EXAMPLE: unlang removing attribute inside a test
Hi Guys I thought I would send an example of unlang being used to remove an attribute after proxying. My attrs file add a Cisco-AVPair which needs removing if the customer is given a static ip address by the retail ISP. authorize { ..... if("%{reply:Framed-IP-Address}") { update reply { Cisco-AVPair -= "ip:addr-pool=ip_pool_1" } update reply { Cisco-AVPair -= "ip:addr-pool=ip_pool_2" } update reply { Cisco-AVPair -= "ip:addr-pool=ip_pool_3" } } } I also added the update option to the post-auth to remove the Cisco-AVPair in the case of a reject. post-auth { ...... Post-Auth-Type REJECT { update reply { Cisco-AVPair -= "ip:addr-pool=ip_pool_1" } update reply { Cisco-AVPair -= "ip:addr-pool=ip_pool_2" } update reply { Cisco-AVPair -= "ip:addr-pool=ip_pool_3" } sql_log } } One issue I could not seem to find a way of removing an attribute unless both the attribute and value match, this means that I have to list each of the pool individually. Cheers Mike
Mike O'Connor wrote:
One issue I could not seem to find a way of removing an attribute unless both the attribute and value match, this means that I have to list each of the pool individually.
One option is to add more filtering operators. e.g. "-~", meaning "regex match, and remove". Or perhaps a better way, is to add a "filter" section: filter request { # filter out attributes matching the following Foo =~ /bar/ # remove by regex } Also, adding a "require" section may be useful, too: require request { # filter out attributes NOT matching .... Foo =~ /bar/ } Alan DeKok.
Hi Alan The documentation does not mention these options so I assume that you mean it would need writing ?
One option is to add more filtering operators. e.g. "-~", meaning "regex match, and remove". Or perhaps a better way, is to add a "filter" section:
filter request { # filter out attributes matching the following Foo =~ /bar/ # remove by regex }
Also, adding a "require" section may be useful, too:
require request { # filter out attributes NOT matching .... Foo =~ /bar/ }
As I have not written much C code in 15 years, its going to take me awhile to work that one out. Cheers Mike
participants (2)
-
Alan DeKok -
Mike O'Connor