upgrade unlang from 2.1.12 to 3.0.14
We have a fairly complex configuration running on an ageing 2.1.12 version of FreeRadius. We are looking to upgrade to latest 3.0.14 for various reasons. I'm having some issues with some of the unlang and would be grateful for some clarification please? We have config similar to: if ( !(Cisco-SSG-Service-Info) && ("%{Tunnel-Type}" != "VLAN") ) { ... } and if ( ("%{Acct-Status-Type}" == "Stop") && ("%{Tunnel-Type}" == "VLAN") && ("%{client:operator}" != "WLC") ) { ... } But are seeing error messages such as: ERROR: Failed retrieving values required to evaluate condition So questions are: 1. Testing presence of an attribute I think is now "if ( &Cisco-SSG-Service-Info )" ? 2. Can I test presence of and value of an attribute of a variable at the same time, i.e. "if (&Cisco-SSG-Service-Info = "fred" )" ? 3. How can I now do "client:operator" ? Thanks Adrian
On Jul 5, 2017, at 3:07 AM, <adrian.p.smith@bt.com> <adrian.p.smith@bt.com> wrote:
We have config similar to:
if ( !(Cisco-SSG-Service-Info) && ("%{Tunnel-Type}" != "VLAN") ) {
First, you don't have to quote everything. Just: ... (Tunnel-Type != VLAN) will work.
and
if ( ("%{Acct-Status-Type}" == "Stop") && ("%{Tunnel-Type}" == "VLAN") && ("%{client:operator}" != "WLC") ) { ...
The same applies here. Attributes and their values don't need to be quoted. Only string expansions.
But are seeing error messages such as:
ERROR: Failed retrieving values required to evaluate condition
Then the attributes being looked at don't exist in the packet
So questions are:
1. Testing presence of an attribute I think is now "if ( &Cisco-SSG-Service-Info )" ?
Yes.
2. Can I test presence of and value of an attribute of a variable at the same time, i.e. "if (&Cisco-SSG-Service-Info = "fred" )" ?
You can do that, but if Cisco-SSG-Service-Info doesn'tt exist, it will result in the above error.
3. How can I now do "client:operator" ?
That still works. Alan DeKok.
3. How can I now do "client:operator" ?
That still works. Alan DeKok. /home/adrian/freeradius-server-3.0.14/etc/raddb/sites-enabled/default[568]: Parse error in condition /home/adrian/freeradius-server-3.0.14/etc/raddb/sites-enabled/default[568]: ... && ( &Tunnel-Type == "VLAN" ) && ( &client:shortname != "WLC") ) { /home/adrian/freeradius-server-3.0.14/etc/raddb/sites-enabled/default[568]: ^ Invalid list qualifier
=On Jul 5, 2017, at 10:28 AM, <adrian.p.smith@bt.com> <adrian.p.smith@bt.com> wrote:
3. How can I now do "client:operator" ?
That still works.
Alan DeKok.
/home/adrian/freeradius-server-3.0.14/etc/raddb/sites-enabled/default[568]: Parse error in condition /home/adrian/freeradius-server-3.0.14/etc/raddb/sites-enabled/default[568]: ... && ( &Tunnel-Type == "VLAN" ) && ( &client:shortname != "WLC") ) { /home/adrian/freeradius-server-3.0.14/etc/raddb/sites-enabled/default[568]: ^ Invalid list qualifier
The client:shortname isn't an attribute. So you can't use &client:shortname. You still need to do "%{client:shortname}" Because it's a string expansion. On a related note, there are a *lot* of people and third-party sites who recommend using "%{Attribute-Name}" to check values in attributes. I have no idea why. Just using the name has worked since 2.0.0, and has been *documented* as working since 2.0.0. Alan DeKok.
I expect it's because a lot of the docs, even official ones, didn't make it clear that you can use the naked name rather than %{} - certainly a lot of the provided config still had older ways of doing things alan On 5 Jul 2017 3:43 pm, "Alan DeKok" <aland@deployingradius.com> wrote:
=On Jul 5, 2017, at 10:28 AM, <adrian.p.smith@bt.com> < adrian.p.smith@bt.com> wrote:
3. How can I now do "client:operator" ?
That still works.
