On 28.04.15 17:25, Stefan Paetow wrote:
Do you need me to test it with Called-Station-SSID as well to verify that this syntax works unlike the other? Alan and Arran always request the *full* output of 'radiusd -X' for a good reason... just copying and pasting what you might consider relevant is not always necessarily what they need to diagnose whether this is a bug or not.
I thought it has been established it is a bug.
So, suggestion is:
1. Run one radiusd -X output with the standard Called-Station-SSID that you believe does not work.
2. Run one radiusd -X output with your policy that you say works.
I don't need two runs for that. I can put all three ways to address the outer Called-Station-SSID in a single section.
Post both (and that includes *everything* from the version line at the top of the initial output to the return of the final Access-Accept or Access-Reject).
If there are any passwords, radiusd -X usually removes them, but you might wish to grep for any passwords you know you are using and replace them with '<< password >>' or similar.
That way Alan can look at your configuration and check whether something's wrong, and where he may need to start looking.
I have attached the full output of a test run of a eap-peap authentication from a new CentOS 7 freeradius-3.0.4-6.el7.x86_64 installation. As you can see outer.request:Called-Station-SSID and outer.Called-Station-SSID don't return anything but "%{outer.request:Called-Station-SSID}" does. There are only three differences to the configuration files from the distribution: Added to the end of users -> ./mods-config/files/authorize: bob Cleartext-Password := "hello" Reply-Message := "Hello, %{User-Name}" *** sites-available/default 2015-03-06 00:41:49.000000000 +0100 --- sites-enabled/default 2015-04-28 18:04:58.954102428 +0200 *************** *** 331,336 **** --- 331,338 ---- suffix # ntdomain + rewrite_called_station_id + # # This module takes care of EAP-MD5, EAP-TLS, and EAP-LEAP # authentication. *************** *** 517,522 **** --- 519,526 ---- preacct { preprocess + rewrite_called_station_id + # # Merge Acct-[Input|Output]-Gigawords and Acct-[Input-Output]-Octets # into a single 64bit counter Acct-[Input|Output]-Octets64. *** sites-available/inner-tunnel 2015-03-06 00:41:49.000000000 +0100 --- sites-enabled/inner-tunnel 2015-04-28 18:09:32.427065903 +0200 *************** *** 46,51 **** --- 46,76 ---- # Make *sure* that 'preprocess' comes before any realm if you # need to setup hints for the remote radius server authorize { + update request { + Called-Station-SSID := outer.request:Called-Station-SSID + } + if ( Called-Station-SSID ) { + update reply { + Reply-Message += "1: Called-Station-SSID = %{Called-Station-SSID}" + } + } + update request { + Called-Station-SSID := outer.Called-Station-SSID + } + if ( Called-Station-SSID ) { + update reply { + Reply-Message += "2: Called-Station-SSID = %{Called-Station-SSID}" + } + } + update request { + Called-Station-SSID := "%{outer.request:Called-Station-SSID}" + } + if ( Called-Station-SSID ) { + update reply { + Reply-Message += "3: Called-Station-SSID = %{Called-Station-SSID}" + } + } + # # The chap module will set 'Auth-Type := CHAP' if we are # handling a CHAP request and Auth-Type has not already been set -Gerald