...

I need a hooker, some California rolls, and 10 grams of coke...

But what about blackjack??? We need *blackjack* and hookers.

I'm sure that can be arranged ;-) Stefan -- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom

http://i.imgur.com/ugU0qQu.jpg 2014-03-31 13:07 GMT+02:00 Arran Cudbard-Bell <a.cudbardb@freeradius.org>:

On 31 Mar 2014, at 10:42, stefan.paetow@diamond.ac.uk wrote:

...

...

...

I need a hooker, some California rolls, and 10 grams of coke...

But what about blackjack??? We need *blackjack* and hookers.

I'm sure that can be arranged ;-)

Can it be a theme park, a theme park with blackjack and hookers?

Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team

FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

-- Alberto Martínez Setién Middleware Comunicación y Sistemas Servicio Informático Universidad de Deusto Avda. de las Universidades, 24 48007 - Bilbao (SPAIN) Phone: +34 94 413 90 00 Ext. 2684 Fax: +34 94 413 91 01

Hello, I'm testing the case of an Access-Request proxied to a home server which does not respond. I expect to see my request go through : - authorize - pre-proxy (no response from proxy) - Post-Proxy-Type Fail And client gets no response (or possibly an Access-Reject). This is what happened in 3.0.1, but it seems it has changed in 3.0.2, now I have: - authorize - pre-proxy (no response from proxy) And then the weird part: - authorize (again) - post-auth Then an Access-Accept is sent back to the client. Which it can't use, because there's nothing useful inside. Is this a bug, or a configuration issue ? Here is my site configuration (stripped down to a minimal setup to reproduce the issue): SRS_3gpp_fictive_realm = 3gpp.orange.fr server server-owa-eap { listen { ipaddr = * type = auth port = 1812 } listen { ipaddr = * port = 1813 type = acct } authorize { # Handle EAP/SIM Authentication request if (EAP-Message) { update control { Proxy-To-Realm := ${SRS_3gpp_fictive_realm} } } } # end of authorize section post-auth { # an Access-Reject goes through post-auth REJECT subsection. # In the current section we are handling Accept and Challenge responses Post-Auth-Type REJECT { attr_filter.access_reject } } # end of post-auth section pre-proxy { } post-proxy { Post-Proxy-Type Fail { update control { Auth-Type := Reject } } } # end of post-proxy section } # end of server-owa-eap virtual server configuration. And here is the debug output: rad_recv: Access-Request packet from host 10.67.106.9 port 49191, id=219, length=65 User-Name = 'test-cui@SIM.orange.fr' EAP-Message = 0x78 Message-Authenticator = 0x487abb36d8a3ae1555680419160778c7 (0) # Executing section authorize from file /opt/application/mwpsrs/current/etc/raddb/sites-enabled/server-owa-eap (0) authorize { (0) if (EAP-Message) (0) if (EAP-Message) -> TRUE (0) if (EAP-Message) { (0) update control { (0) Proxy-To-Realm := '3gpp.orange.fr' (0) } # update control = noop (0) } # if (EAP-Message) = noop (0) } # authorize = noop (0) Proxying request to home server 10.67.141.66 port 61822 Sending Access-Request of id 221 from 0.0.0.0 port 63870 to 10.67.141.66 port 61822 User-Name = 'test-cui@SIM.orange.fr' EAP-Message = 0x78 Message-Authenticator = 0x487abb36d8a3ae1555680419160778c7 Proxy-State = 0x323139 Waking up in 0.3 seconds. Waking up in 0.4 seconds. (0) Expecting proxy response no later than 10 seconds from now Waking up in 9.1 seconds. (0) No proxy response, giving up on request and marking it done Marking home server 10.67.141.66 port 61822 as zombie (it has not responded in 10 seconds). (0) ERROR: Failing request - proxy ID 221, due to lack of any response from home server 10.67.141.66 port 61822 (0) # Executing section authorize from file /opt/application/mwpsrs/current/etc/raddb/sites-enabled/server-owa-eap (0) authorize { (0) if (EAP-Message) (0) if (EAP-Message) -> TRUE (0) if (EAP-Message) { (0) update control { (0) Proxy-To-Realm := '3gpp.orange.fr' (0) } # update control = noop (0) } # if (EAP-Message) = noop (0) } # authorize = noop (0) Auth-Type = Accept, accepting the user (0) # Executing section post-auth from file /opt/application/mwpsrs/current/etc/raddb/sites-enabled/server-owa-eap Sending Access-Accept of id 219 from 10.67.106.9 port 1812 to 10.67.106.9 port 49191 (0) Finished request 0. Waking up in 0.3 seconds. Waking up in 3.6 seconds. No response to status check 1 for home server 10.67.141.66 port 61822 Waking up in 0.9 seconds. (0) Cleaning up request packet ID 219 with timestamp +5 Waking up in 15.8 seconds. This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

Thanks for the fix! I still have a question, though. Now, the request goes through: - authorize - pre-proxy (no response from proxy server) - Post-Auth-Type REJECT It does *not* go through "Post-Proxy-Type Fail" anymore. Is that the expected behaviour ? If it is, this contradicts the comments in the "default" site example (copied below). If these are not accurate anymore, they probably need to be edited. # If the server tries to proxy a request and fails, then the # request is processed through the modules in this section. # # The main use of this section is to permit robust proxying # of accounting packets. The server can be configured to # proxy accounting packets as part of normal processing. # Then, if the home server goes down, accounting packets can # be logged to a local "detail" file, for processing with # radrelay. When the home server comes back up, radrelay # will read the detail file, and send the packets to the # home server. # # With this configuration, the server always responds to # Accounting-Requests from the NAS, but only writes # accounting packets to disk if the home server is down. # # Post-Proxy-Type Fail { # detail # }

-----Message d'origine----- De : freeradius-users- bounces+nicolas.chaigneau=capgemini.com@lists.freeradius.org [mailto:freeradius-users- bounces+nicolas.chaigneau=capgemini.com@lists.freeradius.org] De la part de Alan DeKok Envoyé : lundi 31 mars 2014 16:54 À : FreeRadius users mailing list Objet : Re: 3.0.2 / possible bug when proxying with no response from home server

Chaigneau, Nicolas wrote:

...

Is this a bug, or a configuration issue ?

Bug. I've pushed a fix.

Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

OK, thanks. Any hope for a fix soon ? Regards, Nicolas. De : freeradius-users-bounces+nicolas.chaigneau=capgemini.com@lists.freeradius.org [mailto:freeradius-users-bounces+nicolas.chaigneau=capgemini.com@lists.freeradius.org] De la part de Arran Cudbard-Bell Envoyé : mardi 1 avril 2014 09:51 À : FreeRadius users mailing list Objet : Re: 3.0.2 / possible bug when proxying with no response from home server On 1 Apr 2014, at 08:15, Chaigneau, Nicolas <nicolas.chaigneau@capgemini.com<mailto:nicolas.chaigneau@capgemini.com>> wrote: Thanks for the fix! I still have a question, though. Now, the request goes through: - authorize - pre-proxy (no response from proxy server) - Post-Auth-Type REJECT It does *not* go through "Post-Proxy-Type Fail" anymore. Is that the expected behaviour ? Nope! As show by this handy dandy revised diagram. [cid:image001.png@01CF4E5B.60196060] Arran Cudbard-Bell <a.cudbardb@freeradius.org<mailto:a.cudbardb@freeradius.org>> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2 This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.