RLM_Perl not seeing huntgroup-name
Hi I am working to update our old FreeRADIUS 1.x.x installation to the FreeRADIUS 2.x.x version, purely for maintainability, current platform has been running happily for over 10 years. We use a custom Perl module to perform some logic for some of our products (mainly providing L2TP tunnel selection), during the testing of the newly configured system running FreeRADIUS 2.1.12 (Debian Wheeze package) I have discovered that the Huntgroup-Name attribute doesn't seem to be being passed to the Perl module in the data structures which is required by the module. To confirm this I have added Data::Dumper and dumped the various structures and cannot see it anywhere. The RLM_PERL module is called after preprocess module which returns OK also. Is there something I have missed? Thanks Graeme -- Graeme Hinchliffe Senior Designer - Systems, Zen Internet T: 01706 902000 F: 01706 902005 W: zen.co.uk We have been nominated Which? Best Telecoms Provider. http://www.zen.co.uk/latest-news.aspx?page=11939 This message is private and confidential. If you have received this message in error, please notify us and remove it from your system. Zen Internet Limited may monitor email traffic data to manage billing, to handle customer enquiries and for the prevention and detection of fraud. We may also monitor the content of emails sent to and/or from Zen Internet Limited for the purposes of security, staff training and to monitor quality of service. Zen Internet Limited is registered in England and Wales, Sandbrook Park, Sandbrook Way, Rochdale, OL11 1RY Company No. 03101568 VAT Reg No. 686 0495 01
Huntgroup-Name is an internal attribute, and as such is held in the "control" value pair list. You can access this list in perl through the %RAD_CHECK hash, which is populated by rlm_perl. Check that this hash is declared at the beginning of your perl script. For example: # Bring the global hashes into the package scope our (%RAD_REQUEST, %RAD_REPLY, %RAD_REQUEST_PROXY_REPLY, %RAD_CHECK); # note: %RAD_CONFIG is a synonym for %RAD_CHECK. De : freeradius-users-bounces+nicolas.chaigneau=capgemini.com@lists.freeradius.org [mailto:freeradius-users-bounces+nicolas.chaigneau=capgemini.com@lists.freeradius.org] De la part de Graeme Hinchliffe Envoyé : jeudi 15 mai 2014 15:21 À : freeradius-users@lists.freeradius.org Objet : RLM_Perl not seeing huntgroup-name Hi I am working to update our old FreeRADIUS 1.x.x installation to the FreeRADIUS 2.x.x version, purely for maintainability, current platform has been running happily for over 10 years. We use a custom Perl module to perform some logic for some of our products (mainly providing L2TP tunnel selection), during the testing of the newly configured system running FreeRADIUS 2.1.12 (Debian Wheeze package) I have discovered that the Huntgroup-Name attribute doesn't seem to be being passed to the Perl module in the data structures which is required by the module. To confirm this I have added Data::Dumper and dumped the various structures and cannot see it anywhere. The RLM_PERL module is called after preprocess module which returns OK also. Is there something I have missed? Thanks Graeme -- Graeme Hinchliffe Senior Designer - Systems, Zen Internet T: 01706 902000 F: 01706 902005 W: zen.co.uk We have been nominated Which? Best Telecoms Provider. http://www.zen.co.uk/latest-news.aspx?page=11939 This message is private and confidential. If you have received this message in error, please notify us and remove it from your system. Zen Internet Limited may monitor email traffic data to manage billing, to handle customer enquiries and for the prevention and detection of fraud. We may also monitor the content of emails sent to and/or from Zen Internet Limited for the purposes of security, staff training and to monitor quality of service. Zen Internet Limited is registered in England and Wales, Sandbrook Park, Sandbrook Way, Rochdale, OL11 1RY Company No. 03101568 VAT Reg No. 686 0495 01 This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.
Graeme Hinchliffe wrote:
To confirm this I have added Data::Dumper and dumped the various structures and cannot see it anywhere. The RLM_PERL module is called after preprocess module which returns OK also.
Huntgroup-Name is a virtual attribute. You can compare it to something, but you can't read it's value. Alan DeKok.
