Rewrite Rule

[Maile Halatuituia]

Hi I have this Cisco-AVPair = "acct-input-octets-ipv6=xxx" on my radius acct-request packet coming from my Cisco BRAS.
I want to rewrite it to something like this acct-input-octets-ipv6=xxx on my preacct section of my default server (/etc/freeradius/sites-available/default) config and update my request .....
I have this policy already

if( &Cisco-AVPair[*]=~/\(acct-input-octets-ipv6\)=\(\d+)/ ) {
update request {
&acct-input-octets-ipv6 := "%{2}"
}
}

But seems it doing nothing. Maybe my regex above is wrong or something but that's why I ask .
Here is the portion of my freeradius -X I think it is relevant to this question.

# Executing section preacct from file /etc/freeradius/sites-enabled/default
(2) preacct {
(2) policy acct_counters64.preacct {
(2) update request {
(2) WARNING: Can't find &Acct-Input-Gigawords. Using 0 as operand value
(2) EXPAND %{expr:(&Acct-Input-Gigawords << 32) | &Acct-Input-Octets}
(2) --> 52
(2) &Acct-Input-Octets64 = 52
(2) WARNING: Can't find &Acct-Output-Gigawords. Using 0 as operand value
(2) EXPAND %{expr:(&Acct-Output-Gigawords << 32) | &Acct-Output-Octets}
(2) --> 92
(2) &Acct-Output-Octets64 = 92
(2) } # update request = noop
(2) } # policy acct_counters64.preacct = noop
(2) [preprocess] = ok
(2) if ( &User-Name !~ /\@/ ) {
(2) if ( &User-Name !~ /\@/ ) -> FALSE
(2) update request {
(2) EXPAND %{expr: %l - %{%{Acct-Session-Time}:-0} - %{%{Acct-Delay-Time}:-0}}
(2) --> 1541032848
(2) &FreeRADIUS-Acct-Session-Start-Time := Nov 1 2018 13:40:48 +13
(2) } # update request = noop
(2) policy acct_unique {
(2) update request {
(2) Tmp-String-9 := "ai:"
(2) } # update request = noop
(2) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) {
(2) EXPAND %{hex:&Class}
(2) -->
(2) EXPAND ^%{hex:&Tmp-String-9}
(2) --> ^61693a
(2) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) -> FALSE
(2) else {
(2) update request {
(2) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}}
(2) --> 8022139d00768a562a41866693fa1427
(2) &Acct-Unique-Session-Id := 8022139d00768a562a41866693fa1427
(2) } # update request = noop
(2) } # else = noop
(2) } # policy acct_unique = noop
(2) if ( &Cisco-AVPair[*]=~/\(acct-input-octets-ipv6\)=\(\d+)/ ) {
(2) if ( &Cisco-AVPair[*]=~/\(acct-input-octets-ipv6\)=\(\d+)/ ) -> FALSE
(2) if ( &Cisco-AVPair[*]=~/\(acct-output-octets-ipv6\)=\(\d+)/ ) {
(2) if ( &Cisco-AVPair[*]=~/\(acct-output-octets-ipv6\)=\(\d+)/ ) -> FALSE
(2) } # preacct = ok


Confidentiality Notice: This email (including any attachment) is intended for internal use only. Any unauthorized use, dissemination or copying of the content is prohibited. If you are not the intended recipient and have received this e-mail in error, please notify the sender by email and delete this email and any attachment.
-
List info/subscribe/unsubscribe? Se

[Maile Halatuituia]

This is the exact portion

(3) # Executing section preacct from file /etc/freeradius/sites-enabled/default
(3) preacct {
(3) [preprocess] = ok
(3) if ( &Cisco-AVPair ) {
(3) if ( &Cisco-AVPair ) -> TRUE
(3) if ( &Cisco-AVPair ) {
(3) if ( &Cisco-AVPair[*]=~/\(client-mac-address\)=\([[:alnum:]]{4}\.[[:alnum:]]{4}\.[[:alnum:]]{4}\)/ ) {
(3) if ( &Cisco-AVPair[*]=~/\(client-mac-address\)=\([[:alnum:]]{4}\.[[:alnum:]]{4}\.[[:alnum:]]{4}\)/ ) -> TRUE
(3) if ( &Cisco-AVPair[*]=~/\(client-mac-address\)=\([[:alnum:]]{4}\.[[:alnum:]]{4}\.[[:alnum:]]{4}\)/ ) {
(3) update request {
(3) EXPAND %{2}
(3) --> ae6e.0e71.2d61
(3) &Client-MAC-Address := ae6e.0e71.2d61
(3) } # update request = noop
(3) } # if ( &Cisco-AVPair[*]=~/\(client-mac-address\)=\([[:alnum:]]{4}\.[[:alnum:]]{4}\.[[:alnum:]]{4}\)/ ) = noop
(3) if ( &Cisco-AVPair[*]=~/\(acct-input-octets-ipv6\)=\(\d+)/ ) {
(3) if ( &Cisco-AVPair[*]=~/\(acct-input-octets-ipv6\)=\(\d+)/ ) -> FALSE
(3) if ( &Cisco-AVPair[*]=~/\(acct-output-octets-ipv6\)=\(\d+)/ ) {
(3) if ( &Cisco-AVPair[*]=~/\(acct-output-octets-ipv6\)=\(\d+)/ ) -> FALSE

