ascend-data-filters missing from access-accept
Hi, I'm having some trouble getting all the Ascend-Data-Filter attributes I set in the users file returned in an access-accept packet. Its strange because some of the filters get returned, but others do not. Its creating a real problem for me. Here is the stanza where I match and attach the attributes. Note that there is no other area in my users file where Ascend-Data-Filters are being used. DEFAULT Huntgroup-Name == xxxyyyzzz Ascend-Data-Filter += "ip out drop udp dstport = 135", Ascend-Data-Filter += "ip out drop udp dstport = 136", Ascend-Data-Filter += "ip out drop udp dstport = 137", Ascend-Data-Filter += "ip out drop udp dstport = 138", Ascend-Data-Filter += "ip out drop udp dstport = 139", Ascend-Data-Filter += "ip out drop udp dstport = 445", Ascend-Data-Filter += "ip out drop udp dstport = 587", Ascend-Data-Filter += "ip out drop udp dstport = 1433", Ascend-Data-Filter += "ip out drop udp dstport = 1434", Ascend-Data-Filter += "ip out drop udp dstport = 4444", Ascend-Data-Filter += "ip out drop tcp dstport = 135", Ascend-Data-Filter += "ip out drop tcp dstport = 136", Ascend-Data-Filter += "ip out drop tcp dstport = 137", Ascend-Data-Filter += "ip out drop tcp dstport = 138", Ascend-Data-Filter += "ip out drop tcp dstport = 139", Ascend-Data-Filter += "ip out drop tcp dstport = 445", Ascend-Data-Filter += "ip out drop tcp dstport = 587", Ascend-Data-Filter += "ip out drop tcp dstport = 1433", Ascend-Data-Filter += "ip out drop tcp dstport = 1434", Ascend-Data-Filter += "ip out drop tcp dstport = 4444", Ascend-Data-Filter += "ip out forward 0", Ascend-Data-Filter += "ip in forward 0 dstip xxx.xxx.xxx.xxx/32", Ascend-Data-Filter += "ip in forward 0 dstip xxx.xxx.xxx.xxx/32", Ascend-Data-Filter += "ip in forward 0 dstip xxx.xxx.xxx.xxx/32", Ascend-Data-Filter += "ip in forward 0 dstip xxx.xxx.xxx.xxx/30", Ascend-Data-Filter += "ip in forward 0 dstip xxx.xxx.xxx.xxx/30", Ascend-Data-Filter += "ip in drop tcp dstport = 25", Ascend-Data-Filter += "ip in drop tcp dstport = 587", Ascend-Data-Filter += "ip in forward 0", Fall-Through = no Here is the output using radclient on an auth packet that matches that huntgroup: su-2.05b# radclient -f auth localhost:6969 auth nas41v29 Received response ID 72, code 2, length = 1004 Ascend-Data-Filter = "ip output drop udp dstport = 135" Ascend-Data-Filter = "ip output drop udp dstport = 136" Ascend-Data-Filter = "ip output drop udp dstport = 137" Ascend-Data-Filter = "ip output drop udp dstport = 138" Ascend-Data-Filter = "ip output drop udp dstport = 139" Ascend-Data-Filter = "ip output drop udp dstport = 445" Ascend-Data-Filter = "ip output drop udp dstport = 587" Ascend-Data-Filter = "ip output drop udp dstport = 1433" Ascend-Data-Filter = "ip output drop udp dstport = 1434" Ascend-Data-Filter = "ip output drop udp dstport = 4444" Ascend-Data-Filter = "ip output drop tcp dstport = 135" Ascend-Data-Filter = "ip output drop tcp dstport = 136" Ascend-Data-Filter = "ip output drop tcp dstport = 137" Ascend-Data-Filter = "ip output drop tcp dstport = 138" Ascend-Data-Filter = "ip output drop tcp dstport = 139" Ascend-Data-Filter = "ip output drop tcp dstport = 445" Ascend-Data-Filter = "ip output drop tcp dstport = 587" Ascend-Data-Filter = "ip output drop tcp dstport = 1433" Ascend-Data-Filter = "ip output drop tcp dstport = 1434" Ascend-Data-Filter = "ip output drop tcp dstport = 4444" Ascend-Data-Filter = "ip output forward 0" Ascend-Data-Filter = "ip input drop tcp dstport = 25" Ascend-Data-Filter = "ip input drop tcp dstport = 587" Ascend-Data-Filter = "ip input forward 0" Idle-Timeout = 1800 Framed-Protocol = PPP Service-Type = Framed-User Framed-IP-Netmask = 255.255.255.255 There's no other place Ascend-Data-Filter is used in the users file, so, there's no chance of that messing it up. This is confusing because it seems to add some but not others. Basically it causes email not to work for the users because the drop rule for port 25 traffic gets added but the allow rule to our mail server does not. Any ideas? Thanks! Chris Carver
Christopher Carver <ccarver@pennswoods.net> wrote:
I'm having some trouble getting all the Ascend-Data-Filter attributes I set in the users file returned in an access-accept packet. Its strange because some of the filters get returned, but others do not.
The ones that don't get returned are probably not being parsed correctly. Create a test user containing just those entries, run the server in debugging mode, and see what it says. Alan DeKok.
Alan DeKok wrote:
Christopher Carver <ccarver@pennswoods.net> wrote:
I'm having some trouble getting all the Ascend-Data-Filter attributes I set in the users file returned in an access-accept packet. Its strange because some of the filters get returned, but others do not.
The ones that don't get returned are probably not being parsed correctly. Create a test user containing just those entries, run the server in debugging mode, and see what it says.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Thanks for the reply Alan. It looks like you're right. First I tried adding it to the radreply table in sql to get around this problem, but it looks like it parses it the same and runs into the same problem. Here's the message from radiusd -X this time: rlm_sql: Failed to create the pair: failed to parse Ascend binary attribute: Unknown string "dstip" in IP data filter rlm_sql (sql): Error getting data from database rlm_sql (sql): Released sql socket id: 4 Then it returns the same list of attributes. I looked in dictionary.ascend and I think I have the format of my rules right: # IP FILTERS: # # ip dir action [ dstip n.n.n.n/nn ] [ srcip n.n.n.n/nn ] # [ proto [ dstport cmp value ] [ srcport cmd value ] [ est ] ] Here is what I'm using: | 34 | mailAccess | Ascend-Data-Filter | += | ip in forward 0 dstip xxx.xxx.xxx.xxx/32 | 0 | | 27 | firewallGroup | Ascend-Data-Filter | += | ip in forward 0 dstip xxx.xxx.xxx.xxx/32 | 0 | | 28 | firewallGroup | Ascend-Data-Filter | += | ip in forward 0 dstip xxx.xxx.xxx.xxx/32 | 0 | | 29 | firewallGroup | Ascend-Data-Filter | += | ip in forward 0 dstip xxx.xxx.xxx.xxx/30 | 0 | | 30 | firewallGroup | Ascend-Data-Filter | += | ip in forward 0 dstip xxx.xxx.xxx.xxx/30 | 0 | Is this wrong? I would appreciate any other help in this matter. Thanks, Chris Carver
Christopher Carver <ccarver@pennswoods.net> wrote:
# ip dir action [ dstip n.n.n.n/nn ] [ srcip n.n.n.n/nn ] # [ proto [ dstport cmp value ] [ srcport cmd value ] [ est ] ]
Here is what I'm using:
| 34 | mailAccess | Ascend-Data-Filter | += | ip in forward 0 dstip xxx.xxx.xxx.xxx/32 | 0 |
What's the extra "0" doing after "forward"? It's not following the documented format. Alan DeKok.
participants (2)
-
Alan DeKok -
Christopher Carver