Hi all, I'm trying to save some of the Cisco-AVPair attributes into sql while acounting. Specifically, I'm interested in the dhcp-options and http-tlv attributes. WLC describes the connected device in these. Unfortunately, Freeradius 3.12 expands these values unregexable way. (With_cisco_vsa_hack = yes in preprocess the result is the same) Correctly expanded is just Cisco-AVPair = "audit-session-id=1ef1a8c000014809cba76859" Policy file: device_regex = '^((dhcp-option=)|(http-tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)' () fill_device_type { if (&Cisco-AVPair) { foreach &Cisco-AVPair { if ("%{Foreach-Variable-0}" =~ /${policy.device_regex}/i) { update request { &Calling-Device += "%{8} " } } } } } Processing: (98) Received Accounting-Request Id 28 from 192.168.241.30:57614 to 172.31.12.101:1813 length 482 (98) User-Name = "martin" (98) NAS-Port = 8 (98) NAS-IP-Address = 192.168.241.30 (98) Framed-IP-Address = 10.252.136.9 (98) Framed-IPv6-Prefix = 2a07:8d84:800:325f::/64 (98) Framed-IPv6-Prefix = 2a07:8d84:800:325f::/64 (98) Framed-IPv6-Prefix = 2a07:8d84:800:325f::/64 (98) Framed-IPv6-Prefix = 2a07:8d84:800:325f::/64 (98) Framed-IPv6-Prefix = 2a07:8d84:800:325f::/64 (98) Framed-IPv6-Prefix = fe80::/64 (98) NAS-Identifier = "d4-wlc5520" (98) Airespace-Wlan-Id = 20 (98) Acct-Session-Id = "5968a7cb/34:ab:37:ed:a2:bb/90671" (98) NAS-Port-Type = Wireless-802.11 (98) Cisco-AVPair = "audit-session-id=1ef1a8c000014809cba76859" (98) Acct-Authentic = RADIUS (98) Tunnel-Type:0 = VLAN (98) Tunnel-Medium-Type:0 = IEEE-802 (98) Tunnel-Private-Group-Id:0 = "595" (98) Event-Timestamp = "Jul 14 2017 14:47:01 CEST" (98) Cisco-AVPair = "dhcp-option=\000\014\000\0056spMK" (98) Cisco-AVPair = "http-tlv=\000\001\000\030iPhone8,2/10.3.2 (14F89)" How to regex these ? (98) Acct-Status-Type = Interim-Update (98) Acct-Input-Octets = 699538 (98) Acct-Input-Gigawords = 0 (98) Acct-Output-Octets = 2957172 (98) Acct-Output-Gigawords = 0 (98) Acct-Input-Packets = 5974 (98) Acct-Output-Packets = 5319 (98) Acct-Session-Time = 5494 (98) Acct-Delay-Time = 0 (98) Calling-Station-Id = "34-ab-37-ed-a2-bb" (98) Called-Station-Id = "d4-air1702-ap-1:UI MK tst" (98) # Executing section preacct from file /etc/freeradius/3.0/sites-enabled/default (98) preacct { (98) [preprocess] = ok (98) policy rewrite_called_station_id { (98) if (&Called-Station-Id && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/i)) { (98) if (&Called-Station-Id && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/i)) -> FALSE (98) elsif (&Called-Station-Id && (&Called-Station-Id =~ /^(.+)(:){1}((.+))?$/i)) { (98) elsif (&Called-Station-Id && (&Called-Station-Id =~ /^(.+)(:){1}((.+))?$/i)) -> TRUE (98) elsif (&Called-Station-Id && (&Called-Station-Id =~ /^(.+)(:){1}((.+))?$/i)) { (98) update request { (98) EXPAND %{1} (98) --> d4-air1702-ap-1 (98) &Called-Station-Id := d4-air1702-ap-1 (98) EXPAND %{3} (98) --> UI MK tst (98) &Called-Station-SSID := UI MK tst (98) } # update request = noop (98) [updated] = updated (98) } # elsif (&Called-Station-Id && (&Called-Station-Id =~ /^(.+)(:){1}((.+))?