Fixup default virtual servers and policies to use &references

diff --git a/raddb/policy.d/accounting b/raddb/policy.d/accounting
index bacf76b25e15928a77a8104dac1874c26089e448..8fea9a24972899b0a658055a960abd40404d59a9 100644 (file)
--- a/raddb/policy.d/accounting
+++ b/raddb/policy.d/accounting
@@ -34,7 +34,7 @@ acct_unique {
        #
        if ("%{string:Class}" =~ /${policy.class_value_prefix}([0-9a-f]{32})/i) {
                update request {
-                       Acct-Unique-Session-Id := "%{md5:%{1},%{Acct-Session-ID}}"
+                       &Acct-Unique-Session-Id := "%{md5:%{1},%{Acct-Session-ID}}"
                }
        }
 
@@ -46,7 +46,7 @@ acct_unique {
        #
        else {
                update request {
-                       Acct-Unique-Session-Id := "%{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}}"
+                       &Acct-Unique-Session-Id := "%{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}}"
                 }
        }
 }
@@ -56,7 +56,7 @@ acct_unique {
 #
 insert_acct_class {
        update reply {
-               Class = "${policy.class_value_prefix}%{md5:%t,%I,%{Packet-Src-Port},%{Packet-Src-IP-Address},%{NAS-IP-Address},%{Calling-Station-ID},%{User-Name}}"
+               &Class = "${policy.class_value_prefix}%{md5:%t,%I,%{Packet-Src-Port},%{Packet-Src-IP-Address},%{NAS-IP-Address},%{Calling-Station-ID},%{User-Name}}"
        }
 }
 
@@ -65,8 +65,8 @@ insert_acct_class {
 #
 acct_counters64.preacct {
        update request {
-               Acct-Input-Octets64 = "%{expr:(%{%{Acct-Input-Gigawords}:-0} * 4294967296) + %{%{Acct-Input-Octets}:-0}}"
-               Acct-Output-Octets64 = "%{expr:(%{%{Acct-Output-Gigawords}:-0} * 4294967296) + %{%{Acct-Output-Octets}:-0}}"
+               &Acct-Input-Octets64 = "%{expr:(%{%{Acct-Input-Gigawords}:-0} * 4294967296) + %{%{Acct-Input-Octets}:-0}}"
+               &Acct-Output-Octets64 = "%{expr:(%{%{Acct-Output-Gigawords}:-0} * 4294967296) + %{%{Acct-Output-Octets}:-0}}"
        }
 }
 

diff --git a/raddb/policy.d/canonicalization b/raddb/policy.d/canonicalization
index 4018de00b362d1c70e74431fd0b041f6337df931..cae86c388e0dca85da204b222c19973e946ab9fd 100644 (file)
--- a/raddb/policy.d/canonicalization
+++ b/raddb/policy.d/canonicalization
@@ -15,8 +15,8 @@ nai_regexp = "^([^@]*)(@([-[:alnum:]]+\\.[-[:alnum:].]+))?$"
 split_username_nai {
        if (&User-Name =~ /${policy.nai_regexp}/) {
                update request {
-                       Stripped-User-Name := "%{1}"
-                       Stripped-User-Domain = "%{3}"
+                       &Stripped-User-Name := "%{1}"
+                       &Stripped-User-Domain = "%{3}"
                }
 
                # If any of the expansions result in a null
@@ -35,8 +35,8 @@ split_username_nai {
 split_username_nai.post-proxy {
        if (&proxy-reply:User-Name =~ /${policy.nai_regexp}/) {
                update proxy-reply {
-                       Stripped-User-Name := "%{1}"
-                       Stripped-User-Domain = "%{3}"
+                       &Stripped-User-Name := "%{1}"
+                       &Stripped-User-Domain = "%{3}"
                }
                updated
        }
@@ -57,13 +57,13 @@ mac-addr-regexp = ([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0
 rewrite_called_station_id {
        if (&Called-Station-Id =~ /^${policy.mac-addr-regexp}(:(.+))?$/i) {
                update request {
-                       Called-Station-Id := "%{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}"
+                       &Called-Station-Id := "%{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}"
                }
 
