Attributes sent to proxy servers ...
Arran Cudbard-Bell
A.Cudbard-Bell at sussex.ac.uk
Tue Feb 5 14:57:45 CET 2008
Arran Cudbard-Bell wrote:
> A.L.M.Buxey at lboro.ac.uk wrote:
>> hi,
>>
>> you are still pre-proxy attr filtering?
>> alan
>> -
>> List info/subscribe/unsubscribe? See
>> http://www.freeradius.org/list/users.html
>>
> No, didn't really see the point.. Internal attributes aren't meant to
> be proxied, and those are the only ones I really wanted filtering out.
>
> Looks like something very strange is going on with proxying accounting
> packets as well.
>
> rad_recv: Accounting-Request packet from host 139.184.8.16 port 1026,
> id=225, length=141
> Acct-Session-Id = "004E00000019"
> Acct-Status-Type = Start
> Acct-Authentic = RADIUS
> Acct-Delay-Time = 15
> NAS-Port = 1
> Calling-Station-Id = "00-1B-63-A3-A8-DD"
> Event-Type = Framed-User
> NAS-IP-Address = 139.184.8.16
> NAS-Identifier = "hp-e-its-dev8021x-sw1"
> User-Name = "ac221 at loopback.sussex.ac.uk"
> server default-outer {
> +- entering group preacct
> ++? if ("%{User-Name}" =~ /\\\\?([^@\\\\]+)@?([-[:alnum:]._]*)?$/)
> expand: %{User-Name} -> ac221 at loopback.sussex.ac.uk
> ? Evaluating ("%{User-Name}" =~
> /\\\\?([^@\\\\]+)@?([-[:alnum:]._]*)?$/) -> TRUE
> ++? if ("%{User-Name}" =~ /\\\\?([^@\\\\]+)@?([-[:alnum:]._]*)?$/) ->
> TRUE
> ++- entering if ("%{User-Name}" =~
> /\\\\?([^@\\\\]+)@?([-[:alnum:]._]*)?$/)
> +++? if (!"%{2}"||("%{2}" == 'sussex.ac.uk'))
> expand: %{2} -> loopback.sussex.ac.uk
> ? Evaluating "loopback.sussex.ac.uk" -> FALSE
> expand: %{2} -> loopback.sussex.ac.uk
> ? Evaluating ("%{2}" == 'sussex.ac.uk') -> FALSE
> +++? if (!"%{2}"||("%{2}" == 'sussex.ac.uk')) -> FALSE
> +++- entering else else
> expand: %{1}@%{2} -> ac221 at loopback.sussex.ac.uk
> ++++[request] returns noop
> +++- else else returns noop
> ++- if ("%{User-Name}" =~ /\\\\?([^@\\\\]+)@?([-[:alnum:]._]*)?$/)
> returns noop
> ++ ... skipping else for request 20: Preceding "if" was taken
> expand: %{Realm} -> %{2}
> ++- entering switch %{Realm}
> +++- entering case
> ++++[control] returns noop
> ++++[request] returns noop
> +++- case returns noop
> ++- switch %{Realm} returns noop
> ++? if ("%{Called-Station-Id}" =~
> /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2,})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i)
>
> expand: %{Called-Station-Id} ->
> ? Evaluating ("%{Called-Station-Id}" =~
> /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2,})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i)
> -> FALSE
> ++? if ("%{Called-Station-Id}" =~
> /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2,})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i)
> -> FALSE
> ++? if ("%{Calling-Station-Id}" =~
> /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2,})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
>
> expand: %{Calling-Station-Id} -> 00-1B-63-A3-A8-DD
> ? Evaluating ("%{Calling-Station-Id}" =~
> /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2,})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
> -> TRUE
> ++? if ("%{Calling-Station-Id}" =~
> /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2,})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
> -> TRUE
> ++- entering if ("%{Calling-Station-Id}" =~
> /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2,})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
>
> expand: %{1}%{2}%{3}%{4}%{5}%{6} -> 001B63A3A8DD
> +++[request] returns noop
> ++- if ("%{Calling-Station-Id}" =~
> /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2,})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
> returns noop
> ++? if ("%{NAS-Port-Id}" =~ /wl[0-9]*/)
> expand: %{NAS-Port-Id} ->
> ? Evaluating ("%{NAS-Port-Id}" =~ /wl[0-9]*/) -> FALSE
> ++? if ("%{NAS-Port-Id}" =~ /wl[0-9]*/) -> FALSE
> ++? if (("%{NAS-Port-Type}" == 'Wireless-802.11')||("%{NAS-Port-Type}"
> == 'Ethernet'))
> expand: %{NAS-Port-Type} ->
> ?? Evaluating ("%{NAS-Port-Type}" == 'Wireless-802.11') -> FALSE
> expand: %{NAS-Port-Type} ->
> ?? Evaluating ("%{NAS-Port-Type}" == 'Ethernet') -> FALSE
> ++? if (("%{NAS-Port-Type}" == 'Wireless-802.11')||("%{NAS-Port-Type}"
> == 'Ethernet')) -> FALSE
> ++? if ("%{NAS-IP-Address}" == '127.0.0.1')
> expand: %{NAS-IP-Address} -> 139.184.8.16
> ? Evaluating ("%{NAS-IP-Address}" == '127.0.0.1') -> FALSE
> ++? if ("%{NAS-IP-Address}" == '127.0.0.1') -> FALSE
> expand: %{Client-Shortname} -> hp-e-its-dev8021x-sw1
> ++[request] returns noop
> rlm_acct_unique: WARNING: Attribute Client-IP-Address was not found in
> request, unique ID MAY be inconsistent
> rlm_acct_unique: Hashing ',NAS-Port = 1,NAS-IP-Address =
> 139.184.8.16,Acct-Session-Id = "004E00000019",User-Name =
> "ac221 at loopback.sussex.ac.uk"'
> rlm_acct_unique: Acct-Unique-Session-ID = "67d4bffd71faf76b".
