Freeradius V2 to V3 - Handle "Tagged" Attributes
Hi everyone, hope you are well ! I'm currently trying to update a freeradius server from V2 to V3, and I'm struggling with tagged attributes that don't work correctly on the V3 server. This is what i have in my radreply table : +----------+-------------------------------------+------------------------+----+---------------------------+ | id | UserName | Attribute | op | Value | +----------+-------------------------------------+------------------------+----+---------------------------+ | 35928801 | userXX | Framed-Protocol | = | PPP | | 35928811 | userXX | Service-Type | = | Framed-User | | 35928821 | userXX | Tunnel-Server-Auth-Id | = | :1:xxxxxxxxxx | | 35928831 | userXX | Tunnel-Server-Endpoint | = | :1:xx.xx.xx.xx | | 35928841 | userXX | Tunnel-Medium-Type | = | IP | | 35928851 | userXX | Tunnel-Type | = | :1:L2TP | | 35928861 | userXX | Tunnel-Client-Auth-ID | = | :1:XX_XXX | | 35928901 |userXX | Tunnel-Password | = | :1:xxxxxx In the V2 server, the response is like this : Packet-Type = Access-Accept Framed-Protocol = PPP Service-Type = Framed-User Tunnel-Server-Auth-Id:1 = "xxxxxx" Tunnel-Server-Endpoint:1 = "xx.xx.xx.xx" Tunnel-Medium-Type:1 = IPv4 Tunnel-Type:1 = L2TP Tunnel-Client-Auth-Id:1 = "xx_XXX" Tunnel-Password:1 = "xxxxx" As you can see, the ":1:" contained in the value goes at the end of the attribute. I spent a lot of time trying to understand this on the V2 server, but I found nothing related to this configuration. It's like freeradiusV2 understands itself how to deal with tagged attributs. On the V3 server, it respond exactly what is on the radreply table : Packet-Type = Access-Accept Framed-Protocol = PPP Service-Type = Framed-User Tunnel-Server-Auth-Id = ":1:xxxxxxxx" Tunnel-Server-Endpoint = ":1:xx.xx.xx.xxx" Tunnel-Medium-Type = IPv4 Tunnel-Type = L2TP Tunnel-Client-Auth-Id = ":1:xxxxxxx" Tunnel-Password = ":1:xxxxxx" For now, i can't change nothing on my bdd, i have do deal it with freeradius I found nothing about changes between V2 and V3 about tagged attributes (i found something between v3 and v4) Do you have an idea, how can I make it work with V3 ? Regards, Kabsof
On Mar 13, 2024, at 10:40 AM, Kabsof <kabsof10@gmail.com> wrote:
I found nothing about changes between V2 and V3 about tagged attributes (i found something between v3 and v4)
Do you have an idea, how can I make it work with V3 ?
Move the tag to the attribute name: Tunnel-Server-Auth-Id:1 = "xxxxxx" v2 prints this out, and accepts that format as input, too. It accepts the tag in the value for compatibility with RADIUS servers going back to 1993. That was too hard to keep in v3, so we keep the "Name:tag" format, and removed the "tag:value" format. Alan DeKok.
Hi Alan, Thank you for your quick response ! Ok it's more clear now why it doesn't work with the V3. I will go with the modifications on the database. Regards, Kabsof Le mer. 13 mars 2024 à 16:33, Alan DeKok <aland@deployingradius.com> a écrit :
On Mar 13, 2024, at 10:40 AM, Kabsof <kabsof10@gmail.com> wrote:
I found nothing about changes between V2 and V3 about tagged attributes (i found something between v3 and v4)
Do you have an idea, how can I make it work with V3 ?
Move the tag to the attribute name:
Tunnel-Server-Auth-Id:1 = "xxxxxx"
v2 prints this out, and accepts that format as input, too. It accepts the tag in the value for compatibility with RADIUS servers going back to 1993.
That was too hard to keep in v3, so we keep the "Name:tag" format, and removed the "tag:value" format.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Alan DeKok <aland@deployingradius.com> writes:
On Mar 13, 2024, at 10:40 AM, Kabsof <kabsof10@gmail.com> wrote:
I found nothing about changes between V2 and V3 about tagged attributes (i found something between v3 and v4)
Do you have an idea, how can I make it work with V3 ?
Move the tag to the attribute name:
Tunnel-Server-Auth-Id:1 = "xxxxxx"
v2 prints this out, and accepts that format as input, too. It accepts the tag in the value for compatibility with RADIUS servers going back to 1993.
That was too hard to keep in v3, so we keep the "Name:tag" format, and removed the "tag:value" format.
I know I should just take your word for it, but... this surprised me since I just recently looked at that code in the 3.2.x branch: https://github.com/FreeRADIUS/freeradius-server/blob/v3.2.x/src/lib/pair.c#L... I'm all for converting to the new format. But to me it looks like ":tag:value" is still supported in 3.2. Or am I completely lost now? Bjørn
On Mar 13, 2024, at 3:51 PM, Bjørn Mork <bjorn@mork.no> wrote:
I know I should just take your word for it, but... this surprised me since I just recently looked at that code in the 3.2.x branch: https://github.com/FreeRADIUS/freeradius-server/blob/v3.2.x/src/lib/pair.c#L...
I'm all for converting to the new format. But to me it looks like ":tag:value" is still supported in 3.2. Or am I completely lost now?
If it works, great. But I don't think it's well tested. And it it doesn't work, I'm not going to work hard to fix it. Alan DeKok.
participants (3)
-
Alan DeKok -
Bjørn Mork -
Kabsof