Hi In the Perl module we have: if ($RAD_REQUEST{'Huntgroup-Name'} eq 'Valuehere') This code works perfectly in FreeRADIUS 1.1.3 I guess that at some point after 1.1.3 Virtual attributes were no-longer passed to the RLM_PERL module from what you are saying? Which means I am going to need to refactor this code, perhaps test the Huntgroup within the users file and call a different Perl module for case ? Is it possible to specify multiple perl modules or dynamically change the methods used within a single perl module base on AutZ-Type section? Thanks for your help, I can now at least stop banging my head on the desk and hopefully start working on a solution :) Graeme -----Original Message----- From: freeradius-users-bounces+graeme.hinchliffe=zeninternet.co.uk@lists.freeradius.org [mailto:freeradius-users-bounces+graeme.hinchliffe=zeninternet.co.uk@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 15 May 2014 15:16 To: FreeRadius users mailing list Subject: Re: RLM_Perl not seeing huntgroup-name Graeme Hinchliffe wrote:
To confirm this I have added Data::Dumper and dumped the various structures and cannot see it anywhere. The RLM_PERL module is called after preprocess module which returns OK also.
Huntgroup-Name is a virtual attribute. You can compare it to something, but you can't read it's value. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- Graeme Hinchliffe Senior Designer - Systems, Zen Internet T: 01706 902000 F: 01706 902005 W: zen.co.uk We have been nominated Which? Best Telecoms Provider. http://www.zen.co.uk/latest-news.aspx?page=11939 This message is private and confidential. If you have received this message in error, please notify us and remove it from your system. Zen Internet Limited may monitor email traffic data to manage billing, to handle customer enquiries and for the prevention and detection of fraud. We may also monitor the content of emails sent to and/or from Zen Internet Limited for the purposes of security, staff training and to monitor quality of service. Zen Internet Limited is registered in England and Wales, Sandbrook Park, Sandbrook Way, Rochdale, OL11 1RY Company No. 03101568 VAT Reg No. 686 0495 01
Hi I just noticed that in the RAD_CONFIG list that the Autz-Type attribute is visible, I imagine this is also a virtual attribute? Perhaps it would be useful to include the Huntgroup-Name in RAD_CONFIG as well? I think I will try using the Autz-Type as the attribute to check against for now. (Changing it based on the Huntgroup-Name in the users file) Graeme -----Original Message----- From: freeradius-users-bounces+graeme.hinchliffe=zeninternet.co.uk@lists.freeradius.org [mailto:freeradius-users-bounces+graeme.hinchliffe=zeninternet.co.uk@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 15 May 2014 15:16 To: FreeRadius users mailing list Subject: Re: RLM_Perl not seeing huntgroup-name Graeme Hinchliffe wrote:
To confirm this I have added Data::Dumper and dumped the various structures and cannot see it anywhere. The RLM_PERL module is called after preprocess module which returns OK also.
Huntgroup-Name is a virtual attribute. You can compare it to something, but you can't read it's value. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- Graeme Hinchliffe Senior Designer - Systems, Zen Internet T: 01706 902000 F: 01706 902005 W: zen.co.uk We have been nominated Which? Best Telecoms Provider. http://www.zen.co.uk/latest-news.aspx?page=11939 This message is private and confidential. If you have received this message in error, please notify us and remove it from your system. Zen Internet Limited may monitor email traffic data to manage billing, to handle customer enquiries and for the prevention and detection of fraud. We may also monitor the content of emails sent to and/or from Zen Internet Limited for the purposes of security, staff training and to monitor quality of service. Zen Internet Limited is registered in England and Wales, Sandbrook Park, Sandbrook Way, Rochdale, OL11 1RY Company No. 03101568 VAT Reg No. 686 0495 01
