Option82 - question about sending sub-options
I have a question about sending Option82 - I am setting sub-options 1,2 and 9 in response to DISCOVER: update reply { &DHCP-Relay-Remote-Id := &request:DHCP-Relay-Remote-Id &DHCP-Relay-Circuit-Id := &request:DHCP-Relay-Circuit-Id &DHCP-Vendor-Specific-Information := &request:DHCP-Vendor-Specific-Information } and see it being set in the freeradius log: (1702) DHCP-Relay-Remote-Id := 0xacdb489f87af (1702) DHCP-Relay-Circuit-Id := 0xacdb489f87af (1702) DHCP-Vendor-Specific-Information := 0x0000118b060104010203010000061b34030a444d5a2d434f532d3032010e4554492d5250442d504f52542d300207756e69636173740e07000100000079000d040a666f07 and also in the packet capture of our OFFER packet: Agent-Information (82), length 8: Circuit-ID SubOption 1, length 6: M-,M-[HM-^_M-^GM-/ Agent-Information (82), length 8: Remote-ID SubOption 2, length 6: M-,M-[HM-^_M-^GM-/ Agent-Information (82), length 70: Unknown SubOption 9, length 68: 0x0000: 0000 118b 0601 0401 0203 0100 0006 1b34 0x0010: 030a 444d 5a2d 434f 532d 3032 010e 4554 0x0020: 492d 5250 442d 504f 5254 2d30 0207 756e 0x0030: 6963 6173 740e 0700 0100 0000 7900 0d04 0x0040: 0a66 6f07 END (255), length 0 it all looks ok to me. However the relay agent vendor requires the sub-options to be set in one Option 82 block (like they send it to us in DISCOVER): Agent-Information (82), length 86: Circuit-ID SubOption 1, length 6: M-,M-[HM-^_M-^GM-/ Remote-ID SubOption 2, length 6: M-,M-[HM-^_M-^GM-/ Unknown SubOption 9, length 68: 0x0000: 0000 118b 0601 0401 0203 0100 0006 1b34 0x0010: 030a 444d 5a2d 434f 532d 3032 010e 4554 0x0020: 492d 5250 442d 504f 5254 2d30 0207 756e 0x0030: 6963 6173 740e 0700 0100 0000 7900 0d04 0x0040: 0a66 6f07 END (255), length 0 Is this possible (or am I doing something wrong), we're using freeradius v3.2.3 ? -- Ludo
On Sep 18, 2025, at 8:55 AM, Ľudovít Mikula <ludovit.mikula@mikori.sk> wrote:
I have a question about sending Option82 - I am setting sub-options 1,2 and 9 in response to DISCOVER:
update reply { &DHCP-Relay-Remote-Id := &request:DHCP-Relay-Remote-Id &DHCP-Relay-Circuit-Id := &request:DHCP-Relay-Circuit-Id &DHCP-Vendor-Specific-Information := &request:DHCP-Vendor-Specific-Information }
and see it being set in the freeradius log:
(1702) DHCP-Relay-Remote-Id := 0xacdb489f87af (1702) DHCP-Relay-Circuit-Id := 0xacdb489f87af (1702) DHCP-Vendor-Specific-Information := 0x0000118b060104010203010000061b34030a444d5a2d434f532d3032010e4554492d5250442d504f52542d300207756e69636173740e07000100000079000d040a666f07 ... However the relay agent vendor requires the sub-options to be set in one Option 82 block (like they send it to us in DISCOVER): .. Is this possible (or am I doing something wrong), we're using freeradius v3.2.3 ?
We can push a fix, but it will have to go into 3.2.9. Alan DeKok.
