Detailed Logging freeradius Request Packets

[Boris Lytochkin]

Hi there!

> > So this message, the Access-Challenge messages are not logged, although
> > the Access-Accept are logged.
> >
> > I should have said I want to log Access-Challenge messages, would be
> > more correct.
>
>   That's a bit harder.  Put this in the "authenticate" section, to
> replace the "eap" line:
>
>     Auth-Type eap {
>         eap {
>             handled = 1
>         }
>         if (handled) {
>             auth_log.post-auth
>         }
>     }
>
>   That should do the trick.
>   Alan DeKok.
I found this thread in 2019 (10 years after that, I hope that I hacked headers good enough to glue this message to old thread) to achieve the same goal with a slightly more complex situation.

Original unlang code was:
==========
Auth-Type eap {
         eap
         perl
     }
==========
So if you just use the recipe as-is you would encounter perl being invoked on every single EAP conversation cycle.
To overcome this, one might want to use an upgraded version of the original idea:
==========
     Auth-Type eap {
         eap {
             handled = 9999
         }
         if (handled) {
             auth_log.post-auth
             return
         }
         perl
     }
==========

Increased priority for handled return code is there just in case we would have something **above** eap that could emit OK/NOOP/UPDATED/etc which have higher priority. OK returned by auth_log.post-auth 
would be overridden by handled priority as well.
Before using this magic, please take a look on doc/configuration/configurable_failover.rst in FreeRADIUS sources to understand what's going on here, it takes a while to settle the things down. :)

-- 
Boris Lytochkin
Yandex NOC
+7 (495) 739 70 00 ext. 7671