freeradius + MySQL not working after upgrade from 1.0.1
Hello. I have encountered a problem upon upgrading from freeradius version 1.0.1. I'm using the sql module (rlm_sql_mysql) for authorization and accounting of dialup users (reselling dialup from several networks). After upgrading to 1.0.2 with the same configuration, it no longer works.
From the logs I see that authorization works: Login OK: [xxxx@xxxxx.com] (from client xxxxxxxx port 15) and it sends "Access-Accept" but the connecting dialup user can't connect.
I now have two servers with the same freeradius configuration (minus minor changes from the upgrade) and the same MySQL database with one running version 1.0.1 (which works) and the other running 1.0.4 (which does not work). Comparing the logs produced by "radiusd -X", I see that the only substantial difference is the X-Ascend-Data-Filter Attributes which look something like this: WORKING VERSION 1.0.1: Sending Access-Accept of id 158 to 216.126.136.243:1814 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 255.255.255.254 Framed-IP-Netmask = 255.255.255.255 Port-Limit = 1 Idle-Timeout = 600 Session-Timeout = 28800 Filter-Id = "data6330_1" Proxy-State = 0x3532 X-Ascend-Data-Filter += "ip in forward tcp est" X-Ascend-Data-Filter += "ip in forward dstip 200.100.100.10/32 0" X-Ascend-Data-Filter += "ip in forward dstip 66.55.44.0/24 0" X-Ascend-Data-Filter += "ip in forward dstip 66.44.55.0/24 0" X-Ascend-Data-Filter += "ip in drop tcp dstport = 25" X-Ascend-Data-Filter += "ip in forward 0" Finished request 0 Going to the next request NON-WORKING VERSION 1.0.4: Sending Access-Accept of id 154 to 216.126.136.243:1814 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 255.255.255.254 Framed-IP-Netmask = 255.255.255.255 Port-Limit = 1 Idle-Timeout = 600 Session-Timeout = 28800 X-Ascend-Data-Filter += 0x697020696e20666f72776172642074637020657374 X-Ascend-Data-Filter += 0x697020696e20666f7277617264206473746970203230392e3130322e3130372e37372f33322030 X-Ascend-Data-Filter += 0x697020696e20666f72776172642064737469702036342e32342e33352e302f32342030 X-Ascend-Data-Filter += 0x697020696e20666f72776172642064737469702036362e34352e3234332e302f32342030 X-Ascend-Data-Filter += 0x697020696e2064726f702074637020647374706f7274203d203235 X-Ascend-Data-Filter += 0x697020696e20666f72776172642030 Filter-Id = "data6330_1" Proxy-State = 0x3234 Finished request 3 Going to the next request The working version proceeds to do accounting sometime after sending that while the other version stops there. I suspect those long strings are the culprit since everything else in the logs looks the same. The attributes come from the database and they look fine there. Any ideas how I can get the previous behavior or get the newer versions to work? Or maybe the problem is something else? Thanks, Marc
marc-ml@neoharmonix.net wrote:
I now have two servers with the same freeradius configuration (minus minor changes from the upgrade) and the same MySQL database with one running version 1.0.1 (which works) and the other running 1.0.4 (which does not work). Comparing the logs produced by "radiusd -X", I see that the only substantial difference is the X-Ascend-Data-Filter Attributes.
It could be the bug #242. http://bugs.freeradius.org/show_bug.cgi?id=242 -- Nicolas Baradakis
I now have two servers with the same freeradius configuration (minus minor changes from the upgrade) and the same MySQL database with one running version 1.0.1 (which works) and the other running 1.0.4 (which does not work). Comparing the logs produced by "radiusd -X", I see that the only substantial difference is the X-Ascend-Data-Filter Attributes.