Note that the portion for MAC address is work ok but not the portion mentioned ealier on.

-----Original Message-----
From: Freeradius-Users <freeradius-users-bounces+maile.halatuituia=***@lists.freeradius.org> On Behalf Of Maile Halatuituia
Sent: Thursday, 1 November 2018 1:45 PM
To: FreeRadius users mailing list <freeradius-***@lists.freeradius.org>
Subject: Rewrite Rule

Hi I have this Cisco-AVPair = "acct-input-octets-ipv6=xxx" on my radius acct-request packet coming from my Cisco BRAS.
I want to rewrite it to something like this acct-input-octets-ipv6=xxx on my preacct section of my default server (/etc/freeradius/sites-available/default) config and update my request .....
I have this policy already

if( &Cisco-AVPair[*]=~/\(acct-input-octets-ipv6\)=\(\d+)/ ) {
update request {
&acct-input-octets-ipv6 := "%{2}"
}
}

But seems it doing nothing. Maybe my regex above is wrong or something but that's why I ask .
Here is the portion of my freeradius -X I think it is relevant to this question.

# Executing section preacct from file /etc/freeradius/sites-enabled/default
(2) preacct {
(2) policy acct_counters64.preacct {
(2) update request {
(2) WARNING: Can't find &Acct-Input-Gigawords. Using 0 as operand value
(2) EXPAND %{expr:(&Acct-Input-Gigawords << 32) | &Acct-Input-Octets}
(2) --> 52
(2) &Acct-Input-Octets64 = 52
(2) WARNING: Can't find &Acct-Output-Gigawords. Using 0 as operand value
(2) EXPAND %{expr:(&Acct-Output-Gigawords << 32) | &Acct-Output-Octets}
(2) --> 92
(2) &Acct-Output-Octets64 = 92
(2) } # update request = noop
(2) } # policy acct_counters64.preacct = noop
(2) [preprocess] = ok
(2) if ( &User-Name !~ /\@/ ) {
(2) if ( &User-Name !~ /\@/ ) -> FALSE
(2) update request {
(2) EXPAND %{expr: %l - %{%{Acct-Session-Time}:-0} - %{%{Acct-Delay-Time}:-0}}
(2) --> 1541032848
(2) &FreeRADIUS-Acct-Session-Start-Time := Nov 1 2018 13:40:48 +13
(2) } # update request = noop
(2) policy acct_unique {
(2) update request {
(2) Tmp-String-9 := "ai:"
(2) } # update request = noop
(2) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) {
(2) EXPAND %{hex:&Class}
(2) -->
(2) EXPAND ^%{hex:&Tmp-String-9}
(2) --> ^61693a
(2) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) -> FALSE
(2) else {
(2) update request {
(2) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}}
(2) --> 8022139d00768a562a41866693fa1427
(2) &Acct-Unique-Session-Id := 8022139d00768a562a41866693fa1427
(2) } # update request = noop
(2) } # else = noop
(2) } # policy acct_unique = noop
(2) if ( &Cisco-AVPair[*]=~/\(acct-input-octets-ipv6\)=\(\d+)/ ) {
(2) if ( &Cisco-AVPair[*]=~/\(acct-input-octets-ipv6\)=\(\d+)/ ) -> FALSE
(2) if ( &Cisco-AVPair[*]=~/\(acct-output-octets-ipv6\)=\(\d+)/ ) {
(2) if ( &Cisco-AVPair[*]=~/\(acct-output-octets-ipv6\)=\(\d+)/ ) -> FALSE
(2) } # preacct = ok


Confidentiality Notice: This email (including any attachment) is intended for internal use only. Any unauthorized use, dissemination or copying of the content is prohibited. If you are not the intended recipient and have received this e-mail in error, please notify the sender by email and delete this email and any attachment.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Confidentiality Notice: This email (including any attachment) is intended for internal use only. Any unauthorized use, dissemination or copying of the content is prohibited. If you are not the intended recipient and have received this e-mail in error, please notify the sender by email and delete this email and any attachment.
Confidentiality Notice: This email (including any attachment) is intended for internal use only. Any unauthorized use, dissemination or copying of the content is prohibited. If you are not the intended recipient and have received this e-mail in error, please notify the sender by email and delete this email and any attachment.

