Altering the RADIUS dictionary files...
Hey everyone, I attempted at first to post this issue in openser's mailing list but have failed to get a reply and thus I am trying in freeradius's as I hope there are people here with similar experience. OpenSER is a SIP Proxy tool and I integrated it to send accounting records to a freeradius deployed server. To do that I had to patch a source copy of freeradius and provide both the radius server and client the appropriate dictionary files. What I would like is the ability to extend the formal SIP ATTRIBUTES with my own set. And so, I tried adding myself some custom attributes to both dictionary files, the one on the freeradius server and the other on openser's radiusclient-ng server and tried for example this: ATTRIBUTE Sip-Src-IP 900 string ATTRIBUTE Sip-Src-Port 901 string ATTRIBUTE Sip-Hdr-Contact 902 string ATTRIBUTE Sip-Hdr-UA 903 string ATTRIBUTE Sip-Hdr-From 904 string ATTRIBUTE Sip-Hdr-Media 905 string But this fails to work, openser/radiusclient-ng is sending accounting records still but specifically without the above attributes even when they are defined in both server and client's dictionary.sip files. My question is why, and how is it possible to do that? And the second question, is there a more extensive dictionary.sip file? Thanks, Liri.
liran tal wrote:
What I would like is the ability to extend the formal SIP ATTRIBUTES with my own set.
Use a vendor-specific dictionary. We're trying to convince the SER people to do the same thing.
And so, I tried adding myself some custom attributes to both dictionary files, the one on the freeradius server and the other on openser's radiusclient-ng server and tried for example this:
ATTRIBUTE Sip-Src-IP 900 string
That won't work. See the documentation for why. i.e. "man dictionary" in FreeRADIUS.
My question is why, and how is it possible to do that? And the second question, is there a more extensive dictionary.sip file?
No. Create one. See the other vendor dictionaries for examples. It's not hard. Alan DeKok.
Thank you Alan, you'd probably notice my 2nd email prior to receiving yours that I found the relevant information in the manpage and hope that it'll be enough to understand and follow it to the end. In the meanwhile, waiting for your book already :) Regards, Liri. On 6/27/07, Alan DeKok <aland@deployingradius.com> wrote:
liran tal wrote:
What I would like is the ability to extend the formal SIP ATTRIBUTES with my own set.
Use a vendor-specific dictionary. We're trying to convince the SER people to do the same thing.
And so, I tried adding myself some custom attributes to both dictionary files, the one on the freeradius server and the other on openser's radiusclient-ng server and tried for example this:
ATTRIBUTE Sip-Src-IP 900 string
That won't work. See the documentation for why. i.e. "man dictionary" in FreeRADIUS.
My question is why, and how is it possible to do that? And the second question, is there a more extensive dictionary.sip file?
No. Create one.
See the other vendor dictionaries for examples. It's not hard.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I will appreciate if others can still comment on this subject as I do want to understand more thoroughly what's going on but it seems like the manpage for dictionary explains it pretty well: " The dictionaries in */usr/local/share* SHOULD NOT be edited unless you know exactly what you are doing. Changing them will most likely break your RADIUSdeployment. If you need to add new attributes, please edit the */etc/raddb/dictionary*file. It's sole purpose is to contain site-local defintions that are added by the local administrator. " On 6/27/07, liran tal <liransgarage@gmail.com> wrote:
Hey everyone,
I attempted at first to post this issue in openser's mailing list but have failed to get a reply and thus I am trying in freeradius's as I hope there are people here with similar experience.
OpenSER is a SIP Proxy tool and I integrated it to send accounting records to a freeradius deployed server. To do that I had to patch a source copy of freeradius and provide both the radius server and client the appropriate dictionary files.
What I would like is the ability to extend the formal SIP ATTRIBUTES with my own set. And so, I tried adding myself some custom attributes to both dictionary files, the one on the freeradius server and the other on openser's radiusclient-ng server and tried for example this:
ATTRIBUTE Sip-Src-IP 900 string ATTRIBUTE Sip-Src-Port 901 string ATTRIBUTE Sip-Hdr-Contact 902 string ATTRIBUTE Sip-Hdr-UA 903 string ATTRIBUTE Sip-Hdr-From 904 string ATTRIBUTE Sip-Hdr-Media 905 string
But this fails to work, openser/radiusclient-ng is sending accounting records still but specifically without the above attributes even when they are defined in both server and client's dictionary.sip files.
My question is why, and how is it possible to do that? And the second question, is there a more extensive dictionary.sip file?
Thanks, Liri.
On Wed 27 Jun 2007, liran tal wrote:
Hey everyone,
I attempted at first to post this issue in openser's mailing list but have failed to get a reply and thus I am trying in freeradius's as I hope there are people here with similar experience.
Hi Liran Basically the way both SER and openSER do RADIUS is broken. We are aware of the patches to FreeRADIUS and will not be applying them. We are working with the openSER people to clean up their RADIUS module. To that end we have forked radiusclient-ng and called in freeradius-client. The latest version of openSER works with freeradius-client as a drop-in replacement for radiusclient-ng (I wrote the patch to do so, and a slightly modified version was applied to openSER cvs). The currently released version of freeradius-client however is basically a slightly patched version of radiusclient-ng (it works on 64bit etc) We will be releasing a new version of freeradius-client in the next few days/weeks which has significant code cleanups and features an embedded mode which means you no longer need a separate config file for the radius client. The openSER radius module should to be updated to use this new embedded mode. openSER has also recently registered an Enterprise Number and it needs to be updated to use this number to send VSAs instead of non-RFC compliant RADIUS attributes. Once this work is done by openSER, it should work perfectly with FreeRADIUS Server (or any other RFC compliant RADIUS Server) without patches... Cheers -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc
participants (3)
-
Alan DeKok -
liran tal -
Peter Nixon