Hi All, I am processing Accounting records from a vendor who overloads VSA 255 to extend the range of available attributes. For instance, they may send something like this: VENDOR-Attr-255 = "272=Yes” Which really means VSA 272 = “Yes” I am struggling a bit to figure out how to process these effectively. I found rlm_attr_rewrite but I can’t see a way to make it split the string and drop the “272=“ part. Is there a way to do this in unlang at all or am I going to need to bring in rlm_python or similar? Thanks in Advance, Ben
On Dec 31, 2014, at 5:16 AM, Ben Gatewood <Ben.Gatewood@essensys.co.uk> wrote:
I am processing Accounting records from a vendor who overloads VSA 255 to extend the range of available attributes. For instance, they may send something like this:
VENDOR-Attr-255 = "272=Yes”
Which really means VSA 272 = “Yes”
Which is a terrible idea. Horrific, even.
I am struggling a bit to figure out how to process these effectively. I found rlm_attr_rewrite but I can’t see a way to make it split the string and drop the “272=“ part. Is there a way to do this in unlang at all or am I going to need to bring in rlm_python or similar?
Removing the “272=“ text won’t help. You’ll get a bare “Yes”, which isn’t very meaningful. I’d have to ask WHICH vendor does this. That information shouldn’t be secret. And WHY you need this re-written. What are you doing with the data? There’s likely a better way of getting the “Yes” out, which doesn’t involve rewriting an attribute. Alan DeKok.
I agree - horrific. The vendor is Broadsoft who make (actually very good IMHO) VoIP PABX products. I don’t need to ‘do’ anything with the value other than store it into the DB in an appropriately recognisable column. It’s relevant to the Call Detail Record that the PABX is sending me. I’d much rather have each of these 'overloaded’ VSAs broken out into a separate column like the ‘normal’ VSAs so I have to do less in the mediation layer. That is, rather than having a single DB column with values like: “272=Yes”, "372=2678148:1” etc. etc. Thanks very much for your help. Ben On 31 Dec 2014, at 13:23, Alan DeKok <aland@deployingradius.com> wrote:
On Dec 31, 2014, at 5:16 AM, Ben Gatewood <Ben.Gatewood@essensys.co.uk> wrote:
I am processing Accounting records from a vendor who overloads VSA 255 to extend the range of available attributes. For instance, they may send something like this:
VENDOR-Attr-255 = "272=Yes”
Which really means VSA 272 = “Yes”
Which is a terrible idea. Horrific, even.
I am struggling a bit to figure out how to process these effectively. I found rlm_attr_rewrite but I can’t see a way to make it split the string and drop the “272=“ part. Is there a way to do this in unlang at all or am I going to need to bring in rlm_python or similar?
Removing the “272=“ text won’t help. You’ll get a bare “Yes”, which isn’t very meaningful.
I’d have to ask WHICH vendor does this. That information shouldn’t be secret. And WHY you need this re-written. What are you doing with the data?
There’s likely a better way of getting the “Yes” out, which doesn’t involve rewriting an attribute.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 31 Dec 2014, at 08:45, Ben Gatewood <Ben.Gatewood@essensys.co.uk> wrote:
I agree - horrific. The vendor is Broadsoft who make (actually very good IMHO) VoIP PABX products.
I don’t need to ‘do’ anything with the value other than store it into the DB in an appropriately recognisable column. It’s relevant to the Call Detail Record that the PABX is sending me. I’d much rather have each of these 'overloaded’ VSAs broken out into a separate column like the ‘normal’ VSAs so I have to do less in the mediation layer. That is, rather than having a single DB column with values like: “272=Yes”, "372=2678148:1” etc. etc.
Thanks very much for your help.
So you just need the attribute number and the value split out? You can just use a regex if (<vendor attr> =~ /^([0-9]+)=(.*)$/) { # integer available as %{1} # value available as %{2} } There's also the option of adding a RADIUS decoder xlat which operates like the DHCP options decoder xlat. But then we'd really need a pack module to help with forming the octet string to feed into that. Another way would be to accept xlats on the LHS of maps which expand into attribute names. if (<vendor attr> =~ /^([0-9]+)=(.*)$/) { update request { "%{vendor:<vendor attr>}-Attr-%{1}" := "%{2}" } } Vendor in this case operates like %{tag:} and gets you the vendor name associated with the attribute. If we tweaked dict_unknown_from_str to accept attribute names as well, I think we could probably get rid of the Cisco AVPair hacks in the code, and replace them with a policy. What do people think? Seems like a more generic solution to vendor stupidity. I've seen similar formats used by vendors other than Cisco and Broadsoft. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Thanks, Arran - that seems to make sense to me. I’m going to have a crack at doing it like you suggest. Regards, Ben On 31 Dec 2014, at 14:44, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On 31 Dec 2014, at 08:45, Ben Gatewood <Ben.Gatewood@essensys.co.uk> wrote:
I agree - horrific. The vendor is Broadsoft who make (actually very good IMHO) VoIP PABX products.
I don’t need to ‘do’ anything with the value other than store it into the DB in an appropriately recognisable column. It’s relevant to the Call Detail Record that the PABX is sending me. I’d much rather have each of these 'overloaded’ VSAs broken out into a separate column like the ‘normal’ VSAs so I have to do less in the mediation layer. That is, rather than having a single DB column with values like: “272=Yes”, "372=2678148:1” etc. etc.
Thanks very much for your help.
So you just need the attribute number and the value split out?
You can just use a regex
if (<vendor attr> =~ /^([0-9]+)=(.*)$/) { # integer available as %{1} # value available as %{2} }
There's also the option of adding a RADIUS decoder xlat which operates like the DHCP options decoder xlat.
