pax_global_header00006660000000000000000000000064152235260520014514gustar00rootroot0000000000000052 comment=3bb5d93a9ef0451b44ea8fca3c2ad2be8fab1e34 freeradius-3.2.10+dfsg/000077500000000000000000000000001522352605200146475ustar00rootroot00000000000000freeradius-3.2.10+dfsg/.gitattributes000066400000000000000000000001411522352605200175360ustar00rootroot00000000000000* text=auto * ident *.h linguist-language=c *.c linguist-language=c doc/* linguist-documentation freeradius-3.2.10+dfsg/.github/000077500000000000000000000000001522352605200162075ustar00rootroot00000000000000freeradius-3.2.10+dfsg/.github/workflows/000077500000000000000000000000001522352605200202445ustar00rootroot00000000000000freeradius-3.2.10+dfsg/.github/workflows/ci-deb.yml000066400000000000000000000154361522352605200221230ustar00rootroot00000000000000name: CI DEB on: push: branches-ignore: - coverity_scan pull_request: env: DEBIAN_FRONTEND: noninteractive CC: gcc jobs: deb-build: strategy: matrix: env: - { NAME: "ubuntu-20.04", OS: "ubuntu:20.04" } - { NAME: "ubuntu-22.04", OS: "ubuntu:22.04" } - { NAME: "ubuntu-24.04", OS: "ubuntu:24.04" } - { NAME: "ubuntu-26.04", OS: "ubuntu:26.04" } - { NAME: "debian-11", OS: "debian:bullseye" } - { NAME: "debian-12", OS: "debian:bookworm" } - { NAME: "debian-13", OS: "debian:trixie" } - { NAME: "debian-sid", OS: "debian:sid" } fail-fast: false runs-on: ubuntu-latest container: image: ${{ matrix.env.OS }} env: HOSTAPD_BUILD_DIR: /tmp/eapol_test.ci HOSTAPD_GIT_TAG: hostap_2_8 name: "DEB build" steps: - name: Package manager performance and stability improvements run: | if [ -f "/etc/apt/sources.list" ]; then sed -i 's/deb.debian.org/debian-archive.trafficmanager.net/' /etc/apt/sources.list sed -i 's/archive.ubuntu.com/azure.archive.ubuntu.com/' /etc/apt/sources.list fi echo 'Acquire::Retries "10";' > /etc/apt/apt.conf.d/80-retries echo 'force-unsafe-io' > /etc/dpkg/dpkg.cfg.d/02speedup echo 'man-db man-db/auto-update boolean false' | debconf-set-selections apt-get update - name: Install recent git run: | apt-get install -y --no-install-recommends git-core ca-certificates - uses: actions/checkout@v6 with: path: freeradius - name: Prepare filesystem run: | pwd ls -la mkdir debs ls -la - name: Install build dependencies run: | apt-get install -y --no-install-recommends build-essential devscripts quilt equivs procps fakeroot touch -t 202001010000 debian/control debian/rules debian/control mk-build-deps -irt"apt-get -y" debian/control working-directory: freeradius - name: Show versions run: | $CC --version make --version krb5-config --all || : openssl version - name: Build DEBs run: | make deb working-directory: freeradius - name: Collect DEBs run: | mv *.deb debs/ - name: Restore eapol_test build directory from cache uses: actions/cache@v5 id: hostapd-cache with: path: ${{ env.HOSTAPD_BUILD_DIR }} key: hostapd-${{ matrix.env.NAME }}-${{ env.HOSTAPD_GIT_TAG }}-v1 # Debian sid defaults to gcc12 which fails to build eapol_test - name: Install GCC 11 for eapol_test build run: | apt-get install -y --no-install-recommends gcc-11 update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-11 60 && update-alternatives --set gcc /usr/bin/gcc-11 if: ${{ matrix.env.OS == 'debian:sid' }} - name: Build eapol_test run: | apt-get install -y libnl-3-dev libnl-genl-3-dev scripts/ci/eapol_test-build.sh mv scripts/ci/eapol_test/eapol_test ../debs working-directory: freeradius - name: Store DEBs uses: actions/upload-artifact@v6 with: name: debs-${{ matrix.env.NAME }} path: debs # # If the CI has failed and the branch is ci-debug then start a tmate # session. SSH rendezvous point is emited continuously in the job output. # - name: "Debug: Package dependancies for tmate" run: | apt-get install -y --no-install-recommends