Repost: Properly using the := and = operators?
Dear list, I'm having a hard time learning how to use the attribute properties correctly in my mysql/radius database and my test enviroment is freeradius 1.1.3 / debian etch. What I'm trying to do is to establish a 'suspended' user group which receives a Framed-IP-Address attribute of 10.10.0.2+, and which overrides any previously assigned Famed-IP-Address, if present. I know that group processing is happening, because I can add attributes to the suspended group and my test user gets those attributes. I am adding the Framed-IP-Address attribute in the radreply table, but it is not being overwritten from the one set by radgroupreply. If I remove this from radreply, then the ip assigned in suspended group is applied. If I change the one in radgroupreply to use the += operator, then it returns both ip addresses in the reply. But I can't seem to get := to overwrite like the docs says it does. Here is a dump of my sample sql tables: mysql> select * from radcheck ; +----+----------+---------------+----+-----------------+ | id | UserName | Attribute | op | Value | +----+----------+---------------+----+-----------------+ | 2 | joe.user | User-Password | == | ididntpaymybill | +----+----------+---------------+----+-----------------+ mysql> select * from radreply ; +----+----------+-------------------+----+---------+ | id | UserName | Attribute | op | Value | +----+----------+-------------------+----+---------+ | 2 | joe.user | Framed-IP-Address | = | 1.2.3.4 | +----+----------+-------------------+----+---------+ mysql> select * from usergroup ; +----------+-----------+----------+ | UserName | GroupName | priority | +----------+-----------+----------+ | joe.user | suspended | 1 | +----------+-----------+----------+ mysql> select * from radgroupcheck ; +----+-----------+-----------------+----+-------+ | id | GroupName | Attribute | op | Value | +----+-----------+-----------------+----+-------+ | 3 | dynamic | Framed-Protocol | == | PPP | | 4 | suspended | Framed-Protocol | == | PPP | +----+-----------+-----------------+----+-------+ mysql> select * from radgroupreply ; +----+-----------+-------------------+----+-----------------+ | id | GroupName | Attribute | op | Value | +----+-----------+-------------------+----+-----------------+ | 6 | suspended | Framed-Netmask | = | 255.255.255.255 | | 5 | suspended | Framed-IP-Address | = | 10.10.0.2+ | | 7 | dynamic | Framed-IP-Address | := | 255.255.255.255 | +----+-----------+-------------------+----+-----------------+ Here is the results of running radtest on this user:
radtest joe.user ididntpaymybill localhost 0 testing123 Sending Access-Request of id 140 to 127.0.0.1 port 1812 User-Name = "joe.user" User-Password = "ididntpaymybill" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=140, length=32 Framed-IP-Address = 1.2.3.4 Framed-IP-Netmask = 255.255.255.255
What I am trying to accomplish is simply to allow us to put overdue users into the 'suspended' group, which will hand out a different set of ip addresses than their normal non-suspended configuration. I realise I could be approaching this all wrong but right now I simply set those items (framed-ip-address, framed-route, and etc) in the radreply table and I don't want to remove those items from the database, just override them. Any pointers would be greatly appreciated. Mike- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Mike, See http://wiki.freeradius.org/Operators for operator behavior. On Tuesday 26 December 2006 17:52, Mike wrote:
mysql> select * from radreply ; | 2 | joe.user | Framed-IP-Address | = | 1.2.3.4 |
This looks correct. The = operator says to assign 1.2.3.4 to the Framed-IP-Address attribute, if that attribute doesn't already exist.
mysql> select * from radgroupreply ; | 5 | suspended | Framed-IP-Address | = | 10.10.0.2+ |
The = operator here is incorrect, as you want to always override the Framed-IP-Address. Using := will replace any/all Framed-IP-Address attributes in the reply with the one listed above. Kevin Bonner
Kevin Bonner wrote:
| 5 | suspended | Framed-IP-Address | = | 10.10.0.2+ |
mysql> select * from radgroupreply ;
The = operator here is incorrect, as you want to always override the Framed-IP-Address. Using := will replace any/all Framed-IP-Address attributes in the reply with the one listed above.