                # SSID component?
                if ("%{8}") {
                        update request {
-                               Called-Station-SSID := "%{8}"
+                               &Called-Station-SSID := "%{8}"
                        }
                }
                updated
@@ -80,7 +80,7 @@ rewrite_called_station_id {
 rewrite_calling_station_id {
        if (&Calling-Station-Id =~ /^${policy.mac-addr-regexp}$/i) {
                update request {
-                       Calling-Station-Id := "%{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}"
+                       &Calling-Station-Id := "%{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}"
                }
                updated
        }

diff --git a/raddb/policy.d/control b/raddb/policy.d/control
index b056ed106b45ca9e0e3cbf305d6bc0b301fa3fe6..d8bada512f33f7e7d722991830a134f928fdda27 100644 (file)
--- a/raddb/policy.d/control
+++ b/raddb/policy.d/control
@@ -4,7 +4,7 @@
 #
 do_not_respond {
        update control {
-               Response-Packet-Type := Do-Not-Respond
+               &Response-Packet-Type := Do-Not-Respond
        }
 
        handled
@@ -17,6 +17,6 @@ do_not_respond {
 #
 accept.authorize {
        update control {
-               Auth-Type := accept
+               &Auth-Type := accept
        }
 }

diff --git a/raddb/policy.d/cui b/raddb/policy.d/cui
index 6a6c1acf57599f5bc25a5390cb0d51a0df6f01b7..08b2c91267ffff31ea3c2807ddf28f61d57e57f7 100644 (file)
--- a/raddb/policy.d/cui
+++ b/raddb/policy.d/cui
@@ -41,7 +41,7 @@ cui_require_operator_name = "no"
 cui.authorize {
        if ("%{client:add_cui}" == 'yes') {
                update request {
-                       Chargeable-User-Identity := 0x00
+                       &Chargeable-User-Identity := 0x00
                }
        }
 }
@@ -53,7 +53,7 @@ cui.authorize {
 cui.pre-proxy {
        if (("%{request:Packet-Type}" == 'Access-Request') && ("%{client:add_cui}" == 'yes')) {
                update proxy-request {
-                       Chargeable-User-Identity = 0x00
+                       &Chargeable-User-Identity = 0x00
                }
        }
 }
@@ -69,7 +69,7 @@ cui.post-auth {
        if (!&control:Proxy-To-Realm && &Chargeable-User-Identity && !&reply:Chargeable-User-Identity && \
            (&Operator-Name || ('${policy.cui_require_operator_name}' != 'yes')) ) {
                update reply {
-                       Chargeable-User-Identity = "%{sha1:${policy.cui_hash_key}%{tolower:%{User-Name}%{%{Operator-Name}:-}}}"
+                       &Chargeable-User-Identity = "%{sha1:${policy.cui_hash_key}%{tolower:%{User-Name}%{%{Operator-Name}:-}}}"
                }
        }
 
@@ -84,7 +84,7 @@ cui.post-auth {
        if (&reply:Chargeable-User-Identity) {
                # Force User-Name to be the User-Name from the request
                update {
-                       reply:User-Name := &request:User-Name
+                       &reply:User-Name := &request:User-Name
                }
                cuisql
        }
@@ -95,7 +95,7 @@ cui-inner.post-auth {
        if (&outer.request:Chargeable-User-Identity && \
            (&outer.request:Operator-Name || ('${policy.cui_require_operator_name}' != 'yes'))) {
                update reply {
-                       Chargeable-User-Identity := "%{sha1:${policy.cui_hash_key}%{tolower:%{User-Name}%{%{outer.request:Operator-Name}:-}}}"
+                       &Chargeable-User-Identity := "%{sha1:${policy.cui_hash_key}%{tolower:%{User-Name}%{%{outer.request:Operator-Name}:-}}}"
                }
        }
 }
@@ -113,7 +113,7 @@ cui.accounting {
        #
        if (!&Chargeable-User-Identity) {
                update request {
-                       Chargeable-User-Identity := "%{cuisql:\
+                       &Chargeable-User-Identity := "%{cuisql:\
                                SELECT cui FROM cui \
                                WHERE clientipaddress = '%{%{Packet-Src-IPv6-Address}:-%{Packet-Src-IP-Address}}' \
                                AND callingstationid = '%{Calling-Station-Id}' \

