With freeradius 2.1.10 I can configure failover for SQL lookups like this: # in policy.conf sql_foo { redundant { sql_foo_local sql_foo_remote } } # in sites-available/foo authorize { sql_foo } However, it looks like I can't use this redundant module inside a string expansion: authorize { update request { Huntgroup-Name = "%{sql_foo:SELECT groupname FROM radhuntgroup where nasipaddress='%{NAS-IP-Address}' limit 1}" } } --- Error logged: WARNING: Unknown module "sql_foo" in string expansion "%" How could I get the same level of redundancy for string expansions? Could I do the expansion multiple times inside a redundant section? I am thinking of perhaps: huntgroup_local { update request { Huntgroup-Name = "%{sql_foo_local:SELECT groupname FROM radhuntgroup where nasipaddress='%{NAS-IP-Address}' limit 1}" } } huntgroup_remote { update request { Huntgroup-Name = "%{sql_foo_remote:SELECT groupname FROM radhuntgroup where nasipaddress='%{NAS-IP-Address}' limit 1}" } } ... authorize { redundant { huntgroup_local huntgroup_remote } } However, I'm just not sure whether the ok/notfound/fail status would propagate through a string expansion in this case. The examples in configurable_failover.rst talk only about normal modules. Thanks, Brian.
On 10/03/11 14:21, Brian Candler wrote:
With freeradius 2.1.10 I can configure failover for SQL lookups like this:
# in policy.conf sql_foo { redundant { sql_foo_local sql_foo_remote } }
# in sites-available/foo authorize { sql_foo }
However, it looks like I can't use this redundant module inside a string expansion:
authorize { update request { Huntgroup-Name = "%{sql_foo:SELECT groupname FROM radhuntgroup where nasipaddress='%{NAS-IP-Address}' limit 1}" } }
Correct. Virtual modules (e.g. "redundant") do not implement the "xlat" function.
How could I get the same level of redundancy for string expansions? Could I do the expansion multiple times inside a redundant section? I am thinking of perhaps:
Unfortunately the "xlat" functions in FR don't return error/success codes. They return "length of result string", and 0 for any failure condition, which means it's impossible to distinguish a failure from an empty result, and also that you can't use "if (ok)" constructs. You will probably need something like this: update request { Attrib := "%{sql1:select ...}" } if (!Attrib) { update request { Attrib := "%{sql2:select ...}" } } ...and you will obviously need to ensure that a working SQL module never returns an empty string for your query, else you'll just double the work up.
Phil Mayers wrote:
Correct. Virtual modules (e.g. "redundant") do not implement the "xlat" function. ... Unfortunately the "xlat" functions in FR don't return error/success codes. They return "length of result string", and 0 for any failure condition, which means it's impossible to distinguish a failure from an empty result, and also that you can't use "if (ok)" constructs.
OK, thanks for that. I wonder if it would be worth coding for this, e.g. return -1 for fail? (although that would break everything which blindly uses it as length of string :-) It does seem that some string expansions fail silently at the moment, which could perhaps do with being a bit more strict. e.g. I once wrote "%{Reply:AttrName}" instead of "%{reply:AttrName}" and it produced nothing more than a 'Warning' at freeradius -X.
You will probably need something like this:
update request { Attrib := "%{sql1:select ...}" } if (!Attrib) { update request { Attrib := "%{sql2:select ...}" } }
Thank you. I'll see what I can do. Regards, Brian.
participants (2)
-
Brian Candler -
Phil Mayers