-
List info/subscribe/unsubscribe? See htt

[Alan DeKok]

Post by Maile Halatuituia
Hi I have this Cisco-AVPair = "acct-input-octets-ipv6=xxx" on my radius acct-request packet coming from my Cisco BRAS.
I want to rewrite it to something like this acct-input-octets-ipv6=xxx on my preacct section of my default server (/etc/freeradius/sites-available/default) config and update my request .....
I have this policy already
if( &Cisco-AVPair[*]=~/\(acct-input-octets-ipv6\)=\(\d+)/ ) {

That won't work. You can't use [*] to look at *all* Cisco-AVPair attributes.

Post by Maile Halatuituia
update request {
&acct-input-octets-ipv6 := "%{2}"

That won't work, either. "acct-input-octets-ipv6" isn't a RADIUS attribute.

You can't just make up names and expect that they do what you want. The dictionaries (and what they do) is well documented.

Post by Maile Halatuituia
But seems it doing nothing. Maybe my regex above is wrong or something but that's why I ask .
Here is the portion of my freeradius -X I think it is relevant to this question.

Which doesn't include the packet received by the server.

There *is* documentation that says what we need on the mailing list. You get a link to that documentation when you subscribe to the mailing list.

Alan DeKok.


-
List info/subscribe/unsubscribe? See http://www.freeradius.org/lis

[Maile Halatuituia]

Hi Alan
Here is the packet

(4) Acct-Session-Id = "0/0/2/213_0048C203"
(4) Framed-IP-Address = b.b.b.b
(4) Framed-Protocol = PPP
(4) Framed-IPv6-Prefix = a.a.a.a
(4) Framed-Interface-Id = cb5:8c6:2d40:47d7
(4) Delegated-IPv6-Prefix = a.a.a.a
(4) User-Name := "***@kalianet.to"
(4) Cisco-AVPair = "connect-progress=LAN Ses Up"
(4) Cisco-AVPair = "nas-tx-speed=1000000000"
(4) Cisco-AVPair = "nas-rx-speed=1000000000"
(4) Acct-Session-Time = 318
(4) Acct-Input-Octets = 3350
(4) Acct-Output-Octets = 6658
(4) Cisco-AVPair = "acct-input-octets-ipv6=2586"
(4) Cisco-AVPair = "acct-output-octets-ipv6=4914"
(4) Acct-Input-Packets = 65
(4) Acct-Output-Packets = 81
(4) Cisco-AVPair = "acct-input-packets-ipv6=41"
(4) Cisco-AVPair = "acct-output-packets-ipv6=50"
(4) Acct-Authentic = RADIUS
(4) Acct-Status-Type = Interim-Update
(4) NAS-Port-Type = Ethernet
(4) NAS-Port = 33554645
(4) NAS-Port-Id = "0/0/2/213"
(4) Connect-Info = "ACCESS-STATIC"
(4) Cisco-AVPair = "client-mac-address=ae6e.0e71.2d61"
(4) Service-Type = Framed-User
(4) NAS-IP-Address = x.x.x.x
(4) PMIP6-Home-HN-Prefix = 3841:3433:4642::/55
(4) Event-Timestamp = "Nov 1 2018 13:52:44 +13"
(4) NAS-Identifier = "ha_bng2.kalianet.to"
(4) Acct-Delay-Time = 0
(4) Proxy-State = 0x313033

I have three take away from your reply below.
1. I need to look at what value should I use for this particular Cisco AVP attribute for my filter. We use the same for the MAC address and seems to rewrite the MAC address received on the packet and it is working but not for the ipv6 counter.
2. any suggestion how to do this or particular documentation is very much appreciated
3. I also send the packet for your further specific comment that would help

-----Original Message-----
From: Freeradius-Users <freeradius-users-bounces+maile.halatuituia=***@lists.freeradius.org> On Behalf Of Alan DeKok
Sent: Thursday, 1 November 2018 1:54 PM
To: FreeRadius users mailing list <freeradius-***@lists.freeradius.org>
Subject: Re: Rewrite Rule

Post by Maile Halatuituia
Hi I have this Cisco-AVPair = "acct-input-octets-ipv6=xxx" on my radius acct-request packet coming from my Cisco BRAS.
I want to rewrite it to something like this acct-input-octets-ipv6=xxx on my preacct section of my default server (/etc/freeradius/sites-available/default) config and update my request .....
I have this policy already
if( &Cisco-AVPair[*]=~/\(acct-input-octets-ipv6\)=\(\d+)/ ) {

That won't work. You can't use [*] to look at *all* Cisco-AVPair attributes.