$/i)) = updated (98) ... skipping else: Preceding "if" was taken (98) } # policy rewrite_called_station_id = updated (98) policy fill_device_type { (98) if (&Cisco-AVPair) { (98) if (&Cisco-AVPair) -> TRUE (98) if (&Cisco-AVPair) { (98) foreach &Cisco-AVPair (98) if ("%{Foreach-Variable-0}" =~ /^((dhcp-option=)|(http-tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)/i) { (98) EXPAND Foreach-Variable-0 (98) --> audit-session-id=1ef1a8c000014809cba76859 (98) EXPAND %{Foreach-Variable-0} (98) --> audit-session-id=1ef1a8c000014809cba76859 (98) if ("%{Foreach-Variable-0}" =~ /^((dhcp-option=)|(http-tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)/i) -> FALSE (98) if ("%{Foreach-Variable-0}" =~ /^((dhcp-option=)|(http-tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)/i) { (98) EXPAND Foreach-Variable-0 (98) --> dhcp-option= (98) EXPAND %{Foreach-Variable-0} (98) --> dhcp-option= (98) if ("%{Foreach-Variable-0}" =~ /^((dhcp-option=)|(http-tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)/i) -> FALSE (98) if ("%{Foreach-Variable-0}" =~ /^((dhcp-option=)|(http-tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)/i) { (98) EXPAND Foreach-Variable-0 (98) --> http-tlv= (98) EXPAND %{Foreach-Variable-0} (98) --> http-tlv= Both attributes are expanded till first whitespace char (98) if ("%{Foreach-Variable-0}" =~ /^((dhcp-option=)|(http-tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)/i) -> FALSE (98) } # foreach &Cisco-AVPair = updated (98) } # if (&Cisco-AVPair) = updated How to get text values following whitespaces? I've already tried if ("unescape:%{Foreach-Variable-0}" =~ /${policy.device_regex}/i) with no luck Martin Kylián
On Jul 14, 2017, at 9:22 AM, Kylián Martin <kylianm@plzen.eu> wrote:
I'm trying to save some of the Cisco-AVPair attributes into sql while acounting. Specifically, I'm interested in the dhcp-options and http-tlv attributes. WLC describes the connected device in these.
Unfortunately, Freeradius 3.12 expands these values unregexable way. (With_cisco_vsa_hack = yes in preprocess the result is the same) Correctly expanded is just Cisco-AVPair = "audit-session-id=1ef1a8c000014809cba76859"
That's just text. There shouldn't be a problem.
Policy file:
device_regex = '^((dhcp-option=)|(http-tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)'
That seems much too complicated. And doesn't match the Cisco-AVPair you have above.
(98) Cisco-AVPair = "dhcp-option=\000\014\000\0056spMK" (98) Cisco-AVPair = "http-tlv=\000\001\000\030iPhone8,2/10.3.2 (14F89)"
How to regex these ?
Use a regex library which can handle embedded NUL bytes. Regexes normally work on strings. i.e. printable data. The attributes above are binary, not printable data.
Both attributes are expanded till first whitespace char
No, they stop on the first NUL character. i.e. embedded zero.
(98) if ("%{Foreach-Variable-0}" =~ /^((dhcp-option=)|(http-tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)/i) -> FALSE (98) } # foreach &Cisco-AVPair = updated (98) } # if (&Cisco-AVPair) = updated
How to get text values following whitespaces? I've already tried if ("unescape:%{Foreach-Variable-0}" =~ /${policy.device_regex}/i) with no luck
Install pcre, and use it as the regex engine. It can handle embedded NUL bytes. Or, use another method to parse the Cisco-AVPairs. e.g. rlm_perl. Or, use the "unpack" module to unpack binary data. See raddb/mods-available/unpack for documentation. Alan DeKok.
Hi Alan, thanks for everything you do for the community . I came back to this after some time:
-----Original Message----- From: Freeradius-Users [mailto:freeradius-users- bounces+kylianm=plzen.eu@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Friday, July 14, 2017 3:35 PM To: FreeRadius users mailing list Subject: Re: Cisco-AVPair regex
On Jul 14, 2017, at 9:22 AM, Kylián Martin <kylianm@plzen.eu> wrote:
I'm trying to save some of the Cisco-AVPair attributes into sql while
acounting. Specifically, I'm interested in the dhcp-options and http-tlv attributes. WLC describes the connected device in these.
