Dynamic session timeout

[Sam T]

Hey there

I was wondering if you could help me with some logic

I'm working with some pretty limited attributes on some APs. They support
radius, but only these attributes:

Session-timeout
Idle-timeout
Bandwidth-up
Bandwidth-down

It sadly doesn't understand WISPr-Session-Terminate-Time

Our application needs to timeout a user account and all devices with
activate sessions on that account at a specific time. Our Service is
offered monthly and are unlimited data.

Is SQL counter or some other module able to send session timeout
dynamically on the fly to accounts for a session that should only be 200min
vs 1440 for an session that needs to expire at a specific moment on all
devices?

I was thinking to make a sql query script to do a Delta calculation between
now and WISPr-Session-Terminate-Time and if that number is less than
session-timeout, to use that value.

I feel like there may be a module in freeradius that may do this but I
could not figure if SQL counter does this.

Any tips in what direction to go would be great!
-
List info/subscribe/unsubscribe? See http

[Alan DeKok]

Post by Sam T
Our application needs to timeout a user account and all devices with
activate sessions on that account at a specific time. Our Service is
offered monthly and are unlimited data.
Is SQL counter or some other module able to send session timeout
dynamically on the fly to accounts for a session that should only be 200min
vs 1440 for an session that needs to expire at a specific moment on all
devices?

The sqlcounter module tracks total time per month. It can't disconnect people at a particular time.

Post by Sam T
I was thinking to make a sql query script to do a Delta calculation between
now and WISPr-Session-Terminate-Time and if that number is less than
session-timeout, to use that value.
I feel like there may be a module in freeradius that may do this but I
could not figure if SQL counter does this.

You don't need an SQL query or a module. Just use simple logic in "unlang".

if (reply:WISPr-Session-Terminate-Time) {
update reply {
Session-Timeout <= "%{expr:%{WISPr-Session-Terminate-Time} - %l}"
}
}

See "man unlang" for the meaning of "<=". And the "expr" module just does math.

Alan DeKok.


-
List info/subscribe/unsubscribe? See ht

[Sam T]

Thank you so much for the reply. I'm working with my team and they tried to
implement the unlang you shared with me. The result was a very negative
value. We reversed it and it was the same but positive


if (reply:WISPr-Session-Terminate-Time) {
update reply {
Session-Timeout := "%{expr:%{WISPr-Session-Terminate-Time} - %l}"
}
}

They broke down for me what they are trying to do, maybe this can help us
find tune the question

### RULES

GET 'date/time now', 'WISPr-Session-Terminate-Time', and Session-Timeout;
COMPARE 'date/time now' & 'WISPr-Session-Terminate-Time' and determine the
difference in seconds as "session-timeout-delta";
IF "session-timeout-delta" is less than Session-Timeout
ACTION set Session-Timeout = "session-timeout-delta";


Here are screen shots of the radius reply we received.

[image: image.png]

[image: image.png]

session timeout was reply'ed at = 1540400055
should have been 3600?
WISPr-Session-Terminate-Time = 2018-11-18T12:22:23+00:00

THANK YOU!

Post by Sam T

Post by Sam T
Our application needs to timeout a user account and all devices with
activate sessions on that account at a specific time. Our Service is
offered monthly and are unlimited data.
Is SQL counter or some other module able to send session timeout
dynamically on the fly to accounts for a session that should only be

200min

Post by Sam T
vs 1440 for an session that needs to expire at a specific moment on all
devices?

The sqlcounter module tracks total time per month. It can't disconnect
people at a particular time.

Post by Sam T
I was thinking to make a sql query script to do a Delta calculation

between

Post by Sam T
now and WISPr-Session-Terminate-Time and if that number is less than
session-timeout, to use that value.
I feel like there may be a module in freeradius that may do this but I
could not figure if SQL counter does this.

