gmane.comp.freeradius.devel

Commit report for master branch

The git bot — 2013-05-17T22:00:07

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server)

======
A better way of getting empty alternations

Alan T. DeKok< at >2013-05-17T17:26:06Z
Files modified:
* src/main/xlat.c

Commit diff:
https://github.com/FreeRADIUS/freeradius-server/commit/25b6fdd66ac5144610e805d6476b4286c09e9a04
======

Re: More additions to unlang

Arran Cudbard-Bell — 2013-05-17T15:47:15

On 17 May 2013, at 08:33, Alan DeKok <aland< at >deployingradius.com> wrote:


*sigh*, please no, no pointless variations, this isn't Perl.


and the new xlat parser may eventually allow pre-compilation of static expressions so the performance hit should go down significantly.

Arran Cudbard-Bell <a.cudbardb< at >freeradius.org>
FreeRADIUS Development Team

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html

Re: ASSERT FAILED

Maja Wolniewicz — 2013-05-17T14:13:38

W dniu 16.05.2013 23:44, Alan DeKok pisze:
Today with last git version the sever dies while parsing it.

Maja

Re: More additions to unlang

Alan DeKok — 2013-05-17T12:33:13

  Yeah.


  That's hard.  Mostly because the configuration file parser is bad.


  Hmm... that may be easier to do.


  Sure... but regex matches work for now.

  Alan DeKok.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html

Re: More additions to unlang

Jakob Hirsch — 2013-05-17T08:05:44

Alan DeKok, 16.05.2013 23:51:

Is there any difference (functional or performance-wise) between this
and the previously posted form with the ampersand, i.e. "if
(&Session-Timeout < ..."?


So it seem there's quite a lot of good stuff coming :)

Btw, if you are still looking for more ideas, what about this:

- ternary logic, like C's "condition ? yes : no"
This would save a bunch of lines, because instead of

if (some condition) {
  update reply {
    Some-Attribute := "foo"
    Session-Timeout := 600
  }
}
else {
  update reply {
    Some-Attribute := "bar"
    Session-Timeout := 600
  }
}

we could do a simple and short

update reply {
  Some-Attribute := (some condition) ? "foo" : "bar"
}

Not sure how easy this is to parse, though. Maybe something like
"%{cond ? true : false}" would be better.


- regex-like comparison operators
E.g. =^ and =$ would be true if the LHS starts/ends with the RHS string.
I.e.,

( "foobar" =^ "foo") -> true
( "foobar" =^ "bar") -> false
( "foobar" =$ "foo") -> false
( "foobar"

Re: More additions to unlang

Arran Cudbard-Bell — 2013-05-16T22:08:59

On 16 May 2013, at 17:51, Alan DeKok <aland< at >deployingradius.com> wrote:


The idea being that you can reference other things in your conditions
like environmental variables, or other configuration items and enable
or disable blocks of policy code.

Regular expressions should work too, as should all of the casting 
previously discussed.

The idea is to allow something like:

if (<cidr>$ENV{HOSTNAME} == 192.168/24) {
// slight variation in policy
} else if (<cidr>$ENV{hostname} == 172.0/24) {
// other slight variation in policy
}

or

if ($ENV{HOSTNAME} =~ /*.[.]cluster_x.example.org$/) {
// slight variation in policy
} else if ($ENV{hostname} =~ /*.[.]cluster_y.example.org$/) {
// other slight variation in policy
}

So if you're deploying the same OS image to multiple virtual machines
or multiple clusters, and require slight variations in policy, you can
now do that extremely efficiently.

HUP will cause the config to be re-read, re-parsed and so re-evaluate
all the pre-evaluated conditions.

