Alan T. DeKok [Thu, 1 Jan 2026 17:11:21 +0000 (12:11 -0500)]
create $(fork-bg ) function and glue it into the build system.
which mostly works, sort of.
It allows environent variables to be passed in. It parses the
command-line options, including quoted strings.
But the interaction with GNU make is somewhat lacking.
changing src/tests/radiusd.mk to use it shows some oddities.
* we have to use $$(fork-bg ...) there, in order to delay the
running of the fork until the target rule is run, not when the
function is defined
* radiusd needs to get passed '-r', so that it reads from stdin for
radmin. And therefore when make exits, the input pipe should be
closed, and (after the recent radmin changes), radiusd exits.
Note that we must use pipe() and not socketpair(). A socketpair
is a unix socket which sticks around after the process has
exited. In contrast, a pipe() is closed then the parent process
exits.
* we can see if the exec failed, but we can't see if the program
later exited with an error. This could perhaps be fixed by
adding another function $(fork-running KEY). which would have
to check if the stdout socket was writeable, and try to write
one byte to it? if we get ECONNRESET, then we know that the
program has exited.
* $(fork-bg returns immediately, and not when the program is
fully functional. This means that radclient runs right away,
even before the server is ready. We should probably update the
code to read data from the program. If we can get at least one
byte of data, then the program must be running. If the read
fails, then it's likely that the program has exited.
It's not clear right now how to add in those checks in a way that
is both easy to understand, and easy to implement in some gnu make
framework.
Perhaps we could push the tests over to a child thread, and have
it select(max,NULL,NULL,errorfds) to see if the socket has gone
away. Than, it could flag the internal memory structure as
"child exited".
But that then doesn't provide a way for it to send some kind of
signal back to Make, so that it can run something which catches
the "failed to start program" error case.
Alan T. DeKok [Fri, 2 Jan 2026 00:31:49 +0000 (19:31 -0500)]
allow radmin to read/write to the console
if we're not running in debug mode, the various log APIs close
stdin/stdout/stderr in order to prevent exec'd programs from
mangling them. However, this operation also mangles the file
descriptors which are needed by radmin.
So we dup the file descriptors, and tell radmin / readline to use
the new ones.
Alan T. DeKok [Tue, 30 Dec 2025 16:29:25 +0000 (11:29 -0500)]
rename "is_oid_leaf" to "leaf"
which is less confusing.
The "leaf" property means that when we're encoding a nested set
of attributes, we encode the OIDs until we hit one which has the
"leaf" property set. We then encode the OID of this attribute,
along with its value.
These are required by the server, but unfortunately due to the number of cross-dependencies, it's very hard to separate them, and at the moment installing something like freeradius-utils, pulls in the main daemon too.
Alan T. DeKok [Mon, 29 Dec 2025 19:10:40 +0000 (14:10 -0500)]
add "root" refs to FR_TYPE_ATTR
and use in DER. The "root" ref is to the OID tree, and is largely
a work-around for the fact that the OIDs are not in their own
dictionary.
We also update the value-box code to get the correct enumv, and
then that lets the tests both drop any "OID-Tree" prefix from the
expected output, and also updates the "can't find OID" message to
refer to "OID-Tree" instead of the DER root.
Also add aliases in the DER root from "iso" to "OID-Tree.iso",
so that we the parser doesn't need to know anything about the enums
for FR_TYPE_ATTR
Alan T. DeKok [Mon, 29 Dec 2025 12:21:40 +0000 (07:21 -0500)]
allow some groups to print attributes as "flat"
For now, we add a special attribute flag "allow_flat", which
causes the attributes to be printed as a flat list. But only when
there is only one child. e.g. when we have:
Vendor-Specific = { Cisco = { AVPair = 1 } }
we can now sometimes print it as
Vendor-Specific.Cisco.AVPair = 1
for now, this is only done for attributes of type 'group', in order
to support the DER code. We don't change the output for all
protocols, as doing so would involve a lot of changes to the tests.
The different output may also confuse the average admin, who would
sometimes see nested attributes, and sometimes flat ones, for no
apparent reason.
The parser has already been updated to take a flat definition
(as above), and create the fully nested version.
Alan T. DeKok [Thu, 25 Dec 2025 18:45:16 +0000 (13:45 -0500)]
add function to decode IP addresses from network
which takes more arguments than the mroe generic function
fr_value_box_from_network(). This flexibility makes it useful
for protocols which do not have a "standard" way to encode IP
addresses / prefixes
Alan T. DeKok [Thu, 25 Dec 2025 13:05:04 +0000 (08:05 -0500)]
limit the "name2" for update sections in modules
since we no longer support full-featured "update" sections, there
is no point in supporting full paths (outer, parent, etc.) in
update sections. Plus, none of the modules use them.
So rather than either confusing the admin, or allowing them to do
something which might not work, we just return a compile-time
error.
The deleted code was also the only code (other then tests) that
called tmpl_request_ref_list_afrom_substr(). This cleanup will
allow us to fix the tmpl code for ""flat" groups