You don't need an SQL query or a module. Just use simple logic in "unlang".
if (reply:WISPr-Session-Terminate-Time) {
update reply {
Session-Timeout <=
"%{expr:%{WISPr-Session-Terminate-Time} - %l}"
}
}
See "man unlang" for the meaning of "<=". And the "expr" module just does math.
Alan DeKok.
-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html

[Sam T]

here is another tidbit of data


[image: image.png]

[Alan DeKok]

Post by Sam T
Thank you so much for the reply. I'm working with my team and they tried to
implement the unlang you shared with me. The result was a very negative
value. We reversed it and it was the same but positive
if (reply:WISPr-Session-Terminate-Time) {
update reply {
Session-Timeout := "%{expr:%{WISPr-Session-Terminate-Time} - %l}"
}
}

That's fine.

Post by Sam T
They broke down for me what they are trying to do, maybe this can help us
find tune the question
### RULES
GET 'date/time now', 'WISPr-Session-Terminate-Time', and Session-Timeout;
COMPARE 'date/time now' & 'WISPr-Session-Terminate-Time' and determine the
difference in seconds as "session-timeout-delta";
IF "session-timeout-delta" is less than Session-Timeout
ACTION set Session-Timeout = "session-timeout-delta";
Here are screen shots of the radius reply we received.

Please don't post screen shots to the list. It should be simple to cut & paste text.

Post by Sam T
[image: image.png]
[image: image.png]
session timeout was reply'ed at = 1540400055
should have been 3600?
WISPr-Session-Terminate-Time = 2018-11-18T12:22:23+00:00

I would have to see the debug output to know more.

Alan DeKok.


-
List info/subscribe/unsubscribe? See http://www.freer

[Sam T]

Here is the debug output from the unlang you shared with me. Any extra
direction would be greatly appreciated!

User-Password in the request is correct.
Login OK: [22-22-22-22-22-11/password] (from client wificpa port 0)
# Executing section post-auth from file
/etc/freeradius/sites-enabled/wifirush.rad
+- entering group post-auth {...}
++? if (reply:WISPr-Session-Terminate-Time)
? Evaluating (reply:WISPr-Session-Terminate-Time) -> TRUE
++? if (reply:WISPr-Session-Terminate-Time) -> TRUE
++- entering if (reply:WISPr-Session-Terminate-Time) {...}
expand: %{WISPr-Session-Terminate-Time} - %l -> - 1540961491
expand: %{expr:%{WISPr-Session-Terminate-Time} - %l} -> -1540961491
+++[reply] returns noop
++- if (reply:WISPr-Session-Terminate-Time) returns noop
Sending Access-Accept of id 187 to 96.227.97.217 port 53933
WISPr-Bandwidth-Max-Up = 5000000
WISPr-Bandwidth-Max-Down = 5000000
Mikrotik-Rate-Limit = ""
Acct-Interim-Interval = 300
Session-Timeout = 2754005805
Idle-Timeout = 900
WISPr-Session-Terminate-Time = "2018-11-18T12:22:23+00:00"
Finished request 0.
Going to the next request
Waking up in 4.9 seconds.
Cleaning up request 0 ID 187 with timestamp +14
Ready to process requests.
-
List info/subscribe/unsubscribe? See htt

[Alan DeKok]

Post by Sam T
Here is the debug output from the unlang you shared with me. Any extra
direction would be greatly appreciated!
User-Password in the request is correct.
Login OK: [22-22-22-22-22-11/password] (from client wificpa port 0)
# Executing section post-auth from file
/etc/freeradius/sites-enabled/wifirush.rad
+- entering group post-auth {...}
++? if (reply:WISPr-Session-Terminate-Time)
? Evaluating (reply:WISPr-Session-Terminate-Time) -> TRUE
++? if (reply:WISPr-Session-Terminate-Time) -> TRUE
++- entering if (reply:WISPr-Session-Terminate-Time) {...}
expand: %{WISPr-Session-Terminate-Time} - %l -> - 1540961491

If WISPr-Session-Terminate-Time is in the reply, then the expansion should be:

Session-Timeout := "%{expr:%{reply:WISPr-Session-Terminate-Time} - %l}"

Alan DeKok.


