Trying to understand change in behaviour between 2.1.12 and 2.2.5 (ok = reject) or Bug?
Hey everyone I'm the main developer behind the Grase hotspot project, that internally uses Freeradius and Coova Chilli for a Captive portal hotspot. On my testing system, Freeradius recently upgraded to 2.2.5, which seems to have some strange new behaviour with my configs. I'm using the below snippit to get custom reply messages for rejections. authorize { ... logintime { reject = 1 } if(reject){ update reply { Reply-Message := "Your are not allowed to login at this time" } ok = reject } ... } This was working nicely in 2.1.12, detecting when the logintime module had returned a reject code, and then updating the Reply-Message with a nicer message. I've been doing this since at least 2012 without problems. I also use this for many other sections to return custom Reply-Messages when rejecting a user. However, in 2.2.5, it appears to be ignoring the ok = reject part, and it sends back an Accept-Accept with the Reply-Message, instead of an Access-Reject. Complete configs are available at https://github.com/GraseHotspot/grase-conf-freeradius/blob/master/freeradius... (these configs have an extra "reject" under each ok = reject, something I tried which seems to have made no difference) My reading of the changelogs doesn't reveal anything obvious to me about a change in behaviour, so I'm starting to wonder if it's a bug? Has anyone else come across this problem/change? Regards Tim
Can you reproduce this with what will be 2.2.8? https://github.com/FreeRADIUS/freeradius-server/tree/v2.x.x 2.2.x is EOL so you should be targeting 3.0 these days. Nick
On Jun 28, 2015, at 2:39 AM, Timothy White <timwhite88@gmail.com> wrote:
I'm the main developer behind the Grase hotspot project, that internally uses Freeradius and Coova Chilli for a Captive portal hotspot. ... I'm using the below snippit to get custom reply messages for rejections. authorize { ... logintime { reject = 1 } if(reject){ update reply { Reply-Message := "Your are not allowed to login at this time" } ok = reject }
That configuration is wrong. The documentation never said you could do "ok = return" in a block of code like that. The return code over-rides were documented only for modules. Instead of doing "ok = reject", you should just use "reject". That is the documented way of rejecting a user. And doing "ok = reject / reject" does' t make sense. Just use 'reject". It's simpler. My guess is you didn't try that.
My reading of the changelogs doesn't reveal anything obvious to me about a change in behaviour, so I'm starting to wonder if it's a bug?
The "unlang" interpreter had a number of bugs fixed. As a side effect, undocumented behaviour no longer works. In v3, the above configuration would result in a descriptive error, and the server would refuse to start. Alan DeKok.
On Sun, Jun 28, 2015 at 10:46 PM, Alan DeKok <aland@deployingradius.com> wrote:
ok = reject }
That configuration is wrong. The documentation never said you could do "ok = return" in a block of code like that. The return code over-rides were documented only for modules.
Instead of doing "ok = reject", you should just use "reject". That is the documented way of rejecting a user.
And doing "ok = reject / reject" does' t make sense. Just use 'reject". It's simpler. My guess is you didn't try that.
Thanks for that Alan. My searching as to how I ended up with the "ok = reject" doesn't find me the original I found it from. And it seems that seeing as I documented it (with the Grase Hotspot) like that years ago, many others have now found my post and used it too. A quick check shows that a plain "reject" works fine. I'll update my posts relating to this, and hopefully others who stumble across this issue will find my updated posts! Nick, I know 2.2.x is EOL, however until it's in Debian/Ubuntu, I can't start working with it. And as the Grase Hotspot aims to support the LTS releases, it'll be a long time before I'm free of the 2.2.x branch. Thanks everyone for the quick responses. I must have been tired for not trying a plain reject. Regards Tim
Hi,
I'm using the below snippit to get custom reply messages for rejections. authorize { ... logintime { reject = 1 } if(reject){ update reply { Reply-Message := "Your are not allowed to login at this time" } ok = reject } ... }
provide the debug output, not the configuration files - so we can see the logic that is being used. alan
participants (4)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Nick Lowe -
Timothy White