From: Arran Cudbard-Bell Date: Fri, 29 Aug 2014 19:26:50 +0000 (+0200) Subject: Fixup default virtual servers and policies to use &references X-Git-Tag: release_3_0_5~674 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ce23665c0cd07b50d0b102f01d0492cfdf8dfdad;p=thirdparty%2Ffreeradius-server.git Fixup default virtual servers and policies to use &references --- diff --git a/raddb/policy.d/accounting b/raddb/policy.d/accounting index bacf76b25e1..8fea9a24972 100644 --- a/raddb/policy.d/accounting +++ b/raddb/policy.d/accounting @@ -34,7 +34,7 @@ acct_unique { # if ("%{string:Class}" =~ /${policy.class_value_prefix}([0-9a-f]{32})/i) { update request { - Acct-Unique-Session-Id := "%{md5:%{1},%{Acct-Session-ID}}" + &Acct-Unique-Session-Id := "%{md5:%{1},%{Acct-Session-ID}}" } } @@ -46,7 +46,7 @@ acct_unique { # else { update request { - Acct-Unique-Session-Id := "%{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}}" + &Acct-Unique-Session-Id := "%{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}}" } } } @@ -56,7 +56,7 @@ acct_unique { # insert_acct_class { update reply { - Class = "${policy.class_value_prefix}%{md5:%t,%I,%{Packet-Src-Port},%{Packet-Src-IP-Address},%{NAS-IP-Address},%{Calling-Station-ID},%{User-Name}}" + &Class = "${policy.class_value_prefix}%{md5:%t,%I,%{Packet-Src-Port},%{Packet-Src-IP-Address},%{NAS-IP-Address},%{Calling-Station-ID},%{User-Name}}" } } @@ -65,8 +65,8 @@ insert_acct_class { # acct_counters64.preacct { update request { - Acct-Input-Octets64 = "%{expr:(%{%{Acct-Input-Gigawords}:-0} * 4294967296) + %{%{Acct-Input-Octets}:-0}}" - Acct-Output-Octets64 = "%{expr:(%{%{Acct-Output-Gigawords}:-0} * 4294967296) + %{%{Acct-Output-Octets}:-0}}" + &Acct-Input-Octets64 = "%{expr:(%{%{Acct-Input-Gigawords}:-0} * 4294967296) + %{%{Acct-Input-Octets}:-0}}" + &Acct-Output-Octets64 = "%{expr:(%{%{Acct-Output-Gigawords}:-0} * 4294967296) + %{%{Acct-Output-Octets}:-0}}" } } diff --git a/raddb/policy.d/canonicalization b/raddb/policy.d/canonicalization index 4018de00b36..cae86c388e0 100644 --- a/raddb/policy.d/canonicalization +++ b/raddb/policy.d/canonicalization @@ -15,8 +15,8 @@ nai_regexp = "^([^@]*)(@([-[:alnum:]]+\\.[-[:alnum:].]+))?$" split_username_nai { if (&User-Name =~ /${policy.nai_regexp}/) { update request { - Stripped-User-Name := "%{1}" - Stripped-User-Domain = "%{3}" + &Stripped-User-Name := "%{1}" + &Stripped-User-Domain = "%{3}" } # If any of the expansions result in a null @@ -35,8 +35,8 @@ split_username_nai { split_username_nai.post-proxy { if (&proxy-reply:User-Name =~ /${policy.nai_regexp}/) { update proxy-reply { - Stripped-User-Name := "%{1}" - Stripped-User-Domain = "%{3}" + &Stripped-User-Name := "%{1}" + &Stripped-User-Domain = "%{3}" } updated } @@ -57,13 +57,13 @@ mac-addr-regexp = ([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0 rewrite_called_station_id { if (&Called-Station-Id =~ /^${policy.mac-addr-regexp}(:(.+))?