move policies to new function syntax

diff --git a/raddb/policy.d/abfab-tr b/raddb/policy.d/abfab-tr
index 816ac5f63139c93039d28334c2b11ddbddfb03b4..ba088ac1d15c23ce675bf8349b5ad285c5a047da 100644 (file)
--- a/raddb/policy.d/abfab-tr
+++ b/raddb/policy.d/abfab-tr
@@ -11,7 +11,7 @@
 abfab_psk_authorize {
        if (&TLS-PSK-Identity) {
                # TODO: may need to check trust-router-apc as well
-               if ("%{psksql:select distinct keyid from authorizations_keys where keyid = '%{tls-psk-identity}' and '%{trust-router-coi}' like coi and '%{gss-acceptor-realm-name}' like acceptor_realm and '%{gss-acceptor-host-name}' like hostname;}") {
+               if ("%psksql(select distinct keyid from authorizations_keys where keyid = '%{tls-psk-identity}' and '%{trust-router-coi}' like coi and '%{gss-acceptor-realm-name}' like acceptor_realm and '%{gss-acceptor-host-name}' like hostname;)") {
                        # do things here
                }
                else {
@@ -24,8 +24,8 @@ abfab_psk_authorize {
 
 abfab_client_check {
        # check that the acceptor host name is correct
-       if ("%(client:gss_acceptor_host_name)" && &GSS-acceptor-host-name) {
-               if ("%(client:gss_acceptor_host_name)" != "%{gss-acceptor-host-name}") {
+       if ("%client(gss_acceptor_host_name)" && &GSS-acceptor-host-name) {
+               if ("%client(gss_acceptor_host_name)" != "%{gss-acceptor-host-name}") {
                        &reply.Reply-Message = "GSS-Acceptor-Host-Name incorrect"
 
                        reject
@@ -33,13 +33,13 @@ abfab_client_check {
        }
 
        # set trust-router-coi attribute from the client configuration
-       if ("%(client:trust_router_coi)") {
-               &request.Trust-Router-COI := "%(client:trust_router_coi)"
+       if ("%client(trust_router_coi)") {
+               &request.Trust-Router-COI := "%client(trust_router_coi)"
        }
 
        # set gss-acceptor-realm-name attribute from the client configuration
-       if ("%(client:gss_acceptor_realm_name)") {
-               &request.GSS-Acceptor-Realm-Name := "%(client:gss_acceptor_realm_name)"
+       if ("%client(gss_acceptor_realm_name)") {
+               &request.GSS-Acceptor-Realm-Name := "%client(gss_acceptor_realm_name)"
        }
 }
 

diff --git a/raddb/policy.d/accounting b/raddb/policy.d/accounting
index 569ec4aeabb23c9ee18c0e5eb99c256b3059c42f..8fca45425105b9bce7c8854fcffb5b463677e386 100644 (file)
--- a/raddb/policy.d/accounting
+++ b/raddb/policy.d/accounting
@@ -23,12 +23,12 @@ class_value_prefix = 'ai:'
 #      result in the string `192.0.2.1`, but will instead be
 #      represented internally as 32-bits of binary data `c0000201`.
 #      The MD5 hash of those inputs will then be different.
-#      We fix this issue by using `%{string:..}` to convert the
+#      We fix this issue by using `%string(..}` to convert the
 #      inputs to MD5 into printable string form.
 #
-#      Similarly, the output of `%{md5:..}` is binary safe, and is
+#      Similarly, the output of `%md5(..}` is binary safe, and is
 #      therefore a binary blob.  We therefore convert the output
-#      of it to a printable string via `%{hex:...}`
+#      of it to a printable string via `%hex(...}`
 #
 acct_unique {
        #
@@ -56,8 +56,8 @@ acct_unique {
        #  initial authentication session (Common in a
        #  wireless environment).
        #
-       if ("%{string:Class}" =~ /${policy.class_value_prefix}([0-9a-f]{32})/i) {
-               &request.Acct-Unique-Session-Id := "%{hex:%{md5:%{string:%{1},%{Acct-Session-ID}}}}"
+       if ("%string(Class)" =~ /${policy.class_value_prefix}([0-9a-f]{32})/i) {
+               &request.Acct-Unique-Session-Id := "%hex(%md5(%string(%{1},%{Acct-Session-ID})))"
        }
 
