*** the module decides it has everything it needs to do authentication so sets `&control:Auth-Type = pap`
*** as RADIUS attributes were changed, it returns `updated` as a result code to unlang
. the authenticate section runs and hands off to `pap` as `&control:Auth-Type = pap` was set earlier
- ** `&control:Cleartext-Password` is compared to `&request:User-Password`
+ ** `&control:Cleartext-Password` is compared to `&request.User-Password`
** matches so `ok` is returned
. we return `Access-Accept` as `ok` was returned to unlang
All certificate attributes are available in the `&session-state:`
list, immediately after they are parsed from their ASN1 form.
-The certificates are no longer added to the `&request:` list. Instead,
+The certificates are no longer added to the `&request.` list. Instead,
they are added to the `session-state` list. You are advised to update
any references during the upgrade to 4.0:
=== rlm_rest
-`REST-HTTP-Code` is now inserted into the `&request:` list instead
+`REST-HTTP-Code` is now inserted into the `&request.` list instead
of the `&reply:` list, to be compliant with the
http://wiki.freeradius.org/guide/List-Usage[list usage] guidelines.
add_stats::
If `yes` the following attributes will be added to the request:
- * `&request:Cache-Entry-Hits` - The number of times this entry
+ * `&request.Cache-Entry-Hits` - The number of times this entry
has been retrieved.
NOTE: Not supported by the `rlm_cache_memcached` module.
ttl = 15
update reply {
&reply: += &reply:
- &control:State := &request:State
+ &control:State := &request.State
}
}
```
&DHCP-Relay-Remote-Id := 0x010203040506
}
update request {
- &Tmp-Octets-0 := "%{dhcpv4_encode:&request:[*]}"
+ &Tmp-Octets-0 := "%{dhcpv4_encode:&request.[*]}"
}
if (&Tmp-Octets-0 != 0x520d0103abcdef0206010203040506) {
update reply {
.Example
```
-%{json_encode:&request:[*] !&User-Password}
+%{json_encode:&request.[*] !&User-Password}
```
In another (contrived) example, all the attributes in the RADIUS request will
.Example
```
-%{json_encode:&request:[*] !&reply:[*] &control:User-Name}
+%{json_encode:&request.[*] !&reply:[*] &control:User-Name}
```
#### Output format modes
* Attributes marked as `=` are added to the `&reply:` list,
instead of default `&control:` list.
- * Attributes marked as `~` are added to the `&request:` list.
+ * Attributes marked as `~` are added to the `&request.` list.
* Field marked as `,` may contain a comma separated list of attributes.
split:: If true, the authorize method of `rlm_yubikey` will attempt to split the
value of `link:https://freeradius.org/rfc/rfc2865.html#User-Password[User-Password]`, into the user's password, and the OTP token.
-NOTE: If enabled and successful, the value of `&request:User-Password` will be
-truncated and `&request:Yubikey-OTP` will be added.
+NOTE: If enabled and successful, the value of `&request.User-Password` will be
+truncated and `&request.Yubikey-OTP` will be added.
[options="header,autowidth"]
|===
| Attributes | Description
-| `&request:Yubikey-Public-ID` | The public portion of the OTP string.
+| `&request.Yubikey-Public-ID` | The public portion of the OTP string.
The value is a `id_len` modhex string.
|===
[options="header,autowidth"]
|===
| Attributes | Description
-| `&request:Yubikey-OTP` | The OTP portion of `link:https://freeradius.org/rfc/rfc2865.html#User-Password[User-Password]`.
+| `&request.Yubikey-OTP` | The OTP portion of `link:https://freeradius.org/rfc/rfc2865.html#User-Password[User-Password]`.
|===
These attributes are available after authentication (if successful):
[options="header,autowidth"]
|===
| Attributes | Description
-| `&request:Yubikey-Private-ID` | The encrypted ID included in OTP data,
+| `&request.Yubikey-Private-ID` | The encrypted ID included in OTP data,
should be verified for increased security.
The value is a `6-byte` binary blob.
-| `&request:Yubikey-Counter` | The last counter value (should be recorded).
+| `&request.Yubikey-Counter` | The last counter value (should be recorded).
The value is a concatenation of the 16-bit
session count & `8-bit` use count which form a
`24-bit` monotonically strictly increasing
integer (until the individual count ceilings
are hit)
-| `&request:Yubikey-Timestamp` | Token's internal clock (mainly useful for debugging).
+| `&request.Yubikey-Timestamp` | Token's internal clock (mainly useful for debugging).
The value is a 24-bit increasing `integer @ 8 Hz`
with rollover which is randomly initialized each session.
-| `&request:Yubikey-Random` | Randomly generated value from the token.
+| `&request.Yubikey-Random` | Randomly generated value from the token.
The value is a 16-bit integer.
|===
}
subrequest CoA-Request {
update request {
- &request := &parent.request:[*]
+ &request := &parent.request.[*]
&Acct-Session-Id := &parent.control:Tmp-String-1
&Event-Timestamp := "%l"
&Message-Authenticator := 0x00
Individual attributes from the outer request may be
accessed with:
- &outer.request
:<attribute>
+ &outer.request
.<attribute>
The following policy in raddb/policy.d/eap can be used
to copy attributes over.
-sql
attr_filter.access_reject
update outer.session-state {
- &Module-Failure-Message := &request:Module-Failure-Message
+ &Module-Failure-Message := &request.Module-Failure-Message
}
}
} # inner-tunnel server block
A request will be generated with the following attributes:
-- &request:LDAP-Sync-DN the base_dn of the sync.
-- &request:LDAP-Sync-Filter the filter of the sync (optional).
-- &request:LDAP-Sync-Scope the scope of the sync (optional).
-- &request:LDAP-Sync-attr the attributes returned by the sync (optional).
+- &request.LDAP-Sync-DN the base_dn of the sync.
+- &request.LDAP-Sync-Filter the filter of the sync (optional).
+- &request.LDAP-Sync-Scope the scope of the sync (optional).
+- &request.LDAP-Sync-attr the attributes returned by the sync (optional).
You should use these attributes to uniquely identify the sync when retrieving
previous cookie values.
A request will be generated with the following attributes:
-- &request:LDAP-Sync-DN the base_dn of the sync.
-- &request:LDAP-Sync-Cookie the cookie value to store.
-- &request:LDAP-Sync-Filter the filter of the sync (optional).
-- &request:LDAP-Sync-Scope the scope of the sync (optional).
-- &request:LDAP-Sync-attr the attributes returned by the sync (optional).
+- &request.LDAP-Sync-DN the base_dn of the sync.
+- &request.LDAP-Sync-Cookie the cookie value to store.
+- &request.LDAP-Sync-Filter the filter of the sync (optional).
+- &request.LDAP-Sync-Scope the scope of the sync (optional).
+- &request.LDAP-Sync-attr the attributes returned by the sync (optional).
The return code of this section is ignored.
A request will be generated with the following attributes:
-- &request:LDAP-Sync-DN the base_dn of the sync.
-- &request:LDAP-Sync-Entry-UUID the UUID of the object.
-- &request:LDAP-Sync-Entry-DN the DN of the object that was added.
+- &request.LDAP-Sync-DN the base_dn of the sync.
+- &request.LDAP-Sync-Entry-UUID the UUID of the object.
+- &request.LDAP-Sync-Entry-DN the DN of the object that was added.
- &*:* attributes mapped from the LDAP entry to FreeRADIUS
attributes using the update section within the sync.
-- &request:LDAP-Sync-Filter the filter of the sync (optional).
-- &request:LDAP-Sync-Scope the scope of the sync (optional).
-- &request:LDAP-Sync-attr the attributes returned by the sync (optional).
+- &request.LDAP-Sync-Filter the filter of the sync (optional).
+- &request.LDAP-Sync-Scope the scope of the sync (optional).
+- &request.LDAP-Sync-attr the attributes returned by the sync (optional).
The return code of this section is ignored (for now).
A request will be generated with the following attributes:
-- &request:LDAP-Sync-DN the base_dn of the sync.
-- &request:LDAP-Sync-Entry-UUID the UUID of the object.
-- &request:LDAP-Sync-Entry-DN the DN of the object that was added.
+- &request.LDAP-Sync-DN the base_dn of the sync.
+- &request.LDAP-Sync-Entry-UUID the UUID of the object.
+- &request.LDAP-Sync-Entry-DN the DN of the object that was added.
- &*:* attributes mapped from the LDAP entry to FreeRADIUS
attributes using the update section within the sync.
-- &request:LDAP-Sync-Filter the filter of the sync (optional).
-- &request:LDAP-Sync-Scope the scope of the sync (optional).
-- &request:LDAP-Sync-attr the attributes returned by the sync (optional).
+- &request.LDAP-Sync-Filter the filter of the sync (optional).
+- &request.LDAP-Sync-Scope the scope of the sync (optional).
+- &request.LDAP-Sync-attr the attributes returned by the sync (optional).
The return code of this section is ignored (for now).
A request will be generated with the following attributes:
-- &request:LDAP-Sync-DN the base_dn of the sync.
-- &request:LDAP-Sync-Entry-UUID the UUID of the object.
-- &request:LDAP-Sync-Entry-DN the DN of the object that was added (optional).
-- &request:LDAP-Sync-Filter the filter of the sync (optional).
-- &request:LDAP-Sync-Scope the scope of the sync (optional).
-- &request:LDAP-Sync-attr the attributes returned by the sync (optional).
+- &request.LDAP-Sync-DN the base_dn of the sync.
+- &request.LDAP-Sync-Entry-UUID the UUID of the object.
+- &request.LDAP-Sync-Entry-DN the DN of the object that was added (optional).
+- &request.LDAP-Sync-Filter the filter of the sync (optional).
+- &request.LDAP-Sync-Scope the scope of the sync (optional).
+- &request.LDAP-Sync-attr the attributes returned by the sync (optional).
The return code of this section is ignored (for now).
