Alan T. DeKok [Tue, 30 Mar 2010 14:06:15 +0000 (16:06 +0200)]
Revert "= NULL" checks. They should be "IS NULL"
Alan T. DeKok [Tue, 30 Mar 2010 14:04:23 +0000 (16:04 +0200)]
Move to using phony targets for subdirectories.
This removes the explicit shell loop over subdirs, which means that
the main "make" program now tracks all dependencies. I've also updated
some dependencies to be correct. Now "make -j 4" will work.
Alan T. DeKok [Wed, 17 Mar 2010 00:28:16 +0000 (17:28 -0700)]
Fix merge for struct names changed in 2.2.0
Alan T. DeKok [Tue, 9 Mar 2010 09:12:01 +0000 (10:12 +0100)]
Check for closed sockets.
This allows the module to continue if the DB suddenly disappears
Alan T. DeKok [Tue, 9 Mar 2010 09:15:49 +0000 (10:15 +0100)]
Move struct definition to the correct place
Alan T. DeKok [Sat, 6 Mar 2010 14:45:08 +0000 (15:45 +0100)]
Allow IPv6 to bind to interface with scope.
A follow-on to the previous patch.
Alan T. DeKok [Sat, 6 Mar 2010 13:26:27 +0000 (14:26 +0100)]
Add IPv6 "scope" for link-local addresses.
Added to fr_ipaddr_t.
fr_ipaddr_cmp(), fr_sockaddr2ipaddr(), fr_ipaddr2sockaddr().
Also made ip_hton() call fr_sockaddr2ipaddr() to prevent code duplication.
Alan T. DeKok [Sat, 6 Mar 2010 11:40:23 +0000 (12:40 +0100)]
Check for AF_INET6, not HAVE_AF_INET6
HAVE_AF_INET6 isn't defined, AF_INET6 is.
Alan T. DeKok [Sat, 6 Mar 2010 11:13:54 +0000 (12:13 +0100)]
Work around implementation-dependent shift results
uint32 foo = ~0;
foo <<= 32;
Q: what's foo?
A: undefined.
Alan T. DeKok [Sat, 6 Mar 2010 10:03:33 +0000 (11:03 +0100)]
Calculate IPv6 netmask correctly.
Closes bug #69
Alan T. DeKok [Sat, 6 Mar 2010 07:48:06 +0000 (08:48 +0100)]
Receive CoA packets when they have been separated from parents
Otherwise, the code thinks that there is a proxy reply WITHOUT
an original reply..
There's still likely a bug, as the CoA request->reply is built BEFORE
the original->reply. The post-proxy CoA work should very likely have
complete access to the original reply packet type
Alan T. DeKok [Fri, 26 Feb 2010 10:11:02 +0000 (11:11 +0100)]
Clean up log file handling. Fixes bug #63
We now open the log file from the option parsing (-l file)
OR in mainconfig.c. That way, the code in log.c can assume that
there is ALWAYS a log file, and it doesn't need to open one. This
simplifies log.c substantially.
We also moved the syslog "openlog" code from log.c to mainconfig.c
This again makes it simpler.
On HUP, the hup_mainconfig() function takes care of re-opening the
log file. This is so that the log.c functions don't have to do it.
Alan T. DeKok [Fri, 26 Feb 2010 09:31:59 +0000 (10:31 +0100)]
As posted to the list
Alan T. DeKok [Tue, 16 Feb 2010 16:47:27 +0000 (17:47 +0100)]
Switch default for acct realms to "no_response_fail"
Since accounting packets aren't re-tried, failing one packet over
from one server to another isn't a good idea.
Alan T. DeKok [Thu, 11 Feb 2010 11:44:24 +0000 (12:44 +0100)]
Added sample CoA server
Alan T. DeKok [Thu, 11 Feb 2010 09:38:20 +0000 (10:38 +0100)]
Make it consisent with the example in decoupled-accounting
Alan T. DeKok [Thu, 11 Feb 2010 09:36:51 +0000 (10:36 +0100)]
As posted to the list
Alan T. DeKok [Thu, 11 Feb 2010 09:36:26 +0000 (10:36 +0100)]
Ran it through the formatter.
