dynamic lookup of list entries
Hi all, Here is the situation I'm trying to get working with FreeRadius, but having tried a load of variations around this I'm still stuck. I have a list of sites with specific VLANs I'd like users to end up on: sites { 1 { vlan = 234 } 2 { vlan = 245 } } I then have some clients, each with a site assigned: client cli1 { ipaddr = 1.2.3.4 secret = asdfasdf site = 1 } I'd now like to assign the VLAN from sites, something like: post-auth { update reply { Tunnel-Private-Group-ID = ${sites[${client.site}].vlan} } } But I've not a found a way of looking up an entry in a map dynamically ${sites.1.vlan} works (gives 234) ${client.site} works (gives 1) But ${sites.${client.site}.vlan} (or variations) doesn't work for me Do you have a way of doing this? (Or a different approach? I've also tried embedding sites in clients by setting client{sites = ${sites.1} } - no banana either). I'm trying to avoid death by switch statement here, one org I work with has 120 sites Any help would be greatly appreciated Thanks, Jim Potter UK
On Jan 26, 2024, at 8:47 AM, James Potter via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
Here is the situation I'm trying to get working with FreeRadius, but having tried a load of variations around this I'm still stuck.
Trying random things is usually an exercise in frustration.
I have a list of sites with specific VLANs I'd like users to end up on:
sites { 1 { vlan = 234
I'm presuming you put that into the configuration files somewhere?
I then have some clients, each with a site assigned:
client cli1 { ipaddr = 1.2.3.4 secret = asdfasdf site = 1 }
OK, THAT SHOULD BE FINE.
I'd now like to assign the VLAN from sites, something like:
post-auth { update reply { Tunnel-Private-Group-ID = ${sites[${client.site}].vlan}
That's close, but not quite correct. The ${...} syntax is really just a macro replacement for when the server is starting up. It's not a run-time lookup. i.e. when you want "get me client information", you're not ${client}, because that doesn't refer to *any* client. What you want is "the current client that the packet comes from", which is %{client:...} You also want run-time lookups for the configuration entries, which is %{config:...} Putting out all together gets you: Tunnel-Private-Group-ID = %{config:sites[%{client.site}].vlan} That should work, I think. Alan DeKok.
Hi Alan, OK, after a bit of tweaking I got this working: Tunnel-Private-Group-ID := "%{config:sites.${client.site}.remote}" ## mix of quotes, % and $... Here's my code for completeness: clients.conf: sites { 1 { local = 123 remote = 234 } 2 { local = 345 remote = 543 } } client localhost { ipaddr = 127.0.0.1 proto = * secret = testing123 site = 1 } ----------- Sites-enabled/whatnot: server eap { ... post-auth { update reply { Tunnel-Type := VLAN Tunnel-Medium-Type := IEEE-802 Tunnel-Private-Group-ID := "%{config:sites.${client.site}.remote}" } } } Thanks, Jim Jisc -----Original Message----- From: Alan DeKok <aland@deployingradius.com> Sent: Friday, January 26, 2024 5:00 PM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Cc: James Potter <Jim.Potter@jisc.ac.uk> Subject: Re: dynamic lookup of list entries [You don't often get email from aland@deployingradius.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ] On Jan 26, 2024, at 8:47 AM, James Potter via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
Here is the situation I'm trying to get working with FreeRadius, but having tried a load of variations around this I'm still stuck.
Trying random things is usually an exercise in frustration.
I have a list of sites with specific VLANs I'd like users to end up on:
sites { 1 { vlan = 234
I'm presuming you put that into the configuration files somewhere?
I then have some clients, each with a site assigned:
client cli1 { ipaddr = 1.2.3.4 secret = asdfasdf site = 1 }
OK, THAT SHOULD BE FINE.
I'd now like to assign the VLAN from sites, something like:
post-auth { update reply { Tunnel-Private-Group-ID = ${sites[${client.site}].vlan}
That's close, but not quite correct. The ${...} syntax is really just a macro replacement for when the server is starting up. It's not a run-time lookup. i.e. when you want "get me client information", you're not ${client}, because that doesn't refer to *any* client. What you want is "the current client that the packet comes from", which is %{client:...} You also want run-time lookups for the configuration entries, which is %{config:...} Putting out all together gets you: Tunnel-Private-Group-ID = %{config:sites[%{client.site}].vlan} That should work, I think. Alan DeKok.
On Jan 29, 2024, at 7:22 AM, James Potter via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
OK, after a bit of tweaking I got this working:
Tunnel-Private-Group-ID := "%{config:sites.${client.site}.remote}"
Except that the ${...} is expanded only once, when the server starts. So this works (maybe) for one client. It doesn't work when there are multiple clients. Alan DeKok.
Bah. OK, a spot more refinement and testing, I have: Tunnel-Private-Group-ID := "%{config:sites.%{client:site}.remote}" (not sure why its ${client.site} with a fullstop but %{client:site} with a colon - is there any info on all variables/?namespaces? available within FreeRad?) This looks better... now 2 clients configured: client localhost { ipaddr = 127.0.0.1 proto = * secret = testing123 site = 2 } client eth0 { ipaddr = 192.168.0.34 proto = * secret = testing123 site = 1 } ...and the sites sites { 1 { local = 123 remote = 234 } 2 { local = 345 remote = 543 } } Now, when I eapol_test from: - 127.0.0.1 I get Tunnel-Private-Group-Id := "543" - 192.168.0.34 I get Tunnel-Private-Group-Id := "234" Which looks like it works to me Does that look correct? Thanks, Jim -----Original Message----- From: Freeradius-Users <freeradius-users-bounces+jim.potter=jisc.ac.uk@lists.freeradius.org> On Behalf Of Alan DeKok Sent: Monday, January 29, 2024 1:14 PM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: dynamic lookup of list entries [You don't often get email from aland@deployingradius.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ] On Jan 29, 2024, at 7:22 AM, James Potter via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
OK, after a bit of tweaking I got this working:
Tunnel-Private-Group-ID := "%{config:sites.${client.site}.remote}"
Except that the ${...} is expanded only once, when the server starts. So this works (maybe) for one client. It doesn't work when there are multiple clients. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 29/01/2024 15:21, James Potter via Freeradius-Users wrote:
(not sure why its ${client.site} with a fullstop but %{client:site} with a colon - is there any info on all variables/?namespaces? available within FreeRad?)
%{ ... } is a run time expansion %{config: } and %{client: } are xlat functions, with their arguments starting after the : ${ ... } is an expansion which happens once at server startup and looks for a site option which is a child of the client option. So - they are completely different purposes, hence the different syntax. Your final implementation of Tunnel-Private-Group-ID := "%{config:sites.%{client:site}.remote}" is looking up the config item of sites.<n>.remote where <n> is the "site" config item found in the client for the current request. The expansion will work from the inside out - so first %{client:site} will be expanded, then it's result will be used to build the config structure that is going to be looked up. Nick -- Nick Porter
participants (3)
-
Alan DeKok -
James Potter -
Nick Porter