[IEC-16] [IEC][SEBA][PONSim] ONU has been validated - Authentication denied Created: 25/Jul/19 Updated: 23/Oct/19 Resolved: 20/Sep/19 |
|
| Status: | Done |
| Project: | Integrated Edge Cloud |
| Component/s: | None |
| Affects Version/s: | None |
| Fix Version/s: | None |
| Type: | Bug | Priority: | Medium |
| Reporter: | Ciprian Barbu | Assignee: | Ciprian Barbu |
| Resolution: | Done | Votes: | 0 |
| Labels: | Release_2 | ||
| Remaining Estimate: | Not Specified | ||
| Time Spent: | Not Specified | ||
| Original Estimate: | Not Specified | ||
| Issue Links: |
|
||||||||
| Description |
|
Running the tests for SEBA-in-a-Box with PONSim will fail with Authentication denied on aarch64 pods. There is no clear indication as to the cause, but there are several logs in ONOS that need to be checked |
| Comments |
| Comment by Ciprian Barbu [ 20/Sep/19 ] |
|
This was in effect fixed by this change, which updates the commit id in iecedge/seba_charts: |
| Comment by Ciprian Barbu [ 30/Aug/19 ] |
|
I managed to test with a modified Docker image based on the iecedge/freeradius:2.2.8. I simply commented out the sql option in the post-auth section and I was able to pass the authentication step. I pushed a change to the corresponding repo: I also pushed the modified docker image, overwriting the old version: There might still be an issue with the DHCP request step, I will have to investigate it further, maybe create a new card as well. |
| Comment by Ciprian Barbu [ 26/Aug/19 ] |
|
Looking at the freeradius config file /etc/freeradius/sites-enabled/default, the post-auth section has the sql option enabled, unlike on the x86 pod, where is commented. So perhaps the Mysql error does have a role, but in this case indicates it does not belong there. I will need to track down where the config is generated and modify it in order to test. |
| Comment by Ciprian Barbu [ 26/Aug/19 ] |
|
On the freeradius side, on x86 we have: # group authenticate = ok+} # group authenticate = okLogin OK: [user] (from client 0.0.0.0/0 port 0)# Executing section post-auth from file /etc/freeradius/sites-enabled/default+group post-auth {+[exec] = noop} # group post-auth = noopSending Access-Accept of id 3 to 100.100.0.73 port 1812 EAP-Message = 0x03020004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "user"Finished request 1.Going to the next request
On the aarch64 pod: rad_recv: Access-Request packet from host 100.100.236.199 port 1812, id=2, length=61rad_recv: Access-Request packet from host 100.100.236.199 port 1812, id=2, length=61 User-Name = "user" NAS-IP-Address = 10.128.9.244 EAP-Message = 0x020100090175736572 Message-Authenticator = 0x8a260065a4e048cfbbe8297ebf204b1d# Executing section authorize from file /etc/freeradius/sites-enabled/default+group authorize { ........ +}# group authenticate = ok+} # group authenticate = okLogin OK: [user] (from client 0.0.0.0/0 port 0)# Executing section post-auth from file /etc/freeradius/sites-enabled/default+group post-auth {[sql] expand: % {User-Name}-> user[sql] sql_set_user escaped user --> 'user'[sql] expand: %{User-Password} -> [sql] ... expanding second conditional[sql] expand: %{Chap-Password} -> [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate, mac) VALUES ( '%{User-Name}', '%{% {User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S', '%{Calling-Station-Id}') -> INSERT INTO radpostauth (username, pass, reply, authdate, mac) VALUES ( 'user', '', 'Access-Accept', '2019-08-26 17:15:24', '')rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate, mac) VALUES ( 'user', '', 'Access-Accept', '2019-08-26 17:15:24', '')rlm_sql (sql): Trying to (re)connect unconnected handle 31..rlm_sql (sql): Attempting to connect rlm_sql_mysql #31rlm_sql_mysql: Starting connect to MySQL server for #31rlm_sql_mysql: Couldn't connect socket to MySQL server radius@localhost:radiusrlm_sql_mysql: Mysql error 'Can't connect to local MySQL server through socket '/var/run/mysqld/mysqld.sock' (2)'rlm_sql (sql): Failed to connect DB handle #31rlm_sql (sql): Ignoring unconnected handle 31..
So something is different when executing the post-auth section. The Mysql error might nor might not be meaningful, the socket doesn't seem to exist on the x86 pod either. |
| Comment by Ciprian Barbu [ 26/Aug/19 ] |
|
Update. I haven't been able to make much progress on this because I kept getting into other issues with either SEBA or even PONSim, some of which I will detail in other related cards. However, today I managed to spend some quality time on a pod which has deployed correctly and I managed to get some interesting information, also by comparing against a working x86 pod. First of all here is the onos log showing logs from AAA: By comparison, on the x86 pod: , priority=40000, appId=DefaultApplicationId{id=169, name=org.opencord.aaa}, nodeId=100.100.0.73, applies to=all} to of:0000aabbccddeeff: BADPARAMS Then I also looked in the freeradius pod logs: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked
So for now the freeradius logs look interesting, I will continue on this track. |