See dictionaries
On Feb 24, 2022, at 5:50 AM, Rahman Duran <rahman.duran@erzurum.edu.tr> wrote:
Hi,
I am trying to do some filtering/policing in the authorize section of the default virtual server. I need to check source ip matches our Wireless Controllers and SSID and username format etc then decide what to do with the request. How can I user some kind of alias/variable for our IP address block so I should not need to write and update IP addresses multiple places?
Here sample of what I try to achieve:
////////////////////// etu_aruba_wlc_001 = 10.10.243.0/24 etu_aruba_wlc_002 = 10.10.244.0/24 etu_aruba_wlc_002 = 10.10.245.0/24
### 001: Test Wifi Service ### *if ((&Packet-Src-IP-Address < ${etu_aruba_wlc_001}) \* && (&NAS-Port-Type == "Wireless-802.11") \ && (&Called-Station-SSID == "bidb-test") \ && (&User-Name =~ /[0-9a-fA-F]{12}/)) {
update request { &ETU-Radius-Service-Name := "BIDB_Test" }
# Authentication source files_bidb_test_mac_list
# Authentication modules pap
# If this service match, do not continue to check rest of the section return }
### 002: Simulation Lab Service ### * if ((&Packet-Src-IP-Address < ${etu_aruba_wlc_001}) \* && (&NAS-Port-Type == "Wireless-802.11") \ && (&Called-Station-SSID == "saglik_bilimleri-sim-lab") \ && (&User-Name =~ /[0-9a-fA-F]{12}/)) {
update request { &ETU-Radius-Service-Name := "Saglik_Bilimleri_Sim_Lab" }
# Authentication source files_saglik_bilimleri_sim_lab_mac_list
# Authentication modules pap
# If this service match, do not continue to check rest of the section return }
### DEFAULT REJECT: If no service matched reject undefined request directly here ### update session-state { Module-Failure-Message := "No matching service found for this request!" } reject /////////////////////
Well using variables (${...}) in conditions not working, Freeradius daemon not starting with parse error:
/etc/freeradius/3.0/sites-enabled/default[40]: ((&Packet-Src-IP-Address < *${etu_aruba_wlc_001}) * && (&NAS-Port-Type == "Wireless-80... /etc/freeradius/3.0/sites-enabled/default[40]: ^ Failed to parse value for attribute
Any hint on this? If it is possible I want to define IP blocks and groups of IP blocks if possible and use them in unlang conditions.
Regards,
Rahman Duran Bilgi İşlem Daire Başkanlığı Erzurum Teknik Üniversitesi - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html