xz-utils if: ${{ github.ref == 'refs/heads/ci-debug' && failure() }} - name: "Debug: Start tmate" uses: mxschmitt/action-tmate@v3 with: limit-access-to-actor: true sudo: false if: ${{ github.ref == 'refs/heads/ci-debug' && failure() }} deb-test: needs: - deb-build strategy: matrix: env: - { NAME: "ubuntu-20.04", OS: "ubuntu:20.04" } - { NAME: "ubuntu-22.04", OS: "ubuntu:22.04" } - { NAME: "ubuntu-24.04", OS: "ubuntu:24.04" } - { NAME: "ubuntu-26.04", OS: "ubuntu:26.04" } - { NAME: "debian-11", OS: "debian:bullseye" } - { NAME: "debian-12", OS: "debian:bookworm" } - { NAME: "debian-13", OS: "debian:trixie" } - { NAME: "debian-sid", OS: "debian:sid" } fail-fast: false runs-on: ubuntu-latest container: image: ${{ matrix.env.OS }} name: "DEB install test" steps: - name: Load DEBs uses: actions/download-artifact@v8 with: name: debs-${{ matrix.env.NAME }} - name: Package manager performance improvements run: | if [ -f "/etc/apt/sources.list" ]; then sed -i 's/deb.debian.org/debian-archive.trafficmanager.net/' /etc/apt/sources.list sed -i 's/archive.ubuntu.com/azure.archive.ubuntu.com/' /etc/apt/sources.list fi echo force-unsafe-io > /etc/dpkg/dpkg.cfg.d/02speedup echo 'man-db man-db/auto-update boolean false' | debconf-set-selections apt-get update # For pkill and strings - name: Install procps and binutils run: | apt-get update apt-get install -y --no-install-recommends procps binutils - name: Install DEBs run: | find . -maxdepth 1 -name '*.deb' | xargs apt-get install -y --no-install-recommends - name: Config test run: | freeradius -XxC # # We now perform some post-install tests that depend on the availability # of the source tree # - name: Install pre-built eapol_test run: | apt-get install -y libssl1.? libdbus-1-? libnl-3-200 libnl-genl-3-200 mv eapol_test /usr/local/bin chmod +x /usr/local/bin/eapol_test - uses: actions/checkout@v6 with: path: freeradius - name: Run the post-install test target run: | echo "top_builddir := $(pwd)" > Make.inc make -C src/tests/ OPENSSL_LIBS=1 EAPOL_TEST_BIN="$(which eapol_test)" $(pwd)/build/tests/eapol_test/eapol_test.mk make -f scripts/ci/package-test.mk package-test working-directory: freeradius - name: Upload radius logs on failure if: ${{ failure() }} uses: actions/upload-artifact@v6 with: name: radius-logs-${{ matrix.env.NAME }}.tgz path: | /var/log/freeradius freeradius/build/tests/eapol_test # # See above comments for tmate # - name: "Debug: Package dependancies for tmate" run: | apt-get install -y --no-install-recommends xz-utils if: ${{ github.ref == 'refs/heads/ci-debug' && failure() }} - name: "Debug: Start tmate" uses: mxschmitt/action-tmate@v3 with: limit-access-to-actor: true sudo: false if: ${{ github.ref == 'refs/heads/ci-debug' && failure() }} freeradius-3.2.10+dfsg/.github/workflows/ci-rpm.yml000066400000000000000000000212721522352605200221620ustar00rootroot00000000000000name: CI RPM on: push: branches-ignore: - coverity_scan pull_request: env: CC: gcc jobs: rpm-build: strategy: matrix: env: - { NAME: "rocky-8", OS: "rockylinux/rockylinux:8" } - { NAME: "rocky-9", OS: "rockylinux/rockylinux:9" } - { NAME: "rocky-10", OS: "rockylinux/rockylinux:10" } fail-fast: false runs-on: ubuntu-latest container: image: ${{ matrix.env.OS }} env: HOSTAPD_BUILD_DIR: /tmp/eapol_test.ci HOSTAPD_GIT_TAG: hostapd_2_8 name: "RPM build" steps: - name: Install distro git for Rocky. if: ${{ startsWith(matrix.env.NAME, 'rocky-') }} run: | dnf install -y git-core - uses: actions/checkout@v6 with: path: freeradius - name: Prepare filesystem run: | pwd ls -la mkdir rpms ls -la - name: LTB repo for Rocky Linux 8 if: ${{ matrix.env.NAME == 'rocky-8' }} run: | echo '[ltb-project]' > /etc/yum.repos.d/ltb-project.repo echo 'name=LTB project packages' >> /etc/yum.repos.d/ltb-project.repo