Unfortunately, Freeradius 3.12 expands these values unregexable way. (With_cisco_vsa_hack = yes in preprocess the result is the same) Correctly expanded is just Cisco-AVPair = "audit-session-
id=1ef1a8c000014809cba76859"
That's just text. There shouldn't be a problem.
Policy file:
device_regex = '^((dhcp-option=)|(http- tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)'
That seems much too complicated. And doesn't match the Cisco-AVPair you have above.
(98) Cisco-AVPair = "dhcp-option=\000\014\000\0056spMK" (98) Cisco-AVPair = "http-tlv=\000\001\000\030iPhone8,2/10.3.2 (14F89)"
How to regex these ?
Use a regex library which can handle embedded NUL bytes.
Regexes normally work on strings. i.e. printable data. The attributes above are binary, not printable data.
Both attributes are expanded till first whitespace char
No, they stop on the first NUL character. i.e. embedded zero.
(98) if ("%{Foreach-Variable-0}" =~ /^((dhcp-option=)|(http- tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)/i) -> FALSE (98) } # foreach &Cisco-AVPair = updated (98) } # if (&Cisco-AVPair) = updated
How to get text values following whitespaces? I've already tried if ("unescape:%{Foreach-Variable-0}" =~ /${policy.device_regex}/i) with no luck
Install pcre, and use it as the regex engine. It can handle embedded NUL bytes.
I am using the debian packages (currently 3.0.16+dfsg-1+b1 from the unstable release) and I'd love to keep this approach (because of the updates). I don't know how exactly the maintainer compile the FR packages, but i would not expect the pcre support as enabled during the compilation. Does exist any other way for me how to enable the pcre support ?
Or, use another method to parse the Cisco-AVPairs. e.g. rlm_perl.
This turned out to be ideal. Howerer, passing request to the perl script fails on the same thing - attributes are passed empty aswell. (11) Received Accounting-Request Id 57 from 192.168.241.30:34261 to 172.31.12.101:1813 length 393 ... (11) Cisco-AVPair = "dhcp-option=\000\014\000\002MK" (11) Cisco-AVPair = "http-tlv=\000\001\000\031iPhone10,2/11.2.5 (15D60)" (11) # Executing section preacct from file /etc/freeradius/3.0/sites-enabled/default (11) preacct { (11) [preprocess] = ok (11) sitmp-regex-parser: $RAD_REQUEST{'Cisco-AVPair'}[0] = &request:Cisco-AVPair -> 'audit-session-id=1ef1a8c000052ac48ab18e5a' (11) sitmp-regex-parser: $RAD_REQUEST{'Cisco-AVPair'}[1] = &request:Cisco-AVPair -> 'dhcp-option=' (11) sitmp-regex-parser: $RAD_REQUEST{'Cisco-AVPair'}[2] = &request:Cisco-AVPair -> 'http-tlv='
Or, use the "unpack" module to unpack binary data. See raddb/mods- available/unpack for documentation.
I did. I tried if (&Cisco-AVPair) { foreach &Cisco-AVPair { if ("%{unpack: &Foreach-Variable-0 0 short}" =~ /${policy.device_regex}/i) {} } With the result (25) if (&Cisco-AVPair) -> TRUE (25) if (&Cisco-AVPair) { (25) foreach &Cisco-AVPair (25) if ("%{unpack: &Foreach-Variable-0 0 short}" =~ /^((dhcp-option=)|(http-tlv=)){1}([\\][0-9]{1,3}){1,5}(.*)$/i) { (25) EXPAND %{unpack: &Foreach-Variable-0 0 short} (25) --> (25) if ("%{unpack: &Foreach-Variable-0 0 short}" =~ /^((dhcp-option=)|(http-tlv=)){1}([\\][0-9]{1,3}){1,5}(.*)$/i) -> FALSE (25) if ("%{unpack: &Foreach-Variable-0 0 short}" =~ /^((dhcp-option=)|(http-tlv=)){1}([\\][0-9]{1,3}){1,5}(.*)$/i) { (25) EXPAND %{unpack: &Foreach-Variable-0 0 short} (25) --> (25) if ("%{unpack: &Foreach-Variable-0 0 short}" =~ /^((dhcp-option=)|(http-tlv=)){1}([\\][0-9]{1,3}){1,5}(.*)$/i) -> FALSE (25) if ("%{unpack: &Foreach-Variable-0 0 short}" =~ /^((dhcp-option=)|(http-tlv=)){1}([\\][0-9]{1,3}){1,5}(.*)$/i) { (25) EXPAND %{unpack: &Foreach-Variable-0 0 short} (25) --> (25) if ("%{unpack: &Foreach-Variable-0 0 short}" =~ /^((dhcp-option=)|(http-tlv=)){1}([\\][0-9]{1,3}){1,5}(.*)$/i) -> FALSE (25) } # foreach &Cisco-AVPair = ok (25) } # if (&Cisco-AVPair) = ok Thank you in advance for any idea
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Feb 22, 2018, at 1:53 PM, Kylián Martin <kylianm@plzen.eu> wrote:
thanks for everything you do for the community .