But then we'd really need a pack module to help with forming the octet string to feed into that.
Another way would be to accept xlats on the LHS of maps which expand into attribute names.
if (<vendor attr> =~ /^([0-9]+)=(.*)$/) { update request { "%{vendor:<vendor attr>}-Attr-%{1}" := "%{2}" } }
Vendor in this case operates like %{tag:} and gets you the vendor name associated with the attribute.
If we tweaked dict_unknown_from_str to accept attribute names as well, I think we could probably get rid of the Cisco AVPair hacks in the code, and replace them with a policy.
What do people think? Seems like a more generic solution to vendor stupidity. I've seen similar formats used by vendors other than Cisco and Broadsoft.
-Arran
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
In master the destination of an update section can now be specified using an xlat: authorize { update request { BroadSoft-Attr-255 += '250=123456' BroadSoft-Attr-255 += '260=false' } foreach &BroadSoft-Attr-255 { if ("%{Foreach-Variable-0}" =~ /^([0-9]+)=(.*)$/) { update request { "%{vendor:Broadsoft-Attr-255}-Attr-%{1}" += "%{2}" } } } update { Tmp-String-0 := "%{debug_attr:request:}" } } (1) update request { (1) BroadSoft-Attr-255 += '250=123456' (1) BroadSoft-Attr-255 += '260=false' (1) } # update request = noop (1) foreach &BroadSoft-Attr-255 (1) # Foreach-Variable-0 = "250=123456" (1) if ("%{Foreach-Variable-0}" =~ /^([0-9]+)=(.*)$/) { (1) EXPAND Foreach-Variable-0 (1) --> 250=123456 (1) EXPAND %{Foreach-Variable-0} (1) --> 250=123456 (1) if ("%{Foreach-Variable-0}" =~ /^([0-9]+)=(.*)$/) -> TRUE (1) if ("%{Foreach-Variable-0}" =~ /^([0-9]+)=(.*)$/) { (1) update request { (1) EXPAND %{vendor:Broadsoft-Attr-255}-Attr-%{1} (1) --> BroadSoft-Attr-250 (1) EXPAND %{2} (1) --> 123456 (1) BroadSoft-Attr-250 += "123456" (1) } # update request = noop (1) } # if ("%{Foreach-Variable-0}" =~ /^([0-9]+)=(.*)$/) = noop (1) # Foreach-Variable-0 = "260=false" (1) if ("%{Foreach-Variable-0}" =~ /^([0-9]+)=(.*)$/) { (1) EXPAND Foreach-Variable-0 (1) --> 260=false (1) EXPAND %{Foreach-Variable-0} (1) --> 260=false (1) if ("%{Foreach-Variable-0}" =~ /^([0-9]+)=(.*)$/) -> TRUE (1) if ("%{Foreach-Variable-0}" =~ /^([0-9]+)=(.*)$/) { (1) update request { (1) EXPAND %{vendor:Broadsoft-Attr-255}-Attr-%{1} (1) --> BroadSoft-Attr-260 (1) EXPAND %{2} (1) --> false (1) BroadSoft-Attr-260 += "false" (1) } # update request = noop (1) } # if ("%{Foreach-Variable-0}" =~ /^([0-9]+)=(.*)$/) = noop (1) } # foreach &BroadSoft-Attr-255 = noop (1) update { (1) Attributes matching "request:" (1) &request:User-Name = foo (1) &request:User-Password = bar (1) &request:NAS-IP-Address = 127.0.0.1 (1) &request:NAS-Port = 0 (1) &request:Message-Authenticator = 0x16c9d85342f767d7ebc5332ba54e9156 (1) &request:BroadSoft-Attr-255 += 250=123456 (1) &request:BroadSoft-Attr-255 += 260=false (1) &request:BWAS-Call-Center-Forced-Forwarding-Act-Result += 123456 (1) &request:BWAS-CB-Deactivation-Fac-Result += false (1) EXPAND %{debug_attr:request:} (1) --> (1) Tmp-String-0 := "" (1) } # update = noop (1) } # authorize = noop Lots of changes though, and relaxation of allowed attribute number ranges for VSAs so probably not a good idea to merge it in to v3.0.x. Hopefully we can fix foreach to provide full attribute references with &Foreach-Variable-N, instead of just the string value. Then re-encoding for proxying would be fairly trivial: update request { BroadSoft-Attr-255 !* ANY } foreach &request: { if (("%{vendor:&Foreach-Variable-0}" == 'BroadSoft') && ("%{attr_num:&Foreach-Variable-0}" > 255)) { update { Broadsoft-Attr-255 += "%{attr_num:&Foreach-Variable-0}=%{Foreach-Variable-0}" } } } Same would work for Cisco-AVPairs. Decode/Encode process could be wrapped in some policies shipped with the server. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Thanks, Arran. I have to confess I’ve hit a wall in my expertise and can’t figure out how to make your regex model work for cases where there are more than one Attr-255 in the request. I got it working on the first (or nth) one fine but can’t seem to get it to run for each instance of the attribute. Have I misunderstood something? Thanks, Ben On 2 Jan 2015, at 18:44, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
In master the destination of an update section can now be specified using an xlat:
authorize { update request { BroadSoft-Attr-255 += '250=123456' BroadSoft-Attr-255 += '260=false' }
foreach &BroadSoft-Attr-255 { if ("%{Foreach-Variable-0}" =~ /^([0-9]+)=(.*)$/) { update request { "%{vendor:Broadsoft-Attr-255}-Attr-%{1}" += "%{2}" } } }
update { Tmp-String-0 := "%{debug_attr:request:}" } }
