--- a/doc/radius_gw.conf.sample	Thu Apr 30 17:23:31 2009 +0900
+++ b/doc/radius_gw.conf.sample	Fri May 01 14:58:46 2009 +0900
@@ -5,12 +5,54 @@
 # RADIUS/Diameter gateway. Typically, a RADIUS client (e.g. a NAS) would connect to
 # this extension, and the message would be converted to Diameter and sent to a Diameter server.
 #
-# This extension contains two almost independent parts: authentication/authorization and accounting.
-# See the detail of each section bellow.
+# Note that this extension alone is not sufficient to achieve RADIUS/Diameter gateway function.
+# You need to add specific extensions to handle RADIUS messages and convert them to 
+# Diameter apps such as NASREQ, EAP, ... See the next section for information.
+
+
+##############
+# Extensions #
+##############
+
+# Additional extensions must be loaded to support specific RADIUS messages and attributes.
+
+# Extensions are registered either for every message, or by port (auth or acct), or by port and code.
+# The general format is:
+# extension [: conf_file [: port] [: code(s)]] ;
+#  Where:
+#    extension is the file name (relative or absolute) of the extension to load.
+#    conf_file is optional and the name of the configuration file.
+#    port is optional, either "auth" or "acct". 
+#       If not specified, extension is called for messages incoming on both ports
+#    code(s): coma-separated list of command codes for which this extension must be called.
+#       If not specified, the extension is called for all incoming messages.
 #
-# Note that this extension alone is not sufficient for most authentication / authorization applications.
-# You need to add specific extensions for each application such as NASREQ, EAP, ...
-# See the "auth_mod" configuration parameter for this purpose.
+# The extensions are called in the order they appear in this file.
+# Here are some explained examples:
+#  3579.so;   Load this extension and call it for all messages. No configuration file.
+#  3579.so : 3579.conf;  Same as previous but with a configuration file specified.
+#  3579.so : : auth; No configuration file, but called only for messages on authentication port.
+#  3579.so : : 4, 8, 11;  Called for messages with command code 4, 8, or 11 only.
+#  3579.so : 3579.conf : auth : 4, 8, 11;  All parameters combined.
+
+# Once the list of extensions for an incoming message has been called (or empty list), 
+# if some of the attributes have not been handled, an error is loggued.
+
+##################
+# RADIUS Clients #
+##################
+
+# Each RADIUS client must be declared in the form: IP = shared-secret ;
+# IP can be ipv4 or ipv6
+# shared-secret can be a quoted string, or a list of hexadecimal values.
+# examples:
+# 192.168.100.1 = "secret key" ; # the shared secret buffer is 0x736563726574206b6579 (length 10 bytes)
+# fe00::1 = 73 65 63 72 65 74 20 6b 65 79; # same shared secret as previously
+# When a packet is received from an IP not declared here, it is silently discarded.
+#
+# Alternatively, a separate file can be specified in the form:
+# radius_client_file = "/path/to/file";
+# The format of this file in that case is yet to be defined (option not supported fully yet)
 
 
 ####################
@@ -30,14 +72,6 @@
 # The IPv6 address to which the server is bound, or "disable"
 # auth_server_ipv6 = :: ;
 
-# Enabling the auth server is not sufficient, one must provide additional modules
-# that will convert the specific RADIUS messages / attributes depending on application.
-# When a RADIUS message is received and no module is available to handle it / one of its attributes, 
-# it is logged and an error message is returned.
-# auth_mod = radius_2865 ;                       # RADIUS base RFC, PAP / CHAP authentication (NASREQ)
-# auth_mod = radius_3579 : radius_eap.conf ;     # RADIUS EAP RFC (Diameter EAP)
-# auth_mod = radius_ignore : radius_ignore.conf; # list of attributes to discard or blind copy in answers.
-
 
 ################
 #  Accounting  #
@@ -54,22 +88,3 @@
 
 # The IPv6 address to which the server is bound, or "disable"
 # acct_server_ipv6 = :: ;
-
-# Store session id used by authentication messages to find the application id for the accounting msg
-# acct_app_sessions = 1;
-
-# The Diameter Application to use for the accounting messages with unknown session information
-# acct_app_id = 0;
-
-
-##################
-# RADIUS Clients #
-##################
-
-# Each RADIUS client must be declared in the form: IP = shared-secret ;
-# IP can be ipv4 or ipv6
-# shared-secret can be a quoted string, or a list of hexadecimal values.
-# examples:
-# 192.168.100.1 = "secret key" ; # the shared secret buffer is 0x736563726574206b6579 (length 10 bytes)
-# fe00::1 = 73 65 63 72 65 74 20 6b 65 79; # same shared secret as previously
-# When a packet is received from an IP not declared here, it is silently discarded.