Managing Data Volume Control More Than 4GB FR & CoovaChilli
Hi List Members i have been reading archives and tying to understand for some days now, but unsuccessful. i am currently working to extend data volume control up to 10GB, which is requirement for the organization. Is anyone able to manage more then 4GB using CoovaChilli & Freeradius? Since there is no one piece of information available on the net. Until now, i am unclear about the components needs to be fine tune. i understand that FR has 32 bit integers but it is not the limitation to manage more than 4GB, if NAS supports the "Gigaword" attributes. It seems that my "sql_counter" or MySQL it self is the problem. *NOTE: It is working setup up to 4GB, if i assigne 6GB to a user, counter rolls up on 4GB* 1.) I came across a post where guys are tell that sqlcounter module uses 32-bit integers in it's source code. Should it be change to 64-bit integers? 2.) CoovaChilli has built in support for "gigaword" attributes, which is enable. 3.) is it possible by rlm_sql or rlm_perl must be used 4.) Counter rolls up on 4GB. sqlcounter gigawordcounter { counter-name = Total-Max-Octets check-name = Acct-Input-Gigawords reply-name = Acct-Input-Gigawords sqlmod-inst = sql key = User-Name reset = never counter-type = data check-unit = KibiOctets query = "SELECT SUM(acctinputoctets) + SUM(acctoutputoctets) FROM radacct WHERE username='%{%k}'" } Thanks / Regards
On 8 Oct 2013, at 10:10, Russell Mike <radius.sir@gmail.com> wrote:
Hi List Members
i have been reading archives and tying to understand for some days now, but unsuccessful. i am currently working to extend data volume control up to 10GB, which is requirement for the organization. Is anyone able to manage more then 4GB using CoovaChilli & Freeradius? Since there is no one piece of information available on the net. Until now, i am unclear about the components needs to be fine tune. i understand that FR has 32 bit integers but it is not the limitation to manage more than 4GB, if NAS supports the "Gigaword" attributes. It seems that my "sql_counter" or MySQL it self is the problem.
NOTE: It is working setup up to 4GB, if i assigne 6GB to a user, counter rolls up on 4GB
1.) I came across a post where guys are tell that sqlcounter module uses 32-bit integers in it's source code. Should it be change to 64-bit integers?
Yes. I've just done this in 3.0.x and master branches. Check and reply attributes will now be treated as unsigned 64bit integers. There's no downside to this and the change should be fully backwards compatible.
2.) CoovaChilli has built in support for "gigaword" attributes, which is enable.
Ok.
3.) is it possible by rlm_sql or rlm_perl must be used
Well yes, rlm_sql needs to be used. The default queries will correctly convert Acct-Input-Octets and Acct-Input-Gigawords into a proper 64bit value which is stored in the database.
4.) Counter rolls up on 4GB.
You'll need to create a local 64bit attribute to use as the check and reply items Something like: ATTRIBUTE Acct-Input-Octets64 3005 integer64 ATTRIBUTE Acct-Output-Octets64 3006 integer64 And specify their value in bytes. It might actually be an idea to add those to the internal dictionary to make it a bit easier. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
It might actually be an idea to add those to the internal dictionary to make it a bit easier.
Just to clarify there are two reasons why your current config isn't working: 1. rlm_sql stores the value as a proper 64bit integer, not in the two 32bit chunks represented by Acct-Input-Gigawords and Acct-Input-Octets. When this value is pulled out into rlm_sqlcounter the value is truncated because internally it only deals with 32bit unsigned ints. I've now fixed this. 2. You're comparing gigawords to bytes, with no conversion, so even with the updated module you'll find the user is rejected way way too early. You also invented "counter-type" and "check-unit" config pairs. The server isn't magic, just because it doesn't error out, doesn't mean it knows about those config pairs or will use values assigned to them. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
Dear Arran C. Bell, Thank you very much, i am extremely grateful for your advise and guidelines for troubleshoot also. i am currently experimenting a different rlm_sqlcounter using CoovaChilli dictionary "All-In-MB". In result, i can store short number in db. This counter would reset at 2TB with same 32bit number. i have actually tested up to 6GB. it just works!!!. Next test is in progress to logout user when 7GB downloaded. i really appreciated your input and TIME. i will try your proposed solution as well after "All-In-MB" has tested. After the successful practical of both solutions. i would like to document this topic on one page for archives, so that it can help others. i may need your support incase i came across some challenges during the test of your solution. Thanks once again !!! Regards --RM On Tue, Oct 8, 2013 at 12:16 PM, Arran Cudbard-Bell < a.cudbardb@freeradius.org> wrote:
It might actually be an idea to add those to the internal dictionary to
make it a bit easier.
