run script on dhcp events
Hello, how can I run a script when the freeradius dhcp server returns the address back to the ip-pool? -- Evgeniy
On Jan 24, 2020, at 8:26 AM, Семёнов Евгений Владимирович <sem@unn.ru> wrote:
how can I run a script when the freeradius dhcp server returns the address back to the ip-pool?
What do you mean "returns the address back to the ip-pool"? The addresses are maintained in a database. The IPs are *always* in the pool. They just change state. IPs are automatically re-used after they're expired. This isn't "returning" to the pool, this is re-allocating them after they've expired. This re-use is done via database queries, and FreeRADIUS doesn't control what's going on inside of the DB. DHCP clients don't need to notify servers when they stop using an address, either. There's a DHCPRELEASE packet, but the client doesn't need to send it. So please explain a little more exactly what you want to do with the address, when you want to do this, and why. It sounds like you want something to happen, but you're not sure *when* it happens, or *how* DHCP works. Explaining your requirements in more detail would be helpful. Alan DeKok.
Sorry, my question was too unclear, I will explain. I develop new university WiFi captive portal and use freeradius as authentication/accounting and dhcp server. I call script from DHCP-Request section to set firewall rule (because i need supplicant MAC-address and issued IP-address). And i need to know where i can call script to remove firewall rule after supplicant disconnected from WiFi network. I tried to call a script (that remove firewall rule) from accounting section when Acct-Status-Type equal Stop, but it is work only for standalone wifi access point without neighbors with same SSID. But when the supplicant passes through the Wi-Fi zone and communicates with one access point, and then with another, the scheme described above stops working, because after receiving the acct-stop packet from the first access point, the firewall rule is deleted, but does not create a new one (there may not be a new dhcp-request).I want to try to call script that deletes a firewall rule after releasing the IP address of the supplicant or after dhcp decides that the supplicant has not confirmed the address and marks the address as unoccupied. But i don't know where i can do it. Maybe you will advise me something? -- Evgeniy
On 24 Jan 2020, at 13:31, Семёнов Евгений Владимирович <sem@unn.ru> wrote:
Sorry, my question was too unclear, I will explain.
I develop new university WiFi captive portal and use freeradius as authentication/accounting and dhcp server. I call script from DHCP-Request section to set firewall rule (because i need supplicant MAC-address and issued IP-address). And i need to know where i can call script to remove firewall rule after supplicant disconnected from WiFi network.
I tried to call a script (that remove firewall rule) from accounting section when Acct-Status-Type equal Stop, but it is work only for standalone wifi access point without neighbors with same SSID. But when the supplicant passes through the Wi-Fi zone and communicates with one access point, and then with another, the scheme described above stops working, because after receiving the acct-stop packet from the first access point, the firewall rule is deleted, but does not create a new one (there may not be a new dhcp-request).
If that's really what's occurring and you're not just misinterpreting the accounting messages then it's a bug in the RADIUS accounting implementation on your APs and you should complain to your vendor. The APs should not send a Stop message unless the session is actually terminated. As the user continues to use the network on the new AP, then the session has not been terminated, and a stop should not have been sent. I suspect what's actually happening is the original AP is sending a Stop and Start pair, but the Stop from AP1, is arriving after the Start from AP2, and is deleting the active firewall state. If that's the case, fix your SQL queries so that doesn't happen.
I want to try to call script that deletes a firewall rule after releasing the IP address of the supplicant or after dhcp decides that the supplicant has not confirmed the address and marks the address as unoccupied. But i don't know where i can do it.
Maybe you will advise me something?
If a client roams out of range of the wireless network how is it going to send a DHCP release to the DHCP server? -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
24.01.2020 22:00, Arran Cudbard-Bell пишет:
Sorry, my question was too unclear, I will explain.
I develop new university WiFi captive portal and use freeradius as authentication/accounting and dhcp server. I call script from DHCP-Request section to set firewall rule (because i need supplicant MAC-address and issued IP-address). And i need to know where i can call script to remove firewall rule after supplicant disconnected from WiFi network.
I tried to call a script (that remove firewall rule) from accounting section when Acct-Status-Type equal Stop, but it is work only for standalone wifi access point without neighbors with same SSID. But when the supplicant passes through the Wi-Fi zone and communicates with one access point, and then with another, the scheme described above stops working, because after receiving the acct-stop packet from the first access point, the firewall rule is deleted, but does not create a new one (there may not be a new dhcp-request).
If that's really what's occurring and you're not just misinterpreting the accounting messages then it's a bug in the RADIUS accounting implementation on your APs and you should complain to your vendor.
The APs should not send a Stop message unless the session is actually terminated. As the user continues to use the network on the new AP, then the session has not been terminated, and a stop should not have been sent.
I suspect what's actually happening is the original AP is sending a Stop and Start pair, but the Stop from AP1, is arriving after the Start from AP2, and is deleting the active firewall state. If that's the case, fix your SQL queries so that doesn't happen.
Yes, I also thought about it, I will check, thanks.
I want to try to call script that deletes a firewall rule after releasing the IP address of the supplicant or after dhcp decides that the supplicant has not confirmed the address and marks the address as unoccupied. But i don't know where i can do it.
Maybe you will advise me something? If a client roams out of range of the wireless network how is it going to send a DHCP release to the DHCP server?
In this case, the DHCP release will never occur, so I asked how the script could be executed when the server decides that the client is lost and marks its IP address as unoccupied. Can I run the script somewhere here ( in sqlippool_log_clear, or somewhere else )? sqlippool dhcp_sqlippool { ... sqlippool_log_exists = "DHCP: Existing IP: %{reply:Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_success = "DHCP: Allocated IP: %{reply:Framed-IP-Address} from %{control:${pool_name}} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_clear = "DHCP: Released IP %{Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name})" sqlippool_log_failed = "DHCP: IP Allocation FAILED from %{control:${pool_name}} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_nopool = "DHCP: No ${pool_name} defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" } I want to make sure that stop packets were not lost.
-Arran
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Evgeniy
On Jan 27, 2020, at 1:33 AM, Семёнов Евгений Владимирович <sem@unn.ru> wrote:
In this case, the DHCP release will never occur, so I asked how the script could be executed when the server decides that the client is lost and marks its IP address as unoccupied.
As I said in my first response, no. The server does not decide that the client is lost. The IP simply expires. And then is reallocated at some later time. You can write a cron job which scans the database for expired IPs, and then does something when it sees them. This can't be done inside of FreeRADIUS. Alan DeKok.
I see, thank you.
In this case, the DHCP release will never occur, so I asked how the script could be executed when the server decides that the client is lost and marks its IP address as unoccupied. As I said in my first response, no. The server does not decide that the client is lost. The IP simply expires. And then is reallocated at some later time.
You can write a cron job which scans the database for expired IPs, and then does something when it sees them. This can't be done inside of FreeRADIUS.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Evgeniy
participants (3)
-
Alan DeKok -
Arran Cudbard-Bell -
Семёнов Евгений Владими рович