Alan T. DeKok [Thu, 11 Feb 2010 09:33:19 +0000 (10:33 +0100)]
Add more information to warning message
Component && module, if a child thread is stuck for a long time.
Alan T. DeKok [Thu, 11 Feb 2010 09:32:20 +0000 (10:32 +0100)]
Quiet compiler warnings
Alan T. DeKok [Thu, 11 Feb 2010 09:24:57 +0000 (10:24 +0100)]
Do waitpid() for ALL children, even if there are no threads waiting
i.e. call radius_exec_program() 4 times for each packet, each
with "nowait". The "reap_children" function is called ONCE per packet,
and was calling waitpid() ONCE if there were no threads waiting
for a child.
This change makes it KEEP waiting until there are no more children
to wait for.
Alan T. DeKok [Thu, 4 Feb 2010 17:09:22 +0000 (18:09 +0100)]
Fixes to build without TCP
Alan T. DeKok [Thu, 4 Feb 2010 07:50:37 +0000 (08:50 +0100)]
Added note on global CA
Alan T. DeKok [Thu, 4 Feb 2010 07:45:12 +0000 (08:45 +0100)]
Make MS-CHAP call xlat on NT-Hash and LM-Password
This moves the "expand variable" code to the correct place.
Alan T. DeKok [Sat, 23 Jan 2010 09:08:55 +0000 (10:08 +0100)]
in pairmake_any(), value may be NULL
Alan T. DeKok [Sat, 23 Jan 2010 08:05:21 +0000 (09:05 +0100)]
As posted to the list
Alan T. DeKok [Fri, 22 Jan 2010 12:40:30 +0000 (13:40 +0100)]
Added more 'const', and changed stats to %u
Some tests showed that the stats went over 2^31... and then they
went negative
Alan T. DeKok [Fri, 22 Jan 2010 12:40:16 +0000 (13:40 +0100)]
Added more 'const'
Alan T. DeKok [Fri, 22 Jan 2010 09:41:46 +0000 (10:41 +0100)]
Set flag CORRECTLY for resumed session
Alan T. DeKok [Thu, 21 Jan 2010 10:37:21 +0000 (11:37 +0100)]
Add statistics for detail listeners, too
Alan T. DeKok [Thu, 4 Feb 2010 07:59:53 +0000 (08:59 +0100)]
Check for allocation failure
Alan T. DeKok [Thu, 4 Feb 2010 07:58:28 +0000 (08:58 +0100)]
Be more careful about handling of temporary packet
Alan T. DeKok [Thu, 4 Feb 2010 07:57:26 +0000 (08:57 +0100)]
Print the request number on every log line.
Alan T. DeKok [Thu, 4 Feb 2010 07:55:43 +0000 (08:55 +0100)]
More useful errors
track total number of open sockets, and print "too many sockets" if
there are too many
Alan T. DeKok [Tue, 5 Jan 2010 11:53:30 +0000 (12:53 +0100)]
Properly account for accounting responses from a home server
Alan T. DeKok [Tue, 5 Jan 2010 11:52:00 +0000 (12:52 +0100)]
Correctly handle large attributes
Alan T. DeKok [Mon, 4 Jan 2010 16:50:22 +0000 (17:50 +0100)]
Reset ping variables in home server when marking it zombie
This should only affect situations when a home server doesn't respond
to normal packets, but does respond to "ping" packets.