It's what I do... I'm not *always* cranky...
I am using the debian packages (currently 3.0.16+dfsg-1+b1 from the unstable release) and I'd love to keep this approach (because of the updates). I don't know how exactly the maintainer compile the FR packages, but i would not expect the pcre support as enabled during the compilation. Does exist any other way for me how to enable the pcre support ?
Install the pcre development headers. Then build FreeRADIUS from source yourself. Instructions are on the wiki for building a debian package.
Or, use another method to parse the Cisco-AVPairs. e.g. rlm_perl.
This turned out to be ideal. Howerer, passing request to the perl script fails on the same thing - attributes are passed empty aswell.
(11) Received Accounting-Request Id 57 from 192.168.241.30:34261 to 172.31.12.101:1813 length 393 ... (11) Cisco-AVPair = "dhcp-option=\000\014\000\002MK" (11) Cisco-AVPair = "http-tlv=\000\001\000\031iPhone10,2/11.2.5 (15D60)" (11) # Executing section preacct from file /etc/freeradius/3.0/sites-enabled/default (11) preacct { (11) [preprocess] = ok (11) sitmp-regex-parser: $RAD_REQUEST{'Cisco-AVPair'}[0] = &request:Cisco-AVPair -> 'audit-session-id=1ef1a8c000052ac48ab18e5a' (11) sitmp-regex-parser: $RAD_REQUEST{'Cisco-AVPair'}[1] = &request:Cisco-AVPair -> 'dhcp-option=' (11) sitmp-regex-parser: $RAD_REQUEST{'Cisco-AVPair'}[2] = &request:Cisco-AVPair -> 'http-tlv='
Hmm... I guess that expansion isn't binary safe. Oh well...
Or, use the "unpack" module to unpack binary data. See raddb/mods- available/unpack for documentation.
I did.
I tried
if (&Cisco-AVPair) { foreach &Cisco-AVPair { if ("%{unpack: &Foreach-Variable-0 0 short}" =~ /${policy.device_regex}/i) {} }
That won't work. The Foreach-Variable can't be passed in expansions like that. Plus, even if it did work, you would be unpacking the first 2 bytes of the value. Which are ASCII, and not the number you want. Alan DeKok.
-----Original Message----- From: Freeradius-Users [mailto:freeradius-users- bounces+kylianm=plzen.eu@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Thursday, February 22, 2018 3:02 PM To: FreeRadius users mailing list Subject: Re: Cisco-AVPair regex
On Feb 22, 2018, at 1:53 PM, Kylián Martin <kylianm@plzen.eu> wrote:
thanks for everything you do for the community .
It's what I do... I'm not *always* cranky...
I am using the debian packages (currently 3.0.16+dfsg-1+b1 from the unstable release) and I'd love to keep this approach (because of the updates). I don't know how exactly the maintainer compile the FR packages, but i would not expect the pcre support as enabled during the compilation. Does exist any other way for me how to enable the pcre support ?
Install the pcre development headers. Then build FreeRADIUS from source yourself. Instructions are on the wiki for building a debian package.