Thank you Alan! Freeradius 3.2.9 is ok. (I can build from 3.2.x branch until 3.2.9 is released). Ludo On 18. 9. 2025 16:37, Alan DeKok via Freeradius-Users wrote:
On Sep 18, 2025, at 8:55 AM, Ľudovít Mikula <ludovit.mikula@mikori.sk> wrote:
I have a question about sending Option82 - I am setting sub-options 1,2 and 9 in response to DISCOVER:
update reply { &DHCP-Relay-Remote-Id := &request:DHCP-Relay-Remote-Id &DHCP-Relay-Circuit-Id := &request:DHCP-Relay-Circuit-Id &DHCP-Vendor-Specific-Information := &request:DHCP-Vendor-Specific-Information }
and see it being set in the freeradius log:
(1702) DHCP-Relay-Remote-Id := 0xacdb489f87af (1702) DHCP-Relay-Circuit-Id := 0xacdb489f87af (1702) DHCP-Vendor-Specific-Information := 0x0000118b060104010203010000061b34030a444d5a2d434f532d3032010e4554492d5250442d504f52542d300207756e69636173740e07000100000079000d040a666f07 ... However the relay agent vendor requires the sub-options to be set in one Option 82 block (like they send it to us in DISCOVER): .. Is this possible (or am I doing something wrong), we're using freeradius v3.2.3 ?
We can push a fix, but it will have to go into 3.2.9.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Ľudovít Mikula Mikori s.r.o ------------------------ Fatranská 3100/4 01008 Žilina Slovenská Republika ------------------------ ... aby korenie chutilo, ako má ... ------------------------ Web: https://www.mikori.sk/ E-Shop: https://www.cerstvekorenie.sk/ E-mail: ludovit.mikula@mikori.sk Facebook: https://www.facebook.com/mikori.korenie/
Hi Alan, is there any estimate when it might land in 3.2.x branch? Ludo On 18. 9. 2025 16:37, Alan DeKok via Freeradius-Users wrote:
On Sep 18, 2025, at 8:55 AM, Ľudovít Mikula <ludovit.mikula@mikori.sk> wrote:
I have a question about sending Option82 - I am setting sub-options 1,2 and 9 in response to DISCOVER:
update reply { &DHCP-Relay-Remote-Id := &request:DHCP-Relay-Remote-Id &DHCP-Relay-Circuit-Id := &request:DHCP-Relay-Circuit-Id &DHCP-Vendor-Specific-Information := &request:DHCP-Vendor-Specific-Information }
and see it being set in the freeradius log:
(1702) DHCP-Relay-Remote-Id := 0xacdb489f87af (1702) DHCP-Relay-Circuit-Id := 0xacdb489f87af (1702) DHCP-Vendor-Specific-Information := 0x0000118b060104010203010000061b34030a444d5a2d434f532d3032010e4554492d5250442d504f52542d300207756e69636173740e07000100000079000d040a666f07 ... However the relay agent vendor requires the sub-options to be set in one Option 82 block (like they send it to us in DISCOVER): .. Is this possible (or am I doing something wrong), we're using freeradius v3.2.3 ?
We can push a fix, but it will have to go into 3.2.9.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Nick looked into it, it works in 3.2.8.
On Sep 25, 2025, at 2:33 PM, Ľudovít Mikula via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
Hi Alan,
is there any estimate when it might land in 3.2.x branch?
Ludo
On 18. 9. 2025 16:37, Alan DeKok via Freeradius-Users wrote:
On Sep 18, 2025, at 8:55 AM, Ľudovít Mikula <ludovit.mikula@mikori.sk> wrote:
I have a question about sending Option82 - I am setting sub-options 1,2 and 9 in response to DISCOVER:
update reply { &DHCP-Relay-Remote-Id := &request:DHCP-Relay-Remote-Id &DHCP-Relay-Circuit-Id := &request:DHCP-Relay-Circuit-Id &DHCP-Vendor-Specific-Information := &request:DHCP-Vendor-Specific-Information }
and see it being set in the freeradius log:
(1702) DHCP-Relay-Remote-Id := 0xacdb489f87af (1702) DHCP-Relay-Circuit-Id := 0xacdb489f87af (1702) DHCP-Vendor-Specific-Information := 0x0000118b060104010203010000061b34030a444d5a2d434f532d3032010e4554492d5250442d504f52542d300207756e69636173740e07000100000079000d040a666f07 ... However the relay agent vendor requires the sub-options to be set in one Option 82 block (like they send it to us in DISCOVER): .. Is this possible (or am I doing something wrong), we're using freeradius v3.2.3 ?
We can push a fix, but it will have to go into 3.2.9. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hmm are there any rules to be followed when setting the suboptions, does the order of setting them in reply make any difference? I've tried now with 3.2.8 (official docker image - freeradius/freeradius-server:3.2.8) but still see the same, it's split into 3 Option82 attributes from what I can see in the packet capture. Ludo On 25. 9. 2025 20:46, Alan DeKok wrote:
Nick looked into it, it works in 3.2.8.