# User-Name
# Acct-Session-Id
# subrequest Disconnect-Request {
-# &User-Name = &parent.request:User-Name
-# &Acct-Session-Id = &parent.request:Acct-Session-Id
+# &User-Name = &parent.request.User-Name
+# &Acct-Session-Id = &parent.request.Acct-Session-Id
# &NAS-IP-Address = &parent.NAS-IP-Address}
# ...
# }
recv Accounting-Request {
subrequest Disconnect-Request {
update request {
- &User-Name := &parent.request:User-Name
- &Acct-Session-Id := &parent.request:Acct-Session-Id
- &NAS-Identifier := &parent.request:NAS-Identifier
- &NAS-IP-Address := &parent.request:NAS-IP-Addres
- &NAS-IPv6-Address := &parent.request:NAS-IPv6-Address
- &NAS-Port := &parent.request:NAS-Port
- &Framed-IP-Address := &parent.request:Framed-IP-Address
+ &User-Name := &parent.request.User-Name
+ &Acct-Session-Id := &parent.request.Acct-Session-Id
+ &NAS-Identifier := &parent.request.NAS-Identifier
+ &NAS-IP-Address := &parent.request.NAS-IP-Addres
+ &NAS-IPv6-Address := &parent.request.NAS-IPv6-Address
+ &NAS-Port := &parent.request.NAS-Port
+ &Framed-IP-Address := &parent.request.Framed-IP-Address
}
radius.coa
}
Create an unlang version of "suffix" that splits an incoming `&User-Name` into
two components on the "@" separator.
-The first component should be written to the `&request:Stripped-User-Name`
+The first component should be written to the `&request.Stripped-User-Name`
attribute and the second component should be written to the
`&control:Stripped-User-Domain` attribute.
----
subrequest Disconnect-Request {
update request {
- &User-Name := &parent.request:User-Name
- &NAS-IP-Address := &parent.request:NAS-IP-Address
- &NAS-Port := &parent.request:NAS-Port
- &Acct-Session-Id := &parent.request:Acct-Session-Id
+ &User-Name := &parent.request.User-Name
+ &NAS-IP-Address := &parent.request.NAS-IP-Address
+ &NAS-Port := &parent.request.NAS-Port
+ &Acct-Session-Id := &parent.request.Acct-Session-Id
}
detach
----
subrequest Disconnect-Request {
update request {
- &User-Name := &parent.request:User-Name
- &NAS-IP-Address := &parent.request:NAS-IP-Address
- &NAS-Port := &parent.request:NAS-Port
- &Acct-Session-Id := &parent.request:Acct-Session-Id
+ &User-Name := &parent.request.User-Name
+ &NAS-IP-Address := &parent.request.NAS-IP-Address
+ &NAS-Port := &parent.request.NAS-Port
+ &Acct-Session-Id := &parent.request.Acct-Session-Id
}
update control {
+
If the _<list>_ qualifier is omitted, then each entry inside of the
`filter` section *must* be prefixed with a list name. For example,
-`&request:User-Name ...`
+`&request.User-Name ...`
<server-attribute>:: The server attribute which is being filtered via the given
_<value>_.
The _<list>_ field sets the attribute list that will be filter. If
the _<list>_ qualifier is omitted, then each entry inside of the
`filter` section *must* be prefixed with a list name. For example,
-`&request:User-Name ...`
+`&request.User-Name ...`
Please see the xref:list.adoc[list] page for valid list names.
finishes, it is deleted, and is no longer accessible to the parent.
.Examples
-`&parent.request:User-Name` +
+`&parent.request.User-Name` +
`&parent.reply:Reply-Message` +
`&parent.parent.session-state:Filter-Id`
parallel empty {
group {
update request {
- &User-Name := "%{&parent.request:User-Name}@example.org"
+ &User-Name := "%{&parent.request.User-Name}@example.org"
&User-Password := "hello"
}
radius1
}
group {
update request {
- &User-Name := "%{&parent.request:User-Name}@example.com"
- &User-Password := &parent.request:User-Password
+ &User-Name := "%{&parent.request.User-Name}@example.com"
+ &User-Password := &parent.request.User-Password
}
radius2
}
----
subrequest Disconnect-Request {
update request {
- &User-Name := &parent.request:User-Name
- &NAS-IP-Address := &parent.request:NAS-IP-Address
- &NAS-Port := &parent.request:NAS-Port
- &Acct-Session-Id := &parent.request:Acct-Session-Id
+ &User-Name := &parent.request.User-Name
+ &NAS-IP-Address := &parent.request.NAS-IP-Address
+ &NAS-Port := &parent.request.NAS-Port
+ &Acct-Session-Id := &parent.request.Acct-Session-Id
}
radius
----
subrequest dhcpv4.DHCP-Discover {
update request {
- &DHCP-Your-IP-Address := &parent.request:Framed-IP-Address
+ &DHCP-Your-IP-Address := &parent.request.Framed-IP-Address
...
}
----
subrequest Disconnect-Request {
update request {
- &User-Name := &parent.request:User-Name
- &NAS-IP-Address := &parent.request:NAS-IP-Address
- &NAS-Port := &parent.request:NAS-Port
- &Acct-Session-Id := &parent.request:Acct-Session-Id
+ &User-Name := &parent.request.User-Name
+ &NAS-IP-Address := &parent.request.NAS-IP-Address
+ &NAS-Port := &parent.request.NAS-Port
+ &Acct-Session-Id := &parent.request.Acct-Session-Id
}
detach
+
If the _<list>_ qualifier is omitted, then each entry inside of the
`update` section *must* be prefixed with a list name. For example,
-`&request:User-Name ...`
+`&request.User-Name ...`
<server-attribute>:: The server attribute which is assigned the
_<value>_.
The _<list>_ field sets the attribute list that will be updated. If
the _<list>_ qualifier is omitted, then each entry inside of the
`update` section *must* be prefixed with a list name. For example,
-`&request:User-Name ...`
+`&request.User-Name ...`
Please see the xref:list.adoc[list] page for valid list names.
[source,unlang]
----
recv Access-Request {
- if (&request:User-Name == "bob") {
+ if (&request.User-Name == "bob") {
"%{debug:4}"
} else {
"%{debug:0}"
```
...
(0) recv Access-Request {
-(0) if (&request:User-Name == "bob") {
+(0) if (&request.User-Name == "bob") {
(0) EXPAND %{debug:4}
(0) --> 2
-(0) } # if (&request:User-Name == "bob") (...)
+(0) } # if (&request.User-Name == "bob") (...)
(0) filter_username {
(0) if (&State) {
(0) ...
[source,unlang]
----
recv Access-Request {
- if (&request:User-Name == "bob") {
- "%{debug_attr:request:[*]}"
+ if (&request.User-Name == "bob") {
+ "%{debug_attr:request.[*]}"
}
...
}
```
...
(0) recv Access-Request {
-(0) if (&request:User-Name == "bob") {
-(0) Attributes matching "request:[*]"
-(0) &request:User-Name = bob
-(0) &request:User-Password = hello
-(0) &request:NAS-IP-Address = 127.0.1.1
-(0) &request:NAS-Port = 1
-(0) &request:Message-Authenticator = 0x9210ee447a9f4c522f5300eb8fc15e14
-(0) EXPAND %{debug_attr:request:[*]}
-(0) } # if (&request:User-Name == "bob") (...)
+(0) if (&request.User-Name == "bob") {
+(0) Attributes matching "request.[*]"
+(0) &request.User-Name = bob
+(0) &request.User-Password = hello
+(0) &request.NAS-IP-Address = 127.0.1.1
+(0) &request.NAS-Port = 1
+(0) &request.Message-Authenticator = 0x9210ee447a9f4c522f5300eb8fc15e14
+(0) EXPAND %{debug_attr:request.[*]}
+(0) } # if (&request.User-Name == "bob") (...)
...
```
.br
update request {
.br
- &User-Name = &parent.request:User-Name
+ &User-Name = &parent.request.User-Name
.br
...
.br
.DS
User-Name
.br
- request:User-Name # same as above
+ request.User-Name # same as above
.br
reply:User-Name
.br
.br
Cisco-AVPAir[2]
.br
- outer.request:User-Name # from inside of a TTLS/PEAP tunnel
+ outer.request.User-Name # from inside of a TTLS/PEAP tunnel
.DE
Note that unlike C, there is no way to define new attributes at
run-time. They MUST be declared in a dictionary file, and loaded when
.IP %{pairs:<list_or_attr>}
Serialize attributes as comma-delimited string
-e.g. "%{pairs:request:}" == "User-Name = 'foo', User-Password = 'bar', ..."
+e.g. "%{pairs:request.}" == "User-Name = 'foo', User-Password = 'bar', ..."
.IP %{base64:<string>}
Encode string as base64.
When the value is an an attribute reference, it must take the form of
"&Attribute-Name". The leading "&" signifies that the value is a
reference. The "Attribute-Name" is an attribute name, such as
-"User-Name" or "request:User-Name". When an attribute reference is
+"User-Name" or "request.User-Name". When an attribute reference is
used, both attributes must have the same data type. For example,
"User-Name := &NAS-Port" is invalid, because "User-Name" is a string,
and "NAS-Port" is an integer.
# add_stats::
#
# If `yes` the following attributes will be added to the request:
- # * `&request:Cache-Entry-Hits` - The number of times this entry
+ # * `&request.Cache-Entry-Hits` - The number of times this entry
# has been retrieved.
#
# NOTE: Not supported by the `rlm_cache_memcached` module.
#
update reply {
&reply: += &reply:
- &control:State := &request:State
+ &control:State := &request.State
}
}
# &DHCP-Relay-Remote-Id := 0x010203040506
# }
# update request {
-# &Tmp-Octets-0 := "%{dhcpv4_encode:&request:[*]}"
+# &Tmp-Octets-0 := "%{dhcpv4_encode:&request.[*]}"
# }
# if (&Tmp-Octets-0 != 0x520d0103abcdef0206010203040506) {
# update reply {
# .Example
#
# ```
-# %{json_encode:&request:[*] !&User-Password}
+# %{json_encode:&request.[*] !&User-Password}
# ```
#
# In another (contrived) example, all the attributes in the RADIUS request will
# .Example
#
# ```
-# %{json_encode:&request:[*] !&reply:[*] &control:User-Name}
+# %{json_encode:&request.[*] !&reply:[*] &control:User-Name}
# ```
#
# #### Output format modes
# * Attributes marked as `=` are added to the `&reply:` list,
# instead of default `&control:` list.
#
- # * Attributes marked as `~` are added to the `&request:` list.
+ # * Attributes marked as `~` are added to the `&request.` list.
#
# * Field marked as `,` may contain a comma separated list of attributes.
#
# split:: If true, the authorize method of `rlm_yubikey` will attempt to split the
# value of `User-Password`, into the user's password, and the OTP token.
#
- # NOTE: If enabled and successful, the value of `&request:User-Password` will be
- # truncated and `&request:Yubikey-OTP` will be added.
+ # NOTE: If enabled and successful, the value of `&request.User-Password` will be
+ # truncated and `&request.Yubikey-OTP` will be added.
#
# split = yes
# [options="header,autowidth"]
# |===
# | Attributes | Description
- # | `&request:Yubikey-Public-ID` | The public portion of the OTP string.