It could be the bug #242. http://bugs.freeradius.org/show_bug.cgi?id=242
The issue I'm experiencing appears to be something else. After further testing, I've found that the same issue is also present when using the users file for authorization rather than sql. I encounter this problem upon upgrading from version 1.0.1 to >= 1.0.2 (using Gentoo). Could it be something to do with the X-Ascend-Data-Filter abinary format? Perhaps a configuration option for that introduced after 1.0.1? This is the output from running radtest between the two servers with different freeradius versions (just showing the X-Ascend-Data-Filter stuff since everything else is the same): * 1.0.1 --> 1.0.1 : X-Ascend-Data-Filter = "ip in forward tcp est" X-Ascend-Data-Filter = "ip in forward dstip 209.102.107.77/32 0" X-Ascend-Data-Filter = "ip in forward dstip 64.24.35.0/24 0" X-Ascend-Data-Filter = "ip in forward dstip 66.45.243.0/24 0" X-Ascend-Data-Filter = "ip in drop tcp dstport = 25" X-Ascend-Data-Filter = "ip in forward 0" * 1.0.1 --> 1.0.4 : X-Ascend-Data-Filter = "?? out drop" X-Ascend-Data-Filter = 0x 69 70 20 69 6e 20 66 6f 72 77 61 72 64 20 64 73 74 69 70 20 32 30 39 2e 31 30 32 2e 31 30 37 2e 37 37 2f 33 32 20 30 X-Ascend-Data-Filter = 0x 69 70 20 69 6e 20 66 6f 72 77 61 72 64 20 64 73 74 69 70 20 36 34 2e 32 34 2e 33 35 2e 30 2f 32 34 20 30 X-Ascend-Data-Filter = 0x 69 70 20 69 6e 20 66 6f 72 77 61 72 64 20 64 73 74 69 70 20 36 36 2e 34 35 2e 32 34 33 2e 30 2f 32 34 20 30 X-Ascend-Data-Filter = "?? out drop" X-Ascend-Data-Filter = "?? out drop" * 1.0.4 --> 1.0.1 : X-Ascend-Data-Filter = 0x0101010000000000000000000000060100000000000000000000000000000000 X-Ascend-Data-Filter = 0x0101010000000000d1666b4d0020000000000000000000000000000000000000 X-Ascend-Data-Filter = 0x0101010000000000401823000018000000000000000000000000000000000000 X-Ascend-Data-Filter = 0x0101010000000000422df3000018000000000000000000000000000000000000 X-Ascend-Data-Filter = 0x0100010000000000000000000000060000000019000200000000000000000000 X-Ascend-Data-Filter = 0x0101010000000000000000000000000000000000000000000000000000000000 * 1.0.4 --> 1.0.4 : X-Ascend-Data-Filter = 0x697020696e20666f72776172642074637020657374 X-Ascend-Data-Filter = 0x697020696e20666f7277617264206473746970203230392e3130322e3130372e37372f33322030 X-Ascend-Data-Filter = 0x697020696e20666f72776172642064737469702036342e32342e33352e302f32342030 X-Ascend-Data-Filter = 0x697020696e20666f72776172642064737469702036362e34352e3234332e302f32342030 X-Ascend-Data-Filter = 0x697020696e2064726f702074637020647374706f7274203d203235 X-Ascend-Data-Filter = 0x697020696e20666f72776172642030 Any ideas? Thanks. -Marc
marc-ml@neoharmonix.net wrote:
Could it be something to do with the X-Ascend-Data-Filter abinary format? Perhaps a configuration option for that introduced after 1.0.1? This is the output from running radtest between the two servers with different freeradius versions (just showing the X-Ascend-Data-Filter stuff since everything else is the same):
The parsing & printing code for Ascend data filters (src/lib/filters.c) hasn't changed in 1.0.0 to 1.0.4. So that can't be the source of the problem.
* 1.0.1 --> 1.0.4 : X-Ascend-Data-Filter = "?? out drop" X-Ascend-Data-Filter = 0x 69 70 20 69 6e 20 66 6f 72 77 61 72 64 20 64 73 74 69 70 20 32 30 39 2e 31 30 32 2e 31 30 37 2e 37 37 2f 33 32 20 30
Which is the *ascii* version of the data, and not the packed Ascend format.
* 1.0.4 --> 1.0.1 : X-Ascend-Data-Filter = 0x0101010000000000000000000000060100000000000000000000000000000000
Which looks like it might be the correct (but weird) format.
* 1.0.4 --> 1.0.4 : X-Ascend-Data-Filter = 0x697020696e20666f72776172642074637020657374
And again, with the text strings.
Any ideas? Thanks.
It looks like the dictionaries you're using for 1.0.4 have the X-Ascend0Data-Filter as type "octets", and not type "abinary". Are you sure you didn't edit the dictionaries? Are you sure there's no other attribute 242, of type "octets"? Are you sure you're using the 1.0.4 dictionaries with 1.0.4? Alan DeKok.
Problem solved. I had been compiling versions > 1.0.1 without enabling Ascend binary support.
Are you sure you didn't edit the dictionaries? Are you sure there's no other attribute 242, of type "octets"? Are you sure you're using the 1.0.4 dictionaries with 1.0.4?
I was in the process of removing and reinstalling freeradius, on what was already a fresh install on a new sever. to make absolute sure of all of that when I noticed a Gentoo local use flag, "frascend", which appears to have been introduced in Gentoo freeradius ebuilds after version 1.0.1 which changed the "default" behavior for later versions to not enable what was previously enabled "by default". Much thanks. -Marc
On Tue, Aug 23, 2005 at 06:30:16PM -0700, marc-ml@neoharmonix.net wrote:
Problem solved. I had been compiling versions > 1.0.1 without enabling Ascend binary support.
Are you sure you didn't edit the dictionaries? Are you sure there's no other attribute 242, of type "octets"? Are you sure you're using the 1.0.4 dictionaries with 1.0.4?
I was in the process of removing and reinstalling freeradius, on what was already a fresh install on a new sever. to make absolute sure of all of that when I noticed a Gentoo local use flag, "frascend", which appears to have been introduced in Gentoo freeradius ebuilds after version 1.0.1 which changed the "default" behavior for later versions to not enable what was previously enabled "by default".
frascend in the 1.0.4 ebuild seems to behave the same way as in my freeradius 0.9.0 ebuilds. I don't see that they changed the meaning of that use flag from my submitted ebuild over the 1.0.X versions to the 1.0.4 version. The defualt behavior is and was to only compile with-ascend-binary if the frascend use flag is present. Oliver.
participants (4)
-
Alan DeKok -
marc-ml＠neoharmonix.net -
Nicolas Baradakis -
Oliver Graf