Hi I have done some further testing. Fresh install of FreeRADIUS 2.1.12 (Debian package). I have made only minor changes to the config (I added perl after preprocess in Authorization section of the default server, and added a testhuntgroup). I have then added a small perl module which simply dumps the output of the lists passed to the module and exits with a NO-OP. When I test an auth request against this I get the following output from freeradius -X [preprocess] expand: %{Client-IP-Address} -> 127.0.0.1 ++[preprocess] returns ok GOT HERE! REQUEST = $VAR1 = { 'User-Name' => 'testuser@test', 'User-Password' => 'testing', 'Huntgroup-Name' => 'testhunt', 'NAS-IP-Address' => '127.0.0.1' }; CHECK = $VAR1 = {}; REPLY = $VAR1 = {}; CONFIG = $VAR1 = {}; PROXY = $VAR1 = {}; PROXY REP = $VAR1 = {}; rlm_perl: Added pair User-Name = testuser@test rlm_perl: Added pair User-Password = testing rlm_perl: Added pair Huntgroup-Name = testhunt rlm_perl: Added pair NAS-IP-Address = 127.0.0.1 ++[perl] returns noop So in this instance Huntgroup-Name *is* visible within the perl module as it was in FreeRADIUS 1.x.x however something is stopping this from occurring on the test platform with the full config. I am suspecting that for some reason it isn't assigning the Huntgroup to the request, although the test IP address has been assigned one in the huntgroup file, is there a way I could check what, if any hunt group is being selected? Or do you have any ideas of what may suppress the Huntgroup from appearing in the attributes sent to RLM_Perl ? Thanks Graeme -----Original Message----- From: freeradius-users-bounces+graeme.hinchliffe=zeninternet.co.uk@lists.freeradius.org [mailto:freeradius-users-bounces+graeme.hinchliffe=zeninternet.co.uk@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 15 May 2014 15:16 To: FreeRadius users mailing list Subject: Re: RLM_Perl not seeing huntgroup-name Graeme Hinchliffe wrote:
To confirm this I have added Data::Dumper and dumped the various structures and cannot see it anywhere. The RLM_PERL module is called after preprocess module which returns OK also.
Huntgroup-Name is a virtual attribute. You can compare it to something, but you can't read it's value. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- Graeme Hinchliffe Senior Designer - Systems, Zen Internet T: +441706902000 F: +441706902005 W: zen.co.uk We have reduced our Business Talk SIP and SIP Connect call rates by up to 40%. http://www.zen.co.uk/business/voice/sip-trunking.aspx This message is private and confidential. If you have received this message in error, please notify us and remove it from your system. Zen Internet Limited may monitor email traffic data to manage billing, to handle customer enquiries and for the prevention and detection of fraud. We may also monitor the content of emails sent to and/or from Zen Internet Limited for the purposes of security, staff training and to monitor quality of service. Zen Internet Limited is registered in England and Wales, Sandbrook Park, Sandbrook Way, Rochdale, OL11 1RY Company No. 03101568 VAT Reg No. 686 0495 01
I just tried changing the line in the huntgroups file from: Testhunt Client-IP-Address 127.0.0.1 To Testhunt NAS-IP-Address 127.0.0.1 And this seemed to make the huntgroup be selected! However on the vanilla FreeRADIUS install, it is configured with Client-IP-Address of 127.0.0.1 and selecting the huntgroup. I am using radclient -f testuser 127.0.0.1:1645 auth testing123 to send the test packet, On both setups freeradius is seeing the request come from: rad_recv: Access-Request packet from host 127.0.0.1 port 34345, id=153, length=48 User-Name = "testuser" User-Password = "kdsjhfksf" On the non-working config we then get: +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop But on the working (vanilla FreeRADIUS config) +- entering group authorize {...} [preprocess] expand: %{Client-IP-Address} -> 127.0.0.1 ++[preprocess] returns ok I suspect preprocess isn't working correctly on the non-vanilla setup for some reason, I have md5'd both versions of the preprocess configuration file and they are identical, I have also ensured that preprocess appears in the same places within the site configuration. When I change the huntgroup files to use NAS-IP-Address, there is still nothing other than: ++[preprocess] returns ok But the huntgroup appears within RLM_Perl. Any ideas? Thanks Graeme -----Original Message----- From: freeradius-users-bounces+graeme.hinchliffe=zeninternet.co.uk@lists.freeradius.org [mailto:freeradius-users-bounces+graeme.hinchliffe=zeninternet.co.uk@lists.freeradius.org] On Behalf Of Graeme Hinchliffe Sent: 19 May 2014 