I'm having some trouble with attribute filtering: we're preparing to move from router assigned ip addressing to radius pool assignment. For initial testing, I thought I'd just add a Pool-Name to the user check items for a few test accounts. That doesn't work because the Framed-IP-Address that tells the router to do the assignment is added in the group reply items, which prevents sqlippool from doing an assignment. It's probably possible to do a convoluted sql statement in the group lookup, but that would be...convoluted. Our solution was to just create separate groups for these cases, but I would like to figure out how to do overrides like this. What I looked for was an operator to remove an attribute, but that doesn't seem to exist - you can only add them. I noticed the attr_filter module, and tried that with: mods-config/attr_filter/framed_ip_address: if (&control:Pool-Nmae && &control:Pool-Name != "") { Framed-IP-Address !* ANY } If I read that module right, it filters out anything that doesn't match the given patterns, but that doesn't seem to do anything: (2) Thu Feb 11 12:16:27 2016: Debug: attr_filter.framed_ip_address: EXPAND %{Framed-IP-Address} (2) Thu Feb 11 12:16:27 2016: Debug: attr_filter.framed_ip_address: --> (2) Thu Feb 11 12:16:27 2016: Debug: [attr_filter.framed_ip_address] = noop was the debug output in all cases and Framed-IP-Address was left alone. The only thing that did work was putting this in a perl module: sub post_auth { if (defined($RAD_CHECK{'Pool-Name'})) { delete $RAD_REPLY{'Framed-IP-Address'}; } return RLM_MODULE_OK; } but using perl seems heavy-handed for a simple task like this, so I'm wondering what the "approved" mechanism for deleting an attribute is? Thanks...
On Feb 11, 2016, at 3:43 PM, Alan Batie <alan@peak.org> wrote:
I'm having some trouble with attribute filtering: we're preparing to move from router assigned ip addressing to radius pool assignment. For initial testing, I thought I'd just add a Pool-Name to the user check items for a few test accounts. That doesn't work because the Framed-IP-Address that tells the router to do the assignment is added in the group reply items, which prevents sqlippool from doing an assignment.
ou should be able to remove it for those test users.
It's probably possible to do a convoluted sql statement in the group lookup, but that would be...convoluted. Our solution was to just create separate groups for these cases, but I would like to figure out how to do overrides like this.
sql if (test user) { update reply { Framed-IP-Address !* ANY } update control { Pool-Name := "pool" } sqlippool }
What I looked for was an operator to remove an attribute, but that doesn't seem to exist - you can only add them.
There are attribute filtering operators. See "man unlang".
I noticed the attr_filter module, and tried that with:
mods-config/attr_filter/framed_ip_address:
if (&control:Pool-Nmae && &control:Pool-Name != "") { Framed-IP-Address !* ANY }
Which is "unlang" syntax. The attr_filter module takes a different formant. See the examples shipped with the server. Alan DeKok.
On 2/11/16 1:43 PM, Alan DeKok wrote:
if (test user) { update reply { Framed-IP-Address !* ANY } update control { Pool-Name := "pool" }
sqlippool }
Doh! I forgot the update reply part; in my case: if (&control:Pool-Name && &control:Pool-Name != "") { update reply { Framed-IP-Address !* ANY } } Thanks!
mods-config/attr_filter/framed_ip_address:
if (&control:Pool-Nmae && &control:Pool-Name != "") { Framed-IP-Address !* ANY }
Which is "unlang" syntax. The attr_filter module takes a different formant. See the examples shipped with the server.
I was trying to expand on those examples, but clearly that wasn't the right approach ;-)
participants (2)
-
Alan Batie -
Alan DeKok