v3.0.x: raddebug/radmin ignore conditions
Hi! I tried to use the control socket and raddebug to debug certain clients but radmin seems to ignore any conditions (f.i. Packet-Src-IP-Address). Also, we had to explicitly set a debug log level in order to see anything at all. Does setting a (global?) log level somehow override the conditions? We also had to comment the group checking ("show config group") out in order for raddebug to work at all. Cheers, JB
To clarify: We always get the whole debug output and not just those messages regarding clients with a certain Packet-Src-IP-Address. JB wrote:
Hi!
I tried to use the control socket and raddebug to debug certain clients but radmin seems to ignore any conditions (f.i. Packet-Src-IP-Address). Also, we had to explicitly set a debug log level in order to see anything at all. Does setting a (global?) log level somehow override the conditions?
We also had to comment the group checking ("show config group") out in order for raddebug to work at all.
Cheers, JB
JB wrote:
I tried to use the control socket and raddebug to debug certain clients but radmin seems to ignore any conditions (f.i. Packet-Src-IP-Address).
radmin just sets the debug condition in the server. But the server shouldn't be ignoring conditions. Have you tried using a simple one, like User-Name?
Also, we had to explicitly set a debug log level in order to see anything at all. Does setting a (global?) log level somehow override the conditions?
No. The global log level is used to initialize the log level for a particular request. The debug condition is then used to update the log level for that request. If the debug condition never matches, then the request log level will never be updated.
We also had to comment the group checking ("show config group") out in order for raddebug to work at all.
Probably because you don't have a "group" setting in radiusd.conf. Alan DeKok.
Alan DeKok wrote:
radmin just sets the debug condition in the server. But the server shouldn't be ignoring conditions. Have you tried using a simple one, like User-Name?
Yes. And I get the following line in the radius.log: Debug: radmin> debug condition "(User-Name == 'test')" But no matter what user name is used, raddebug shows debug output.
We also had to comment the group checking ("show config group") out in order for raddebug to work at all.
Probably because you don't have a "group" setting in radiusd.conf.
No, we have that. I think the problem is that the user/group configs moved to the security section, so the command should be "show config security.group", shouldn't it?
JB wrote:
Yes. And I get the following line in the radius.log: Debug: radmin> debug condition "(User-Name == 'test')" But no matter what user name is used, raddebug shows debug output.
That's bad. I'll take a look at it.
No, we have that. I think the problem is that the user/group configs moved to the security section, so the command should be "show config security.group", shouldn't it?
Oops. I'll go fix that. Alan DeKok.
JB wrote:
Yes. And I get the following line in the radius.log: Debug: radmin> debug condition "(User-Name == 'test')" But no matter what user name is used, raddebug shows debug output.
I've just pushed some fixes for problems I ran into. But I've tested it, and the debug conditions work for me. Alan DeKok.
Alan DeKok wrote:
JB wrote:
Yes. And I get the following line in the radius.log: Debug: radmin> debug condition "(User-Name == 'test')" But no matter what user name is used, raddebug shows debug output.
I've just pushed some fixes for problems I ran into. But I've tested it, and the debug conditions work for me.
Thanks! At least User-Name seems to work now in radmin. Unfortunately, the -u argument of raddebug is now broken. I'm getting this error message: Error: Failed parsing condition '(User-Name == test)': Must have string as value for attribute Packet-Src-Ip-Address isn't working either but as Arran pointed out, it isn't the best attribute to use. I'll try alternatives tomorrow and let you know if it works. Cheers, JB
JB wrote:
At least User-Name seems to work now in radmin.
OK.
Unfortunately, the -u argument of raddebug is now broken. I'm getting this error message: Error: Failed parsing condition '(User-Name == test)': Must have string as value for attribute
That's an easy fix. The problem is that the *server* now requires: User-Name == "test" The previous form is forbidden.
Packet-Src-Ip-Address isn't working either but as Arran pointed out, it isn't the best attribute to use.
It should work, though. Alan DeKok.
Alan DeKok wrote:
JB wrote:
Unfortunately, the -u argument of raddebug is now broken. I'm getting this error message: Error: Failed parsing condition '(User-Name == test)': Must have string as value for attribute
That's an easy fix. The problem is that the *server* now requires:
User-Name == "test"
The previous form is forbidden.
I see. Since the script seems to strip my quotes when I write something like -u "test", I changed the line to: u) condition="(User-Name == '$OPTARG')" Works fine now. (Sorry, don't know how to make patches with Git yet.)
Packet-Src-Ip-Address isn't working either but as Arran pointed out, it isn't the best attribute to use. It should work, though.