        #
@@ -67,7 +67,7 @@ acct_unique {
        #  is not included
        #
        else {
-               &request.Acct-Unique-Session-Id := "%{hex:%{md5:%{string:%{User-Name},%{Acct-Multi-Session-ID},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}}}}"
+               &request.Acct-Unique-Session-Id := "%hex(%md5(%string(%{User-Name},%{Acct-Multi-Session-ID},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port})))"
        }
 }
 
@@ -75,7 +75,7 @@ acct_unique {
 #      Insert a (hopefully unique) value into class
 #
 insert_acct_class {
-       &reply.Class = "${policy.class_value_prefix}%{md5:%t,%I,%{Net.Src.Port},%{Net.Src.IP},%{NAS-IP-Address},%{Calling-Station-ID},%{User-Name}}"
+       &reply.Class = "${policy.class_value_prefix}%md5(%t,%I,%{Net.Src.Port},%{Net.Src.IP},%{NAS-IP-Address},%{Calling-Station-ID},%{User-Name})"
 }
 
 #
@@ -88,13 +88,13 @@ acct_counters64.preacct {
                &request.Acct-Input-Octets64 := "%{%{Acct-Input-Octets}:-0}"
        }
        else {
-               &request.Acct-Input-Octets64 = "%{expr:(&Acct-Input-Gigawords << 32) | &Acct-Input-Octets}"
+               &request.Acct-Input-Octets64 =  (((uint64) &Acct-Input-Gigawords) << 32) | (uint64) &Acct-Input-Octets
        }
        if (!&Acct-Output-Gigawords) {
                &request.Acct-Output-Octets64 := "%{%{Acct-Output-Octets}:-0}"
        }
        else {
-               &request.Acct-Output-Octets64 = "%{expr:(&Acct-Output-Gigawords << 32) | &Acct-Output-Octets}"
+               &request.Acct-Output-Octets64 = (((uint64) &Acct-Output-Gigawords) << 32) | (uint64) &Acct-Output-Octets
        }
 }
 

diff --git a/raddb/policy.d/canonicalisation b/raddb/policy.d/canonicalisation
index 9d42a00631216117ce3b4455d8e66259705ee28b..7d0596d2f36d07e89742ca8cebe47c0543457acf 100644 (file)
--- a/raddb/policy.d/canonicalisation
+++ b/raddb/policy.d/canonicalisation
@@ -52,7 +52,7 @@ mac-addr-regexp = '([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^
 #
 rewrite_called_station_id {
        if (&Called-Station-Id && (&Called-Station-Id =~ /^${policy.mac-addr-regexp}([^0-9a-f](.+))?$/i)) {
-               &request.Called-Station-Id := "%{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}"
+               &request.Called-Station-Id := "%toupper(%{1}-%{2}-%{3}-%{4}-%{5}-%{6})"
 
                # SSID component?
                if ("%{8}") {
@@ -74,7 +74,7 @@ rewrite_called_station_id {
 #
 rewrite_calling_station_id {
        if (&Calling-Station-Id && (&Calling-Station-Id =~ /^${policy.mac-addr-regexp}$/i)) {
-               &request.Calling-Station-Id := "%{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}"
+               &request.Calling-Station-Id := "%toupper(%{1}-%{2}-%{3}-%{4}-%{5}-%{6})"
 
