Adding Multiple Cisco-AVPairs using rlm_perl
I have a rlm_perl script where i'd like to return multiple Cisco-AVPair attributes in an Access-Accept response. Since rlm_perl is passed hashes for RAD_REQUEST, RAD_CHECK, and RAD_REPLY, is there a way to pass an array as the value for the Cisco-AVPair hash key? If not, is there another way to do this? Thanks, James
James Nedila <jn@colonynetworks.com> writes:
I have a rlm_perl script where i'd like to return multiple Cisco-AVPair attributes in an Access-Accept response.
Since rlm_perl is passed hashes for RAD_REQUEST, RAD_CHECK, and RAD_REPLY, is there a way to pass an array as the value for the Cisco-AVPair hash key? If not, is there another way to do this?
Use an array ref as value. I.e $RAD_REPLY{'Cisco-AVPair'} = [ 'ip:inacl#1=permit udp any any eq 53', 'ip:inacl#2=permit tcp any any eq 80', 'ip:inacl#3=deny ip any any', ]; Bjørn
В сообщении от Среда 20 января 2010 02:29:54 автор Bjørn Mork написал:
James Nedila <jn@colonynetworks.com> writes:
I have a rlm_perl script where i'd like to return multiple Cisco-AVPair attributes in an Access-Accept response.
Since rlm_perl is passed hashes for RAD_REQUEST, RAD_CHECK, and RAD_REPLY, is there a way to pass an array as the value for the Cisco-AVPair hash key? If not, is there another way to do this?
Use an array ref as value. I.e
$RAD_REPLY{'Cisco-AVPair'} = [ 'ip:inacl#1=permit udp any any eq 53', 'ip:inacl#2=permit tcp any any eq 80', 'ip:inacl#3=deny ip any any', ];
This isn't working, i'm trying to put 2 dns-servers in dhcp configuration like this: $RAD_REPLY{'DHCP-Domain-Name-Server'} = ["$ns1","$ns2"] ; and in resolv.conf i see: nameserver IP1 IP2 but i need nameserver IP1 nameserver IP2 and if to talk about perl - where no way to have 2 one named key(attribute like DHCP-Domain-Name-Server ) in hash array, so must be other way to put 2 dns-servers in rad_reply from rlm_perl, how to do this? for now only one way - dhcp-site and 2 attributes in unlang condition.
Bjørn
-- Alexander Kubatkin
Alexander Kubatkin wrote:
This isn't working, i'm trying to put 2 dns-servers in dhcp configuration like this: $RAD_REPLY{'DHCP-Domain-Name-Server'} = ["$ns1","$ns2"] ;
and in resolv.conf i see: nameserver IP1 IP2
The RADIUS server doesn't edit /etc/resolv.conf. The above line shows that both IPs are getting to the client (and WHY not run the server in debugging mode to see what it's sending?) Alan DeKok.
В сообщении от Воскресенье 22 августа 2010 10:48:56 автор Alan DeKok написал:
Alexander Kubatkin wrote:
This isn't working, i'm trying to put 2 dns-servers in dhcp configuration like this: $RAD_REPLY{'DHCP-Domain-Name-Server'} = ["$ns1","$ns2"] ;
and in resolv.conf i see: nameserver IP1 IP2
The RADIUS server doesn't edit /etc/resolv.conf.
:) i know that, just show a result.
The above line shows that both IPs are getting to the client (and WHY not run the server in debugging mode to see what it's sending?)
it sending only one DHCP-Domain-Name-Server attribute Sending DHCP-Ack of id 3a639955 from DHCP-SERVER:67 to DHCP-AGENT-RELAY:67 DHCP-Subnet-Mask = MASK DHCP-Router-Address = GATEWAY DHCP-Domain-Name-Server = NS_IP2 DHCP-Domain-Name = DOMAIN DHCP-Broadcast-Address = BROADCAST DHCP-NTP-Servers = NTP_IP DHCP-IP-Address-Lease-Time = LEASE_TIME Finished request 2. by in fact, when domain-name-server configured as: $RAD_REPLY{'DHCP-Domain-Name-Server'} = ["$ns1","$ns2"] ; dhcp-ack packet sended option t=6 and l=4, as a result - we have only one nameserver and when configured in dhcp-site as: DHCP-Domain-Name-Server = IP1 DHCP-Domain-Name-Server = IP2 dhcp-ack packet sended option t=6 and l=8, as a result we have two nameservers and more... then this attrubute configured in dhcp-site as 2 separate IPs, in radiusd -X output showed only one this attribute with only one value in "Sending DHCP-Ack"-section.
