Different behaviour of 2.2.0 and 2.2.6 in handling Post-auth-type reject
Hello, I've used default server configured as follows: post-auth { # my module decides to allow or reject request rtdps2 Post-Auth-Type REJECT { attr_filter.access_reject } } When I run this on 2.2.0 I got debug: Thu Nov 27 14:28:44 2014 : Info: ++[rtdps2] returns reject Thu Nov 27 14:28:44 2014 : Info: Using Post-Auth-Type REJECT Thu Nov 27 14:28:44 2014 : Info: # Executing group from file ../etc/raddb/sites-enabled/default Thu Nov 27 14:28:44 2014 : Info: +- entering group REJECT {...} Thu Nov 27 14:28:44 2014 : Info: [attr_filter.access_reject] expand: %{User-Name} -> testing Thu Nov 27 14:28:44 2014 : Debug: attr_filter: Matched entry DEFAULT at line 11 Thu Nov 27 14:28:44 2014 : Info: ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 80 to 192.168.1.4 port 33304 Cisco-AVPair := "h323-return-code=8" Which is correct, but when I run it in 2.2.6 I got: Thu Nov 27 14:19:35 2014 : Info: ++[rtdps2] = reject Thu Nov 27 14:19:35 2014 : Info: +} # group post-auth = reject Sending Access-Reject of id 186 to 192.168.1.4 port 49975 Service-Type = 0 Framed-Protocol = 0 Cisco-AVPair := "h323-return-code=8" Thu Nov 27 14:19:35 2014 : Info: Finished request 0. Which is wrong, because attributes was not filtered out. Am I missing something ? Is this a bug ? What to do to make version 2.2.6 to work the same way 2.2.0 does ? Regards- *Wiesław Bieniek* <http://www.comarch.pl>
Hello, I've made some additional investigation and it seems, the problem is only present when request is rejected in post-auth section. Any cue how to overcome this. I need to reject requests based on some attributes received from proxied response. But the same code is also used when no proxying is performed. Any suggestions ? I'm not as fluent in C programing to debug the code and locate the problem. Besides I even don't know if it is a bug or planned feature. Could some please point the part of code where to look for the issue ? W dniu 2014-11-27 15:49, Wiesław Bieniek pisze:
Hello,
I've used default server configured as follows: post-auth { # my module decides to allow or reject request rtdps2
Post-Auth-Type REJECT {
attr_filter.access_reject }
}
When I run this on 2.2.0 I got debug:
Thu Nov 27 14:28:44 2014 : Info: ++[rtdps2] returns reject Thu Nov 27 14:28:44 2014 : Info: Using Post-Auth-Type REJECT Thu Nov 27 14:28:44 2014 : Info: # Executing group from file ../etc/raddb/sites-enabled/default Thu Nov 27 14:28:44 2014 : Info: +- entering group REJECT {...} Thu Nov 27 14:28:44 2014 : Info: [attr_filter.access_reject] expand: %{User-Name} -> testing Thu Nov 27 14:28:44 2014 : Debug: attr_filter: Matched entry DEFAULT at line 11 Thu Nov 27 14:28:44 2014 : Info: ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 80 to 192.168.1.4 port 33304 Cisco-AVPair := "h323-return-code=8"
Which is correct, but when I run it in 2.2.6 I got:
Thu Nov 27 14:19:35 2014 : Info: ++[rtdps2] = reject Thu Nov 27 14:19:35 2014 : Info: +} # group post-auth = reject Sending Access-Reject of id 186 to 192.168.1.4 port 49975 Service-Type = 0 Framed-Protocol = 0 Cisco-AVPair := "h323-return-code=8" Thu Nov 27 14:19:35 2014 : Info: Finished request 0.
Which is wrong, because attributes was not filtered out.
Am I missing something ? Is this a bug ? What to do to make version 2.2.6 to work the same way 2.2.0 does ?
Regards- *Wiesław Bieniek*
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- *Wiesław Bieniek* Projektant Telco BSS R&D tel. +48 12 646 12 66 website: www.comarch.pl <http://www.comarch.pl>
On 2 Dec 2014, at 12:17, Wiesław Bieniek <wieslaw.bieniek@comarch.com> wrote:
Hello,
I've made some additional investigation and it seems, the problem is only present when request is rejected in post-auth section.
Any cue how to overcome this.
I need to reject requests based on some attributes received from proxied response. But the same code is also used when no proxying is performed.
Any suggestions ? I'm not as fluent in C programing to debug the code and locate the problem. Besides I even don't know if it is a bug or planned feature.
Could some please point the part of code where to look for the issue ?