+ # | `&request.Yubikey-Public-ID` | The public portion of the OTP string.
# The value is a `id_len` modhex string.
# |===
#
# [options="header,autowidth"]
# |===
# | Attributes | Description
- # | `&request:Yubikey-OTP` | The OTP portion of `User-Password`.
+ # | `&request.Yubikey-OTP` | The OTP portion of `User-Password`.
# |===
#
# These attributes are available after authentication (if successful):
# [options="header,autowidth"]
# |===
# | Attributes | Description
- # | `&request:Yubikey-Private-ID` | The encrypted ID included in OTP data,
+ # | `&request.Yubikey-Private-ID` | The encrypted ID included in OTP data,
# should be verified for increased security.
# The value is a `6-byte` binary blob.
- # | `&request:Yubikey-Counter` | The last counter value (should be recorded).
+ # | `&request.Yubikey-Counter` | The last counter value (should be recorded).
# The value is a concatenation of the 16-bit
# session count & `8-bit` use count which form a
# `24-bit` monotonically strictly increasing
# integer (until the individual count ceilings
# are hit)
- # | `&request:Yubikey-Timestamp` | Token's internal clock (mainly useful for debugging).
+ # | `&request.Yubikey-Timestamp` | Token's internal clock (mainly useful for debugging).
# The value is a 24-bit increasing `integer @ 8 Hz`
# with rollover which is randomly initialized each session.
- # | `&request:Yubikey-Random` | Randomly generated value from the token.
+ # | `&request.Yubikey-Random` | Randomly generated value from the token.
# The value is a 16-bit integer.
# |===
#
# A policy which is used to validate channel-bindings.
#
abfab_channel_bindings {
- if (&GSS-Acceptor-Service-Name && (&outer.request:GSS-Acceptor-Service-Name != &GSS-Acceptor-Service-Name)) {
+ if (&GSS-Acceptor-Service-Name && (&outer.request.GSS-Acceptor-Service-Name != &GSS-Acceptor-Service-Name)) {
reject
}
- if (&GSS-Acceptor-Host-Name && &outer.request:GSS-Acceptor-Host-Name != &GSS-Acceptor-Host-Name) {
+ if (&GSS-Acceptor-Host-Name && &outer.request.GSS-Acceptor-Host-Name != &GSS-Acceptor-Host-Name) {
reject
}
- if (&GSS-Acceptor-Realm-Name && &outer.request:GSS-Acceptor-Realm-Name != &GSS-Acceptor-Realm-Name) {
+ if (&GSS-Acceptor-Realm-Name && &outer.request.GSS-Acceptor-Realm-Name != &GSS-Acceptor-Realm-Name) {
reject
}
if (&reply:Chargeable-User-Identity) {
# Force User-Name to be the User-Name from the request
update {
- &reply:User-Name := &request:User-Name
+ &reply:User-Name := &request.User-Name
}
cuisql
}
cui-inner.post-auth {
- if (&outer.request:Chargeable-User-Identity && \
- (&outer.request:Operator-Name || ('${policy.cui_require_operator_name}' != 'yes'))) {
+ if (&outer.request.Chargeable-User-Identity && \
+ (&outer.request.Operator-Name || ('${policy.cui_require_operator_name}' != 'yes'))) {
update reply {
&Chargeable-User-Identity := "%{sha1:${policy.cui_hash_key}%{tolower:%{User-Name}%{%{outer.request.Operator-Name}:-}}}"
}
# Outputs the contents of the request list in debugging (-X) mode
#
debug_request {
- if ("%{debug_attr:request:[*]}" == '') {
+ if ("%{debug_attr:request.[*]}" == '') {
noop
}
}
# PEAP and EAP-FAST require EAP inside of
# the tunnel, so this check is OK.
# If so, then there MUST be an outer EAP message.
- if (!&outer.request || !&outer.request:EAP-Message) {
+ if (!&outer.request || !&outer.request.EAP-Message) {
reject
}
}
#
copy_request_to_tunnel {
update request {
- Calling-Station-Id = &outer.request:Calling-Station-Id
- Called-Station-Id = &outer.request:Called-Station-Id
+ Calling-Station-Id = &outer.request.Calling-Station-Id
+ Called-Station-Id = &outer.request.Called-Station-Id
}
}
#
# No names, reject.
#
- if (!&outer.request:User-Name || !&User-Name) {
+ if (!&outer.request.User-Name || !&User-Name) {
update request {
&Module-Failure-Message += "User-Name is required for tunneled authentication"
}
# If the NAIs are the same, it violates user privacy,
# but is allowed.
#
- if (&outer.request:User-Name != &User-Name) {
+ if (&outer.request.User-Name != &User-Name) {
#
# Get the outer realm.
#
- if (&outer.request:User-Name =~ /@([^@]+)$/) {
+ if (&outer.request.User-Name =~ /@([^@]+)$/) {
update request {
&Outer-Realm-Name = "%{1}"
}
# We don't check for the full "anonymous", because
# some vendors don't follow the standards.
#
- if (&outer.request:User-Name !~ /^(anon|@)/) {
+ if (&outer.request.User-Name !~ /^(anon|@)/) {
update request {
&Module-Failure-Message += "User-Name is not anonymized"
}
# Otherwise, you could log in as outer "bob", and inner "doug",
# and we'd have no idea which one was correct.
#
- elsif (&outer.request:User-Name !~ /^anon/) {
+ elsif (&outer.request.User-Name !~ /^anon/) {
update request {
&Module-Failure-Message += "User-Name is not anonymized"
}
# The subrequest begins empty, so initially copy all attributes
# from the incoming request.
#
- &request := &parent.request:[*]
+ &request := &parent.request.[*]
#
# Add/override the session identification attributes looked up
}
# If the request is not for this server then silently discard it
- if (&request:DHCP-DHCP-Server-Identifier && \
- &request:DHCP-DHCP-Server-Identifier != &control:DHCP-DHCP-Server-Identifier) {
+ if (&request.DHCP-DHCP-Server-Identifier && \
+ &request.DHCP-DHCP-Server-Identifier != &control:DHCP-DHCP-Server-Identifier) {
do_not_respond
}
if (ok) {
update reply {
- &DHCP-Your-IP-Address := "%{%{request.DHCP-Requested-IP-Address}:-{request:DHCP-Client-IP-Address}}"
+ &DHCP-Your-IP-Address := "%{%{request.DHCP-Requested-IP-Address}:-{request.DHCP-Client-IP-Address}}"
}
}
# Individual attributes from the outer request may be
# accessed with:
#
- # &outer.request
:<attribute>
+ # &outer.request
.<attribute>
#
# The following policy in raddb/policy.d/eap can be used
# to copy attributes over.
# Let the outer session know which module failed, and why.
#
update outer.session-state {
- &Module-Failure-Message := &request:Module-Failure-Message
+ &Module-Failure-Message := &request.Module-Failure-Message
}
}
} # inner-tunnel server block
#
# A request will be generated with the following attributes:
#
- # - &request:LDAP-Sync-DN the base_dn of the sync.
- # - &request:LDAP-Sync-Filter the filter of the sync (optional).
- # - &request:LDAP-Sync-Scope the scope of the sync (optional).
- # - &request:LDAP-Sync-attr the attributes returned by the sync (optional).
+ # - &request.LDAP-Sync-DN the base_dn of the sync.
+ # - &request.LDAP-Sync-Filter the filter of the sync (optional).
+ # - &request.LDAP-Sync-Scope the scope of the sync (optional).
+ # - &request.LDAP-Sync-attr the attributes returned by the sync (optional).
#
# You should use these attributes to uniquely identify the sync when retrieving
# previous cookie values.
#
# A request will be generated with the following attributes:
#
- # - &request:LDAP-Sync-DN the base_dn of the sync.
- # - &request:LDAP-Sync-Cookie the cookie value to store.
- # - &request:LDAP-Sync-Filter the filter of the sync (optional).
- # - &request:LDAP-Sync-Scope the scope of the sync (optional).
- # - &request:LDAP-Sync-attr the attributes returned by the sync (optional).
+ # - &request.LDAP-Sync-DN the base_dn of the sync.
+ # - &request.LDAP-Sync-Cookie the cookie value to store.
+ # - &request.LDAP-Sync-Filter the filter of the sync (optional).
+ # - &request.LDAP-Sync-Scope the scope of the sync (optional).
+ # - &request.LDAP-Sync-attr the attributes returned by the sync (optional).
#
# The return code of this section is ignored.
store Cookie {
#
# A request will be generated with the following attributes:
#
- # - &request:LDAP-Sync-DN the base_dn of the sync.
- # - &request:LDAP-Sync-Entry-UUID the UUID of the object.
- # - &request:LDAP-Sync-Entry-DN the DN of the object that was added.
+ # - &request.LDAP-Sync-DN the base_dn of the sync.
+ # - &request.LDAP-Sync-Entry-UUID the UUID of the object.
+ # - &request.LDAP-Sync-Entry-DN the DN of the object that was added.
# - &*:* attributes mapped from the LDAP entry to FreeRADIUS
# attributes using the update section within the sync.
- # - &request:LDAP-Sync-Filter the filter of the sync (optional).
- # - &request:LDAP-Sync-Scope the scope of the sync (optional).
- # - &request:LDAP-Sync-attr the attributes returned by the sync (optional).
+ # - &request.LDAP-Sync-Filter the filter of the sync (optional).
+ # - &request.LDAP-Sync-Scope the scope of the sync (optional).
+ # - &request.LDAP-Sync-attr the attributes returned by the sync (optional).
#
# The return code of this section is ignored (for now).
recv Add {
#
# A request will be generated with the following attributes:
#
- # - &request:LDAP-Sync-DN the base_dn of the sync.
- # - &request:LDAP-Sync-Entry-UUID the UUID of the object.
- # - &request:LDAP-Sync-Entry-DN the DN of the object that was added.
+ # - &request.LDAP-Sync-DN the base_dn of the sync.
+ # - &request.LDAP-Sync-Entry-UUID the UUID of the object.
+ # - &request.LDAP-Sync-Entry-DN the DN of the object that was added.
# - &*:* attributes mapped from the LDAP entry to FreeRADIUS
# attributes using the update section within the sync.
- # - &request:LDAP-Sync-Filter the filter of the sync (optional).
- # - &request:LDAP-Sync-Scope the scope of the sync (optional).
- # - &request:LDAP-Sync-attr the attributes returned by the sync (optional).
+ # - &request.LDAP-Sync-Filter the filter of the sync (optional).