Just to clarify there are two reasons why your current config isn't working: 1. rlm_sql stores the value as a proper 64bit integer, not in the two 32bit chunks represented by Acct-Input-Gigawords and Acct-Input-Octets. When this value is pulled out into rlm_sqlcounter the value is truncated because internally it only deals with 32bit unsigned ints. I've now fixed this.
2. You're comparing gigawords to bytes, with no conversion, so even with the updated module you'll find the user is rejected way way too early.
You also invented "counter-type" and "check-unit" config pairs. The server isn't magic, just because it doesn't error out, doesn't mean it knows about those config pairs or will use values assigned to them.
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 8 Oct 2013, at 15:40, Russell Mike <radius.sir@gmail.com> wrote:
Dear Arran C. Bell,
Thank you very much, i am extremely grateful for your advise and guidelines for troubleshoot also. i am currently experimenting a different rlm_sqlcounter using CoovaChilli dictionary "All-In-MB". In result, i can store short number in db. This counter would reset at 2TB with same 32bit number. i have actually tested up to 6GB. it just works!!!. Next test is in progress to logout user when 7GB downloaded. i really appreciated your input and TIME.
i will try your proposed solution as well after "All-In-MB" has tested. After the successful practical of both solutions. i would like to document this topic on one page for archives, so that it can help others. i may need your support incase i came across some challenges during the test of your solution.
wiki.freeradius.org is the place to do that :)
Thanks once again !!!
No problem, glad I could help. -Arran
Dear Aran C. Bell Thanks for everything, Here is update. 1.) All-In-MB counter works. Please note, when a user has downloaded his quota, counter do not force log off . Saying other way, if the user is online, he would remain online until he log off him self or stop browsing. But point to be noted that counter prevents from login him again. user cannot login again if he has already hit quota threshold. Please look the example of reject. This user is allowed for 7GB, please mind that *check_item which shows 7168*is specified in MB. *[gigawordcounter] expand: %{sql:SELECT SUM(AcctInputOctets) / (1024*1024) + SUM(AcctOutputOctets) / (1024*1024) FROM radacct WHERE UserName='quotauser'} -> 7389.1705* *rlm_sqlcounter: (Check item - counter) is less than zero* *rlm_sqlcounter: Rejected user quotauser, check_item=7168, counter=7389* *++[gigawordcounter] returns reject* Which basically means that initially authorization is done by SQL then "max_all_mb", checks are only done once when the user makes the logon attempt and checks are never done again. This is where i have failed. Since you are more in to this, is there a way to perform this check on frequent basis and send reply to NAS to logoff user? then it should work. Counter: sqlcounter gigawordcounter { counter-name = Max-All-MB check-name = Max-All-MB reply-name = Max-All-MB reply-message = "You have reached your bandwidth limit" sqlmod-inst = sql key = User-Name reset = never query = "SELECT SUM(AcctInputOctets) / (1024*1024) + SUM(AcctOutputOctets) / (1024*1024) FROM radacct WHERE UserName='%{%k}'" } *2.) Solution offered by You. * I tried your recommendations also, i tried to maintain following in local FR dictionary *"/etc/freeradius/dictionary"* and Chilli dictionary ATTRIBUTE Acct-Input-Octets64 3005 integer64 ATTRIBUTE Acct-Output-Octets64 3006 integer64 Results: failed to start FR reason for failing: : un recognized value specified in * "/etc/freeradius/dictionary"* reason for failing: : un recognized value specified in * "/usr/share/freeradius/dictionary.chillihotspot"* Thanks / Regards RM -- On Tue, Oct 8, 2013 at 3:38 PM, Arran Cudbard-Bell < a.cudbardb@freeradius.org> wrote:
On 8 Oct 2013, at 15:40, Russell Mike <radius.sir@gmail.com> wrote:
Dear Arran C. Bell,
Thank you very much, i am extremely grateful for your advise and guidelines for troubleshoot also. i am currently experimenting a different rlm_sqlcounter using CoovaChilli dictionary "All-In-MB". In result, i can store short number in db. This counter would reset at 2TB with same 32bit number. i have actually tested up to 6GB. it just works!!!. Next test is in progress to logout user when 7GB downloaded. i really appreciated your input and TIME.
