(RADIATOR) AuthBy GROUP and AuthBy Policy
Toomas Kärner
tomkar at estpak.ee
Fri Jan 26 04:08:57 CST 2007
Hi,
My radius has started acting "funny" in some point after some update
of radiator. Now I have traced it so far that something has changed in
a way which AuthByPolicy-s act in a <AuthBy Group>
Part of configuration:
<Realm DEFAULT>
AuthLog LoginFailureLog
RejectHasReason
AuthBy FindAuthBy
PostAuthHook file:"/home/radius/etc/hooks/wn/PortalPostAuthHook.pl"
</Realm DEFAULT>
<AuthBy GROUP>
Identifier FindAuthBy
AuthByPolicy ContinueWhileIgnore
<AuthBy SQL>
Identifier GetInfoFromWnsession
DBSource dbi:mysql:xx
DBUsername xx
DBAuth xx
AuthSelect Select \
location_id, \
mac_address \
from \
plaah where s_id = '%{ETC-Session-Id}'
AuthColumnDef 0, ETC-Location-Id,request
AuthColumnDef 1, ETC-Mac,request
NoDefault
</AuthBy>
######################
<AuthBy SQL>
Identifier GetAuthType
DBSource dbi:mysql:xx
DBUsername xx
DBAuth xx
AuthSelect Select \
if(isnull(auth_by),'RealmDefaultRejectAuth',auth_by) \
from plaah2 where realm = '%R' or realm = 'undef' \
order by product_id desc limit 1
AuthColumnDef 0, Auth-Type,check
AcceptIfMissing
NoDefault
</AuthBy>
</AuthBy>
Explanation: GetAuthType gets a Auth-Type = AuthRoamingRadius
<AuthBy RADIUS>
Identifier AuthRoamingRadius
<Host localhost>
Secret
AuthPort 2001
AcctPort
Retries 0
RetryTimeout 2
# FailureBackoffTime 20
</Host>
AllowInReply Reply-Message
AllowInRequest User-Name,User-Password,ETC-Member-Of,ETC-Session-Id,ETC-Location-Id
##################################
ReplyHook sub { \
&main::log($main::LOG_DEBUG, "ReplyHook executed!"); \
my $p = ${$_[0]};\
my $rp = ${$_[1]};\
my $code = $p->code;\
if ($code eq 'Access-Reject') { \
&main::log($main::LOG_DEBUG, "ReplyHook found Reply-Message, giving it as a reason."); \
my $message=${$_[2]}->get_attr('Reply-Message'); \
${$_[3]}=$message;\
} \
}
##################################
NoReplyHook sub { \
&main::log($main::LOG_DEBUG, "NoReplyHook executed!"); \
my $p = ${$_[0]};\
my $sp = ${$_[1]};\
my $rp = ${$_[2]};\
my $code = $p->code;\
if ($code eq 'Access-Request') { \
$rp->set_code('Access-Reject'); \
$rp->add_attr('Reply-Message', 'Access rejected because roaming service is currently unavailable.')
$p->{Client}->replyTo($p); \
} \
}
##################################
</AuthBy>
In short:
1) all requests get some attributes added into from DB.
2) based on realm a search is run on DB and AuthBy module identifier
is found.
3) Request is handled in this "faulty" case by AuthBy RADIUS and sent
to some other server.
It should IGNORE then but it gives ACCEPT for some reason...
Debug 4:
Fri Jan 26 09:42:03 2007: DEBUG: Packet dump:
