Фильтры обработки запросов

plugins:
  filters:
    case_before:
      decode_option_82:
        tags: post_auth
        case:
          - when: $request.RAD_REQUEST.DHCP-Relay-Circuit-Id.like?("^0x0006[0-9a-f]{12}$")
            then:
              '$var.PE-Switch-MAC-Address': $request.RAD_REQUEST.DHCP-Relay-Remote-Id.substring(2).format_mac()
              '$var.PE-Switch-Port-Number': $request.RAD_REQUEST.DHCP-Relay-Circuit-Id.substring(-2).to_i(16).to_s()
          - when: $request.RAD_REQUEST.DHCP-Relay-Circuit-Id.like?("^0x[0-9a-f]{20}$")
            then:
              '$var.PE-Switch-MAC-Address': $request.RAD_REQUEST.DHCP-Relay-Remote-Id.substring(2).format_mac()
              '$var.PE-Switch-Port-Number': $request.RAD_REQUEST.DHCP-Relay-Circuit-Id.substring(-10, -8).to_i(16).to_s()
          - else:
              '$var.PE-Switch-IP-Address': $request.RAD_REQUEST.DHCP-Relay-Remote-Id.unhex()
              '$var.PE-Switch-Port-Number': $request.RAD_REQUEST.DHCP-Relay-Circuit-Id.unhex().regexp_replace("^.+/(\d+):\d+$", "\\1")

plugins:
  filters:
    check_attr_before:
      finish_processing_of_unnecessary_accounting:
        condition: '   $context.has_tag?("accounting")
                   and $request.RAD_REQUEST.try("Session-Error-Msg").in?("Radius test by administrator;Authentication failure".split(";"))'
        action:
          type: halt_processing
          arguments:
            reply:
              result: $rlm.OK

plugins:
  filters:
    delete_attrs_after:
      no_first_service:
        condition: $context.has_tag?("authenticate") and $response.RAD_REPLY.try("ERX-Service-Activate:1").empty?()
        attribute_patterns:
          $response.RAD_REPLY: '^ERX-Service.+:1$'

plugins:
  filters:
    delete_attrs_after:
      no_ip_address:
        condition: $context.has_tag?("authenticate") and $response.RAD_REPLY.try("Framed-IP-Address").empty?()
        attributes:
          - $response.RAD_REPLY.Framed-IP-Address
          - $response.RAD_REPLY.Framed-IP-Netmask

plugins:
  filters:
    divide_after:
      tags:
        - authorize
        - service_status_ok
        - residential_customer
      divide_speed_limits:
        factors:
          '$response.RAD_REPLY.HARD-Day-In-Speed': 8
          '$response.RAD_REPLY.HARD-Day-Out-Speed': 2
          '$response.RAD_REPLY.HARD-Night-In-Speed': 4
          '$response.RAD_REPLY.HARD-Night-Out-Speed': 2

plugins:
  filters:
    format_after:
      combine_rate_and_burst_values:
        tags: [authorize, individual_customer]
        values:
          InRate: '$response.RAD_REPLY.InRate'
          OutRate: '$response.RAD_REPLY.OutRate'
        destination: '$response.Speed-Limits'
        template: 'InRate=#{$InRate};InBurst=#{($InRate.to_i() / 8 * 900).to_i()};OutRate=#{$OutRate};OutBurst=#{($OutRate.to_i() / 8 * 900).to_i()}'
        delete_values: true

plugins:
  filters:
    map_before:
      get_possible_subnets_list:
        value_expression: '"27,28,29,30".split(",")'
        destination: '$var.Possible-Subnets'
        transform_expression: '$request.RAD_REQUEST.Framed-IP-Address.ip4_and($value.to_subnet_mask()) + "/" + $value'

plugins:
  filters:
    map_after:
      build_dynamic-qos-param:
        destination: '$response.RAD_REPLY.Dynamic-QoS-Param'
        value:
          - ['meter-class-rate CLS-DAY-OUT rate-absolute',   'Day-In-Speed',    1]
          - ['meter-class-burst CLS-DAY-OUT',                'Day-In-Speed',    128]
          - ['meter-class-excess-burst CLS-DAY-OUT',         'Day-In-Speed',    192]
          - ['meter-class-rate CLS-NIGHT-OUT rate-absolute', 'Night-In-Speed',  1]
          - ['meter-class-burst CLS-NIGHT-OUT',              'Night-In-Speed',  128]
          - ['meter-class-excess-burst CLS-NIGHT-OUT',       'Night-In-Speed',  192]
          - ['police-class-rate CLS-DAY-IN rate-absolute',   'Day-Out-Speed',   1]
          - ['police-class-burst CLS-DAY-IN',                'Day-Out-Speed',   128]
          - ['police-class-excess-burst CLS-DAY-IN',         'Day-Out-Speed',   192]
          - ['police-class-rate CLS-NIGHT-IN rate-absolute', 'Night-Out-Speed', 1]
          - ['police-class-burst CLS-NIGHT-IN',              'Night-Out-Speed', 128]
          - ['police-class-excess-burst CLS-NIGHT-IN',       'Night-Out-Speed', 192]
        filter_expression: '$var.try($value[1]).present?()'
        transform_expression: '$value[0] + " " + ($var[$value[1]].to_i() * $value[2]).to_s()'

