Hello, We were sucessfuly using regexp on keys in attr_filter module with FR 2.1.6 FreeBSD 8.0 Something like that in attrs file : "~\^\(.+\)\\.telco$" Framed-IP-Address =* ANY, Framed-IP-Netmask =* ANY, Framed-MTU =* ANY, Service-Type =* ANY, Framed-Protocol =* ANY, ERX-Virtual-Router-Name := "test", Tunnel-Type:0 =* ANY, Tunnel-Preference:0 =* ANY, Tunnel-Medium-Type:0 =* ANY, Tunnel-Client-Endpoint:0 =* ANY, Tunnel-Server-Endpoint:0 =* ANY, Tunnel-Assignment-Id:0 =* ANY, Tunnel-Client-Auth-Id:0 =* ANY, Tunnel-Server-Auth-Id:0 =* ANY, Class =* ANY After upgrading to FR 2.2.6 Freebsd 10.0, I've got the feeling that this regular expression on realm attribute does not work anymore. I've also noticed that the same regular expression still work in proxy.conf. Tue May 12 02:07:30 2015 : Debug: [suffix] Looking up realm "toto.telco" for User-Name = "test@toto.telco" Tue May 12 02:07:30 2015 : Debug: [suffix] Found realm "~^(.+)\.telco$" Tue May 12 02:07:30 2015 : Debug: [suffix] Adding Realm = "toto.telco" Tue May 12 02:07:30 2015 : Debug: [suffix] Proxying request from user test to realm ~^(.+)\.telco$ Tue May 12 02:07:30 2015 : Debug: [suffix] Preparing to proxy authentication request to realm "~^(.+)\.telco$" ... Tue May 12 02:07:30 2015 : Debug: +group post-proxy { Tue May 12 02:07:30 2015 : Debug: [attr_filter.post-proxy] expand: %{Realm} -> toto.telco Tue May 12 02:07:30 2015 : Debug: ++[attr_filter.post-proxy] = noop Tue May 12 02:07:30 2015 : Debug: +} # group post-proxy = noop After spending some time on the mailing list and the doc, I've got different ideas to solve that : 1. The new FR might not have been compile properly with pcre lib (as this was a package) (radiusd -Xv does not tell me wether this is the case or not) 2. The way regex work have change and I should fine the proper one 3. FR 3.x.x has been rewriten and should work better 4. Do not use rlm_attrs_filter and do something else (unlang ?) Could you advise ? Many thanks Thomas
After spending some time on the mailing list and the doc, I've got different ideas to solve that : 1. The new FR might not have been compile properly with pcre lib (as this was a package) (radiusd -Xv does not tell me wether this is the case or not) 2. The way regex work have change and I should fine the proper one 3. FR 3.x.x has been rewriten and should work better 4. Do not use rlm_attrs_filter and do something else (unlang ?)
Using FR 3.0.7 or newer will simplify your regex (no more excessive escaping necessary) in unlang. And it gets you off FR 2.x which is on its way to the bit graveyard. :-) Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp@jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc¹s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200.
What about regex on keys in attr_filter ? Will this work ? Le 2015-05-12 10:00, Stefan Paetow a écrit :
After spending some time on the mailing list and the doc, I've got different ideas to solve that : 1. The new FR might not have been compile properly with pcre lib (as this was a package) (radiusd -Xv does not tell me wether this is the case or not) 2. The way regex work have change and I should fine the proper one 3. FR 3.x.x has been rewriten and should work better 4. Do not use rlm_attrs_filter and do something else (unlang ?)
Using FR 3.0.7 or newer will simplify your regex (no more excessive escaping necessary) in unlang. And it gets you off FR 2.x which is on its way to the bit graveyard.
:-)
Stefan Paetow Moonshot Industry & Research Liaison Coordinator
t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp@jabber.dev.ja.net skype: stefan.paetow.janet
jisc.ac.uk
Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc¹s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.
Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Thomas, I suggest upgrade to 3.0.8. Em 11/05/2015 21:44, "Thomas Fagart" <tfagart@brozs.net> escreveu:
Hello,
We were sucessfuly using regexp on keys in attr_filter module with FR 2.1.6 FreeBSD 8.0
Something like that in attrs file :
"~\^\(.+\)\\.telco$" Framed-IP-Address =* ANY, Framed-IP-Netmask =* ANY, Framed-MTU =* ANY, Service-Type =* ANY, Framed-Protocol =* ANY, ERX-Virtual-Router-Name := "test", Tunnel-Type:0 =* ANY, Tunnel-Preference:0 =* ANY, Tunnel-Medium-Type:0 =* ANY, Tunnel-Client-Endpoint:0 =* ANY, Tunnel-Server-Endpoint:0 =* ANY, Tunnel-Assignment-Id:0 =* ANY, Tunnel-Client-Auth-Id:0 =* ANY, Tunnel-Server-Auth-Id:0 =* ANY, Class =* ANY
After upgrading to FR 2.2.6 Freebsd 10.0, I've got the feeling that this regular expression on realm attribute does not work anymore. I've also noticed that the same regular expression still work in proxy.conf.
