Attribute filtering

[Alan Batie]

I'm having some trouble with attribute filtering:  we're preparing to
move from router assigned ip addressing to radius pool assignment.  For
initial testing, I thought I'd just add a Pool-Name to the user check
items for a few test accounts.  That doesn't work because the
Framed-IP-Address that tells the router to do the assignment is added in
the group reply items, which prevents sqlippool from doing an
assignment.  It's probably possible to do a convoluted sql statement in
the group lookup, but that would be...convoluted.  Our solution was to
just create separate groups for these cases, but I would like to figure
out how to do overrides like this.

What I looked for was an operator to remove an attribute, but that
doesn't seem to exist - you can only add them.

I noticed the attr_filter module, and tried that with:

mods-config/attr_filter/framed_ip_address:

if (&control:Pool-Nmae && &control:Pool-Name != "") {
        Framed-IP-Address !* ANY
}

If I read that module right, it filters out anything that doesn't match
the given patterns, but that doesn't seem to do anything:

(2) Thu Feb 11 12:16:27 2016: Debug: attr_filter.framed_ip_address:
EXPAND %{Framed-IP-Address}
(2) Thu Feb 11 12:16:27 2016: Debug: attr_filter.framed_ip_address:    -->
(2) Thu Feb 11 12:16:27 2016: Debug:     [attr_filter.framed_ip_address]
= noop

was the debug output in all cases and Framed-IP-Address was left alone.

The only thing that did work was putting this in a perl module:

sub post_auth {
       if (defined($RAD_CHECK{'Pool-Name'})) {
           delete $RAD_REPLY{'Framed-IP-Address'};
       }

       return RLM_MODULE_OK;
}

but using perl seems heavy-handed for a simple task like this, so I'm
wondering what the "approved" mechanism for deleting an attribute is?

Thanks...