-
List info/subscribe/uns

[Sam T]

Thanks for that edit earlier

This time it's serving a session timeout of 0

As an update, we are aiming for getting the actual Session-Timeout value
from the reply or the difference in seconds between now() and the
WISPr-Session-Terminate-Time - Whichever value is smaller

Here is the new output

Any tips would be much appreciated!


///
Login OK: [22-22-22-22-22-11/password] (from client wificpa port 0)
# Executing section post-auth from file
/etc/freeradius/sites-enabled/wifirush.rad
+- entering group post-auth {...}
++? if (reply:WISPr-Session-Terminate-Time)
? Evaluating (reply:WISPr-Session-Terminate-Time) -> TRUE
++? if (reply:WISPr-Session-Terminate-Time) -> TRUE
++- entering if (reply:WISPr-Session-Terminate-Time) {...}
expand: %{reply:WISPr-Session-Terminate-Time} - %l ->
2000-11-01T12:22:23+00:00 - 1541009986
Not a number at "T12:22:23+00:00 - 1541009986"
expand: %{expr:%{reply:WISPr-Session-Terminate-Time} - %l} ->
+++[reply] returns noop
++- if (reply:WISPr-Session-Terminate-Time) returns noop
Sending Access-Accept of id 247 to 96.227.97.217 port 57890
WISPr-Bandwidth-Max-Up = 5000000
WISPr-Bandwidth-Max-Down = 5000000
Mikrotik-Rate-Limit = ""
Acct-Interim-Interval = 300
Session-Timeout = 0
Idle-Timeout = 900
WISPr-Session-Terminate-Time = "2000-11-01T12:22:23+00:00"
Finished request 1.
Going to the next request
Waking up in 0.5 seconds.
Cleaning up request 0 ID 246 with timestamp +4
Waking up in 4.4 seconds.
Cleaning up request 1 ID 247 with timestamp +9
Ready to process requests.
////
-
List info/subscribe/unsubscribe? See http://www.freera

[Alan DeKok]

Post by Sam T
As an update, we are aiming for getting the actual Session-Timeout value
from the reply or the difference in seconds between now() and the
WISPr-Session-Terminate-Time - Whichever value is smaller
Here is the new output
Any tips would be much appreciated!
///
Login OK: [22-22-22-22-22-11/password] (from client wificpa port 0)
# Executing section post-auth from file
/etc/freeradius/sites-enabled/wifirush.rad
+- entering group post-auth {...}
++? if (reply:WISPr-Session-Terminate-Time)
? Evaluating (reply:WISPr-Session-Terminate-Time) -> TRUE
++? if (reply:WISPr-Session-Terminate-Time) -> TRUE
++- entering if (reply:WISPr-Session-Terminate-Time) {...}
expand: %{reply:WISPr-Session-Terminate-Time} - %l ->
2000-11-01T12:22:23+00:00 - 1541009986

OK, i't sprinting the session terminate time as a full date string. You can fix that by using:

%{expr:%{%{integer:reply:WISPr-Session-Terminate-Time}} - %l}

Which will print it as an integer.

Post by Sam T
WISPr-Session-Terminate-Time = "2000-11-01T12:22:23+00:00"

Note *also* that the termination year is 2000, or 18 years in the past. That has to be fixed, too. It MUST be in the future, otherwise the Session-Timeout will again be wrong.

Alan DeKok.



-
List info/subscribe/unsubscribe

[Sam T]

Hi!

Thanks again for the help! the year 2000 was us playing with dates to see
if we can learn about out issue. We are getting this error:

Improperly nested variable; %{integer:reply:WISPr-Session-Terminate-Time}}
rlm_expr: xlat failed.

We have some syntax issue.

Your advise is very helpful!