$/i) { update request { - Called-Station-Id := "%{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}" + &Called-Station-Id := "%{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}" } # SSID component? if ("%{8}") { update request { - Called-Station-SSID := "%{8}" + &Called-Station-SSID := "%{8}" } } updated @@ -80,7 +80,7 @@ rewrite_called_station_id { rewrite_calling_station_id { if (&Calling-Station-Id =~ /^${policy.mac-addr-regexp}$/i) { update request { - Calling-Station-Id := "%{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}" + &Calling-Station-Id := "%{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}" } updated } diff --git a/raddb/policy.d/control b/raddb/policy.d/control index b056ed106b4..d8bada512f3 100644 --- a/raddb/policy.d/control +++ b/raddb/policy.d/control @@ -4,7 +4,7 @@ # do_not_respond { update control { - Response-Packet-Type := Do-Not-Respond + &Response-Packet-Type := Do-Not-Respond } handled @@ -17,6 +17,6 @@ do_not_respond { # accept.authorize { update control { - Auth-Type := accept + &Auth-Type := accept } } diff --git a/raddb/policy.d/cui b/raddb/policy.d/cui index 6a6c1acf575..08b2c91267f 100644 --- a/raddb/policy.d/cui +++ b/raddb/policy.d/cui @@ -41,7 +41,7 @@ cui_require_operator_name = "no" cui.authorize { if ("%{client:add_cui}" == 'yes') { update request { - Chargeable-User-Identity := 0x00 + &Chargeable-User-Identity := 0x00 } } } @@ -53,7 +53,7 @@ cui.authorize { cui.pre-proxy { if (("%{request:Packet-Type}" == 'Access-Request') && ("%{client:add_cui}" == 'yes')) { update proxy-request { - Chargeable-User-Identity = 0x00 + &Chargeable-User-Identity = 0x00 } } } @@ -69,7 +69,7 @@ cui.post-auth { if (!&control:Proxy-To-Realm && &Chargeable-User-Identity && !&reply:Chargeable-User-Identity && \ (&Operator-Name || ('${policy.cui_require_operator_name}' != 'yes')) ) { update reply { - Chargeable-User-Identity = "%{sha1:${policy.cui_hash_key}%{tolower:%{User-Name}%{%{Operator-Name}:-}}}" + &Chargeable-User-Identity = "%{sha1:${policy.cui_hash_key}%{tolower:%{User-Name}%{%{Operator-Name}:-}}}" } } @@ -84,7 +84,7 @@ cui.post-auth { if (&reply:Chargeable-User-Identity) { # Force User-Name to be the User-Name from the request update { - reply:User-Name := &request:User-Name + &reply:User-Name := &request:User-Name } cuisql } @@ -95,7 +95,7 @@ cui-inner.post-auth { if (&outer.request:Chargeable-User-Identity && \ (&outer.request:Operator-Name || ('${policy.cui_require_operator_name}' != 'yes'))) { update reply { - Chargeable-User-Identity := "%{sha1:${policy.cui_hash_key}%{tolower:%{User-Name}%{%{outer.request:Operator-Name}:-}}}" + &Chargeable-User-Identity := "%{sha1:${policy.cui_hash_key}%{tolower:%{User-Name}%{%{outer.request:Operator-Name}:-}}}" } } } @@ -113,7 +113,7 @@ cui.accounting { # if (!&Chargeable-User-Identity) { update request { - Chargeable-User-Identity := "%{cuisql:\ + &Chargeable-User-Identity := "%{cuisql:\ SELECT cui FROM cui \ WHERE clientipaddress = '%{%{Packet-Src-IPv6-Address}:-%{Packet-Src-IP-Address}}' \ AND callingstationid = '%{Calling-Station-Id}' \ diff --git a/raddb/policy.d/dhcp b/raddb/policy.d/dhcp index 4396f062570..8ed03a664c6 100644 --- a/raddb/policy.d/dhcp +++ b/raddb/policy.d/dhcp @@ -5,10 +5,10 @@ dhcp_sqlippool.post-auth { # Do some minor hacks to the request so that it looks # like a RADIUS request to the SQL IP Pool module. update request { - User-Name = "DHCP-%{DHCP-Client-Hardware-Address}" - Calling-Station-Id = "%{DHCP-Client-Hardware-Address}" - NAS-IP-Address = "%{%{DHCP-Gateway-IP-Address}:-127.0.0.1}" - Acct-Status-Type = Start + &User-Name = "DHCP-%{DHCP-Client-Hardware-Address}" + &Calling-Station-Id = "%{DHCP-Client-Hardware-Address}" + &NAS-IP-Address = "%{%{DHCP-Gateway-IP-Address}:-127.0.0.1}" + &Acct-Status-Type = Start } # Call the actual module @@ -18,7 +18,7 @@ dhcp_sqlippool.post-auth { # actually allocated an address. if (ok) { update reply { - DHCP-Your-IP-Address = "%{reply:Framed-IP-Address}" + &DHCP-Your-IP-Address = "%{reply:Framed-IP-Address}" } } } diff --git a/raddb/policy.d/eap b/raddb/policy.d/eap index 0d35d76ce98..0718eab5117 100644 --- a/raddb/policy.d/eap +++ b/raddb/policy.d/eap @@ -9,13 +9,12 @@ Xeap.authorize { # if (&control:State) { update control { - Cache-TTL := 0 + &Cache-TTL := 0 } cache_eap update control { - Cache-TTL !* ANY - State !* ANY + &State !* ANY } } @@ -76,7 +75,7 @@ permit_only_eap { remove_reply_message_if_eap { if (&reply:EAP-Message && &reply:Reply-Message) { update reply { - Reply-Message !* ANY + &Reply-Message !* ANY } } else { diff --git a/raddb/policy.d/filter b/raddb/policy.d/filter index 85b8e3242fd..9a2e1460cc3 100644 --- a/raddb/policy.d/filter +++ b/raddb/policy.d/filter @@ -33,7 +33,7 @@ filter_username { # if (&User-Name =~ / /) { update reply { - Reply-Message += "Rejected: Username contains whitespace" + &Reply-Message += 'Rejected: Username contains whitespace' } reject } @@ -44,7 +44,7 @@ filter_username { # if (&User-Name =~ /@.*@/ ) { update reply { - Reply-Message += "Rejected: Multiple @ in username" + &Reply-Message += 'Rejected: Multiple @ in username' } reject } @@ -55,7 +55,7 @@ filter_username { # if (&User-Name =~ /\\.\\./ ) { update reply { - Reply-Message += "Rejected: Username contains ..s" + &Reply-Message += 'Rejected: Username contains ..s' } reject } @@ -66,7 +66,7 @@ filter_username { # if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\\.(.+)$/)) { update reply { - Reply-Message += "Rejected: Realm does not have at least one dot separator" + &Reply-Message += 'Rejected: Realm does not have at least one dot separator' } reject } @@ -77,7 +77,7 @@ filter_username { # if (&User-Name =~ /\\.$/) { update reply { - Reply-Message += "Rejected: Realm ends with a dot" + &Reply-Message += 'Rejected: Realm ends with a dot' } reject } @@ -88,7 +88,7 @@ filter_username { # if (&User-Name =~ /@\\./) { update reply { - Reply-Message += "Rejected: Realm begins with a dot" + &Reply-Message += 'Rejected: Realm begins with a dot' } reject } diff --git a/raddb/policy.d/operator-name b/raddb/policy.d/operator-name index a16fa1ea803..6d042d41254 100644 --- a/raddb/policy.d/operator-name +++ b/raddb/policy.d/operator-name @@ -28,7 +28,7 @@ operator-name.authorize { if ("%{client:Operator-Name}") { update request { - Operator-Name = "%{client:Operator-Name}" + &Operator-Name = "%{client:Operator-Name}" } } } @@ -40,7 +40,7 @@ operator-name.authorize { operator-name.pre-proxy { if (("%{request:Packet-Type}" == 'Access-Request') && "%{client:Operator-Name}") { update proxy-request { - Operator-Name := "%{client:Operator-Name}" + &Operator-Name := "%{client:Operator-Name}" } } } diff --git a/raddb/sites-available/channel_bindings b/raddb/sites-available/channel_bindings index 1252230314c..83843290aac 100644 --- a/raddb/sites-available/channel_bindings +++ b/raddb/sites-available/channel_bindings @@ -10,13 +10,13 @@ server channel_bindings { # Only the "authorize" section is needed. # authorize { - if (GSS-Acceptor-Service-Name && (outer.request:GSS-Acceptor-Service-Name != GSS-Acceptor-Service-Name)) { + if (&GSS-Acceptor-Service-Name && (&outer.request:GSS-Acceptor-Service-Name != &GSS-Acceptor-Service-Name)) { reject } - if (GSS-Acceptor-Service-Name || GSS-Acceptor-Realm-Name || GSS-Acceptor-Host-Name) { + if (&GSS-Acceptor-Service-Name || &GSS-Acceptor-Realm-Name || &GSS-Acceptor-Host-Name) { update control { - Chbind-Response-Code := success + &Chbind-Response-Code := success } # @@ -26,9 +26,9 @@ authorize { # then they won't be copied to the reply. # update reply { - GSS-Acceptor-Service-Name = &GSS-Acceptor-Service-Name - GSS-Acceptor-Host-Name = &GSS-Acceptor-Host-Name - GSS-Acceptor-Realm-Name = &GSS-Acceptor-Realm-Name + &GSS-Acceptor-Service-Name = &GSS-Acceptor-Service-Name + &GSS-Acceptor-Host-Name = &GSS-Acceptor-Host-Name + &GSS-Acceptor-Realm-Name = &GSS-Acceptor-Realm-Name } } diff --git a/raddb/sites-available/check-eap-tls b/raddb/sites-available/check-eap-tls index d84378ffd33..ea2e81c162d 100644 --- a/raddb/sites-available/check-eap-tls +++ b/raddb/sites-available/check-eap-tls @@ -34,7 +34,7 @@ authorize { # By default, we just accept the request: # update config { - Auth-Type := Accept + &Auth-Type := Accept } @@ -42,17 +42,17 @@ authorize { # Check the client certificate matches a string, and reject otherwise # -# if ("%{TLS-Client-Cert-Common-Name}" == "client.example.com") { +# if ("%{TLS-Client-Cert-Common-Name}" == 'client.example.com') { # update config { -# Auth-Type := Accept +# &Auth-Type := Accept # } # } # else { # update config { -# Auth-Type := Reject +# &Auth-Type := Reject # } # update reply { -# Reply-Message := "Your certificate is not valid." +# &Reply-Message := "Your certificate is not valid." # } # } @@ -60,14 +60,14 @@ authorize { # # Check the client certificate common name against the supplied User-Name # -# if ("host/%{TLS-Client-Cert-Common-Name}" == "%{User-Name}") { +# if ("host/%{TLS-Client-Cert-Common-Name}" == &User-Name) { # update config { -# Auth-Type := Accept +# &Auth-Type := Accept # } # } # else { # update config { -# Auth-Type := Reject +# &Auth-Type := Reject # } # } @@ -96,7 +96,7 @@ authorize { # if (!(Ldap-Group == "Permitted-Laptops")) { # update config { -# Auth-Type := Reject +# &Auth-Type := Reject # } # } @@ -124,8 +124,5 @@ authorize { auth_log } - - - } diff --git a/raddb/sites-available/dhcp b/raddb/sites-available/dhcp index 170e2b191af..fd2c8b269f9 100644 --- a/raddb/sites-available/dhcp +++ b/raddb/sites-available/dhcp @@ -127,12 +127,12 @@ dhcp DHCP-Discover { # The contents here are invented. Change them! update reply { - DHCP-Domain-Name-Server = 127.0.0.1 - DHCP-Domain-Name-Server = 127.0.0.2 - DHCP-Subnet-Mask = 255.255.255.0 - DHCP-Router-Address = 192.0.2.1 - DHCP-IP-Address-Lease-Time = 86400 - DHCP-DHCP-Server-Identifier = 192.0.2.1 + &DHCP-Domain-Name-Server = 127.0.0.1 + &DHCP-Domain-Name-Server = 127.0.0.2 + &DHCP-Subnet-Mask = 255.255.255.0 + &DHCP-Router-Address = 192.0.2.1 + &DHCP-IP-Address-Lease-Time = 86400 + &DHCP-DHCP-Server-Identifier = 192.0.2.1 } # Do a simple mapping of MAC to assigned IP. @@ -152,7 +152,7 @@ dhcp DHCP-Discover { # Or, allocate IPs from the DHCP pool in SQL. You may need to # set the pool name here if you haven't set it elsewhere. # update control { -# Pool-Name := "local" +# &Pool-Name := "local" # } # dhcp_sqlippool @@ -168,17 +168,17 @@ dhcp DHCP-Request { # Response packet type. See DHCP-Discover