Do not send Accounting-Response
Weird question here, want to stop freeradius sending an Accounting-Response, I assume it's probably possible since it's like a Lego set, but how is best/easiest way of doing it on a per NAS basis. Why you would want to do such a thing, well I'll have more info on that tomorrow after I've spoken with the Telco. At the moment I just want to know if it's possible and best way of doing it. Mark. ________________________________ This e-mail message is for the sole use of the intended recipient(s) and may contain confidential and privileged information of Transaction Network Services. Any unauthorized reviews, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. --------------------------------------------------------------------------------------- This email has been scanned for email related threats and delivered safely by Mimecast. For more information please visit http://www.mimecast.com ---------------------------------------------------------------------------------------
On Jun 15, 2021, at 12:28 AM, Strong, Mark <mstrong@tnsi.com> wrote:
Weird question here, want to stop freeradius sending an Accounting-Response, I assume it's probably possible since it's like a Lego set, but how is best/easiest way of doing it on a per NAS basis.
Why you would want to do such a thing, well I'll have more info on that tomorrow after I've spoken with the Telco.
At the moment I just want to know if it's possible and best way of doing it.
Yes. There's a "do_not_respond" policy: accounting { ... if (User-Name == "bob") { do_not_respond } ... } But this is a VERY bad idea in general. Doing this will make the NAS think that the server is down. Alan DeKok.
Thanks Alan. Was going to try it today, but time got away (and my test rig is busted). This apparently is a hack to make Jasper work. Instead of "User-Name" is there a variable matching the "client" or NAS who we would be replying to (under normal circumstances). Mark.
Yes. There's a "do_not_respond" policy:
accounting { ... if (User-Name == "bob") { do_not_respond } ... }
But this is a VERY bad idea in general. Doing this will make the NAS think that the server is down.
________________________________ This e-mail message is for the sole use of the intended recipient(s) and may contain confidential and privileged information of Transaction Network Services. Any unauthorized reviews, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. --------------------------------------------------------------------------------------- This email has been scanned for email related threats and delivered safely by Mimecast. For more information please visit http://www.mimecast.com ---------------------------------------------------------------------------------------
On Jun 17, 2021, at 2:37 AM, Strong, Mark <mstrong@tnsi.com> wrote:
Thanks Alan. Was going to try it today, but time got away (and my test rig is busted).
This apparently is a hack to make Jasper work.
Instead of "User-Name" is there a variable matching the "client" or NAS who we would be replying to (under normal circumstances).
Read the debug output to see what the NAS is sending. Read the documentation and examples to see how to match packets based on source IP. Alan DeKok.
Instead of "User-Name" is there a variable matching the "client" or NAS who we would be replying to (under normal circumstances).
Read the debug output to see what the NAS is sending.
Read the documentation and examples to see how to match packets based on source IP.
Alan DeKok.
I did that, got it working. if ((NAS-IP-Address == "1.1.1.1") || (NAS-IP-Address == "1.1.1.2")) { if ("%{Called-Station-Id}" != "apn3") { do_not_respond } } However I was trying a pattern match prior that wouldn't work, something like; if ((NAS-IP-Address == "1.1.1.1") || (NAS-IP-Address == "1.1.1.2")) { if ("%{Called-Station-Id}" =~ /apn1|apn2|apn4|apn5/) { do_not_respond } } Assuming Called-Station-Id = "apn3", I was hoping it would evaluate to false, but it was true (said radiusd -X) Is there someway to do something like find string1 inside string2, I had a read thru the unlang doc and googled some examples, didn't find anything like that. Mark. ________________________________ This e-mail message is for the sole use of the intended recipient(s) and may contain confidential and privileged information of Transaction Network Services. Any unauthorized reviews, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. --------------------------------------------------------------------------------------- This email has been scanned for email related threats and delivered safely by Mimecast. For more information please visit http://www.mimecast.com ---------------------------------------------------------------------------------------
On Jun 18, 2021, at 12:22 AM, Strong, Mark <mstrong@tnsi.com> wrote:
I did that, got it working.
if ((NAS-IP-Address == "1.1.1.1") || (NAS-IP-Address == "1.1.1.2")) {
There is no need to quote IP addresses.
if ("%{Called-Station-Id}" != "apn3") {
I'm not clear why many people use string expansions for things which are already strings. I ended up putting in hacks to the unlang compiler to catch this, and fix it. You can just do: if (Called-Station-Id != "apn3") {
However I was trying a pattern match prior that wouldn't work, something like;
if ((NAS-IP-Address == "1.1.1.1") || (NAS-IP-Address == "1.1.1.2")) { if ("%{Called-Station-Id}" =~ /apn1|apn2|apn4|apn5/) { do_not_respond } }
Assuming Called-Station-Id = "apn3", I was hoping it would evaluate to false, but it was true (said radiusd -X)
Regular expressions work. We have tests which verify this on every code commit.
Is there someway to do something like find string1 inside string2, I had a read thru the unlang doc and googled some examples, didn't find anything like that.
Regular expressions. Post the debug output here, and let someone else see what's up. Alan DeKok.
participants (2)
-
Alan DeKok -
Strong, Mark