Alan T. DeKok [Wed, 30 Dec 2009 12:59:33 +0000 (13:59 +0100)]
Renamed these to 2.2.0, too
Alan T. DeKok [Tue, 22 Dec 2009 12:01:57 +0000 (13:01 +0100)]
Prepare for 2.1.8 by renaming stable to 2.2.0
Alan T. DeKok [Mon, 21 Dec 2009 13:39:24 +0000 (14:39 +0100)]
Remove patches no longer in use
Alan T. DeKok [Mon, 21 Dec 2009 13:16:45 +0000 (14:16 +0100)]
Fixed debian bug
Alan T. DeKok [Mon, 21 Dec 2009 13:15:48 +0000 (14:15 +0100)]
Fixed typo
Alan T. DeKok [Mon, 21 Dec 2009 12:53:13 +0000 (13:53 +0100)]
Sync with Debian to enable SSL
Alan T. DeKok [Mon, 21 Dec 2009 11:07:08 +0000 (12:07 +0100)]
Add OpenSSL license exception
Alan T. DeKok [Mon, 21 Dec 2009 09:49:50 +0000 (10:49 +0100)]
Synced with upstream debian
Alan T. DeKok [Mon, 21 Dec 2009 09:46:20 +0000 (10:46 +0100)]
Make integers unsigned 32-bit, rather than signed
Alan T. DeKok [Sat, 19 Dec 2009 08:33:20 +0000 (09:33 +0100)]
Move DHCP options to "octets" type
Alan T. DeKok [Fri, 18 Dec 2009 13:08:32 +0000 (14:08 +0100)]
Simplify stats code, and keep track of dropped versus bad authenticators
Alan T. DeKok [Fri, 18 Dec 2009 12:52:50 +0000 (13:52 +0100)]
Make "dropped packet" message debugging
This is so that we don't spam the logs wih a DoS when we get lots
of packets with a bad signature
Alan T. DeKok [Fri, 18 Dec 2009 11:31:38 +0000 (12:31 +0100)]
Added notes on SQL && packets with zero session time
Alan T. DeKok [Thu, 17 Dec 2009 10:42:03 +0000 (11:42 +0100)]
Alan T. DeKok [Thu, 17 Dec 2009 10:28:12 +0000 (11:28 +0100)]
Removed unnecessary debug message
Alan T. DeKok [Thu, 17 Dec 2009 08:35:35 +0000 (09:35 +0100)]
Simplified use of llvm checker
Alan T. DeKok [Tue, 15 Dec 2009 15:01:20 +0000 (16:01 +0100)]
Ensure that len > 0
Alan T. DeKok [Tue, 15 Dec 2009 13:29:49 +0000 (14:29 +0100)]
Initialize value
Alan T. DeKok [Tue, 15 Dec 2009 13:23:47 +0000 (14:23 +0100)]
Catch possible NULL pointer on editing attribute list
Alan T. DeKok [Tue, 15 Dec 2009 13:17:52 +0000 (14:17 +0100)]
Catch situations where COA may be NULL
Alan T. DeKok [Tue, 15 Dec 2009 10:52:03 +0000 (11:52 +0100)]
If we have "user=foo", and we're ALREADY running as that user, ignore it.
This prevents us from complaining when "initgroups" is run as non-root
Alan T. DeKok [Thu, 10 Dec 2009 10:38:39 +0000 (11:38 +0100)]
Fix CVE-2009-3736
Alan T. DeKok [Wed, 9 Dec 2009 14:48:30 +0000 (15:48 +0100)]
Template code to use lt_dladvise()
The libtool people have discovered that it's useful to allow
*additional* features from linking. Like allowing libraries to
link to libraries. Using this magic API allows FreeRADIUS to load
the Perl module, which in turn loads other modules, which in turn
load dynamic libraries. Right now, it complains because of
limitations in libltdl.
We COULD do these checks in 2.1.8, but that involves either adding
configure checks, OR upgrading our version of libltdl. We don't want
to do either.
