Just for Info. We are running freeradius-2.2.0. We are unsing 802.1x on Cisco Switches with MAB (Mac Authentication Bypass). In the beginning we used the sql module to put the Clients into their VLAN using MAB. Now we use Certifiacts and the Client info to decide where we put the Port. Because we get no Info if the Client is usind 802.1x or MAB I check with the perl script, if the Calling-Station-Id equals the Stripped-User-Name. After an uptdate in Win7 or using the debugging option in Windows: # netsh ras set tracing * enable/disable # Logs: C:\Windows\tracing # - Explorer_RASTLS.log # - svchost_RASTLS.log The authorization was running fine during a Windows Boot. One moment befor the Logon Prompt is showing, Windows makes a last reauthentication, or link down/up. This session has as Calling-Station-Id an ARRAY. So my script failed, and the Port was set to the MAB VLAN where clients only get Updates or PXE Boot. With Help of the Script from <Ana Gallardo Gómez> I created this script. Feel free to use it: my $Client_REQ_TYPE = ""; my $VLAN = ""; my $CSI = ""; my $req; my @array; if (exists $RAD_REQUEST{'Calling-Station-Id'} && defined $RAD_REQUEST{'Calling-Station-Id'}) { $req=$RAD_REQUEST{'Calling-Station-Id'}; #RAD Request is an array. if (ref($req) eq "ARRAY") { foreach (@{$req}) { #print ("\nCSId: $_"); $CSI=lc($_); push(@array, $_); } } if ($#array ==1 ){ # everyting OK, one Entry ; } elsif ($#array > 1){ syslog('info', "More than one Calling-Station-Id"); print "\n"; print @array; print "\n"; } elsif ($#array == 0){ syslog('info', "No Calling-Station-Id"); print $array[0]; } unless (ref($req)) { #not an Array simply $CSI=lc($req); print ("\nCSId End: $req"); } } our $SessionIdentifier; $CSI =~ s/-//g; my $SUID = lc($RAD_REQUEST{'Stripped-User-Name'}); #syslog('info', "CSI: $CSI"); #syslog('info', "SUID: $SUID"); print "CSI: $CSI\n"; print "SUID: $SUID\n"; print "--------------CallerID VLan---------------\n"; if ( $CSI == $SUID) { $Client_REQ_TYPE = "MAB"; syslog('info', "MAB Request $SUID"); } else { $Client_REQ_TYPE = "dot1x"; syslog('info', "802.1X Authentication $SUID"); } Have Fun Tom
On 08-01-15 10:55, Thomas Zenz wrote:
This session has as Calling-Station-Id an ARRAY. So my script failed, and the Port was set to the MAB VLAN where clients only get Updates or PXE Boot.
According to Section 5.44 of RFC2865, a request should contain at most 1 Calling-Station-Id, so this client doesn't behave like it should.
if ($#array ==1 ){ # everyting OK, one Entry ; } elsif ($#array > 1){ syslog('info', "More than one Calling-Station-Id"); print "\n"; print @array; print "\n"; } elsif ($#array == 0){ syslog('info', "No Calling-Station-Id"); print $array[0]; }
The syntax $#array return the index of the last element of the array, or -1 if the array is empty. So with "$#array == 0" you have exactly one element in @array instead of none, "$#array == 1" means two elements. You probably want to rewrite "$#array" to "scalar(@array)", which returns the number of elements. You could even shortcut it to statements like "if (@array == 0)", which converts the array to a scalar with the size automatically, but I'm not a big fan of that syntax (it heavily relies on perl internals and make it less understandable for readers who know only other programming languages). -- Herwin Weststrate
Thank you Herwin for the improvement of my coding. My perl basics are quite old ;) I agree with you about the readability, that's why I use empty if leaves ;) I changed the code below to the scalar function version. Thank' s to Microsoft, we have to fix their bugs... Thomas -----Ursprüngliche Nachricht----- Von: freeradius-users-bounces+thomas.zenz=oenb.at@lists.freeradius.org [mailto:freeradius-users-bounces+thomas.zenz=oenb.at@lists.freeradius.org] Im Auftrag von Herwin Weststrate Gesendet: Donnerstag, 08. Jänner 2015 14:21 An: FreeRadius users mailing list Betreff: Re: RAD_REQUEST: Calling-Station-Id = ARRAY(0x825a588) On 08-01-15 10:55, Thomas Zenz wrote:
This session has as Calling-Station-Id an ARRAY. So my script failed, and the Port was set to the MAB VLAN where clients only get Updates or PXE Boot.
According to Section 5.44 of RFC2865, a request should contain at most 1 Calling-Station-Id, so this client doesn't behave like it should. if (scalar(@array) == 1 ){ # everyting OK, one Entry ; } elsif (scalar(@array) > 1){ syslog('info', "More than one Calling-Station-Id"); print "\n"; print @array; print "\n"; } elsif (scalar(@array) == 1){ syslog('info', "No Calling-Station-Id"); } The syntax $#array return the index of the last element of the array, or -1 if the array is empty. So with "$#array == 0" you have exactly one element in @array instead of none, "$#array == 1" means two elements. You probably want to rewrite "$#array" to "scalar(@array)", which returns the number of elements. You could even shortcut it to statements like "if (@array == 0)", which converts the array to a scalar with the size automatically, but I'm not a big fan of that syntax (it heavily relies on perl internals and make it less understandable for readers who know only other programming languages). -- Herwin Weststrate - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 08-01-15 15:08, Zenz, Thomas wrote:
if (scalar(@array) == 1 ){ # everyting OK, one Entry ; } ... elsif (scalar(@array) == 1){ syslog('info', "No Calling-Station-Id"); }
You probably meant "elsif (scalar(@array) == 0) {" in that second block. -- Herwin Weststrate
On Thu, Jan 8, 2015 at 9:41 AM, Herwin Weststrate <herwin@quarantainenet.nl> wrote:
On 08-01-15 15:08, Zenz, Thomas wrote:
if (scalar(@array) == 1 ){ # everyting OK, one Entry ; } ... elsif (scalar(@array) == 1){ syslog('info', "No Calling-Station-Id"); }
You probably meant "elsif (scalar(@array) == 0) {" in that second block.
Just a point of Perl idioms... Perl will use the array in scalar context because of the scalar comparison. No need to force the context: if (@array == 1) { } elsif (@array == 0) { } -m
participants (4)
-
Herwin Weststrate -
Matt Zagrabelny -
Thomas Zenz -
Zenz, Thomas