On Sep 25, 2025, at 2:33 PM, Ľudovít Mikula via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
Hi Alan,
is there any estimate when it might land in 3.2.x branch?
Ludo
On 18. 9. 2025 16:37, Alan DeKok via Freeradius-Users wrote:
On Sep 18, 2025, at 8:55 AM, Ľudovít Mikula <ludovit.mikula@mikori.sk> wrote:
I have a question about sending Option82 - I am setting sub-options 1,2 and 9 in response to DISCOVER:
update reply { &DHCP-Relay-Remote-Id := &request:DHCP-Relay-Remote-Id &DHCP-Relay-Circuit-Id := &request:DHCP-Relay-Circuit-Id &DHCP-Vendor-Specific-Information := &request:DHCP-Vendor-Specific-Information }
and see it being set in the freeradius log:
(1702) DHCP-Relay-Remote-Id := 0xacdb489f87af (1702) DHCP-Relay-Circuit-Id := 0xacdb489f87af (1702) DHCP-Vendor-Specific-Information := 0x0000118b060104010203010000061b34030a444d5a2d434f532d3032010e4554492d5250442d504f52542d300207756e69636173740e07000100000079000d040a666f07 ... However the relay agent vendor requires the sub-options to be set in one Option 82 block (like they send it to us in DISCOVER): .. Is this possible (or am I doing something wrong), we're using freeradius v3.2.3 ?
We can push a fix, but it will have to go into 3.2.9. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Ľudovít Mikula Mikori s.r.o ------------------------ Fatranská 3100/4 01008 Žilina Slovenská Republika ------------------------ ... aby korenie chutilo, ako má ... ------------------------ Web: https://www.mikori.sk/ E-Shop: https://www.cerstvekorenie.sk/ E-mail: ludovit.mikula@mikori.sk Facebook: https://www.facebook.com/mikori.korenie/
On 25. 9. 2025 20:46, Alan DeKok wrote:
Nick looked into it, it works in 3.2.8.
I have created a minimal config and re-run the scenario. You can see that the suboption 1 and 2 are merged into one Option82 attribute and suboption 9 is added into a separate one. Took a capture with tcpdump, here is print of the capture: $ tcpdump -vv -A -r freeradius.pcap reading from file freeradius.pcap, link-type EN10MB (Ethernet), snapshot length 262144 07:38:06.743239 IP (tos 0x0, ttl 64, id 2028, offset 0, flags [none], proto UDP (17), length 390) 10.42.0.2.bootps > 10.20.24.1.bootps: [bad udp cksum 0x2dc4 -> 0x8cd4!] BOOTP/DHCP, Reply, length 362, hops 1, xid 0x35c130, Flags [Broadcast] (0x8000) Gateway-IP 10.20.24.1 Client-Ethernet-Address ac:db:48:9f:87:af (oui Unknown) Vendor-rfc1048 Extensions Magic Cookie 0x63825363 DHCP-Message (53), length 1: Offer Server-ID (54), length 4: 10.42.0.3 MSZ (57), length 2: 1500 Client-ID (61), length 15: hardware-type 255, 48:9f:87:af:00:03:00:01:ac:db:48:9f:87:af Agent-Information (82), length 16: Circuit-ID SubOption 1, length 6: M-,M-[HM-^_M-^GM-/ Remote-ID SubOption 2, length 6: M-,M-[HM-^_M-^GM-/ Agent-Information (82), length 70: Unknown SubOption 9, length 68: 0x0000: 0000 118b 0601 0401 0203 0100 0006 1b34 0x0010: 030a 444d 5a2d 434f 532d 3032 010e 4554 0x0020: 492d 5250 442d 504f 5254 2d30 0207 756e 0x0030: 6963 6173 740e 0700 0100 0000 7900 0d04 0x0040: 0a66 6f07 Debug output from freeradius: FreeRADIUS Version 3.2.8 Copyright (C) 1999-2025 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT FreeRADIUS is developed, maintained, and supported by InkBridge Networks. For commercial support, please email sales@inkbridgenetworks.com https://inkbridgenetworks.com/ Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/dictionary including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/mods-enabled/ including configuration file /etc/freeradius/mods-enabled/unpack including configuration file /etc/freeradius/mods-enabled/echo including configuration file /etc/freeradius/mods-enabled/expiration including configuration file /etc/freeradius/mods-enabled/radutmp including configuration file /etc/freeradius/mods-enabled/detail including configuration file /etc/freeradius/mods-enabled/logintime including configuration file /etc/freeradius/mods-enabled/attr_filter including configuration file /etc/freeradius/mods-enabled/totp including configuration file /etc/freeradius/mods-enabled/digest including configuration file /etc/freeradius/mods-enabled/realm including configuration