Плагины

plugins:
  base:
    isg-ipoe-by-ip:
      call_stack:
        # Установка тега с типом запроса
        - set_tag_before/request_type
 
        # Отправка отказа в случае возникновения ошибки
        - reject_on_error/main

        # Игнорирование лишнего аккаунтинга
        - check_attr_before/skip_unnecessary_accounting_packet

        # Аккаунтинг по базовой сессии
        - set_tag_before/base-session-accounting

        # Авторизация ISG-сервисов вида IPOE-SC-INET-<Rate>-<Burst>
        - set_tag_before/auth-internet-access-isg-service
        - match_before/get_speed_limit_values_for_internet-access-isg-service
        - format_after/set_cisco-service-info_attr_for_internet-access-isg-service

        # Добавление префикса ко всем активируемым сервисам
        - map_after/add_prefix_to_isg-services

plugins:
  base:
    jmx5-qinq:
      actions:
        authorize:
          customer_profile: &customer_profile
            set_by: search_cache
            query:
              MAC-Address: $request.RAD_REQUEST.User-Name.normalize_mac()

          provider_profile: &provider_profile
            set_by: search_cache
            query:
              Switch-VLAN: $var.Remote-Circuit-Ids.Remote_Id
              Switch-Port-Code: $var.Remote-Circuit-Ids.Circuit_Id

          default_bind_type: network_connection

plugins:
  base:
    se-ipoe-by-o82:
      actions:
        authorize:
          provider_profile:
            set_by: search_cache
            query:
              Switch-IP: $request.RAD_REQUEST.Agent-Remote-Id.substring(6).unhex()
              Switch-Port-Code: $request.RAD_REQUEST.Agent-Circuit-Id.substring(12).to_i(16)

          customer_profile:
            set_by: set_first_from_provider_profile
            filter:
              Auth-Scheme: '"DHCP+L2TP"'

plugins:
  base:
    l2tp-by-login:
      actions:
        authorize:
          customer_profile: &customer_profile
            set_by: search_cache
            query:
              L2TP-Login: $request.RAD_REQUEST.User-Name.lower().regexp_replace("@.*$|\\\\t|\s")
              Auth-Scheme: '"DHCP+L2TP"'

          provider_profile: {}

plugins:
  base:
    isg-ipoe-by-ip:
      actions:
        authorize:
          reply: &default_reply
            # Авторизация ISG-сервисов вида IPOE-SC-INET-<Rate>-<Burst>
            - condition: $context.has_tag?("auth-internet-access-isg-service") and $request.RAD_REQUEST.User-Name.like?("^IPOE-SC-INET(-\d+){2}$")
              template:
                RAD_CHECK: &default_rad_check
                  # Идентификация абонентского оборудования выполняется по IP-адресу, а для сервисов вовсе не нужна.
                  # Поэтому для PAP-модуля FreeRADIUS передаём в качестве «правильного» пароль из запроса.
                  Cleartext-Password: $request.RAD_REQUEST.User-Password

                RAD_REPLY:
                  Cisco-AVPair:
                    - '"subscriber:accounting-list=HYDRA-IPOE"'
                    - '"ip:traffic-class=in access-group name IPOE-ACL-ALL-TRAFF priority 1000"'
                    - '"ip:traffic-class=out access-group name IPOE-ACL-ALL-TRAFF priority 1000"'
                  Acct-Interim-Interval: '"300"'
 
                result: $rlm.OK

            # Оборудование не подобралось - отказ
            - condition: $customer_profile.null?()
              template:
                RAD_CHECK:
                  Auth-Type: '"Reject"'

                RAD_REPLY:
                  Reply-Message: '"Incorrect IP address"'

                result: $rlm.NOTFOUND

            # Всё в порядке
            - condition: $customer_profile.attributes.try("Internet-Access-Service-State") == "SERV_STATE_Provision"
              template:
                RAD_CHECK:
                  <<: *default_rad_check

                RAD_REPLY: &ok_rad_reply
                  Cisco-AVPair: '"subscriber:accounting-list=HYDRA-IPOE"'
                  Acct-Interim-Interval: '"300"'
                  Idle-Timeout: '"86400"'
                  Cisco-Account-Info: $customer_profile.attributes.ISG-IPoE-Services.split(",")

                result: $rlm.OK

            # Доступ заблокирован
            - template:
                RAD_CHECK:
                  <<: *default_rad_check

                RAD_REPLY:
                  <<: *ok_rad_reply
                  Cisco-Account-Info:
                    - '"IPOE-SC-REDIRECT"'
                    - '"IPOE-SC-OPENGARDEN"'

                result: $rlm.OK 

plugins:
  base:
    dhcp-by-o82:
      actions:
        post_auth:
          provider_profile:
            set_by: search_cache
            query:
              Switch-IP: $request.RAD_REQUEST.DHCP-Relay-Remote-Id.substring(6).unhex()
              Switch-Port-Code: $request.RAD_REQUEST.DHCP-Relay-Circuit-Id.substring(12).to_i(16)

          customer_profile:
            set_by: set_first_from_provider_profile
            filter:
              Auth-Scheme: '"DHCP+L2TP"'

          reply:
            # Всё в порядке
            - condition: '    $customer_profile.present?()
                          and $customer_profile.attributes.DHCP-IP-Address.ip4?()
                          and $customer_profile.attributes.DHCP-Gateway-IP.ip4?()
                          and $customer_profile.attributes.DHCP-Subnet-Mask.ip4_mask?()'
              template:
                RAD_REPLY:
                  DHCP-Domain-Name-Server:
                    - '"192.168.11.15"'
                    - '"192.168.11.16"'
                  DHCP-IP-Address-Lease-Time: '"86400"'
                  DHCP-Router-Address: $customer_profile.attributes.DHCP-Gateway-IP
                  DHCP-Subnet-Mask: $customer_profile.attributes.DHCP-Subnet-Mask
                  DHCP-Your-IP-Address: $customer_profile.attributes.DHCP-IP-Address

                result: $rlm.OK
 
            # Профиль абонентского оборудования не подобрался - отказ
            - condition: $customer_profile.null?()
              template:
                RAD_REPLY: {}
                reject_reason: '"Customer equipment profile not found // Option 82"'
                result: $rlm.REJECT

            # В профиле нет маски/адреса/шлюза - отказ
            - template:
                RAD_REPLY: {}
                reject_reason: '"Not valid customer equipment profile // Option 82"'
                result: $rlm.REJECT