According to the docs:

http://wiki.freeradius.org/config/Operators

That is not allowed as a reply item.


> -----Original Message-----
> From: Freeradius-Users [mailto:freeradius-users-
> bounces+ggiesen+freeradius-users=giesen.me@lists.freeradius.org] On
> Behalf Of Jorge Pereira
> Sent: October 1, 2015 2:19 PM
> To: FreeRadius users mailing list
> Subject: Re: Operator to remove attributes
> 
> Hi Gary,
> 
>     try something like:
> 
> Attribute !* ANY
> 
> 
> --
> Jorge Pereira
> 
> On Thu, Oct 1, 2015 at 3:13 PM, Gary T. Giesen <
> ggiesen+freeradius-users@giesen.me> wrote:
> 
> > I'm currently using FreeRADIUS 2.1.12 with an SQL backend and a
> > custom-developed front end.
> >
> > I've run into a situation where we need to be able to apply a group to
> > the user (that contains a check attribute) that would strip reply
> > items (basically we want to strip Service-Type, Framed-Protocol,
> > Framed-IP-Address, Framed-IP-Netmask, Framed-Route, etc) depending
> on
> > which device the request is coming from.
> >
> > I realize that using unlang is probably the best supported method for
> > this, unfortunately it doesn't jive well with our setup. I noticed a
> > while back that Joe Maimon wrote some patches to create some custom
> > operators to do just that:
> >
> >
> > http://lists.freeradius.org/pipermail/freeradius-devel/2005-October/00
> > 0550.h
> > tml
> >
> > "Attribute -= Value"
> > As a reply item it means remove matching items from the reply list.
> > Not allowed as a check item.
> >
> > "Attribute -* Value"
> > As a reply item it means remove all "Attribute" attributes items from
> > the reply list.
> > Not allowed as a check item.
> >
> > "Attribute -~ Value"
> > As a reply item it means remove regex matching items from the reply list.
> > Not allowed as a check item.
> >
> > Since it's not in the documentation, I presume this never made it into
> > an official release.  Were there problems with the patch? I'd be very
> > interested to see this implemented...
> >
> > Cheers,
> >
> > Gary T. Giesen
> >
> >
> > -
> > List info/subscribe/unsubscribe? See
> > http://www.freeradius.org/list/users.html
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html

Doesn't seem to work: mysql> select * from radgroupreply WHERE groupname LIKE "DEVICE-MGMT-LNS"; +-----+-----------------+-------------------+----+-------------------------- -------------+ | id | groupname | attribute | op | value | +-----+-----------------+-------------------+----+-------------------------- -------------+ | 229 | DEVICE-MGMT-LNS | Framed-IP-Address | !* | ANY | | 230 | DEVICE-MGMT-LNS | Framed-IP-Netmask | !* | ANY | | 231 | DEVICE-MGMT-LNS | Cisco-AVPair | += | vpdn:tunnel-type=l2tp | | 232 | DEVICE-MGMT-LNS | Cisco-AVPair | += | vpdn:tunnel-id=dev-mgmt | | 235 | DEVICE-MGMT-LNS | Cisco-AVPair | += | vpdn:tunnel-password=XXXXXXXXXX | | 238 | DEVICE-MGMT-LNS | Cisco-AVPair | += | vpdn:vpn-vrf=XXXXXXXX | | 239 | DEVICE-MGMT-LNS | Cisco-AVPair | += | vpdn:ip-addresses=XXXXXXXXXXX | +-----+-----------------+-------------------+----+-------------------------- -------------+ lns#test aaa group PPPOE-RADIUS-SERVERS test_mgmt_account TestAccount new-code User successfully authenticated USER ATTRIBUTES addr 0 10.55.0.100 netmask 0 255.255.255.255 addr 0 0.0.0.0 netmask 0 0.0.0.0 tunnel-type 0 3 [l2tp] tunnel-id 0 "dev-mgmt" tunnel-password 0 <hidden> vpn-vrf 0 "XXXXXXXX" ip-addresses 0 "XXXXXXXXXXX" It looks like it just adds a second set of attributes with values of 0.0.0.0. Cheers, GTG

-----Original Message----- From: Freeradius-Users [mailto:freeradius-users- bounces+ggiesen+freeradius-users=giesen.me@lists.freeradius.org] On Behalf Of Arran Cudbard-Bell Sent: October 1, 2015 2:33 PM To: FreeRadius users mailing list Subject: Re: Operator to remove attributes

...

On Oct 1, 2015, at 2:24 PM, Gary T. Giesen <ggiesen+freeradius- users@giesen.me> wrote:

According to the docs:

http://wiki.freeradius.org/config/Operators

That is not allowed as a reply item.

That document is for rlm_files only (I added a note).

you should review man unlang for operator documentation.