+ # - &request.LDAP-Sync-Scope the scope of the sync (optional).
+ # - &request.LDAP-Sync-attr the attributes returned by the sync (optional).
#
# The return code of this section is ignored (for now).
recv Modify {
#
# A request will be generated with the following attributes:
#
- # - &request:LDAP-Sync-DN the base_dn of the sync.
- # - &request:LDAP-Sync-Entry-UUID the UUID of the object.
- # - &request:LDAP-Sync-Entry-DN the DN of the object that was added (optional).
- # - &request:LDAP-Sync-Filter the filter of the sync (optional).
- # - &request:LDAP-Sync-Scope the scope of the sync (optional).
- # - &request:LDAP-Sync-attr the attributes returned by the sync (optional).
+ # - &request.LDAP-Sync-DN the base_dn of the sync.
+ # - &request.LDAP-Sync-Entry-UUID the UUID of the object.
+ # - &request.LDAP-Sync-Entry-DN the DN of the object that was added (optional).
+ # - &request.LDAP-Sync-Filter the filter of the sync (optional).
+ # - &request.LDAP-Sync-Scope the scope of the sync (optional).
+ # - &request.LDAP-Sync-attr the attributes returned by the sync (optional).
#
# The return code of this section is ignored (for now).
recv Delete {
# and call the `radius` module to send the packet.
#
# subrequest Disconnect-Request {
-# &User-Name = &parent.request:User-Name
-# &Acct-Session-Id = &parent.request:Acct-Session-Id
+# &User-Name = &parent.request.User-Name
+# &Acct-Session-Id = &parent.request.Acct-Session-Id
# &NAS-IP-Address = &parent.NAS-IP-Address}
# ...
# }
# attributes over.
#
update request {
- &User-Name := &parent.request:User-Name
- &Acct-Session-Id := &parent.request:Acct-Session-Id
- &NAS-Identifier := &parent.request:NAS-Identifier
- &NAS-IP-Address := &parent.request:NAS-IP-Addres
- &NAS-IPv6-Address := &parent.request:NAS-IPv6-Address
- &NAS-Port := &parent.request:NAS-Port
- &Framed-IP-Address := &parent.request:Framed-IP-Address
+ &User-Name := &parent.request.User-Name
+ &Acct-Session-Id := &parent.request.Acct-Session-Id
+ &NAS-Identifier := &parent.request.NAS-Identifier
+ &NAS-IP-Address := &parent.request.NAS-IP-Addres
+ &NAS-IPv6-Address := &parent.request.NAS-IPv6-Address
+ &NAS-Port := &parent.request.NAS-Port
+ &Framed-IP-Address := &parent.request.Framed-IP-Address
}
#
fr_cursor_init(&cursor, &request->control);
- RDEBUG2("Converting &request:control to client {...} section");
+ RDEBUG2("Converting &request.control to client {...} section");
RINDENT();
for (vp = fr_cursor_init(&cursor, &request->control);
*/
vp = fr_pair_find_by_da(request->packet->vps, state->da);
if (!vp) {
- RDEBUG3("No &request:State attribute, can't restore &session-state");
+ RDEBUG3("No &request.State attribute, can't restore &session-state");
if (request->seq_start == 0) request->seq_start = request->number; /* Need check for fake requests */
return;
}
*
* Adds the following attributes to the request:
*
- * - &request:Session-Id
+ * - &request.Session-Id
*
* Session identity will contain the binary session key used to create, retrieve
* and delete cache entries related to the SSL session.
/** Store OCSP response as a TLS-OCSP-Response attribute
*
- * @note Adds &request:TLS-OCSP-Response to the current request, and adds
+ * @note Adds &request.TLS-OCSP-Response to the current request, and adds
* stapling data to the current SSL session.
*
* @param out Where to write the TLS-OCSP-Response attribute. Will also
*
* Example:
@verbatim
-"%{debug_attr:&request:[*]}"
+"%{debug_attr:&request.[*]}"
@endverbatim
*
* @ingroup xlat_functions
*
* Example:
@verbatim
-"%{pairs:request:[*]}" == "User-Name = 'foo'User-Password = 'bar'"
-"%{concat:, %{pairs:request:[*]}}" == "User-Name = 'foo', User-Password = 'bar'"
+"%{pairs:request.[*]}" == "User-Name = 'foo'User-Password = 'bar'"
+"%{concat:, %{pairs:request.[*]}}" == "User-Name = 'foo', User-Password = 'bar'"
@endverbatim
*
* @see #xlat_func_concat
dv = fr_dict_enum_by_value(attr_arp_operation, fr_box_uint16(request->packet->code));
if (!dv) {
- REDEBUG("Failed to find value for &request:ARP-Operation");
+ REDEBUG("Failed to find value for &request.ARP-Operation");
return RLM_MODULE_FAIL;
}
dv = fr_dict_enum_by_value(attr_message_type, fr_box_uint8(request->packet->code));
if (!dv) {
- REDEBUG("Failed to find value for &request:DHCP-Message-Type");
+ REDEBUG("Failed to find value for &request.DHCP-Message-Type");
return RLM_MODULE_FAIL;
}
*/
dv = fr_dict_enum_by_value(attr_packet_type, fr_box_uint32(request->packet->code));
if (!dv) {
- REDEBUG("Failed to find value for &request:Packet-Type");
+ REDEBUG("Failed to find value for &request.Packet-Type");
return RLM_MODULE_FAIL;
}
dv = fr_dict_enum_by_value(attr_packet_type, fr_box_uint32(request->packet->code));
if (!dv) {
- REDEBUG("Failed to find value for &request:VMPS-Packet-Type");
+ REDEBUG("Failed to find value for &request.VMPS-Packet-Type");
return RLM_MODULE_FAIL;
}
}
if (chap->vp_length == 0) {
- REDEBUG("&request:CHAP-Password is empty");
+ REDEBUG("&request.CHAP-Password is empty");
return RLM_MODULE_INVALID;
}
if (chap->vp_length != RADIUS_CHAP_CHALLENGE_LENGTH + 1) {
- REDEBUG("&request:CHAP-Password has invalid length");
+ REDEBUG("&request.CHAP-Password has invalid length");
return RLM_MODULE_INVALID;
}
vp = fr_pair_find_by_da(request->packet->vps, attr_chap_challenge);
if (vp) {
- RDEBUG2("Using challenge from &request:CHAP-Challenge");
+ RDEBUG2("Using challenge from &request.CHAP-Challenge");
p = vp->vp_octets;
length = vp->vp_length;
} else {
*
* Example:
@verbatim
-%{dhcpv4_encode:&request:[*]}
+%{dhcpv4_encode:&request.[*]}
@endverbatim
*
* @ingroup xlat_functions
if (t->username) {
vp = fr_pair_copy(fake->packet, t->username);
fr_pair_add(&fake->packet->vps, vp);
- RDEBUG2("Setting &request:User-Name from tunneled (inner) identity \"%s\"",
+ RDEBUG2("Setting &request.User-Name from tunneled (inner) identity \"%s\"",
vp->vp_strvalue);
} else {
RDEBUG2("No tunnel username (SSL resumption?)");
*/
vp = fr_pair_find_by_da(request->packet->vps, attr_acct_status_type);
if (!vp) {
- RDEBUG2("Couldn't find &request:Acct-Status-Type or &control:Pool-Action, doing nothing...");
+ RDEBUG2("Couldn't find &request.Acct-Status-Type or &control:Pool-Action, doing nothing...");
return RLM_MODULE_NOOP;
}
code = rest_get_handle_code(handle);
if (!code) {
pair_delete_request(attr_rest_http_status_code);
- RDEBUG2("&request:REST-HTTP-Status-Code !* ANY");
+ RDEBUG2("&request.REST-HTTP-Status-Code !* ANY");
return -1;
}
- RDEBUG2("&request:REST-HTTP-Status-Code := %i", code);
+ RDEBUG2("&request.REST-HTTP-Status-Code := %i", code);
MEM(pair_update_request(&vp, attr_rest_http_status_code) >= 0);
vp->vp_uint32 = code;
RINDENT();
if (RDEBUG_ENABLED3) {
- RDEBUG3("&request:%pP", vp);
- RDEBUG3("&request:%pP", password);
+ RDEBUG3("&request.%pP", vp);
+ RDEBUG3("&request.%pP", password);
} else {
- RDEBUG2("&request:%s := <<< secret >>>", vp->da->name);
- RDEBUG2("&request:%s := <<< secret >>>", password->da->name);
+ RDEBUG2("&request.%s := <<< secret >>>", vp->da->name);
+ RDEBUG2("&request.%s := <<< secret >>>", password->da->name);
}
REXDENT();