User-Password in the request is correct.
Login OK: [22-22-22-22-22-11/password] (from client wificpa port 0)
# Executing section post-auth from file
/etc/freeradius/sites-enabled/wifirush.rad
+- entering group post-auth {...}
++? if (reply:WISPr-Session-Terminate-Time)
? Evaluating (reply:WISPr-Session-Terminate-Time) -> TRUE
++? if (reply:WISPr-Session-Terminate-Time) -> TRUE
++- entering if (reply:WISPr-Session-Terminate-Time) {...}
Improperly nested variable; %{integer:reply:WISPr-Session-Terminate-Time}}
rlm_expr: xlat failed.
expand: %{expr:%{%{integer:reply:WISPr-Session-Terminate-Time}} -
%l} ->
+++[reply] returns noop
++- if (reply:WISPr-Session-Terminate-Time) returns noop
Sending Access-Accept of id 0 to 96.227.97.217 port 54434
WISPr-Bandwidth-Max-Up = 5000000
WISPr-Bandwidth-Max-Down = 5000000
Mikrotik-Rate-Limit = ""
Acct-Interim-Interval = 300
Session-Timeout = 0
Idle-Timeout = 900
WISPr-Session-Terminate-Time = "2018-11-02T12:22:23+00:00"
Finished request 0.
Going to the next request
Waking up in 4.9 seconds.
Cleaning up request 0 ID 0 with timestamp +4
Ready to process requests.

Post by Alan DeKok

Post by Sam T
As an update, we are aiming for getting the actual Session-Timeout value
from the reply or the difference in seconds between now() and the
WISPr-Session-Terminate-Time - Whichever value is smaller
Here is the new output
Any tips would be much appreciated!
///
Login OK: [22-22-22-22-22-11/password] (from client wificpa port 0)
# Executing section post-auth from file
/etc/freeradius/sites-enabled/wifirush.rad
+- entering group post-auth {...}
++? if (reply:WISPr-Session-Terminate-Time)
? Evaluating (reply:WISPr-Session-Terminate-Time) -> TRUE
++? if (reply:WISPr-Session-Terminate-Time) -> TRUE
++- entering if (reply:WISPr-Session-Terminate-Time) {...}
expand: %{reply:WISPr-Session-Terminate-Time} - %l ->
2000-11-01T12:22:23+00:00 - 1541009986

OK, i't sprinting the session terminate time as a full date string. You
%{expr:%{%{integer:reply:WISPr-Session-Terminate-Time}} - %l}
Which will print it as an integer.

Post by Sam T
WISPr-Session-Terminate-Time = "2000-11-01T12:22:23+00:00"

Note *also* that the termination year is 2000, or 18 years in the past.
That has to be fixed, too. It MUST be in the future, otherwise the
Session-Timeout will again be wrong.
Alan DeKok.
-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html

-
List info/subscribe/unsubscrib

[Alan DeKok]

Post by Sam T
Hi!
Thanks again for the help! the year 2000 was us playing with dates to see
Improperly nested variable; %{integer:reply:WISPr-Session-Terminate-Time}}
rlm_expr: xlat failed.

You didn't use what I suggested.

Post by Sam T

Post by Alan DeKok
OK, i't sprinting the session terminate time as a full date string. You
%{expr:%{%{integer:reply:WISPr-Session-Terminate-Time}} - %l}
Which will print it as an integer.

Alan DeKok.

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.h

[Sam T]

Arg, were stuck. I thought we had your edit in here correctly. Here is the
entire expression and the output.