Arran Cudba

Commit report for master branch

The git bot — 2013-05-16T22:00:02

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server)

======
'A' is a valid base64 character

Alan T. DeKok< at >2013-05-16T16:43:21Z
Files modified:
* src/lib/base64.c

Commit diff:
https://github.com/FreeRADIUS/freeradius-server/commit/d34c33d2b70e69eeefd4bae13e0195a8bbe28cb9
====== 
Tests for xlat output

Alan T. DeKok< at >2013-05-16T15:31:56Z
Files modified:
* src/include/parser.h
* src/main/radattr.c
* src/main/xlat.c
* src/tests/xlat.txt

Commit diff:
https://github.com/FreeRADIUS/freeradius-server/commit/e07b87d38abcb5fa4d3a23b1a7f924510cc72313
====== 
Save the parsed array reference

Alan T. DeKok< at >2013-05-16T15:31:38Z
Files modified:
* src/main/xlat.c

Commit diff:
https://github.com/FreeRADIUS/freeradius-server/commit/bf6e5b1c2ea2a13b137cdba7085531f9a67379c2
====== 
Allow RHS of xlat alternation to be empty

Alan T. DeKok< at >2013-05-16T15:06:03Z
Files modified:
* src/main/xlat.c
* src/tests/xlat.txt

Commit diff:
https://github.com/FreeRADIUS/freeradius-server/commit/

More additions to unlang

Alan DeKok — 2013-05-16T21:51:53

  The changes in today add "compile-time" validation, and evaluation of
static values.  For example:

 if (Session-Timeout < blue) {

  In v2, the server will start, and give run-time errors.

  In v3, the server will refuse to start, as "blue" is not a valid number.

  Even better, parts of the virtual servers can now be removed at start
time:

if (0) {
sql
ldap
}

  When the contents of a condition are statically equivalent to false
(e.g. 0), then the contents of the "if" block are completely ignored.
It lets you have conditional parts of the configuration, which have zero
run-time CPU or memory cost.

  Alan DeKok.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html

Re: ASSERT FAILED

Alan DeKok — 2013-05-16T21:44:42

  Hmm... I guess you'll have to use %{%{Operator-Name}:-}

  I'll make sure that works for v3.

  Alan DeKok.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html

Re: ASSERT FAILED

Maja Wolniewicz — 2013-05-16T12:42:23

W dniu 15.05.2013 18:40, Alan DeKok pisze:
I'm still having trouble with it. It works correctly when Operator-Name
is set, but
when Operator-Name is unset (it does not appear in  Access-Request packets)

${policy.cui_hash_key}%{tolower:%{User-Name}}%{Operator-Name}

where cui_hash_key is changeme, User-Name is someone< at >somewhere

is expanded as changemesomeone< at >somewere_

expand: 'changeme%{tolower:%{User-Name}}%{Operator-Name}' ->
'changemesomeone< at >somewere_'

the same is when I have
${policy.cui_hash_key}%{tolower:%{User-Name}}%{%{Operator-Name}:-aaa}
expand: 'changeme%{tolower:%{User-Name}}%{%{Operator-Name}:-aaa}' ->
'changemesomeone< at >somewere_'

It seems that Operator-Name is set then to _

Maja

Commit report for master branch

The git bot — 2013-05-15T22:00:07

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server)

======
A more robust way of statically removing "if (false)" sections

Alan T. DeKok< at >2013-05-15T18:07:04Z
Files modified:
* src/main/modules.c

Commit diff:
https://github.com/FreeRADIUS/freeradius-server/commit/4bc3e552b5e4f6b218ec1294ceab26f2139533ca
====== 
Never mind... we'll get to this later

Alan T. DeKok< at >2013-05-15T17:25:00Z
Files modified:
* src/main/modules.c

Commit diff:
https://github.com/FreeRADIUS/freeradius-server/commit/4c0eba986561c0a0c97235c8b6dcc790d7aa1127
====== 
Minor fixes

Alan T. DeKok< at >2013-05-15T16:20:05Z
Files modified:
* src/main/modules.c

Commit diff:
https://github.com/FreeRADIUS/freeradius-server/commit/7f01740fdc2f56ac600b43bff12ef63e135f9243
====== 
Ignore subsections which statically evaluate to "false"

So that large swaths of the configuration can be taken out
of the configuration with zero run-time memory or CPU impact

Alan T. DeKok< at >2013-05-15T16:13:33Z
Files modified:
* src/m

Re: rad_unlockfd

Alan DeKok — 2013-05-15T17:51:49

..

  OK.


  That sounds right, IIRC.


  OK.

  Alan DeKok.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html

Re: ASSERT FAILED

Alan DeKok — 2013-05-15T16:40:29

  Yes.

