FreeRADIUS 4: DHCP v4: ERROR: Expansion "network" needs to be resolved before it is used
Hi, I am trying to test FreeRADIUS 4 on RockyLinux 9.4 built from commit c01f1dbb733966ac51f7d2bacb6343fc04450024 I know that this software is not supposed to be used in production (and I don't do it, it is testing only for now). I tried to configure a simple DHCPv4 service which uses the "files" module to assign per-network properties. The processing fails with expansion of "key" in files: """ files files_dhcp_network { # # moddir:: Search for files in a subdirectory of mods-config which # matches this instance of the files module. # moddir = ${modconfdir}/files_dhcp # # key:: The default key attribute to use for matches. # # The content of this attribute is used to match the `name` of the entry. # key = 'network' # # filename:: The old `users` style file is now located here. # filename = ${moddir}/dhcp_config } """ with error: files_dhcp_network - ERROR: Expansion "network" needs to be resolved before it is used. Here is a part of my ${moddir}/dhcp_config (inspired by https://www.freeradius.org/documentation/freeradius-server/3.2.7/howto/proto... ): """ network IP-Pool.Name := "local" Domain-Name := "example.org", Subnet-Mask := 255.255.255.0, Router-Address := 172.16.1.1, Domain-Name-Server := 192.168.20.2, Fall-Through := yes network Network-Subnet < 172.25.1.0/24 IP-Pool.Name := "pool-172.25.1.0/24", Subnet-Mask := 255.255.255.0, Broadcast-Address := 172.25.1.255 """ Could you, please, if possible point me to what should be corrected? Here is the debug output of a test request: [root@w-v-dmierm-freeradius-test-0 mods-enabled]# radiusd -v Info : radiusd - FreeRADIUS version 4.0.65535 (git #), for host x86_64-redhat-linux-gnu, built on Sep 25 2013 at 00:00:00 Info : Copyright 1999-2024 The FreeRADIUS server project and contributors Info : There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Info : PARTICULAR PURPOSE Info : You may redistribute copies of FreeRADIUS under the terms of the Info : GNU General Public License Info : For more information about these matters, see the file named COPYRIGHT [root@w-v-dmierm-freeradius-test-0 mods-enabled]# radiusd -X Info : Copyright 1999-2024 The FreeRADIUS server project and contributors Info : There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Info : PARTICULAR PURPOSE Info : You may redistribute copies of FreeRADIUS under the terms of the Info : GNU General Public License Info : For more information about these matters, see the file named COPYRIGHT Info : Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf Including files in directory "/etc/raddb/template.d/" including configuration file /etc/raddb/template.d/default including configuration file /etc/raddb/clients.conf Including files in directory "/etc/raddb/global.d/" including configuration file /etc/raddb/global.d/ldap including configuration file /etc/raddb/global.d/python Including files in directory "/etc/raddb/mods-enabled/" including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/files_dhcp Including files in directory "/etc/raddb/policy.d/" including configuration file /etc/raddb/policy.d/abfab-tr including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/canonicalisation including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/operator-name including configuration file /etc/raddb/policy.d/time including configuration file /etc/raddb/policy.d/vendor /etc/raddb/policy.d/vendor[8]: Using deprecated syntax. Please use new the new 'foreach' syntax. Including files in directory "/etc/raddb/sites-enabled/" including configuration file /etc/raddb/sites-enabled/dhcp Loaded module process_dhcpv4 Parsing initial logging configuration. main { prefix = /usr log { destination = file syslog_facility = daemon local_state_dir = "/usr/var" logdir = "/usr/var/log" file = /var/log/radius/radius.log