refresh variable after exec module
Good morning, I back with the same problem. I've seeing past post for last week but I have any wrong because those solutions don't work for me. I have a script in exec module which set 2 values: Session-Timeout if everything is correct for each user and it calculate his remaining time to connect, and Reply-Message if there is any problem, to show this message to the user I've seen these values are cached before when mysql runs the queries to radcheck, radgroupchek, radreply, etc...in authtorize section and when I execute my script in post-auth module the new values aren't replaced and sent together with Access-Accept or Access-Reject I've done an update in post-auth section, like you said in last posts, in two different modes: first example: Post-Auth-Type REJECT { attr_filter.access_reject update outer.reply { Reply-Message := "%{reply:Reply-Message}" } sql reply_log } Second example: Post-Auth-Type REJECT { attr_filter.access_reject update outer.reply { Reply-Message := "pepe" } sql reply_log } I've set Reply-Message := "pepe" to try without a variable but unsuccessfully because I'm not sure if I've set the variable correctly but if I put the value of variable and this is not send neither it is because my value is not replaced by the before one, ok? why? Post-Auth section post-auth { # Get an address from the IP Pool. # main_pool # # If you want to have a log of authentication replies, # un-comment the following line, and the 'detail reply_log' # section, above. reply_log # # After authenticating the user, do another SQL query. # # See "Authentication Logging Queries" in sql.conf sql # # Instead of sending the query to the SQL server, # write it into a log file. # sql_log # # Un-comment the following if you have set # 'edir_account_policy_check = yes' in the ldap module sub-section of # the 'modules' section. # # ldap exec update outer.reply { Session-Timeout:="%{reply:Session-Timeout}" } # # Access-Reject packets are sent through the REJECT sub-section of the # post-auth section. # # Add the ldap module name (or instance) if you have set # 'edir_account_policy_check = yes' in the ldap module configuration # Post-Auth-Type REJECT { attr_filter.access_reject update outer.reply { Reply-Message := "pepe" } sql reply_log } } I try with "update reply" too. I don't understand the different between both modes. Can you say me where I can read the neccesary doc to find this difference? thanks in advance and I'm sorry to repeat this issue again
Ok, I'm back with another cuestion. now, if I put the variable in this way, I send the Reply-Message (pepe) with Access-Reject connections update reply { Reply-Message := "pepe" } Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> Copazo24@prueba.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated ++[reply] returns updated Sending Access-Reject of id 46 to 192.168.1.10 port 32925 Reply-Message = "pepe" but if I wanna update it with a variable that I got from external script and I put this: update reply { Reply-Message := "%{reply:Reply-Message}" +- entering group post-auth {...} [exec] expand: %{User-Name} -> Copazo24@prueba.com [exec] expand: %{Reply-Message} -> Exec-Program output: VALOR 1(Username) ES Copazo24@prueba.com El usuario ya esta cnectado El usuario ya esta conectado Exec-Program-Wait: plaintext: VALOR 1(Username) ES Copazo24@prueba.com El usuario ya esta cnectado El usuario ya esta conectado Exec-Program: returned: 255 ++[exec] returns fail Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> Copazo24@prueba.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated expand: %{reply:Reply-Message} -> NULL ++[reply] returns updated Is it correct this way? Reply-Message := "%{reply:Reply-Message}" thanks bLn escribió:
Good morning,
I back with the same problem.
I've seeing past post for last week but I have any wrong because those solutions don't work for me.
I have a script in exec module which set 2 values: Session-Timeout if everything is correct for each user and it calculate his remaining time to connect, and Reply-Message if there is any problem, to show this message to the user
I've seen these values are cached before when mysql runs the queries to radcheck, radgroupchek, radreply, etc...in authtorize section and when I execute my script in post-auth module the new values aren't replaced and sent together with Access-Accept or Access-Reject
I've done an update in post-auth section, like you said in last posts, in two different modes:
first example: Post-Auth-Type REJECT { attr_filter.access_reject update outer.reply { Reply-Message := "%{reply:Reply-Message}" } sql reply_log }
Second example:
Post-Auth-Type REJECT { attr_filter.access_reject update outer.reply { Reply-Message := "pepe" } sql reply_log }
I've set Reply-Message := "pepe" to try without a variable but unsuccessfully because I'm not sure if I've set the variable correctly but if I put the value of variable and this is not send neither it is because my value is not replaced by the before one, ok? why?