Yeah that's the problem. The documentation says that's what it does, but in fact it doesn't. Any Framed-IP-Address in radreply, superceeds and overrules any Framed-IP-Address from radgroupreply, and no operators change or alter that. I can put in a Framed-IP-Address in radgroupreply using = or :=, but it never ever overwrites Framed-IP-Address from radreply, and I can prove that group processing is happening because if I change it to +=, I then get both ip addresses in the reply. For example: mysql> select * from radreply ; +----+----------+-------------------+----+---------+ | id | UserName | Attribute | op | Value | +----+----------+-------------------+----+---------+ | 4 | joe.user | Framed-IP-Address | := | 1.2.3.4 | +----+----------+-------------------+----+---------+ mysql> select * from usergroup where GroupName = 'suspended'; +----------+-----------+----------+ | UserName | GroupName | priority | +----------+-----------+----------+ | joe.user | suspended | 1 | +----------+-----------+----------+ mysql> select * from radgroupreply where GroupName = 'suspended' ; +----+-----------+-------------------+----+-----------------+ | id | GroupName | Attribute | op | Value | +----+-----------+-------------------+----+-----------------+ | 6 | suspended | Framed-Netmask | = | 255.255.255.255 | | 5 | suspended | Framed-IP-Address | += | 10.10.0.2+ | | 10 | suspended | Framed-Filter-Id | = | "natroutes" | +----+-----------+-------------------+----+-----------------+ 3 rows in set (0.00 sec) radtest joe.user ididntpaymybill localhost 0 testing123 hello Sending Access-Request of id 58 to 127.0.0.1 port 1812 User-Name = "joe.user" User-Password = "ididntpaymybill" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Framed-Protocol = PPP rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=58, length=62 Framed-IP-Address = 1.2.3.4 Framed-IP-Address = 10.10.0.2 Framed-IP-Netmask = 255.255.255.255 Framed-Route = "40.0.0.0/16" Filter-Id = "natroutes" So you can see both Framed-IP-Address from above. I got two because += added the 10.10.0.2 to the reply. And now I'll change it back to := for show: mysql> select * from radgroupreply where GroupName = 'suspended' ; +----+-----------+-------------------+----+-----------------+ | id | GroupName | Attribute | op | Value | +----+-----------+-------------------+----+-----------------+ | 6 | suspended | Framed-Netmask | = | 255.255.255.255 | | 5 | suspended | Framed-IP-Address | := | 10.10.0.2+ | | 10 | suspended | Framed-Filter-Id | = | "natroutes" | +----+-----------+-------------------+----+-----------------+ 3 rows in set (0.00 sec) radtest joe.user ididntpaymybill localhost 0 testing123 hello Sending Access-Request of id 166 to 127.0.0.1 port 1812 User-Name = "joe.user" User-Password = "ididntpaymybill" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Framed-Protocol = PPP rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=166, length=56 Framed-IP-Address = 1.2.3.4 Framed-IP-Netmask = 255.255.255.255 Framed-Route = "40.0.0.0/16" Filter-Id = "natroutes" Now you can see the Framed-IP-Address is 1.2.3.4 - it was not overwritten by the 10.10.0.2 from radgroupreply despite what the documentation seems to suggest and what you have stated. Can you suggest changes that will allow radgroupreply to set a Framed-IP-Address attribute that overwrites any set from radreply? --
-- Do not try to make the creditors stop calling, for that is impossibe. Instead, only try to realise the truth: THERE IS NO PHONE! <a href="http://speedtest.dslreports.com"><img border=0 src="http://www.dslreports.com/im/18224717/86472.png"></a>
Hi List, Can anyone here demonstrate a simple sql configuration that proves that the := operator will in fact replace any attribute of the same name, as the documentation says it does? Specfically, I want to see an attribute set in radreply which is then overwritten in radgroupreply, if the user belongs to a certain group. I'm only able to demonstrate that group processing works, but := acts exactly like = for the purposes of this test. Mike-
participants (2)
-
Kevin Bonner -
Mike