suppress_secrets = no } } Parsing security rules to bootstrap UID / GID / chroot / etc. main { log { } security { allow_core_dumps = no allow_vulnerable_openssl = no openssl_fips_mode = no } name = radiusd local_state_dir = "/usr/var" run_dir = /var/run/radiusd } Parsing main configuration main { server dhcp { namespace = dhcpv4 Loaded module proto_dhcpv4 listen { type = Discover type = Request type = Inform type = Release type = Decline transport = udp Loaded module proto_dhcpv4_udp udp { ipaddr = 0.0.0.0 interface = ens224 port = 67 client_port = 68 broadcast = yes networks { } max_packet_size = 4096 max_attributes = 255 } limit { cleanup_delay = 5.0 idle_timeout = 30.0 nak_lifetime = 30.0 max_connections = 1024 max_clients = 256 max_pending_packets = 256 priority { Discover = normal Request = normal Decline = normal Release = normal Inform = normal Lease-Query = low Bulk-Lease-Query = low } } } } log { colourise = yes } security { } sbin_dir = "/usr/sbin" logdir = /var/log/radius radacctdir = /var/log/radius/radacct reverse_lookups = no hostname_lookups = yes max_request_time = 30 pidfile = /var/run/radiusd/radiusd.pid debug_level = 0 max_requests = 16384 resources { } thread pool { num_networks = 1 Dynamically determined thread.workers = 2 num_workers = 2 openssl_async_pool_init = 64 openssl_async_pool_max = 1024 } migrate { rewrite_update = false forbid_update = false } } Switching to configured log settings log debug { destination = null timestamp = yes colourise = no } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 secret = <<< secret >>> require_message_authenticator = auto limit_proxy_state = auto proto = * limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 secret = <<< secret >>> require_message_authenticator = no limit_proxy_state = auto limit { max_connections = 16 lifetime = 0 idle_timeout = 30s } } Debugger not attached Configuration version: A2E989E4-D5C6-4963-A1D1-083575FFAC4D systemd watchdog is disabled pre-suid-down capabilities: =ep trigger { ... } subsection not found, triggers will be disabled #### Instantiating libraries #### #### Bootstrapping process modules #### #### Bootstrapping protocol modules #### #### Instantiating libraries #### #### Bootstrapping static modules #### modules { static { Loaded module rlm_always always reject { rcode = reject } always fail { rcode = fail } always ok { rcode = ok } always handled { rcode = handled } always invalid { rcode = invalid } always disallow { rcode = disallow } always notfound { rcode = notfound } always noop { rcode = noop } always updated { rcode = updated } Loaded module rlm_files files files_dhcp_network { filename = /etc/raddb/mods-config/files_dhcp/dhcp_config } files files_dhcp_host { filename = /etc/raddb/mods-config/files_dhcp/dhcp_config } } # static #### Bootstrapping rlm modules #### Bootstrapping rlm_always "disallow" Bootstrapping rlm_always "fail" Bootstrapping rlm_always "handled" Bootstrapping rlm_always "invalid" Bootstrapping rlm_always "noop" Bootstrapping rlm_always "notfound" Bootstrapping rlm_always "ok" Bootstrapping rlm_always "reject" Bootstrapping rlm_always "updated" Including dictionary file "/etc/raddb/dictionary" #### Instantiating listeners #### Compiling policies in server dhcp { ... } Compiling policies in - recv Discover {...} Reading file /etc/raddb/mods-config/files_dhcp/dhcp_config Reading file /etc/raddb/mods-config/files_dhcp/dhcp_config Compiling policies in - recv Request {...} Compiling policies in - recv Decline {...} Compiling policies in - recv Release {...} Compiling policies in - recv Inform {...} Compiling policies in - recv Lease-Query {...