Custom attribute list
Hi Folks, Is there any way to create a custom attribute list as there are for "request", "config", "session-state", "reply"? New attributes can be created with a dictionary file but is there similar way to create a new list? Background is that I want to use the linelog module and the xlat expansion, e.g. %{pairs:reply:}, but don't want to log EAP stuff and MPPE session keys etc, but it would be nice to have the possibility to use the dynamic expansion of these lists. In a Python module I have tried to return these attributes in a new list ``` reply = { 'reply': (('Reply-Message', 'hello'),), 'customlist': (('Nice-Attribute', 'hi again'),) } return (radiusd.RLM_MODULE_OK, reply) ``` but of course it's not creating a new list magically. Since I didn't find anything in the documentation, the answer is probably no but it doesn't hurt to ask. Regards, Lineconnect
On Dec 3, 2021, at 8:17 AM, Lineconnect <nabble@felix.world> wrote:
Is there any way to create a custom attribute list as there are for "request", "config", "session-state", "reply"?
Unfortunately, no.
New attributes can be created with a dictionary file but is there similar way to create a new list? Background is that I want to use the linelog module and the xlat expansion, e.g. %{pairs:reply:}, but don't want to log EAP stuff and MPPE session keys etc, but it would be nice to have the possibility to use the dynamic expansion of these lists.
You can just list each attribute you want to log.
Since I didn't find anything in the documentation, the answer is probably no but it doesn't hurt to ask.
Yup. In v4, there's native support for nested groups. So it would be possible there to (a) create a "group" attribute, and (b) copy a bunch of things there. It's not entirely like a new list, but it's close enough that it's fine. We're doing some final architectural work. We hope to have an alpha version in Q2 2022. Alan DeKok.
New attributes can be created with a dictionary file but is there similar way to create a new list? Background is that I want to use the linelog module and the xlat expansion, e.g. %{pairs:reply:}, but don't want to log EAP stuff and MPPE session keys etc, but it would be nice to have the possibility to use the dynamic expansion of these lists. You can just list each attribute you want to log.
Yes but not every attribute will always filled, so there are sometimes empty "field" which i wanted to avoid.
In v4, there's native support for nested groups. So it would be possible there to (a) create a "group" attribute, and (b) copy a bunch of things there. It's not entirely like a new list, but it's close enough that it's fine. Great!
Regards, Lineconnect
On 03/12/2021 13:32, Lineconnect wrote:
New attributes can be created with a dictionary file but is there similar way to create a new list? Background is that I want to use the linelog module and the xlat expansion, e.g. %{pairs:reply:}, but don't want to log EAP stuff and MPPE session keys etc, but it would be nice to have the possibility to use the dynamic expansion of these lists. You can just list each attribute you want to log.
Yes but not every attribute will always filled, so there are sometimes empty "field" which i wanted to avoid.
There's some things that might work, albeit a bit hacky. 1. You could write with "detail" and then post-process the detail file. 2. Depending on when you're logging, you may be able to shuffle things around the lists if one list is no longer needed. E.g. if you're logging right at the end of post-auth then the request list probably won't be used any more. So # clear the request list update { &request: !* ANY } # copy &reply: to &request: update { &request: := &reply:[*] } # call attr_filter for the request list to get rid of unwanted reply attributes (configure appropriately) attr_filter # linelog &request:[*] linelog You may also be able to do the same with the session-state list. Again if you're 100% sure you never need it again. If you break it you definitely get to keep all the pieces with this one. It's really not a good idea... 3. Or you could use rlm_json which is now in v3.2 and lets you specify a list of attributes to log, e.g. "%{json_encode:&request:[*] !&User-Password !&State !&Message-Authenticator !&EAP-Message}" But it's bleeding edge and not tested. And you get JSON output, not plain text, so still needs post-processing. Alan's suggestion is still the cleanest and best, really. -- Matthew
On Freitag, 3. Dezember 2021 14:50:52 CET Matthew Newton wrote:
There's some things that might work, albeit a bit hacky.
1. You could write with "detail" and then post-process the detail file. This will properly what i will go for. Just wanted to avoid to write/config a parser for the log files in the later log destination if FreeRADIUS is able to handle all the stuff i need. Unusual that FreeRADIUS is not able to do everything ;)
2. Depending on when you're logging, you may be able to shuffle things around the lists if one list is no longer needed.
You may also be able to do the same with the session-state list. Again if you're 100% sure you never need it again.
If you break it you definitely get to keep all the pieces with this one. It's really not a good idea...
Yes i've played around with stuff like that for some hours but the effort to research every single peace which is neccessary in which context at which time is too much and if something is not working in the future i'll not able to find anything.. Thanks for your Time Matthew thinking about it! Regards, Lineconnect
participants (3)
-
Alan DeKok -
Lineconnect -
Matthew Newton