Re: Question on Unlang

29 Mar 2017

      Hi Brian,

thanks, i think's that files modules is the solution because we have
actually 40 domains and in may we add 150 new domain without sub-subdomains

a question because i have tested but that's don't work. i have:

added in /etc/raddb/modules/subrealm:

files subrealm {
        key = "%{Realm}"
        filename = ${confdir}/Liste-des-Sous-Realm
}

in /etc/raddb/Liste-des-Sous-Realm, i have:
network.local Tmp-String-0 := "Excluded"
admin.local Tmp-String-0 := "Excluded"
wifi.local Tmp-String-0 := "Excluded"

in my /etc/raddb/policy.d/my.conf:

        if ((Tunnel-Server-Endpoint:0[0] != '172.16.1.1') && (User-Name =~
/\\.local/) && (&control:Tmp-String-0 != "Excluded") &&
("%{Packet-Src-IP-Address}" == "192.168.20.1")) {
                update reply {
                          <...>
                }
        }
        elsif ((Tunnel-Server-Endpoint:0[0] != '172.16.1.1') &&
(&control:Tmp-String-0 != "Excluded") && ("%{Packet-Src-IP-Address}" ==
"192.168.50.1")) {
                update reply {
                          <...>
                }
        }

and when i am connect with @network.local, all time i have:
     ?? Evaluating (&control:Tmp-String-0 != "Excluded") -> TRUE

tested too:
       if ((Tunnel-Server-Endpoint:0[0] != '172.16.1.1') && (User-Name =~
/\\.local/) && ("%{control:Tmp-String-0}" != "Excluded") &&
("%{Packet-Src-IP-Address}" == "192.168.20.1")) {

same result

Last test:
      i have added "subrealm" /etc/raddb/sites-available/default
in post-auth { but no change

I did not do everything right?

i don't know how i can see the value of "Tmp-String-0", they have a
equivalent of "print Tmp-String-0" for see in logs ?

includ:

thanks

2017-03-25 18:36 GMT+01:00 Brian Candler <b.candler@pobox.com>:
...
On 25/03/2017 11:54, Olivier CALVANO wrote:
...
but for me not a big difference between my actual config and regular
expressions.
all line ar very very long
If you're only excluding three domains it seems a good enough solution to
me.
If you want something "data driven" then you can look at the files module:
files subrealm {
  key = "%{Realm}"
  filename = ${moddir}/subrealm
}
# subrealm file
network.local    Tmp-String-0 := "Excluded"
admin.local    Tmp-String-0 := "Excluded"
wifi.local    Tmp-String-0 := "Excluded"
then check control:Tmp-String-0 in your policy. However that doesn't do
*exactly* what your current config does, because your current config would
match sub-subdomains like user@foo.network.local, and the above doesn't.