (25) [updated] = updated (25) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (25) ... skipping else for request 25: Preceding "if" was taken (25) } # policy rewrite_calling_station_id = updated (25) policy wism-checks { (25) if (Service-Type == "NAS-Prompt-User") { (25) if (Service-Type == "NAS-Prompt-User") -> FALSE (25) } # policy wism-checks = updated (25) [preprocess] = ok (25) if (User-Name =~ /@bris\\.ac\\.uk$/) { (25) if (User-Name =~ /@bris\\.ac\\.uk$/) -> FALSE (25) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) { (25) elsif (User-Name =~ /@bristol\\.ac\\.uk$/) -> FALSE (25) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (25) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) -> TRUE (25) elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) { (25) suffix: Checking for suffix after "@" (25) suffix: Looking up realm "my.bristol.ac.uk" for User-Name = "rp12811@my.bristol.ac.uk" (25) suffix: Found realm "my.bristol.ac.uk" (25) suffix: Adding Stripped-User-Name = "rp12811" (25) suffix: Adding Realm = "my.bristol.ac.uk" (25) suffix: Authentication realm is LOCAL (25) [suffix] = ok (25) update request { (25) Realm := "my.bristol.ac.uk" (25) } # update request = noop (25) } # elsif (User-Name =~ /@my.bristol\\.ac\\.uk$/) = ok (25) ... skipping elsif for request 25: Preceding "if" was taken (25) ... skipping else for request 25: Preceding "if" was taken (25) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) { (25) if (User-Name =~ /AppleOSXMachineAuth2011a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (25) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) { (25) elsif (User-Name =~ /AppleOSXMachineAuth2012a@lion\\.bristol\\.ac\\.uk$/) -> FALSE (25) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) { (25) elsif (User-Name =~ /@lion\\.bristol\\.ac\\.uk$/) -> FALSE (25) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) { (25) elsif (User-Name =~ /^host\\\/.+\\.bris(tol)?\\.ac\\.uk$/i) -> FALSE (25) else { (25) eduroameap: Peer sent EAP Response (code 2) ID 4 length 6 (25) eduroameap: Continuing tunnel setup (25) [eduroameap] = ok (25) } # else = ok (25) } # authorize = updated (25) Found Auth-Type = eduroameap (25) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (25) Auth-Type eduroameap { (25) eduroameap: Expiring EAP session with state 0x6fc3095a6cc610be (25) eduroameap: Finished EAP session with state 0xc126606ec3227937 (25) eduroameap: Previous EAP request found for state 0xc126606ec3227937, released from the list (25) eduroameap: Peer sent packet with method EAP PEAP (25) (25) eduroameap: Calling submodule eap_peap to process data (25) eap_peap: Continuing EAP-TLS (25) eap_peap: Peer ACKed our handshake fragment (25) eap_peap: [eaptls verify] = request (25) eap_peap: [eaptls process] = handled (25) eduroameap: Sending EAP Request (code 1) ID 5 length 832 (25) eduroameap: EAP session adding &reply:State = 0xc126606ec2237937 (25) [eduroameap] = handled (25) if (handled && (Response-Packet-Type == Access-Challenge)) { (25) EXPAND Response-Packet-Type (25) --> Access-Challenge (25) if (handled && (Response-Packet-Type == Access-Challenge)) -> TRUE (25) if (handled && (Response-Packet-Type == Access-Challenge)) { (25) filter.eduroamlocal-a_challenge: EXPAND %{User-Name} (25) filter.eduroamlocal-a_challenge: --> rp12811@my.bristol.ac.uk (25) filter.eduroamlocal-a_challenge: Matched entry DEFAULT at line 1 (25) [filter.eduroamlocal-a_challenge.post-auth] = updated (25) [handled] = handled (25) } # if (handled && (Response-Packet-Type == Access-Challenge)) = handled (25) } # Auth-Type eduroameap = handled (25) Using Post-Auth-Type Challenge (25) Post-Auth-Type sub-section not found. Ignoring. (25) # Executing group from file /etc/raddb/sites-enabled/eduroamlocal-auth (25) Sent Access-Challenge Id 142 from 137.222.8.128:16006 to 172.17.107.208:32770 length 0 (25) EAP-Message = 0x010503401900c1311e301c060355040a1315556e6976657273697479206f662042726973746f6c311f301d060355040b1316495420536572766963657320284e6574776f726b73293129302706092a864886f70d010901161a736572766963652d6465736b4062726973746f6c2e61632e756b3110300e (25) Message-Authenticator = 0x00000000000000000000000000000000 (25) State = 0xc126606ec22379374752ac9f596ed690 (25) Finished request Waking up in 4.3 seconds.