RE: Using Attributes to differentiate between different EAP types
I'm trying the following code, I've tried most every variation ("request:EAP-Type", "request.EAP-Type","EAP-Type","outer.EAP-Type".) but freeradius does not even parse the configuration. I've tried %{} and just the bare variables (which works for "outer.NAS-IP-Address"). if("%{outer.request:EAP-Type}" == 21) { ldap_wireless } And I get the error /etc/freeradius/sites-enabled/inner-tunnel[131]: Parse error in condition at: "%{outer.request:EAP-Type}" == 21) Does anyone know where this information is accessible from? I'm not able to find any data for what's available in the different inner/outer/request structs (or whatever they might be). Thanks, Nathan Van Fleet
I'm trying the following code, I've tried most every variation ("request:EAP-Type", "request.EAP-Type","EAP-Type","outer.EAP-Type".) but freeradius does not even parse the configuration. I've tried %{} and just the bare variables (which works for "outer.NAS-IP-Address").
It's the internal attribute (for local server use), so it should be on the control list (control.EAP-Type). Ivan Kalik Kalik Informatika ISP
if("%{control.EAP-Type}" == 21) if(control.EAP-Type == 21) Still getting a parse error on that one. I'm surprised that it won't even start the service on this, but I suppose it's better anyhow. Nathan Van Fleet Telecommunications Analyst Network Assessment and Integration IITS Concordia University (514) 848-2424 Extension:5434
-----Original Message----- From: freeradius-users- bounces+nmcdavit=alcor.concordia.ca@lists.freeradius.org [mailto:freeradius-users- bounces+nmcdavit=alcor.concordia.ca@lists.freeradius.org] On Behalf Of Ivan Kalik Sent: Tuesday, September 15, 2009 12:13 PM To: FreeRadius users mailing list Subject: RE: Using Attributes to differentiate between different EAP types
I'm trying the following code, I've tried most every variation ("request:EAP-Type", "request.EAP-Type","EAP-Type","outer.EAP-Type".) but freeradius does not even parse the configuration. I've tried %{} and just the bare variables (which works for "outer.NAS-IP-Address").
It's the internal attribute (for local server use), so it should be on the control list (control.EAP-Type).
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Nathan McDavit-Van Fleet wrote:
if("%{control.EAP-Type}" == 21) if(control.EAP-Type == 21)
Still getting a parse error on that one. I'm surprised that it won't even start the service on this, but I suppose it's better anyhow.
Maybe "if ("... i.e. put a space between the "if" and "(". Alan DeKok.
Okay, Probably everone but me knew this but" If(blah == blah2) { Doesn't work. You have to do If(blah == blah2) { So no returns for the first curly bracket or it won't parse out. Sorry, Nathan Van Fleet
-----Original Message----- From: freeradius-users- bounces+nmcdavit=alcor.concordia.ca@lists.freeradius.org [mailto:freeradius-users- bounces+nmcdavit=alcor.concordia.ca@lists.freeradius.org] On Behalf Of Ivan Kalik Sent: Tuesday, September 15, 2009 12:13 PM To: FreeRadius users mailing list Subject: RE: Using Attributes to differentiate between different EAP types
I'm trying the following code, I've tried most every variation ("request:EAP-Type", "request.EAP-Type","EAP-Type","outer.EAP-Type".) but freeradius does not even parse the configuration. I've tried %{} and just the bare variables (which works for "outer.NAS-IP-Address").
It's the internal attribute (for local server use), so it should be on the control list (control.EAP-Type).
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hrmm, Now that it's parsing I find that it doesn't work in terms of actually evaluating the EAP-Type. For if (control.EAP-Type==21) and (outer.control.EAP-Type==21) I always get a false even though I am testing for TTLS (21). Is there some way to just have the value thrown into the debug output so I can see what it is at that moment? Regards, Nathan Van Fleet
-----Original Message----- From: freeradius-users- bounces+nmcdavit=alcor.concordia.ca@lists.freeradius.org [mailto:freeradius-users- bounces+nmcdavit=alcor.concordia.ca@lists.freeradius.org] On Behalf Of Nathan McDavit-Van Fleet Sent: Tuesday, September 15, 2009 1:05 PM To: 'FreeRadius users mailing list' Subject: RE: Using Attributes to differentiate between different EAP types
Okay,
Probably everone but me knew this but" If(blah == blah2) {
Doesn't work.
You have to do
If(blah == blah2) {
So no returns for the first curly bracket or it won't parse out.