i will try your proposed solution as well after "All-In-MB" has tested. After the successful practical of both solutions. i would like to document this topic on one page for archives, so that it can help others. i may need your support incase i came across some challenges during the test of your solution.
wiki.freeradius.org is the place to do that :)
Thanks once again !!!
No problem, glad I could help.
-Arran - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Russell Mike wrote:
All-In-MB counter works. Please note, when a user has downloaded his quota, counter do not force log off .
The counter modules DOES NOT DO THAT. To see why, ask yourself what does FreeRADIUS see when the user has downloaded his quota? The answer is "nothing". The users traffic doesn't go through FreeRADIUS, because FreeRADIUS isn't a router. What FreeRADIUS *may* see is an Accounting-Request for the user. Which contains the total traffic for the user. So if you want to do something when the users traffic is over the quota, you have to do it in the accounting section. You have to update the SQL database, and then check if the user is over quota. If so, send a Disconnect-Message, or exec a program to kick the user offline.
Which basically means that initially authorization is done by SQL then "max_all_mb", checks are only done once when the user makes the logon attempt and checks are never done again.
Yes. That's what you've configured. If you want more, you need to tell the server to do more
This is where i have failed. Since you are more in to this, is there a way to perform this check on frequent basis and send reply to NAS to logoff user? then it should work.
Read the debug output. You'll see the server receiving Accounting-Request packets, with the users traffic over quota. THAT is when FreeRADIUS can do something. Alan DeKok.
Thanks Alan. D So if you want to do something when the users traffic is over the quota, you have to do it in the accounting section. Could you please kindly indicate what should i do there ? i tried to perform the check again when user is online by adding counter entry in * session* section. but did not work either. session { sql gigawordcounter } You have to update the SQL database, and then check if the user is over quota. If so, send a Disconnect-Message, or exec a program to kick the user offline. I am not very clear how to update mysql db & perform the check on frequent basis. base on the output from the counter module (ok,noop,etc..), i understand how to update the reply from un-lang to log off user. Thanks / Regards RM-- On Wed, Oct 9, 2013 at 1:12 PM, Alan DeKok <aland@deployingradius.com>wrote:
Russell Mike wrote:
All-In-MB counter works. Please note, when a user has downloaded his quota, counter do not force log off .
The counter modules DOES NOT DO THAT.
To see why, ask yourself what does FreeRADIUS see when the user has downloaded his quota?
The answer is "nothing". The users traffic doesn't go through FreeRADIUS, because FreeRADIUS isn't a router.
What FreeRADIUS *may* see is an Accounting-Request for the user. Which contains the total traffic for the user.
So if you want to do something when the users traffic is over the quota, you have to do it in the accounting section. You have to update the SQL database, and then check if the user is over quota.
If so, send a Disconnect-Message, or exec a program to kick the user offline.
Which basically means that initially authorization is done by SQL then "max_all_mb", checks are only done once when the user makes the logon attempt and checks are never done again.
Yes. That's what you've configured. If you want more, you need to tell the server to do more
This is where i have failed. Since you are more in to this, is there a way to perform this check on frequent basis and send reply to NAS to logoff user? then it should work.
Read the debug output. You'll see the server receiving Accounting-Request packets, with the users traffic over quota. THAT is when FreeRADIUS can do something.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Russell Mike wrote:
So if you want to do something when the users traffic is over the quota, you have to do it in the accounting section.
Could you please kindly indicate what should i do there ? i tried to perform the check again when user is online by adding counter entry in *session* section. but did not work either.
Uh... you do know that "session" is not the same as "accounting", right? Why are you doing something wrong?
I am not very clear how to update mysql db & perform the check on frequent basis. base on the output from the counter module (ok,noop,etc..), i understand how to update the reply from un-lang to log off user.