I installed the libpcre3-dev package and compiled the latest v3.x code. So far the new build is behaving the same way in regex parsing. There should be the "--with-pcre" and two more related options present as configuration switch, am i right? It runned with: ./configure --build x86_64-linux-gnu \ --config-cache \ --disable-developer \ --disable-openssl-version-check \ --prefix=/usr \ --exec-prefix=/usr \ --mandir=/usr/share/man \ --sysconfdir=/etc \ --libdir=/usr/lib/freeradius \ --datadir=/usr/share \ --localstatedir=/var \ --with-raddbdir=/etc/freeradius \ --with-logdir=/var/log/freeradius \ --with-large-files \ --with-udpfromto \ --without-rlm_eap_tnc \ --with-rlm_sql_postgresql_lib_dir=`pg_config --libdir` \ --with-rlm_sql_postgresql_include_dir=`pg_config --includedir` \ --with-iodbc-include-dir='/usr/include/iodbc' \ --without-rlm_eap_ikev2 \ --without-rlm_sql_oracle \ --without-rlm_sql_unixodbc \ --enable-reproducible-builds So I installed the wrong pcre-dev headers most likely. What is the correct pcre dev package for debian systems?
Or, use another method to parse the Cisco-AVPairs. e.g. rlm_perl.
This turned out to be ideal. Howerer, passing request to the perl script fails on the same thing - attributes are passed empty aswell.
(11) Received Accounting-Request Id 57 from 192.168.241.30:34261 to 172.31.12.101:1813 length 393 ... (11) Cisco-AVPair = "dhcp-option=\000\014\000\002MK" (11) Cisco-AVPair = "http-tlv=\000\001\000\031iPhone10,2/11.2.5 (15D60)" (11) # Executing section preacct from file /etc/freeradius/3.0/sites- enabled/default (11) preacct { (11) [preprocess] = ok (11) sitmp-regex-parser: $RAD_REQUEST{'Cisco-AVPair'}[0] = &request:Cisco-AVPair -> 'audit-session-id=1ef1a8c000052ac48ab18e5a' (11) sitmp-regex-parser: $RAD_REQUEST{'Cisco-AVPair'}[1] = &request:Cisco-AVPair -> 'dhcp-option=' (11) sitmp-regex-parser: $RAD_REQUEST{'Cisco-AVPair'}[2] = &request:Cisco-AVPair -> 'http-tlv='
Hmm... I guess that expansion isn't binary safe. Oh well...
Or, use the "unpack" module to unpack binary data. See raddb/mods- available/unpack for documentation.
I did.
I tried
if (&Cisco-AVPair) { foreach &Cisco-AVPair { if ("%{unpack: &Foreach-Variable-0 0 short}" =~ /${policy.device_regex}/i) {} }
That won't work. The Foreach-Variable can't be passed in expansions like that. Plus, even if it did work, you would be unpacking the first 2 bytes of the value. Which are ASCII, and not the number you want.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Fri, 2018-02-23 at 09:44 +0000, Kylián Martin wrote:
I installed the libpcre3-dev package and compiled the latest v3.x code. So far the new build is behaving the same way in regex parsing. There should be the "--with-pcre" and two more related options present as configuration switch, am i right?
--with-pcre should be enabled automatically if the library is found.
So I installed the wrong pcre-dev headers most likely.
What did the output from configure say? -- Matthew
On Feb 23, 2018, at 4:30 PM, Matthew Newton <mcn@freeradius.org> wrote:
On Fri, 2018-02-23 at 09:44 +0000, Kylián Martin wrote:
I installed the libpcre3-dev package and compiled the latest v3.x code. So far the new build is behaving the same way in regex parsing. There should be the "--with-pcre" and two more related options present as configuration switch, am i right?
--with-pcre should be enabled automatically if the library is found.
So I installed the wrong pcre-dev headers most likely.
What did the output from configure say?
also radiusd -Xv will tell you which regex engine the server is using. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
On Fri, 2018-02-23 at 17:21 +0600, Arran Cudbard-Bell wrote:
On Feb 23, 2018, at 4:30 PM, Matthew Newton <mcn@freeradius.org> wrote: On Fri, 2018-02-23 at 09:44 +0000, Kylián Martin wrote:
So I installed the wrong pcre-dev headers most likely.