file /etc/freeradius/mods-enabled/files including configuration file /etc/freeradius/mods-enabled/always including configuration file /etc/freeradius/mods-enabled/exec including configuration file /etc/freeradius/mods-enabled/unix including configuration file /etc/freeradius/mods-enabled/detail.log including configuration file /etc/freeradius/mods-enabled/sradutmp including configuration file /etc/freeradius/mods-enabled/soh including configuration file /etc/freeradius/mods-enabled/chap including configuration file /etc/freeradius/mods-enabled/ntlm_auth including configuration file /etc/freeradius/mods-enabled/expr including configuration file /etc/freeradius/mods-enabled/mschap including configuration file /etc/freeradius/mods-enabled/replicate including configuration file /etc/freeradius/mods-enabled/linelog including configuration file /etc/freeradius/mods-enabled/utf8 including configuration file /etc/freeradius/mods-enabled/dynamic_clients including configuration file /etc/freeradius/mods-enabled/proxy_rate_limit including configuration file /etc/freeradius/mods-enabled/date including configuration file /etc/freeradius/mods-enabled/pap including configuration file /etc/freeradius/mods-enabled/passwd including files in directory /etc/freeradius/policy.d/ including configuration file /etc/freeradius/policy.d/eap including configuration file /etc/freeradius/policy.d/operator-name including configuration file /etc/freeradius/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/policy.d/debug including configuration file /etc/freeradius/policy.d/dhcp including configuration file /etc/freeradius/policy.d/abfab-tr including configuration file /etc/freeradius/policy.d/cui including configuration file /etc/freeradius/policy.d/rfc7542 including configuration file /etc/freeradius/policy.d/filter including configuration file /etc/freeradius/policy.d/accounting including configuration file /etc/freeradius/policy.d/control including configuration file /etc/freeradius/policy.d/canonicalization including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/dhcp main { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 proxy_dedup_window = 1 cleanup_delay = 5 max_requests = 16384 max_fds = 512 postauth_client_lost = no pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 delay_proxy_rejects = no status_server = yes require_message_authenticator = "auto" limit_proxy_state = "auto" } unlang { group_stop_return = no policy_stop_return = no } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { nonblock = no ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 900 } } Shared secret for client localhost is short, and likely can be broken by an attacker. client localhost_ipv6 { ipv6addr = ::1 secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Shared secret for client localhost_ipv6 is short, and likely can be broken by an attacker. Debug state unknown (cap_sys_ptrace capability not set) Configuration version: b0ce-a96a-deff-4223 systemd watchdog is disabled radiusd: #### Instantiating modules #### modules { # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/mods-enabled/unpack # Loaded module rlm_exec # Loading module "echo" from file /etc/freeradius/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/mods-enabled/expiration # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/freeradius/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_detail # Loading module "detail" from file /etc/freeradius/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no dates_as_integer = no escape_filenames = no log_packet_header = no } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.coa" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.coa { filename = "/etc/freeradius/mods-config/attr_filter/coa" key = "%{User-Name}" relaxed = no } # Loaded module rlm_totp # Loading module "totp" from file /etc/freeradius/mods-enabled/totp totp { time_step = 30 otp_length = 6 lookback_steps = 1 lookback_interval = 30 lookforward_steps = 0 } # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/mods-enabled/digest # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "bangpath" from file /etc/freeradius/mods-enabled/realm realm bangpath { format = "prefix" delimiter = "!" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/mods-enabled/files files { filename = "/etc/freeradius/mods-config/files/authorize" acctusersfile = "/etc/freeradius/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/mods-config/files/pre-proxy" } # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loading module "exec" from file /etc/freeradius/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Creating attribute Unix-Group # Loading module "auth_log" from file /etc/freeradius/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no dates_as_integer = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no dates_as_integer = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no dates_as_integer = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no dates_as_integer = no escape_filenames = no log_packet_header = no } # Loading module "sradutmp" from file /etc/freeradius/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/mods-enabled/chap # Loading module "ntlm_auth" from file /etc/freeradius/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/mods-enabled/replicate # Loaded module rlm_linelog # Loading module "linelog" from file /etc/freeradius/mods-enabled/linelog linelog { filename = "/var/log/freeradius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/freeradius/mods-enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/mods-enabled/utf8 # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/mods-enabled/dynamic_clients # Loaded module rlm_proxy_rate_limit # Loading module "proxy_rate_limit" from file /etc/freeradius/mods-enabled/proxy_rate_limit proxy_rate_limit { max_entries = 2048 idle_timeout = 10 num_subtables = 256 window = 1 } # Loaded module rlm_date # Loading module "date" from file /etc/freeradius/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loading module "wispr2date" from file /etc/freeradius/mods-enabled/date date wispr2date { format = "%Y-%m-%dT%H:%M:%S" utc = no } # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } instantiate { } # Instantiating module "expiration" from file /etc/freeradius/mods-enabled/expiration # Instantiating module "detail" from file /etc/freeradius/mods-enabled/detail # Instantiating module "logintime" from file /etc/freeradius/mods-enabled/logintime # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/accounting_response # Instantiating module "attr_filter.coa" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/coa # Instantiating module "totp" from file /etc/freeradius/mods-enabled/totp # Instantiating module "IPASS" from file /etc/freeradius/mods-enabled/realm # Instantiating module "suffix" from file /etc/freeradius/mods-enabled/realm # Instantiating module "bangpath" from file /etc/freeradius/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/freeradius/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/freeradius/mods-enabled/realm # Instantiating module "files" from file /etc/freeradius/mods-enabled/files reading pairlist file /etc/freeradius/mods-config/files/authorize reading pairlist file /etc/freeradius/mods-config/files/accounting reading pairlist file /etc/freeradius/mods-config/files/pre-proxy # Instantiating module "reject" from file /etc/freeradius/mods-enabled/always # Instantiating module "fail" from file /etc/freeradius/mods-enabled/always # Instantiating module "ok" from file /etc/freeradius/mods-enabled/always # Instantiating module "handled" from file /etc/freeradius/mods-enabled/always # Instantiating module "invalid" from file /etc/freeradius/mods-enabled/always # Instantiating module "userlock" from file /etc/freeradius/mods-enabled/always # Instantiating module "notfound" from file /etc/freeradius/mods-enabled/always # Instantiating module "noop" from file /etc/freeradius/mods-enabled/always # Instantiating module "updated" from file /etc/freeradius/mods-enabled/always # Instantiating module "auth_log" from file /etc/freeradius/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "mschap" from file /etc/freeradius/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "linelog" from file /etc/freeradius/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/freeradius/mods-enabled/linelog # Instantiating module "proxy_rate_limit" from file /etc/freeradius/mods-enabled/proxy_rate_limit # Instantiating module "pap" from file /etc/freeradius/mods-enabled/pap # Instantiating module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf } # server server dhcp { # from file /etc/freeradius/sites-enabled/dhcp # Loading dhcp DHCP-Discover {...