12:12 To: FreeRadius users mailing list Subject: RE: RLM_Perl not seeing huntgroup-name Hi I have done some further testing. Fresh install of FreeRADIUS 2.1.12 (Debian package). I have made only minor changes to the config (I added perl after preprocess in Authorization section of the default server, and added a testhuntgroup). I have then added a small perl module which simply dumps the output of the lists passed to the module and exits with a NO-OP. When I test an auth request against this I get the following output from freeradius -X [preprocess] expand: %{Client-IP-Address} -> 127.0.0.1 ++[preprocess] returns ok GOT HERE! REQUEST = $VAR1 = { 'User-Name' => 'testuser@test', 'User-Password' => 'testing', 'Huntgroup-Name' => 'testhunt', 'NAS-IP-Address' => '127.0.0.1' }; CHECK = $VAR1 = {}; REPLY = $VAR1 = {}; CONFIG = $VAR1 = {}; PROXY = $VAR1 = {}; PROXY REP = $VAR1 = {}; rlm_perl: Added pair User-Name = testuser@test rlm_perl: Added pair User-Password = testing rlm_perl: Added pair Huntgroup-Name = testhunt rlm_perl: Added pair NAS-IP-Address = 127.0.0.1 ++[perl] returns noop So in this instance Huntgroup-Name *is* visible within the perl module as it was in FreeRADIUS 1.x.x however something is stopping this from occurring on the test platform with the full config. I am suspecting that for some reason it isn't assigning the Huntgroup to the request, although the test IP address has been assigned one in the huntgroup file, is there a way I could check what, if any hunt group is being selected? Or do you have any ideas of what may suppress the Huntgroup from appearing in the attributes sent to RLM_Perl ? Thanks Graeme -----Original Message----- From: freeradius-users-bounces+graeme.hinchliffe=zeninternet.co.uk@lists.freeradius.org [mailto:freeradius-users-bounces+graeme.hinchliffe=zeninternet.co.uk@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 15 May 2014 15:16 To: FreeRadius users mailing list Subject: Re: RLM_Perl not seeing huntgroup-name Graeme Hinchliffe wrote:
To confirm this I have added Data::Dumper and dumped the various structures and cannot see it anywhere. The RLM_PERL module is called after preprocess module which returns OK also.
Huntgroup-Name is a virtual attribute. You can compare it to something, but you can't read it's value. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- Graeme Hinchliffe Senior Designer - Systems, Zen Internet T: +441706902000 F: +441706902005 W: zen.co.uk We have reduced our Business Talk SIP and SIP Connect call rates by up to 40%. http://www.zen.co.uk/business/voice/sip-trunking.aspx This message is private and confidential. If you have received this message in error, please notify us and remove it from your system. Zen Internet Limited may monitor email traffic data to manage billing, to handle customer enquiries and for the prevention and detection of fraud. We may also monitor the content of emails sent to and/or from Zen Internet Limited for the purposes of security, staff training and to monitor quality of service. Zen Internet Limited is registered in England and Wales, Sandbrook Park, Sandbrook Way, Rochdale, OL11 1RY Company No. 03101568 VAT Reg No. 686 0495 01 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi I have had a Eureka moment :) Thought I would post here, maybe of use to someone in future. The issue was that 'expr' had been commented out in the instantiate section, I guess this is needed by preprocess to match. Re-enabling that has resolved my problem Graeme -----Original Message----- From: freeradius-users-bounces+graeme.hinchliffe=zeninternet.co.uk@lists.freeradius.org [mailto:freeradius-users-bounces+graeme.hinchliffe=zeninternet.co.uk@lists.freeradius.org] On Behalf Of Graeme Hinchliffe Sent: 19 May 2014 12:37 To: FreeRadius users mailing list Subject: RE: RLM_Perl not seeing huntgroup-name I just tried changing the line in the huntgroups file from: Testhunt Client-IP-Address 127.0.0.1 To Testhunt NAS-IP-Address 127.0.0.1 And this seemed to make the huntgroup be selected! However on the vanilla FreeRADIUS install, it is configured with Client-IP-Address of 127.0.0.1 and selecting the huntgroup. I am using radclient -f testuser 127.0.0.1:1645 auth testing123 to send the test packet, On both setups freeradius is seeing the request come from: rad_recv: Access-Request packet from host 127.0.0.1 port 34345, id=153, length=48 User-Name = "testuser" User-Password = "kdsjhfksf" On the non-working config we then get: +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop But on the working (vanilla FreeRADIUS config) +- entering group authorize {...