Post-Auth section
post-auth { # Get an address from the IP Pool. # main_pool # # If you want to have a log of authentication replies, # un-comment the following line, and the 'detail reply_log' # section, above. reply_log # # After authenticating the user, do another SQL query. # # See "Authentication Logging Queries" in sql.conf sql # # Instead of sending the query to the SQL server, # write it into a log file. # sql_log # # Un-comment the following if you have set # 'edir_account_policy_check = yes' in the ldap module sub-section of # the 'modules' section. # # ldap exec update outer.reply { Session-Timeout:="%{reply:Session-Timeout}" } # # Access-Reject packets are sent through the REJECT sub-section of the # post-auth section. # # Add the ldap module name (or instance) if you have set # 'edir_account_policy_check = yes' in the ldap module configuration # Post-Auth-Type REJECT { attr_filter.access_reject update outer.reply { Reply-Message := "pepe" } sql reply_log } }
I try with "update reply" too. I don't understand the different between both modes. Can you say me where I can read the neccesary doc to find this difference?
thanks in advance and I'm sorry to repeat this issue again - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
bLn wrote:
but if I wanna update it with a variable that I got from external script and I put this: update reply { Reply-Message := "%{reply:Reply-Message}"
Uh... that says "set the Reply-Message to the value of the Reply-Message". What do you *really* want to do? What does the script return? Alan DeKok.
Good morning, My script returns 2 possible values: a) If all is correct (ie: an user has time and money to connect) then I set in Session-Timeout with the time available to this user b) If not, then I set Reply-Message with the exactly error. Both of them are in radgroupreply in my database. For that, the value is previously cached in auth section and I can't refresh or update the new value after, in post-auth section Alan DeKok escribió:
bLn wrote:
but if I wanna update it with a variable that I got from external script and I put this: update reply { Reply-Message := "%{reply:Reply-Message}"
Uh... that says "set the Reply-Message to the value of the Reply-Message".
What do you *really* want to do? What does the script return?
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
bLn wrote:
My script returns 2 possible values: a) If all is correct (ie: an user has time and money to connect) then I set in Session-Timeout with the time available to this user b) If not, then I set Reply-Message with the exactly error.
Both of them are in radgroupreply in my database. For that, the value is previously cached in auth section and I can't refresh or update the new value after, in post-auth section
Yes, you can. See the documentation on the operators in "man users", or "man unlang". The ":=" operator is likely what you want. Alan DeKok.
Hi, I've reviewed those manuals (users and unlang) and I think I've got the same way. My script sets into radgroupreply 2 differents values Session-Timeout or Reply-Message, when the script or exec module is finished. Then, in Post-Auth section I do the "update", like this: post-auth{ ..... exec update reply { Session-Timeout:="%{reply:Session-Timeout}" } } Post-Auth-Type REJECT { attr_filter.access_reject update reply { Reply-Message := "%{reply:Reply-Message}" } sql } I've set in all places (op into radgroupreply and those sentences) with ":=" operator mysql> select * from radgroupreply; +----+---------------+---------------------+----+------------+------+ | id | GroupName | Attribute | op | Value | prio | +----+---------------+---------------------+----+------------+------+ | 1 | Navega Gratis | Idle-Timeout | := | 300 | 0 | | 2 | Navega Gratis | Mikrotik-Rate-Limit | := | 128k/512k | 0 | | 4 | Navega12meses | Idle-Timeout | := | 300 | 0 | | 5 | Navega12meses | Mikrotik-Rate-Limit | := | 128k/6M | 0 | | 7 | NavegaMes | Idle-Timeout | := | 300 | 0 | | 8 | NavegaMes | Mikrotik-Rate-Limit | := | 128k/3M | 0 | | 10 | Navega Hoy | Idle-Timeout | := | 300 | 0 | | 11 | Navega Hoy | Mikrotik-Rate-Limit | := | 128k/3M | 0 | | 13 | Navega24horas | Idle-Timeout | := | 300 | 0 | | 14 | Navega24horas | Mikrotik-Rate-Limit | := | 128k/3072k | 0 | | 3 | Navega Gratis | Session-Timeout | := | 1800 | 0 | | 15 | Navega24horas | Session-Timeout | := | 8938 | 0 | | 9 | NavegaMes | Reply-Message | := | NULL | 0 | | 16 | Navega24horas | Reply-Message | := | NULL | 0 | | 12 | Navega Gratis | Reply-Message | := | NULL | 0 | | 17 | Navega12meses | Reply-Message | := | NULL | 0 | | 18 | Navega Hoy | Reply-Message | := | NULL | 0 | +----+---------------+---------------------+----+------------+------+ but the value is the same, the before one I've got a dude.I've proved Reply-Message:="%{reply:Reply-Message}}" but "%{reply:Reply-Message}}" is not the new value in Reply-Message I think, my problem is the new value is being saved into database and it's impossible get it again without a "select" query and I don't know how I can exit the value out the script. I'm trying to salve this value into a variable "Reply-Message" (however into the script is REPLY_MESSAGE). Also I'm playing with the return value of the program run, ie:with exit 1 (reject), exit 2 (fail)...and then I'll do a conditional if with Exit-Program...but unsuccessfully too Alan DeKok escribió:
bLn wrote:
My script returns 2 possible values: a) If all is correct (ie: an user has time and money to connect) then I set in Session-Timeout with the time available to this user b) If not, then I set Reply-Message with the exactly error.