diff --git a/raddb/policy.d/dhcp b/raddb/policy.d/dhcp
index 4396f062570e6087a3fc7e7642218b900e63f68a..8ed03a664c6dc4a10cf9da0335cf79bbce6dff20 100644 (file)
--- a/raddb/policy.d/dhcp
+++ b/raddb/policy.d/dhcp
@@ -5,10 +5,10 @@ dhcp_sqlippool.post-auth {
        #  Do some minor hacks to the request so that it looks
        #  like a RADIUS request to the SQL IP Pool module.
        update request {
-               User-Name = "DHCP-%{DHCP-Client-Hardware-Address}"
-               Calling-Station-Id = "%{DHCP-Client-Hardware-Address}"
-               NAS-IP-Address = "%{%{DHCP-Gateway-IP-Address}:-127.0.0.1}"
-               Acct-Status-Type = Start
+               &User-Name = "DHCP-%{DHCP-Client-Hardware-Address}"
+               &Calling-Station-Id = "%{DHCP-Client-Hardware-Address}"
+               &NAS-IP-Address = "%{%{DHCP-Gateway-IP-Address}:-127.0.0.1}"
+               &Acct-Status-Type = Start
        }
 
        #  Call the actual module
@@ -18,7 +18,7 @@ dhcp_sqlippool.post-auth {
        #  actually allocated an address.
        if (ok) {
                update reply {
-                       DHCP-Your-IP-Address = "%{reply:Framed-IP-Address}"
+                       &DHCP-Your-IP-Address = "%{reply:Framed-IP-Address}"
                }
        }
 }

diff --git a/raddb/policy.d/eap b/raddb/policy.d/eap
index 0d35d76ce98c1e31a7314b3fac30253ce2c356f9..0718eab511759648d7b326a0c3f15c42fd73673f 100644 (file)
--- a/raddb/policy.d/eap
+++ b/raddb/policy.d/eap
@@ -9,13 +9,12 @@ Xeap.authorize {
                #
                if (&control:State) {
                        update control {
-                               Cache-TTL := 0
+                               &Cache-TTL := 0
                        }
                        cache_eap
 
                        update control {
-                               Cache-TTL !* ANY
-                               State !* ANY
+                               &State !* ANY
                        }
                }
 
@@ -76,7 +75,7 @@ permit_only_eap {
 remove_reply_message_if_eap {
        if (&reply:EAP-Message && &reply:Reply-Message) {
                update reply {
-                       Reply-Message !* ANY
+                       &Reply-Message !* ANY
                }
        }
        else {

diff --git a/raddb/policy.d/filter b/raddb/policy.d/filter
index 85b8e3242fd0bea15ea2baf42af31aaf90b592be..9a2e1460cc38e751212a70dc79e9ad587363b814 100644 (file)
--- a/raddb/policy.d/filter
+++ b/raddb/policy.d/filter
@@ -33,7 +33,7 @@ filter_username {
        #
        if (&User-Name =~ / /) {
                update reply {
-                       Reply-Message += "Rejected: Username contains whitespace"
+                       &Reply-Message += 'Rejected: Username contains whitespace'
                }
                reject
        }
@@ -44,7 +44,7 @@ filter_username {
        #
        if (&User-Name =~ /@.*@/ ) {
                update reply {
-                       Reply-Message += "Rejected: Multiple @ in username"
+                       &Reply-Message += 'Rejected: Multiple @ in username'
                }
                reject
        }
@@ -55,7 +55,7 @@ filter_username {
        #
        if (&User-Name =~ /\\.\\./ ) {
                update reply {
-                       Reply-Message += "Rejected: Username contains ..s"
+                       &Reply-Message += 'Rejected: Username contains ..s'
                }
                reject
        }
@@ -66,7 +66,7 @@ filter_username {
        #
        if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\\.(.+)$/))  {
                update reply {
-                       Reply-Message += "Rejected: Realm does not have at least one dot separator"
+                       &Reply-Message += 'Rejected: Realm does not have at least one dot separator'
                }
                reject
        }
@@ -77,7 +77,7 @@ filter_username {
        #
        if (&User-Name =~ /\\.$/)  {
                update reply {
-                       Reply-Message += "Rejected: Realm ends with a dot"
+                       &Reply-Message += 'Rejected: Realm ends with a dot'
                }
                reject
        }
@@ -88,7 +88,7 @@ filter_username {
        #
        if (&User-Name =~ /@\\./)  {
                update reply {
-                       Reply-Message += "Rejected: Realm begins with a dot"
+                       &Reply-Message += 'Rejected: Realm begins with a dot'
                }
                reject
        }