What did the output from configure say?
also radiusd -Xv will tell you which regex engine the server is using.
radiusd -Xxv -- Matthew
-----Original Message----- From: Freeradius-Users [mailto:freeradius-users- bounces+kylianm=plzen.eu@lists.freeradius.org] On Behalf Of Matthew Newton Sent: Friday, February 23, 2018 12:26 PM To: freeradius-users@lists.freeradius.org Subject: Re: Cisco-AVPair regex
On Fri, 2018-02-23 at 17:21 +0600, Arran Cudbard-Bell wrote:
On Feb 23, 2018, at 4:30 PM, Matthew Newton <mcn@freeradius.org> wrote: On Fri, 2018-02-23 at 09:44 +0000, Kylián Martin wrote:
So I installed the wrong pcre-dev headers most likely.
What did the output from configure say?
also radiusd -Xv will tell you which regex engine the server is using.
radiusd -Xxv
The output looks good: Fri Feb 23 12:44:09 2018 : Info: radiusd: FreeRADIUS Version 3.0.17 (git #86e1e83b7), for host x86_64-pc-linux-gnu Fri Feb 23 12:44:09 2018 : Debug: Server was built with: Fri Feb 23 12:44:09 2018 : Debug: accounting : yes Fri Feb 23 12:44:09 2018 : Debug: authentication : yes Fri Feb 23 12:44:09 2018 : Debug: ascend-binary-attributes : yes Fri Feb 23 12:44:09 2018 : Debug: coa : yes Fri Feb 23 12:44:09 2018 : Debug: control-socket : yes Fri Feb 23 12:44:09 2018 : Debug: detail : yes Fri Feb 23 12:44:09 2018 : Debug: dhcp : yes Fri Feb 23 12:44:09 2018 : Debug: dynamic-clients : yes Fri Feb 23 12:44:09 2018 : Debug: osfc2 : no Fri Feb 23 12:44:09 2018 : Debug: proxy : yes Fri Feb 23 12:44:09 2018 : Debug: regex-pcre : yes Fri Feb 23 12:44:09 2018 : Debug: regex-posix : no Fri Feb 23 12:44:09 2018 : Debug: regex-posix-extended : no Fri Feb 23 12:44:09 2018 : Debug: session-management : yes Fri Feb 23 12:44:09 2018 : Debug: stats : yes Fri Feb 23 12:44:09 2018 : Debug: tcp : yes Fri Feb 23 12:44:09 2018 : Debug: threads : yes Fri Feb 23 12:44:09 2018 : Debug: tls : yes Fri Feb 23 12:44:09 2018 : Debug: unlang : yes Fri Feb 23 12:44:09 2018 : Debug: vmps : yes Fri Feb 23 12:44:09 2018 : Debug: developer : no Fri Feb 23 12:44:09 2018 : Debug: Server core libs: Fri Feb 23 12:44:09 2018 : Debug: freeradius-server : 3.0.17 Fri Feb 23 12:44:09 2018 : Debug: talloc : 2.0.* Fri Feb 23 12:44:09 2018 : Debug: ssl : 1.1.0f release Fri Feb 23 12:44:09 2018 : Debug: pcre : 8.39 2016-06-14 Fri Feb 23 12:44:09 2018 : Debug: Endianness: Fri Feb 23 12:44:09 2018 : Debug: little Fri Feb 23 12:44:09 2018 : Debug: Compilation flags: Fri Feb 23 12:44:09 2018 : Debug: cppflags : -Wdate-time -D_FORTIFY_SOURCE=2 Fri Feb 23 12:44:09 2018 : Debug: cflags : -I. -Isrc -include src/freeradius-devel/autoconf.h -include src/freeradius-devel/build.h -include src/freeradius-devel/features.h -include src/freeradius-devel/radpaths.h -fno-strict-aliasing -g -O2 -fdebug-prefix-map=/root/freeradius-server=. -fstack-protector-strong -Wformat -Werror=format-security -O2 -Wall -std=c99 -D_GNU_SOURCE -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -DNDEBUG -DIS_MODULE=1 Fri Feb 23 12:44:09 2018 : Debug: ldflags : -Wl,-z,relro Fri Feb 23 12:44:09 2018 : Debug: libs : -lcrypto -lssl -ltalloc -lpcre -lcap -lnsl -lresolv -ldl -lpthread -lreadline Here is the unlang snippet device_regex = '^(http-tlv=){1}([\\][0-9]{1,3}){1,5}(.