Tue May 12 02:07:30 2015 : Debug: [suffix] Looking up realm "toto.telco" for User-Name = "test@toto.telco" Tue May 12 02:07:30 2015 : Debug: [suffix] Found realm "~^(.+)\.telco$" Tue May 12 02:07:30 2015 : Debug: [suffix] Adding Realm = "toto.telco" Tue May 12 02:07:30 2015 : Debug: [suffix] Proxying request from user test to realm ~^(.+)\.telco$ Tue May 12 02:07:30 2015 : Debug: [suffix] Preparing to proxy authentication request to realm "~^(.+)\.telco$" ... Tue May 12 02:07:30 2015 : Debug: +group post-proxy { Tue May 12 02:07:30 2015 : Debug: [attr_filter.post-proxy] expand: %{Realm} -> toto.telco Tue May 12 02:07:30 2015 : Debug: ++[attr_filter.post-proxy] = noop Tue May 12 02:07:30 2015 : Debug: +} # group post-proxy = noop
After spending some time on the mailing list and the doc, I've got different ideas to solve that : 1. The new FR might not have been compile properly with pcre lib (as this was a package) (radiusd -Xv does not tell me wether this is the case or not) 2. The way regex work have change and I should fine the proper one 3. FR 3.x.x has been rewriten and should work better 4. Do not use rlm_attrs_filter and do something else (unlang ?)
Could you advise ?
Many thanks
Thomas
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On May 11, 2015, at 8:43 PM, Thomas Fagart <tfagart@brozs.net> wrote:
We were sucessfuly using regexp on keys in attr_filter module with FR 2.1.6 FreeBSD 8.0
Something like that in attrs file :
"~\^\(.+\)\\.telco$" Framed-IP-Address =* ANY,
I don't think that ever worked. You can't put a regex into the key field for the attr_filter module. The matching for keys is done via string equality.
After upgrading to FR 2.2.6 Freebsd 10.0, I've got the feeling that this regular expression on realm attribute does not work anymore. I've also noticed that the same regular expression still work in proxy.conf.
They're documented as working in proxy.conf.
After spending some time on the mailing list and the doc, I've got different ideas to solve that : 1. The new FR might not have been compile properly with pcre lib (as this was a package) (radiusd -Xv does not tell me wether this is the case or not) 2. The way regex work have change and I should fine the proper one 3. FR 3.x.x has been rewriten and should work better 4. Do not use rlm_attrs_filter and do something else (unlang ?)
5. The attrs file never did what you think it did. I've checked the 2.1.6 source. The matching for keys is done via string equality. It has *no* regex capability. Alan DeKok.
Thanks a lot for your answer, so this is not a feature :-). (I don't know how this could have worked then :-(), I could send trace if you want, because this has been working for many years with more than 20 requests /secondes). We will try to code such a module in perl. Is there any other way we could do that (eg regex on keys) using existing modules ? Thanks Thomas Le 2015-05-12 13:40, Alan DeKok a écrit :
On May 11, 2015, at 8:43 PM, Thomas Fagart <tfagart@brozs.net> wrote:
We were sucessfuly using regexp on keys in attr_filter module with FR 2.1.6 FreeBSD 8.0
Something like that in attrs file :
"~\^\(.+\)\\.telco$" Framed-IP-Address =* ANY,
I don't think that ever worked. You can't put a regex into the key field for the attr_filter module. The matching for keys is done via string equality.
After upgrading to FR 2.2.6 Freebsd 10.0, I've got the feeling that this regular expression on realm attribute does not work anymore. I've also noticed that the same regular expression still work in proxy.conf.
They're documented as working in proxy.conf.
After spending some time on the mailing list and the doc, I've got different ideas to solve that : 1. The new FR might not have been compile properly with pcre lib (as this was a package) (radiusd -Xv does not tell me wether this is the case or not) 2. The way regex work have change and I should fine the proper one 3. FR 3.x.x has been rewriten and should work better 4. Do not use rlm_attrs_filter and do something else (unlang ?)