diff --git a/raddb/policy.d/operator-name b/raddb/policy.d/operator-name
index a16fa1ea8034c979318bf12e7e6da28daefbbdab..6d042d412546907435f0c5edbdb491d1df775810 100644 (file)
--- a/raddb/policy.d/operator-name
+++ b/raddb/policy.d/operator-name
@@ -28,7 +28,7 @@
 operator-name.authorize {
        if ("%{client:Operator-Name}") {
                update request {
-                       Operator-Name = "%{client:Operator-Name}"
+                       &Operator-Name = "%{client:Operator-Name}"
                }
        }
 }
@@ -40,7 +40,7 @@ operator-name.authorize {
 operator-name.pre-proxy {
        if (("%{request:Packet-Type}" == 'Access-Request') && "%{client:Operator-Name}") {
                update proxy-request {
-                       Operator-Name := "%{client:Operator-Name}"
+                       &Operator-Name := "%{client:Operator-Name}"
                }
        }
 }

diff --git a/raddb/sites-available/channel_bindings b/raddb/sites-available/channel_bindings
index 1252230314ccbc53059248ae53fa00527f31d26d..83843290aac1f463d213c4e8cd572ec946f73e0b 100644 (file)
--- a/raddb/sites-available/channel_bindings
+++ b/raddb/sites-available/channel_bindings
@@ -10,13 +10,13 @@ server channel_bindings {
 #  Only the "authorize" section is needed.
 #
 authorize {
-       if (GSS-Acceptor-Service-Name && (outer.request:GSS-Acceptor-Service-Name != GSS-Acceptor-Service-Name)) {
+       if (&GSS-Acceptor-Service-Name && (&outer.request:GSS-Acceptor-Service-Name != &GSS-Acceptor-Service-Name)) {
                reject
        }
 
-       if (GSS-Acceptor-Service-Name || GSS-Acceptor-Realm-Name || GSS-Acceptor-Host-Name) {
+       if (&GSS-Acceptor-Service-Name || &GSS-Acceptor-Realm-Name || &GSS-Acceptor-Host-Name) {
                update control {
-                       Chbind-Response-Code := success
+                       &Chbind-Response-Code := success
                }
 
                #
@@ -26,9 +26,9 @@ authorize {
                #  then they won't be copied to the reply.
                #
                update reply {
-                       GSS-Acceptor-Service-Name = &GSS-Acceptor-Service-Name
-                       GSS-Acceptor-Host-Name = &GSS-Acceptor-Host-Name
-                       GSS-Acceptor-Realm-Name = &GSS-Acceptor-Realm-Name
+                       &GSS-Acceptor-Service-Name = &GSS-Acceptor-Service-Name
+                       &GSS-Acceptor-Host-Name = &GSS-Acceptor-Host-Name
+                       &GSS-Acceptor-Realm-Name = &GSS-Acceptor-Realm-Name
                }
        }
 

diff --git a/raddb/sites-available/check-eap-tls b/raddb/sites-available/check-eap-tls
index d84378ffd3335a7baf0a42052db49d709e5e9866..ea2e81c162d551950492074be354579e3f363f88 100644 (file)
--- a/raddb/sites-available/check-eap-tls
+++ b/raddb/sites-available/check-eap-tls
@@ -34,7 +34,7 @@ authorize {
        # By default, we just accept the request:
        #
        update config {
-               Auth-Type := Accept
+               &Auth-Type := Accept
        }
 
 
@@ -42,17 +42,17 @@ authorize {
        # Check the client certificate matches a string, and reject otherwise
        #
 
-#      if ("%{TLS-Client-Cert-Common-Name}" == "client.example.com") {
+#      if ("%{TLS-Client-Cert-Common-Name}" == 'client.example.com') {
 #              update config {
-#                      Auth-Type := Accept
+#                      &Auth-Type := Accept
 #              }
 #      }
 #      else {
 #              update config {
-#                      Auth-Type := Reject
+#                      &Auth-Type := Reject
 #              }
 #              update reply {
-#                      Reply-Message := "Your certificate is not valid."
+#                      &Reply-Message := "Your certificate is not valid."
 #              }
 #      }
 
@@ -60,14 +60,14 @@ authorize {
        #
        # Check the client certificate common name against the supplied User-Name
        #
-#      if ("host/%{TLS-Client-Cert-Common-Name}" == "%{User-Name}") {
+#      if ("host/%{TLS-Client-Cert-Common-Name}" == &User-Name) {
 #              update config {
-#                      Auth-Type := Accept
+#                      &Auth-Type := Accept
 #              }
 #      }
 #      else {
 #              update config {
-#                      Auth-Type := Reject
+#                      &Auth-Type := Reject
 #              }
 #      }
 