*)$' regex_device_type { if (&Cisco-AVPair) { foreach &Cisco-AVPair { if ("%{string:%{Foreach-Variable-0}}" =~ /{policy.device_regex}/i) { update request { &Calling-Device += "%{3} " } } } } } These attributes (11) Cisco-AVPair = "audit-session-id=1ef1a8c0000536beb5ff8f5a" (11) Cisco-AVPair = "dhcp-option=\000\014\000\002MK" (11) Cisco-AVPair = "http-tlv=\000\001\000\031iPhone10,2/11.2.5 (15D60)" Are expanded as (11) policy regex_device_type { (11) if (&Cisco-AVPair) { (11) if (&Cisco-AVPair) -> TRUE (11) if (&Cisco-AVPair) { (11) foreach &Cisco-AVPair (11) if ("%{string:%{Foreach-Variable-0}}" =~ /{policy.device_regex}/i) { (11) EXPAND Foreach-Variable-0 (11) --> audit-session-id=1ef1a8c0000536beb5ff8f5a (11) EXPAND %{string:%{Foreach-Variable-0}} (11) --> (11) if ("%{string:%{Foreach-Variable-0}}" =~ /{policy.device_regex}/i) -> FALSE (11) if ("%{string:%{Foreach-Variable-0}}" =~ /{policy.device_regex}/i) { (11) EXPAND Foreach-Variable-0 (11) --> dhcp-option= (11) EXPAND %{string:%{Foreach-Variable-0}} (11) --> (11) if ("%{string:%{Foreach-Variable-0}}" =~ /{policy.device_regex}/i) -> FALSE (11) if ("%{string:%{Foreach-Variable-0}}" =~ /{policy.device_regex}/i) { (11) EXPAND Foreach-Variable-0 (11) --> http-tlv= (11) EXPAND %{string:%{Foreach-Variable-0}} (11) --> (11) if ("%{string:%{Foreach-Variable-0}}" =~ /{policy.device_regex}/i) -> FALSE (11) } # foreach &Cisco-AVPair = ok (11) } # if (&Cisco-AVPair) = ok (11) } # policy regex_device_type = ok I also suspected the foreach itself, but following snippet produces same expansion regex_device_type { if (&Cisco-AVPair[2]) { if ("%{Cisco-AVPair[2]}" =~ /{policy.device_regex}/i) { update request { &Calling-Device += "%{3} " } } } }
-- Matthew
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Fri, 2018-02-23 at 11:56 +0000, Kylián Martin wrote:
Here is the unlang snippet
device_regex = '^(http-tlv=){1}([\\][0-9]{1,3}){1,5}(.*)$'
regex_device_type { if (&Cisco-AVPair) { foreach &Cisco-AVPair { if ("%{string:%{Foreach-Variable-0}}" =~ /{policy.device_regex}/i) {
You're matching the text '{policy.device_regex}', not the defined string. Use ${policy.device_regex} if ("%{string:%{Foreach-Variable-0}}" =~ /${policy.device_regex}/i) { -- Matthew
-----Original Message----- From: Freeradius-Users [mailto:freeradius-users- bounces+kylianm=plzen.eu@lists.freeradius.org] On Behalf Of Matthew Newton Sent: Friday, February 23, 2018 2:19 PM To: freeradius-users@lists.freeradius.org Subject: Re: Cisco-AVPair regex
On Fri, 2018-02-23 at 11:56 +0000, Kylián Martin wrote:
Here is the unlang snippet
device_regex = '^(http-tlv=){1}([\\][0-9]{1,3}){1,5}(.*)$'
regex_device_type { if (&Cisco-AVPair) { foreach &Cisco-AVPair { if ("%{string:%{Foreach-Variable-0}}" =~ /{policy.device_regex}/i) {
You're matching the text '{policy.device_regex}', not the defined string.