5. The attrs file never did what you think it did.
I've checked the 2.1.6 source. The matching for keys is done via string equality. It has *no* regex capability.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Tue, May 12, 2015 at 02:53:23PM +0200, Thomas Fagart wrote:
We will try to code such a module in perl.
Probably slow.
Is there any other way we could do that (eg regex on keys) using existing modules ?
unlang. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
On May 12, 2015, at 8:53 AM, Thomas Fagart <tfagart@brozs.net> wrote:
Thanks a lot for your answer, so this is not a feature :-). (I don't know how this could have worked then :-(), I could send trace if you want, because this has been working for many years with more than 20 requests /secondes).
You probably had the Realm attribute set to the string "~\^\(.+\)\\.telco$". Which mean that string matching worked. Or, someone made local patches to the server.
We will try to code such a module in perl.
Is there any other way we could do that (eg regex on keys) using existing modules ?
Perhaps you could explain the goal, instead of talking about a particular solution. You could put the regular expression into unlang, and then go from there: if (Realm =~ /^(.+)\.telco$/) { update request { My-Filter-Realm := "DEFAULT" } } else { update request { My-Filter-Realm := "%{Realm}" } } Then add My-Filter-Realm to raddb/dictionary as a "string" attribute. And make the attr_filter module key off of My-Filter-Realm instead of Realm. Alan DeKok.
Many thanks that will do the trick ! Sorry not to have been clear enough about my needs. Thomas Le 2015-05-12 15:38, Alan DeKok a écrit :
On May 12, 2015, at 8:53 AM, Thomas Fagart <tfagart@brozs.net> wrote:
Thanks a lot for your answer, so this is not a feature :-). (I don't know how this could have worked then :-(), I could send trace if you want, because this has been working for many years with more than 20 requests /secondes).
You probably had the Realm attribute set to the string "~\^\(.+\)\\.telco$". Which mean that string matching worked.
Or, someone made local patches to the server.
We will try to code such a module in perl.
Is there any other way we could do that (eg regex on keys) using existing modules ?
Perhaps you could explain the goal, instead of talking about a particular solution.
You could put the regular expression into unlang, and then go from there:
if (Realm =~ /^(.+)\.telco$/) { update request { My-Filter-Realm := "DEFAULT" } } else { update request { My-Filter-Realm := "%{Realm}" } }
Then add My-Filter-Realm to raddb/dictionary as a "string" attribute. And make the attr_filter module key off of My-Filter-Realm instead of Realm.
Alan DeKok.
Sorry to answer to this post so late : About your last post :
You probably had the Realm attribute set to the string "~\^\(.+\)\\.telco$". Which mean that string matching worked.
You were right, by having a look at the old log, that was how it was working. But then could we say that this behaviour has change between 2.1.6 and 2.2.x ? (now the "real" real is kept by freeradius instead of the "matched" one in proxy.conf ?). Thanks Thomas -----Message d'origine----- De : Thomas Fagart [mailto:tfagart@brozs.net] Envoyé : mardi 12 mai 2015 16:57 À : Alan DeKok Cc : FreeRadius users mailing list Objet : Re: [Attrs Regex] Many thanks that will do the trick ! Sorry not to have been clear enough about my needs. Thomas Le 2015-05-12 15:38, Alan DeKok a écrit :
On May 12, 2015, at 8:53 AM, Thomas Fagart <tfagart@brozs.net> wrote:
Thanks a lot for your answer, so this is not a feature :-). (I don't know how this could have worked then :-(), I could send trace if you want, because this has been working for many years with more than 20 requests /secondes).
You probably had the Realm attribute set to the string "~\^\(.+\)\\.telco$". Which mean that string matching worked.
Or, someone made local patches to the server.
We will try to code such a module in perl.
Is there any other way we could do that (eg regex on keys) using existing modules ?
Perhaps you could explain the goal, instead of talking about a particular solution.
You could put the regular expression into unlang, and then go from there:
if (Realm =~ /^(.+)\.telco$/) { update request { My-Filter-Realm := "DEFAULT" } } else { update request { My-Filter-Realm := "%{Realm}" } }
Then add My-Filter-Realm to raddb/dictionary as a "string" attribute. And make the attr_filter module key off of My-Filter-Realm instead of Realm.
Alan DeKok.
participants (5)
-
Alan DeKok -
Jorge Pereira -
Matthew Newton -
Stefan Paetow -
Thomas Fagart