@@ -96,7 +96,7 @@ authorize {
 
 #      if (!(Ldap-Group == "Permitted-Laptops")) {
 #              update config {
-#                      Auth-Type := Reject
+#                      &Auth-Type := Reject
 #              }
 #      }
 
@@ -124,8 +124,5 @@ authorize {
        auth_log
 
 }
-
-
-
 }
 

diff --git a/raddb/sites-available/dhcp b/raddb/sites-available/dhcp
index 170e2b191af7184b519d3594fa99476c857dfda5..fd2c8b269f956ef62ff684687d25c91888ea3bf7 100644 (file)
--- a/raddb/sites-available/dhcp
+++ b/raddb/sites-available/dhcp
@@ -127,12 +127,12 @@ dhcp DHCP-Discover {
 
        #  The contents here are invented.  Change them!
        update reply {
-               DHCP-Domain-Name-Server = 127.0.0.1
-               DHCP-Domain-Name-Server = 127.0.0.2
-               DHCP-Subnet-Mask = 255.255.255.0
-               DHCP-Router-Address = 192.0.2.1
-               DHCP-IP-Address-Lease-Time = 86400
-               DHCP-DHCP-Server-Identifier = 192.0.2.1
+               &DHCP-Domain-Name-Server = 127.0.0.1
+               &DHCP-Domain-Name-Server = 127.0.0.2
+               &DHCP-Subnet-Mask = 255.255.255.0
+               &DHCP-Router-Address = 192.0.2.1
+               &DHCP-IP-Address-Lease-Time = 86400
+               &DHCP-DHCP-Server-Identifier = 192.0.2.1
        }
 
        #  Do a simple mapping of MAC to assigned IP.
@@ -152,7 +152,7 @@ dhcp DHCP-Discover {
        #  Or, allocate IPs from the DHCP pool in SQL. You may need to
        #  set the pool name here if you haven't set it elsewhere.
 #      update control {
-#              Pool-Name := "local"
+#              &Pool-Name := "local"
 #      }
 #      dhcp_sqlippool
 
@@ -168,17 +168,17 @@ dhcp DHCP-Request {
 
        # Response packet type. See DHCP-Discover section above.
        update reply {
-              DHCP-Message-Type = DHCP-Ack
+              &DHCP-Message-Type = DHCP-Ack
        }
 
        #  The contents here are invented.  Change them!
        update reply {
-               DHCP-Domain-Name-Server = 127.0.0.1
-               DHCP-Domain-Name-Server = 127.0.0.2
-               DHCP-Subnet-Mask = 255.255.255.0
-               DHCP-Router-Address = 192.0.2.1
-               DHCP-IP-Address-Lease-Time = 86400
-               DHCP-DHCP-Server-Identifier = 192.0.2.1
+               &DHCP-Domain-Name-Server = 127.0.0.1
+               &DHCP-Domain-Name-Server = 127.0.0.2
+               &DHCP-Subnet-Mask = 255.255.255.0
+               &DHCP-Router-Address = 192.0.2.1
+               &DHCP-IP-Address-Lease-Time = 86400
+               &DHCP-DHCP-Server-Identifier = 192.0.2.1
        }
 
        #  Do a simple mapping of MAC to assigned IP.
@@ -198,7 +198,7 @@ dhcp DHCP-Request {
        #  Or, allocate IPs from the DHCP pool in SQL. You may need to
        #  set the pool name here if you haven't set it elsewhere.
 #      update control {
-#              Pool-Name := "local"
+#              &Pool-Name := "local"
 #      }
 #      dhcp_sqlippool
 
@@ -220,21 +220,21 @@ dhcp DHCP-Request {
 
 dhcp DHCP-Decline {
        update reply {
-              DHCP-Message-Type = DHCP-Do-Not-Respond
+              &DHCP-Message-Type = DHCP-Do-Not-Respond
        }
        reject
 }
 
 dhcp DHCP-Inform {
        update reply {
-              DHCP-Message-Type = DHCP-Do-Not-Respond
+              &DHCP-Message-Type = DHCP-Do-Not-Respond
        }
        reject
 }
 
 dhcp DHCP-Release {
        update reply {
-              DHCP-Message-Type = DHCP-Do-Not-Respond
+              &DHCP-Message-Type = DHCP-Do-Not-Respond
        }
        reject
 }

