{"id":1332,"date":"2018-11-07T08:32:24","date_gmt":"2018-11-07T06:32:24","guid":{"rendered":"https:\/\/www.mcgill.org.za\/stuff\/?p=1332"},"modified":"2018-11-07T08:32:24","modified_gmt":"2018-11-07T06:32:24","slug":"freeradius-module-failure-message-failed-retrieving-values-required-to-evaluate-condition","status":"publish","type":"post","link":"https:\/\/www.mcgill.org.za\/stuff\/archives\/1332","title":{"rendered":"Freeradius Module-Failure-Message = &#8220;Failed retrieving values required to evaluate condition&#8221;"},"content":{"rendered":"<p>One of my radius servers stopped doing its radius thing. Everything was going along swimmingly, and then it suddenly stopped at 1:00AM.\u00a0 Restarts didn&#8217;t fix it.<\/p>\n<p>The way this server works is that the default handler receives accounting packets, writes it to spool files, and then another process forwards the contents of the spool files to the correct destinations (e.g. databases). However, it stopped. There was no reason, so I (eventually) looked at the spool files in <code>\/var\/log\/radius\/radacct\/blah<\/code> and found this packet:<\/p>\n<pre>Tue Nov 6 00:57:15 2018\r\n    User-Name = \"\"\r\n    Event-Timestamp = \"Nov 6 2018 00:57:15 SAST\"\r\n    Acct-Status-Type = Accounting-Off\r\n    NAS-IP-Address = 104.78.28.84\r\n    Connect-Info = \"\"\r\n    Module-Failure-Message = \"Failed retrieving values required to evaluate condition\"\r\n    Module-Failure-Message = \"Failed retrieving values required to evaluate condition\"\r\n    Module-Failure-Message = \"Failed retrieving values required to evaluate condition\"\r\n    Timestamp = 1541458635\r\n<\/pre>\n<p>That&#8217;s an accounting packet from the NAS that says it is rebooting, and <strong>all<\/strong> the sessions have are going away. When this packet was handled, FreeRadius lost its mind and added the <code>Module-Failure-Message<\/code> attributes.<\/p>\n<p>The reason that this was happening to these accounting packets is that the processing section for the accounting packets said things like this (edited for brevity):<\/p>\n<pre>accounting {\r\n    if ( &amp;Framed-IP-Address =~ \/^192\\\\.168\\.\/) {\r\n        detail-write-nat-server\r\n    }\r\n    # ...\r\n    ok\r\n}\r\n<\/pre>\n<p>The idea is to log to a spool file for handling by another server:<\/p>\n<pre>detail detail-write-nat-server {\r\n    filename = ${radacctdir}\/nat\/detail-%Y%m%d:%H\r\n    permissions = 0664\r\n    header = \"%t\"\r\n    locking = yes\r\n}<\/pre>\n<p>So the trouble is that the <code>Framed-IP-Address<\/code> attribute is not present in this particular accounting packet. Here&#8217;s the right way of doing it:<\/p>\n<pre>accounting {\r\n    if ( <b>&amp;Framed-IP-Address &amp;&amp;<\/b> &amp;Framed-IP-Address =~ \/^192\\\\.168\\.\/) {\r\n        detail-write-nat-server\r\n    }\r\n    # ...\r\n    ok\r\n}<\/pre>\n<p>So I fixed it, and now it&#8217;s better.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>One of my radius servers stopped doing its radius thing. Everything was going along swimmingly, and then it suddenly stopped at 1:00AM.\u00a0 Restarts didn&#8217;t fix it. The way this server works is that the default handler receives accounting packets, writes &hellip; <a href=\"https:\/\/www.mcgill.org.za\/stuff\/archives\/1332\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[119,111,190,11],"class_list":["post-1332","post","type-post","status-publish","format-standard","hentry","category-stuff","tag-freeradius","tag-radius","tag-stuff","tag-stupidity"],"_links":{"self":[{"href":"https:\/\/www.mcgill.org.za\/stuff\/wp-json\/wp\/v2\/posts\/1332","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcgill.org.za\/stuff\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcgill.org.za\/stuff\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcgill.org.za\/stuff\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcgill.org.za\/stuff\/wp-json\/wp\/v2\/comments?post=1332"}],"version-history":[{"count":1,"href":"https:\/\/www.mcgill.org.za\/stuff\/wp-json\/wp\/v2\/posts\/1332\/revisions"}],"predecessor-version":[{"id":1333,"href":"https:\/\/www.mcgill.org.za\/stuff\/wp-json\/wp\/v2\/posts\/1332\/revisions\/1333"}],"wp:attachment":[{"href":"https:\/\/www.mcgill.org.za\/stuff\/wp-json\/wp\/v2\/media?parent=1332"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcgill.org.za\/stuff\/wp-json\/wp\/v2\/categories?post=1332"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcgill.org.za\/stuff\/wp-json\/wp\/v2\/tags?post=1332"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}