Problem with regular expression in huntgroups
Hello, I'm migrating my current freeradius2 configuration to freeradius3. In my current FR2 configuration I have rules to check for huntgroups like: test_huntgroup NAS-IP-Address =~ ^10\.57\.1\.[0-9]+$ This same rule is not working in my FR3 configuration. Running FR in debug mode shows: .... (0) NAS-IP-Address = 10.57.1.50 (0) NAS-Identifier = 'RADIUS-PRUEBAS' (0) # Executing section authorize from file /etc/freeradius/sites-enabled/eduroam (0) authorize { (0) preprocess: EXPAND /10\.57\.1\.[0-9]+$/ (0) preprocess: --> /10\.57\.1\.[0-9]+$/ (0) preprocess: EXPAND ^10\.57\.8\.[0-9]+$ (0) preprocess: --> ^10\.57\.8\.[0-9]+$ (0) preprocess: EXPAND ^10\.57\.14\.[0-9]+$ (0) preprocess: --> ^10\.57\.14\.[0-9]+$ ... (0) [preprocess] = ok ... but no huntgroup is assigned. I have tried putting the RE inside // with the same result. Any help? Thank you. -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337
For example this works: LNS NAS-IP-Address =~ "213.151.23(1|2).*" On Tue, Apr 21, 2015 at 11:05 AM, Angel L. Mateo <amateo@um.es> wrote:
Hello,
I'm migrating my current freeradius2 configuration to freeradius3. In my current FR2 configuration I have rules to check for huntgroups like:
test_huntgroup NAS-IP-Address =~ ^10\.57\.1\.[0-9]+$
This same rule is not working in my FR3 configuration. Running FR in debug mode shows:
.... (0) NAS-IP-Address = 10.57.1.50 (0) NAS-Identifier = 'RADIUS-PRUEBAS' (0) # Executing section authorize from file /etc/freeradius/sites-enabled/eduroam (0) authorize { (0) preprocess: EXPAND /10\.57\.1\.[0-9]+$/ (0) preprocess: --> /10\.57\.1\.[0-9]+$/ (0) preprocess: EXPAND ^10\.57\.8\.[0-9]+$ (0) preprocess: --> ^10\.57\.8\.[0-9]+$ (0) preprocess: EXPAND ^10\.57\.14\.[0-9]+$ (0) preprocess: --> ^10\.57\.14\.[0-9]+$ ... (0) [preprocess] = ok ...
but no huntgroup is assigned.
I have tried putting the RE inside // with the same result.
Any help? Thank you.
-- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 21 Apr 2015, at 11:06, Peter Balsianok <balsianok.peter@gmail.com> wrote:
For example this works: LNS NAS-IP-Address =~ "213.151.23(1|2).*"
Regular expressions against IP address type attributes are no longer supported in huntgroups or the users file. I'd seriously considering about moving way from huntgroups, they are extremely inefficient. If you want to associate data with a client, you can add arbitrary pairs to the client definitions, and access them with the "%{client:<attr>}" xlat. This works for bulk loaded clients from couchbase/ldap, and dynamically clients, as well as clients defined in the static clients.conf file. example: client loopback { ipaddr = 127.0.0.1 secret = testing123 arbitrary_attribute = 'testing' } authorize { update request { Tmp-String-0 := "%{client:arbitrary_attribute}" } } -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Great idea, clear from configuration perspective. Peter On Tue, Apr 21, 2015 at 12:13 PM, Arran Cudbard-Bell < a.cudbardb@freeradius.org> wrote:
On 21 Apr 2015, at 11:06, Peter Balsianok <balsianok.peter@gmail.com> wrote:
For example this works: LNS NAS-IP-Address =~ "213.151.23(1|2).*"
Regular expressions against IP address type attributes are no longer supported in huntgroups or the users file.
I'd seriously considering about moving way from huntgroups, they are extremely inefficient.
If you want to associate data with a client, you can add arbitrary pairs to the client definitions, and access them with the "%{client:<attr>}" xlat.
This works for bulk loaded clients from couchbase/ldap, and dynamically clients, as well as clients defined in the static clients.conf file.
example:
client loopback { ipaddr = 127.0.0.1 secret = testing123
arbitrary_attribute = 'testing' }
authorize { update request { Tmp-String-0 := "%{client:arbitrary_attribute}" } }
-Arran
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
El 21/04/15 a las 12:13, Arran Cudbard-Bell escribió:
On 21 Apr 2015, at 11:06, Peter Balsianok <balsianok.peter@gmail.com> wrote:
For example this works: LNS NAS-IP-Address =~ "213.151.23(1|2).*"
Regular expressions against IP address type attributes are no longer supported in huntgroups or the users file.
I'd seriously considering about moving way from huntgroups, they are extremely inefficient.
If you want to associate data with a client, you can add arbitrary pairs to the client definitions, and access them with the "%{client:<attr>}" xlat.
Oopps... Assigning an attribute could be a mess in my case. The problem is that I have a lot of access points authenticating against my radius. Until now, I'm using only a client definition for all of them, using the network address instead of particular IPs and with the ER in huntgroup's file then I classified them (I use then the huntgroup in the user file to assign different VLANs depending of the AP of the request) I have to think another way to do this...
This works for bulk loaded clients from couchbase/ldap, and dynamically clients, as well as clients defined in the static clients.conf file.
example:
client loopback { ipaddr = 127.0.0.1 secret = testing123
arbitrary_attribute = 'testing' }
authorize { update request { Tmp-String-0 := "%{client:arbitrary_attribute}" } }
-Arran
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337
On 21 Apr 2015, at 12:30, Angel L. Mateo <amateo@um.es> wrote:
El 21/04/15 a las 12:13, Arran Cudbard-Bell escribió:
On 21 Apr 2015, at 11:06, Peter Balsianok <balsianok.peter@gmail.com> wrote:
For example this works: LNS NAS-IP-Address =~ "213.151.23(1|2).*"
Regular expressions against IP address type attributes are no longer supported in huntgroups or the users file.
I'd seriously considering about moving way from huntgroups, they are extremely inefficient.
If you want to associate data with a client, you can add arbitrary pairs to the client definitions, and access them with the "%{client:<attr>}" xlat.
Oopps... Assigning an attribute could be a mess in my case. The problem is that I have a lot of access points authenticating against my radius. Until now, I'm using only a client definition for all of them, using the network address instead of particular IPs and with the ER in huntgroup's file then I classified them (I use then the huntgroup in the user file to assign different VLANs depending of the AP of the request)
I have to think another way to do this...
If you can help it, you shouldn't really be using the same shared secret for all the APs anyway. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
participants (3)
-
Angel L. Mateo -
Arran Cudbard-Bell -
Peter Balsianok