diff --git a/raddb/sites-available/dhcp.relay b/raddb/sites-available/dhcp.relay
index 737cc5d5d69096c44efac181f93d8a4475c869a0..76d1e1003437f08b95a560711836c135a69ba763 100644 (file)
--- a/raddb/sites-available/dhcp.relay
+++ b/raddb/sites-available/dhcp.relay
@@ -22,11 +22,11 @@ server dhcp.eth1 {
        dhcp DHCP-Discover {
                update config {
                        # IP Address of the DHCP server
-                       DHCP-Relay-To-IP-Address := 192.0.2.2
+                       &DHCP-Relay-To-IP-Address := 192.0.2.2
                }
                update request {
                        # IP Address of the DHCP relay (ourselves)
-                       DHCP-Gateway-IP-Address := 192.0.2.1
+                       &DHCP-Gateway-IP-Address := 192.0.2.1
                }
                ok
        }
@@ -34,10 +34,10 @@ server dhcp.eth1 {
        dhcp DHCP-Request {
                update config {
                        # IP Address of the DHCP server
-                       DHCP-Relay-To-IP-Address := 192.0.2.2
+                       &DHCP-Relay-To-IP-Address := 192.0.2.2
                }
                update request {
-                       DHCP-Gateway-IP-Address := 192.0.2.2
+                       &DHCP-Gateway-IP-Address := 192.0.2.2
                }
                ok
        }

diff --git a/raddb/sites-available/dynamic-clients b/raddb/sites-available/dynamic-clients
index cdfa6175a9617bcd081b0b69f2c9340c3adaa56e..4bbcb675b695c5361c4f25f6bf081275a229a9a1 100644 (file)
--- a/raddb/sites-available/dynamic-clients
+++ b/raddb/sites-available/dynamic-clients
@@ -110,19 +110,19 @@ server dynamic_clients {
 
                        #
                        #  Echo the IP address of the client.
-                       FreeRADIUS-Client-IP-Address = "%{Packet-Src-IP-Address}"
+                       &FreeRADIUS-Client-IP-Address = "%{Packet-Src-IP-Address}"
 
                        # require_message_authenticator
-                       FreeRADIUS-Client-Require-MA = no
+                       &FreeRADIUS-Client-Require-MA = no
 
                        # secret
-                       FreeRADIUS-Client-Secret = "testing123"
+                       &FreeRADIUS-Client-Secret = "testing123"
 
                        # shortname
-                       FreeRADIUS-Client-Shortname = "%{Packet-Src-IP-Address}"
+                       &FreeRADIUS-Client-Shortname = "%{Packet-Src-IP-Address}"
 
                        # nas_type
-                       FreeRADIUS-Client-NAS-Type = "other"
+                       &FreeRADIUS-Client-NAS-Type = "other"
 
                        # virtual_server
                        #
@@ -134,7 +134,7 @@ server dynamic_clients {
                        #  virtual_server defined, then that is used,
                        #  and there is no need to define this attribute.
                        #
-                       FreeRADIUS-Client-Virtual-Server = "something"
+                       &FreeRADIUS-Client-Virtual-Server = "something"
 
                }
 
@@ -159,18 +159,18 @@ server dynamic_clients {
                        update control {
                                #
                                #  Echo the IP.
-                               FreeRADIUS-Client-IP-Address = "%{Packet-Src-IP-Address}"
+                               &FreeRADIUS-Client-IP-Address = "%{Packet-Src-IP-Address}"
 
                                #
                                #  Do multiple SELECT statements to grab
                                #  the various definitions.
-                               FreeRADIUS-Client-Shortname = "%{sql: SELECT shortname FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}"
+                               &FreeRADIUS-Client-Shortname = "%{sql: SELECT shortname FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}"
 
-                               FreeRADIUS-Client-Secret = "%{sql: SELECT secret FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}"
+                               &FreeRADIUS-Client-Secret = "%{sql: SELECT secret FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}"
 
-                               FreeRADIUS-Client-NAS-Type = "%{sql: SELECT type FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}"
+                               &FreeRADIUS-Client-NAS-Type = "%{sql: SELECT type FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}"
 
-                               FreeRADIUS-Client-Virtual-Server = "%{sql: SELECT server FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}"
+                               &FreeRADIUS-Client-Virtual-Server = "%{sql: SELECT server FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}"
                        }
 
                }
@@ -200,17 +200,17 @@ server dynamic_clients {
                # for the NAS element. ie "password"
                if ("%{ldap:ldap:///OU=Elements,OU=Radius,DC=ACME,DC=COM?ou?sub?cn=%{Packet-Src-IP-Address}}") {
                        update control {
-                              FreeRADIUS-Client-IP-Address = "%{Packet-Src-IP-Address}"
+                               &FreeRADIUS-Client-IP-Address = "%{Packet-Src-IP-Address}"
 
                                # Set the Client-Shortname to be the Location
                                # "l" just like in the Huntgroups, but this
                                # time to the shortname.
 