Alan DeKok.
/home/adrian/freeradius-server-3.0.14/etc/raddb/sites-enabled/default[568]:
Parse error in condition
/home/adrian/freeradius-server-3.0.14/etc/raddb/sites-enabled/default[568]: ... && ( &Tunnel-Type == "VLAN" ) && ( &client:shortname != "WLC") ) { /home/adrian/freeradius-server-3.0.14/etc/raddb/sites-enabled/default[568]: ^ Invalid list qualifier
The client:shortname isn't an attribute. So you can't use &client:shortname.
You still need to do "%{client:shortname}" Because it's a string expansion.
On a related note, there are a *lot* of people and third-party sites who recommend using "%{Attribute-Name}" to check values in attributes. I have no idea why. Just using the name has worked since 2.0.0, and has been *documented* as working since 2.0.0.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
I personally use:
if ( &request:Client-Shortname =~ /(.*)_(.*)$/ ) {
update request {
Tmp-String-0 := "%{1}"
Client-Shortname := "%{2}"
}
}
And then I can create my shortnames as "PROD_ServerA" and then know I can
have a single clients.conf with all environments and derive logic from if
it's PROD/DEV etc.
Works for me (TM)
On Thu, Jul 6, 2017 at 4:23 AM, Alan Buxey <alan.buxey@gmail.com> wrote:
> I expect it's because a lot of the docs, even official ones, didn't make it
> clear that you can use the naked name rather than %{} - certainly a lot of
> the provided config still had older ways of doing things
>
> alan
>
> On 5 Jul 2017 3:43 pm, "Alan DeKok" <aland@deployingradius.com> wrote:
>
> > =On Jul 5, 2017, at 10:28 AM, <adrian.p.smith@bt.com> <
> > adrian.p.smith@bt.com> wrote:
> > >
> > >
> > >> 3. How can I now do "client:operator" ?
> > >
> > > That still works.
> > >
> > > Alan DeKok.
> > >
> > > /home/adrian/freeradius-server-3.0.14/etc/raddb/sites-
> enabled/default[568]:
> > Parse error in condition
> > > /home/adrian/freeradius-server-3.0.14/etc/raddb/sites-
> enabled/default[568]:
> > ... && ( &Tunnel-Type == "VLAN" ) && ( &client:shortname != "WLC") ) {
> > > /home/adrian/freeradius-server-3.0.14/etc/raddb/sites-
> enabled/default[568]:
> > ^ Invalid list qualifier
> >
> > The client:shortname isn't an attribute. So you can't use
> > &client:shortname.
> >
> > You still need to do "%{client:shortname}" Because it's a string
> > expansion.
> >
> > On a related note, there are a *lot* of people and third-party sites
> who
> > recommend using "%{Attribute-Name}" to check values in attributes. I
> have
> > no idea why. Just using the name has worked since 2.0.0, and has been
> > *documented* as working since 2.0.0.
> >
> > Alan DeKok.
> >
> >
> > -
> > List info/subscribe/unsubscribe? See http://www.freeradius.org/
> > list/users.html
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/
> list/users.html
>
Thanks for all the input, that has cleared up most of my migration issues.
There is one final one however!
In our old server, for some business logic reasons we artificially create some accounting packets from access requests by writing them into a detail file using the sql_log module to format the request:
Post-Auth = "%t\n\tAcct-Status-Type = Interim-Update\n\tUser-Name = \"%{User-Name}\"\n\tAcct-Session-Id = \"REJECT\"\n\tBTOpenzone-Reject-Message = \"8021xReject:%{reply:Reply-Message}\"\n\tNAS-IP-Address = %{NAS-IP-Address}\n\tFramed-IP-Address = %{Framed-IP-Address}\n\tCalled-Station-Id = %{Called-Station-Id}\n\tCalling-Station-Id = %{Calling-Station-Id}\n\tAcct-Delay-Time = 0\n\tTimestamp = %l\n"
This then gets picked up by another server "listening" to the file.
With the latest code I cannot get either rlm_sql_null or linelog to honour the control characters to allow creation of the pseudo detail file.
Any ideas?