} /etc/raddb/sites-enabled/dhcp[307]: Skipping remaining instructions due to 'return' /etc/raddb/sites-enabled/dhcp[319]: Skipping remaining instructions due to 'return' dhcpv4 { ... } section is unused #### Instantiating process modules #### #### Instantiating protocol modules #### Instantiating proto_dhcpv4 "dhcp.dhcpv4" Instantiating proto_dhcpv4_udp "dhcp.dhcpv4.udp" #### Instantiating rlm modules #### Instantiating rlm_always "disallow" Instantiating rlm_always "fail" Instantiating rlm_always "handled" Instantiating rlm_always "invalid" Instantiating rlm_always "noop" Instantiating rlm_always "notfound" Instantiating rlm_always "ok" Instantiating rlm_always "reject" Instantiating rlm_always "updated" Scheduler created in single-threaded mode #### Opening listener interfaces #### Listening on dhcpv4_udp server * port 67 on interface ens224 bound to virtual server dhcp post-suid-down capabilities: =ep Ready to process requests proto_dhcpv4_udp - Received Discover XID f252956f length 300 dhcpv4_udp server * port 67 on interface ens224 Worker - Resetting cleanup timer to +30 (0) dhcp { (0) Received Discover XID f252956f from 0.0.0.0:68 to 255.255.255.255:67 via ens224 (0) Opcode = Client-Message (0) Hardware-Type = Ethernet (0) Hardware-Address-Length = 6 (0) Hop-Count = 0 (0) Transaction-Id = 4065498479 (0) Number-of-Seconds = 0 (0) Flags = 0 (0) Client-IP-Address = 0.0.0.0 (0) Your-IP-Address = 0.0.0.0 (0) Server-IP-Address = 0.0.0.0 (0) Gateway-IP-Address = 0.0.0.0 (0) Client-Hardware-Address = 02:01:aa:bb:cc:dd (0) Message-Type = Discover (0) Client-Identifier = 0x616263313233 (0) Network-Subnet = 0.0.0.0/32 (0) Net { (0) Src { (0) IP = 0.0.0.0 (0) Port = 68 (0) } (0) Dst { (0) IP = 255.255.255.255 (0) Port = 67 (0) } (0) Timestamp = "2024-11-08T10:16:53Z" (0) } (0) Packet-Type = Discover (0) Running 'recv Discover' from file /etc/raddb/sites-enabled/dhcp (0) recv Discover { (0) files_dhcp_network - ERROR: Expansion "network" needs to be resolved before it is used (0) files_dhcp_network (fail) (0) } # recv Discover (fail) (0) Not sending reply to client (0) dhcp (fail) (0) } # dhcp (fail) (0) Done request (0) Finished request proto_dhcpv4_udp - cleaning up request in 5.000000s ^CSignalled to terminate Exiting normally Thank you in advance, // Dmitrii.
On Nov 8, 2024, at 11:27 AM, Dima Ermakov <demonihin@gmail.com> wrote:
I am trying to test FreeRADIUS 4 on RockyLinux 9.4 built from commit c01f1dbb733966ac51f7d2bacb6343fc04450024 I know that this software is not supposed to be used in production (and I don't do it, it is testing only for now).
It should mostly work, barring some corner cases and features which aren't implemented.
I tried to configure a simple DHCPv4 service which uses the "files" module to assign per-network properties. The processing fails with expansion of "key" in files:
""" files files_dhcp_network { ... key = 'network'
Why are you using a fixed string here? This doesn't make sense. What are you trying to do? Why are all of the "files" entries using a fixed name "network"?
with error: files_dhcp_network - ERROR: Expansion "network" needs to be resolved before it is used.
Yes, the documentation explains that the "key" field should be an expansion, an attribute reference, etc. It shouldn't be a fixed string.
Here is a part of my ${moddir}/dhcp_config (inspired by https://www.freeradius.org/documentation/freeradius-server/3.2.7/howto/proto... ):
""" network IP-Pool.Name := "local" Domain-Name := "example.org", Subnet-Mask := 255.255.255.0, Router-Address := 172.16.1.1, Domain-Name-Server := 192.168.20.2, Fall-Through := yes
network Network-Subnet < 172.25.1.0/24 IP-Pool.Name := "pool-172.25.1.0/24", Subnet-Mask := 255.255.255.0, Broadcast-Address := 172.25.1.255 """
So every "files" entry is keyed with the word "network". Why? What are you trying to do? Why do you expect it to do when you configure a fixed key of "network"?
Could you, please, if possible point me to what should be corrected?
Use the word DEFAULT to match all entries, or configure the "key" field to use an actual key, and not a fixed string. Alan DeKok.