//////////

%{expr:%{%{integer:reply:WISPr-Session-Terminate-Time}} - %l}


if (reply:WISPr-Session-Terminate-Time) {
update reply {
# Session-Timeout := "%{expr:%{WISPr-Session-Terminate-Time} - %l}"
# Session-Timeout := "%{expr:%{reply:WISPr-Session-Terminate-Time}
- %l}"
Session-Timeout :=
"%{expr:%{%{integer:reply:WISPr-Session-Terminate-Time}} - %l}"
}
}

/////////////

User-Password in the request is correct.
Login OK: [22-22-22-22-22-11/password] (from client wificpa port 0)
# Executing section post-auth from file
/etc/freeradius/sites-enabled/wifirush.rad
+- entering group post-auth {...}
++? if (reply:WISPr-Session-Terminate-Time)
? Evaluating (reply:WISPr-Session-Terminate-Time) -> TRUE
++? if (reply:WISPr-Session-Terminate-Time) -> TRUE
++- entering if (reply:WISPr-Session-Terminate-Time) {...}
Improperly nested variable; %{integer:reply:WISPr-Session-Terminate-Time}}
rlm_expr: xlat failed.
expand: %{expr:%{%{integer:reply:WISPr-Session-Terminate-Time}} -
%l} ->
+++[reply] returns noop
++- if (reply:WISPr-Session-Terminate-Time) returns noop
Sending Access-Accept of id 0 to 96.227.97.217 port 54434
WISPr-Bandwidth-Max-Up = 5000000
WISPr-Bandwidth-Max-Down = 5000000
Mikrotik-Rate-Limit = ""
Acct-Interim-Interval = 300
Session-Timeout = 0
Idle-Timeout = 900
WISPr-Session-Terminate-Time = "2018-11-02T12:22:23+00:00"
Finished request 0.
Going to the next request
Waking up in 4.9 seconds.
Cleaning up request 0 ID 0 with timestamp +4
Ready to process requests.

Post by Alan DeKok

Post by Sam T
Hi!
Thanks again for the help! the year 2000 was us playing with dates to see
Improperly nested variable;

%{integer:reply:WISPr-Session-Terminate-Time}}

Post by Sam T
rlm_expr: xlat failed.

You didn't use what I suggested.

Post by Sam T

Post by Alan DeKok
OK, i't sprinting the session terminate time as a full date string.

You

Post by Sam T

Post by Alan DeKok
%{expr:%{%{integer:reply:WISPr-Session-Terminate-Time}} - %l}
Which will print it as an integer.

Alan DeKok.
-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html

-
List info/subscribe/unsubs

[Arran Cudbard-Bell]

Post by Sam T
Arg, were stuck. I thought we had your edit in here correctly. Here is the
entire expression and the output.
//////////
%{expr:%{%{integer:reply:WISPr-Session-Terminate-Time}} - %l}
if (reply:WISPr-Session-Terminate-Time) {
update reply {
# Session-Timeout := "%{expr:%{WISPr-Session-Terminate-Time} - %l}"
# Session-Timeout := "%{expr:%{reply:WISPr-Session-Terminate-Time}
- %l}"
Session-Timeout :=
"%{expr:%{%{integer:reply:WISPr-Session-Terminate-Time}} - %l}"
}
}

Ah Alan's initial expression was slightly incorrect, the correct one is:

%{expr:%{integer:reply:WISPr-Session-Terminate-Time} - %l}

It had two many levels of nesting around the integer expansion.

-Arran

Arran Cudbard-Bell <***@freeradius.org>
FreeRADIUS Development Team

FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/l

[Arran Cudbard-Bell]

Post by Arran Cudbard-Bell

Post by Sam T
Arg, were stuck. I thought we had your edit in here correctly. Here is the
entire expression and the output.
//////////
%{expr:%{%{integer:reply:WISPr-Session-Terminate-Time}} - %l}
if (reply:WISPr-Session-Terminate-Time) {
update reply {
# Session-Timeout := "%{expr:%{WISPr-Session-Terminate-Time} - %l}"
# Session-Timeout := "%{expr:%{reply:WISPr-Session-Terminate-Time}
- %l}"
Session-Timeout :=
"%{expr:%{%{integer:reply:WISPr-Session-Terminate-Time}} - %l}"
}
}

%{expr:%{integer:reply:WISPr-Session-Terminate-Time} - %l}
It had two many levels of nesting around the integer expansion.

too/two, technically both correct :)

-Arran

Arran Cudbard-Bell <***@freeradius.org>
FreeRADIUS Development Team

FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2


-
List info/subscribe/unsub

[Sam T]

Hi Alan and Arran

Thank you for your feedback. So if this expression is indeed corrected now,
i guess my question lies with how to handle the output.

