Hello everyone, I am trying to do a more complicated query for a custom session time counter, but I am running into problems. Can someone please answer the following questions? Problem: When I have the attribute Session-Timeout in the radcheck table, I get a Segmentation Fault after the query as run, no matter if it returns results or not. a) I've noticed that freeradius performs Accounting-Request when this attribute is set, is this normal? b) Is there a limit to the sql query length? c) Is there a limit to the field name, i.e., should I use "SELECT This_is_a_very_long_field_name_having_ifs_nulls_etc AS ShortFieldName" or is it irrelevant? d) The particular query performs a join to another table, may this be the source of the problem? e) Is it mandatory that a query returns results? f) Can I use multiple 'query' in radius.conf, using the values from a first query to feed the next one? Thank you !!
Spam Eater wrote:
Problem: When I have the attribute Session-Timeout in the radcheck table, I get a Segmentation Fault after the query as run, no matter if it returns results or not.
doc/bugs
a) I've noticed that freeradius performs Accounting-Request when this attribute is set, is this normal?
I have no idea what you mean by that. FreeRADIUS doesn't magically create Accounting-Requests if it sees a Session-Timeout.
b) Is there a limit to the sql query length?
In 1.1.x, yes. About 253 octets in many cases. If the queries are in the configuration (e.g. rlm_sql_ippool), then the queries can be very long. In 2.0, the queries in "unlang" can be about 7k in length.
c) Is there a limit to the field name, i.e., should I use "SELECT This_is_a_very_long_field_name_having_ifs_nulls_etc AS ShortFieldName" or is it irrelevant?
There is no limit to field names imposed by FreeRADIUS.
d) The particular query performs a join to another table, may this be the source of the problem?
Maybe, if you're using MySQL and an old version of the server. See doc/ChangeLog in 1.1.7.
e) Is it mandatory that a query returns results?
Yes.
f) Can I use multiple 'query' in radius.conf, using the values from a first query to feed the next one?
Yes, so long as the output from a query goes into a RADIUS attribute. Alan DeKok.
Hello Alan, Thank you so much for your quick response! Please check my comments inline below:
Problem: When I have the attribute Session-Timeout in the radcheck table, I get a Segmentation Fault after the query as run, no matter if it returns results or not. doc/bugs
a) I've noticed that freeradius performs Accounting-Request when this attribute is set, is this normal?
I have no idea what you mean by that. FreeRADIUS doesn't magically create Accounting-Requests if it sees a Session-Timeout.
I think I've might misinterpreted a log. I've just tried to duplicate this behaviour without success, now I see only Access-Request packets. If this happens again, I'll try to be more informative.
b) Is there a limit to the sql query length?
In 1.1.x, yes. About 253 octets in many cases. If the queries are in the configuration (e.g. rlm_sql_ippool), then the queries can be very long.
Ok, this is certainly a problem for me. I can't change freeradius version (at least not now, maybe in the future) so I assume the only option is to 'exec' external scripts to perform more complex queries, am I right?
In 2.0, the queries in "unlang" can be about 7k in length.
c) Is there a limit to the field name, i.e., should I use "SELECT This_is_a_very_long_field_name_having_ifs_nulls_etc AS ShortFieldName" or is it irrelevant?
There is no limit to field names imposed by FreeRADIUS.
d) The particular query performs a join to another table, may this be the source of the problem?
Maybe, if you're using MySQL and an old version of the server. See doc/ChangeLog in 1.1.7.
e) Is it mandatory that a query returns results?
Yes.
f) Can I use multiple 'query' in radius.conf, using the values from a first query to feed the next one?
Yes, so long as the output from a query goes into a RADIUS attribute.
Can you please elaborate, Alan, maybe with a small example or pointer to documentation? Thank you for your time! :-)
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
b) Is there a limit to the sql query length?
In 1.1.x, yes. About 253 octets in many cases. If the queries are in the configuration (e.g. rlm_sql_ippool), then the queries can be very long.
Ok, this is certainly a problem for me. I can't change freeradius version (at least not now, maybe in the future) so I assume the only option is to 'exec' external scripts to perform more complex queries, am I right?
Or use a SQL stored proceedure. -- Peter Nixon http://peternixon.net/
Is there a way to open two ports (1645 and 1812) for auth at the same time? We want to find a way to open 1645, 1812, 1646, and 1813 for auth and acct in parallel. Thanks, Kevin --------------------------------- Never miss a thing. Make Yahoo your homepage.
Kevin J wrote:
Is there a way to open two ports (1645 and 1812) for auth at the same time? We want to find a way to open 1645, 1812, 1646, and 1813 for auth and acct in parallel.
See the "listen" directive in radiusd.conf. This is documented. Alan DeKok.
Spam Eater wrote:
Ok, this is certainly a problem for me. I can't change freeradius version (at least not now, maybe in the future) so I assume the only option is to 'exec' external scripts to perform more complex queries, am I right?
It's an option, but not the only one. You can use Perl or Python, too.
> f) Can I use multiple 'query' in radius.conf, using the values from a > first query to feed the next one?
Yes, so long as the output from a query goes into a RADIUS attribute.
Can you please elaborate, Alan, maybe with a small example or pointer to documentation?
There are no variables in the server, so you cannot put values from one query into another. There ARE radius attributes. You can put values from one query into a radius attribute, and use that attribute in another query. This is much, much, easier in 2.0. See "man unlang". Alan DeKok.
Ok, this is certainly a problem for me. I can't change freeradius version (at least not now, maybe in the future) so I assume the only option is to 'exec' external scripts to perform more complex queries, am I right? It's an option, but not the only one. You can use Perl or Python, too.
Sorry if this seems studpid, but, do you mean that I can embed Perl in radiusd.conf?
> f) Can I use multiple 'query' in radius.conf, using the values
from a
> first query to feed the next one?
Yes, so long as the output from a query goes into a RADIUS
attribute.
Can you please elaborate, Alan, maybe with a small example or pointer to documentation?
There are no variables in the server, so you cannot put values from one query into another. There ARE radius attributes. You can put values from one query into a radius attribute, and use that attribute in another query.
How do I set one radius attribute with a value from a query? I think I really need an example here :-/
This is much, much, easier in 2.0. See "man unlang".
Thanks for the tip, I'll try to force into the upgrade asap. Cheers!
Hi,
option is to 'exec' external scripts to perform more complex queries, am I right? It's an option, but not the only one. You can use Perl or Python, too.
Sorry if this seems studpid, but, do you mean that I can embed Perl in radiusd.conf?
no - you can call PERL from pre-auth, auth, post-auth, accounting etc at which point the chosen script defined in the PERL section of experimental.conf will be run and the subroutine associated with the call will be run - at which point you can inspect any RADIUS attribute, make a decision and return updated attributes, ok, reject and so on. alan
participants (5)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Kevin J -
Peter Nixon -
Spam Eater