Hi Alan, Thank you for your explanation. Here is what I want to do eventually: 1. Define per IP Prefix DHCP configuration, preferably, via text "files". The configuration should contain: DNS settings, Lease time, Default gateway (maybe more later); 2. For some network prefixes I want to define DHCP pools with SQL integration to track active leases (this will be my next step, when I manage to do the first step). To do so, I read the wiki page (although for FreeRADIUS 3.2) about DHCP and read the configuration from v3.2 (which was probably my mistake). The examples from v3.2 (mods-available/dhcp_files) gave me the idea to use static key="network" (see below): """ # Instances of the "files" module for managing DHCP options # files dhcp_network { # The file containing network-specific DHCP options mapping filename = ${modconfdir}/files/dhcp # For network lookups we use a fixed key. Matching # actual networks is done by additional filtering within # the file key = "network" } """ I see your recommendation to use DEFAULT. To implement (1), should I create several DEFAULT sections + Fall-Through := yes + Network-Subnet comparison operations like below? """ # files dhcp_config content: DEFAULT Network-Subnet < 172.25.1.0/24 Domaiin-Name-Server := 192.168.20.2, Router-Address := 172.25.1.1, Fall-Through := yes DEFAULT Network-Subnet < 172.25.2.0/24 Domaiin-Name-Server := 192.168.20.2, Router-Address := 172.25.2.1, Fall-Through := yes """ or I misunderstood you? // Dmitrii. On Fri, 8 Nov 2024 at 13:00, Alan DeKok <aland@deployingradius.com> wrote:
On Nov 8, 2024, at 11:27 AM, Dima Ermakov <demonihin@gmail.com> wrote:
I am trying to test FreeRADIUS 4 on RockyLinux 9.4 built from commit c01f1dbb733966ac51f7d2bacb6343fc04450024 I know that this software is not supposed to be used in production (and I don't do it, it is testing only for now).
It should mostly work, barring some corner cases and features which aren't implemented.
I tried to configure a simple DHCPv4 service which uses the "files" module to assign per-network properties. The processing fails with expansion of "key" in files:
""" files files_dhcp_network { ... key = 'network'
Why are you using a fixed string here? This doesn't make sense.
What are you trying to do? Why are all of the "files" entries using a fixed name "network"?
with error: files_dhcp_network - ERROR: Expansion "network" needs to be resolved before it is used.
Yes, the documentation explains that the "key" field should be an expansion, an attribute reference, etc. It shouldn't be a fixed string.
Here is a part of my ${moddir}/dhcp_config (inspired by https://www.freeradius.org/documentation/freeradius-server/3.2.7/howto/proto... ):
""" network IP-Pool.Name := "local" Domain-Name := "example.org", Subnet-Mask := 255.255.255.0, Router-Address := 172.16.1.1, Domain-Name-Server := 192.168.20.2, Fall-Through := yes
network Network-Subnet < 172.25.1.0/24 IP-Pool.Name := "pool-172.25.1.0/24", Subnet-Mask := 255.255.255.0, Broadcast-Address := 172.25.1.255 """
So every "files" entry is keyed with the word "network". Why?
What are you trying to do? Why do you expect it to do when you configure a fixed key of "network"?
Could you, please, if possible point me to what should be corrected?
Use the word DEFAULT to match all entries, or configure the "key" field to use an actual key, and not a fixed string.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- С уважением, Дмитрий Ермаков.
On Nov 8, 2024, at 12:34 PM, Dima Ermakov <demonihin@gmail.com> wrote:
Here is what I want to do eventually: 1. Define per IP Prefix DHCP configuration, preferably, via text "files". The configuration should contain: DNS settings, Lease time, Default gateway (maybe more later);
That's a little vague. The documentation / configuration for the "files" module explains how it works. You will need to read that, and then figure out how your requirements can be implemented in the "files" module. Note that this does *not* mean configuring a fixed key "network" for every entry.
2. For some network prefixes I want to define DHCP pools with SQL integration to track active leases (this will be my next step, when I manage to do the first step).
That's fine.
To do so, I read the wiki page (although for FreeRADIUS 3.2) about DHCP and read the configuration from v3.2 (which was probably my mistake).
The examples from v3.2 (mods-available/dhcp_files) gave me the idea to use static key="network" (see below):
You can't apply the v3 documentation to v4. It's a major version upgrade.
I see your recommendation to use DEFAULT. To implement (1), should I create several DEFAULT sections + Fall-Through := yes + Network-Subnet comparison operations like below?
Maybe? What do you want to do? You still haven't really explained. Why not just write the rules directly in "unlang"? If every entry matches, you might as well just write if / then / else statements. Alan DeKok.
