# -*- text -*-
######################################################################
#
#	Sample configuration file for dynamically updating the list
#	of RADIUS clients at run time.
#
#	Everything is keyed off of a client "network".  (e.g. 192.0.2/24)
#	This configuration lets the server know that clients within
#	that network are defined dynamically.
#
#	When the server receives a packet from an unknown IP address
#	within that network, it tries to find a dynamic definition
#	for that client.  If the definition is found, the IP address
#	(and other configuration) is added to the server's internal
#	cache of "known clients", with a configurable lifetime.
#
#	Further packets from that IP address result in the client
#	definition being found in the cache.  Once the lifetime is
#	reached, the client definition is deleted, and any new requests
#	from that client are looked up as above.
#
#	If the dynamic definition is not found, then the request is
#	treated as if it came from an unknown client.  i.e. It is
#	silently discarded.
#
#	As part of protection from Denial of Service (DoS) attacks,
#	the server will add only one new client per second.  This CANNOT
#	be changed, and is NOT configurable.
#
#	$Id$
#
######################################################################

#
#  Define a network where clients may be dynamically defined.
client dynamic {
	#
	#  You MUST specify a netmask!
	#  IPv4 /32 or IPv6 /128 are NOT allowed!
	ipaddr = 0.0.0.0/0

	#
	#  Any other configuration normally found in a "client"
	#  entry can be used here.

	#
	#  A shared secret does NOT have to be defined.  It can
	#  be left out.

	#
	#  Define the virtual server used to discover dynamic clients.
	dynamic_clients = dynamic_clients

	#
	#  Define the lifetime (in seconds) for dynamic clients.
	#  They will be cached for this lifetime, and deleted afterwards.
	#
	#  If the lifetime is "0", then the dynamic client is never
	#  deleted.  The only way to delete the client is to re-start
	#  the server.
	lifetime = 3600
}

#
#  This is the virtual server referenced above by "dynamic_clients".
server dynamic_clients {

	#
	#  The only contents of the virtual server is the "authorize" section.
	authorize {
		#
		#  Example 3: Look the clients up in SQL.
		#
		#  This requires the SQL module to be configured, of course.
		if ("%{sql: SELECT name FROM network_devices WHERE ipv4 = '%{Packet-Src-IP-Address}'}") {
			update control {
				#
				#  Echo the IP.
				&FreeRADIUS-Client-IP-Address = "%{Packet-Src-IP-Address}"

				#
				#  Do multiple SELECT statements to grab
				#  the various definitions.
				&FreeRADIUS-Client-Shortname = "%{sql: SELECT name FROM network_devices WHERE ipv4 = '%{Packet-Src-IP-Address}'}"

				&FreeRADIUS-Client-Secret = "%{sql: SELECT radius_auth_settings.secret FROM network_devices LEFT JOIN radius_auth_settings ON radius_auth_settings.id = network_devices.radius_auth_settings_id WHERE ipv4='%{Packet-Src-IP-Address}'}"

				&FreeRADIUS-Client-NAS-Type = "other"
			}

            #
            #  Tell the caller that the client was defined properly.
            #
            #  If the authorize section does NOT return "ok", then
            #  the new client is ignored.
            ok
		}
	}
}