plugins:
  filters:
    match_before:
      get_remote_circuit_ids:
        condition: not $context.has_tag?("accounting_on_or_off_packet") and $request.RAD_REQUEST.try("NAS-Port-Id", "").like?('^.+:\d+-\d+$')
        value_expression: $request.RAD_REQUEST.NAS-Port-Id
        destination: $var.Remote-Circuit-Ids
        # Q-in-Q VLAN:    S-VLAN        - C-VLAN=PortNumber+100
        matcher: '^.+:(?P<Remote_Id>\d+)-(?P<Circuit_Id>\d+)$'
        transformations:
          # Remote_Id = S-VLAN
          Remote_Id: $value.to_i()
          # Circuit_Id = C-VLAN - 100
          Circuit_Id: $value.to_i() - 100

plugins:
  filters:
    multiply_after:
      multiply_speed_limits:
        condition: $context.has_tag?('trial_period')
        factors:
          '$response.RAD_REPLY.HARD-Day-In-Speed': 2
          '$response.RAD_REPLY.HARD-Day-Out-Speed': 4
          '$response.RAD_REPLY.HARD-Night-In-Speed': 4
          '$response.RAD_REPLY.HARD-Night-Out-Speed': 6

plugins:
  filters:
    reduce_before:
      convert_cisco-avpair_to_dictionary:
        destination: $var.Cisco-Attributes
        value_expression: $request.RAD_REQUEST.Cisco-AVPair
        initial_expression: '{}'
        reduce_expression: '$accumulator.merge($value.split("=", 1))'

plugins:
  filters:
    reduce_after:
      # https://tools.ietf.org/html/rfc3442
      fill_dhcp-classless-static-route_attr:
        condition: $response.RAD_REPLY.try("DHCP-Router-Address").ip4?()
        initial_expression: '"0x"'
        reduce_expression: $accumulator + $value.to_i().to_hex().substring(2).pad_left(2, "0")
        value_expression: '(   "9" + "," + "10.0"           + "," + $response.RAD_REPLY.DHCP-Router-Address + ","
                            + "24" + "," + "192.168.100"    + "," + $response.RAD_REPLY.DHCP-Router-Address + ","
                            + "24" + "," + "192.168.113"    + "," + $response.RAD_REPLY.DHCP-Router-Address + ","
                            + "24" + "," + "192.168.120"    + "," + $response.RAD_REPLY.DHCP-Router-Address + ","
                            + "24" + "," + "192.168.158"    + "," + $response.RAD_REPLY.DHCP-Router-Address + ","
                            + "23" + "," + "192.168.224"    + "," + $response.RAD_REPLY.DHCP-Router-Address      ).replace(".", ",").split(",")'
        destination: $response.RAD_REPLY.DHCP-Classless-Static-Route

plugins:
  filters:
    set_tag_before:
      request_type:
        value_expression: $request.type

plugins:
  filters:
    set_tag_before:
      accounting_on_or_off_packet:
        condition: '   $context.has_tag?("accounting")
                   and $request.RAD_REQUEST.Acct-Status-Type.in?("Accounting-On;Accounting-Off".split(";"))'
        value: accounting_on_or_off_packet

plugins:
  filters:
    set_value_before:
      add_ip_to_cpe-addresses-list:
        destination: $var.CPE-Addresses-List
        value_expression: '$var.Possible-Subnets + $request.RAD_REQUEST.Framed-IP-Address.split(";")'

plugins:
  filters:
    set_value_after:
      add_dhcp-ms-classless-static-route_attr:
        condition: $response.RAD_REPLY.try("DHCP-Classless-Static-Route").present?()
        destination: $response.RAD_REPLY.DHCP-MS-Classless-Static-Route
        value_expression: $response.RAD_REPLY.DHCP-Classless-Static-Route

plugins:
  filters:
    split_after:
      get_speed_limits:
        # Example value: 'QU;20971520;3932160;D;20971520;3932160'
        value_expression: $response.RAD_REPLY.Cisco-Account-Info
        delimiter: ';'
        destination:
          - ''
          - '$var.Inbound-Speed'
          - '$var.Inbound-Burst'
          - ''
          - '$var.Outgoing-Speed'
          - '$var.Outgoing-Burst'

plugins:
  filters:
    encode_dhcp_options_after:
      router_and_dns-servers:
        condition: '   $context.has_tag?("authenticate")
                   and $response.RAD_REPLY.try("ERX-Dhcp-Options").empty?()
                   and $customer_profile.attributes.try("CPE-IP-Gateway").present?()'
        destination: $response.RAD_REPLY.ERX-Dhcp-Options
        value:
          - '"router:" + $customer_profile.attributes.CPE-IP-Gateway'
          - '"domain_name_server:192.168.1.2,10.10.10.1"'

plugins:
  filters:
    render_reply_after:
      main:
        condition: not $context.has_tag?("accounting")

plugins:
  base:
    dhcp-ip-private:
      call_stack:
        # Стандартные фильтры
        - reject_on_error/main
        - set_tag_before/request_type

        # Для DHCP-relay D-Link нужны особые параметры - маркируем запрос
        - set_tag_before/dlink_dhcp-relay

        # Добавление MS-атрибута с маршрутами
        - set_value_after/add_dhcp-ms-classless-static-route_attr

        # Заполнение атрибута с маршрутами
        - reduce_after/fill_dhcp-classless-static-route_attr

        # Добавление в ответ порта для D-Link или IP сервера для остальных
        - case_after/add_dst-port_for_dlink-relays_or_server-ip_for_others