} Compiling dhcp DHCP-Discover for attr DHCP-Message-Type # Loading dhcp DHCP-Request {...} Compiling dhcp DHCP-Request for attr DHCP-Message-Type # Loading dhcp DHCP-Decline {...} Compiling dhcp DHCP-Decline for attr DHCP-Message-Type # Loading dhcp DHCP-Inform {...} Compiling dhcp DHCP-Inform for attr DHCP-Message-Type # Loading dhcp DHCP-Release {...} Compiling dhcp DHCP-Release for attr DHCP-Message-Type # Loading dhcp DHCP-Lease-Query {...} Compiling dhcp DHCP-Lease-Query for attr DHCP-Message-Type } # server dhcp radiusd: #### Opening IP addresses and Ports #### listen { type = "dhcp" ipaddr = 0.0.0.0 port = 67 performance { skip_duplicate_checks = no } src_ipaddr = 127.0.0.1 } Listening on dhcp interface eth0 address * port 67 bound to server dhcp Ready to process requests (0) Received code 1025 Id 3522864 from 10.42.0.2:68 to 10.42.0.2:67 length 354 (0) DHCP-Opcode = Client-Message (0) DHCP-Hardware-Type = Ethernet (0) DHCP-Hardware-Address-Length = 6 (0) DHCP-Hop-Count = 1 (0) DHCP-Transaction-Id = 3522864 (0) DHCP-Number-of-Seconds = 0 (0) DHCP-Flags = Broadcast (0) DHCP-Client-IP-Address = 0.0.0.0 (0) DHCP-Your-IP-Address = 0.0.0.0 (0) DHCP-Server-IP-Address = 0.0.0.0 (0) DHCP-Gateway-IP-Address = 10.20.24.1 (0) DHCP-Client-Hardware-Address = ac:db:48:9f:87:af (0) DHCP-Message-Type = DHCP-Discover (0) DHCP-DHCP-Maximum-Msg-Size = 1500 (0) DHCP-Client-Identifier = 0xff489f87af00030001acdb489f87af (0) DHCP-Relay-Circuit-Id = 0xacdb489f87af (0) DHCP-Relay-Remote-Id = 0xacdb489f87af (0) DHCP-Vendor-Specific-Information = 0x0000118b060104010203010000061b34030a444d5a2d434f532d3032010e4554492d5250442d504f52542d300207756e69636173740e07000100000079000d040a666f07 (0) DHCP-Network-Subnet = 10.20.24.1/32 Trying sub-section dhcp DHCP-Discover {...} (0) dhcp DHCP-Discover { (0) update control { (0) &DHCP-DHCP-Server-Identifier = 10.42.0.3 (0) } # update control = noop (0) update reply { (0) Packet-Dst-Port = 67 (0) &DHCP-Message-Type = DHCP-Offer (0) &DHCP-DHCP-Server-Identifier := 10.42.0.3 (0) &DHCP-Relay-Remote-Id := &request:DHCP-Relay-Remote-Id -> 0xacdb489f87af (0) &DHCP-Relay-Circuit-Id := &request:DHCP-Relay-Circuit-Id -> 0xacdb489f87af (0) &DHCP-Vendor-Specific-Information := &request:DHCP-Vendor-Specific-Information -> 0x0000118b060104010203010000061b34030a444d5a2d434f532d3032010e4554492d5250442d504f52542d300207756e69636173740e07000100000079000d040a666f07 (0) } # update reply = noop (0) } # dhcp DHCP-Discover = noop (0) DHCP: Reply will be unicast to giaddr from original packet (0) Sent code 1026 Id 3522864 from 10.42.0.2:67 to 10.20.24.1:67 length 0 (0) DHCP-Relay-IP-Address = 10.20.24.1 (0) DHCP-Client-Identifier = 0xff489f87af00030001acdb489f87af (0) DHCP-Message-Type = DHCP-Offer (0) DHCP-DHCP-Server-Identifier := 10.42.0.3 (0) DHCP-Relay-Remote-Id := 0xacdb489f87af (0) DHCP-Relay-Circuit-Id := 0xacdb489f87af (0) DHCP-Vendor-Specific-Information := 0x0000118b060104010203010000061b34030a444d5a2d434f532d3032010e4554492d5250442d504f52542d300207756e69636173740e07000100000079000d040a666f07 (0) DHCP-DHCP-Maximum-Msg-Size = 1500 (0) DHCP-Opcode = Server-Message (0) DHCP-Hardware-Type = Ethernet (0) DHCP-Hardware-Address-Length = 6 (0) DHCP-Hop-Count = 1 (0) DHCP-Transaction-Id = 3522864 (0) DHCP-Flags = Broadcast (0) DHCP-Client-IP-Address = 0.0.0.0 (0) DHCP-Gateway-IP-Address = 10.20.24.1 (0) DHCP-Client-Hardware-Address = ac:db:48:9f:87:af (0) Finished request (0) Cleaning up request packet ID 3522864 with timestamp +190 due to done Ready to process requests
On Sep 26, 2025, at 3:48 AM, Ľudovít Mikula via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
On 25. 9. 2025 20:46, Alan DeKok wrote:
Nick looked into it, it works in 3.2.8.