-----Original Message-----
From: Freeradius-Users [mailto:freeradius-users-bounces+adrian.p.smith=bt.com@lists.freeradius.org] On Behalf Of Peter Lambrechtsen
Sent: 05 July 2017 20:07
To: FreeRadius users mailing list
Subject: Re: upgrade unlang from 2.1.12 to 3.0.14
I personally use:
if ( &request:Client-Shortname =~ /(.*)_(.*)$/ ) {
update request {
Tmp-String-0 := "%{1}"
Client-Shortname := "%{2}"
}
}
And then I can create my shortnames as "PROD_ServerA" and then know I can have a single clients.conf with all environments and derive logic from if it's PROD/DEV etc.
Works for me (TM)
On Thu, Jul 6, 2017 at 4:23 AM, Alan Buxey <alan.buxey@gmail.com> wrote:
> I expect it's because a lot of the docs, even official ones, didn't
> make it clear that you can use the naked name rather than %{} -
> certainly a lot of the provided config still had older ways of doing
> things
>
> alan
>
> On 5 Jul 2017 3:43 pm, "Alan DeKok" <aland@deployingradius.com> wrote:
>
> > =On Jul 5, 2017, at 10:28 AM, <adrian.p.smith@bt.com> <
> > adrian.p.smith@bt.com> wrote:
> > >
> > >
> > >> 3. How can I now do "client:operator" ?
> > >
> > > That still works.
> > >
> > > Alan DeKok.
> > >
> > > /home/adrian/freeradius-server-3.0.14/etc/raddb/sites-
> enabled/default[568]:
> > Parse error in condition
> > > /home/adrian/freeradius-server-3.0.14/etc/raddb/sites-
> enabled/default[568]:
> > ... && ( &Tunnel-Type == "VLAN" ) && ( &client:shortname != "WLC") )
> > {
> > > /home/adrian/freeradius-server-3.0.14/etc/raddb/sites-
> enabled/default[568]:
> > ^ Invalid list qualifier
> >
> > The client:shortname isn't an attribute. So you can't use
> > &client:shortname.
> >
> > You still need to do "%{client:shortname}" Because it's a string
> > expansion.
> >
> > On a related note, there are a *lot* of people and third-party
> > sites
> who
> > recommend using "%{Attribute-Name}" to check values in attributes.
> > I
> have
> > no idea why. Just using the name has worked since 2.0.0, and has
> > been
> > *documented* as working since 2.0.0.
> >
> > Alan DeKok.
> >
> >
> > -
> > List info/subscribe/unsubscribe? See http://www.freeradius.org/
> > list/users.html
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/
> list/users.html
>
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Jul 6, 2017, at 4:04 AM, adrian.p.smith@bt.com wrote:
Thanks for all the input, that has cleared up most of my migration issues.
Good to hear.
There is one final one however!
In our old server, for some business logic reasons we artificially create some accounting packets from access requests by writing them into a detail file using the sql_log module to format the request:
Post-Auth = "%t\n\tAcct-Status-Type = Interim-Update\n\tUser-Name = \"%{User-Name}\"\n\tAcct-Session-Id = \"REJECT\"\n\tBTOpenzone-Reject-Message = \"8021xReject:%{reply:Reply-Message}\"\n\tNAS-IP-Address = %{NAS-IP-Address}\n\tFramed-IP-Address = %{Framed-IP-Address}\n\tCalled-Station-Id = %{Called-Station-Id}\n\tCalling-Station-Id = %{Calling-Station-Id}\n\tAcct-Delay-Time = 0\n\tTimestamp = %l\n"
This then gets picked up by another server "listening" to the file.
With the latest code I cannot get either rlm_sql_null or linelog to honour the control characters to allow creation of the pseudo detail file.
Use the real detail module. We've made version 3 be more careful about what it accepts, and what it produces. In this case, you can't fake out a multi-line message with a module designed to produce single-line messages. Alan DeKok.
There is one final one however!
