Strange proxied accounting errors
We proxy some authentication and accounting to another company. After installing freeradius version 2.0.1 they have said they are getting errors in their log file: 02/13/2008 00:01:06 Missing Acct-Status-Type attribute in request 02/13/2008 00:01:06 Request has invalid syntax (e.g. invalid, missing or duplicate attributes), Silently discarding We get the accounting info fine in our sql database. Here is the part from the debugging that sends the accounting info to the other company. Wed Feb 13 15:17:00 2008 : Debug: rlm_sql (sql): Released sql socket id: 4 Wed Feb 13 15:17:00 2008 : Debug: modsingle[accounting]: returned from sql (rlm_sql) for request 0 Wed Feb 13 15:17:00 2008 : Debug: ++[sql] returns ok Wed Feb 13 15:17:00 2008 : Debug: modsingle[accounting]: calling attr_filter.accounting_response (rlm_attr_filter) for request 0 Wed Feb 13 15:17:00 2008 : Debug: expand: %{User-Name} -> user1@dsl.realm1.co.uk Wed Feb 13 15:17:00 2008 : Debug: attr_filter: Matched entry DEFAULT at line 12 Wed Feb 13 15:17:00 2008 : Debug: modsingle[accounting]: returned from attr_filter.accounting_response (rlm_attr_filter) for request 0 Wed Feb 13 15:17:00 2008 : Debug: ++[attr_filter.accounting_response] returns updated Wed Feb 13 15:17:00 2008 : Debug: +- entering group pre-proxy Wed Feb 13 15:17:00 2008 : Debug: modsingle[pre-proxy]: calling pre_proxy_log (rlm_detail) for request 0 Wed Feb 13 15:17:00 2008 : Debug: expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m %d -> /usr/local/var/log/radius/radacct/192.168.1.88/pre-proxy-detail-20080213 Wed Feb 13 15:17:00 2008 : Debug: rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m %d expands to /usr/local/var/log/radius/radacct/192.168.1.88/pre-proxy-detail-20080213 Wed Feb 13 15:17:00 2008 : Debug: expand: %t -> Wed Feb 13 15:17:00 2008 Wed Feb 13 15:17:00 2008 : Debug: modsingle[pre-proxy]: returned from pre_proxy_log (rlm_detail) for request 0 Wed Feb 13 15:17:00 2008 : Debug: ++[pre_proxy_log] returns ok Wed Feb 13 15:17:00 2008 : Debug: proxy: allocating destination 10.0.3.4 port 1646 - Id 128 Sending Accounting-Request of id 128 to 10.0.3.4 port 1646 Cisco-AVPair = "connect-progress=LAN Ses Up" Cisco-AVPair = "nas-tx-speed=2261000" Cisco-AVPair = "nas-rx-speed=2261000" Proxy-State = 0x313235 Wed Feb 13 15:17:00 2008 : Debug: Proxying request 0 to home server 10.0.3.4 port 1646 Sending Accounting-Request of id 128 to 10.0.3.4 port 1646 Cisco-AVPair = "connect-progress=LAN Ses Up" Cisco-AVPair = "nas-tx-speed=2261000" Cisco-AVPair = "nas-rx-speed=2261000" Realm = "dsl.realm1.co.uk" Proxy-State = 0x313235 It does seem to be sending the correct info. The version of freeradius we had installed before used to send: Sending Accounting-Request of id 0 to 10.0.3.4:1646 Acct-Session-Id = "0016CCEC" Tunnel-Type:0 = L2TP Tunnel-Medium-Type:0 = IP Tunnel-Server-Endpoint:0 = "192.168.1.88" Tunnel-Client-Endpoint:0 = "212.248.197.74" Tunnel-Assignment-Id:0 = "1" Tunnel-Client-Auth-Id:0 = "RTMAN-HATH-BROAD-05" Tunnel-Server-Auth-Id:0 = " VPDN1-ADSL" Acct-Tunnel-Connection = "2931893097" Framed-Protocol = PPP Framed-IP-Address = 85.92.161.203 User-Name = "user1@dsl.realm1.co.uk" Cisco-AVPair = "connect-progress=LAN Ses Up" Cisco-AVPair = "nas-tx-speed=5088000" Cisco-AVPair = "nas-rx-speed=5088000" Acct-Session-Time = 50249 Acct-Input-Octets = 123755364 Acct-Output-Octets = 3820769896 Acct-Input-Packets = 1905005 Acct-Output-Packets = 2718597 Acct-Authentic = RADIUS Acct-Status-Type = Alive NAS-Port-Type = Virtual NAS-Port = 1349 NAS-Port-Id = "Uniq-Sess-ID1349" Class = 0x5342522d434c20444e3d22323034393136222041543d22323030222055533d22222053493d 22383139362200 Service-Type = Framed-User NAS-IP-Address = 192.168.1.88 Acct-Delay-Time = 5 Proxy-State = 0x3936 Any help appreciated. Thanks Tony No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.516 / Virus Database: 269.20.4/1277 - Release Date: 13/02/2008 20:00
Tony Spencer wrote:
We proxy some authentication and accounting to another company.