I have created a minimal config and re-run the scenario. You can see that the suboption 1 and 2 are merged into one Option82 attribute and suboption 9 is added into a separate one.
We'll take another look at it. Alan DeKok.
On 26/09/2025 08:48, Ľudovít Mikula via Freeradius-Users wrote:
I have created a minimal config and re-run the scenario. You can see that the suboption 1 and 2 are merged into one Option82 attribute and suboption 9 is added into a separate one.
Can you share your minimal config please. All the tests I have done so far have the entire option 82 data encoded as a single instance with the sub options correctly nested within that option. Nick -- Nick Porter
Sure thing. I have attached the sites-available/dhcp file, the docker-compose I'm using to start it and the request I'm using with dhcpclient. There is also the freeradius log and the packet capture for convenience. Let me know if you need anything else. Ludo On 26. 9. 2025 13:11, Nick Porter wrote:
On 26/09/2025 08:48, Ľudovít Mikula via Freeradius-Users wrote:
I have created a minimal config and re-run the scenario. You can see that the suboption 1 and 2 are merged into one Option82 attribute and suboption 9 is added into a separate one.
Can you share your minimal config please.
All the tests I have done so far have the entire option 82 data encoded as a single instance with the sub options correctly nested within that option.
Nick
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 26/09/2025 12:32, Ľudovít Mikula via Freeradius-Users wrote:
I have attached the sites-available/dhcp file, the docker-compose I'm using to start it and the request I'm using with dhcpclient.
There is also the freeradius log and the packet capture for convenience.
Thank you I believe the issue is now addressed in the latest code in the 3.2.x branch. If you're using Docker then the freeradius/freeradius-dev images on Docker Hub are built from the 3.2.x branch whenever the branch is updated, so if you use one of those images as your base, then that will have the latest code. Nick -- Nick Porter
Thank you Nick! I'll give it a go and report back. Ludo On 26. 9. 2025 16:51, Nick Porter wrote:
On 26/09/2025 12:32, Ľudovít Mikula via Freeradius-Users wrote:
I have attached the sites-available/dhcp file, the docker-compose I'm using to start it and the request I'm using with dhcpclient.
There is also the freeradius log and the packet capture for convenience.
Thank you
I believe the issue is now addressed in the latest code in the 3.2.x branch.
If you're using Docker then the freeradius/freeradius-dev images on Docker Hub are built from the 3.2.x branch whenever the branch is updated, so if you use one of those images as your base, then that will have the latest code.
Nick
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Works like a charm! Thank you again Nick for making the fix so fast, much appreciated! Ludo On 26. 9. 2025 17:11, Ľudovít Mikula via Freeradius-Users wrote:
Thank you Nick! I'll give it a go and report back.
Ludo
On 26. 9. 2025 16:51, Nick Porter wrote:
On 26/09/2025 12:32, Ľudovít Mikula via Freeradius-Users wrote:
I have attached the sites-available/dhcp file, the docker-compose I'm using to start it and the request I'm using with dhcpclient.
There is also the freeradius log and the packet capture for convenience.
Thank you
I believe the issue is now addressed in the latest code in the 3.2.x branch.
If you're using Docker then the freeradius/freeradius-dev images on Docker Hub are built from the 3.2.x branch whenever the branch is updated, so if you use one of those images as your base, then that will have the latest code.
Nick
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/ users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/ users.html
On Fri, 26 Sept 2025 at 15:51, Nick Porter <nick@portercomputing.co.uk> wrote:
On 26/09/2025 12:32, Ľudovít Mikula via Freeradius-Users wrote:
I have attached the sites-available/dhcp file, the docker-compose I'm using to start it and the request I'm using with dhcpclient.
There is also the freeradius log and the packet capture for convenience.
Thank you
I believe the issue is now addressed in the latest code in the 3.2.x branch.
This seems to fix a related issue with encoding DHCP-Relay-Circuit-Id is a configuration that I'm working on.
participants (4)
-
Alan DeKok -
Nick Porter -
Terry Burton -
Ľudovít Mikula