It appears that the function to get WISPr-Session-Terminate-Time as an
integer is resulting in a blank value

if (reply:WISPr-Session-Terminate-Time) {
update reply {

# Session-Timeout :=
"%{expr:%{integer:reply:WISPr-Session-Terminate-Time} - %l}"
# Session-Timeout := "%l"
Session-Timeout := "%{integer:reply:WISPr-Session-Terminate-Time}"
}
}

Specifically,

Session-Timeout := "%{integer:reply:WISPr-Session-Terminate-Time}"

results in a blank value

/////

This returns noop

Login OK: [22-22-22-22-22-11/password] (from client wificpa port 0)
# Executing section post-auth from file
/etc/freeradius/sites-enabled/wifirush.rad
+- entering group post-auth {...}
++? if (reply:WISPr-Session-Terminate-Time)
? Evaluating (reply:WISPr-Session-Terminate-Time) -> TRUE
++? if (reply:WISPr-Session-Terminate-Time) -> TRUE
++- entering if (reply:WISPr-Session-Terminate-Time) {...}
expand: %{integer:reply:WISPr-Session-Terminate-Time} ->
+++[reply] returns noop
++- if (reply:WISPr-Session-Terminate-Time) returns noop
Sending Access-Accept of id 105 to 96.227.97.217 port 63869
WISPr-Bandwidth-Max-Up = 5000000
WISPr-Bandwidth-Max-Down = 5000000
Mikrotik-Rate-Limit = ""
Acct-Interim-Interval = 300
Session-Timeout = 0
Idle-Timeout = 900
WISPr-Session-Terminate-Time = "2018-12-02T12:22:23+00:00"
Finished request 3.
Going to the next request

//////////



%{expr:%{integer:reply:WISPr-Session-Terminate-Time} - %l}

the value being returned is not what we are expecting / Session-Timeout =
2753857926 / 2.7 Billion seconds is not what we were hoping for /
2753857926 seconds ago was July 28 1931

So, my question is, is the nested function,

{integer:reply:WISPr-Session-Terminate-Time}

actually converting into seconds or is it the value compared to epoch?

Any additional direction on how to handle the output, if correct, would be
greatly appreciated.
-
List info/subscribe/unsubscrib

[Sam T]

Hi all

Can I get some help to interpret the output value from
%{expr:%{integer:reply:WISPr-Session-Terminate-Time} - %l}

the value being returned is not what we are expecting / Session-Timeout =
2753857926

is the unlang or output erroneous or is it in some epoch related time?
-
List info/subscribe/unsubscribe? See http://www.freeradius.o

[Alan DeKok]

Post by Sam T
Hi all
Can I get some help to interpret the output value from
%{expr:%{integer:reply:WISPr-Session-Terminate-Time} - %l}
the value being returned is not what we are expecting / Session-Timeout =
2753857926
is the unlang or output erroneous or is it in some epoch related time?

It's impossible to tell without seeing the debug output.

Alan DeKok.


-
List info/subscribe/unsubscribe? See http://www.freeradius.org/lis

[Sam T]

Hi Alan

First off, Thanks so much for the reply! I think there was some delay in my
last email sending, so I sent an abridged follow up which you replied to
not seeing the debug info.