After installing freeradius version 2.0.1 they have said they are getting errors in their log file: ... Wed Feb 13 15:17:00 2008 : Debug: modsingle[accounting]: returned from attr_filter.accounting_response (rlm_attr_filter) for request 0
Delete the "attr_filter.accounting_response" entry from the "accounting" section. The attr_filter module is filtering the *request*, when it is documented as filtering the *response*. This is a bug. The problem is fixed in 2.0.2, see "man rlm_attr_filter" in 2.0.2 for details. Alan DeKok.
.. snip ...
Wed Feb 13 15:17:00 2008 : Debug: rlm_sql (sql): Released sql socket id: 4
Wed Feb 13 15:17:00 2008 : Debug: modsingle[accounting]: returned from sql (rlm_sql) for request 0
Wed Feb 13 15:17:00 2008 : Debug: ++[sql] returns ok
Wed Feb 13 15:17:00 2008 : Debug: modsingle[accounting]: calling attr_filter.accounting_response (rlm_attr_filter) for request 0
Wed Feb 13 15:17:00 2008 : Debug: expand: %{User-Name} -> user1@dsl.realm1.co.uk
Wed Feb 13 15:17:00 2008 : Debug: attr_filter: Matched entry DEFAULT at line 12
Wed Feb 13 15:17:00 2008 : Debug: modsingle[accounting]: returned from attr_filter.accounting_response (rlm_attr_filter) for request 0
---
Wed Feb 13 15:17:00 2008 : Debug: ++[attr_filter.accounting_response] returns updated
--- Accounting response filter is stripping out required attributes before the accounting packet is proxied. It's a small oversight in the default config. The reason why the cisco attributes are getting through, is because VSAs are allowed in the accounting response. As accounting packets don't pose much of a risk, I leave them unfiltered... # If request is being proxied, don't filter the accounting packet through accounting_response. accounting { ... if(!"%{control:Proxy-To-Realm}"){ attr_filter.accounting_response } } # Accounting requests are exempt from the pre-proxy filter pre-proxy { ... if("%{Packet-Type}" != 'Accounting-Request'){ attr_filter.pre-proxy } } It's not perfect, but it'll work for now. Can always apply the accounting_response filter in post-proxy if you were worried about it... something like post-proxy { ... if("%{Packet-Type}" == 'Accounting-Response'){ attr_filter.accounting_response } else { attr_filter.post-proxy } }
-- Arran Cudbard-Bell (A.Cudbard-Bell@sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900
Arran Cudbard-Bell wrote:
Can always apply the accounting_response filter in post-proxy if you were worried about it... something like
post-proxy { ... if("%{Packet-Type}" == 'Accounting-Response'){ attr_filter.accounting_response
That won't do what you think. It filters the Accounting-Request, not the response! See the source code in 2.0.1. Alan DeKok.
Alan DeKok wrote:
Arran Cudbard-Bell wrote:
Can always apply the accounting_response filter in post-proxy if you were worried about it... something like
post-proxy { ... if("%{Packet-Type}" == 'Accounting-Response'){ attr_filter.accounting_response
That won't do what you think. It filters the Accounting-Request, not the response! See the source code in 2.0.1.
Ah yes ... thanks. Right, so for 2.02 you've changed the lists the filters operate on for those sections preacct and accounting. Thats good, I can remove those bits of unlang. Are you still planning on releasing 2.02 this week ?
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Arran Cudbard-Bell (A.Cudbard-Bell@sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900
Arran Cudbard-Bell wrote:
Alan DeKok wrote:
Arran Cudbard-Bell wrote:
Can always apply the accounting_response filter in post-proxy if you were worried about it... something like
post-proxy { ... if("%{Packet-Type}" == 'Accounting-Response'){ attr_filter.accounting_response
That won't do what you think. It filters the Accounting-Request, not the response! See the source code in 2.0.1.
Ah yes ... thanks.
Right, so for 2.02 you've changed the lists the filters operate on for those sections preacct and accounting. Thats good, I can remove those bits of unlang.
Are you still planning on releasing 2.02 this week ? Might be worth mentioning in the attr filter man page that you can use the result of any expanded string as a key, not just attributes.
i.e key = "%{Packet-Type}.%{Realm}" Allows filter entries like: Access-Request.external-realm attr = val .... and Accounting-Request.external-realm acctattr = acctval ...
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Arran Cudbard-Bell (A.Cudbard-Bell@sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900
participants (3)
-
Alan DeKok -
Arran Cudbard-Bell -
Tony Spencer