Post by Maile Halatuituia
update request {
&acct-input-octets-ipv6 := "%{2}"

That won't work, either. "acct-input-octets-ipv6" isn't a RADIUS attribute.

You can't just make up names and expect that they do what you want. The dictionaries (and what they do) is well documented.

Post by Maile Halatuituia
But seems it doing nothing. Maybe my regex above is wrong or something but that's why I ask .
Here is the portion of my freeradius -X I think it is relevant to this question.

Which doesn't include the packet received by the server.

There *is* documentation that says what we need on the mailing list. You get a link to that documentation when you subscribe to the mailing list.

Alan DeKok.


-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Confidentiality Notice: This email (including any attachment) is intended for internal use only. Any unauthorized use, dissemination or copying of the content is prohibited. If you are not the intended recipient and have received this e-mail in error, please notify the sender by email and delete this email and any attachment.
Confidentiality Notice: This email (including any attachment) is intended for internal use only. Any unauthorized use, dissemination or copying of the content is prohibited. If you are not the intended recipient and have received this e-mail in error, please notify the sender by email and delete this email and any attachment.

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/lis

[Alan DeKok]

Post by Maile Halatuituia
Hi Alan
Here is the packet
...
(4) Cisco-AVPair = "connect-progress=LAN Ses Up"
(4) Cisco-AVPair = "nas-tx-speed=1000000000"
(4) Cisco-AVPair = "nas-rx-speed=1000000000"
...
(4) Cisco-AVPair = "acct-input-octets-ipv6=2586"
(4) Cisco-AVPair = "acct-output-octets-ipv6=4914"
...
(4) Cisco-AVPair = "acct-input-packets-ipv6=41"
(4) Cisco-AVPair = "acct-output-packets-ipv6=50"
...
(4) Cisco-AVPair = "client-mac-address=ae6e.0e71.2d61"

So lots of Cisco-AVPAirs.

To be honest, "unlang" isn't well suited for picking specific attributes based on specific contents. You can use "foreach", which should work. But it's a bit awkward.

Post by Maile Halatuituia
I have three take away from your reply below.
1. I need to look at what value should I use for this particular Cisco AVP attribute for my filter.

You should test the regular expression in isolation. i.e. with packets containing ONE Cisco-AVPair. And use "radclient" to send test packets.

It also would be good to fix the regular expression. You have the brackets escaped, which doesn't seem right.

Post by Maile Halatuituia
We use the same for the MAC address and seems to rewrite the MAC address received on the packet and it is working but not for the ipv6 counter.

Well, if the MAC regex works, and this one doesn't, then they're not the same, are they?

Post by Maile Halatuituia
2. any suggestion how to do this or particular documentation is very much appreciated

Use the correct regex. Do *small* tests, with *small* packets. There is no simple way in unlang to do this kind of thing. Cisco has made it very hard, by burying names inside of values.

You should be able to do something like this:

foreach &Cisco-AVPair {
if ("%{Foreach-Variable-0}" =~ /^acct-input-octets-ipv6=(.*)$/) {
update request {
... something ...
}
}
}

You will need to use a *real* attribute name instead of "something". As I said before, you can't just invent a "acct-input-octets-ipv6" attribute, and expect it to do what you want. If you do that, the server will fail to start. So you have to create the attribute. See raddb/dictionary for documentation.

Alan DeKok.


-
List info/subscribe/unsubscribe? See http://www.free

[Maile Halatuituia]

I looked through the cisco dictionary file and see no mention of ipv6 there

-----Original Message-----
From: Freeradius-Users <freeradius-users-bounces+maile.halatuituia=***@lists.freeradius.org> On Behalf Of Alan DeKok
Sent: Thursday, 1 November 2018 2:14 PM
To: FreeRadius users mailing list <freeradius-***@lists.freeradius.org>
Subject: Re: Rewrite Rule

Post by Maile Halatuituia
Hi Alan
Here is the packet
...
(4) Cisco-AVPair = "connect-progress=LAN Ses Up"
(4) Cisco-AVPair = "nas-tx-speed=1000000000"
(4) Cisco-AVPair = "nas-rx-speed=1000000000"
...
(4) Cisco-AVPair = "acct-input-octets-ipv6=2586"
(4) Cisco-AVPair = "acct-output-octets-ipv6=4914"
...
(4) Cisco-AVPair = "acct-input-packets-ipv6=41"
(4) Cisco-AVPair = "acct-output-packets-ipv6=50"
...
(4) Cisco-AVPair = "client-mac-address=ae6e.0e71.2d61"

So lots of Cisco-AVPAirs.

