Nas-Ip-Address attribute and source IP address of UDP datagram.
Hello! I deal with bad "hand-made" NAS, which doesn't include "Nas-Ip-Address" attribute into the packet. So I can't distinguish packets from different NAS'es. Is there a way to add this attribute (with value of source address of UDP datagram) using standard FreeRadius facilities? We don't use proxies, so this solution seems to be correct. I'm writing my own rlm and I can implement desired functionality if there is no one in FreeRadius. The problem lies in that I can't find the address of client in REQUEST (i.e. auth_req) structure. Comments in "site-enabled/default" say that preprocess module should add "Client-IP-Address" attribute. I printed request->packet->vps, but did't find this attribute in the list. Is source IP address reachable via REQUEST structure passed to authorize callback? -- Sincerely yours, Dmitry V. Krivenok Orange System Co., Ltd. Saint-Petersburg, Russia work phone: +7 812 332-32-40 cellular phone: +7 921 576-70-91 e-mail: krivenok@orangesystem.ru web: http://www.orangesystem.ru skype: krivenok_dmitry jabber: krivenok_dmitry@jabber.ru icq: 242-526-443
I deal with bad "hand-made" NAS, which doesn't include "Nas-Ip-Address" attribute into the packet. So I can't distinguish packets from different NAS'es.
Is there a way to add this attribute (with value of source address of UDP datagram) using standard FreeRadius facilities?
Packet-Src-IP-Address already exists. Ivan Kalik Kalik Informatika ISP
Dmitry V. Krivenok wrote:
I deal with bad "hand-made" NAS, which doesn't include "Nas-Ip-Address" attribute into the packet. So I can't distinguish packets from different NAS'es.
Look at Packet-Src-IP-Address. It is a "virtual" attribute that you can use in dynamic expansions.
Is there a way to add this attribute (with value of source address of UDP datagram) using standard FreeRadius facilities? We don't use proxies, so this solution seems to be correct.
if (!NAS-IP-Address) { update request { NAS-IP-Address = "%{Packet-Src-IP-Address}" } }
I'm writing my own rlm and I can implement desired functionality if there is no one in FreeRadius. The problem lies in that I can't find the address of client in REQUEST (i.e. auth_req) structure.
request->packet->src_ipaddr. Alan Dekok.
Alan DeKok wrote:
Dmitry V. Krivenok wrote:
I deal with bad "hand-made" NAS, which doesn't include "Nas-Ip-Address" attribute into the packet. So I can't distinguish packets from different NAS'es.
Look at Packet-Src-IP-Address. It is a "virtual" attribute that you can use in dynamic expansions.
Is there a way to add this attribute (with value of source address of UDP datagram) using standard FreeRadius facilities? We don't use proxies, so this solution seems to be correct.
if (!NAS-IP-Address) { update request { NAS-IP-Address = "%{Packet-Src-IP-Address}" } }
It looks cool. Where can I use this code? In authorize section?
I'm writing my own rlm and I can implement desired functionality if there is no one in FreeRadius. The problem lies in that I can't find the address of client in REQUEST (i.e. auth_req) structure.
request->packet->src_ipaddr.
request->client->ipaddr seems to be what I need. I tested via the following command: DEBUG("rlm_osb: Source IP address %s.", inet_ntoa(request->client->ipaddr.ipaddr.ip4addr)); Is it correct to use request->client->ipaddr instead of request->packet->src_ipaddr?
Alan Dekok.
-- Sincerely yours, Dmitry V. Krivenok Orange System Co., Ltd. Saint-Petersburg, Russia work phone: +7 812 332-32-40 cellular phone: +7 921 576-70-91 e-mail: krivenok@orangesystem.ru web: http://www.orangesystem.ru skype: krivenok_dmitry jabber: krivenok_dmitry@jabber.ru icq: 242-526-443
Dmitry V. Krivenok wrote:
It looks cool. Where can I use this code? In authorize section?
Anywhere.
request->client->ipaddr seems to be what I need.
It may *not* be the same as request->packet->src_ipaddr. The client IP address may be a netmask, and not a /32.
I tested via the following command: DEBUG("rlm_osb: Source IP address %s.", inet_ntoa(request->client->ipaddr.ipaddr.ip4addr));
Is it correct to use request->client->ipaddr instead of request->packet->src_ipaddr?
No. There's a *reason* I said use request->packet->src_ipaddr. I'm curious why you went looking for something else, rather than just use what I told you. Alan DeKok.
participants (3)
-
Alan DeKok -
Dmitry V. Krivenok -
tnt＠kalik.net