section above. update reply { - DHCP-Message-Type = DHCP-Ack + &DHCP-Message-Type = DHCP-Ack } # The contents here are invented. Change them! update reply { - DHCP-Domain-Name-Server = 127.0.0.1 - DHCP-Domain-Name-Server = 127.0.0.2 - DHCP-Subnet-Mask = 255.255.255.0 - DHCP-Router-Address = 192.0.2.1 - DHCP-IP-Address-Lease-Time = 86400 - DHCP-DHCP-Server-Identifier = 192.0.2.1 + &DHCP-Domain-Name-Server = 127.0.0.1 + &DHCP-Domain-Name-Server = 127.0.0.2 + &DHCP-Subnet-Mask = 255.255.255.0 + &DHCP-Router-Address = 192.0.2.1 + &DHCP-IP-Address-Lease-Time = 86400 + &DHCP-DHCP-Server-Identifier = 192.0.2.1 } # Do a simple mapping of MAC to assigned IP. @@ -198,7 +198,7 @@ dhcp DHCP-Request { # Or, allocate IPs from the DHCP pool in SQL. You may need to # set the pool name here if you haven't set it elsewhere. # update control { -# Pool-Name := "local" +# &Pool-Name := "local" # } # dhcp_sqlippool @@ -220,21 +220,21 @@ dhcp DHCP-Request { dhcp DHCP-Decline { update reply { - DHCP-Message-Type = DHCP-Do-Not-Respond + &DHCP-Message-Type = DHCP-Do-Not-Respond } reject } dhcp DHCP-Inform { update reply { - DHCP-Message-Type = DHCP-Do-Not-Respond + &DHCP-Message-Type = DHCP-Do-Not-Respond } reject } dhcp DHCP-Release { update reply { - DHCP-Message-Type = DHCP-Do-Not-Respond + &DHCP-Message-Type = DHCP-Do-Not-Respond } reject } diff --git a/raddb/sites-available/dhcp.relay b/raddb/sites-available/dhcp.relay index 737cc5d5d69..76d1e100343 100644 --- a/raddb/sites-available/dhcp.relay +++ b/raddb/sites-available/dhcp.relay @@ -22,11 +22,11 @@ server dhcp.eth1 { dhcp DHCP-Discover { update config { # IP Address of the DHCP server - DHCP-Relay-To-IP-Address := 192.0.2.2 + &DHCP-Relay-To-IP-Address := 192.0.2.2 } update request { # IP Address of the DHCP relay (ourselves) - DHCP-Gateway-IP-Address := 192.0.2.1 + &DHCP-Gateway-IP-Address := 192.0.2.1 } ok } @@ -34,10 +34,10 @@ server dhcp.eth1 { dhcp DHCP-Request { update config { # IP Address of the DHCP server - DHCP-Relay-To-IP-Address := 192.0.2.2 + &DHCP-Relay-To-IP-Address := 192.0.2.2 } update request { - DHCP-Gateway-IP-Address := 192.0.2.2 + &DHCP-Gateway-IP-Address := 192.0.2.2 } ok } diff --git a/raddb/sites-available/dynamic-clients b/raddb/sites-available/dynamic-clients index cdfa6175a96..4bbcb675b69 100644 --- a/raddb/sites-available/dynamic-clients +++ b/raddb/sites-available/dynamic-clients @@ -110,19 +110,19 @@ server dynamic_clients { # # Echo the IP address of the client. - FreeRADIUS-Client-IP-Address = "%{Packet-Src-IP-Address}" + &FreeRADIUS-Client-IP-Address = "%{Packet-Src-IP-Address}" # require_message_authenticator - FreeRADIUS-Client-Require-MA = no + &FreeRADIUS-Client-Require-MA = no # secret - FreeRADIUS-Client-Secret = "testing123" + &FreeRADIUS-Client-Secret = "testing123" # shortname - FreeRADIUS-Client-Shortname = "%{Packet-Src-IP-Address}" + &FreeRADIUS-Client-Shortname = "%{Packet-Src-IP-Address}" # nas_type - FreeRADIUS-Client-NAS-Type = "other" + &FreeRADIUS-Client-NAS-Type = "other" # virtual_server # @@ -134,7 +134,7 @@ server dynamic_clients { # virtual_server defined, then that is used, # and there is no need to define this attribute. # - FreeRADIUS-Client-Virtual-Server = "something" + &FreeRADIUS-Client-Virtual-Server = "something" } @@ -159,18 +159,18 @@ server dynamic_clients { update control { # # Echo the