Radius Accounting Queries

[PWJW]

Just a few queries:

Please can you add the Called-Station-Id attribute to the Accounting On/Off packets? We use this to identify the NAS. It is present in the normal auth/account packets.

When I run uspot restart it is not sending Stop packets for any authenticated sessions, so the RADIUS server does not know the session has ended and ends up with duplicate active sessions if another session is authenticated. Is this a bug or just not present?

Thanks!

[f00b4r0]

Just a few queries:

Please can you add the Called-Station-Id attribute to the Accounting On/Off packets? We use this to identify the NAS. It is present in the normal auth/account packets.

It should already be added unless I broke something, see

uspot/files/usr/share/uspot/uspot.uc

Line 141 in 9b5c245

for (let key in [ 'Acct-Session-Id', 'Framed-IP-Address', 'Called-Station-Id', 'Calling-Station-Id', 'NAS-IP-Address', 'NAS-Port-Type', 'User-Name', 'WISPr-Location-Name', 'Chargeable-User-Identity' ])

Can you send me an excerpt of tcpdump -v udp port 1813 for one Accounting-Request? (you can obfuscate private data as needed, I just want to see which attributes are transmitted).

When I run uspot restart it is not sending Stop packets for any authenticated sessions, so the RADIUS server does not know the session has ended and ends up with duplicate active sessions if another session is authenticated. Is this a bug or just not present?

It's not present. uspot is however sending an Accounting-Off packet (matching the Accounting-On sent at startup. I was naively expecting that RADIUS would use that to clear all in-flight accounting sessions for the corresponding NASID. I'll see if this can be improved somewhat.

[PWJW]

Here's the RADIUS side capture, showing no Called-Station-Id being present.

09:17:32.173765 IP (tos 0x0, ttl 59, id 55210, offset 0, flags [DF], proto UDP (17), length 134)
    x.44308 > radius-test-internal.radius-acct: RADIUS, length: 106
        Accounting-Request (4), id: 0x68, Authenticator: 6432c2c5f38bd62431b6df924f4daa04
          Acct-Status-Type Attribute (40), length: 6, Value: Accounting-Off
          Acct-Session-Id Attribute (44), length: 18, Value: 751527f62d5070cd
          NAS-Identifier Attribute (32), length: 19, Value: x
          Vendor-Specific Attribute (26), length: 25, Value: Vendor: Wi-Fi Alliance (14122)
            Vendor Attribute: 2, Length: 17, Value: x
          NAS-Port Attribute (5), length: 6, Value: 0
          Acct-Delay-Time Attribute (41), length: 6, Value: 00 secs
          NAS-IP-Address Attribute (4), length: 6, Value: 192.168.1.63

    x.53606 > radius-test-internal.radius-acct: RADIUS, length: 106
        Accounting-Request (4), id: 0xf0, Authenticator: 77c3d98626f6aca8c9a6d08e0ea87ee5
          Acct-Status-Type Attribute (40), length: 6, Value: Accounting-On
          Acct-Session-Id Attribute (44), length: 18, Value: 158f7d3d2a3f2cf1
          NAS-Identifier Attribute (32), length: 19, Value: x
          Vendor-Specific Attribute (26), length: 25, Value: Vendor: Wi-Fi Alliance (14122)
            Vendor Attribute: 2, Length: 17, Value: x
          NAS-Port Attribute (5), length: 6, Value: 0
          Acct-Delay-Time Attribute (41), length: 6, Value: 00 secs
          NAS-IP-Address Attribute (4), length: 6, Value: 192.168.1.63

the line you mentioned (114), is only for authenticated client sessions, not the device's own Accounting On/Off requests:

if (!auth && mac) {
		// dealing with client accounting
		let client = uspots[uspot].clients[mac];
		let radius = client.radius.request;
		for (let key in [ 'Acct-Session-Id', 'Framed-IP-Address', 'Called-Station-Id', 'Calling-Station-Id', 'NAS-IP-Address', 'NAS-Port-Type', 'User-Name', 'WISPr-Location-Name', 'Chargeable-User-Identity' ])

[f00b4r0]

OK sorry I read your initial message way too quick. Fix pushed to next, ebpf branch has been rebased.
Can you enlighten me as to the use of Accounting-On/Accounting-Off if RADIUS doesn't tie this to client sessions (and does not terminate said sessions upon receiving Accounting-Off)?

[PWJW]

We don't actually utilise the On/Off packets, its just that in our situation, we ignore any packets send to our RADIUS without the Called-Station-Id present in general. If it's there, at lease we know that the packet is received and can be attributed back to what we need our side if required.