}
#
-# "request:[0-9]" should be parsed as a list followed
+# "request.[0-9]" should be parsed as a list followed
# by an attribute.
#
update control {
&Tmp-String-0 := &3GPP-IMSI
- &Tmp-String-1 := &request:3GPP-IMSI
+ &Tmp-String-1 := &request.3GPP-IMSI
}
success
# PRE: update if
#
update {
- &request:Class := 0xad
+ &request.Class := 0xad
}
if (<byte>&Class == 173) {
# PRE: update if
#
update {
- &request:Class := 0x00000101
+ &request.Class := 0x00000101
}
if (<integer>&Class[0] == 257) {
# PRE: update if redundant
#
update {
- &request:NAS-IP-Address := 127.0.0.1
- &request:Tmp-Integer-0 := 2130706433
+ &request.NAS-IP-Address := 127.0.0.1
+ &request.Tmp-Integer-0 := 2130706433
}
update request {
# PRE: update if
#
update {
- &request:Class := 0x0101
+ &request.Class := 0x0101
}
if (<short>&Class == 257) {
&control:User-Name := 'whatever' # do some random stuff
} #{'} Closing block with extra special chars {} '"
-update { &request:Tmp-String-0 := 'candy' } # Comment after unicorn block
+update { &request.Tmp-String-0 := 'candy' } # Comment after unicorn block
update request {
- &request:Reply-Message += 'I am #literally a comment #'
- &request:Reply-Message += "I am #literally a comment #"
+ &request.Reply-Message += 'I am #literally a comment #'
+ &request.Reply-Message += "I am #literally a comment #"
}
-if (&request:Tmp-String-0 != 'candy') {
+if (&request.Tmp-String-0 != 'candy') {
test_fail
}
-if (&request:Reply-Message[0] != 'I am #literally a comment #') {
+if (&request.Reply-Message[0] != 'I am #literally a comment #') {
test_fail
}
-if (&request:Reply-Message[1] != "I am #literally a comment #") {
+if (&request.Reply-Message[1] != "I am #literally a comment #") {
test_fail
}
# PRE: update if
#
update {
- &request:Tmp-String-0 := "ab c"
- &request:Tmp-String-0 += "de fg"
- &request:Tmp-Integer-0 := 123
+ &request.Tmp-String-0 := "ab c"
+ &request.Tmp-String-0 += "de fg"
+ &request.Tmp-Integer-0 := 123
}
update {
- &request:Tmp-String-1 := "%{concat:, %{request[*]}}"
- &request:Tmp-String-2 := "%{concat:, %{Tmp-String-0[*]}}"
+ &request.Tmp-String-1 := "%{concat:, %{request[*]}}"
+ &request.Tmp-String-2 := "%{concat:, %{Tmp-String-0[*]}}"
}
-if (&request:Tmp-String-1 != "bob, hello, ab c, de fg, 123") {
+if (&request.Tmp-String-1 != "bob, hello, ab c, de fg, 123") {
test_fail
}
-if (&request:Tmp-String-2 != "ab c, de fg") {
+if (&request.Tmp-String-2 != "ab c, de fg") {
test_fail
}
# Adding attribute during request and immediately breaking
#
update {
- &request:Filter-Id += "1"
- &request:Filter-Id += "2"
+ &request.Filter-Id += "1"
+ &request.Filter-Id += "2"
}
-foreach &request:Reply-Message {
+foreach &request.Reply-Message {
if("%{Foreach-Variable-0}" == "1") {
update {
- &request:Filter-Id += "3"
+ &request.Filter-Id += "3"
}
break
}
}
update {
- &request:Filter-Id !* ANY
+ &request.Filter-Id !* ANY
}
#
# Adding attribute during request and continuing
#
update {
- &request:Filter-Id += "1"
- &request:Filter-Id += "2"
+ &request.Filter-Id += "1"
+ &request.Filter-Id += "2"
}
-foreach &request:Reply-Message {
+foreach &request.Reply-Message {
if("%{Foreach-Variable-0}" == "1") {
update {
- &request:Filter-Id += "3"
+ &request.Filter-Id += "3"
}
}
}
foreach &control:Calling-Station-Id {
- if (&request:Calling-Station-Id == "%{Foreach-Variable-0}") {
+ if (&request.Calling-Station-Id == "%{Foreach-Variable-0}") {
success
break
}
}
foreach &control:Calling-Station-Id {
- if (&request:Calling-Station-Id == "%{Foreach-Variable-0}") {
+ if (&request.Calling-Station-Id == "%{Foreach-Variable-0}") {
success
break
}
#
# Mmmm O(N^2)
#
-if (&request:Tmp-String-0[*] != &control:Tmp-String-0[*]) {
+if (&request.Tmp-String-0[*] != &control:Tmp-String-0[*]) {
test_fail
}
-if (&request:Tmp-String-0[*] == &control:Tmp-String-1[*]) {
+if (&request.Tmp-String-0[*] == &control:Tmp-String-1[*]) {
test_fail
}
-if (&request:Tmp-String-1[*] == &control:Tmp-String-0[*]) {
+if (&request.Tmp-String-1[*] == &control:Tmp-String-0[*]) {
test_fail
}
#
# Integer comparison and normalisation
#
-if (&request:Tmp-Integer-0 != &control:Tmp-Integer-0) {
+if (&request.Tmp-Integer-0 != &control:Tmp-Integer-0) {
test_fail
}
#
-# if any value of request:Tmp-Integer-0 > any value of
-# request:Tmp-Integer-1 then evaluate to true
+# if any value of request.Tmp-Integer-0 > any value of
+# request.Tmp-Integer-1 then evaluate to true
#
-if (&request:Tmp-Integer-0[*] > &control:Tmp-Integer-1[*]) {
+if (&request.Tmp-Integer-0[*] > &control:Tmp-Integer-1[*]) {
test_fail
}
#
# Compiled regex comparisons
#
-if (&request:Tmp-String-1[*] !~ /PEONS$/) {
+if (&request.Tmp-String-1[*] !~ /PEONS$/) {
test_fail
}
#
# Dynamic regex comparisons
#
-if (&request:Tmp-String-1[*] !~ /%{Tmp-String-2[0]}$/) {
+if (&request.Tmp-String-1[*] !~ /%{Tmp-String-2[0]}$/) {
test_fail
}
-if (&request:Tmp-String-1 =~ /%{Tmp-String-2[1]}$/) {
+if (&request.Tmp-String-1 =~ /%{Tmp-String-2[1]}$/) {
test_fail
}
-if (&request:Tmp-String-1 !~ /%{Tmp-String-2[2]}$/) {
+if (&request.Tmp-String-1 !~ /%{Tmp-String-2[2]}$/) {
test_fail
}
-if (&request:Tmp-String-1 =~ /%{Tmp-String-2[#]}$/) {
+if (&request.Tmp-String-1 =~ /%{Tmp-String-2[#]}$/) {
test_fail
}
test_fail
}
-if (&request:Tmp-Integer-0[*] > 10) {
+if (&request.Tmp-Integer-0[*] > 10) {
test_fail
}
-if (!(&request:Tmp-Integer-0[*] < 10)) {
+if (!(&request.Tmp-Integer-0[*] < 10)) {
test_fail
}
#
update {
&Tmp-String-0 := '&control:Tmp-String-0 := \'testing123\''
- &Tmp-String-1 := "request:Alc-MSAP-Interface = 'UNICAST_7360OLT3'"
- &Tmp-String-1 += "request:Alc-MSAP-Interface += 'UNICAST_7360OLT4'"
+ &Tmp-String-1 := "request.Alc-MSAP-Interface = 'UNICAST_7360OLT3'"
+ &Tmp-String-1 += "request.Alc-MSAP-Interface += 'UNICAST_7360OLT4'"
}
if ("%{map:%{Tmp-String-0}}" != 1) {
}
}
-if (&request:Alc-MSAP-Interface[0] != 'UNICAST_7360OLT3') {
+if (&request.Alc-MSAP-Interface[0] != 'UNICAST_7360OLT3') {
test_fail
}
-if (&request:Alc-MSAP-Interface[1] != 'UNICAST_7360OLT4') {
+if (&request.Alc-MSAP-Interface[1] != 'UNICAST_7360OLT4') {
test_fail
}
# PRE: update if
#
update {
- &request:Tmp-String-0 := "This is a string\n"
- &request:Tmp-Octets-0 := 0x000504030201
- &request:Tmp-String-1 := "what do ya want for nothing?"
- &request:Tmp-String-2 := "Jefe"
- &request:Tmp-String-3 := ""
+ &request.Tmp-String-0 := "This is a string\n"
+ &request.Tmp-Octets-0 := 0x000504030201
+ &request.Tmp-String-1 := "what do ya want for nothing?"
+ &request.Tmp-String-2 := "Jefe"
+ &request.Tmp-String-3 := ""
}
# PRE: update if
#
update {
- &request:Tmp-String-0 := "This is a string\n"
- &request:Tmp-Octets-0 := 0x000504030201
- &request:Tmp-String-1 := "what do ya want for nothing?"
- &request:Tmp-String-2 := "Jefe"
- &request:Tmp-String-3 := ""
+ &request.Tmp-String-0 := "This is a string\n"
+ &request.Tmp-Octets-0 := 0x000504030201
+ &request.Tmp-String-1 := "what do ya want for nothing?"
+ &request.Tmp-String-2 := "Jefe"
+ &request.Tmp-String-3 := ""
}
test
-if (&request:Module-Failure-Message[4] != 'test: RERROR error message') {
+if (&request.Module-Failure-Message[4] != 'test: RERROR error message') {
test_fail
}
-if (&request:Module-Failure-Message[3] != 'test: RDEBUG error message') {
+if (&request.Module-Failure-Message[3] != 'test: RDEBUG error message') {
test_fail
}
-if (&request:Module-Failure-Message[2] != 'test: RDEBUG2 error message') {
+if (&request.Module-Failure-Message[2] != 'test: RDEBUG2 error message') {
test_fail
}
-if (&request:Module-Failure-Message[1] != 'test: RDEBUG3 error message') {
+if (&request.Module-Failure-Message[1] != 'test: RDEBUG3 error message') {
test_fail
}
-if (&request:Module-Failure-Message[0] != 'test: RDEBUG4 error message') {
+if (&request.Module-Failure-Message[0] != 'test: RDEBUG4 error message') {
test_fail
}
# PRE: update if
#
update {
- &request:Tmp-String-0 := "This is a string"
- &request:Tmp-String-0 += "This is another one"
- &request:Tmp-Octets-0 := 0x000504030201
- &request:Tmp-Integer-0 := 7331
+ &request.Tmp-String-0 := "This is a string"
+ &request.Tmp-String-0 += "This is another one"
+ &request.Tmp-Octets-0 := 0x000504030201
+ &request.Tmp-Integer-0 := 7331
}
update {
- &request:Tmp-String-1 := "%{concat:, %{pairs:request:[*]}}"
- &request:Tmp-String-2 := "%{pairs:Tmp-String-0}"
- &request:Tmp-String-3 := "%{concat:, %{pairs:Tmp-String-0[*]}}"
- &request:Tmp-String-4 := "%{pairs:control:}"
- &request:Tmp-String-5 := "%{pairs:control:User-Name}"
+ &request.Tmp-String-1 := "%{concat:, %{pairs:request.[*]}}"
+ &request.Tmp-String-2 := "%{pairs:Tmp-String-0}"
+ &request.Tmp-String-3 := "%{concat:, %{pairs:Tmp-String-0[*]}}"
+ &request.Tmp-String-4 := "%{pairs:control:}"
+ &request.Tmp-String-5 := "%{pairs:control:User-Name}"
}
-if (&request:Tmp-String-1 != "User-Name = \"bob\", User-Password = \"hello\", Tmp-String-0 = \"This is a string\", Tmp-String-0 = \"This is another one\", Tmp-Octets-0 = 0x000504030201, Tmp-Integer-0 = 7331") {
+if (&request.Tmp-String-1 != "User-Name = \"bob\", User-Password = \"hello\", Tmp-String-0 = \"This is a string\", Tmp-String-0 = \"This is another one\", Tmp-Octets-0 = 0x000504030201, Tmp-Integer-0 = 7331") {
test_fail
}
-if (&request:Tmp-String-2 != "Tmp-String-0 = \"This is a string\"") {
+if (&request.Tmp-String-2 != "Tmp-String-0 = \"This is a string\"") {
test_fail
}
-if (&request:Tmp-String-3 != "Tmp-String-0 = \"This is a string\", Tmp-String-0 = \"This is another one\"") {
+if (&request.Tmp-String-3 != "Tmp-String-0 = \"This is a string\", Tmp-String-0 = \"This is another one\"") {
test_fail
}
-if (&request:Tmp-String-4 != "Cleartext-Password = \"hello\"") {
+if (&request.Tmp-String-4 != "Cleartext-Password = \"hello\"") {
test_fail
}
-if (&request:Tmp-String-5 != '') {
+if (&request.Tmp-String-5 != '') {
test_fail
}
#
update {
&control: !* ANY
- &request:Tmp-String-0 := "5RNqNl8iYLbkCc7JhR8as4TtDDCX6otuuWtcja8rITUyx9zrnHSe9tTHGmKK" # 60 byte salt
+ &request.Tmp-String-0 := "5RNqNl8iYLbkCc7JhR8as4TtDDCX6otuuWtcja8rITUyx9zrnHSe9tTHGmKK" # 60 byte salt
}
#
if (!fail) {
test_fail
}
-if (&request:Tmp-String-0) {
+if (&request.Tmp-String-0) {
test_fail
}
if (!fail) {
test_fail
}
-if (&request:Tmp-String-0 != 'foo') {
+if (&request.Tmp-String-0 != 'foo') {
test_fail
}
# PRE: update if
#
update {
- &request:Tmp-String-0 := "This is a string\n"
- &request:Tmp-Octets-0 := 0x000504030201
- &request:Tmp-String-1 := "what do ya want for nothing?"