To be honest, "unlang" isn't well suited for picking specific attributes based on specific contents. You can use "foreach", which should work. But it's a bit awkward.

Post by Maile Halatuituia
I have three take away from your reply below.
1. I need to look at what value should I use for this particular Cisco AVP attribute for my filter.

You should test the regular expression in isolation. i.e. with packets containing ONE Cisco-AVPair. And use "radclient" to send test packets.

It also would be good to fix the regular expression. You have the brackets escaped, which doesn't seem right.

Post by Maile Halatuituia
We use the same for the MAC address and seems to rewrite the MAC address received on the packet and it is working but not for the ipv6 counter.

Well, if the MAC regex works, and this one doesn't, then they're not the same, are they?

Post by Maile Halatuituia
2. any suggestion how to do this or particular documentation is very much appreciated

Use the correct regex. Do *small* tests, with *small* packets. There is no simple way in unlang to do this kind of thing. Cisco has made it very hard, by burying names inside of values.

You should be able to do something like this:

foreach &Cisco-AVPair {
if ("%{Foreach-Variable-0}" =~ /^acct-input-octets-ipv6=(.*)$/) {
update request {
... something ...
}
}
}

You will need to use a *real* attribute name instead of "something". As I said before, you can't just invent a "acct-input-octets-ipv6" attribute, and expect it to do what you want. If you do that, the server will fail to start. So you have to create the attribute. See raddb/dictionary for documentation.

Alan DeKok.


-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Confidentiality Notice: This email (including any attachment) is intended for internal use only. Any unauthorized use, dissemination or copying of the content is prohibited. If you are not the intended recipient and have received this e-mail in error, please notify the sender by email and delete this email and any attachment.
Confidentiality Notice: This email (including any attachment) is intended for internal use only. Any unauthorized use, dissemination or copying of the content is prohibited. If you are not the intended recipient and have received this e-mail in error, please notify the sender by email and delete this email and any attachment.

-
List info/subscribe/unsubscribe? Se

[Nathan Ward]

Post by Maile Halatuituia
I looked through the cisco dictionary file and see no mention of ipv6 there

Hi,

What is the outcome you are trying to achieve? It is not clear why you need to rewrite this. What do you want to happen? Why?

I replied to a very similar question from you a few days ago, but I see you haven’t made any changes, and are asking basically the same question.

--
Nathan Ward


-
List info/subscribe/unsubscribe? See http://www.fre

[Maile Halatuituia]

Hi Nathan
Yes you right .
I have this situation to be exact.

MSAN ------------ BRAS (Cisco) ---------- Freeradius Server (Acct+Auth)
I will refer to me Freeradius Server as Radius for short.

Right now I have IPv4 only which i received this standard attribute (Acct-Input-Octets) from my BRAS on my Radius server. Upon receive a perl module process that attribute to store on local mysql server DB on the same server above.

Before asking the question I enabe ipv6 as well alongside ipv4 where now I have dual stack working perfectly. Still I continue to recives the same standard attribute above (Acct-Input-Octets) which contain the count for both the ipv4 and ipv6 according the ietf RFC 2866.

Now I also enable the Cisco command to receive also the Cisco AVP attribute (acct-input-octets-ipv6) in the format mentioned on my previous email (Cisco-AVPair = "acct-input-octets-ipv6=xxx)" I want to process that in addition to my standard counter so I can know how much ipv6 traffic to each customer compare to its ipv4 traffic.

Because Radius doesn't understand that Cisco thing I need to rewrite that specific Cisco thing upon receiving the request packet from BRAS on the preacct module on my default server config before it can be processed......

That’s why I do that regex thing and I am still asking for help regarding it.

I hope I express my situation more clear. Please let me know



-----Original Message-----
From: Freeradius-Users <freeradius-users-bounces+maile.halatuituia=***@lists.freeradius.org> On Behalf Of Nathan Ward
Sent: Thursday, 1 November 2018 2:36 PM
To: FreeRadius users mailing list <freeradius-***@lists.freeradius.org>
Subject: Re: Rewrite Rule

Post by Maile Halatuituia
I looked through the cisco dictionary file and see no mention of ipv6 there

Hi,

What is the outcome you are trying to achieve? It is not clear why you need to rewrite this. What do you want to happen? Why?

I replied to a very similar question from you a few days ago, but I see you haven’t made any changes, and are asking basically the same question.