(1) update request { (1) BroadSoft-Attr-255 += '250=123456' (1) BroadSoft-Attr-255 += '260=false' (1) } # update request = noop (1) foreach &BroadSoft-Attr-255 (1) # Foreach-Variable-0 = "250=123456" (1) if ("%{Foreach-Variable-0}" =~ /^([0-9]+)=(.*)$/) { (1) EXPAND Foreach-Variable-0 (1) --> 250=123456 (1) EXPAND %{Foreach-Variable-0} (1) --> 250=123456 (1) if ("%{Foreach-Variable-0}" =~ /^([0-9]+)=(.*)$/) -> TRUE (1) if ("%{Foreach-Variable-0}" =~ /^([0-9]+)=(.*)$/) { (1) update request { (1) EXPAND %{vendor:Broadsoft-Attr-255}-Attr-%{1} (1) --> BroadSoft-Attr-250 (1) EXPAND %{2} (1) --> 123456 (1) BroadSoft-Attr-250 += "123456" (1) } # update request = noop (1) } # if ("%{Foreach-Variable-0}" =~ /^([0-9]+)=(.*)$/) = noop (1) # Foreach-Variable-0 = "260=false" (1) if ("%{Foreach-Variable-0}" =~ /^([0-9]+)=(.*)$/) { (1) EXPAND Foreach-Variable-0 (1) --> 260=false (1) EXPAND %{Foreach-Variable-0} (1) --> 260=false (1) if ("%{Foreach-Variable-0}" =~ /^([0-9]+)=(.*)$/) -> TRUE (1) if ("%{Foreach-Variable-0}" =~ /^([0-9]+)=(.*)$/) { (1) update request { (1) EXPAND %{vendor:Broadsoft-Attr-255}-Attr-%{1} (1) --> BroadSoft-Attr-260 (1) EXPAND %{2} (1) --> false (1) BroadSoft-Attr-260 += "false" (1) } # update request = noop (1) } # if ("%{Foreach-Variable-0}" =~ /^([0-9]+)=(.*)$/) = noop (1) } # foreach &BroadSoft-Attr-255 = noop (1) update { (1) Attributes matching "request:" (1) &request:User-Name = foo (1) &request:User-Password = bar (1) &request:NAS-IP-Address = 127.0.0.1 (1) &request:NAS-Port = 0 (1) &request:Message-Authenticator = 0x16c9d85342f767d7ebc5332ba54e9156 (1) &request:BroadSoft-Attr-255 += 250=123456 (1) &request:BroadSoft-Attr-255 += 260=false (1) &request:BWAS-Call-Center-Forced-Forwarding-Act-Result += 123456 (1) &request:BWAS-CB-Deactivation-Fac-Result += false (1) EXPAND %{debug_attr:request:} (1) --> (1) Tmp-String-0 := "" (1) } # update = noop (1) } # authorize = noop
Lots of changes though, and relaxation of allowed attribute number ranges for VSAs so probably not a good idea to merge it in to v3.0.x.
Hopefully we can fix foreach to provide full attribute references with &Foreach-Variable-N, instead of just the string value.
Then re-encoding for proxying would be fairly trivial:
update request { BroadSoft-Attr-255 !* ANY }
foreach &request: { if (("%{vendor:&Foreach-Variable-0}" == 'BroadSoft') && ("%{attr_num:&Foreach-Variable-0}" > 255)) { update { Broadsoft-Attr-255 += "%{attr_num:&Foreach-Variable-0}=%{Foreach-Variable-0}" } } }
Same would work for Cisco-AVPairs. Decode/Encode process could be wrapped in some policies shipped with the server.
-Arran
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 5 Jan 2015, at 09:32, Ben Gatewood <Ben.Gatewood@essensys.co.uk> wrote:
Thanks, Arran. I have to confess I’ve hit a wall in my expertise and can’t figure out how to make your regex model work for cases where there are more than one Attr-255 in the request.
Foreach... operates the same as any other programming language. Iterator is hard coded to the level of nesting. foreach &Broadsoft-Attr-255 { # values of Broadsoft-Attr-255 are available as %{Foreach-Variable-0} if ("%{Foreach-Variable-0}" =~ /^([0-9]+)=(.*)$/) { # %{1} attr %{2} value } } If you're doing presence checks you can also use: if (&Broadsoft-Attr-255[*] == '<attr>=<value>') { # evaluates to true if any instance of Broadsoft-Attr-255 has the value <attr>=<value> } but that's >= 3.0.6 only. -Arran
Thanks, Arran. I tried that and got "Failed to load module "foreach”.” which, I presume means I need to do an upgrade, right? Regards, Ben On 6 Jan 2015, at 02:19, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On 5 Jan 2015, at 09:32, Ben Gatewood <Ben.Gatewood@essensys.co.uk> wrote:
Thanks, Arran. I have to confess I’ve hit a wall in my expertise and can’t figure out how to make your regex model work for cases where there are more than one Attr-255 in the request.
Foreach... operates the same as any other programming language.
Iterator is hard coded to the level of nesting.
foreach &Broadsoft-Attr-255 { # values of Broadsoft-Attr-255 are available as %{Foreach-Variable-0} if ("%{Foreach-Variable-0}" =~ /^([0-9]+)=(.*)$/) { # %{1} attr %{2} value } }
If you're doing presence checks you can also use:
if (&Broadsoft-Attr-255[*] == '<attr>=<value>') { # evaluates to true if any instance of Broadsoft-Attr-255 has the value <attr>=<value> }
but that's >= 3.0.6 only.
-Arran - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 6 Jan 2015, at 08:10, Ben Gatewood <Ben.Gatewood@essensys.co.uk> wrote:
Thanks, Arran. I tried that and got "Failed to load module "foreach”.” which, I presume means I need to do an upgrade, right?