- &request:Tmp-String-2 := "Jefe"
- &request:Tmp-String-3 := ""
+ &request.Tmp-String-0 := "This is a string\n"
+ &request.Tmp-Octets-0 := 0x000504030201
+ &request.Tmp-String-1 := "what do ya want for nothing?"
+ &request.Tmp-String-2 := "Jefe"
+ &request.Tmp-String-3 := ""
}
update {
- &request:Tmp-Octets-2 := "%{sha1:This is a string\n}"
- &request:Tmp-Octets-3 := "%{sha1:%{Tmp-String-0}}"
- &request:Tmp-Octets-4 := "%{sha1:%{request.Tmp-String-0}}"
- &request:Tmp-Octets-5 := "%{sha1:%{request.Tmp-Octets-9}}"
- &request:Tmp-Octets-6 := "%{hmacsha1:%{Tmp-String-1} %{Tmp-String-2}}"
- &request:Tmp-Octets-7 := "%{hmacsha1:%{Tmp-String-3} %{Tmp-String-3}}"
- &request:Tmp-Octets-8 := "%{hmacsha1:%{Tmp-String-1} }"
+ &request.Tmp-Octets-2 := "%{sha1:This is a string\n}"
+ &request.Tmp-Octets-3 := "%{sha1:%{Tmp-String-0}}"
+ &request.Tmp-Octets-4 := "%{sha1:%{request.Tmp-String-0}}"
+ &request.Tmp-Octets-5 := "%{sha1:%{request.Tmp-Octets-9}}"
+ &request.Tmp-Octets-6 := "%{hmacsha1:%{Tmp-String-1} %{Tmp-String-2}}"
+ &request.Tmp-Octets-7 := "%{hmacsha1:%{Tmp-String-3} %{Tmp-String-3}}"
+ &request.Tmp-Octets-8 := "%{hmacsha1:%{Tmp-String-1} }"
}
#
# Put "This is a string" into a file and call "sha1sum" on it.
# You should get this string.
#
-if (&request:Tmp-Octets-2 != 0xcc7edf1ccc4bdf1e0ec8f72b95388b65218ecf0c) {
+if (&request.Tmp-Octets-2 != 0xcc7edf1ccc4bdf1e0ec8f72b95388b65218ecf0c) {
test_fail
}
-if (&request:Tmp-Octets-3 != 0xcc7edf1ccc4bdf1e0ec8f72b95388b65218ecf0c) {
+if (&request.Tmp-Octets-3 != 0xcc7edf1ccc4bdf1e0ec8f72b95388b65218ecf0c) {
test_fail
}
-if (&request:Tmp-Octets-4 != 0xcc7edf1ccc4bdf1e0ec8f72b95388b65218ecf0c) {
+if (&request.Tmp-Octets-4 != 0xcc7edf1ccc4bdf1e0ec8f72b95388b65218ecf0c) {
test_fail
}
#
# SHA1 of empty string
#
-if (&request:Tmp-Octets-5 != 0xda39a3ee5e6b4b0d3255bfef95601890afd80709) {
+if (&request.Tmp-Octets-5 != 0xda39a3ee5e6b4b0d3255bfef95601890afd80709) {
test_fail
}
#
# SHA1 HMAC with attribute references
#
-if (&request:Tmp-Octets-6 != 0xeffcdf6ae5eb2fa2d27416d5f184df9c259a7c79) {
+if (&request.Tmp-Octets-6 != 0xeffcdf6ae5eb2fa2d27416d5f184df9c259a7c79) {
test_fail
}
# PRE: update if
#
update {
- &request:Tmp-String-0 := "This is a string\n"
- &request:Tmp-Octets-0 := 0x000504030201
+ &request.Tmp-String-0 := "This is a string\n"
+ &request.Tmp-Octets-0 := 0x000504030201
}
update {
- &request:Tmp-Octets-1 := "%{sha2_256:This is a string\n}"
- &request:Tmp-Octets-2 := "%{sha2_256:%{Tmp-String-0}}"
- &request:Tmp-Octets-3 := "%{sha2_256:%{request.Tmp-String-0}}"
- &request:Tmp-Octets-4 := "%{sha2_256:%{request.Tmp-Octets-0}}"
- &request:Tmp-Octets-5 := "%{sha2_256:%{request.Tmp-Octets-9}}"
+ &request.Tmp-Octets-1 := "%{sha2_256:This is a string\n}"
+ &request.Tmp-Octets-2 := "%{sha2_256:%{Tmp-String-0}}"
+ &request.Tmp-Octets-3 := "%{sha2_256:%{request.Tmp-String-0}}"
+ &request.Tmp-Octets-4 := "%{sha2_256:%{request.Tmp-Octets-0}}"
+ &request.Tmp-Octets-5 := "%{sha2_256:%{request.Tmp-Octets-9}}"
}
#
# Put "This is a string" into a file and call "sha2_256sum" on it.
# You should get this string.
#
-if (&request:Tmp-Octets-1 != 0xb3716a1ab53042bb392034f29071e13b0c38aa19b4edd75d9a76022f91189124) {
+if (&request.Tmp-Octets-1 != 0xb3716a1ab53042bb392034f29071e13b0c38aa19b4edd75d9a76022f91189124) {
test_fail
}
-if (&request:Tmp-Octets-2 != 0xb3716a1ab53042bb392034f29071e13b0c38aa19b4edd75d9a76022f91189124) {
+if (&request.Tmp-Octets-2 != 0xb3716a1ab53042bb392034f29071e13b0c38aa19b4edd75d9a76022f91189124) {
test_fail
}
-if (&request:Tmp-Octets-3 != 0xb3716a1ab53042bb392034f29071e13b0c38aa19b4edd75d9a76022f91189124) {
+if (&request.Tmp-Octets-3 != 0xb3716a1ab53042bb392034f29071e13b0c38aa19b4edd75d9a76022f91189124) {
test_fail
}
#
# SHA256 should also be able to cope with references to octet attributes
#
-if (&request:Tmp-Octets-4 != 0xf307e202b881fded70e58017aa0c4d7b29c76ab25d02bf078301a5f6635187eb) {
+if (&request.Tmp-Octets-4 != 0xf307e202b881fded70e58017aa0c4d7b29c76ab25d02bf078301a5f6635187eb) {
test_fail
}
#
# SHA256 of empty string
#
-if (&request:Tmp-Octets-5 != 0xe3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855) {
+if (&request.Tmp-Octets-5 != 0xe3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855) {
test_fail
}
# as exhaustive.
#
update {
- &request:Tmp-Octets-1 := "%{sha2_512:This is a string\n}"
- &request:Tmp-Octets-2 := "%{sha2_512:%{Tmp-String-0}}"
- &request:Tmp-Octets-3 := "%{sha2_512:%{request.Tmp-Octets-0}}"
+ &request.Tmp-Octets-1 := "%{sha2_512:This is a string\n}"
+ &request.Tmp-Octets-2 := "%{sha2_512:%{Tmp-String-0}}"
+ &request.Tmp-Octets-3 := "%{sha2_512:%{request.Tmp-Octets-0}}"
}
-if (&request:Tmp-Octets-1 != 0x56b57df5cce42d4e35c644649798ea23ec16f4f4626e78faf4d2d8f430ea349bcc28cd5532457c82f0aa66bf68988346039fe75b900a92ff94fd53993d45990f) {
+if (&request.Tmp-Octets-1 != 0x56b57df5cce42d4e35c644649798ea23ec16f4f4626e78faf4d2d8f430ea349bcc28cd5532457c82f0aa66bf68988346039fe75b900a92ff94fd53993d45990f) {
test_fail
}
-if (&request:Tmp-Octets-2 != 0x56b57df5cce42d4e35c644649798ea23ec16f4f4626e78faf4d2d8f430ea349bcc28cd5532457c82f0aa66bf68988346039fe75b900a92ff94fd53993d45990f) {
+if (&request.Tmp-Octets-2 != 0x56b57df5cce42d4e35c644649798ea23ec16f4f4626e78faf4d2d8f430ea349bcc28cd5532457c82f0aa66bf68988346039fe75b900a92ff94fd53993d45990f) {
test_fail
}
-if (&request:Tmp-Octets-3 != 0xde80271eb5e03a1c24dd0cd823a22305a743ee3a54f1de5bf97adbf56984561154bfb6928b1da4ccc3f5dde9f4032ad461937b60b9ace4ad3898cf45c90596d7) {
+if (&request.Tmp-Octets-3 != 0xde80271eb5e03a1c24dd0cd823a22305a743ee3a54f1de5bf97adbf56984561154bfb6928b1da4ccc3f5dde9f4032ad461937b60b9ace4ad3898cf45c90596d7) {
