Response-Packet-Type == Access-Challenge
Hi, I have no luck with testing the Reponse-Packet-Type in the post-proxy section, after "rad_recv: Access-Challenge packet..." Something like : post-proxy { ... if (Response-Packet-Type == Access-Challenge) { ... } ... } What am I doing wrong? Dominique
On 6 Aug 2013, at 12:35, Dominique Frise <dominique.frise@unil.ch> wrote:
Hi,
I have no luck with testing the Reponse-Packet-Type in the post-proxy section, after "rad_recv: Access-Challenge packet..."
Something like :
post-proxy { ... if (Response-Packet-Type == Access-Challenge) { ... } ... }
What am I doing wrong?
Nothing. That's not officially supported. You may find it works in 2.x.x HEAD though :) Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
On 08/06/2013 01:55 PM, Arran Cudbard-Bell wrote:
On 6 Aug 2013, at 12:35, Dominique Frise <dominique.frise@unil.ch> wrote:
Hi,
I have no luck with testing the Reponse-Packet-Type in the post-proxy section, after "rad_recv: Access-Challenge packet..."
Something like :
post-proxy { ... if (Response-Packet-Type == Access-Challenge) { ... } ... }
What am I doing wrong?
Nothing. That's not officially supported. You may find it works in 2.x.x HEAD though :)
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Thanks Arran, I forgot to mention that I am using freeradius-2.2.0-2.el6.x86_64. Should this version support it or not? Dominique
On 6 Aug 2013, at 13:20, Dominique Frise <dominique.frise@unil.ch> wrote:
On 08/06/2013 01:55 PM, Arran Cudbard-Bell wrote:
On 6 Aug 2013, at 12:35, Dominique Frise <dominique.frise@unil.ch> wrote:
Hi,
I have no luck with testing the Reponse-Packet-Type in the post-proxy section, after "rad_recv: Access-Challenge packet..."
Something like :
post-proxy { ... if (Response-Packet-Type == Access-Challenge) { ... } ... }
What am I doing wrong?
Nothing. That's not officially supported. You may find it works in 2.x.x HEAD though :)
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Thanks Arran,
I forgot to mention that I am using freeradius-2.2.0-2.el6.x86_64. Should this version support it or not?
No. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
On 08/06/2013 03:36 PM, A.L.M.Buxey@lboro.ac.uk wrote:
Hi,
I forgot to mention that I am using freeradius-2.2.0-2.el6.x86_64. Should this version support it or not?
no, it wont support it. you need the latest code from the GIT to use that feature.
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Is there any other flag/function that would indicate that an Access-Challenge packet was received from the NAS? Dominique
Dominique Frise wrote:
Is there any other flag/function that would indicate that an Access-Challenge packet was received from the NAS?
A NAS will NEVER send an Access-Challenge to the server. A proxy will receive an Access-Challenge from a home server. As was said, you need the latest code from the GIT to use that feature. Alan DeKok.
On 08/06/2013 05:29 PM, Alan DeKok wrote:
Dominique Frise wrote:
Is there any other flag/function that would indicate that an Access-Challenge packet was received from the NAS?
A NAS will NEVER send an Access-Challenge to the server.
A proxy will receive an Access-Challenge from a home server. As was said, you need the latest code from the GIT to use that feature.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Yeah, sorry about this mistake. I actually wanted to mean the home server. ;-). I will then compile a fresh code. Thanks for your help, Dominique
On 08/06/2013 05:29 PM, Alan DeKok wrote:
Dominique Frise wrote:
Is there any other flag/function that would indicate that an Access-Challenge packet was received from the NAS?
A NAS will NEVER send an Access-Challenge to the server.
A proxy will receive an Access-Challenge from a home server. As was said, you need the latest code from the GIT to use that feature.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Did a fresh install from http://github.com/FreeRADIUS/freeradius-server/tree/v2.x.x ./radiusd -v radiusd: FreeRADIUS Version 2.2.1 (git #12be9f6), for host x86_64-unknown-linux-gnu, built on Aug 6 2013 at 21:51:33 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. But still no luck :-( --------------------- rad_recv: Access-Challenge packet from host X.X.X.X port 1812, id=101, length=49 Reply-Message = "Enter OTP:" State = 0x38373131 Prompt = No-Echo Proxy-State = 0x313039 # Executing section post-proxy from file /usr/local/etc/raddb/sites-enabled/default +- entering group post-proxy {...} [eap] No pre-existing handler found ++[eap] returns noop ++? if (Response-Packet-Type == Access-Challenge) ? Evaluating (Response-Packet-Type == Access-Challenge) -> FALSE ---------------------- Any other idea? Dominique
On 7 Aug 2013, at 07:51, Dominique Frise <dominique.frise@unil.ch> wrote:
On 08/06/2013 05:29 PM, Alan DeKok wrote:
Dominique Frise wrote:
Is there any other flag/function that would indicate that an Access-Challenge packet was received from the NAS?