Here is the entire message with the output. Let me know if there is
something more you need to see. I am very excited to get this working :)

----

So if this expression is indeed corrected now, i guess my question lies
with how to handle the output? Take a look

if (reply:WISPr-Session-Terminate-Time) {
update reply {

Session-Timeout :=
"%{expr:%{integer:reply:WISPr-Session-Terminate-Time} - %l}"
}
}

# this returns

User-Password in the request is correct.
Login OK: [22-22-22-22-22-11/password] (from client wificpa port 0)
# Executing section post-auth from file
/etc/freeradius/sites-enabled/wifirush.rad
+- entering group post-auth {...}
++? if (reply:WISPr-Session-Terminate-Time)
? Evaluating (reply:WISPr-Session-Terminate-Time) -> TRUE
++? if (reply:WISPr-Session-Terminate-Time) -> TRUE
++- entering if (reply:WISPr-Session-Terminate-Time) {...}
expand: %{integer:reply:WISPr-Session-Terminate-Time} - %l -> -
1541810370
expand: %{expr:%{integer:reply:WISPr-Session-Terminate-Time} - %l}
-> -1541810370
+++[reply] returns noop
++- if (reply:WISPr-Session-Terminate-Time) returns noop
Sending Access-Accept of id 148 to 96.227.97.217 port 52831
WISPr-Bandwidth-Max-Up = 5000000
WISPr-Bandwidth-Max-Down = 5000000
Mikrotik-Rate-Limit = ""
Acct-Interim-Interval = 300
Session-Timeout = 2753156926
Idle-Timeout = 900
WISPr-Session-Terminate-Time = "2018-12-02T12:22:23+00:00"
Finished request 1.
Going to the next request
Waking up in 4.9 seconds.
Cleaning up request 1 ID 148 with timestamp +13
Ready to process requests.

#############

Here is a debug rule with what we are trying to do that will output the two
values we are interested in doing math on ....

if (reply:WISPr-Session-Terminate-Time) {
update reply {

Session-Timeout :=
"%{expr:%{integer:reply:WISPr-Session-Terminate-Time} - %l}"
Reply-Message := "Now Value is %l AND Debug-SessionTimeoutInt is
"%{integer:reply:WISPr-Session-Terminate-Time}"
}
}

Login OK: [22-22-22-22-22-11/password] (from client wificpa port 0)
# Executing section post-auth from file
/etc/freeradius/sites-enabled/wifirush.rad
+- entering group post-auth {...}
++? if (reply:WISPr-Session-Terminate-Time)
? Evaluating (reply:WISPr-Session-Terminate-Time) -> TRUE
++? if (reply:WISPr-Session-Terminate-Time) -> TRUE
++- entering if (reply:WISPr-Session-Terminate-Time) {...}
expand: %{integer:reply:WISPr-Session-Terminate-Time} - %l -> -
1541810786
expand: %{expr:%{integer:reply:WISPr-Session-Terminate-Time} - %l}
-> -1541810786
expand: Now Value is %l AND Debug-SessionTimeoutInt is -> Now
Value is 1541810786 AND Debug-SessionTimeoutInt is
+++[reply] returns noop
++- if (reply:WISPr-Session-Terminate-Time) returns noop
Sending Access-Accept of id 151 to 96.227.97.217 port 53014
WISPr-Bandwidth-Max-Up = 5000000
WISPr-Bandwidth-Max-Down = 5000000
Mikrotik-Rate-Limit = ""
Acct-Interim-Interval = 300
Session-Timeout = 2753156510
Idle-Timeout = 900
WISPr-Session-Terminate-Time = "2018-12-02T12:22:23+00:00"
Reply-Message = "Now Value is 1541810786 AND
Debug-SessionTimeoutInt is "
Finished request 2.
Going to the next request

-----

I think the issue is handling this
Reply-Message = "Now Value is 1541810786 AND Debug-SessionTimeoutInt is "

Shows that %l = 1541810786
%{integer:reply:WISPr-Session-Terminate-Time} = NULL
%{integer:reply:WISPr-Session-Terminate-Time} should result in some integer

Then, we will need to convert the final value into seconds, and not as
compared to epoch, if that is what it is outputting vs the actual session
timout :)

Any additional direction on how to handle the output, if correct, would be
greatly appreciated.