test_fail
}
#
# This gives the game away.
#
-update { &control:User-Name := 'bob', &request:Reply-Message := "foo" }
+update { &control:User-Name := 'bob', &request.Reply-Message := "foo" }
success
#
subrequest Access-Request {
update request {
- &User-Name := &parent.request:User-Name
+ &User-Name := &parent.request.User-Name
}
if (!&User-Name) {
}
}
-if ((&request:Tmp-String-0 == "testing1234") && !&reply:Tmp-String-1) {
+if ((&request.Tmp-String-0 == "testing1234") && !&reply:Tmp-String-1) {
success
}
else {
# Outputs the contents of the request list in debugging (-X) mode
#
debug_request {
- if("%{debug_attr:request:[*]}" == '') {
+ if("%{debug_attr:request.[*]}" == '') {
noop
}
}
}
}
- if (&parent.request:User-Name && !&parent.reply:Filter-Id) {
+ if (&parent.request.User-Name && !&parent.reply:Filter-Id) {
update parent.reply {
&Filter-Id := "filter"
}
&Filter-Id += "Failure in test at line %{interpreter:...line}"
}
- if (&parent.request:User-Name) {
+ if (&parent.request.User-Name) {
update parent.reply {
&Filter-Id += "Failure in test at line %{interpreter:...line}"
}
# PRE: update
#
update {
- &request:Tmp-String-0 := 'foobarbaz'
- &request:Tmp-Integer-0 := 123456789
- &request:Tmp-IP-Address-0 := 192.0.2.1
- &request:Tmp-IP-Address-0 += 192.0.2.2
+ &request.Tmp-String-0 := 'foobarbaz'
+ &request.Tmp-Integer-0 := 123456789
+ &request.Tmp-IP-Address-0 := 192.0.2.1
+ &request.Tmp-IP-Address-0 += 192.0.2.2
&control:Tmp-IP-Address-0 := 192.0.2.1
&control:Tmp-IP-Address-0 += 192.0.2.3
&control:Tmp-IP-Address-1 := 192.0.3.1
# Remove all attributes in the request list
update {
- &request:Tmp-IP-Address-0 !* ANY
+ &request.Tmp-IP-Address-0 !* ANY
}
# Non Tmp-IP-Address-0 address attributes should still be in the request list
#
update {
- &request:Tmp-String-0 := 'foobarbaz'
- &request:Tmp-Integer-0 := 123456789
- &request:Tmp-IP-Address-0 := 192.0.2.1
- &request:Tmp-IP-Address-0 += 192.0.2.2
- &request:Tmp-IP-Address-0 += 192.0.2.3
- &request:Tmp-IP-Address-0 += 192.0.2.2
- &request:Tmp-IP-Address-0 += 192.0.2.4
+ &request.Tmp-String-0 := 'foobarbaz'
+ &request.Tmp-Integer-0 := 123456789
+ &request.Tmp-IP-Address-0 := 192.0.2.1
+ &request.Tmp-IP-Address-0 += 192.0.2.2
+ &request.Tmp-IP-Address-0 += 192.0.2.3
+ &request.Tmp-IP-Address-0 += 192.0.2.2
+ &request.Tmp-IP-Address-0 += 192.0.2.4
}
#
update {
- &request:Tmp-String-0 := 'foobarbaz'
- &request:Tmp-Integer-0 := 123456789
- &request:Tmp-IP-Address-0 := 192.0.2.1
- &request:Tmp-IP-Address-0 += 192.0.2.2
- &request:Tmp-IP-Address-0 += 192.0.2.3
- &request:Tmp-IP-Address-0 += 192.0.2.4
+ &request.Tmp-String-0 := 'foobarbaz'
+ &request.Tmp-Integer-0 := 123456789
+ &request.Tmp-IP-Address-0 := 192.0.2.1
+ &request.Tmp-IP-Address-0 += 192.0.2.2
+ &request.Tmp-IP-Address-0 += 192.0.2.3
+ &request.Tmp-IP-Address-0 += 192.0.2.4
&control:Tmp-IP-Address-0 := 192.0.2.1
&control:Tmp-IP-Address-0 += 192.0.2.3
}
# Remove Tmp-IP-Address-0 with a specific value
update {
- &request:Tmp-IP-Address-0 -= 192.0.2.1
+ &request.Tmp-IP-Address-0 -= 192.0.2.1
}
# Only the 2nd, 3rd and 4th Tmp-IP-Address attributes should still be in the list
# Remove Tmp-IP-Address-0 with a specific value (somewhere in the middle)
update {
- &request:Tmp-IP-Address-0 -= 192.0.2.3
+ &request.Tmp-IP-Address-0 -= 192.0.2.3
}
# Only the 1st, and 3rd Tmp-IP-Address attributes should still be in the list
# Remove Tmp-IP-Address-0 with a specific value (which doesn't exist)
update {
- &request:Tmp-IP-Address-0 -= 192.0.2.3
+ &request.Tmp-IP-Address-0 -= 192.0.2.3
}
# Only the 1st, and 3rd Tmp-IP-Address attributes should still be in the list
# Remove Tmp-IP-Address-4 (which doesn't exist - more to check for SEGV/assert)
update {
- &request:Tmp-IP-Address-4 -= 192.0.2.3
+ &request.Tmp-IP-Address-4 -= 192.0.2.3
}
# Remove Tmp-IP-Address-0 with a specific value
update {
- &request:Tmp-IP-Address-0 -= 192.0.2.4
+ &request.Tmp-IP-Address-0 -= 192.0.2.4
}
# Only the 1st, and 3rd Tmp-IP-Address attributes should still be in the list
# Remove Tmp-IP-Address-0 with a specific value
update {
- &request:Tmp-IP-Address-0 -= 192.0.2.2
+ &request.Tmp-IP-Address-0 -= 192.0.2.2
}
# Only the 1st, and 3rd Tmp-IP-Address attributes should still be in the list
# Check explode works correctly
#
update {
- &request:Class := '1=1|my_attr=2|my_attr=hello|'
- &request:Calling-Station-ID += '|'
+ &request.Class := '1=1|my_attr=2|my_attr=hello|'
+ &request.Calling-Station-ID += '|'
&control:User-Name += '|hello|goodbye'
&control:User-Name += '|morning|night|1|'
&control:Reply-Message := 'Can\'t touch this'
&Filter-Id[*] := "filter"
&User-Name[*] := "blah"
- &reply:Filter-Id[*] += &request:Filter-Id[*]
+ &reply:Filter-Id[*] += &request.Filter-Id[*]
}
# Updating lists isn't allowed
#
update {
- &request:Filter-Id := &Filter-Id[#] # ERROR
+ &request.Filter-Id := &Filter-Id[#] # ERROR
}
# PRE:
#
update {
- &request:Tmp-String-0 := 'testkey'
+ &request.Tmp-String-0 := 'testkey'
}
}
# 1. Check the module didn't perform a merge
-if (&request:Tmp-String-1) {
+if (&request.Tmp-String-1) {
test_fail
}
else {
}
# 5.
-if (&request:Tmp-String-1 != &control:Tmp-String-1) {
+if (&request.Tmp-String-1 != &control:Tmp-String-1) {
test_fail
}
else {
}
# 7.
-if (&request:Tmp-String-1 != &control:Tmp-String-1) {
+if (&request.Tmp-String-1 != &control:Tmp-String-1) {
test_fail
}
else {
}
# 17.
-if (&request:Tmp-String-1 != &control:Tmp-String-1) {
+if (&request.Tmp-String-1 != &control:Tmp-String-1) {
test_fail
}
else {
}
# 19. Request Tmp-String-1 shouldn't have been updated yet
-if (&request:Tmp-String-1 == &control:Tmp-String-1) {
+if (&request.Tmp-String-1 == &control:Tmp-String-1) {
test_fail
}
else {
}
# 21. Request Tmp-String-1 still shouldn't have been updated yet
-if (&request:Tmp-String-1 == &control:Tmp-String-1) {
+if (&request.Tmp-String-1 == &control:Tmp-String-1) {
test_fail
}
else {
}
# 23. Request Tmp-String-1 should now have been updated
-if (&request:Tmp-String-1 != &control:Tmp-String-1) {
+if (&request.Tmp-String-1 != &control:Tmp-String-1) {
test_fail
}
else {
}
# 25. Request Tmp-String-1 should now have been updated
-if (&request:Tmp-String-1 != &control:Tmp-String-1) {
+if (&request.Tmp-String-1 != &control:Tmp-String-1) {
test_fail
}
else {
}
# 26. Check Cache-Entry-Hits is updated as we expect
-if (&request:Cache-Entry-Hits != 0) {
+if (&request.Cache-Entry-Hits != 0) {
test_fail
}
else {
}
cache
-if (&request:Cache-Entry-Hits != 1) {
+if (&request.Cache-Entry-Hits != 1) {
test_fail
}
else {
# PRE: cache-logic
#
update {
- &request:Tmp-String-0 := 'testkey'
+ &request.Tmp-String-0 := 'testkey'
# Reply attributes
&reply:Reply-Message := 'hello'
ttl = 2
update {
- &request:Tmp-String-1 := &control:Tmp-String-1[0]
- &request:Tmp-Integer-0 := &control:Tmp-Integer-0[0]
+ &request.Tmp-String-1 := &control:Tmp-String-1[0]
+ &request.Tmp-Integer-0 := &control:Tmp-Integer-0[0]
&control: += &reply:
}
imap_try_tls.authenticate
-# if (&request:cert-attrs.Issuer) {
+# if (&request.cert-attrs.Issuer) {
# test_fail
#}
# else {
reject
}
-if (&request:TLS-Cert-Issuer =~ /@example\.org/) {
+if (&request.TLS-Cert-Issuer =~ /@example\.org/) {
test_pass
} else {
test_fail
imap_tls.authenticate
-# if (&request:cert-attrs.Issuer) {
+# if (&request.cert-attrs.Issuer) {
# test_fail
#}
# else {
reject
}
-if (&request:TLS-Cert-Issuer =~ /@example\.org/) {
+if (&request.TLS-Cert-Issuer =~ /@example\.org/) {
test_pass
} else {
test_fail
# 0. Check basic xlat parsing
update request {
- &Tmp-String-1 := "%{json_encode:&request:[*]}"
- &Tmp-String-2 := "%{json_encode:&request:[*] }"
- &Tmp-String-3 := "%{json_encode: &request:[*]}"
- &Tmp-String-4 := "%{json_encode: &request:[*] }"
- &Tmp-String-5 := "%{json_encode: &request:[*] !&Filter-Id }"
- &Tmp-String-6 := "%{json_encode:&request:[*] ! }"
+ &Tmp-String-1 := "%{json_encode:&request.[*]}"
+ &Tmp-String-2 := "%{json_encode:&request.[*] }"
+ &Tmp-String-3 := "%{json_encode: &request.[*]}"
+ &Tmp-String-4 := "%{json_encode: &request.[*] }"
+ &Tmp-String-5 := "%{json_encode: &request.[*] !&Filter-Id }"
+ &Tmp-String-6 := "%{json_encode:&request.[*] ! }"
# Check defaults are the same as output_mode "object":
- &Tmp-String-7 := "%{json_object_encode:&request:[*]}"
- &Tmp-String-8 := "%{json_object_no_encode:&request:[*]}"
+ &Tmp-String-7 := "%{json_object_encode:&request.[*]}"
+ &Tmp-String-8 := "%{json_object_no_encode:&request.[*]}"