Very likely, Ben. Running radiusd -v (or freeradius -v on Debian platforms) will give you the version you are running. With Regards Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp@jabber.dev.ja.net skype: stefan.paetow.janet Lumen House, Library Avenue, Harwell Oxford, Didcot, OX11 0SG jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200.
On 6 Jan 2015, at 04:57, Stefan Paetow <Stefan.Paetow@jisc.ac.uk> wrote:
On 6 Jan 2015, at 08:10, Ben Gatewood <Ben.Gatewood@essensys.co.uk> wrote:
Thanks, Arran. I tried that and got "Failed to load module "foreach”.” which, I presume means I need to do an upgrade, right?
Very likely, Ben. Running radiusd -v (or freeradius -v on Debian platforms) will give you the version you are running.
Yes preferably v3.0.6 Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
On 6 Jan 2015, at 23:39, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On 6 Jan 2015, at 04:57, Stefan Paetow <Stefan.Paetow@jisc.ac.uk> wrote:
On 6 Jan 2015, at 08:10, Ben Gatewood <Ben.Gatewood@essensys.co.uk> wrote:
Thanks, Arran. I tried that and got "Failed to load module "foreach”.” which, I presume means I need to do an upgrade, right?
Very likely, Ben. Running radiusd -v (or freeradius -v on Debian platforms) will give you the version you are running.
Yes preferably v3.0.6
Just FYI there's now a policy in master branch called broadcom-decode that'll decode these attributes properly. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Thanks, Arran - that’s great! I had a terrible weekend trying to migrate some platforms to the new 3.0.6 server as FR would keep Seg Faulting when I enabled accounting from a particular device. Going to re-sanitise all my config to make sure there’s no problems there then may need some more help with diagnosing that. Regards and Thanks Again, Ben On 12 Jan 2015, at 02:17, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On 6 Jan 2015, at 23:39, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On 6 Jan 2015, at 04:57, Stefan Paetow <Stefan.Paetow@jisc.ac.uk> wrote:
On 6 Jan 2015, at 08:10, Ben Gatewood <Ben.Gatewood@essensys.co.uk> wrote:
Thanks, Arran. I tried that and got "Failed to load module "foreach”.” which, I presume means I need to do an upgrade, right?
Very likely, Ben. Running radiusd -v (or freeradius -v on Debian platforms) will give you the version you are running.
Yes preferably v3.0.6
Just FYI there's now a policy in master branch called broadcom-decode that'll decode these attributes properly.
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 12 Jan 2015, at 16:42, Ben Gatewood <Ben.Gatewood@essensys.co.uk> wrote:
Thanks, Arran - that’s great!
I had a terrible weekend trying to migrate some platforms to the new 3.0.6 server as FR would keep Seg Faulting when I enabled accounting from a particular device. Going to re-sanitise all my config to make sure there’s no problems there then may need some more help with diagnosing that.
If you're using realm regexes e.g. realm ~foo { } We found an issue with that and fixed it. Might want to try v3.0.x HEAD. If it's not that, install gdb and take a look at the panic_action stuff in radiusd.conf There's instructions in there on how to use it to generate backtraces. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Thanks, Arran - will do and let you know what I find. Ben On 12 Jan 2015, at 10:11, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On 12 Jan 2015, at 16:42, Ben Gatewood <Ben.Gatewood@essensys.co.uk> wrote:
Thanks, Arran - that’s great!
I had a terrible weekend trying to migrate some platforms to the new 3.0.6 server as FR would keep Seg Faulting when I enabled accounting from a particular device. Going to re-sanitise all my config to make sure there’s no problems there then may need some more help with diagnosing that.
If you're using realm regexes e.g.
realm ~foo {
}
We found an issue with that and fixed it. Might want to try v3.0.x HEAD.
If it's not that, install gdb and take a look at the panic_action stuff in radiusd.conf
There's instructions in there on how to use it to generate backtraces.
-Arran
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
The new build I grabbed last night appears to be holding up fine so far. Thanks! Ben On 12 Jan 2015, at 10:11, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On 12 Jan 2015, at 16:42, Ben Gatewood <Ben.Gatewood@essensys.co.uk> wrote:
Thanks, Arran - that’s great!
I had a terrible weekend trying to migrate some platforms to the new 3.0.6 server as FR would keep Seg Faulting when I enabled accounting from a particular device. Going to re-sanitise all my config to make sure there’s no problems there then may need some more help with diagnosing that.
If you're using realm regexes e.g.
realm ~foo {
}
We found an issue with that and fixed it. Might want to try v3.0.x HEAD.
If it's not that, install gdb and take a look at the panic_action stuff in radiusd.conf
There's instructions in there on how to use it to generate backtraces.