Alan DeKok.
-- __________________________________________________ Alexander Kubatkin
On Aug 22, 2010, at 3:06 PM, Alexander Kubatkin wrote:
В сообщении от Воскресенье 22 августа 2010 10:48:56 автор Alan DeKok написал:
Alexander Kubatkin wrote:
This isn't working, i'm trying to put 2 dns-servers in dhcp configuration like this: $RAD_REPLY{'DHCP-Domain-Name-Server'} = ["$ns1","$ns2"] ;
To return multiple items you have to use array ref. Try this way. $data[0] = "nameserver_1"; $data[1] = "nameserver_2"; $data[2] = "nameserver_3"; $data[3] = "nameserver_x"; $RAD_REPLY{'DHCP-Domain-Name-Server'} = \@data; Best Regards, Boian Jordanov Head of Voice Department tel. +359 2 4004 723 tel. +359 2 4004 002
Boian Jordanov <bjordanov@orbitel.bg> writes:
On Aug 22, 2010, at 3:06 PM, Alexander Kubatkin wrote:
В сообщении от Воскресенье 22 августа 2010 10:48:56 автор Alan DeKok написал:
Alexander Kubatkin wrote:
This isn't working, i'm trying to put 2 dns-servers in dhcp configuration like this: $RAD_REPLY{'DHCP-Domain-Name-Server'} = ["$ns1","$ns2"] ;
To return multiple items you have to use array ref.
Try this way.
$data[0] = "nameserver_1"; $data[1] = "nameserver_2";
$data[2] = "nameserver_3";
$data[3] = "nameserver_x";
$RAD_REPLY{'DHCP-Domain-Name-Server'} = \@data;
Which should be equivalent to doing $RAD_REPLY{'DHCP-Domain-Name-Server'} = ["nameserver_1", "nameserver_2", "nameserver_3", "nameserver_x"]; so I don't think that's the problem. But we are all guessing, since we haven't yet seen the actual debug output from FreeRADIUS, only selected bits and pieces of the non-working end result. Since we *know* that FreeRADIUS and rlm_perl work when configured correctly, we can deduce that there is "something" wrong with the configuration. I believe that's the best we can do, given the input available to us. Bjørn
В сообщении от Четверг 26 августа 2010 11:17:45 автор Bjørn Mork написал:
Boian Jordanov <bjordanov@orbitel.bg> writes:
On Aug 22, 2010, at 3:06 PM, Alexander Kubatkin wrote:
В сообщении от Воскресенье 22 августа 2010 10:48:56 автор Alan DeKok написал:
Alexander Kubatkin wrote:
This isn't working, i'm trying to put 2 dns-servers in dhcp configuration like this: $RAD_REPLY{'DHCP-Domain-Name-Server'} = ["$ns1","$ns2"] ;
To return multiple items you have to use array ref.
Try this way.
$data[0] = "nameserver_1"; $data[1] = "nameserver_2";
$data[2] = "nameserver_3";
$data[3] = "nameserver_x";
$RAD_REPLY{'DHCP-Domain-Name-Server'} = \@data;
Which should be equivalent to doing
$RAD_REPLY{'DHCP-Domain-Name-Server'} = ["nameserver_1", "nameserver_2", "nameserver_3", "nameserver_x"];
so I don't think that's the problem.
But we are all guessing, since we haven't yet seen the actual debug output from FreeRADIUS, only selected bits and pieces of the non-working end result.