Use ${policy.device_regex}
if ("%{string:%{Foreach-Variable-0}}" =~ /${policy.device_regex}/i) {
You're right, thank you. That’s something I forgot to put back after some tries. But still got the trouble while expanding the AVPs... (12) Cisco-AVPair = "dhcp-option=\000\014\000\003iP6" (12) Cisco-AVPair = "http-tlv=\000\001\000\031iPhone7,2/11.2.2 (15C202)" (12) policy regex_device_type { (12) if (&Cisco-AVPair) { (12) if (&Cisco-AVPair) -> TRUE (12) if (&Cisco-AVPair) { (12) foreach &Cisco-AVPair (12) if ("%{string:%{Foreach-Variable-0}}" =~ /^(http-tlv=){1}([\\][0-9]{1,3}){1,5}(.*)$/i) { (12) EXPAND Foreach-Variable-0 (12) --> audit-session-id=1ef1a8c0000538f82e22905a (12) EXPAND %{string:%{Foreach-Variable-0}} (12) --> (12) if ("%{string:%{Foreach-Variable-0}}" =~ /^(http-tlv=){1}([\\][0-9]{1,3}){1,5}(.*)$/i) -> FALSE (12) if ("%{string:%{Foreach-Variable-0}}" =~ /^(http-tlv=){1}([\\][0-9]{1,3}){1,5}(.*)$/i) { (12) EXPAND Foreach-Variable-0 (12) --> dhcp-option= (12) EXPAND %{string:%{Foreach-Variable-0}} (12) --> (12) if ("%{string:%{Foreach-Variable-0}}" =~ /^(http-tlv=){1}([\\][0-9]{1,3}){1,5}(.*)$/i) -> FALSE (12) if ("%{string:%{Foreach-Variable-0}}" =~ /^(http-tlv=){1}([\\][0-9]{1,3}){1,5}(.*)$/i) { (12) EXPAND Foreach-Variable-0 (12) --> http-tlv= (12) EXPAND %{string:%{Foreach-Variable-0}} (12) --> (12) if ("%{string:%{Foreach-Variable-0}}" =~ /^(http-tlv=){1}([\\][0-9]{1,3}){1,5}(.*)$/i) -> FALSE (12) } # foreach &Cisco-AVPair = updated (12) } # if (&Cisco-AVPair) = updated (12) } # policy regex_device_type = updated
-- Matthew
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Feb 23, 2018, at 10:32 AM, Kylián Martin <kylianm@plzen.eu> wrote:
You're right, thank you. That’s something I forgot to put back after some tries. But still got the trouble while expanding the AVPs...
(12) Cisco-AVPair = "dhcp-option=\000\014\000\003iP6" (12) Cisco-AVPair = "http-tlv=\000\001\000\031iPhone7,2/11.2.2 (15C202)" ... (12) if ("%{string:%{Foreach-Variable-0}}" =~ /^(http-tlv=){1}([\\][0-9]{1,3}){1,5}(.*)$/i) {
I don't see why you're doing %{string:%{Foreach-Variable-0}}. The "string" expansion takes an *attribute name*, finds the attribute, and then outputs it as a printable string. What you're doing is taking the *value* of Foreach-Variable-0, and passing that to %{string:...}
(12) EXPAND Foreach-Variable-0 (12) --> audit-session-id=1ef1a8c0000538f82e22905a
i.e. the value of this variable.
(12) EXPAND %{string:%{Foreach-Variable-0}} (12) -->
Because there is no attribute named "audit-session-id=1ef1a8c0000538f82e22905a". TBH, the simplest thing is to *not* use "foreach". I'd guess that the Cisco-AVPair attributes come in the same order all the time. So you can just rely on that. e.g. if (Cisco-AVPair[0] =~ /^dhcp-option=/) { update request { Tmp-Integer-0 := "%{unpack:&Cisco-AVPair[0] 12 integer}" } } That will get you the binary data (4 octets) into Tmp-Integer-0. i.e. *manually* check that Cisco-AVPair[0] is the "dhcp-option". Then, *manually* check that the binary data you want is at byte offset 12. And then write an "unpack" rule to do that... Alan DeKok.
participants (4)
-
Alan DeKok -
Arran Cudbard-Bell -
Kylián Martin -
Matthew Newton