-Arran
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I just stood up Freeradius 3.0.4 on a Fedora system, and I have an older (2.1.12) one running on Ubuntu (doubt the OS makes any difference….) On the 3x system, I am using mysql to provide the mac to vlan information, while on the 2x system it’s the mac2vlan flat file. IN the 2x version, this is what is displayed for the VMPS -join-request VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 961 VMPS-Client-IP-Address = 192.168.30.11 VMPS-Port-Name = "Fa0/19" VMPS-VLAN-Name = "--NONE--" VMPS-Domain-Name = "seccom.ab.ca" VMPS-Unknown = 0x00 VMPS-MAC = 00:25:bc:e1:5b:4a This is the MAC of my client, and it’s consistent on each connection of the client, regardless of the port. This works fine. In the 3x version, this is what I get VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 913 VMPS-Client-IP-Address = 192.168.30.11 VMPS-Port-Name = 'Fa0/19' VMPS-VLAN-Name = '--NONE--' VMPS-Domain-Name = 'seccom.ab.ca' VMPS-Unknown = 0x00 VMPS-MAC = a0:f4:40:9b:a6:7f Additionally, on the 3x version, each time I connect the client, a different mac is registered: VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 1009 VMPS-Client-IP-Address = 192.168.30.11 VMPS-Port-Name = 'Fa0/19' VMPS-VLAN-Name = '--NONE--' VMPS-Domain-Name = 'seccom.ab.ca' VMPS-Unknown = 0x00 VMPS-MAC = 10:fb:40:9b:a6:7f Here is the full output from the last VMPS query for 3.x: (10) Cleaning up request packet ID 1057 with timestamp +4655 Waking up in 995474.9 seconds. VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 1073 VMPS-Client-IP-Address = 192.168.30.11 VMPS-Port-Name = 'Fa0/11' VMPS-VLAN-Name = '--NONE--' VMPS-Domain-Name = 'seccom.ab.ca' VMPS-Unknown = 0x00 VMPS-MAC = 90:ff:40:9b:a6:7f (11) Received Access-Request packet from host 192.168.30.11 port 57089, id=1073, length=81 (11) VMPS-Packet-Type = VMPS-Join-Request (11) VMPS-Error-Code = VMPS-No-Error (11) VMPS-Sequence-Number = 1073 (11) VMPS-Client-IP-Address = 192.168.30.11 (11) VMPS-Port-Name = 'Fa0/11' (11) VMPS-VLAN-Name = '--NONE--' (11) VMPS-Domain-Name = 'seccom.ab.ca' (11) VMPS-Unknown = 0x00 (11) VMPS-MAC = 90:ff:40:9b:a6:7f Doing VMPS (11) vmps { (11) if (!VMPS-Mac) (11) if (!VMPS-Mac) -> FALSE (11) update reply { (11) VMPS-Packet-Type = VMPS-Join-Response (11) EXPAND %{VMPS-Mac} (11) --> 90:ff:40:9b:a6:7f (11) VMPS-Cookie = 90:ff:40:9b:a6:7f (11) VMPS-VLAN-Name = 'default' (11) EXPAND %{User-Name} (11) --> (11) SQL-User-Name set to '' rlm_sql (sql): Reserved connection (14) rlm_sql (sql): Executing query: 'SELECT vlan FROM mac2vlan WHERE mac='90:ff:40:9b:a6:7f'' (11) SQL query returned no results rlm_sql (sql): Released connection (14) rlm_sql (sql): 0 of 2 connections in use. Need more spares rlm_sql (sql): Opening additional connection (15) rlm_sql_mysql: Starting connect to MySQL server (11) EXPAND %{sql:SELECT vlan FROM mac2vlan WHERE mac='%{VMPS-Mac}'} (11) --> (11) VMPS-VLAN-Name = "" (11) } # update reply = noop (11) if (VMPS-Packet-Type == VMPS-Reconfirm-Request) (11) if (VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (11) } # vmps = noop Done VMPS (11) vmps { (11) if (!VMPS-Mac) (11) if (!VMPS-Mac) -> FALSE (11) update reply { (11) VMPS-Packet-Type = VMPS-Join-Response (11) EXPAND %{VMPS-Mac} (11) --> 90:ff:40:9b:a6:7f (11) VMPS-Cookie = 90:ff:40:9b:a6:7f (11) VMPS-VLAN-Name = 'default' (11) EXPAND %{User-Name} (11) --> (11) SQL-User-Name set to '' rlm_sql (sql): Reserved connection (15) rlm_sql (sql): Executing query: 'SELECT vlan FROM mac2vlan WHERE mac='90:ff:40:9b:a6:7f'' (11) SQL query returned no results rlm_sql (sql): Released connection (15) (11) EXPAND %{sql:SELECT vlan FROM mac2vlan WHERE mac='%{VMPS-Mac}'} (11) --> (11) VMPS-VLAN-Name = "" (11) } # update reply = noop (11) if (VMPS-Packet-Type == VMPS-Reconfirm-Request) (11) if (VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (11) } # vmps = noop (11) Sending Access-Accept packet to host 192.168.30.11 port 57089, id=1073, length=0 (11) VMPS-Packet-Type = VMPS-Join-Response (11) VMPS-Cookie = 90:ff:40:9b:a6:7f (11) VMPS-VLAN-Name = 'default' VMPS-VLAN-Name = 'default' VMPS-Cookie = 90:ff:40:9b:a6:7f (11) Finished request Waking up in 0.3 seconds. Waking up in 4.6 seconds. (11) Cleaning up request packet ID 1073 with timestamp +4691 Waking up in 995438.1 seconds. And the same from the v2.1.12 system: Ready to process requests. VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 1105 VMPS-Client-IP-Address = 192.168.30.11 VMPS-Port-Name = "Fa0/11" VMPS-VLAN-Name = "--NONE--" VMPS-Domain-Name = "seccom.ab.ca" VMPS-Unknown = 0x00 VMPS-MAC = 00:25:bc:e1:5b:4a server vmps { Doing VMPS +- entering group vmps {...} ++? if (!VMPS-Mac) ? Evaluating !(VMPS-Mac) -> FALSE ++? if (!VMPS-Mac) -> FALSE [mac2vlan] Added VMPS-VLAN-Name: 'ENMAX' to reply_items ++[mac2vlan] returns ok expand: %{VMPS-Mac} -> 00:25:bc:e1:5b:4a ++[reply] returns ok ++? if (VMPS-Packet-Type == VMPS-Reconfirm-Request) ? Evaluating (VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE ++? if (VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE [linelog] expand: /var/log/freeradius/vmps.log -> /var/log/freeradius/vmps.log [linelog] expand: %S %C %{VMPS-Port-Name} %{VMPS-Mac} %{reply:VMPS-VLAN-Name} -> 2015-01-14 20:32:58 cisco Fa0/11 00:25:bc:e1:5b:4a ENMAX ++[linelog] returns ok Done VMPS } # server vmps VMPS-VLAN-Name = "ENMAX" VMPS-Cookie = 00:25:bc:e1:5b:4a Finished request 3. Going to the next request Waking up in 4.9 seconds. Cleaning up request 3 ID 1105 with timestamp +1273 Ready to process requests. I’m assuming that somehow the 3.0.4 system is parsing the packet incorrectly, and thus coming up with the wrong information for the MAC. Any idea on what I can do to resolve? Thanks! Keith
On 15 Jan 2015, at 10:47, Keith Olsen <keith.r.olsen@gmail.com> wrote:
I just stood up Freeradius 3.0.4 on a Fedora system, and I have an older (2.1.12) one running on Ubuntu (doubt the OS makes any difference….)