In our old server, for some business logic reasons we artificially create some accounting packets from access requests by writing them into a detail file using the sql_log module to format the request:
Post-Auth = "%t\n\tAcct-Status-Type = Interim-Update\n\tUser-Name = \"%{User-Name}\"\n\tAcct-Session-Id = \"REJECT\"\n\tBTOpenzone-Reject-Message = \"8021xReject:%{reply:Reply-Message}\"\n\tNAS-IP-Address = %{NAS-IP-Address}\n\tFramed-IP-Address = %{Framed-IP-Address}\n\tCalled-Station-Id = %{Called-Station-Id}\n\tCalling-Station-Id = %{Calling-Station-Id}\n\tAcct-Delay-Time = 0\n\tTimestamp = %l\n"
This then gets picked up by another server "listening" to the file.
With the latest code I cannot get either rlm_sql_null or linelog to honour the control characters to allow creation of the pseudo detail file.
Use the real detail module. Using the details module, how can I use an Access-Reject to make an Accounting Request in the way I was doing above?
On Jul 6, 2017, at 7:43 AM, <adrian.p.smith@bt.com> <adrian.p.smith@bt.com> wrote:
Using the details module, how can I use an Access-Reject to make an Accounting Request in the way I was doing above?
Hmm... you can't, so that is an issue. It's why we're redesigning that whole part of the server in v4. Unfortunately, the changes from v2 to v3 were pretty much mandated by security and consistency, so that can't change. If you need performance, it's pretty simple to write a C module to do this work. Just copy the detail module and change it to print the attributes you need, including hard-coded ones. Alan DeKok.
Using the details module, how can I use an Access-Reject to make an Accounting Request in the way I was doing above?
Hmm... you can't, so that is an issue. It's why we're redesigning that whole part of the server in v4.
Unfortunately, the changes from v2 to v3 were pretty much mandated by security and consistency, so that can't change.
If you need performance, it's pretty simple to write a C module to do this work. Just copy the detail module and change it to print the attributes you need, including hard-coded ones.
That's a shame as I was advised to upgrade to get another requirement working, but I cannot do that if I lose previous functionality. Will try and take a look at the module.
You should be able to spew that out with linelog do long as you escape things right otherwise good old perl module ;) alan On 6 Jul 2017 1:26 pm, <adrian.p.smith@bt.com> wrote:
Using the details module, how can I use an Access-Reject to make an Accounting Request in the way I was doing above?
Hmm... you can't, so that is an issue. It's why we're redesigning that whole part of the server in v4.
Unfortunately, the changes from v2 to v3 were pretty much mandated by security and consistency, so that can't change.
If you need performance, it's pretty simple to write a C module to do this work. Just copy the detail module and change it to print the attributes you need, including hard-coded ones.
That's a shame as I was advised to upgrade to get another requirement working, but I cannot do that if I lose previous functionality.
Will try and take a look at the module.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
Using the details module, how can I use an Access-Reject to make an Accounting Request in the way I was doing above?
Hmm... you can't, so that is an issue. It's why we're redesigning that whole part of the server in v4.
Unfortunately, the changes from v2 to v3 were pretty much mandated by security and consistency, so that can't change.
If you need performance, it's pretty simple to write a C module to do this work. Just copy the detail module and change it to print the attributes you need, including hard-coded ones.
That's a shame as I was advised to upgrade to get another requirement working, but I cannot do that if I lose previous functionality.
Will try and take a look at the module.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
Does the linelog module support control characters such as "\n\t" ? -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+adrian.p.smith=bt.com@lists.freeradius.org] On Behalf Of Alan Buxey Sent: 06 July 2017 17:28 To: FreeRadius users mailing list Subject: RE: upgrade unlang from 2.1.12 to 3.0.14 You should be able to spew that out with linelog do long as you escape things right otherwise good old perl module ;) alan On 6 Jul 2017 1:26 pm, <adrian.p.smith@bt.com> wrote: - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Jul 7, 2017, at 6:02 AM, adrian.p.smith@bt.com wrote:
Does the linelog module support control characters such as "\n\t" ?
It shouldn't... We're looking at changing this in v4, where data taken from the network is "tainted", but data taken from the config files is "safe". That will avoid security issues with allowing \n inside of User-Name, for example. Alan DeKok.
participants (4)
-
adrian.p.smith＠bt.com -
Alan Buxey -
Alan DeKok -
Peter Lambrechtsen