  Alan DeKok.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html

Re: ASSERT FAILED

Arran Cudbard-Bell — 2013-05-15T16:39:36

On 15 May 2013, at 12:35, Jakob Hirsch <jh< at >plonk.de> wrote:


Yes.

Arran Cudbard-Bell <a.cudbardb< at >freeradius.org>
FreeRADIUS Development Team

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html

Re: ASSERT FAILED

Jakob Hirsch — 2013-05-15T16:35:18

Alan DeKok, 15.05.2013 15:27:

So the OP's assignment

"%{md5:${policy.cui_hash_key}%{tolower:%{User-Name}}%{%{Operator-Name}:-}}"

could simply rewritten to this?

"%{md5:${policy.cui_hash_key}%{tolower:%{User-Name}}%{Operator-Name}}"


Oh, ok, I wasn't aware if this.

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html

Re: fork() after pthread_mutex_init()

Alan DeKok — 2013-05-15T13:33:06

  That's nice.


  Ah.  The simple answer is "don't do that".  Having layers of competing
library dependencies is wrong.

  Alan DeKok.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html

Re: ASSERT FAILED

Alan DeKok — 2013-05-15T13:27:55

  Yes.


  Nothing.

  But %{%{Foo-Bar}:-} is redundant.  It says "If there's no Foo-Bar,
then use an empty string.  But if there's no Foo-Bar, the result of a
%{} expansion *is* an empty string.


  The change was made deliberately, and to avoid bugs.  In shell,
variable names can't have colons.  In FreeRADIUS modules, they can.

  e.g. this is ambiguous:

  %{module:-foo:-bar}

  Is "-foo" a parameter to "module"?

  This is not ambiguous:

  %{%{module:-foo}:-bar}

  As a result, this behavior will remain in v3.  Anyone wanting to see
more cases of what works and what doesn't can read src/tests/xlat.txt

  Alan DeKok.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html

Re: MODULE DEV: Problem adding an attribute to access-accept message

Ivan Ostres — 2013-05-15T12:11:07

Thank you all for suggestions and help. It appears problem was a cast I 
was doing before creating pair. It works now just fine.

Thanks again,
iostres
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html

Re: MODULE DEV: Problem adding an attribute to access-accept message

Linux Chips — 2013-05-15T12:03:01

not sure about "pairmake_reply", i still use the 2.1.x release. what i 
normally do is something like

VALUE_PAIR *pair;
pair = radius_paircreate(request, &request->reply->vps, 
PW_IDLE-TIMEOUT/*not sure about the spelling*/, PW_TYPE_INTEGER);
pair->vp_integer = 10;

how can you tell there are no "Idle-Timeout" in the packet? i see you 
are using the += operator (T_OP_ADD), you maybe adding a duplicate pair 
and your NAS is considering the first one. i suggest you use wireshark 
to verify. and consider using the set operator := (T_OP_SET) instead.


-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html

Re: ASSERT FAILED

Jakob Hirsch — 2013-05-15T10:59:10

Alan DeKok, 13.05.2013 18:30:

I may be missing something here, but aren't unset attributes just
expanded to an empty string? If so, what is difference between the
outcome of
  %{%{Unset-Attribute}:-""}
and a simple
  %{Unset-Attribute}
?


Oh, and btw: As the :- syntax is copied from Unix shells, shouldn't it
just be "%{Attribute-Name:-attribute not set}", i.e. without additional
"%{}"? In shells it's "${VARNAME:-VARNAME is empty}", not "${${VAR}:-VAR
is empty}" (except if you have stored a variable name VAR, of course).
Using :- with a static string doesn't make much sense, so the extra %{}
is kind of redundant. But I guess it's too late for such a change now
(maybe not for 3.0).



Regards
Jakob
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html

Re: MODULE DEV: Problem adding an attribute to access-accept message

Ivan Ostres — 2013-05-15T10:21:36

Yes, I tried that also...no change. I even tried with ones in rlm_example:

         pairmake_reply("Reply-Message", "This is a challenge", T_OP_EQ);
         pairmake_reply("State", "0", T_OP_EQ);

but still no attributes in access-accept.

BR,
iostres
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html