Sorry,
Nathan Van Fleet
-----Original Message----- From: freeradius-users- bounces+nmcdavit=alcor.concordia.ca@lists.freeradius.org [mailto:freeradius-users- bounces+nmcdavit=alcor.concordia.ca@lists.freeradius.org] On Behalf Of Ivan Kalik Sent: Tuesday, September 15, 2009 12:13 PM To: FreeRadius users mailing list Subject: RE: Using Attributes to differentiate between different EAP types
I'm trying the following code, I've tried most every variation ("request:EAP-Type", "request.EAP-Type","EAP-Type","outer.EAP-Type".) but freeradius does not even parse the configuration. I've tried %{} and just the bare variables (which works for "outer.NAS-IP-Address").
It's the internal attribute (for local server use), so it should be on the control list (control.EAP-Type).
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 15/09/2009 20:57, Nathan McDavit-Van Fleet wrote:
Hrmm,
Now that it's parsing I find that it doesn't work in terms of actually evaluating the EAP-Type.
For if (control.EAP-Type==21) and (outer.control.EAP-Type==21) I always get a false even though I am testing for TTLS (21).
Erm... What.. if("%{control:EAP-Type}" == '21') if("%{outer.control:EAP-Type}" == '21') The list/attribute separator has always been a colon. Alan did some work to make naked variable expansion work, but I still generally stick to the double quoted curly braces consistency, or munging variables together. Don't worry about mixing types, the server just looks at the attribute type when doing conversions.
Is there some way to just have the value thrown into the debug output so I can see what it is at that moment?
Yes update request { Tmp-String-0 := "%{outer.control:EAP-Type}" } Pretty sure you'll also have to have the 'Proxy as EAP' option set in the outer tunnel to get the inner EAP type... Else just insert a policy at the end of the authorize{} section in the inner tunnel to look at control:Auth-Type... Oh and remember to include cases for Identity-Responses and NAKs else you'll break things in weird and interesting ways :) - -Arran
-----Original Message----- From: freeradius-users- bounces+nmcdavit=alcor.concordia.ca@lists.freeradius.org [mailto:freeradius-users- bounces+nmcdavit=alcor.concordia.ca@lists.freeradius.org] On Behalf Of Nathan McDavit-Van Fleet Sent: Tuesday, September 15, 2009 1:05 PM To: 'FreeRadius users mailing list' Subject: RE: Using Attributes to differentiate between different EAP types
Okay,
Probably everone but me knew this but" If(blah == blah2) {
Doesn't work.
You have to do
If(blah == blah2) {
So no returns for the first curly bracket or it won't parse out.
Sorry,
Nathan Van Fleet
-----Original Message----- From: freeradius-users- bounces+nmcdavit=alcor.concordia.ca@lists.freeradius.org [mailto:freeradius-users- bounces+nmcdavit=alcor.concordia.ca@lists.freeradius.org] On Behalf Of Ivan Kalik Sent: Tuesday, September 15, 2009 12:13 PM To: FreeRadius users mailing list Subject: RE: Using Attributes to differentiate between different EAP types
I'm trying the following code, I've tried most every variation ("request:EAP-Type", "request.EAP-Type","EAP-Type","outer.EAP-Type".) but freeradius does not even parse the configuration. I've tried %{} and just the bare variables (which works for "outer.NAS-IP-Address").
It's the internal attribute (for local server use), so it should be on the control list (control.EAP-Type).
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- -- Arran Cudbard-Bell <A.Cudbard-Bell@sussex.ac.uk>, Systems Administrator (AAA), Infrastructure Services (IT Services), E1-1-08, Engineering 1, University Of Sussex, Brighton, BN1 9QT DDI+FAX: +44 1273 873900 | INT: 3900 GPG: 86FF A285 1AA1 EE40 D228 7C2E 71A9 25BB 1E68 54A2 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAkqv9mIACgkQcaklux5oVKL1RQCaA+QcE47BGJVD/8QbIaRGmguN dpcAn1MC+D/xzXKhfxJUcIjwQewl360d =Kh5N -----END PGP SIGNATURE-----
I'm still not able to navigate through the values that the modules are holding. Are there any other pointers in regards to finding where EAP-Type is nested? I cannot figure out how to even access the EAP module from inside inner-tunnel. Regards, Nathan Van Fleet Telecommunications Analyst Network Assessment and Integration IITS Concordia University (514) 848-2424 Extension:5434
-----Original Message----- From: freeradius-users- bounces+nmcdavit=alcor.concordia.ca@lists.freeradius.org [mailto:freeradius-users- bounces+nmcdavit=alcor.concordia.ca@lists.freeradius.org] On Behalf Of Arran Cudbard-Bell Sent: Tuesday, September 15, 2009 4:18 PM To: FreeRadius users mailing list Subject: Re: Using Attributes to differentiate between different EAP types
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 15/09/2009 20:57, Nathan McDavit-Van Fleet wrote:
Hrmm,
Now that it's parsing I find that it doesn't work in terms of actually evaluating the EAP-Type.