On the 3x system, I am using mysql to provide the mac to vlan information, while on the 2x system it’s the mac2vlan flat file.
Yeah, likely a parse issue. I don't think anyone's tested VMPS with v3.0.x, and we certainly have no internal tests. PCAP would be useful so it can be replayed against the server locally. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
HI Arran, I had a quick look in the pcap in wireshark but could not see any obvious issues, I was looking for the erroneous mac addresses, but could not see where the parsing is going wrong. The correct mac (00:25:bc:e1:5b:4a) is there. I have attached the pcap and here is the output from radius -X for the transactions, Ready to process requests VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 145 VMPS-Client-IP-Address = 192.168.30.11 VMPS-Port-Name = 'Fa0/11' VMPS-VLAN-Name = '--NONE--' VMPS-Domain-Name = 'seccom.ab.ca' VMPS-Unknown = 0x00 VMPS-MAC = f0:45:75:08:97:7f (1) Received Access-Request packet from host 192.168.30.11 port 53489, id=145, length=81 (1) VMPS-Packet-Type = VMPS-Join-Request (1) VMPS-Error-Code = VMPS-No-Error (1) VMPS-Sequence-Number = 145 (1) VMPS-Client-IP-Address = 192.168.30.11 (1) VMPS-Port-Name = 'Fa0/11' (1) VMPS-VLAN-Name = '--NONE--' (1) VMPS-Domain-Name = 'seccom.ab.ca' (1) VMPS-Unknown = 0x00 (1) VMPS-MAC = f0:45:75:08:97:7f Doing VMPS (1) vmps { (1) if (!VMPS-Mac) (1) if (!VMPS-Mac) -> FALSE (1) update reply { (1) VMPS-Packet-Type = VMPS-Join-Response (1) EXPAND %{VMPS-Mac} (1) --> f0:45:75:08:97:7f (1) VMPS-Cookie = f0:45:75:08:97:7f (1) VMPS-VLAN-Name = 'default' (1) EXPAND %{User-Name} (1) --> (1) SQL-User-Name set to '' rlm_sql (sql): Reserved connection (4) rlm_sql (sql): Executing query: 'SELECT vlan FROM mac2vlan WHERE mac='f0:45:75:08:97:7f'' (1) SQL query returned no results rlm_sql (sql): Released connection (4) rlm_sql (sql): Closing connection (0), from 1 unused connections rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (3): Hit idle_timeout, was idle for 187 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (2): Hit idle_timeout, was idle for 187 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (1): Hit idle_timeout, was idle for 187 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket (1) EXPAND %{sql:SELECT vlan FROM mac2vlan WHERE mac='%{VMPS-Mac}'} (1) --> (1) VMPS-VLAN-Name = "" (1) } # update reply = noop (1) if (VMPS-Packet-Type == VMPS-Reconfirm-Request) (1) if (VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (1) linelog : EXPAND messages.%{%{Packet-Type}:-default} (1) linelog : --> messages.Access-Request (1) linelog : EXPAND /var/log/radius/linelog (1) linelog : --> /var/log/radius/linelog (1) linelog : EXPAND Requested access: %{User-Name} (1) linelog : --> Requested access: (1) [linelog] = ok (1) } # vmps = ok Done VMPS (1) vmps { (1) if (!VMPS-Mac) (1) if (!VMPS-Mac) -> FALSE (1) update reply { (1) VMPS-Packet-Type = VMPS-Join-Response (1) EXPAND %{VMPS-Mac} (1) --> f0:45:75:08:97:7f (1) VMPS-Cookie = f0:45:75:08:97:7f (1) VMPS-VLAN-Name = 'default' (1) EXPAND %{User-Name} (1) --> (1) SQL-User-Name set to '' rlm_sql (sql): Reserved connection (4) rlm_sql (sql): Executing query: 'SELECT vlan FROM mac2vlan WHERE mac='f0:45:75:08:97:7f'' (1) SQL query returned no results rlm_sql (sql): Released connection (4) (1) EXPAND %{sql:SELECT vlan FROM mac2vlan WHERE mac='%{VMPS-Mac}'} (1) --> (1) VMPS-VLAN-Name = "" (1) } # update reply = noop (1) if (VMPS-Packet-Type == VMPS-Reconfirm-Request) (1) if (VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (1) linelog : EXPAND messages.%{%{Packet-Type}:-default} (1) linelog : --> messages.Access-Request (1) linelog : EXPAND /var/log/radius/linelog (1) linelog : --> /var/log/radius/linelog (1) linelog : EXPAND Requested access: %{User-Name} (1) linelog : --> Requested access: (1) [linelog] = ok (1) } # vmps = ok (1) Sending Access-Accept packet to host 192.168.30.11 port 53489, id=145, length=0 (1) VMPS-Packet-Type = VMPS-Join-Response (1) VMPS-Cookie = f0:45:75:08:97:7f (1) VMPS-VLAN-Name = 'default' VMPS-VLAN-Name = 'default' VMPS-Cookie = f0:45:75:08:97:7f (1) Finished request Waking up in 0.3 seconds. Waking up in 4.6 seconds. (1) Cleaning up request packet ID 145 with timestamp +187 Ready to