--
Nathan Ward


-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Confidentiality Notice: This email (including any attachment) is intended for internal use only. Any unauthorized use, dissemination or copying of the content is prohibited. If you are not the intended recipient and have received this e-mail in error, please notify the sender by email and delete this email and any attachment.
Confidentiality Notice: This email (including any attachment) is intended for internal use only. Any unauthorized use, dissemination or copying of the content is prohibited. If you are not the intended recipient and have received this e-mail in error, please notify the sender by email and delete this email and any attachment.

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.h

[Nathan Ward]

Post by Maile Halatuituia
Hi Nathan
Yes you right .
I have this situation to be exact.
MSAN ------------ BRAS (Cisco) ---------- Freeradius Server (Acct+Auth)
I will refer to me Freeradius Server as Radius for short.
Right now I have IPv4 only which i received this standard attribute (Acct-Input-Octets) from my BRAS on my Radius server. Upon receive a perl module process that attribute to store on local mysql server DB on the same server above.
Before asking the question I enabe ipv6 as well alongside ipv4 where now I have dual stack working perfectly. Still I continue to recives the same standard attribute above (Acct-Input-Octets) which contain the count for both the ipv4 and ipv6 according the ietf RFC 2866.
Now I also enable the Cisco command to receive also the Cisco AVP attribute (acct-input-octets-ipv6) in the format mentioned on my previous email (Cisco-AVPair = "acct-input-octets-ipv6=xxx)" I want to process that in addition to my standard counter so I can know how much ipv6 traffic to each customer compare to its ipv4 traffic.
Because Radius doesn't understand that Cisco thing I need to rewrite that specific Cisco thing upon receiving the request packet from BRAS on the preacct module on my default server config before it can be processed......
That’s why I do that regex thing and I am still asking for help regarding it.
I hope I express my situation more clear. Please let me know

OK,

So, how do you call your perl module? Can the perl module look for that information for you?

FreeRADIUS only deals with attributes defined in the dictionaries.

*IF* your perl module cannot deal with the Cisco-AVPair attributes, you could re-write it to Tmp-Integer-0, or similar - that is an attribute that is already defined.
Note that you will need to use the “integer" expansion (see https://freeradius.org/radiusd/man/unlang.html <https://freeradius.org/radiusd/man/unlang.html>), as group 2 of your regex is a string.

I say IF in big letters here - perl is fine at handling this stuff, if you’re already sending everything to perl, and if you’re going to have to make changes to it to handle this new attribute anyway, why not do all of this in perl?

(Perl is, of course, slow. However on smaller networks it will be fine).



NOTE - you *still* need to fix your regex, as it is broken. Please see my email from last week for information on doing that.

--
Nathan Ward

-
List info/subscribe/unsubscribe? See http://www.freera

[Maile Halatuituia]

Hi Nathan
Thanks for your reply and the info as wel.

-----Original Message-----
From: Freeradius-Users <freeradius-users-bounces+maile.halatuituia=***@lists.freeradius.org> On Behalf Of Nathan Ward
Sent: Thursday, 1 November 2018 3:25 PM
To: FreeRadius users mailing list <freeradius-***@lists.freeradius.org>
Subject: Re: Rewrite Rule

Post by Maile Halatuituia
Hi Nathan
Yes you right .
I have this situation to be exact.
MSAN ------------ BRAS (Cisco) ---------- Freeradius Server
(Acct+Auth) I will refer to me Freeradius Server as Radius for short.
Right now I have IPv4 only which i received this standard attribute (Acct-Input-Octets) from my BRAS on my Radius server. Upon receive a perl module process that attribute to store on local mysql server DB on the same server above.
Before asking the question I enabe ipv6 as well alongside ipv4 where now I have dual stack working perfectly. Still I continue to recives the same standard attribute above (Acct-Input-Octets) which contain the count for both the ipv4 and ipv6 according the ietf RFC 2866.
Now I also enable the Cisco command to receive also the Cisco AVP attribute (acct-input-octets-ipv6) in the format mentioned on my previous email (Cisco-AVPair = "acct-input-octets-ipv6=xxx)" I want to process that in addition to my standard counter so I can know how much ipv6 traffic to each customer compare to its ipv4 traffic.
Because Radius doesn't understand that Cisco thing I need to rewrite that specific Cisco thing upon receiving the request packet from BRAS on the preacct module on my default server config before it can be processed......
That’s why I do that regex thing and I am still asking for help regarding it.
I hope I express my situation more clear. Please let me know

OK,

So, how do you call your perl module? Can the perl module look for that information for you?

FreeRADIUS only deals with attributes defined in the dictionaries.

*IF* your perl module cannot deal with the Cisco-AVPair attributes, you could re-write it to Tmp-Integer-0, or similar - that is an attribute that is already defined.
Note that you will need to use the “integer" expansion (see https://freeradius.org/radiusd/man/unlang.html <https://freeradius.org/radiusd/man/unlang.html>), as group 2 of your regex is a string.

