<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>On 26.6.2024 14.09, Stefan Paetow via radiator wrote:</p>
<blockquote type="cite"
cite="mid:C3C4B785-41FC-4441-BCEE-665D9372EF45@jisc.ac.uk">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta name="Generator"
content="Microsoft Word 15 (filtered medium)">
<style>@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}@font-face
{font-family:Aptos;
panose-1:2 11 0 4 2 2 2 2 2 4;}@font-face
{font-family:"Times New Roman \(Body CS\)";
panose-1:2 11 6 4 2 2 2 2 2 4;}p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Aptos",sans-serif;
mso-ligatures:standardcontextual;
mso-fareast-language:EN-US;}span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}.MsoChpDefault
{mso-style-type:export-only;
font-size:11.0pt;
mso-fareast-language:EN-US;}div.WordSection1
{page:WordSection1;}</style>
<div class="WordSection1">
<p class="MsoNormal"><span
style="font-family:"Calibri",sans-serif">I am
trying to fix a looping problem between two hosts that does
not rely on attributes being added to packets. <o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-family:"Calibri",sans-serif">I know I
can retrieve the client address from the request as
Radius::Util::inet_ntop($request->{RecvFromAddress}), but
I'd like to do the same for the destination host that's been
selected to proxy the request to. Which handler/hook would
be the best to do this in? PreHandlerHook in the destination
AuthBy? And… how do I get the IP address of the destination
host (or the selected host if there are multiple)?</span></p>
</div>
</blockquote>
<br>
<p>That's an interesting question. Many of the hooks run well before
the next hop details (IP + port) are resolved, but I think I found
a solution.</p>
<br>
<blockquote type="cite"
cite="mid:C3C4B785-41FC-4441-BCEE-665D9372EF45@jisc.ac.uk">
<div class="WordSection1">
<p class="MsoNormal"><span
style="font-family:"Calibri",sans-serif">Or is
this not possible?</span></p>
</div>
</blockquote>
<br>
<p>It's possible. There's one hook that runs just before the request
is forwarded. I came up with the following idea. Note that you'd
need to have a <Host ...> clause because that's where the
hook goes into. It should also work with the other proxy AuthBys,
such as AuthBy HASHBALANCE.</p>
<p>Here's a config snippet and the hook:<br>
</p>
<p><font face="monospace"><AuthBy RADIUS><br>
VsaVendor Generic<br>
VsaTranslateOut<br>
</font><font face="monospace"> AuthPort 1812<br>
AcctPort 1813<br>
</font></p>
<p><font face="monospace"> <Host 127.0.0.1><br>
Secret mysecret<br>
# Other host specific parameters</font></p>
<p><font face="monospace"> # $p is the request, $is_out is
set for outgoing messages<br>
# $fp is the request that's about to be forwarded<br>
VsaTranslationHook sub { my ($p, $is_out, $fp) = @_; \<br>
my $host = $fp->{ThisHost}; \<br>
my $addr =
@{$host->{Address}}[$host->{roundRobinCounter} %
@{$host->{Address}}]; \<br>
<br>
my $port = $fp->code eq 'Accounting-Request' \<br>
? $host->{AcctPort} : $host->{AuthPort}; \<br>
my $ip = Radius::Util::inet_ntop($addr); \<br>
main::log($main::LOG_INFO, "Forwarding to IP $ip port
$port\n"); }<br>
</Host><br>
</AuthBy><br>
</font></p>
<p>The Vendor Specific Attribute (VSA) translation parameters are
documented here, except of the hook that needs to be documented:<br>
<a class="moz-txt-link-freetext"
href="https://files.radiatorsoftware.com/radiator/ref/Clientxxxxxx.html#VsaTranslateIn_Client"
moz-do-not-send="true">https://files.radiatorsoftware.com/radiator/ref/Clientxxxxxx.html#VsaTranslateIn_Client</a><br>
</p>
<p>The round robin counter is explained below. Briefly, it's for the
cases where Host is defined with a name that resolves to multiple
IP addresses:<br>
</p>
<p><a class="moz-txt-link-freetext"
href="https://files.radiatorsoftware.com/radiator/ref/AuthByRADIUS.html#Host"
moz-do-not-send="true">https://files.radiatorsoftware.com/radiator/ref/AuthByRADIUS.html#Host</a></p>
<br>
<br>
Thanks,<br>
Heikki
<p>-- <br>
Heikki Vatiainen<br>
OSC, makers of Radiator<br>
Visit radiatorsoftware.com for Radiator AAA server software</p>
<br>
</body>
</html>