-Arran

On Oct 1, 2015, at 2:48 PM, Gary T. Giesen <ggiesen+freeradius-users@giesen.me> wrote:

Doesn't seem to work:

mysql> select * from radgroupreply WHERE groupname LIKE "DEVICE-MGMT-LNS"; +-----+-----------------+-------------------+----+-------------------------- -------------+ | id | groupname | attribute | op | value | +-----+-----------------+-------------------+----+-------------------------- -------------+ | 229 | DEVICE-MGMT-LNS | Framed-IP-Address | !* | ANY | | 230 | DEVICE-MGMT-LNS | Framed-IP-Netmask | !* | ANY | | 231 | DEVICE-MGMT-LNS | Cisco-AVPair | += | vpdn:tunnel-type=l2tp | | 232 | DEVICE-MGMT-LNS | Cisco-AVPair | += | vpdn:tunnel-id=dev-mgmt | | 235 | DEVICE-MGMT-LNS | Cisco-AVPair | += | vpdn:tunnel-password=XXXXXXXXXX | | 238 | DEVICE-MGMT-LNS | Cisco-AVPair | += | vpdn:vpn-vrf=XXXXXXXX | | 239 | DEVICE-MGMT-LNS | Cisco-AVPair | += | vpdn:ip-addresses=XXXXXXXXXXX | +-----+-----------------+-------------------+----+-------------------------- -------------+

lns#test aaa group PPPOE-RADIUS-SERVERS test_mgmt_account TestAccount new-code User successfully authenticated

USER ATTRIBUTES

addr 0 10.55.0.100 netmask 0 255.255.255.255 addr 0 0.0.0.0 netmask 0 0.0.0.0 tunnel-type 0 3 [l2tp] tunnel-id 0 "dev-mgmt" tunnel-password 0 <hidden> vpn-vrf 0 "XXXXXXXX" ip-addresses 0 "XXXXXXXXXXX"

It looks like it just adds a second set of attributes with values of 0.0.0.0.

Ah, SQL uses the old files API too, so it too, unfortunately has the same behaviour. You'll have to do this in the policy language outside of SQL. We'll fix this for v3.2.0 (the stable release of v3.1.) -Arran

trust, move to 3.0.x -- Jorge Pereira On Thu, Oct 1, 2015 at 4:28 PM, Gary T. Giesen < ggiesen+freeradius-users@giesen.me> wrote:

Okay thanks.

I'll work around it for now, but definitely can't wait until we can do it natively in SQL in 3.2.

Cheers,

GTG

...

-----Original Message----- From: Freeradius-Users [mailto:freeradius-users- bounces+ggiesen+freeradius-users=giesen.me@lists.freeradius.org] On Behalf Of Arran Cudbard-Bell Sent: October 1, 2015 3:09 PM To: FreeRadius users mailing list Subject: Re: Operator to remove attributes

...

On Oct 1, 2015, at 2:48 PM, Gary T. Giesen <ggiesen+freeradius- users@giesen.me> wrote:

Doesn't seem to work:

mysql> select * from radgroupreply WHERE groupname LIKE mysql> "DEVICE-MGMT-LNS"; +-----+-----------------+-------------------+----+-------------------- +-----+-----------------+-------------------+----+------ -------------+ | id | groupname | attribute | op | value | +-----+-----------------+-------------------+----+-------------------- +-----+-----------------+-------------------+----+------ -------------+ | 229 | DEVICE-MGMT-LNS | Framed-IP-Address | !* | ANY | | 230 | DEVICE-MGMT-LNS | Framed-IP-Netmask | !* | ANY | | 231 | DEVICE-MGMT-LNS | Cisco-AVPair | += | vpdn:tunnel-type=l2tp | | 232 | DEVICE-MGMT-LNS | Cisco-AVPair | += | vpdn:tunnel-id=dev- mgmt | | 235 | DEVICE-MGMT-LNS | Cisco-AVPair | += | vpdn:tunnel-password=XXXXXXXXXX | | 238 | DEVICE-MGMT-LNS | Cisco-AVPair | += | vpdn:vpn- vrf=XXXXXXXX | | 239 | DEVICE-MGMT-LNS | Cisco-AVPair | += | vpdn:ip-addresses=XXXXXXXXXXX | +-----+-----------------+-------------------+----+-------------------- +-----+-----------------+-------------------+----+------ -------------+

lns#test aaa group PPPOE-RADIUS-SERVERS test_mgmt_account TestAccount new-code User successfully authenticated

USER ATTRIBUTES

addr 0 10.55.0.100 netmask 0 255.255.255.255 addr 0 0.0.0.0 netmask 0 0.0.0.0 tunnel-type 0 3 [l2tp] tunnel-id 0 "dev-mgmt" tunnel-password 0 <hidden> vpn-vrf 0 "XXXXXXXX" ip-addresses 0 "XXXXXXXXXXX"

It looks like it just adds a second set of attributes with values of 0.0.0.0.

Ah, SQL uses the old files API too, so it too, unfortunately has the same behaviour.

You'll have to do this in the policy language outside of SQL.

We'll fix this for v3.2.0 (the stable release of v3.1.)

-Arran

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Anything based on a text-config won't scale for me and my users (they use a web frontend for provisioning). Maybe I misunderstand unlang, if I can use it (and it looks like most importantly the !* operator) in my SQL backend that would be peachy. The problem is the attributes have I have strip change from user to user, and I have hundreds of groups, so if I can't do it in the SQL backend, it likely won't work for me. Cheers, GTG

-----Original Message----- From: Freeradius-Users [mailto:freeradius-users- bounces+ggiesen+freeradius-users=giesen.me@lists.freeradius.org] On Behalf Of A.L.M.Buxey@lboro.ac.uk Sent: October 1, 2015 3:01 PM To: FreeRadius users mailing list Subject: Re: Operator to remove attributes

Hi,

...

According to the docs:

http://wiki.freeradius.org/config/Operators

That is not allowed as a reply item.

different usage...if you look at the config of a recent version you'll see an example

# if (updated) { # update reply { # MS-MPPE-Recv-Key !* 0x00 # MS-MPPE-Send-Key !* 0x00 # } # }

alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html