Hi Alan, Thank you for your explanations. I am sorry for being annoying but I am still somewhat lost. I will try to explain what I want to achieve using an example below: Here is a network description (all network numbers are imaginary): VLAN 10 (192.168.10.0/24, default gateway 192.168.10.1, DNS server 192.168.20.2, DHCP relay 192.168.10.1). VLAN 20 (192.168.20.0/24, default gateway 192.168.20.1, DNS server 192.168.20.2, DHCP relay 192.168.20.1). VLAN 30 (192.168.30.0/24, default gateway 192.168.30.1, DNS server 192.168.20.2, DHCP relay 192.168.30.1). The FreeRADIUS is in VLAN 30, 192.168.30.5. VLAN 10 and VLAN 20 are connected via a switch with layer 3 support and DHCP relay. The DHCP relay is configured to send DHCP packets to the FreeRADIUS IP + add the GIADDR IP address of the interface to which the relay receives DHCP packets (Gateway-IP-Address in FreeRADIUS as far as I understand). The goal is to configure FreeRADIUS to offer IP addresses via DHCP for networks VLAN 10 and VLAN 20. The networks 192.168.10.0/24 and 192.168.20.0/24 should have different default gateways but the same DNS settings. Also, I would like to have the network-specific settings in some kind of text files and not SQL database (if possible) to be able to use external tools to generate (template) the files (expected number of network prefixes is about 300). For the FreeRADIUS 3 one of the recommendations was to use "files" module with configuration in the "files" similar to ( https://www.freeradius.org/documentation/freeradius-server/3.2.5/howto/proto... ): """ network DHCP-Network-Subnet < 192.168.10.0/24 DHCP-Subnet-Mask := 255.255.255.0, DHCP-Router-Address := 192.168.10.1, DHCP-Domain-Name-Server := 192.168.20.2, DHCP-IP-Address-Lease-Time := 7200 network DHCP-Network-Subnet < 192.168.20.0/24 DHCP-Subnet-Mask := 255.255.255.0, DHCP-Router-Address := 192.168.20.1, DHCP-Domain-Name-Server := 192.168.20.2, DHCP-IP-Address-Lease-Time := 7200 """ Could you, please, recommend a way to implement something similar with FreeRADIUS 4? // Dmitrii. """ On Fri, 8 Nov 2024 at 13:49, Alan DeKok <aland@deployingradius.com> wrote:
On Nov 8, 2024, at 12:34 PM, Dima Ermakov <demonihin@gmail.com> wrote:
Here is what I want to do eventually: 1. Define per IP Prefix DHCP configuration, preferably, via text "files". The configuration should contain: DNS settings, Lease time, Default gateway (maybe more later);
That's a little vague.
The documentation / configuration for the "files" module explains how it works. You will need to read that, and then figure out how your requirements can be implemented in the "files" module.
Note that this does *not* mean configuring a fixed key "network" for every entry.
2. For some network prefixes I want to define DHCP pools with SQL integration to track active leases (this will be my next step, when I manage to do the first step).
That's fine.
To do so, I read the wiki page (although for FreeRADIUS 3.2) about DHCP and read the configuration from v3.2 (which was probably my mistake).
The examples from v3.2 (mods-available/dhcp_files) gave me the idea to use static key="network" (see below):
You can't apply the v3 documentation to v4. It's a major version upgrade.
I see your recommendation to use DEFAULT. To implement (1), should I create several DEFAULT sections + Fall-Through := yes + Network-Subnet comparison operations like below?
Maybe?
What do you want to do? You still haven't really explained.
Why not just write the rules directly in "unlang"? If every entry matches, you might as well just write if / then / else statements.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- С уважением, Дмитрий Ермаков.
On Nov 11, 2024, at 4:00 AM, Dima Ermakov <demonihin@gmail.com> wrote
Thank you for your explanations. I am sorry for being annoying but I am still somewhat lost.
I will try to explain what I want to achieve using an example below:
Here is a network description (all network numbers are imaginary):
VLAN 10 (192.168.10.0/24, default gateway 192.168.10.1, DNS server 192.168.20.2, DHCP relay 192.168.10.1). VLAN 20 (192.168.20.0/24, default gateway 192.168.20.1, DNS server 192.168.20.2, DHCP relay 192.168.20.1). VLAN 30 (192.168.30.0/24, default gateway 192.168.30.1, DNS server 192.168.20.2, DHCP relay 192.168.30.1).
OK.
The FreeRADIUS is in VLAN 30, 192.168.30.5.