A NAS will NEVER send an Access-Challenge to the server.
A proxy will receive an Access-Challenge from a home server. As was said, you need the latest code from the GIT to use that feature.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Did a fresh install from http://github.com/FreeRADIUS/freeradius-server/tree/v2.x.x
./radiusd -v radiusd: FreeRADIUS Version 2.2.1 (git #12be9f6), for host x86_64-unknown-linux-gnu, built on Aug 6 2013 at 21:51:33 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT.
But still no luck :-( --------------------- rad_recv: Access-Challenge packet from host X.X.X.X port 1812, id=101, length=49 Reply-Message = "Enter OTP:" State = 0x38373131 Prompt = No-Echo Proxy-State = 0x313039 # Executing section post-proxy from file /usr/local/etc/raddb/sites-enabled/default +- entering group post-proxy {...} [eap] No pre-existing handler found ++[eap] returns noop ++? if (Response-Packet-Type == Access-Challenge) ? Evaluating (Response-Packet-Type == Access-Challenge) -> FALSE ----------------------
Hmm ok. I thought this was fixed at the same time we allowed modification of Response-Packet-Type. I'll have a look at it. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
On 07.08.2013 08:51, Dominique Frise wrote:
Did a fresh install from http://github.com/FreeRADIUS/freeradius-server/tree/v2.x.x
./radiusd -v radiusd: FreeRADIUS Version 2.2.1 (git #12be9f6), for host x86_64-unknown-linux-gnu, built on Aug 6 2013 at 21:51:33 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT.
But still no luck :-( --------------------- rad_recv: Access-Challenge packet from host X.X.X.X port 1812, id=101, length=49 Reply-Message = "Enter OTP:" State = 0x38373131 Prompt = No-Echo Proxy-State = 0x313039 # Executing section post-proxy from file /usr/local/etc/raddb/sites-enabled/default +- entering group post-proxy {...} [eap] No pre-existing handler found ++[eap] returns noop ++? if (Response-Packet-Type == Access-Challenge) ? Evaluating (Response-Packet-Type == Access-Challenge) -> FALSE ----------------------
I made myself a test with the latest git HEAD (3.0) and indeed, this also doesn't work. I'll have a look at it and see why it doesn't call the paircmp callback. Olivier -- Olivier Beytrison Network & Security Engineer, HES-SO Fribourg Mail: olivier@heliosnet.org
On 7 Aug 2013, at 09:35, Olivier Beytrison <olivier@heliosnet.org> wrote:
On 07.08.2013 08:51, Dominique Frise wrote:
Did a fresh install from http://github.com/FreeRADIUS/freeradius-server/tree/v2.x.x
./radiusd -v radiusd: FreeRADIUS Version 2.2.1 (git #12be9f6), for host x86_64-unknown-linux-gnu, built on Aug 6 2013 at 21:51:33 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT.
But still no luck :-( --------------------- rad_recv: Access-Challenge packet from host X.X.X.X port 1812, id=101, length=49 Reply-Message = "Enter OTP:" State = 0x38373131 Prompt = No-Echo Proxy-State = 0x313039 # Executing section post-proxy from file /usr/local/etc/raddb/sites-enabled/default +- entering group post-proxy {...} [eap] No pre-existing handler found ++[eap] returns noop ++? if (Response-Packet-Type == Access-Challenge) ? Evaluating (Response-Packet-Type == Access-Challenge) -> FALSE ----------------------
I made myself a test with the latest git HEAD (3.0) and indeed, this also doesn't work. I'll have a look at it and see why it doesn't call the paircmp callback.
Because pair comparisons don't work in evaluated conditions currently. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
Hi,
Is there any other flag/function that would indicate that an Access-Challenge packet was received from the NAS?
dont know..I have the following on a 2.2.0 box in the authenticate section: if (handled && (Response-Packet-Type == Access-Challenge)) { attr_filter.access_challenge.post-auth handled # override the "updated" code from attr_filter note the (Response-Packet-Type == Access-Challenge) bit. what does your debug show you? alan
On 6 Aug 2013, at 16:38, A.L.M.Buxey@lboro.ac.uk wrote:
Hi,
Is there any other flag/function that would indicate that an Access-Challenge packet was received from the NAS?
dont know..I have the following on a 2.2.0 box in the authenticate section:
if (handled && (Response-Packet-Type == Access-Challenge)) { attr_filter.access_challenge.post-auth handled # override the "updated" code from attr_filter
Right, but you're not attempting to change this in Post-Proxy which is a different code path, and was not allowed for philosophical reasons before 2.2.x. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
participants (5)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Arran Cudbard-Bell -
Dominique Frise -
Olivier Beytrison