process requests VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 161 VMPS-Client-IP-Address = 192.168.30.11 VMPS-Port-Name = 'Fa0/19' VMPS-VLAN-Name = '--NONE--' VMPS-Domain-Name = 'seccom.ab.ca' VMPS-Unknown = 0x00 VMPS-MAC = 20:4c:75:08:97:7f (2) Received Access-Request packet from host 192.168.30.11 port 53489, id=161, length=81 (2) VMPS-Packet-Type = VMPS-Join-Request (2) VMPS-Error-Code = VMPS-No-Error (2) VMPS-Sequence-Number = 161 (2) VMPS-Client-IP-Address = 192.168.30.11 (2) VMPS-Port-Name = 'Fa0/19' (2) VMPS-VLAN-Name = '--NONE--' (2) VMPS-Domain-Name = 'seccom.ab.ca' (2) VMPS-Unknown = 0x00 (2) VMPS-MAC = 20:4c:75:08:97:7f Doing VMPS (2) vmps { (2) if (!VMPS-Mac) (2) if (!VMPS-Mac) -> FALSE (2) update reply { (2) VMPS-Packet-Type = VMPS-Join-Response (2) EXPAND %{VMPS-Mac} (2) --> 20:4c:75:08:97:7f (2) VMPS-Cookie = 20:4c:75:08:97:7f (2) VMPS-VLAN-Name = 'default' (2) EXPAND %{User-Name} (2) --> (2) SQL-User-Name set to '' rlm_sql (sql): Reserved connection (4) rlm_sql (sql): Executing query: 'SELECT vlan FROM mac2vlan WHERE mac='20:4c:75:08:97:7f'' (2) SQL query returned no results rlm_sql (sql): Released connection (4) rlm_sql (sql): 0 of 1 connections in use. Need more spares rlm_sql (sql): Opening additional connection (5) rlm_sql_mysql: Starting connect to MySQL server (2) EXPAND %{sql:SELECT vlan FROM mac2vlan WHERE mac='%{VMPS-Mac}'} (2) --> (2) VMPS-VLAN-Name = "" (2) } # update reply = noop (2) if (VMPS-Packet-Type == VMPS-Reconfirm-Request) (2) if (VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (2) linelog : EXPAND messages.%{%{Packet-Type}:-default} (2) linelog : --> messages.Access-Request (2) linelog : EXPAND /var/log/radius/linelog (2) linelog : --> /var/log/radius/linelog (2) linelog : EXPAND Requested access: %{User-Name} (2) linelog : --> Requested access: (2) [linelog] = ok (2) } # vmps = ok Done VMPS (2) vmps { (2) if (!VMPS-Mac) (2) if (!VMPS-Mac) -> FALSE (2) update reply { (2) VMPS-Packet-Type = VMPS-Join-Response (2) EXPAND %{VMPS-Mac} (2) --> 20:4c:75:08:97:7f (2) VMPS-Cookie = 20:4c:75:08:97:7f (2) VMPS-VLAN-Name = 'default' (2) EXPAND %{User-Name} (2) --> (2) SQL-User-Name set to '' rlm_sql (sql): Reserved connection (5) rlm_sql (sql): Executing query: 'SELECT vlan FROM mac2vlan WHERE mac='20:4c:75:08:97:7f'' (2) SQL query returned no results rlm_sql (sql): Released connection (5) (2) EXPAND %{sql:SELECT vlan FROM mac2vlan WHERE mac='%{VMPS-Mac}'} (2) --> (2) VMPS-VLAN-Name = "" (2) } # update reply = noop (2) if (VMPS-Packet-Type == VMPS-Reconfirm-Request) (2) if (VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (2) linelog : EXPAND messages.%{%{Packet-Type}:-default} (2) linelog : --> messages.Access-Request (2) linelog : EXPAND /var/log/radius/linelog (2) linelog : --> /var/log/radius/linelog (2) linelog : EXPAND Requested access: %{User-Name} (2) linelog : --> Requested access: (2) [linelog] = ok (2) } # vmps = ok (2) Sending Access-Accept packet to host 192.168.30.11 port 53489, id=161, length=0 (2) VMPS-Packet-Type = VMPS-Join-Response (2) VMPS-Cookie = 20:4c:75:08:97:7f (2) VMPS-VLAN-Name = 'default' VMPS-VLAN-Name = 'default' VMPS-Cookie = 20:4c:75:08:97:7f (2) Finished request Waking up in 0.3 seconds. Waking up in 4.6 seconds. (2) Cleaning up request packet ID 161 with timestamp +195 Ready to process requests VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 177 VMPS-Client-IP-Address = 192.168.30.11 VMPS-Port-Name = 'Fa0/25' VMPS-VLAN-Name = '--NONE--' VMPS-Domain-Name = 'seccom.ab.ca' VMPS-Unknown = 0x00 VMPS-MAC = 70:0f:72:08:97:7f (3) Received Access-Request packet from host 192.168.30.11 port 53489, id=177, length=81 (3) VMPS-Packet-Type = VMPS-Join-Request (3) VMPS-Error-Code = VMPS-No-Error (3) VMPS-Sequence-Number = 177 (3) VMPS-Client-IP-Address = 192.168.30.11 (3) VMPS-Port-Name = 'Fa0/25' (3) VMPS-VLAN-Name = '--NONE--' (3) VMPS-Domain-Name = 'seccom.ab.ca' (3) VMPS-Unknown = 0x00 (3) VMPS-MAC = 70:0f:72:08:97:7f Doing VMPS (3) vmps { (3) if (!VMPS-Mac) (3) if (!VMPS-Mac) -> FALSE (3) update reply { (3) VMPS-Packet-Type = VMPS-Join-Response (3) EXPAND %{VMPS-Mac} (3) --> 70:0f:72:08:97:7f (3) VMPS-Cookie = 70:0f:72:08:97:7f (3) VMPS-VLAN-Name = 'default' (3) EXPAND %{User-Name} (3) --> (3) SQL-User-Name