For if (control.EAP-Type==21) and (outer.control.EAP-Type==21) I always get a false even though I am testing for TTLS (21).
Erm... What..
if("%{control:EAP-Type}" == '21')
if("%{outer.control:EAP-Type}" == '21')
The list/attribute separator has always been a colon. Alan did some work to make naked variable expansion work, but I still generally stick to the double quoted curly braces consistency, or munging variables together.
Don't worry about mixing types, the server just looks at the attribute type when doing conversions.
Is there some way to just have the value thrown into the debug output so
I
can see what it is at that moment?
Yes
update request { Tmp-String-0 := "%{outer.control:EAP-Type}" }
Pretty sure you'll also have to have the 'Proxy as EAP' option set in the outer tunnel to get the inner EAP type... Else just insert a policy at the end of the authorize{} section in the inner tunnel to look at control:Auth-Type...
Oh and remember to include cases for Identity-Responses and NAKs else you'll break things in weird and interesting ways :)
- -Arran
-----Original Message----- From: freeradius-users- bounces+nmcdavit=alcor.concordia.ca@lists.freeradius.org [mailto:freeradius-users- bounces+nmcdavit=alcor.concordia.ca@lists.freeradius.org] On Behalf Of Nathan McDavit-Van Fleet Sent: Tuesday, September 15, 2009 1:05 PM To: 'FreeRadius users mailing list' Subject: RE: Using Attributes to differentiate between different EAP
types
Okay,
Probably everone but me knew this but" If(blah == blah2) {
Doesn't work.
You have to do
If(blah == blah2) {
So no returns for the first curly bracket or it won't parse out.
Sorry,
Nathan Van Fleet
-----Original Message----- From: freeradius-users- bounces+nmcdavit=alcor.concordia.ca@lists.freeradius.org [mailto:freeradius-users- bounces+nmcdavit=alcor.concordia.ca@lists.freeradius.org] On Behalf Of Ivan Kalik Sent: Tuesday, September 15, 2009 12:13 PM To: FreeRadius users mailing list Subject: RE: Using Attributes to differentiate between different EAP types
I'm trying the following code, I've tried most every variation ("request:EAP-Type", "request.EAP-Type","EAP-Type","outer.EAP-Type".) but freeradius does not even parse the configuration. I've tried %{} and just the bare variables (which works for "outer.NAS-IP-Address").
It's the internal attribute (for local server use), so it should be on the control list (control.EAP-Type).
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- -- Arran Cudbard-Bell <A.Cudbard-Bell@sussex.ac.uk>, Systems Administrator (AAA), Infrastructure Services (IT Services), E1-1-08, Engineering 1, University Of Sussex, Brighton, BN1 9QT DDI+FAX: +44 1273 873900 | INT: 3900 GPG: 86FF A285 1AA1 EE40 D228 7C2E 71A9 25BB 1E68 54A2 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAkqv9mIACgkQcaklux5oVKL1RQCaA+QcE47BGJVD/8QbIaRGmguN dpcAn1MC+D/xzXKhfxJUcIjwQewl360d =Kh5N -----END PGP SIGNATURE----- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Nathan McDavit-Van Fleet wrote:
I'm still not able to navigate through the values that the modules are holding.
That statement makes no sense. Read doc/aaa.txt for a description of the lists maintained by the server. Read "man unlang" for a description of how to look up entries in a list, or add an entry to a list.
Are there any other pointers in regards to finding where EAP-Type is nested? I cannot figure out how to even access the EAP module from inside inner-tunnel.
You don't "access the EAP module". You access a list. The *outer* virtual server runs a bunch of modules. One of which is "eap". The eap module looks inside of the packet, and adds "EAP-Type" to the list of control attributes for the request. If you want to look at it from the inner tunnel, refer to: a) the outer request b) the control item list c) the EAP-Type attribute e.g. if ("%{outer.control:EAP-Type}" == 22) { ... I will also note that you have now sent a number of messages trying all kinds of different things, and claiming "it doesn't work" for all of them. See the FAQ for "it doesn't work". This is documented. Alan DeKok.
participants (4)
-
Alan DeKok -
Arran Cudbard-Bell -
Ivan Kalik -
Nathan McDavit-Van Fleet