You've trimmed the useful parts of the debug. Provide full debug for both cases. -Arran
Hello, Please find attached complete log from version 2.2.0 Regards Wiesław Bieniek W dniu 2014-12-02 18:35, Arran Cudbard-Bell pisze:
On 2 Dec 2014, at 12:17, Wiesław Bieniek <wieslaw.bieniek@comarch.com> wrote:
Hello,
I've made some additional investigation and it seems, the problem is only present when request is rejected in post-auth section.
Any cue how to overcome this.
I need to reject requests based on some attributes received from proxied response. But the same code is also used when no proxying is performed.
Any suggestions ? I'm not as fluent in C programing to debug the code and locate the problem. Besides I even don't know if it is a bug or planned feature.
Could some please point the part of code where to look for the issue ?
You've trimmed the useful parts of the debug. Provide full debug for both cases.
-Arran - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- *Wiesław Bieniek* Projektant Telco BSS R&D tel. +48 12 646 12 66 website: www.comarch.pl <http://www.comarch.pl>
Hello, And logs from 2.2.6 Separated from 2.2.0 logs because server list does not accept messages larger than 100kB Regards Wiesław Bieniek W dniu 2014-12-02 18:35, Arran Cudbard-Bell pisze:
On 2 Dec 2014, at 12:17, Wiesław Bieniek <wieslaw.bieniek@comarch.com> wrote:
Hello,
I've made some additional investigation and it seems, the problem is only present when request is rejected in post-auth section.
Any cue how to overcome this.
I need to reject requests based on some attributes received from proxied response. But the same code is also used when no proxying is performed.
Any suggestions ? I'm not as fluent in C programing to debug the code and locate the problem. Besides I even don't know if it is a bug or planned feature.
Could some please point the part of code where to look for the issue ?
You've trimmed the useful parts of the debug. Provide full debug for both cases.
-Arran - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- *Wiesław Bieniek* Projektant Telco BSS R&D tel. +48 12 646 12 66 website: www.comarch.pl <http://www.comarch.pl>
On Dec 3, 2014, at 8:13 AM, Wiesław Bieniek <wieslaw.bieniek@comarch.com> wrote:
And logs from 2.2.6
Separated from 2.2.0 logs because server list does not accept messages larger than 100kB
The original intention was to disallow rejecting in the post-auth stage. There is a use for that, so it should be re-added for 2.2.7. Alan DeKok.
Hello Alan, Thanks for quick response. Couple more questions: When the 2.2.7 is planned for release ? Would it be possible to get info when the feature is back ? I would take the version for my tests as soon as possible. I would consider then bakporting of this feature to my 2.2.6 version if 2.2.7 will be release later than end of January 2015. Thanks for your help. Regards Wiesław W dniu 2014-12-03 20:10, Alan DeKok pisze:
On Dec 3, 2014, at 8:13 AM, Wiesław Bieniek <wieslaw.bieniek@comarch.com> wrote:
And logs from 2.2.6
Separated from 2.2.0 logs because server list does not accept messages larger than 100kB The original intention was to disallow rejecting in the post-auth stage. There is a use for that, so it should be re-added for 2.2.7.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- *Wiesław Bieniek* Projektant Telco BSS R&D tel. +48 12 646 12 66 website: www.comarch.pl <http://www.comarch.pl>
On Dec 4, 2014, at 5:20 AM, Wiesław Bieniek <wieslaw.bieniek@comarch.com> wrote:
When the 2.2.7 is planned for release ?
There’s no fixed plan.
Would it be possible to get info when the feature is back ? I would take the version for my tests as soon as possible. I would consider then bakporting of this feature to my 2.2.6 version if 2.2.7 will be release later than end of January 2015.
Don’t back-port it. Just use the v2.x.x branch from git. There are *very* few changes going into the v2.2 release cycle. Alan DeKok.
Hello Alan, Is there any plans for release 2.2.7 ? Will the change be included in it ? Best Regards Wiesław W dniu 2014-12-03 o 20:10, Alan DeKok pisze:
On Dec 3, 2014, at 8:13 AM, Wiesław Bieniek <wieslaw.bieniek@comarch.com> wrote:
And logs from 2.2.6
Separated from 2.2.0 logs because server list does not accept messages larger than 100kB The original intention was to disallow rejecting in the post-auth stage. There is a use for that, so it should be re-added for 2.2.7.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- *Wiesław Bieniek* Projektant Telco BSS R&D tel. +48 12 646 12 66 website: www.comarch.pl <http://www.comarch.pl>
On Mar 12, 2015, at 8:09 AM, Wiesław Bieniek <wieslaw.bieniek@comarch.com> wrote:
Is there any plans for release 2.2.7 ?
Not immediately. I’m out for the next week or two, so we’ll see.
Will the change be included in it ?
I’ll see. Patches would help. Alan DeKok.
