Hello to Alan and the rest of the list. I wanted to report this to the bug tracker but it appears to be down right now so I am sending it to the list. I had a situation where I needed to remove all of the attributes from a reply except for Service-Type to one specific client. Unlang seemed to be perfect for this. It should be as simple as the following. if (Client-IP-Address == "192.168.10.20") { update reply { Framed-Protocol == '' Framed-IP-Address == 0.0.0.0 Framed-IP-Netmask == 0.0.0.0 Idle-Timeout == 999 Session-Timeout == 999 Port-Limit == 999 Cisco-AVPair == '' Service-Type := Authenticate-Only } } However, when I try to do this, radiusd segfaults when attempting to run this block. I tried several tests and I could sometimes get up to two lines with "==" operators in an update block to work. However, adding more than two or three would cause a segfault. I was finally able to use the following workaround under 2.1.4. This workaround did not work under 2.1.3. if (Client-IP-Address == "192.168.10.20") { update reply { Framed-Protocol == '' } update reply { Framed-IP-Address == 0.0.0.0 } update reply { Framed-IP-Netmask == 0.0.0.0 } update reply { Idle-Timeout == 999 } update reply { Session-Timeout == 999 } update reply { Port-Limit == 999 } update reply { Cisco-AVPair == '' } update reply { Service-Type := Authenticate-Only } } My system is CentOS 5.2 32-bit. Hope this helps. Thanks, Jim L.
Hello to Alan and the rest of the list. I wanted to report this to the bug tracker but it appears to be down right now so I am sending it to the list.
I had a situation where I needed to remove all of the attributes from a reply except for Service-Type to one specific client. Unlang seemed to be perfect for this. It should be as simple as the following.
if (Client-IP-Address == "192.168.10.20") { update reply { Framed-Protocol == '' Framed-IP-Address == 0.0.0.0 Framed-IP-Netmask == 0.0.0.0 Idle-Timeout == 999 Session-Timeout == 999 Port-Limit == 999 Cisco-AVPair == '' Service-Type := Authenticate-Only } }
Read man unlang again. See what does == do. Perhaps you want: if (Client-IP-Address == "192.168.10.20") { update reply { Service-Type == Authenticate-Only } } Or you want to use -= on multiple attributes. Ivan Kalik Kalik Informatika ISP
tnt@kalik.net wrote:
Hello to Alan and the rest of the list. I wanted to report this to the bug tracker but it appears to be down right now so I am sending it to the list.
I had a situation where I needed to remove all of the attributes from a reply except for Service-Type to one specific client. Unlang seemed to be perfect for this. It should be as simple as the following.
if (Client-IP-Address == "192.168.10.20") { update reply { Framed-Protocol == '' Framed-IP-Address == 0.0.0.0 Framed-IP-Netmask == 0.0.0.0 Idle-Timeout == 999 Session-Timeout == 999 Port-Limit == 999 Cisco-AVPair == '' Service-Type := Authenticate-Only } }
Read man unlang again. See what does == do. Perhaps you want:
if (Client-IP-Address == "192.168.10.20") { update reply { Service-Type == Authenticate-Only } }
Or you want to use -= on multiple attributes.
Ivan Kalik Kalik Informatika ISP
Ivan, Please read man unlang again, Neither of your examples are appropriate for my purposes. "Service-Type == Authenticate-Only" would remove the Service-Type attribute if its value is not Authenticate-Only. I do not want to remove the Service-Type attribute at all. I want to set its value to Authenticate-Only which is why I used the := operator. The -= operator removes the attribute if the attribute AND its value match the reply. Since the values can vary with different users and groups in our systerm, this operator is also not appropriate. The == operator removes the attribute if the attribute and its value DO NOT match the reply. In my examples you will see that the values for those attributes are unusual values which will probably never be set by our user profiles. Since there is no operator or command in unlang to remove an attribute regardless of value, this was the best alternative that I could design. According to what I have read, my configuration is correct, both in function and in syntax. It just crashes the server :-O Jim L.
Read man unlang again. See what does == do. Perhaps you want:
if (Client-IP-Address == "192.168.10.20") { update reply { Service-Type == Authenticate-Only } }
Or you want to use -= on multiple attributes.
Ivan Kalik Kalik Informatika ISP
Please read man unlang again, Neither of your examples are appropriate for my purposes. "Service-Type == Authenticate-Only" would remove the Service-Type attribute if its value is not Authenticate-Only. I do not want to remove the Service-Type attribute at all. I want to set its value to Authenticate-Only which is why I used the := operator.
So do: if (Client-IP-Address == "192.168.10.20") { update reply { Service-Type:= Authenticate-Only Service-Type == Authenticate-Only } }
The == operator removes the attribute if the attribute and its value DO NOT match the reply.
It removes *all* the attributes and values that do not match. That *is* what you want - to keep that Service-Type and remove all other attributes regardless of value? Listing two attributes with == is pointless - it will delete the whole list. Ivan Kalik Kalik Informatika ISP
tnt@kalik.net wrote:
Read man unlang again. See what does == do. Perhaps you want:
if (Client-IP-Address == "192.168.10.20") { update reply { Service-Type == Authenticate-Only } }
Or you want to use -= on multiple attributes.
Ivan Kalik Kalik Informatika ISP
Please read man unlang again, Neither of your examples are appropriate for my purposes. "Service-Type == Authenticate-Only" would remove the Service-Type attribute if its value is not Authenticate-Only. I do not want to remove the Service-Type attribute at all. I want to set its value to Authenticate-Only which is why I used the := operator.
So do:
if (Client-IP-Address == "192.168.10.20") { update reply { Service-Type:= Authenticate-Only Service-Type == Authenticate-Only } }
The == operator removes the attribute if the attribute and its value DO NOT match the reply.
It removes *all* the attributes and values that do not match. That *is* what you want - to keep that Service-Type and remove all other attributes regardless of value?
Listing two attributes with == is pointless - it will delete the whole list.
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
The == operator does _not_ remove all attributes. It only affects the attribute named on the left of this operator. It does not delete or affect any other attributes in the request. See example below. update request { Idle-Timeout == 999 } Will remove all non-matching attributes. So it will remove Idle-Timeout = 0 Idle-Timeout = 1 Idle-Timeout = 1000 It will not remove Idle-Timeout = 999 I have tested this extensively on my system with debug -X. I know this is how this configuration works because I can see the results in the debug output. Jim L.
participants (3)
-
Alan DeKok -
JDL -
tnt＠kalik.net