> ++[acct_unique] returns ok
> +- entering group accounting
> expand: /var/log/radiusd/%Y%m%d/accounting-detail-%H:00 ->
> /var/log/radiusd/20080205/accounting-detail-12:00
> rlm_detail: /var/log/radiusd/%Y%m%d/accounting-detail-%H:00 expands to
> /var/log/radiusd/20080205/accounting-detail-12:00
> expand: %{Packet-Src-IP-Address} - %t -> 139.184.8.16 - Tue Feb 5
> 12:49:09 2008
> ++[accounting_log] returns ok
> expand: %{Stripped-User-Name} -> ac221 at loopback.sussex.ac.uk
> expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} ->
> ac221 at loopback.sussex.ac.uk
> rlm_sql (sql): sql_set_user escaped user -->
> 'ac221 at loopback.sussex.ac.uk'
> expand: %{Acct-Delay-Time} -> 15
> expand: INSERT INTO radacct
> (acctsessionid, acctuniqueid, username,
> realm, nasidentifier, nasipaddress,
> nasportid, nasporttype, acctstarttime,
> acctstoptime, acctsessiontime, acctauthentic,
> connectinfo_start, connectinfo_stop, acctinputoctets,
> acctoutputoctets, calledstationid, calledstationssid,
> callingstationid, acctterminatecause, servicetype,
> framedprotocol, framedipaddress, acctstartdelay,
> acctstopdelay ) VALUES ('%{Acct-Session-Id}',
> '%{Acct-Unique-Session-Id}',
> '%{SQL-User-Name}', '%{Realm}', '%{NAS-Identifier}',
> '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}',
> '%S', '0', '0', '%{Acct-Authentic}',
> '%{Connect-Info}', '', '0', '0',
> '%{Called-Station-Id}','%{Called-Station-SSID}','%{Calling-Station-Id}',
> '', '%{Service-Type}', '%{Framed-Protocol}',
> '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0')
> -> INSERT INTO radacct (acctsessionid,
> acctuniqueid, username, realm,
> nasidentifier, nasipaddress, nasportid,
> nasporttype, acctstarttime, acctstoptime,
> acctsessiontime, acctauthentic, connectinfo_start,
> connectinfo_stop, acctinputoctets, acctoutputoctets,
> calledstationid, calledstationssid, callingstationid,
> acctterminatecause, servicetype, framedprotocol,
> framedipaddress, acctstartdelay, acctstopdelay
> ) VALUES ('004E00000019',
> '67d4bffd71faf76b',
> 'ac221 at loopback.sussex.ac.uk', 'jrs',
> 'hp-e-its-dev8021x-sw1', '139.184.8.16', '1', '',
> '2008-02-05 12:49:09', '0', '0', 'RADIUS',
> '', '', '0', '0', '','','001B63A3A8DD',
> '', 'Framed-User', '', '', '15', '0')
> rlm_sql (sql): Reserving sql socket id: 19
> rlm_sql (sql): Released sql socket id: 19
> ++[sql] returns ok
> expand: %{User-Name} -> ac221 at loopback.sussex.ac.uk
> attr_filter: Matched entry DEFAULT at line 12
> ++[attr_filter.accounting_response] returns updated
> } # server default-outer
> +- entering group pre-proxy
> expand: /var/log/radiusd/%Y%m%d/pre-proxy-detail-%H:00 ->
> /var/log/radiusd/20080205/pre-proxy-detail-12:00
> rlm_detail: /var/log/radiusd/%Y%m%d/pre-proxy-detail-%H:00 expands to
> /var/log/radiusd/20080205/pre-proxy-detail-12:00
> expand: %{Packet-Src-IP-Address} - %t -> 139.184.8.16 - Tue Feb 5
> 12:49:09 2008
> ++[pre_proxy_log] returns ok
>
> Where have all the attributes gone ?!!?
>
> Sending Accounting-Request of id 180 to 194.82.174.185 port 1813
> Proxy-State = 0x323235
> Proxying request 20 to home server 194.82.174.185 port 1813
> Sending Accounting-Request of id 180 to 194.82.174.185 port 1813
> Realm = "jrs"
> Proxy-State = 0x323235
> Going to the next request
> Waking up in 0.9 seconds.
> Waking up in 14.0 seconds.
> Rejecting request 17 due to lack of any response from home server
> 194.82.174.185 port 1813
>
Never mind ...
++[sql] returns ok
expand: %{User-Name} -> ac221 at loopback.sussex.ac.uk
attr_filter: Matched entry DEFAULT at line 12
++[attr_filter.accounting_response] returns updated
*sigh*
--
Arran Cudbard-Bell (A.Cudbard-Bell at sussex.ac.uk)
Authentication, Authorisation and Accounting Officer
Infrastructure Services | ENG1 E1-1-08
University Of Sussex, Brighton
EXT:01273 873900 | INT: 3900
More information about the Freeradius-Users
mailing list