set to '' rlm_sql (sql): Reserved connection (5) rlm_sql (sql): Executing query: 'SELECT vlan FROM mac2vlan WHERE mac='70:0f:72:08:97:7f'' (3) SQL query returned no results rlm_sql (sql): Released connection (5) rlm_sql (sql): 0 of 2 connections in use. Need more spares rlm_sql (sql): Opening additional connection (6) rlm_sql_mysql: Starting connect to MySQL server (3) EXPAND %{sql:SELECT vlan FROM mac2vlan WHERE mac='%{VMPS-Mac}'} (3) --> (3) VMPS-VLAN-Name = "" (3) } # update reply = noop (3) if (VMPS-Packet-Type == VMPS-Reconfirm-Request) (3) if (VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (3) linelog : EXPAND messages.%{%{Packet-Type}:-default} (3) linelog : --> messages.Access-Request (3) linelog : EXPAND /var/log/radius/linelog (3) linelog : --> /var/log/radius/linelog (3) linelog : EXPAND Requested access: %{User-Name} (3) linelog : --> Requested access: (3) [linelog] = ok (3) } # vmps = ok Done VMPS (3) vmps { (3) if (!VMPS-Mac) (3) if (!VMPS-Mac) -> FALSE (3) update reply { (3) VMPS-Packet-Type = VMPS-Join-Response (3) EXPAND %{VMPS-Mac} (3) --> 70:0f:72:08:97:7f (3) VMPS-Cookie = 70:0f:72:08:97:7f (3) VMPS-VLAN-Name = 'default' (3) EXPAND %{User-Name} (3) --> (3) SQL-User-Name set to '' rlm_sql (sql): Reserved connection (6) rlm_sql (sql): Executing query: 'SELECT vlan FROM mac2vlan WHERE mac='70:0f:72:08:97:7f'' (3) SQL query returned no results rlm_sql (sql): Released connection (6) (3) EXPAND %{sql:SELECT vlan FROM mac2vlan WHERE mac='%{VMPS-Mac}'} (3) --> (3) VMPS-VLAN-Name = "" (3) } # update reply = noop (3) if (VMPS-Packet-Type == VMPS-Reconfirm-Request) (3) if (VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (3) linelog : EXPAND messages.%{%{Packet-Type}:-default} (3) linelog : --> messages.Access-Request (3) linelog : EXPAND /var/log/radius/linelog (3) linelog : --> /var/log/radius/linelog (3) linelog : EXPAND Requested access: %{User-Name} (3) linelog : --> Requested access: (3) [linelog] = ok (3) } # vmps = ok (3) Sending Access-Accept packet to host 192.168.30.11 port 53489, id=177, length=0 (3) VMPS-Packet-Type = VMPS-Join-Response (3) VMPS-Cookie = 70:0f:72:08:97:7f (3) VMPS-VLAN-Name = 'default' VMPS-VLAN-Name = 'default' VMPS-Cookie = 70:0f:72:08:97:7f (3) Finished request Waking up in 0.3 seconds. Waking up in 4.6 seconds. (3) Cleaning up request packet ID 177 with timestamp +203 Ready to process requests On Jan 14, 2015, at 8:58 PM, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On 15 Jan 2015, at 10:47, Keith Olsen <keith.r.olsen@gmail.com> wrote:
I just stood up Freeradius 3.0.4 on a Fedora system, and I have an older (2.1.12) one running on Ubuntu (doubt the OS makes any difference….)
On the 3x system, I am using mysql to provide the mac to vlan information, while on the 2x system it’s the mac2vlan flat file.
Yeah, likely a parse issue. I don't think anyone's tested VMPS with v3.0.x, and we certainly have no internal tests.
PCAP would be useful so it can be replayed against the server locally.
-Arran
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 15 Jan 2015, at 12:39, Keith Olsen <keith.r.olsen@gmail.com> wrote:
HI Arran,
I had a quick look in the pcap in wireshark but could not see any obvious issues, I was looking for the erroneous mac addresses, but could not see where the parsing is going wrong. The correct mac (00:25:bc:e1:5b:4a) is there.
I have attached the pcap and here is the output from radius -X for the transactions,
Could you send over the PCAP. I didn't write the decoder, and have no idea what the contents of a VMPS packet look like :) -Arran
On Jan 14, 2015, at 10:47 PM, Keith Olsen <keith.r.olsen@gmail.com> wrote:
I just stood up Freeradius 3.0.4 on a Fedora system, and I have an older (2.1.12) one running on Ubuntu (doubt the OS makes any difference….) ... In the 3x version, this is what I get
Garbage.
I’m assuming that somehow the 3.0.4 system is parsing the packet incorrectly, and thus coming up with the wrong information for the MAC.
Yes.
Any idea on what I can do to resolve?
Grab the v3.0.x branch from git. I’ve pushed a fix. Sorry for the delay, it’s taken a while to get a working VMPS client going. Alan DeKok.
participants (5)
-
Alan DeKok -
Arran Cudbard-Bell -
Ben Gatewood -
Keith Olsen -
Stefan Paetow