Both of them are in radgroupreply in my database. For that, the value is previously cached in auth section and I can't refresh or update the new value after, in post-auth section
Yes, you can. See the documentation on the operators in "man users", or "man unlang". The ":=" operator is likely what you want.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
My script sets into radgroupreply 2 differents values Session-Timeout or Reply-Message, when the script or exec module is finished. Then, in Post-Auth section I do the "update"
Why? Why are you writing them to the database and then trying to retrieve them? Why don't you assign them to attributes in the script? Ivan Kalik Kalik Informatika ISP
Because I do an update into radgroupreply but now I'm doing a "select" and save the result into a variable, like this: REPLY_MESSAGE="$(mysql -Ns -h$HOST -u$USER -p$PASS -e "SELECT Value FROM radgroupreply WHERE Attribute='Reply-Message' AND GroupName='$GROUP_NAME'" $BD)" Butt this varibale I can't escape the script. I follow the man of "exec echo" where says "Should we escape the envioronment variables?" and I introduce 3 arguments: program = "/usr/local/freeradius/etc/raddb/pre_script.sh %{User-Name} %{Reply-Message} %{Session-Timeout}" but the results keep into the script and I don't know how I could get it out. In the past post, also I said that I'm trying to play with Exit-Program or Exit-Program-Wait. Is it possible? For example, If I put "exit 2" (fail) or "exit 1" (reject), etc. thanks Ivan Kalik escribió:
My script sets into radgroupreply 2 differents values Session-Timeout or Reply-Message, when the script or exec module is finished. Then, in Post-Auth section I do the "update"
Why? Why are you writing them to the database and then trying to retrieve them? Why don't you assign them to attributes in the script?
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
bLn wrote:
Because I do an update into radgroupreply but now I'm doing a "select" and save the result into a variable, like this:
REPLY_MESSAGE="$(mysql -Ns -h$HOST -u$USER -p$PASS -e "SELECT Value FROM radgroupreply WHERE Attribute='Reply-Message' AND GroupName='$GROUP_NAME'" $BD)"
That won't work. The environment variables are NOT passed back to the server when the script exits. The file program scripts/exec-program-wait contains examples of how to pass variables from the script to FreeRADIUS.
but the results keep into the script and I don't know how I could get it out.
The documentation and examples say how to do this. Alan DeKok.
Ok. It's working...thanks a lot!! If I execute my script in wait-program-exec then all it's right and I can get out the variable but if I call an external script in exec module, no. Although I put the same sentence to get my goal...thanks for the lesson...curious :-) Alan DeKok escribió:
bLn wrote:
Because I do an update into radgroupreply but now I'm doing a "select" and save the result into a variable, like this:
REPLY_MESSAGE="$(mysql -Ns -h$HOST -u$USER -p$PASS -e "SELECT Value FROM radgroupreply WHERE Attribute='Reply-Message' AND GroupName='$GROUP_NAME'" $BD)"
That won't work. The environment variables are NOT passed back to the server when the script exits.
The file program scripts/exec-program-wait contains examples of how to pass variables from the script to FreeRADIUS.
but the results keep into the script and I don't know how I could get it out.
The documentation and examples say how to do this.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alan DeKok -
bLn -
Ivan Kalik