Hi, I've got some post-proxy attribute filtering oddness. The servers are both FreeRADIUS 3.0.1. I send an EAP-TTLS/EAP-GTC (or EAP-TTLS/PAP) authentication to my home server (172.23.142.184), which then proxies the request to the UMBRELLAID.ORG realm's server (172.23.142.185). On return, I can see both MS-MPPE-Send-Key and MS-MPPE-Recv-Key in the response, but if I have attr_filter.post-proxy switched on, the MS-MPPE-Send-Key disappears by the beginning of post-auth (so I'm venturing to guess that this triggers a match in the post-proxy attribute filter). When attr_filter.post-proxy is commented out, it is there. The attr_filter/post-proxy file is standard to the distribution with exception of the addition of the following three lines: DEFAULT: User-Name =* ANY, Class =* ANY, Chargeable-User-Identity =* ANY, : : (for clarity, the colons are indicative of the remainder of the DEFAULT entry) I have two logs, one with an Access-Accept with no MS-MPPE-Send-Key (i.e. with filter enabled), one with an Access-Accept with MS-MPPE-Send-Key (filter disabled). The two logs are at https://www.dropbox.com/sh/0j6num17n2tt0mm/sX8GwxgZjR I'm flummoxed! Can someone explain this? Alan D? Alan B? Arran? Anyone? With Regards Stefan -- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom
Hopefully obvious but you do have the MPPE keys listed as allowed in the post proxy attribute filter (as they are in the generic attrs....) Yes? alan -- Sent from my Android device with K-9 Mail. Please excuse my brevity.
Yes, the attribute filter is completely standard with only the addition of the three lines I listed. Stefan From: Alan Buxey [mailto:A.L.M.Buxey@lboro.ac.uk] Sent: 12 March 2014 13:26 To: FreeRadius users mailing list; Paetow, Stefan (DLSLtd,RAL,LSCI) Subject: Re: Post-proxy attribute filtering oddness Hopefully obvious but you do have the MPPE keys listed as allowed in the post proxy attribute filter (as they are in the generic attrs....) Yes? alan -- Sent from my Android device with K-9 Mail. Please excuse my brevity.
This might be a side-effect of one of the bugs which was seen via rlm_perl. We'll be releasing 3.0.2 later today, which includes the fixes.
I'll check it out immediately and let you know. Stefan -- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom
stefan.paetow@diamond.ac.uk wrote:
This might be a side-effect of one of the bugs which was seen via rlm_perl. We'll be releasing 3.0.2 later today, which includes the fixes.
I'll check it out immediately and let you know.
If you could try the v3.0.x branch from git, that would help. Knowing the problem is fixed is nice. Alan DeKok.
If you could try the v3.0.x branch from git, that would help. Knowing the problem is fixed is nice.
Hi Alan, Sorry to disappoint, but the problem has not gone away in 3.0.2 HEAD. I'm happy to take this system home with me and keep testing this evening. Stefan -- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom
stefan.paetow@diamond.ac.uk wrote:
Sorry to disappoint, but the problem has not gone away in 3.0.2 HEAD. I'm happy to take this system home with me and keep testing this evening.
OK. I don't see it here, so there must be something different about your configuration. Please try with a default config, and then make gradual changes. See which change breaks it, and that's the problem. Alan DeKok.
On 12 Mar 2014, at 18:06, stefan.paetow@diamond.ac.uk wrote:
If you could try the v3.0.x branch from git, that would help. Knowing the problem is fixed is nice.
Hi Alan,
Sorry to disappoint, but the problem has not gone away in 3.0.2 HEAD. I'm happy to take this system home with me and keep testing this evening.
It'd make it easier to reproduce if you just provide the list of attributes in the reply, and the exact filter you're using. update request { Tmp-Integer-0 := "%{debug_attr:reply:}" } <filter> update request { Tmp-Integer-0 := "%{debug_attr:reply:}" } -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
It'd make it easier to reproduce if you just provide the list of attributes in the reply, and the exact filter you're using.
update request { Tmp-Integer-0 := "%{debug_attr:reply:}" } <filter> update request { Tmp-Integer-0 := "%{debug_attr:reply:}" }
And Arran has found the bug, squashed it, and I can confirm that it all works now. :-) This will make my admins and my boss happy. Thank you very much! Stefan -- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom
participants (4)
-
Alan Buxey -
Alan DeKok -
Arran Cudbard-Bell -
stefan.paetow＠diamond.ac.uk