-                               FreeRADIUS-Client-Shortname = "%{ldap:ldap:///OU=Elements,OU=Radius,DC=ACME,DC=COM?l?sub?cn=%{Packet-Src-IP-Address}}"
+                               &FreeRADIUS-Client-Shortname = "%{ldap:ldap:///OU=Elements,OU=Radius,DC=ACME,DC=COM?l?sub?cn=%{Packet-Src-IP-Address}}"
 
                                # Lookup and set the Shared Secret based on
                                # the "ou" attribute.
-                               FreeRADIUS-Client-Secret = "%{ldap:ldap:///OU=Elements,OU=Radius,DC=ACME,DC=COM?ou?sub?cn=%{Packet-Src-IP-Address}}"
+                               &FreeRADIUS-Client-Secret = "%{ldap:ldap:///OU=Elements,OU=Radius,DC=ACME,DC=COM?ou?sub?cn=%{Packet-Src-IP-Address}}"
                        }
                }
 

diff --git a/raddb/sites-available/example b/raddb/sites-available/example
index e58e24319d6320a0a0d56fd649d937bf95156739..5f204aaa6fc87e487b8542e1e4781623ff7f4a73 100644 (file)
--- a/raddb/sites-available/example
+++ b/raddb/sites-available/example
@@ -92,9 +92,9 @@ server example {
                #
                #  Some example policies.  See "man unlang" for more.
                #
-               if ("%{User-Name}" == "bob") {
+               if (&User-Name == 'bob') {
                        update control {
-                               Cleartext-Password := "bob"
+                               &Cleartext-Password := 'bob'
                        }
                }
 
@@ -114,7 +114,7 @@ server example {
 
                Post-Auth-Type Reject {
                        update reply {
-                               Reply-Message = "This is only an example."
+                               &Reply-Message = 'This is only an example.'
                        }
                }
        }

diff --git a/raddb/sites-available/originate-coa b/raddb/sites-available/originate-coa
index 539001dec8fd0285a0d6f2591514417ea453d644..a644a17a02d7f43af4ccbcb1e8477ea741371e20 100644 (file)
--- a/raddb/sites-available/originate-coa
+++ b/raddb/sites-available/originate-coa
@@ -25,9 +25,9 @@
 #  "coa" list:
 #
 #      update coa {
-#             User-Name = "%{User-Name}"
-#             Acct-Session-Id = "%{Acct-Session-Id}"
-#             NAS-IP-Address = "%{NAS-IP-Address}"
+#             &User-Name = "%{User-Name}"
+#             &Acct-Session-Id = "%{Acct-Session-Id}"
+#             &NAS-IP-Address = "%{NAS-IP-Address}"
 #      }
 #
 #  And the CoA packet will be sent.  You can also send Disconnect
@@ -45,7 +45,7 @@
 #  CoA packet:
 #
 #      update control {
-#              Send-CoA-Request = No
+#              &Send-CoA-Request = No
 #      }
 #
 #  The default destination of a CoA packet is the NAS (or client)
@@ -135,7 +135,7 @@ home_server_pool coa {
 server originate-coa.example.com {
   pre-proxy {
        update proxy-request {
-               NAS-IP-Address = 127.0.0.1
+               &NAS-IP-Address = 127.0.0.1
        }
   }
 

diff --git a/raddb/sites-available/proxy-inner-tunnel b/raddb/sites-available/proxy-inner-tunnel
index 1ce4137d5f93ff65a92ebaac676690cc718846ad..938d954592d3824e4d51e3315d0f7e0b5cfde824 100644 (file)
--- a/raddb/sites-available/proxy-inner-tunnel
+++ b/raddb/sites-available/proxy-inner-tunnel
@@ -24,7 +24,7 @@ authorize {
 
        update control {
                #  You should update this to be one of your realms.
-               Proxy-To-Realm := "example.com"
+               &Proxy-To-Realm := "example.com"
        }
 }
 

diff --git a/raddb/sites-available/robust-proxy-accounting b/raddb/sites-available/robust-proxy-accounting
index 9bf86978db676ef16f6062f4d359385e291cc930..d21680b2299e1c991d0fa83255b6d907a415cbdd 100644 (file)
--- a/raddb/sites-available/robust-proxy-accounting
+++ b/raddb/sites-available/robust-proxy-accounting
@@ -160,7 +160,7 @@ server home.example.com {
                # You may want accounting policies here...
 