Did some more raddebug testing with all sorts of attributes. NAS-Identifier, User-Name, NAS-IP-Address, … all work in a debug condition but Packet-Src-Ip-Address refuses to play along. If I set "(Packet-Src-IP-Address == the.ip.add.ress)", I don't see any output. If I set "(Packet-Src-IP-Address != the.ip.add.ress)", I get debugging output. Just to make sure, I've added a Reply-Message with %{Packet-Src-IP-Address} and it shows exactly the.ip.add.ress. As far as I understand, Packet-Src-Ip-Address is a custom internal attribute. Could it be possible that it gets filled *after* the debug condition is checked? Cheers, JB
On 13 Feb 2014, at 11:30, JB <list.freeradius@me.com> wrote:
Alan DeKok wrote:
JB wrote:
Unfortunately, the -u argument of raddebug is now broken. I'm getting this error message: Error: Failed parsing condition '(User-Name == test)': Must have string as value for attribute
That's an easy fix. The problem is that the *server* now requires:
User-Name == "test"
The previous form is forbidden.
I see. Since the script seems to strip my quotes when I write something like -u "test", I changed the line to:
u) condition="(User-Name == '$OPTARG')"
Works fine now. (Sorry, don't know how to make patches with Git yet.)
git diff > patch :) Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
JB wrote:
I see. Since the script seems to strip my quotes when I write something like -u "test", I changed the line to:
u) condition="(User-Name == '$OPTARG')"
Works fine now.
I've already pushed that fix.
Did some more raddebug testing with all sorts of attributes. NAS-Identifier, User-Name, NAS-IP-Address, … all work in a debug condition but Packet-Src-Ip-Address refuses to play along. If I set "(Packet-Src-IP-Address == the.ip.add.ress)", I don't see any output. If I set "(Packet-Src-IP-Address != the.ip.add.ress)", I get debugging output.
I'll take a look. It should be easy to debug. Alan DeKok.
Alan DeKok wrote:
JB wrote:
I see. Since the script seems to strip my quotes when I write something like -u "test", I changed the line to: u) condition="(User-Name == '$OPTARG')" Works fine now.
I've already pushed that fix.
Hm, at least according to GitHub, the single quotes are missing: https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/scripts/raddebug...
Did some more raddebug testing with all sorts of attributes. NAS-Identifier, User-Name, NAS-IP-Address, … all work in a debug condition but Packet-Src-Ip-Address refuses to play along. If I set "(Packet-Src-IP-Address == the.ip.add.ress)", I don't see any output. If I set "(Packet-Src-IP-Address != the.ip.add.ress)", I get debugging output.
I'll take a look. It should be easy to debug.
Great, thank you! Cheers, JB
JB wrote:
Hm, at least according to GitHub, the single quotes are missing: https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/scripts/raddebug...
I just pushed the fix now. It didn't get pushed earlier for some reason. Alan DeKok.
I tried to use the control socket and raddebug to debug certain clients but radmin seems to ignore any conditions (f.i. Packet-Src-IP-Address).
Packet-Src-Ip-Address is probably a bad one to use as it's not a real attribute. Not sure about the other issues. You can use the %{debug:<level>} xlat from within the request, it will probably work more reliably than the radmin interface. It marks up the current request for debugging at the point the xlat function is called. Unfortunately the output file can still only be set globally. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Arran Cudbard-Bell wrote:
Packet-Src-Ip-Address is probably a bad one to use as it's not a real attribute.
How else would I filter the debug output per IP using raddebug/radmin?
You can use the %{debug:<level>} xlat from within the request, it will probably work more reliably than the radmin interface.
It marks up the current request for debugging at the point the xlat function is called. Unfortunately the output file can still only be set globally.
So, I just would have to add something like "if (%{User-Name} == …) update control {…}" to the beginning of the sections I am interested in?
On 12 Feb 2014, at 17:36, JB <list.freeradius@me.com> wrote:
Arran Cudbard-Bell wrote:
Packet-Src-Ip-Address is probably a bad one to use as it's not a real attribute.
How else would I filter the debug output per IP using raddebug/radmin?
NAS-IP-Address, which is a real attribute, or you do it from within a virtual server. if ("%{Packet-Src-IP-Address}" == <foo>) { update { request:Tmp-Integer-0 := "%{debug:<level>}" } }
You can use the %{debug:<level>} xlat from within the request, it will probably work more reliably than the radmin interface.
It marks up the current request for debugging at the point the xlat function is called. Unfortunately the output file can still only be set globally.
So, I just would have to add something like "if (%{User-Name} == …) update control {…}" to the beginning of the sections I am interested in?
Yes, or base it on user account flags in an SQL DB or LDAP Directory. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Arran Cudbard-Bell wrote:
if ("%{Packet-Src-IP-Address}" == <foo>) { update { request:Tmp-Integer-0 := "%{debug:<level>}" } }
Ok, thanks for the tip! I tried this, but to no avail: authorize { if (request:NAS-Identifier == 'test') { update control { Tmp-String-0 := "%{debug:4}" } } … } I renamed one client to "test" but there's no debugging output in the log whatsoever. Using global debugging I confirmed that FR indeed enters the condition. "%{debug:4}" seems to be translated to "0". It's 2am here, so it could be that I am missing something. I'll try again tomorrow. Cheers, JB
participants (3)
-
Alan DeKok -
Arran Cudbard-Bell -
JB