VLAN 10 and VLAN 20 are connected via a switch with layer 3 support and DHCP relay. The DHCP relay is configured to send DHCP packets to the FreeRADIUS IP + add the GIADDR IP address of the interface to which the relay receives DHCP packets (Gateway-IP-Address in FreeRADIUS as far as I understand).
The goal is to configure FreeRADIUS to offer IP addresses via DHCP for networks VLAN 10 and VLAN 20.
Does the gateway send VLAN information in the DHCP packets? i.e. how does FreeRADIUS know which VLAN is in use? As always... read the debug output.
The networks 192.168.10.0/24 and 192.168.20.0/24 should have different default gateways but the same DNS settings.
You can configure any options you want in the reply.
Also, I would like to have the network-specific settings in some kind of text files and not SQL database (if possible) to be able to use external tools to generate (template) the files (expected number of network prefixes is about 300).
That's fine,
For the FreeRADIUS 3 one of the recommendations was to use "files" module with configuration in the "files" similar to ( https://www.freeradius.org/documentation/freeradius-server/3.2.5/howto/proto... ):
Yes... there's no need to keep posting that link. You already did that. Posting it again and again doesn't help.
""" network DHCP-Network-Subnet < 192.168.10.0/24 DHCP-Subnet-Mask := 255.255.255.0, DHCP-Router-Address := 192.168.10.1, DHCP-Domain-Name-Server := 192.168.20.2, DHCP-IP-Address-Lease-Time := 7200
network DHCP-Network-Subnet < 192.168.20.0/24 DHCP-Subnet-Mask := 255.255.255.0, DHCP-Router-Address := 192.168.20.1, DHCP-Domain-Name-Server := 192.168.20.2, DHCP-IP-Address-Lease-Time := 7200 """
Could you, please, recommend a way to implement something similar with FreeRADIUS 4?
I already gave you one option: just write the policies in unlang. This can be automatically generated. Another option is to read the comments in the "files" module. It points you to some more documentation, which is also online at: https://www.freeradius.org/documentation/freeradius-server/4.0.0/raddb/mods-... and then that links to: https://www.freeradius.org/documentation/freeradius-server/4.0.0/raddb/mods-... That page says you can use IP addresses as keys! So that's exactly what you want. Instead of using key = 'network' you use key = DHCP-Network-Subnet And then the entries are: 192.168.10.0/24 DHCP-Subnet-Mask := 255.255.255.0, DHCP-Router-Address := 192.168.10.1, DHCP-Domain-Name-Server := 192.168.20.2, DHCP-IP-Address-Lease-Time := 7200 192.168.20.0/24 DHCP-Subnet-Mask := 255.255.255.0, DHCP-Router-Address := 192.168.20.1, DHCP-Domain-Name-Server := 192.168.20.2, DHCP-IP-Address-Lease-Time := 7200 That should work. Alan DeKok.
I tried the "files" approach for now with the ' key = "%{Network-Subnet}" ' please take a look below: If I add in "files": """ 192.168.10.0/24 Router-Address := 192.168.10.1, Subnet-Mask := 255.255.255.0, Broadcast-Address := 192.168.10.255, Domain-Name-Server := 192.168.20.2 """ then the result is "noop", no match which makes sense to me: """ proto_dhcpv4_udp - Received Discover XID 2b863239 length 300 dhcpv4_udp server * port 67 (1) dhcp { (1) Received Discover XID 2b863239 from 192.168.30.1:49373 to 192.168.19.55:67 via ens192 (1) Opcode = Client-Message (1) Hardware-Type = Ethernet (1) Hardware-Address-Length = 6 (1) Hop-Count = 1 (1) Transaction-Id = 730214969 (1) Number-of-Seconds = 0 (1) Flags = 0 (1) Client-IP-Address = 0.0.0.0 (1) Your-IP-Address = 0.0.0.0 (1) Server-IP-Address = 0.0.0.0 (1) Gateway-IP-Address = 192.168.10.1 (1) Client-Hardware-Address = 52:54:00:d8:4e:4e (1) Message-Type = Discover (1) Hostname = "vyos" (1) Parameter-Request-List = Subnet-Mask (1) Parameter-Request-List = Broadcast-Address (1) Parameter-Request-List = Time-Offset (1) Parameter-Request-List = Router-Address (1) Parameter-Request-List = Domain-Name (1) Parameter-Request-List = Domain-Name-Server (1) Parameter-Request-List = Domain-Search (1) Parameter-Request-List = Hostname (1) Parameter-Request-List = NETBIOS-Name-Servers (1) Parameter-Request-List = NETBIOS (1) Parameter-Request-List = Interface-MTU-Size (1) Parameter-Request-List = Classless-Static-Route (1) Parameter-Request-List = NTP-Servers (1) Client-Identifier = 0xff00d84e4e000100012ec4b0ce525400d84e4e (1) Relay-Agent-Information { (1) Circuit-Id = 0x65746831 (1) } (1) Network-Subnet = 192.168.10.1/32 (1) Net { (1) Src { (1) IP = 192.168.30.1 (1) Port = 49373 (1) } (1) Dst { (1) IP = 192.168.19.55 (1) Port = 67 (1) } (1) Timestamp = "2024-11-11T12:21:46Z" (1) } (1) Packet-Type = Discover (1) Running 'recv Discover' from file /etc/raddb/sites-enabled/dhcp (1) recv Discover { (1) files_dhcp_network - | Network-Subnet (1) files_dhcp_network - | %{Network-Subnet} (1) files_dhcp_network - | --> 192.168.10.1/32 (1) files_dhcp_network - Looking for key "192.168.10.1/32" (1) files_dhcp_network - files_dhcp_network (noop) (1) } # recv Discover (noop) (1) Not sending reply to client (1) dhcp (noop) (1) } # dhcp (noop) (1) Done request (1) Finished request """
From the debug above I assume that the DHCP relay adds Relay agent IP from the interface to which it received the DHCP Discover broadcast (192.168.10.1 in this case) which is then stored in FreeRADIUS request context in "Network-Subnet" as "192.168.10.1/32" ipaddr.
For another test (option 2): If I add in "files": """ 192.168.10.1/32 Router-Address := 192.168.10.1, Subnet-Mask := 255.255.255.0, Broadcast-Address := 192.168.10.255, Domain-Name-Server := 192.168.20.2 """ then the match is found and it is what I want to have: """ (1) recv Discover { (1) files_dhcp_network - | Network-Subnet (1) files_dhcp_network - | %{Network-Subnet} (1) files_dhcp_network - | --> 192.168.10.1/32 (1) files_dhcp_network - Looking for key "192.168.10.1/32" (1) files_dhcp_network - Found match "192.168.10.1/32" on line 35 of /etc/raddb/mods-config/files_dhcp/dhcp_config_networks (1) files_dhcp_network - Preparing attribute updates: (1) &Router-Address := 192.168.10.1 (1) &Subnet-Mask := 255.255.255.0 (1) &Broadcast-Address := 192.168.10.255 (1) &Domain-Name-Server := 192.168.20.2 (1) files_dhcp_network - files_dhcp_network (ok) (1) } # recv Discover (ok) """
From the attempts above I think that the "option 2" will work well for me. Still, it is a bit inconvenient to configure the DHCP relay agent "receiving" interface in the FreeRADIUS configuration (192.168.10.1/32 in this case). It would be nice to be able to match by network prefix, so that "any" DHCP relay agent IP from the prefix 192.168.10.0/24 would match some section.
It is probably possible via unlang (something like foreach loop + IP address to network prefix comparison [https://www.freeradius.org/documentation/freeradius-server/4.0.0/reference/u...]) but I need to read more to understand "if" and "how". Thank you very much! // Dmitrii. On Mon, 11 Nov 2024 at 12:27, Alan DeKok <aland@deployingradius.com> wrote:
On Nov 11, 2024, at 4:00 AM, Dima Ermakov <demonihin@gmail.com> wrote
Thank you for your explanations. I am sorry for being annoying but I am still somewhat lost.
I will try to explain what I want to achieve using an example below:
Here is a network description (all network numbers are imaginary):
VLAN 10 (192.168.10.0/24, default gateway 192.168.10.1, DNS server 192.168.20.2, DHCP relay 192.168.10.1). VLAN 20 (192.168.20.0/24, default gateway 192.168.20.1, DNS server 192.168.20.2, DHCP relay 192.168.20.1). VLAN 30 (192.168.30.0/24, default gateway 192.168.30.1, DNS server 192.168.20.2, DHCP relay 192.168.30.1).