Alan T. DeKok [Tue, 8 Dec 2009 15:31:55 +0000 (16:31 +0100)]
Complain about too many sockets earlier
Give feedback from event_new_fd() back to proxy_new_listener(),
and to insert_into_proxy_hash(). When all sockets are allocated,
stop allocating new ones
Alan T. DeKok [Tue, 8 Dec 2009 15:31:02 +0000 (16:31 +0100)]
Add datarootdir from bug #51
Alan T. DeKok [Tue, 8 Dec 2009 13:00:53 +0000 (14:00 +0100)]
Handle case where Acct-Session-Time might not exist
Alan T. DeKok [Mon, 7 Dec 2009 12:53:14 +0000 (13:53 +0100)]
Add %{Attribute-Name#}
This prints the numerical value, rather than the decoded time/VALUE
Alan T. DeKok [Mon, 7 Dec 2009 12:24:14 +0000 (13:24 +0100)]
Added notes on use of FreeRADIUS-Acct-Session-Start-Time
Alan T. DeKok [Mon, 7 Dec 2009 12:20:12 +0000 (13:20 +0100)]
Added synthetic session start time attribute
Alan T. DeKok [Mon, 7 Dec 2009 09:38:51 +0000 (10:38 +0100)]
Make more errors non-fatal
Alan T. DeKok [Sun, 6 Dec 2009 16:02:08 +0000 (17:02 +0100)]
Added sample ntlm_auth module
Alan T. DeKok [Sun, 6 Dec 2009 15:59:07 +0000 (16:59 +0100)]
Fixed before 2.1.8
Alan T. DeKok [Sun, 6 Dec 2009 12:54:14 +0000 (13:54 +0100)]
Use case insensitive comparison. Closes #36
Alan T. DeKok [Sun, 6 Dec 2009 12:51:01 +0000 (13:51 +0100)]
Portability fixes, as noted by bug #33
Alan T. DeKok [Sun, 6 Dec 2009 12:48:14 +0000 (13:48 +0100)]
IP pools require a transactional back-end
So we used InnoDB
Alan T. DeKok [Sun, 6 Dec 2009 12:43:59 +0000 (13:43 +0100)]
Remove notes on unsupported configuration items
Alan T. DeKok [Sun, 6 Dec 2009 12:39:00 +0000 (13:39 +0100)]
Be more specific about which detail files we suppress
Don't write packets back to the same detail file, but allow them
to be written to different detail files
Alan T. DeKok [Sun, 6 Dec 2009 12:37:13 +0000 (13:37 +0100)]
Removed re-definition of detail structure
Alan T. DeKok [Sun, 6 Dec 2009 12:36:28 +0000 (13:36 +0100)]
Moved detail structure defs to a public header file
Alan T. DeKok [Sat, 5 Dec 2009 14:58:19 +0000 (15:58 +0100)]
Fix code so that corner cases of %{%{foo}:-%{bar}} work
The previous code was odd... this code is simpler, and works.
Alan T. DeKok [Sat, 5 Dec 2009 14:54:08 +0000 (15:54 +0100)]
Re-set FP after closing it
Alan T. DeKok [Fri, 4 Dec 2009 13:46:04 +0000 (14:46 +0100)]
Enable new dictionaries
Alan T. DeKok [Thu, 3 Dec 2009 09:25:33 +0000 (10:25 +0100)]
Sign client certs with CA rather than server cert
Alan T. DeKok [Wed, 2 Dec 2009 11:16:57 +0000 (12:16 +0100)]
Use intermediate buffer for error messages.
This prevents the messages from getting mangled
Alan T. DeKok [Wed, 2 Dec 2009 10:37:33 +0000 (11:37 +0100)]
Removed erroneous 'break'
Alan T. DeKok [Wed, 2 Dec 2009 07:51:27 +0000 (08:51 +0100)]
Fixed string copying in sub variable.
Apparently the only reason this worked before is that no one used it.
The decode_attribute() function did the string copying itself,
and therefore avoided this.