I say IF in big letters here - perl is fine at handling this stuff, if you’re already sending everything to perl, and if you’re going to have to make changes to it to handle this new attribute anyway, why not do all of this in perl?

(Perl is, of course, slow. However on smaller networks it will be fine).



NOTE - you *still* need to fix your regex, as it is broken. Please see my email from last week for information on doing that.

--
Nathan Ward

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Confidentiality Notice: This email (including any attachment) is intended for internal use only. Any unauthorized use, dissemination or copying of the content is prohibited. If you are not the intended recipient and have received this e-mail in error, please notify the sender by email and delete this email and any attachment.
Confidentiality Notice: This email (including any attachment) is intended for internal use only. Any unauthorized use, dissemination or copying of the content is prohibited. If you are not the intended recipient and have received this e-mail in error, please notify the sender by email and delete this email and any attachment.

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/l

[Alan DeKok]

Post by Maile Halatuituia
I looked through the cisco dictionary file and see no mention of ipv6 there
You will need to use a *real* attribute name instead of "something". As I said before, you can't just invent a "acct-input-octets-ipv6" attribute, and expect it to do what you want. If you do that, the server will fail to start. So you have to create the attribute. See raddb/dictionary for documentation.

So... you're not going to do what I suggested.

Good luck, I guess.

Alan DeKok.


-
List info/subscribe/unsubscribe? See

[Maile Halatuituia]

Hi Alan
Here is the only attribute
Cisco-Pre-Input-Octets that relate to my question on the file /usr/share/freeradius/dictionary.cisco that’s what I was referring to

-----Original Message-----
From: Freeradius-Users <freeradius-users-bounces+maile.halatuituia=***@lists.freeradius.org> On Behalf Of Alan DeKok
Sent: Thursday, 1 November 2018 3:08 PM
To: FreeRadius users mailing list <freeradius-***@lists.freeradius.org>
Subject: Re: Rewrite Rule

Post by Maile Halatuituia
I looked through the cisco dictionary file and see no mention of ipv6 there
You will need to use a *real* attribute name instead of "something". As I said before, you can't just invent a "acct-input-octets-ipv6" attribute, and expect it to do what you want. If you do that, the server will fail to start. So you have to create the attribute. See raddb/dictionary for documentation.

So... you're not going to do what I suggested.

Good luck, I guess.

Alan DeKok.


-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Confidentiality Notice: This email (including any attachment) is intended for internal use only. Any unauthorized use, dissemination or copying of the content is prohibited. If you are not the intended recipient and have received this e-mail in error, please notify the sender by email and delete this email and any attachment.
Confidentiality Notice: This email (including any attachment) is intended for internal use only. Any unauthorized use, dissemination or copying of the content is prohibited. If you are not the intended recipient and have received this e-mail in error, please notify the sender by email and delete this email and any attachment.

-
List info/subscribe/unsubscribe? See ht

[Maile Halatuituia]

Hi Alan
Right now that broken regex still exist on my default server config , plus these two lines on my /etc/freerdius/dictionary file

ATTRIBUTE acct-input-octets-ipv6 3000 integer
ATTRIBUTE acct-output-octets-ipv6 3000 integer


I have these exists on my resulting Radius Acct Packets

Acct-Input-Octets = 3384
Acct-Output-Octets = 8054
Cisco-AVPair = "acct-input-octets-ipv6=2636"
Cisco-AVPair = "acct-output-octets-ipv6=6390"
acct-input-octets-ipv6 = 2636
acct-output-octets-ipv6 = 6390

Which exactly I want to have. As a conclusion I still do not know how it gives this result but it seems this broken regex not giving any error plus the lines above produce the result I want to have.

This make my day now I can easily store these ipv6 counter to a DB and if I want to see what a user ipv6 traffic is , no problem I can have it.

Anyway I want to thank you for you assistance even still I do not know how this comes out but my problem is solved and that’s more important. Someone else would come after me and understand it but right now I can continue from this and move on.

Once again thank you and surely I will come back if I will have more question to ask.

Good Day.

-----Original Message-----
From: Freeradius-Users <freeradius-users-bounces+maile.halatuituia=***@lists.freeradius.org> On Behalf Of Alan DeKok
Sent: Thursday, 1 November 2018 3:08 PM
To: FreeRadius users mailing list <freeradius-***@lists.freeradius.org>
Subject: Re: Rewrite Rule

Post by Maile Halatuituia
I looked through the cisco dictionary file and see no mention of ipv6 there
You will need to use a *real* attribute name instead of "something". As I said before, you can't just invent a "acct-input-octets-ipv6" attribute, and expect it to do what you want. If you do that, the server will fail to start. So you have to create the attribute. See raddb/dictionary for documentation.

