rlm_dpsk: add generic reply attributes and optional VLAN replies

[hshimomura]

Summary

This change improves rlm_dpsk so that local policy can build vendor-specific replies from standard reply attributes, while keeping the module itself vendor-neutral.

In particular, the module now exposes Pairwise-Master-Key in addition to the existing PSK-Identity and Pre-Shared-Key, so local policy has access to all three reply attributes when it needs to construct vendor-specific responses.

This change also adds an optional fourth CSV column for VLAN assignment, adds Meraki IPSK test attributes to dictionary.meraki, and updates the comments in raddb/mods-available/dpsk and raddb/sites-available/default accordingly.

Details

rlm_dpsk now accepts CSV entries in the following format:

identity,psk[,mac[,vlanid]]

This is backwards compatible with the existing file format:

• identity,psk
• identity,psk,mac

The VLAN field may also be used when the MAC field is empty, for example:

identity,psk,,2065

If vlanid is present, the module returns the standard tunnel reply attributes:

• Tunnel-Type = VLAN
• Tunnel-Medium-Type = IEEE-802
• Tunnel-Private-Group-Id = "<vlanid>"

The VLAN metadata is cached together with the other DPSK data, so cache hits return the same reply behavior as file lookups.

The sample filename expansion in raddb/mods-available/dpsk is also updated from ${..:name} to ${.:name} intentionally, so the example references the current module instance directly.

The Meraki dictionary update provides the IPSK test attributes needed for Meraki request handling and validation in the test environment.

Fix included

While validating MAC-constrained CSV entries, I found that the MAC parsing path compared the decoded output length against 12 instead of 6. This caused valid 12-hex-character MAC entries to be rejected. This patch corrects that check so MAC-constrained CSV rows work as intended.

Documentation

The patch updates:

• raddb/mods-available/dpsk
• raddb/sites-available/default

The documentation now describes:

• the extended CSV format
• optional VLAN replies
• the updated sample filename expansion
• an example Auth-Type dpsk stanza showing the usual pattern for handling the module returning updated

Validation

Tested against upstream v3.2.

Verified:

• legacy CSV rows without MAC or VLAN still work
• CSV rows with identity,psk,,2065 return standard VLAN tunnel reply attributes
• CSV rows with identity,psk,mac now parse and match correctly
• Ruckus DPSK flow works with MAC-constrained rows
• Meraki IPSK flow works with optional VLAN replies alongside the existing Tunnel-Password reply
• the Meraki IPSK validation uses the attributes added in dictionary.meraki
• freeradius -XC passes with the updated module and configuration