Matching a value within an IP subnet
In clients.conf, you can match a whole subnet of source IPs with one rule: client 192.0.2.0/27 { secret = testing123-1 shortname = ADSL-BRAS } But is it possible to do the same to match a range of IPs in an attribute like NAS-IP-Address? I want to tag a collection of NASes from the same subnet with a control attribute (but which may be talking via a proxy, not directly). Perhaps something like: 192.0.2.0/27 NAS-Group := "ADSL-BRAS" or DEFAULT NAS-IP-Address =~ 192.0.2.0/27, NAS-Group := "ADSL-BRAS" I've had a look at paircmp() in src/lib/valuepair.c and can't see any logic which might do this. Are there any options you can suggest, short of expanding the subnet into a list of its constituent IPs? Thanks, Brian.
Brian Candler wrote:
DEFAULT NAS-IP-Address =~ 192.0.2.0/27, NAS-Group := "ADSL-BRAS"
I've had a look at paircmp() in src/lib/valuepair.c and can't see any logic which might do this.
Nope. Write a regex to do the matching. The above string after "=~" is *not* a regex. Alan DeKok.
On Mon, Oct 18, 2010 at 02:51:25PM +0200, Alan DeKok wrote:
Brian Candler wrote:
DEFAULT NAS-IP-Address =~ 192.0.2.0/27, NAS-Group := "ADSL-BRAS"
I've had a look at paircmp() in src/lib/valuepair.c and can't see any logic which might do this.
Nope. Write a regex to do the matching. The above string after "=~" is *not* a regex.
Indeed it is not. But NAS-IP-Address is (natively) not a string in RADIUS either, it's a 4-byte integer. Does FreeRADIUS let me treat it as if it were a string? DEFAULT NAS-IP-Address =~ /^192\.0\.2\.([0-9]|1[0-9]|2[0-9]|3[01])$/, NAS-Group := "ADSL-BRAS" B.
Brian Candler wrote:
Indeed it is not. But NAS-IP-Address is (natively) not a string in RADIUS either, it's a 4-byte integer.
To be pedantic: an IPv4 address.
Does FreeRADIUS let me treat it as if it were a string?
The operator you have chosen to use is: "=~". That is defined as doing a *regex* match. Regexes work on strings. IPv4 addresses can be printed to strings. So... regexes can match strings. You tried to use "=~" for comparing a *network mask*. That won't work. Regex matching is not the same as matching a network mask.
DEFAULT NAS-IP-Address =~ /^192\.0\.2\.([0-9]|1[0-9]|2[0-9]|3[01])$/, NAS-Group := "ADSL-BRAS"
That should work. Alan DeKok.
On Tue, Oct 19, 2010 at 02:11:06PM +0200, Alan DeKok wrote:
Does FreeRADIUS let me treat it as if it were a string?
The operator you have chosen to use is: "=~".
This was more of a "wish" than an actual usage. The question I meant was: is there any sort of operator to match an IP address against a subnet? And =~ was acting as a meta-operator.
DEFAULT NAS-IP-Address =~ /^192\.0\.2\.([0-9]|1[0-9]|2[0-9]|3[01])$/, NAS-Group := "ADSL-BRAS"
That should work.
OK, it's ugly, but it may suffice. Thanks for your help, Brian.
participants (2)
-
Alan DeKok -
Brian Candler