Post by Alan DeKok

Post by Sam T
Hi all
Can I get some help to interpret the output value from
%{expr:%{integer:reply:WISPr-Session-Terminate-Time} - %l}
the value being returned is not what we are expecting / Session-Timeout =
2753857926
is the unlang or output erroneous or is it in some epoch related time?

It's impossible to tell without seeing the debug output.
Alan DeKok.
-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html

-
List info/subscribe/unsubscrib

[Alan DeKok]

Post by Sam T
So if this expression is indeed corrected now, i guess my question lies
with how to handle the output? Take a look
if (reply:WISPr-Session-Terminate-Time) {
update reply {
Session-Timeout :=
"%{expr:%{integer:reply:WISPr-Session-Terminate-Time} - %l}"

It turns out that WISPr-Session-Terminate-Time isn't a "date" attribute. It's just a "string".

So no, you can't convert a string to an integer. The v3.0.x code in GitHub gives descriptive errors that explain what's going wrong.

Post by Sam T
...
WISPr-Session-Terminate-Time = "2018-12-02T12:22:23+00:00"

Which is a *string* that represents a date, and not actually a date. <sigh> Why can't people design their RADIUS dictionaries correctly?

The solution is this:

1) use the v3.0.x branch from GitHub in order to get better error messages, and to fix some "expr" parsing issues

2) edit mods-available/date, and add:

date wispr2date {
format = "%Y-%m-%dT%H:%M:%S"
}

3) use this in the "authorize" section:

if (reply:WISPr-Session-Terminate-Time) {
update reply {
Tmp-Date-0 := "%{wispr2date:&reply:WISPr-Session-Terminate-Time}"
}

update reply {
Session-Timeout = "%{expr:%{integer:reply:Tmp-Date-0} - %l}"
}
}

And that should work.

If the WISPr people had used the correct data types, this would be much easier.

Alan DeKok.


-
List info/subscribe/unsubscribe? See http:

[Sam T]

Hi Alan

Thank you for your input!

Is it necessary to use v3 and run the script you recently sent? Do the
"exper parsing improvements" you mentioned in v3 necessary in the use of
your script?

(I'm not sure we can change the server version as we are on an aging system
with many working bits and customizations over the years)

My team came up with this 2query SQL approach that does give the expected
results, it has multiple queries, and I wanted to ask your opinion to
improve it

if ("%{sql:SELECT
TIMESTAMPDIFF(SECOND,(NOW()),'%{reply:WISPr-Session-Terminate-Time}')#}" <=
"%{reply:Session-Timeout}") {
update reply {
Session-Timeout := "%{sql:SELECT
TIMESTAMPDIFF(SECOND,(NOW()),'%{reply:WISPr-Session-Terminate-Time}')}"
}
}


Thanks!
-
List info/subscribe/u

[Alan DeKok]

Post by Sam T
Is it necessary to use v3 and run the script you recently sent?

Yes,

Post by Sam T
Do the
"exper parsing improvements" you mentioned in v3 necessary in the use of
your script?

The patch fixes parsing errors. Without the patch, it won't work.

Post by Sam T
(I'm not sure we can change the server version as we are on an aging system
with many working bits and customizations over the years)
My team came up with this 2query SQL approach that does give the expected
results, it has multiple queries, and I wanted to ask your opinion to
improve it
if ("%{sql:SELECT
TIMESTAMPDIFF(SECOND,(NOW()),'%{reply:WISPr-Session-Terminate-Time}')#}" <=
"%{reply:Session-Timeout}") {
update reply {
Session-Timeout := "%{sql:SELECT
TIMESTAMPDIFF(SECOND,(NOW()),'%{reply:WISPr-Session-Terminate-Time}')}"
}
}

If it works, it's fine.

Alan DeKok.

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.