Pair matching when attribute not present
There was a discussion previously about merging the different versions of paircompare logic, and I'd just like to mention a related issue. I was expecting that the following rlm_sql authorize_check_query response would work if the attribute was not present: 'Calling-Station-Id', '=~', '^$|^0845' However it doesn't. It looks like there are two sets of logic which might be used: src/lib/valuepair.c: paircmp() expands the argument using vp_prints_value. If it's missing then it expands to empty string. In that case, I think the match would succeed. src/main/valuepair.c: paircompare() fails immediately if the argument is non-existent, except when using the !* operator (T_OP_CMP_FALSE). I haven't yet worked out exactly in which circumstances paircmp() is used and in which circumstances paircompare() is used :-( Another usage case: 'Reply-Message', '!=', 'SPECIALOPTION' (i.e. I would like this to match if either Reply-Message is not present, or if its value is not SPECIALOPTION) It's a matter of discussion as to which is the desired behaviour, and is maybe something that could be considered for freeradius 3.x Regards, Brian.
Brian Candler wrote:
I was expecting that the following rlm_sql authorize_check_query response would work if the attribute was not present:
'Calling-Station-Id', '=~', '^$|^0845'
It doesn't. The "=~" operator can match only if the attribute exists.
Another usage case:
'Reply-Message', '!=', 'SPECIALOPTION'
(i.e. I would like this to match if either Reply-Message is not present, or if its value is not SPECIALOPTION)
It's a matter of discussion as to which is the desired behaviour, and is maybe something that could be considered for freeradius 3.x
Changing the meaning of the operators is not an option. It would break thousands of existing installations. Alan DeKok.
On Thu, Aug 18, 2011 at 08:44:56AM -0400, Alan DeKok wrote:
Changing the meaning of the operators is not an option. It would break thousands of existing installations.
But then should it not be at least consistent? Can you explain when the paircmp() logic is used, and when paircompare() logic is used? Regards, Brian.
Brian Candler wrote:
But then should it not be at least consistent? Can you explain when the paircmp() logic is used, and when paircompare() logic is used?
The first is for "compare two attributes". The second is for "compare two attributes, including server-side internal attributes" Most of the code in the server should use the second function. The only code which uses the first one is the code working on actual RADIUS packets. Alan DeKok.
participants (2)
-
Alan DeKok -
Brian Candler