}
# decide that it's going to use a different ordering of the keys...
update request {
- &Tmp-String-1 := "%{json_object_encode:&request:[*]}"
- &Tmp-String-2 := "%{json_object_ex_encode:&request:[*]}"
+ &Tmp-String-1 := "%{json_object_encode:&request.[*]}"
+ &Tmp-String-2 := "%{json_object_ex_encode:&request.[*]}"
}
if (&Tmp-String-1 == '{"User-Name":{"type":"string","value":"john"},"Filter-Id":{"type":"string","value":["f1","f2"]},"NAS-Port":{"type":"uint32","value":999},"Service-Type":{"type":"uint32","value":"Login-User"}}') {
# 1b. "object" empty inputs
update request {
- &Tmp-String-1 := "%{json_object_encode:!&request:[*]}"
+ &Tmp-String-1 := "%{json_object_encode:!&request.[*]}"
&Tmp-String-2 := "%{json_object_ex_encode:}"
}
# 2a. Output mode "object_simple" tests
update request {
- &Tmp-String-1 := "%{json_object_simple_encode:&request:[*]}"
- &Tmp-String-2 := "%{json_object_simple_ex_encode:&request:[*]}"
+ &Tmp-String-1 := "%{json_object_simple_encode:&request.[*]}"
+ &Tmp-String-2 := "%{json_object_simple_ex_encode:&request.[*]}"
}
if (&Tmp-String-1 == '{"User-Name":"john","Filter-Id":["f1","f2"],"NAS-Port":999,"Service-Type":"Login-User"}') {
# 2b. "object_simple" empty inputs
update request {
- &Tmp-String-1 := "%{json_object_simple_encode:!&request:[*]}"
+ &Tmp-String-1 := "%{json_object_simple_encode:!&request.[*]}"
&Tmp-String-2 := "%{json_object_simple_ex_encode:}"
}
# 3a. Output mode "array" tests
update request {
- &Tmp-String-1 := "%{json_array_encode:&request:[*]}"
- &Tmp-String-2 := "%{json_array_ex_encode:&request:[*]}"
+ &Tmp-String-1 := "%{json_array_encode:&request.[*]}"
+ &Tmp-String-2 := "%{json_array_ex_encode:&request.[*]}"
}
if (&Tmp-String-1 == '[{"name":"User-Name","type":"string","value":"john"},{"name":"Filter-Id","type":"string","value":"f1"},{"name":"Filter-Id","type":"string","value":"f2"},{"name":"NAS-Port","type":"uint32","value":999},{"name":"Service-Type","type":"uint32","value":"Login-User"}]') {
# 3b. "array" empty inputs
update request {
- &Tmp-String-1 := "%{json_array_encode:!&request:[*]}"
+ &Tmp-String-1 := "%{json_array_encode:!&request.[*]}"
&Tmp-String-2 := "%{json_array_ex_encode:}"
}
# 4a. Output mode "array_of_names" tests
update request {
- &Tmp-String-1 := "%{json_array_names_encode:&request:[*]}"
- &Tmp-String-2 := "%{json_array_names_ex_encode:&request:[*]}"
+ &Tmp-String-1 := "%{json_array_names_encode:&request.[*]}"
+ &Tmp-String-2 := "%{json_array_names_ex_encode:&request.[*]}"
}
if (&Tmp-String-1 == '["User-Name","Filter-Id","Filter-Id","NAS-Port","Service-Type"]') {
# 4b. "array_of_names" empty inputs
update request {
- &Tmp-String-1 := "%{json_array_names_encode:!&request:[*]}"
+ &Tmp-String-1 := "%{json_array_names_encode:!&request.[*]}"
&Tmp-String-2 := "%{json_array_names_ex_encode:}"
}
# 5a. Output mode "array_of_values" tests
update request {
- &Tmp-String-1 := "%{json_array_values_encode:&request:[*]}"
- &Tmp-String-2 := "%{json_array_values_ex_encode:&request:[*]}"
+ &Tmp-String-1 := "%{json_array_values_encode:&request.[*]}"
+ &Tmp-String-2 := "%{json_array_values_ex_encode:&request.[*]}"
}
if (&Tmp-String-1 == '["john","f1","f2",999,"Login-User"]') {
# 5b. "array_of_values" empty inputs
update request {
- &Tmp-String-1 := "%{json_array_values_encode:!&request:[*]}"
+ &Tmp-String-1 := "%{json_array_values_encode:!&request.[*]}"
&Tmp-String-2 := "%{json_array_values_ex_encode:}"
}
test_fail
}
-if (&request:Tmp-String-0 == '255.255.255.0') {
+if (&request.Tmp-String-0 == '255.255.255.0') {
test_pass
}
else {
test_fail
}
-if (&request:Tmp-String-1[0] == 'cn=radprofile,ou=profiles,dc=example,dc=com') {
+if (&request.Tmp-String-1[0] == 'cn=radprofile,ou=profiles,dc=example,dc=com') {
test_pass
}
else {
test_fail
}
-if (&request:Tmp-String-1[1] == 'cn=profile1,ou=profiles,dc=example,dc=com') {
+if (&request.Tmp-String-1[1] == 'cn=profile1,ou=profiles,dc=example,dc=com') {
test_pass
}
else {
}
update {
- &request:Pool-Range := &reply:Pool-Range
- &request:Framed-IP-Address := &reply:Framed-IP-Address
- &request:Session-Timeout := &reply:Session-Timeout # We should get the same lease time
+ &request.Pool-Range := &reply:Pool-Range
+ &request.Framed-IP-Address := &reply:Framed-IP-Address
+ &request.Session-Timeout := &reply:Session-Timeout # We should get the same lease time
&reply: !* ANY
}
#
# Check the ranges are the same
#
-if (&request:Pool-Range == &reply:Pool-Range) {
+if (&request.Pool-Range == &reply:Pool-Range) {
test_pass
} else {
test_fail
#
# Check the IP addresses are the same
#
-if (&request:Framed-IP-Address == &reply:Framed-IP-Address) {
+if (&request.Framed-IP-Address == &reply:Framed-IP-Address) {
test_pass
} else {
test_fail
# The fudge factor is to allow for delays running ippool tool and script interpretation
# as we should be allocating the same lesase as before, but its TTL could be slightly lower.
#
-if ("%{expr:&request:Session-Timeout - &reply:Session-Timeout}" < 5) {
+if ("%{expr:&request.Session-Timeout - &reply:Session-Timeout}" < 5) {
test_pass
} else {
test_fail
# Release the IP address
#
update {
- &request:Framed-IP-Address := &reply:Framed-IP-Address
+ &request.Framed-IP-Address := &reply:Framed-IP-Address
&control:Pool-Action := Release
}
redis_ippool {
# Release the IP address again (should still be fine)
#
update {
- &request:Framed-IP-Address := &reply:Framed-IP-Address
+ &request.Framed-IP-Address := &reply:Framed-IP-Address
&control:Pool-Action := Release
}
redis_ippool {
# 6. Verify that the lease time is extended
update {
- &request:Framed-IP-Address := &reply:Framed-IP-Address
- &request:NAS-IP-Address := 127.0.0.2
+ &request.Framed-IP-Address := &reply:Framed-IP-Address
+ &request.NAS-IP-Address := 127.0.0.2
&control:Pool-Action := Renew
}
redis_ippool
# Change the ip address to one that doesn't exist in the pool and check we *can't* update it
update request {
- &request:Framed-IP-Address := 192.168.3.1
+ &request.Framed-IP-Address := 192.168.3.1
}
redis_ippool {
invalid = 1
test_fail
}
update request {
- &request:Framed-IP-Address := 192.168.0.1
+ &request.Framed-IP-Address := 192.168.0.1
}
# 15. Now change the calling station ID and check that we *can't* update the lease
# Attempt to reserve an IP address by performing a renew
#
update {
- &request:Framed-IP-Address := 192.168.0.1
- &request:NAS-IP-Address := 127.0.0.1
+ &request.Framed-IP-Address := 192.168.0.1
+ &request.NAS-IP-Address := 127.0.0.1
&control:Pool-Action := Renew
}
redis_ippool
# Outputs the contents of the request list in debugging (-X) mode
#
debug_request {
- if("%{debug_attr:request:[*]}" == '') {
+ if("%{debug_attr:request.[*]}" == '') {
noop
}
}
#
proto-dictionary radius
-condition &request:User-Name == &reply:User-Name
+condition &request.User-Name == &reply:User-Name
match &User-Name == &reply:User-Name
# All IP address literals should be parsed as prefixes
condition <ipaddr>127.0.0.1 == &Filter-Id
match ERROR offset 0 Cannot compare types 'ipaddr' (cast) and 'string' (attr)
-condition &Tmp-Integer64-0 == &request:Foo-Stuff-Bar
+condition &Tmp-Integer64-0 == &request.Foo-Stuff-Bar
match &Tmp-Integer64-0 == &Foo-Stuff-Bar
condition &Tmp-Integer64-0 == &reply:Foo-Stuff-Bar
#
# Sometimes the attribute/condition parser needs to fallback to bare words
#
-condition request:Foo == 'request:Foo'
+condition request.Foo == 'request.Foo'
match true
# Bareword compared with bareword is true
-condition request:Foo+Bar == request:Foo+Bar
+condition request.Foo+Bar == request.Foo+Bar
match true
-condition &request:Foo+Bar == 'request:Foo+Bar'
+condition &request.Foo+Bar == 'request.Foo+Bar'
match ERROR offset 12 Unexpected text after attribute reference
-condition 'request:Foo+d' == &request:Foo+Bar
+condition 'request.Foo+d' == &request.Foo+Bar
match ERROR offset 31 Unexpected text after attribute reference
# Attribute tags are not allowed for unknown attributes
-condition &request:FooBar:0 == &request:FooBar
+condition &request.FooBar:0 == &request.FooBar
match ERROR offset 15 Unexpected text after attribute reference
condition ¬-a-list:User-Name == ¬-a-list:User-Name
projects / thirdparty / freeradius-server.git / commitdiff