So... you're not going to do what I suggested.

Good luck, I guess.

Alan DeKok.


-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Confidentiality Notice: This email (including any attachment) is intended for internal use only. Any unauthorized use, dissemination or copying of the content is prohibited. If you are not the intended recipient and have received this e-mail in error, please notify the sender by email and delete this email and any attachment.
Confidentiality Notice: This email (including any attachment) is intended for internal use only. Any unauthorized use, dissemination or copying of the content is prohibited. If you are not the intended recipient and have received this e-mail in error, please notify the sender by email and delete this email and any attachment.

-
List info/subscribe/unsubscribe

[Alan DeKok]

Post by Maile Halatuituia
Right now that broken regex still exist on my default server config , plus these two lines on my /etc/freerdius/dictionary file
ATTRIBUTE acct-input-octets-ipv6 3000 integer
ATTRIBUTE acct-output-octets-ipv6 3000 integer

No, you can't assign the same number to different attributes.

Alan DeKok.


-
List info/subscribe/unsubscribe? See http:

[Maile Halatuituia]

Hi Alan
Well I am afraid that’s whats happen in this case I think . Like I said I do not know and understand how this comes out but it is what is happening

-----Original Message-----
From: Freeradius-Users <freeradius-users-bounces+maile.halatuituia=***@lists.freeradius.org> On Behalf Of Alan DeKok
Sent: Friday, 2 November 2018 1:45 PM
To: FreeRadius users mailing list <freeradius-***@lists.freeradius.org>
Subject: Re: Rewrite Rule

Post by Maile Halatuituia
Right now that broken regex still exist on my default server config , plus these two lines on my /etc/freerdius/dictionary file
ATTRIBUTE acct-input-octets-ipv6 3000 integer
ATTRIBUTE acct-output-octets-ipv6 3000 integer

No, you can't assign the same number to different attributes.

Alan DeKok.


-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Confidentiality Notice: This email (including any attachment) is intended for internal use only. Any unauthorized use, dissemination or copying of the content is prohibited. If you are not the intended recipient and have received this e-mail in error, please notify the sender by email and delete this email and any attachment.
Confidentiality Notice: This email (including any attachment) is intended for internal use only. Any unauthorized use, dissemination or copying of the content is prohibited. If you are not the intended recipient and have received this e-mail in error, please notify the sender by email and delete this email and any attachment.

-
List info/subscribe/unsubscribe? See http://www.freeradiu

[Alan DeKok]

Post by Maile Halatuituia
Hi Alan
Well I am afraid that’s whats happen in this case I think . Like I said I do not know and understand how this comes out but it is what is happening

It's happening because you edited the raddb/dictionary file. And, assigned the same number to different attributes. Those attributes are *not* in the default install. They exist *only* in your local configuration.

At this point, you should stop what you're doing. Stop trying to "fix" the problem. Instead, spend time understanding how the server works.

Alan DeKok.


-
List info/subscribe/unsubscribe? See http://www.fr

[Maile Halatuituia]

Hi Alan
Thanks and that's what I will do . I just hope I would be able to learn more quickly ....
Anyway thanks for your comment and information.
Regards.
Maile

-----Original Message-----
From: Freeradius-Users <freeradius-users-bounces+maile.halatuituia=***@lists.freeradius.org> On Behalf Of Alan DeKok
Sent: Friday, 2 November 2018 2:08 PM
To: FreeRadius users mailing list <freeradius-***@lists.freeradius.org>
Subject: Re: Rewrite Rule

Post by Maile Halatuituia
Hi Alan
Well I am afraid that’s whats happen in this case I think . Like I said I do not know and understand how this comes out but it is what is happening

It's happening because you edited the raddb/dictionary file. And, assigned the same number to different attributes. Those attributes are *not* in the default install. They exist *only* in your local configuration.

At this point, you should stop what you're doing. Stop trying to "fix" the problem. Instead, spend time understanding how the server works.

Alan DeKok.


-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Confidentiality Notice: This email (including any attachment) is intended for internal use only. Any unauthorized use, dissemination or copying of the content is prohibited. If you are not the intended recipient and have received this e-mail in error, please notify the sender by email and delete this email and any attachment.
Confidentiality Notice: This email (including any attachment) is intended for internal use only. Any unauthorized use, dissemination or copying of the content is prohibited. If you are not the intended recipient and have received this e-mail in error, please notify the sender by email and delete this email and any attachment.

-
List info/subscribe/unsubscribe? See http://www.freeradius.org