                updated
        }

diff --git a/raddb/policy.d/cui b/raddb/policy.d/cui
index 4e1e5532dad8eb1db9b16e668540b532ccc0b7dc..6d0419a5b1c8f78ee81052c0ed47de62bff3ae33 100644 (file)
--- a/raddb/policy.d/cui
+++ b/raddb/policy.d/cui
@@ -39,7 +39,7 @@ cui_require_operator_name = "no"
 #  }
 #
 cui.authorize {
-       if ("%(client:add_cui)" == 'yes') {
+       if ("%client(add_cui)" == 'yes') {
                &request.Chargeable-User-Identity := 0x00
        }
 }
@@ -54,7 +54,7 @@ cui.authorize {
 cui.post-auth {
        if (!&control.Proxy-To-Realm && &Chargeable-User-Identity && !&reply.Chargeable-User-Identity &&
            (&Operator-Name || ('${policy.cui_require_operator_name}' != 'yes')) ) {
-               &reply.Chargeable-User-Identity = "%{sha1:${policy.cui_hash_key}%{tolower:%{User-Name}%{%{Operator-Name}:-}}}"
+               &reply.Chargeable-User-Identity = "%sha1(${policy.cui_hash_key}%tolower(%{User-Name}%{%{Operator-Name}:-}))"
        }
 
        #
@@ -77,7 +77,7 @@ cui.post-auth {
 cui-inner.post-auth {
        if (&outer.request.Chargeable-User-Identity && \
            (&outer.request.Operator-Name || ('${policy.cui_require_operator_name}' != 'yes'))) {
-               &reply.Chargeable-User-Identity := "%{sha1:${policy.cui_hash_key}%{tolower:%{User-Name}%{%{outer.request.Operator-Name}:-}}}"
+               &reply.Chargeable-User-Identity := "%sha1(${policy.cui_hash_key}%tolower(%{User-Name}%{%{outer.request.Operator-Name}:-}))"
        }
 }
 
@@ -93,11 +93,11 @@ cui.accounting {
        #  in the DB.
        #
        if (!&Chargeable-User-Identity) {
-               &request.Chargeable-User-Identity := %{cuisql:\
+               &request.Chargeable-User-Identity := %cuisql(\
                                SELECT cui FROM cui \
                                WHERE clientipaddress = '%{Net.Src.IP}' \
                                AND callingstationid = '%{Calling-Station-Id}' \
-                               AND username = '%{User-Name}'}
+                               AND username = '%{User-Name}')
        }
 
        #

diff --git a/raddb/policy.d/filter b/raddb/policy.d/filter
index b5733e06bec7a22d1d9cc9067df1dedb9e301dee..bc38860f2a541dbd032715abfb8dc22a85ae8df9 100644 (file)
--- a/raddb/policy.d/filter
+++ b/raddb/policy.d/filter
@@ -37,7 +37,7 @@ filter_username {
                #
                #  reject mixed case e.g. "UseRNaMe"
                #
-               #if (&User-Name != "%{tolower:%{User-Name}}") {
+               #if (&User-Name != "%tolower(%{User-Name}}") {
                #       reject
                #}
 
@@ -119,9 +119,9 @@ filter_username {
 #
 filter_password {
        if (&User-Password && \
-          (&User-Password != "%{string:User-Password}")) {
-               &request.Tmp-String-0 := %{string:User-Password}
-               &request.User-Password := %{string:Tmp-String-0}
+          (&User-Password != "%string(User-Password}")) {
+               &request.Tmp-String-0 := %string(User-Password)
+               &request.User-Password := %string(Tmp-String-0)
         }
 }
 
@@ -148,7 +148,7 @@ filter_inner_identity {
                #  Get the outer realm.
                #
                if (&outer.request.User-Name =~ /@([^@]+)$/) {
-                       &request.Outer-Realm-Name = "%{1}"
+                       &request.Outer-Realm-Name = %{1}
 
                        #
                        #  When we have an outer realm name, the user portion
@@ -183,7 +183,7 @@ filter_inner_identity {
                #  Get the inner realm.
                #
                if (&User-Name =~ /@([^@]+)$/) {
-                       &request.Inner-Realm-Name = "%{1}"
+                       &request.Inner-Realm-Name = %{1}
 
                        #
                        #  Note that we do EQUALITY checks for realm names.