IP. - FreeRADIUS-Client-IP-Address = "%{Packet-Src-IP-Address}" + &FreeRADIUS-Client-IP-Address = "%{Packet-Src-IP-Address}" # # Do multiple SELECT statements to grab # the various definitions. - FreeRADIUS-Client-Shortname = "%{sql: SELECT shortname FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}" + &FreeRADIUS-Client-Shortname = "%{sql: SELECT shortname FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}" - FreeRADIUS-Client-Secret = "%{sql: SELECT secret FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}" + &FreeRADIUS-Client-Secret = "%{sql: SELECT secret FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}" - FreeRADIUS-Client-NAS-Type = "%{sql: SELECT type FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}" + &FreeRADIUS-Client-NAS-Type = "%{sql: SELECT type FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}" - FreeRADIUS-Client-Virtual-Server = "%{sql: SELECT server FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}" + &FreeRADIUS-Client-Virtual-Server = "%{sql: SELECT server FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}" } } @@ -200,17 +200,17 @@ server dynamic_clients { # for the NAS element. ie "password" if ("%{ldap:ldap:///OU=Elements,OU=Radius,DC=ACME,DC=COM?ou?sub?cn=%{Packet-Src-IP-Address}}") { update control { - FreeRADIUS-Client-IP-Address = "%{Packet-Src-IP-Address}" + &FreeRADIUS-Client-IP-Address = "%{Packet-Src-IP-Address}" # Set the Client-Shortname to be the Location # "l" just like in the Huntgroups, but this # time to the shortname. - FreeRADIUS-Client-Shortname = "%{ldap:ldap:///OU=Elements,OU=Radius,DC=ACME,DC=COM?l?sub?cn=%{Packet-Src-IP-Address}}" + &FreeRADIUS-Client-Shortname = "%{ldap:ldap:///OU=Elements,OU=Radius,DC=ACME,DC=COM?l?sub?cn=%{Packet-Src-IP-Address}}" # Lookup and set the Shared Secret based on # the "ou" attribute. - FreeRADIUS-Client-Secret = "%{ldap:ldap:///OU=Elements,OU=Radius,DC=ACME,DC=COM?ou?sub?cn=%{Packet-Src-IP-Address}}" + &FreeRADIUS-Client-Secret = "%{ldap:ldap:///OU=Elements,OU=Radius,DC=ACME,DC=COM?ou?sub?cn=%{Packet-Src-IP-Address}}" } } diff --git a/raddb/sites-available/example b/raddb/sites-available/example index e58e24319d6..5f204aaa6fc 100644 --- a/raddb/sites-available/example +++ b/raddb/sites-available/example @@ -92,9 +92,9 @@ server example { # # Some example policies. See "man unlang" for more. # - if ("%{User-Name}" == "bob") { + if (&User-Name == 'bob') { update control { - Cleartext-Password := "bob" + &Cleartext-Password := 'bob' } } @@ -114,7 +114,7 @@ server example { Post-Auth-Type Reject { update reply { - Reply-Message = "This is only an example." + &Reply-Message = 'This is only an example.' } } } diff --git a/raddb/sites-available/originate-coa b/raddb/sites-available/originate-coa index 539001dec8f..a644a17a02d 100644 --- a/raddb/sites-available/originate-coa +++ b/raddb/sites-available/originate-coa @@ -25,9 +25,9 @@ # "coa" list: # # update coa { -# User-Name = "%{User-Name}" -# Acct-Session-Id = "%{Acct-Session-Id}" -# NAS-IP-Address = "%{NAS-IP-Address}" +# &User-Name = "%{User-Name}" +# &Acct-Session-Id = "%{Acct-Session-Id}" +# &NAS-IP-Address = "%{NAS-IP-Address}" # } # # And the CoA packet will be sent. You can also send Disconnect @@ -45,7 +45,7 @@ # CoA packet: # # update control { -# Send-CoA-Request = No +# &Send-CoA-Request = No # } # # The default