Since we *know* that FreeRADIUS and rlm_perl work when configured correctly, we can deduce that there is "something" wrong with the configuration. I believe that's the best we can do, given the input available to us.
this is with $RAD_REPLY{'DHCP-Domain-Name-Server'} = ["$ns1","$ns2"] ; Received DHCP-Request of id ef3e6917 from Relay_ip:68 to DHCP-Server_ip:67 DHCP-Opcode = Client-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 1 DHCP-Transaction-Id = 4013844759 DHCP-Number-of-Seconds = 73 DHCP-Flags = 0 DHCP-Client-IP-Address = Client_ip DHCP-Your-IP-Address = 0.0.0.0 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = Relay_ip DHCP-Client-Hardware-Address = Client_mac DHCP-Message-Type = DHCP-Request DHCP-Hostname = "kaa-laptop" DHCP-Parameter-Request-List = DHCP-Subnet-Mask DHCP-Parameter-Request-List = DHCP-Broadcast-Address DHCP-Parameter-Request-List = DHCP-Time-Offset DHCP-Parameter-Request-List = DHCP-Router-Address DHCP-Parameter-Request-List = DHCP-Domain-Name DHCP-Parameter-Request-List = DHCP-Domain-Name-Server DHCP-Parameter-Request-List = DHCP-Domain-Search DHCP-Parameter-Request-List = DHCP-Hostname DHCP-Parameter-Request-List = DHCP-NETBIOS-Name-Servers DHCP-Parameter-Request-List = DHCP-NETBIOS DHCP-Parameter-Request-List = DHCP-Interface-MTU-Size DHCP-Parameter-Request-List = DHCP-Classless-Static-Route DHCP-Parameter-Request-List = DHCP-NTP-Servers DHCP-Agent-Circuit-Id = 0x000403e50002 server dhcp { Trying sub-section dhcp DHCP-Request {...} +- entering group DHCP-Request {...} [linelog] expand: %{reply:DHCP-Message-Type} -> [linelog] ... expanding second conditional [linelog] expand: %{request:DHCP-Message-Type} -> DHCP-Request [linelog] expand: %{%{reply:DHCP-Message-Type}:-%{request:DHCP-Message-Type}} -> DHCP-Request [linelog] expand: /var/log/linelog -> /var/log/linelog [linelog] expand: %{request:DHCP-Client-IP-Address} -> Client_ip [linelog] expand: %{DHCP-Transaction-Id} REQUEST: %{%{request:DHCP-Client-IP-Address}:-%{request:DHCP-Requested-IP-Address}} from [%{DHCP-Client-Hardware-Address}] via (%{DHCP-Gateway-IP-Address}) ... option82= %{DHCP- Relay-Agent-Information} -> 4013844759 REQUEST: Client_ip from [Client_mac] via (Relay_ip) ... option82= ++[linelog] returns ok acid: 0x000403e50002 arid: 0x00060022b06cdd22 option82: 0x0106000403e5000200060022b06cdd22 prepare_cached(call dhcp_get_all(?,?,@ip,@broadcast,@mask,@gw,@ns1,@ns2,@ntp,@domain,@lease_time)) statement handle DBI::st=HASH(0x80269bb00) still Active at /usr/local/etc/raddb/dhcp.pl line 235 rlm_perl: Added pair DHCP-Your-IP-Address = 0.0.0.0 rlm_perl: Added pair DHCP-Message-Type = DHCP-Request rlm_perl: Added pair DHCP-Hop-Count = 1 rlm_perl: Added pair Tmp-String-0 = OK rlm_perl: Added pair DHCP-Agent-Circuit-Id = 0x000403e50002 rlm_perl: Added pair DHCP-Number-of-Seconds = 73 rlm_perl: Added pair DHCP-Client-IP-Address = Client_ip rlm_perl: Added pair DHCP-Agent-Remote-Id = 0x00060022b06cdd22 rlm_perl: Added pair DHCP-Gateway-IP-Address = Relay_ip rlm_perl: Added pair DHCP-Hardware-Type = Ethernet rlm_perl: Added pair DHCP-Flags = 0 rlm_perl: Added pair DHCP-Hardware-Address-Length = 6 rlm_perl: Added pair DHCP-Hostname = laptop_hostname rlm_perl: Added pair DHCP-Opcode = Client-Message rlm_perl: Added pair DHCP-Transaction-Id = 4013844759 rlm_perl: Added pair DHCP-Client-Hardware-Address = Client_mac rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-Subnet-Mask rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-Broadcast-Address rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-Time-Offset rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-Router-Address rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-Domain-Name rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-Domain-Name-Server rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-Domain-Search rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-Hostname rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-NETBIOS-Name-Servers rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-NETBIOS rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-Interface-MTU-Size rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-Classless-Static-Route rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-NTP-Servers rlm_perl: Added pair DHCP-Server-IP-Address = 0.0.0.0 rlm_perl: Added pair DHCP-Your-IP-Address = Client_ip rlm_perl: Added pair DHCP-Domain-Name-Server = NS1_ip rlm_perl: Added pair DHCP-Domain-Name-Server = NS2_ip rlm_perl: Added pair DHCP-Subnet-Mask = MASK rlm_perl: Added pair DHCP-Router-Address = Gateway_ip rlm_perl: Added pair DHCP-IP-Address-Lease-Time = 180 rlm_perl: Added pair DHCP-Domain-name = domain1 domain2 rlm_perl: Added pair DHCP-NTP-Servers = NTP-Server_name rlm_perl: Added pair DHCP-Broadcast-Address = BROADCAST ++[perl] returns ok ++? if (ok) ? Evaluating (ok) -> TRUE ++? if (ok) -> TRUE ++- entering if (ok) {...} expand: %{Packet-Dst-IP-Address} -> +++[reply] returns ok +++? if (DHCP-Vendor-Class-Identifier == "MSFT 5.0") (Attribute DHCP-Vendor-Class-Identifier was not found) ++- if (ok) returns ok ++ ... skipping elsif for request 3: Preceding "if" was taken ++ ... skipping else for request 3: Preceding "if" was taken [linelog] expand: %{reply:DHCP-Message-Type} -> DHCP-Ack [linelog] expand: %{%{reply:DHCP-Message-Type}:-%{request:DHCP-Message-Type}} -> DHCP-Ack [linelog] expand: /var/log/linelog -> /var/log/linelog [linelog] expand: %{DHCP-Transaction-Id} ACK: %{reply:DHCP-Your-IP-Address} to [%{DHCP-Client-Hardware-Address}] ... -> 4013844759 ACK: Client_ip to [Client_mac] ... ++[linelog] returns ok ++[ok] returns ok } # server dhcp Sending DHCP-Ack of id ef3e6917 from DHCP-Server-IP:67 to Relay-ip:67 DHCP-Subnet-Mask = MASK DHCP-Router-Address = gateway_ip DHCP-Domain-Name-Server = NS1_ip DHCP-Domain-Name = "Domain1 Domain2" DHCP-Broadcast-Address = BROADCAST DHCP-NTP-Servers = NTP_Server_ip DHCP-IP-Address-Lease-Time = 180 DHCP-DHCP-Server-Identifier = DHCP-Server-ip Finished request 3. Cleaning up request 3 ID -281122537 with timestamp +490 Going to the next request Ready to process requests. __________________________________________________ Alexander Kubatkin
Alexander Kubatkin <kaa@kaa.su> writes:
this is with $RAD_REPLY{'DHCP-Domain-Name-Server'} = ["$ns1","$ns2"] ; [..] rlm_perl: Added pair DHCP-Domain-Name-Server = NS1_ip rlm_perl: Added pair DHCP-Domain-Name-Server = NS2_ip
So, this works as expected.
Sending DHCP-Ack of id ef3e6917 from DHCP-Server-IP:67 to Relay-ip:67 DHCP-Subnet-Mask = MASK DHCP-Router-Address = gateway_ip DHCP-Domain-Name-Server = NS1_ip DHCP-Domain-Name = "Domain1 Domain2" DHCP-Broadcast-Address = BROADCAST DHCP-NTP-Servers = NTP_Server_ip DHCP-IP-Address-Lease-Time = 180 DHCP-DHCP-Server-Identifier = DHCP-Server-ip Finished request 3.
And this does not. So you got a problem with the DHCP code, and not with rlm_perl. I'm afraid I don't know enough about that to help you, but I'm sure someone else can not that we know this hasn't anything to do with rlm_perl Bjørn
participants (5)
-
Alan DeKok -
Alexander Kubatkin -
Bjørn Mork -
Boian Jordanov -
James Nedila