Do you understand what the server does when it receives an accounting packet? Have you tried running the server in debugging mode, and seeing what happens when it receives an accounting packet? Do that before asking more questions. Watch the server go update SQL. Now... how do you query SQL (independent of RADIUS) to see if the users session is over quota? Then... put that query into the "accounting" section, via "unlang". Check if the user is over quota. If so, send a disconnect message. See raddb/sites-available/originate-coa for examples of originating a disconnect message. Alan DeKok.
Thanks Alan D understood. I will use unlang in accounting. Thanks On Wednesday, October 9, 2013, Alan DeKok wrote:
Russell Mike wrote:
So if you want to do something when the users traffic is over the quota, you have to do it in the accounting section.
Could you please kindly indicate what should i do there ? i tried to perform the check again when user is online by adding counter entry in *session* section. but did not work either.
Uh... you do know that "session" is not the same as "accounting", right?
Why are you doing something wrong?
I am not very clear how to update mysql db & perform the check on frequent basis. base on the output from the counter module (ok,noop,etc..), i understand how to update the reply from un-lang to log off user.
Do you understand what the server does when it receives an accounting packet?
Have you tried running the server in debugging mode, and seeing what happens when it receives an accounting packet?
Do that before asking more questions. Watch the server go update SQL.
Now... how do you query SQL (independent of RADIUS) to see if the users session is over quota?
Then... put that query into the "accounting" section, via "unlang". Check if the user is over quota. If so, send a disconnect message.
See raddb/sites-available/originate-coa for examples of originating a disconnect message.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Wed, Oct 9, 2013 at 3:27 PM, Alan DeKok <aland@deployingradius.com>wrote:
Russell Mike wrote:
So if you want to do something when the users traffic is over the quota, you have to do it in the accounting section.
Could you please kindly indicate what should i do there ? i tried to perform the check again when user is online by adding counter entry in *session* section. but did not work either.
Uh... you do know that "session" is not the same as "accounting", right?
Why are you doing something wrong?
I am not very clear how to update mysql db & perform the check on frequent basis. base on the output from the counter module (ok,noop,etc..), i understand how to update the reply from un-lang to log off user.
Do you understand what the server does when it receives an accounting packet?
Have you tried running the server in debugging mode, and seeing what happens when it receives an accounting packet?
Do that before asking more questions. Watch the server go update SQL.
Now... how do you query SQL (independent of RADIUS) to see if the users session is over quota?
Then... put that query into the "accounting" section, via "unlang". Check if the user is over quota. If so, send a disconnect message.
Thats fine, thanks for guidelines, Alan. how can i execute the code frequently in accounting section? i understand how to send disconnect message if value is un desirable.
See raddb/sites-available/originate-coa for examples of originating a disconnect message.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Russell Mike wrote:
Thats fine, thanks for guidelines, Alan. how can i execute the code frequently in accounting section?
I have no idea what that means. You can use SQL queries in "unlang" by wrapping them in dynamic expansions: if ("%{sql:SELECT ...}" > 1000000) { ... } In v3, you can even cast the numbers to 64-bit integers. Alan DeKok.
On Mon, Oct 21, 2013 at 04:38:09PM +0000, Russell Mike wrote:
Thats fine, thanks for guidelines, Alan. how can i execute the code frequently in accounting section? i understand how to send disconnect message if value is un desirable.
The accounting section is run each time an accounting packet is received from the NAS. So to change the frequency that the accounting section is run, configure your NAS to send Interim Updates more or less often. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Thanks Dear Matthew & Alan D. i should be able to do now. On Mon, Oct 21, 2013 at 7:15 PM, Matthew Newton <mcn4@leicester.ac.uk>wrote:
On Mon, Oct 21, 2013 at 04:38:09PM +0000, Russell Mike wrote:
Thats fine, thanks for guidelines, Alan. how can i execute the code frequently in accounting section? i understand how to send disconnect message if value is un desirable.
The accounting section is run each time an accounting packet is received from the NAS.
So to change the frequency that the accounting section is run, configure your NAS to send Interim Updates more or less often.
Matthew
-- Matthew Newton, Ph.D. <mcn4@le.ac.uk>
Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom
For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (4)
-
Alan DeKok -
Arran Cudbard-Bell -
Matthew Newton -
Russell Mike