OK.
The FreeRADIUS is in VLAN 30, 192.168.30.5.
VLAN 10 and VLAN 20 are connected via a switch with layer 3 support and DHCP relay. The DHCP relay is configured to send DHCP packets to the FreeRADIUS IP + add the GIADDR IP address of the interface to which the relay receives DHCP packets (Gateway-IP-Address in FreeRADIUS as far as I understand).
The goal is to configure FreeRADIUS to offer IP addresses via DHCP for networks VLAN 10 and VLAN 20.
Does the gateway send VLAN information in the DHCP packets? i.e. how does FreeRADIUS know which VLAN is in use?
As always... read the debug output.
The networks 192.168.10.0/24 and 192.168.20.0/24 should have different default gateways but the same DNS settings.
You can configure any options you want in the reply.
Also, I would like to have the network-specific settings in some kind of text files and not SQL database (if possible) to be able to use external tools to generate (template) the files (expected number of network prefixes is about 300).
That's fine,
For the FreeRADIUS 3 one of the recommendations was to use "files" module with configuration in the "files" similar to ( https://www.freeradius.org/documentation/freeradius-server/3.2.5/howto/proto... ):
Yes... there's no need to keep posting that link. You already did that. Posting it again and again doesn't help.
""" network DHCP-Network-Subnet < 192.168.10.0/24 DHCP-Subnet-Mask := 255.255.255.0, DHCP-Router-Address := 192.168.10.1, DHCP-Domain-Name-Server := 192.168.20.2, DHCP-IP-Address-Lease-Time := 7200
network DHCP-Network-Subnet < 192.168.20.0/24 DHCP-Subnet-Mask := 255.255.255.0, DHCP-Router-Address := 192.168.20.1, DHCP-Domain-Name-Server := 192.168.20.2, DHCP-IP-Address-Lease-Time := 7200 """
Could you, please, recommend a way to implement something similar with FreeRADIUS 4?
I already gave you one option: just write the policies in unlang. This can be automatically generated.
Another option is to read the comments in the "files" module. It points you to some more documentation, which is also online at:
https://www.freeradius.org/documentation/freeradius-server/4.0.0/raddb/mods-...
and then that links to:
https://www.freeradius.org/documentation/freeradius-server/4.0.0/raddb/mods-...
That page says you can use IP addresses as keys! So that's exactly what you want.
Instead of using
key = 'network'
you use
key = DHCP-Network-Subnet
And then the entries are:
192.168.10.0/24 DHCP-Subnet-Mask := 255.255.255.0, DHCP-Router-Address := 192.168.10.1, DHCP-Domain-Name-Server := 192.168.20.2, DHCP-IP-Address-Lease-Time := 7200
192.168.20.0/24 DHCP-Subnet-Mask := 255.255.255.0, DHCP-Router-Address := 192.168.20.1, DHCP-Domain-Name-Server := 192.168.20.2, DHCP-IP-Address-Lease-Time := 7200
That should work.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- С уважением, Дмитрий Ермаков.
On Nov 11, 2024, at 7:47 AM, Dima Ermakov <demonihin@gmail.com> wrote:
I tried the "files" approach for now with the ' key = "%{Network-Subnet}" ' please take a look below:
Yes, that's good. The attributes all got renamed in v4.
From the attempts above I think that the "option 2" will work well for me. Still, it is a bit inconvenient to configure the DHCP relay agent "receiving" interface in the FreeRADIUS configuration (192.168.10.1/32 in this case). It would be nice to be able to match by network prefix, so that "any" DHCP relay agent IP from the prefix 192.168.10.0/24 would match some section.
As the documentation suggests, you can control the prefix matching. Add a DEFAULT at the top of the file: DEFAULT Next-Shortest-Prefix = yes 192.168.10.0/24 Router-Address := 192.168.10.1, Subnet-Mask := 255.255.255.0, Broadcast-Address := 192.168.10.255, Domain-Name-Server := 192.168.20.2 And it will automatically find the right prefix. This isn't ideal, but it should work. Alan DeKok.
participants (2)
-
Alan DeKok -
Dima Ermakov