Sending a disconnect message when replying with an access reject.
I think I may be doing something wrong but perhaps it is working as designed. When I setup the post-auth policy to send a update disconnect it works fine if the response is an access accept. But if I update the control to access reject the disconnect module gives me a noop. Is this supposed to be working this way as I really do want to send a disconnect for another session based on some of the inbound attributes for the current request which I also want to reject. I'm running fr 2.1.12 with the shipping version included with RedHat 6.3 I think it is a basic logic change but the disconnect function isn't a module its somewhere embedded in main. Or perhaps I am just doing something wrong.
On Thu, Apr 18, 2013 at 05:52:16PM +1200, Peter Lambrechtsen wrote:
When I setup the post-auth policy to send a update disconnect it works fine if the response is an access accept. But if I update the control to access reject the disconnect module gives me a noop.
As a guess: The Post-Auth-Type REJECT section in the inner-tunnel is never called. This is fixed in v2.x.x HEAD and master. Post-Auth-Type REJECT in the outer tunnel is fine. This might be your problem.
Or perhaps I am just doing something wrong.
You didn't send output from radiusd -X. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
On Thu, Apr 18, 2013 at 11:35 PM, Matthew Newton <mcn4@leicester.ac.uk> wrote:
On Thu, Apr 18, 2013 at 05:52:16PM +1200, Peter Lambrechtsen wrote:
When I setup the post-auth policy to send a update disconnect it works fine if the response is an access accept. But if I update the control to access reject the disconnect module gives me a noop.
As a guess:
The Post-Auth-Type REJECT section in the inner-tunnel is never called. This is fixed in v2.x.x HEAD and master.
Post-Auth-Type REJECT in the outer tunnel is fine.
This might be your problem.
Under the authorize section I have: if (ADSL-Agent-Remote-Id !~ /COMP/ ) { update disconnect { Acct-Session-Id = "7444" } # update control { # Auth-Type := Reject # } } This was just for testing to see if I could send a Disconnect from within the Authorize section. In the trace I see: +++? if (ADSL-Agent-Remote-Id !~ "xxx" ) -> TRUE +++- entering if (ADSL-Agent-Remote-Id !~ "xxx" ) {...} ++++[disconnect] returns ok Then at the end of the log I see: Sending Access-Accept of id 161 to 172.25.1.1 port 62037 ERX-Virtual-Router-Name = "default:voiplm1" WARNING: Empty pre-proxy section. Using default return values. Sending Disconnect-Request of id 206 to 172.25.1.1 port 3799 Acct-Session-Id = "7444" Finished request 3. Going to the next request Waking up in 1.2 seconds. rad_recv: Disconnect-NAK packet from host 172.25.1.1 port 3799, id=206, length=20 # Executing section post-proxy from file /etc/raddb/sites-enabled/default +- entering group post-proxy {...} [eap] No pre-existing handler found ++[eap] returns noop Finished request 3. Going to the next request Waking up in 4.9 seconds. Cleaning up request 3 ID 161 with timestamp +163 So in this case I see I get a NAK back (since I sent the wrong session ID). Whereas if I have the Auth-Type := Reject then that rejects the current packet, but I expected the Disconnect to still go through, but this is what I see: +++? if (ADSL-Agent-Remote-Id !~ "xxx" ) -> TRUE +++- entering if (ADSL-Agent-Remote-Id !~ "xxx" ) {...} ++++[control] returns ok ++++[disconnect] returns ok ++++- entering policy do_not_respond {...} +++++[control] returns ok +++++[handled] returns handled ++++- policy do_not_respond returns handled +++- if (ADSL-Agent-Remote-Id !~ "xxx" ) returns handled Whereas all I send back is: Sending Access-Reject of id 165 to 172.25.1.1 port 62037 ERX-Virtual-Router-Name = "default:voiplm1" Waking up in 4.9 seconds. The Disconnect never get sent. I even tried adding it into post-auth as well under the Post-Auth-Type REJECT: Post-Auth-Type REJECT { update disconnect { Acct-Session-Id = "7444" } } And the module returns a noop: Auth-Type = Reject, rejecting user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} ++[disconnect] returns noop Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 186 to 172.25.1.1 port 62037 ERX-Virtual-Router-Name = "default:voiplm1" Waking up in 4.9 seconds. Any ideas? Cheers Peter
participants (2)
-
Matthew Newton -
Peter Lambrechtsen