From: Alan T. DeKok <aland@freeradius.org>
Date: Fri, 28 Jul 2017 16:53:46 +0000 (-0400)
Subject: notes on what to do for finishing the module
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c8df5c8552c186f44fad1cfadf7f6a60eaaa2461;p=thirdparty%2Ffreeradius-server.git

notes on what to do for finishing the module
---

diff --git a/src/modules/rlm_radius/TODO.md b/src/modules/rlm_radius/TODO.md
new file mode 100644
index 00000000000..fba4d0f774b
--- /dev/null
+++ b/src/modules/rlm_radius/TODO.md
@@ -0,0 +1,75 @@
+# rlm_radius
+
+## Multiple connections
+
+rlm_radius_udp.c now has one connection, in `c->active`, which is an
+`fr_dlist_t`.  That needs to be moved to a heap, ordered by (1)
+most-recently active (i.e. most recent sent packet that had a
+response), followed by (2) number of free IDs.
+
+When we need a connection, we pop it from the heap.  Allocate an ID,
+and push it back to the heap.
+
+When we get a reply, we grab the connection, check / update
+`last_sent_with_reply`, free the ID (unless it's Status-Server ping
+checks), and extract / insert the connection back into the heap.
+
+When the packet times out, we just free the ID (unless it's
+Status-Server ping checks), and extract / insert the connection back
+into the heap.
+
+We need to extract / insert because it's location may have changed...
+
+We *probably* want to keep one connection "full", if at all possible.
+i.e. the heap should prefer connections with *fewer* free IDs.
+... unless we're using extended ID, in which was we always pick an
+active connection.  i.e. one that's writable.
+
+The "full" connections should be on a *separate* heap, or maybe a
+`fr_dlist_t`.  The extract / insert connection work needs to be done
+in it's own function, because it's mostly magic, and needs to be done
+in multiple places.
+
+## Packet retransmission timers
+
+Via similar code to v3.  See references to "jitter" and "mrt / irt /
+mrc" in process.c in v3.
+
+## Connection status management
+
+Mark a connection live / dead / zombie based on packet retransmission
+timers.  Set / do Status-Server checks as necessary.
+
+
+## Type = Access-Request checking
+
+Which (if set) limits the outbound packet types mainly so that we can
+fail int the module instead of not getting a reply from the home
+server and it mirrors the old configuration.
+
+This also allows us to parse "Access-Request { ... }" sub-sections
+only if there's an Access-Request.  i.e. we only get the debug output
+for the various timers if they're needed.
+
+see `rlm_radius.h`, retransmission intervals are in:
+
+`rlm_radius_retry_t	packets[FR_MAX_PACKET_CODE];`
+
+## status_check = Status-Server
+
+add status_check = Status-Server or Access-Request, ala old code
+
+The main issue here is the ID allocation... If this is set, then we
+need to reserve one ID via `rr_track_alloc()` for the status-server
+check.  Then use that ID if there are no responses to packets.
+
+We should also allow `status_check = auto`, which picks it up from the
+list of allowed packet types.  We then need to require config for
+username / password, for Access-Request, and just username for
+Accounting-Request.
+
+## Replication (i.e. not proxying)
+
+allow for "no reply" proxying, where we don't care about getting the reply
+i.e. we still drain the socket, we just don't do anything with the replies
+
diff --git a/src/modules/rlm_radius/rlm_radius.c b/src/modules/rlm_radius/rlm_radius.c
index 15a4fb9c9e8..da8aa0a5cf1 100644
--- a/src/modules/rlm_radius/rlm_radius.c
+++ b/src/modules/rlm_radius/rlm_radius.c
@@ -1,12 +1,3 @@
-// * add 'type = Access-Request' checking.  Which (if set) limits the outbound packet types
-//   - mainly so that we can fail here instead of not getting a reply from the home server
-//   - and it mirrors the old configuration
-//   - which allows us to parse "Access-Request { ... }" sub-sections only if there's an Access-Request
-// * add status_check = Status-Server or Access-Request, ala old code
-// * allow for "no reply" proxying, where we don't care about getting the reply
-//   - i.e. we still drain the socket, we just don't do anything with the replies
-// * allow for PCAP interfaces in proto_radius, so we can sniff the network and proxy RADIUS packets...
-
 /*
  *   This program is is free software; you can redistribute it and/or modify
  *   it under the terms of the GNU General Public License as published by
diff --git a/src/modules/rlm_radius/rlm_radius_udp.c b/src/modules/rlm_radius/rlm_radius_udp.c
index 088a9e170af..c07deea2049 100644
--- a/src/modules/rlm_radius/rlm_radius_udp.c
+++ b/src/modules/rlm_radius/rlm_radius_udp.c
@@ -1,10 +1,3 @@
-// @todo - allow for multiple connections
-// * connections have to be in a heap, sorted by most recently sent with reply, followed by # of free packets
-// * need to add zombie connections in a zombie list, so that "dead" ones aren't used for new packets
-// * need to check if a connection is zombie, and if so, move it to the zombie list
-// * add packet retransmission timers
-// * add status-server checks
-
 /*
  *   This program is is free software; you can redistribute it and/or modify
  *   it under the terms of the GNU General Public License as published by