Hello, Just for confirmation, Is this resolved/re-added in 2.2.7 ? I haven't notice it in release notes, so I'm asking just to be sure. Regards Wiesław W dniu 2014-12-03 o 20:10, Alan DeKok pisze:
On Dec 3, 2014, at 8:13 AM, Wiesław Bieniek <wieslaw.bieniek@comarch.com> wrote:
And logs from 2.2.6
Separated from 2.2.0 logs because server list does not accept messages larger than 100kB The original intention was to disallow rejecting in the post-auth stage. There is a use for that, so it should be re-added for 2.2.7.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- *Wiesław Bieniek* Projektant Telco BSS R&D tel. +48 12 646 12 66 website: www.comarch.pl <http://www.comarch.pl>
Yes, it's resolved in 2.2.7. On May 19, 2015, at 9:46 AM, Wiesław Bieniek <wieslaw.bieniek@comarch.com> wrote:
Hello,
Just for confirmation,
Is this resolved/re-added in 2.2.7 ? I haven't notice it in release notes, so I'm asking just to be sure.
Regards Wiesław
W dniu 2014-12-03 o 20:10, Alan DeKok pisze:
On Dec 3, 2014, at 8:13 AM, Wiesław Bieniek <wieslaw.bieniek@comarch.com> wrote:
And logs from 2.2.6
Separated from 2.2.0 logs because server list does not accept messages larger than 100kB The original intention was to disallow rejecting in the post-auth stage. There is a use for that, so it should be re-added for 2.2.7.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- *Wiesław Bieniek* Projektant Telco BSS R&D
tel. +48 12 646 12 66 website: www.comarch.pl <http://www.comarch.pl> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Many thanks, I will test it and let You know. Regards Wiesław W dniu 2015-05-19 o 15:50, Alan DeKok pisze:
Yes, it's resolved in 2.2.7.
On May 19, 2015, at 9:46 AM, Wiesław Bieniek <wieslaw.bieniek@comarch.com> wrote:
Hello,
Just for confirmation,
Is this resolved/re-added in 2.2.7 ? I haven't notice it in release notes, so I'm asking just to be sure.
Regards Wiesław
W dniu 2014-12-03 o 20:10, Alan DeKok pisze:
On Dec 3, 2014, at 8:13 AM, Wiesław Bieniek <wieslaw.bieniek@comarch.com> wrote:
And logs from 2.2.6
Separated from 2.2.0 logs because server list does not accept messages larger than 100kB The original intention was to disallow rejecting in the post-auth stage. There is a use for that, so it should be re-added for 2.2.7.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- *Wiesław Bieniek* Projektant Telco BSS R&D
tel. +48 12 646 12 66 website: www.comarch.pl <http://www.comarch.pl> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- *Wiesław Bieniek* Projektant Telco BSS R&D tel. +48 12 646 12 66 website: www.comarch.pl <http://www.comarch.pl>
Hello, I've tested 2.2.7 with my configuration and it seems it is still not working. When Reject comes from Post-Auth section the post atuh type rejecrt it not called and attributes are not filtered out from Access reject Response. Please see the attached debug output. Regards Wiesław W dniu 2015-05-19 o 15:50, Alan DeKok pisze:
Yes, it's resolved in 2.2.7.
On May 19, 2015, at 9:46 AM, Wiesław Bieniek <wieslaw.bieniek@comarch.com> wrote:
Hello,
Just for confirmation,
Is this resolved/re-added in 2.2.7 ? I haven't notice it in release notes, so I'm asking just to be sure.
Regards Wiesław
W dniu 2014-12-03 o 20:10, Alan DeKok pisze:
On Dec 3, 2014, at 8:13 AM, Wiesław Bieniek <wieslaw.bieniek@comarch.com> wrote:
And logs from 2.2.6
Separated from 2.2.0 logs because server list does not accept messages larger than 100kB The original intention was to disallow rejecting in the post-auth stage. There is a use for that, so it should be re-added for 2.2.7.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- *Wiesław Bieniek* Projektant Telco BSS R&D
tel. +48 12 646 12 66 website: www.comarch.pl <http://www.comarch.pl> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- *Wiesław Bieniek* Projektant Telco BSS R&D tel. +48 12 646 12 66 website: www.comarch.pl <http://www.comarch.pl>
On May 29, 2015, at 6:06 AM, Wiesław Bieniek <wieslaw.bieniek@comarch.com> wrote:
I've tested 2.2.7 with my configuration and it seems it is still not working. When Reject comes from Post-Auth section the post atuh type rejecrt it not called and attributes are not filtered out from Access reject Response.
I've pushed a fix to the v2.x.x branch. Please check it. I think that will likely be the last change to v2. Alan DeKok.
participants (3)
-
Alan DeKok -
Arran Cudbard-Bell -
Wiesław Bieniek