destination of a CoA packet is the NAS (or client) @@ -135,7 +135,7 @@ home_server_pool coa { server originate-coa.example.com { pre-proxy { update proxy-request { - NAS-IP-Address = 127.0.0.1 + &NAS-IP-Address = 127.0.0.1 } } diff --git a/raddb/sites-available/proxy-inner-tunnel b/raddb/sites-available/proxy-inner-tunnel index 1ce4137d5f9..938d954592d 100644 --- a/raddb/sites-available/proxy-inner-tunnel +++ b/raddb/sites-available/proxy-inner-tunnel @@ -24,7 +24,7 @@ authorize { update control { # You should update this to be one of your realms. - Proxy-To-Realm := "example.com" + &Proxy-To-Realm := "example.com" } } diff --git a/raddb/sites-available/robust-proxy-accounting b/raddb/sites-available/robust-proxy-accounting index 9bf86978db6..d21680b2299 100644 --- a/raddb/sites-available/robust-proxy-accounting +++ b/raddb/sites-available/robust-proxy-accounting @@ -160,7 +160,7 @@ server home.example.com { # You may want accounting policies here... update control { - Proxy-To-Realm := "acct_realm.example.com" + &Proxy-To-Realm := "acct_realm.example.com" } } diff --git a/raddb/sites-available/soh b/raddb/sites-available/soh index 9196e5b3d3d..b6ced355011 100644 --- a/raddb/sites-available/soh +++ b/raddb/sites-available/soh @@ -10,22 +10,22 @@ server soh-server { if (SoH-Supported == no) { # client NAKed our request for SoH - not supported, or turned off update config { - Auth-Type = Accept + &Auth-Type = Accept } } else { # client replied; check something - this is a local policy issue! if (SoH-MS-Windows-Health-Status =~ /antivirus (warn|error) /) { update config { - Auth-Type = Reject + &Auth-Type = Reject } update reply { - Reply-Message = "You must have antivirus enabled & installed!" + &Reply-Message = "You must have antivirus enabled & installed!" } } else { update config { - Auth-Type = Accept + &Auth-Type = Accept } } } diff --git a/raddb/sites-available/vmps b/raddb/sites-available/vmps index 8703902cafb..c5c50786f4f 100644 --- a/raddb/sites-available/vmps +++ b/raddb/sites-available/vmps @@ -51,15 +51,15 @@ server vmps { # # Some requests may not have a MAC address. Try to # create one using other attributes. - if (!VMPS-Mac) { - if (VMPS-Ethernet-Frame =~ /0x.{12}(..)(..)(..)(..)(..)(..).*/) { + if (!&VMPS-Mac) { + if (&VMPS-Ethernet-Frame =~ /0x.{12}(..)(..)(..)(..)(..)(..).*/) { update request { - VMPS-Mac = "%{1}:%{2}:%{3}:%{4}:%{5}:%{6}" + &VMPS-Mac = "%{1}:%{2}:%{3}:%{4}:%{5}:%{6}" } } else { update request { - VMPS-Mac = "%{VMPS-Cookie}" + &VMPS-Mac = &VMPS-Cookie } } } @@ -73,23 +73,23 @@ server vmps { # required VMPS reply attributes update reply { - VMPS-Packet-Type = VMPS-Join-Response - VMPS-Cookie = "%{VMPS-Mac}" + &VMPS-Packet-Type = VMPS-Join-Response + &VMPS-Cookie = &VMPS-Mac - VMPS-VLAN-Name = "please_use_real_vlan_here" + &VMPS-VLAN-Name = "please_use_real_vlan_here" # # If you have VLAN's in a database, you can select # the VLAN name based on the MAC address. # - #VMPS-VLAN-Name = "%{sql:select ... where mac='%{VMPS-Mac}'}" + #&VMPS-VLAN-Name = "%{sql:select ... where mac='%{VMPS-Mac}'}" } # correct reply packet type for reconfirmation requests # - if (VMPS-Packet-Type == VMPS-Reconfirm-Request){ + if (&VMPS-Packet-Type == VMPS-Reconfirm-Request){ update reply { - VMPS-Packet-Type := VMPS-Reconfirm-Response + &VMPS-Packet-Type := VMPS-Reconfirm-Response } } }