} [preprocess] expand: %{Client-IP-Address} -> 127.0.0.1 ++[preprocess] returns ok I suspect preprocess isn't working correctly on the non-vanilla setup for some reason, I have md5'd both versions of the preprocess configuration file and they are identical, I have also ensured that preprocess appears in the same places within the site configuration. When I change the huntgroup files to use NAS-IP-Address, there is still nothing other than: ++[preprocess] returns ok But the huntgroup appears within RLM_Perl. Any ideas? Thanks Graeme -----Original Message----- From: freeradius-users-bounces+graeme.hinchliffe=zeninternet.co.uk@lists.freeradius.org [mailto:freeradius-users-bounces+graeme.hinchliffe=zeninternet.co.uk@lists.freeradius.org] On Behalf Of Graeme Hinchliffe Sent: 19 May 2014 12:12 To: FreeRadius users mailing list Subject: RE: RLM_Perl not seeing huntgroup-name Hi I have done some further testing. Fresh install of FreeRADIUS 2.1.12 (Debian package). I have made only minor changes to the config (I added perl after preprocess in Authorization section of the default server, and added a testhuntgroup). I have then added a small perl module which simply dumps the output of the lists passed to the module and exits with a NO-OP. When I test an auth request against this I get the following output from freeradius -X [preprocess] expand: %{Client-IP-Address} -> 127.0.0.1 ++[preprocess] returns ok GOT HERE! REQUEST = $VAR1 = { 'User-Name' => 'testuser@test', 'User-Password' => 'testing', 'Huntgroup-Name' => 'testhunt', 'NAS-IP-Address' => '127.0.0.1' }; CHECK = $VAR1 = {}; REPLY = $VAR1 = {}; CONFIG = $VAR1 = {}; PROXY = $VAR1 = {}; PROXY REP = $VAR1 = {}; rlm_perl: Added pair User-Name = testuser@test rlm_perl: Added pair User-Password = testing rlm_perl: Added pair Huntgroup-Name = testhunt rlm_perl: Added pair NAS-IP-Address = 127.0.0.1 ++[perl] returns noop So in this instance Huntgroup-Name *is* visible within the perl module as it was in FreeRADIUS 1.x.x however something is stopping this from occurring on the test platform with the full config. I am suspecting that for some reason it isn't assigning the Huntgroup to the request, although the test IP address has been assigned one in the huntgroup file, is there a way I could check what, if any hunt group is being selected? Or do you have any ideas of what may suppress the Huntgroup from appearing in the attributes sent to RLM_Perl ? Thanks Graeme -----Original Message----- From: freeradius-users-bounces+graeme.hinchliffe=zeninternet.co.uk@lists.freeradius.org [mailto:freeradius-users-bounces+graeme.hinchliffe=zeninternet.co.uk@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 15 May 2014 15:16 To: FreeRadius users mailing list Subject: Re: RLM_Perl not seeing huntgroup-name Graeme Hinchliffe wrote:
To confirm this I have added Data::Dumper and dumped the various structures and cannot see it anywhere. The RLM_PERL module is called after preprocess module which returns OK also.
Huntgroup-Name is a virtual attribute. You can compare it to something, but you can't read it's value. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- Graeme Hinchliffe Senior Designer - Systems, Zen Internet T: +441706902000 F: +441706902005 W: zen.co.uk We have reduced our Business Talk SIP and SIP Connect call rates by up to 40%. http://www.zen.co.uk/business/voice/sip-trunking.aspx This message is private and confidential. If you have received this message in error, please notify us and remove it from your system. Zen Internet Limited may monitor email traffic data to manage billing, to handle customer enquiries and for the prevention and detection of fraud. We may also monitor the content of emails sent to and/or from Zen Internet Limited for the purposes of security, staff training and to monitor quality of service. Zen Internet Limited is registered in England and Wales, Sandbrook Park, Sandbrook Way, Rochdale, OL11 1RY Company No. 03101568 VAT Reg No. 686 0495 01 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alan DeKok -
Chaigneau, Nicolas -
Graeme Hinchliffe