doubts about the functions in the unlang
Hi, someone know if have some way to do something like. int-require.by { if (!$1) { update { reply:Reply-Message:= "The $1 is required" } reject } else { noop } } and calling like int-require.by "Acct-Session-Id" -- Jorge Pereira
someone know if have some way to do something like.
int-require.by {
if (!$1) { update { reply:Reply-Message:= "The $1 is required" } reject } else { noop } }
Not quite like that, but yes, you can write a policy that checks for specific attributes and sends a reject... In /etc/raddb/policy.d/ you'll find several policies defined that you can call. Yours you can define in a separate file (call it int-require-by, for example), and then include that: int-require-by { if (!&Acct-Session-Id) { update reply { Reply-Message := "Acct-Session-Id is required" } reject } } Call int-require-by where you need it. Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp@jabber.dev.ja.net skype: stefan.paetow.janet Lumen House, Library Avenue, Harwell Oxford, Didcot, OX11 0SG jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200.
On 11 Jun 2015, at 05:39, A.L.M.Buxey@lboro.ac.uk wrote:
Hi,
int-require-by { if (!&Acct-Session-Id) { update reply { Reply-Message := "Acct-Session-Id is required" } reject } }
int-required-by { if ("%{xlat:%%{%{Tmp-String-0}}}" == '') { update reply { Reply-Message := 'Acct-Session-Id is required' } reject } } update { Tmp-String-0 := 'Acct-Session-Id' } int-required-by Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
On 11 Jun 2015, at 08:12, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On 11 Jun 2015, at 05:39, A.L.M.Buxey@lboro.ac.uk wrote:
Hi,
int-require-by { if (!&Acct-Session-Id) { update reply { Reply-Message := "Acct-Session-Id is required" } reject } }
int-required-by { if ("%{xlat:%%{%{Tmp-String-0}}}" == '') { update reply { Reply-Message := 'Acct-Session-Id is required' } reject } }
update { Tmp-String-0 := 'Acct-Session-Id' } int-required-by
Or I guess int-required-by { if ("%{xlat:%%{%{Tmp-String-0}}}" == '') { update reply { Reply-Message := "%{Tmp-String-0} is required" } reject } } Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
On Thu, Jun 11, 2015 at 6:39 AM, <A.L.M.Buxey@lboro.ac.uk> wrote:
Hi,
Hi, I know about that.... but in my case i have a lot of vsas, and I would not want to have to create one for each.
int-require-by { if (!&Acct-Session-Id) { update reply { Reply-Message := "Acct-Session-Id is required" } reject } }
+1
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Jun 11, 2015, at 10:04 AM, Jorge Pereira <jpereiran@gmail.com> wrote:
I know about that.... but in my case i have a lot of vsas, and I would not want to have to create one for each.
I don't want to turn unlang into a real language with functions, function parameters, etc. We already have PHP. That's one PHP too many. Alan DeKok.
Haha! Alan, I figured your thinking like that... Thanks -- Jorge Pereira On Thu, Jun 11, 2015 at 11:09 AM, Alan DeKok <aland@deployingradius.com> wrote:
On Jun 11, 2015, at 10:04 AM, Jorge Pereira <jpereiran@gmail.com> wrote:
I know about that.... but in my case i have a lot of vsas, and I would not want to have to create one for each.
I don't want to turn unlang into a real language with functions, function parameters, etc. We already have PHP. That's one PHP too many.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I know about that.... but in my case i have a lot of vsas, and I would not want to have to create one for each.
Either that, or use Arran's version that calls xlat to translate the temporary strings. Your choice really. :-) Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp@jabber.dev.ja.net skype: stefan.paetow.janet Lumen House, Library Avenue, Harwell Oxford, Didcot, OX11 0SG jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200.
On Thu, Jun 11, 2015 at 02:14:30PM +0000, Stefan Paetow wrote:
I know about that.... but in my case i have a lot of vsas, and I would not want to have to create one for each.
Either that, or use Arran's version that calls xlat to translate the temporary strings. Your choice really. :-)
Or, e.g. use rlm_perl. I'd probably just hack up a script that takes a list of attributes as input and spews out the required unlang. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
On Jun 11, 2015, at 10:25 AM, Matthew Newton <mcn4@leicester.ac.uk> wrote:
On Thu, Jun 11, 2015 at 02:14:30PM +0000, Stefan Paetow wrote:
I know about that.... but in my case i have a lot of vsas, and I would not want to have to create one for each.
Either that, or use Arran's version that calls xlat to translate the temporary strings. Your choice really. :-)
Or, e.g. use rlm_perl.
Or don't :( Have you read the code in rlm_perl? ew. -Arran
Hi, OMG! rlm_perl? no thanks, I love my life... I prefer to jump into the abyss... :) I prefer to use the rlm_python or keep my implementation of rlm_lua that I intend to finish soon! In this case i will keep creating policy-checks for each vsa that i need to check. Thanks everyone! -- Jorge Pereira On Thu, Jun 11, 2015 at 11:40 AM, Arran Cudbard-Bell < a.cudbardb@freeradius.org> wrote:
On Jun 11, 2015, at 10:25 AM, Matthew Newton <mcn4@leicester.ac.uk> wrote:
On Thu, Jun 11, 2015 at 02:14:30PM +0000, Stefan Paetow wrote:
I know about that.... but in my case i have a lot of vsas, and I would not want to have to create one for each.
Either that, or use Arran's version that calls xlat to translate the temporary strings. Your choice really. :-)
Or, e.g. use rlm_perl.
Or don't :(
Have you read the code in rlm_perl? ew.
-Arran
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Thu, Jun 11, 2015 at 11:46:49AM -0300, Jorge Pereira wrote:
OMG! rlm_perl? no thanks, I love my life... I prefer to jump into the abyss... :) I prefer to use the rlm_python
I think you would find that rlm_python is in far worse condition than rlm_perl. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
On Thu, Jun 11, 2015 at 10:40:14AM -0400, Arran Cudbard-Bell wrote:
On Jun 11, 2015, at 10:25 AM, Matthew Newton <mcn4@leicester.ac.uk> wrote:
On Thu, Jun 11, 2015 at 02:14:30PM +0000, Stefan Paetow wrote:
I know about that.... but in my case i have a lot of vsas, and I would not want to have to create one for each.
Either that, or use Arran's version that calls xlat to translate the temporary strings. Your choice really. :-)
Or, e.g. use rlm_perl.
Or don't :(
Have you read the code in rlm_perl? ew.
I don't personally, which is why I suggested automating unlang output. But it is another solution, even if not necessarily a good one! Making a call-out to another language like that always seems like a bad idea to me, unless absolutely required - it "feels" like it's going to be slow, whether it actually is or not. If I wanted something unusual I'd be more inclined to just hack it up as a C module. Having said that, and noting Alan's comments that it's unlikely to happen, having parameters to policies is something I've thought would be useful for a while. Otherwise you tend to end up with an ugly 'update Tmp-String-X' before/after the policy call just to get around it. But as much as I'd thought it would be useful, so far I don't believe I've actually got any config where I would have used it... Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
participants (6)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Arran Cudbard-Bell -
Jorge Pereira -
Matthew Newton -
Stefan Paetow