Alan T. DeKok [Tue, 1 Dec 2009 09:49:18 +0000 (10:49 +0100)]
Fixed typo
Alan T. DeKok [Tue, 1 Dec 2009 09:21:48 +0000 (10:21 +0100)]
Simplify use of fr_event_now
Alan T. DeKok [Mon, 30 Nov 2009 16:07:22 +0000 (17:07 +0100)]
Fix build problem
Alan T. DeKok [Mon, 30 Nov 2009 12:58:49 +0000 (13:58 +0100)]
Print out more useful debugging messages
Rather than
rlm_ldap: ...
do
[foo] ...
Which prints out the instance name in a slightly better format
Alan T. DeKok [Mon, 30 Nov 2009 09:05:37 +0000 (10:05 +0100)]
Cleanups and simplifications.
The FD_SET is now calculated in the event_loop() function,
making it harder to get it wrong.
fr_event_now() ALWAYS returns a time, calling gettimeofday()
if necessary
Alan T. DeKok [Mon, 30 Nov 2009 08:14:27 +0000 (09:14 +0100)]
Clean up "dead" child if there's no thread associated with the request
Alan T. DeKok [Sun, 29 Nov 2009 15:07:23 +0000 (16:07 +0100)]
Clean up state machine.
This error happens when "max_request_time" is set VERY low.
i.e. lower than "response_window". (12s versus 30s).
The current logic for enforcing the various timers is pretty bad. There
is one timer per request, and it bounces around between the different
requirements. At the time it was written, it seemed simpler than trying
to manage 3-4 simultaneous timers per request.
When the request is proxied, the timer being applied is for
"response_window". BUT by the time that expires, the "max_request_time"
has expired. The code *does* notice that it has expired. BUT it doesn't
notice that there's no child thread processing the request. So it waits
for the child thread to exit... forever.
At some point, a timer overflows, and it dies.
There are a few changes to make:
1) check for "no child" in this situation, and clean up the request rather
than waiting forever.
2) cap the timer to 5 minutes (this can still happen, for example, when a
bad DB locks a thread for hours at a time).
3) don't overflow when adding timer values.
Alan T. DeKok [Fri, 27 Nov 2009 14:58:58 +0000 (15:58 +0100)]
L_INFO, "PROXY:... --> L_PROXY, "...
Simplifies and regularizes the log messages
Alan T. DeKok [Fri, 27 Nov 2009 12:01:06 +0000 (13:01 +0100)]
Fix typo
Alan T. DeKok [Fri, 27 Nov 2009 11:07:25 +0000 (12:07 +0100)]
Initialize timers for Status-Server
For some weird reason they weren't initialized in debugging mode,
so we force it here. This WAS tested to work... so I have no idea
why it stopped.
We also ignore Status-Server packets when marking home_servers as
alive. That way, the ping_check will work properly...
Alan T. DeKok [Fri, 27 Nov 2009 10:53:29 +0000 (11:53 +0100)]
Use new home_server_find API
Alan T. DeKok [Fri, 27 Nov 2009 10:47:56 +0000 (11:47 +0100)]
Add tcp/udp to CLI for home_servers
Alan T. DeKok [Thu, 26 Nov 2009 18:10:44 +0000 (19:10 +0100)]
Remove erroneous handling of option 82
Alan T. DeKok [Thu, 26 Nov 2009 17:37:13 +0000 (18:37 +0100)]
Try to force libltdl non-install
Alan T. DeKok [Thu, 26 Nov 2009 17:16:00 +0000 (18:16 +0100)]
Change some DEBUG to radlog
So that interesting state changes / internal events will get
logged
Alan T. DeKok [Thu, 26 Nov 2009 13:24:30 +0000 (14:24 +0100)]
Log more messages, rather than just doing debug with them
Alan T. DeKok [Sun, 22 Nov 2009 15:56:14 +0000 (16:56 +0100)]
Print names for unsupported eap types