*** Received from xxxx port 33686 ....
Code: Access-Request
Identifier: 227
Authentic:
Attributes:
Service-Type = Login-User
User-Name = "plaah at elion.ee"
User-Password = "<195> <147><240>(<197><179><133>d~<1<145><174><177><9>"
NAS-IP-Address = xx
NAS-Port = 0
ETC-Client-IP = yy
ETC-Session-Id = 524481
Fri Jan 26 09:42:03 2007: DEBUG: Rewrote user name to plaah at elion.ee
Fri Jan 26 09:42:03 2007: DEBUG: PortalPreHandlerHook Executed
Fri Jan 26 09:42:03 2007: DEBUG: Handling request with Handler 'Realm=DEFAULT'
Fri Jan 26 09:42:03 2007: DEBUG: SessDBWireless Deleting session for
plaah at elion.ee, yyy, 0
Fri Jan 26 09:42:04 2007: DEBUG: do query is: 'delete from wnsession where username = 'plaah at elion.ee' and framed_ip is null':
Fri Jan 26 09:42:04 2007: DEBUG: Handling with Radius::AuthGROUP: FindAuthBy
Fri Jan 26 09:42:04 2007: DEBUG: Handling with Radius::AuthSQL
Fri Jan 26 09:42:04 2007: DEBUG: Handling with Radius::AuthSQL: GetInfoFromWnsession
Fri Jan 26 09:42:04 2007: DEBUG: Query is: 'Select location_id, mac_address from wnsession where s_id = '524481'':
Fri Jan 26 09:42:04 2007: DEBUG: Radius::AuthSQL looks for match with plaah at elion.ee [plaah at elion.ee]
Fri Jan 26 09:42:04 2007: DEBUG: Radius::AuthSQL ACCEPT: : plaah at elion.ee [plaah at elion.ee]
Fri Jan 26 09:42:04 2007: DEBUG: Handling with Radius::AuthSQL
Fri Jan 26 09:42:04 2007: DEBUG: Handling with Radius::AuthSQL: GetAuthType
Fri Jan 26 09:42:04 2007: DEBUG: Query is: 'Select
if(isnull(auth_by),'RealmDefaultRejectAuth',auth_by) from xxx where realm = 'elion.ee' or realm = 'undef' order by product_id desc limit 1':
Fri Jan 26 09:42:04 2007: DEBUG: Radius::AuthSQL looks for match with plaah at elion.ee [plaah at elion.ee]
Fri Jan 26 09:42:04 2007: DEBUG: Handling with Radius::AuthRADIUS
Fri Jan 26 09:42:04 2007: DEBUG: AuthBy RADIUS creates new local socket '0.0.0.0' for sending requests
Fri Jan 26 09:42:04 2007: DEBUG: Packet dump:
*** Sending to 127.0.0.1 port 2001 ....
Code: Access-Request
Identifier: 1
Authentic: <8><160><198><16>x<192><251>?S<245><166>.<127><225><29>2
Attributes:
User-Name = "plaah at elion.ee"
User-Password = "<134><166>b<222>L<155><176><210>d<145><28>0<186><248><191>5"
ETC-Session-Id = 524481
ETC-Location-Id = 90
Fri Jan 26 09:42:04 2007: DEBUG: Radius::AuthSQL IGNORE: : plaah at elion.ee [plaah at elion.ee]
Fri Jan 26 09:42:04 2007: DEBUG: AuthBy GROUP result: ACCEPT,
Fri Jan 26 09:42:04 2007: DEBUG: PostAuthHook Executed
Fri Jan 26 09:42:04 2007: DEBUG: Access accepted for plaah at elion.ee
Fri Jan 26 09:42:04 2007: DEBUG: Packet dump:
*** Sending to 172.16.250.218 port 33686 ....
Code: Access-Accept
Identifier: 227
Authentic: <8><160><198><16>x<192><251>?S<245><166>.<127><225><29>2
Attributes:
Fri Jan 26 09:42:04 2007: DEBUG: Packet dump:
*** Received from 127.0.0.1 port 2001 ....
Code: Access-Reject
Identifier: 1
Authentic: =@<19>><163>M;<131><247><246><191>%f<23>|t
Attributes:
Reply-Message = "Request Denied"
Fri Jan 26 09:42:04 2007: DEBUG: Received reply in AuthRADIUS for req 1 from 127.0.0.1:2001
Fri Jan 26 09:42:04 2007: DEBUG: ReplyHook executed!
Fri Jan 26 09:42:04 2007: DEBUG: ReplyHook found Reply-Message, giving it as a reason.
Fri Jan 26 09:42:04 2007: INFO: Access rejected for plaah at elion.ee: Proxied
Fri Jan 26 09:42:04 2007: DEBUG: do query is: 'insert into ...' :
Fri Jan 26 09:42:04 2007: DEBUG: Packet dump:
*** Sending to yyy port 33686 ....
Code: Access-Reject
Identifier: 227
Authentic: <8><160><198><16>x<192><251>?S<245><166>.<127><225><29>2
Attributes:
Reply-Message = "Request Denied"
I can not get this "DEBUG: AuthBy GROUP result: ACCEPT," to be IGNORE.
Version 3.16
Rgds.
Toomas
--
Archive at http://www.open.com.au/archives/radiator/
Announcements on radiator-announce at open.com.au
To unsubscribe, email 'majordomo at open.com.au' with
'unsubscribe radiator' in the body of the message.
More information about the radiator
mailing list