                update control {
-                       Proxy-To-Realm := "acct_realm.example.com"
+                       &Proxy-To-Realm := "acct_realm.example.com"
                }
        }
 

diff --git a/raddb/sites-available/soh b/raddb/sites-available/soh
index 9196e5b3d3dad5849a9daa6fef0d441d0d724635..b6ced3550115a24f3e32c5cd357aec62e4d2aaaa 100644 (file)
--- a/raddb/sites-available/soh
+++ b/raddb/sites-available/soh
@@ -10,22 +10,22 @@ server soh-server {
                if (SoH-Supported == no) {
                        # client NAKed our request for SoH - not supported, or turned off
                        update config {
-                               Auth-Type = Accept
+                               &Auth-Type = Accept
                        }
                }
                else {
                        # client replied; check something - this is a local policy issue!
                        if (SoH-MS-Windows-Health-Status =~ /antivirus (warn|error) /) {
                                update config {
-                                       Auth-Type = Reject
+                                       &Auth-Type = Reject
                                }
                                update reply {
-                                       Reply-Message = "You must have antivirus enabled & installed!"
+                                       &Reply-Message = "You must have antivirus enabled & installed!"
                                }
                        }
                        else {
                                update config {
-                                       Auth-Type = Accept
+                                       &Auth-Type = Accept
                                }
                        }
                }

diff --git a/raddb/sites-available/vmps b/raddb/sites-available/vmps
index 8703902cafb5cc2b869dc42da9f554da313825ad..c5c50786f4f5563d27218c70bf98c3898f47e5ba 100644 (file)
--- a/raddb/sites-available/vmps
+++ b/raddb/sites-available/vmps
@@ -51,15 +51,15 @@ server vmps {
                #
                #  Some requests may not have a MAC address.  Try to
                #  create one using other attributes.
-               if (!VMPS-Mac) {
-                       if (VMPS-Ethernet-Frame =~ /0x.{12}(..)(..)(..)(..)(..)(..).*/) {
+               if (!&VMPS-Mac) {
+                       if (&VMPS-Ethernet-Frame =~ /0x.{12}(..)(..)(..)(..)(..)(..).*/) {
                                update request {
-                                       VMPS-Mac = "%{1}:%{2}:%{3}:%{4}:%{5}:%{6}"
+                                       &VMPS-Mac = "%{1}:%{2}:%{3}:%{4}:%{5}:%{6}"
                                }
                        }
                        else {
                                update request {
-                                       VMPS-Mac = "%{VMPS-Cookie}"
+                                       &VMPS-Mac = &VMPS-Cookie
                                }
                        }
                }
@@ -73,23 +73,23 @@ server vmps {
 
                # required VMPS reply attributes
                update reply {
-                       VMPS-Packet-Type = VMPS-Join-Response
-                       VMPS-Cookie = "%{VMPS-Mac}"
+                       &VMPS-Packet-Type = VMPS-Join-Response
+                       &VMPS-Cookie = &VMPS-Mac
 
-                       VMPS-VLAN-Name = "please_use_real_vlan_here"
+                       &VMPS-VLAN-Name = "please_use_real_vlan_here"
 
                        #
                        #  If you have VLAN's in a database, you can select
                        #  the VLAN name based on the MAC address.
                        #
-                       #VMPS-VLAN-Name = "%{sql:select ... where mac='%{VMPS-Mac}'}"
+                       #&VMPS-VLAN-Name = "%{sql:select ... where mac='%{VMPS-Mac}'}"
                }
 
                # correct reply packet type for reconfirmation requests
                #
-               if (VMPS-Packet-Type == VMPS-Reconfirm-Request){
+               if (&VMPS-Packet-Type == VMPS-Reconfirm-Request){
                        update reply {
-                               VMPS-Packet-Type := VMPS-Reconfirm-Response
+                               &VMPS-Packet-Type := VMPS-Reconfirm-Response
                        }
                }
        }