echo 'baseurl=https://ltb-project.org/rpm/$releasever/$basearch' >> /etc/yum.repos.d/ltb-project.repo echo 'enabled=1' >> /etc/yum.repos.d/ltb-project.repo echo 'gpgcheck=1' >> /etc/yum.repos.d/ltb-project.repo echo 'gpgkey=https://www.ltb-project.org/documentation/_static/RPM-GPG-KEY-LTB-project' >> /etc/yum.repos.d/ltb-project.repo rpm --import https://www.ltb-project.org/documentation/_static/RPM-GPG-KEY-LTB-project - name: Enable EPEL for Rocky Linux if: ${{ startsWith(matrix.env.NAME, 'rocky-') }} run: | dnf install -y epel-release - name: Enable PowerTools on Rocky 8. if: ${{ matrix.env.NAME == 'rocky-8' }} run: | dnf install -y yum-utils dnf config-manager --enable PowerTools || : dnf config-manager --enable powertools || : - name: Enable Code Ready Builer on Rocky 9 / 10. if: ${{ matrix.env.NAME == 'rocky-9' || matrix.env.NAME == 'rocky-10' }} run: | dnf install -y yum-utils dnf config-manager --enable crb - name: Install common tools run: | dnf install -y \ bzip2 \ gcc \ make \ perl \ rpm-build \ yum-utils # # We just patch the SPEC file for Fedora since we want to use the standard # make rpm target which wants to build with LDAP. # - name: Disable rlm_ldap on Fedora (no LTB packages) if: ${{ startsWith(matrix.env.NAME, 'fedora-') }} run: | sed -ie 's/%bcond_without ldap/%global _without_ldap: 1/' freeradius/redhat/freeradius.spec - name: Install build dependencies run: | dnf builddep -y freeradius/redhat/freeradius.spec # # It has been observed that sometimes not all the dependencies are # installed on the first go. Give it a second chance. # - name: Second run of install build dependencies run: | dnf builddep -y redhat/freeradius.spec working-directory: freeradius - name: Show versions run: | $CC --version make --version krb5-config --all || : openssl version # For pkill and ps - name: Enable procps-ng on Rocky if: ${{ startsWith(matrix.env.NAME, 'rocky-') }} run: | dnf install -y procps-ng - name: Build RPMs run: | [ -r /opt/rh/devtoolset-8/enable ] && source /opt/rh/devtoolset-8/enable || : ./configure make rpm working-directory: freeradius - name: Collect RPMs run: | mv freeradius/rpmbuild/RPMS/x86_64/*.rpm rpms/ - name: Restore eapol_test build directory from cache uses: actions/cache@v5 id: hostapd-cache with: path: ${{ env.HOSTAPD_BUILD_DIR }} key: hostapd-${{ matrix.env.NAME }}-${{ env.HOSTAPD_GIT_TAG }}-v1 - name: Build eapol_test run: | dnf install -y libnl3-devel which [ -r /opt/rh/devtoolset-8/enable ] && source /opt/rh/devtoolset-8/enable || : scripts/ci/eapol_test-build.sh mv scripts/ci/eapol_test/eapol_test ../rpms/ working-directory: freeradius - name: Store RPMs uses: actions/upload-artifact@v6 with: name: rpms-${{ matrix.env.NAME }} path: rpms # # If the CI has failed and the branch is ci-debug then start a tmate # session. SSH rendezvous point is emited continuously in the job output. # - name: "Debug: Package dependancies for tmate" run: | dnf install -y xz ln -s /bin/true /bin/apt-get if: ${{ github.ref == 'refs/heads/ci-debug' && failure() }} - name: "Debug: Start tmate" uses: mxschmitt/action-tmate@v3 with: limit-access-to-actor: true sudo: false if: ${{ github.ref == 'refs/heads/ci-debug' && failure() }} rpm-test: needs: - rpm-build strategy: matrix: env: - { NAME: "rocky-8", OS: "rockylinux/rockylinux:8" } - { NAME: "rocky-9", OS: "rockylinux/rockylinux:9" } - { NAME: "rocky-10", OS: "rockylinux/rockylinux:10" } fail-fast: false runs-on: ubuntu-latest container: image: ${{ matrix.env.OS }} name: "RPM install test" steps: - name: LTB repo for Rocky 8 if: ${{ matrix.env.NAME == 'rocky-8' }} run: | echo '[ltb-project]' > /etc/yum.repos.d/ltb-project.repo echo 'name=LTB project packages' >> /etc/yum.repos.d/ltb-project.repo echo 'baseurl=https://ltb-project.org/rpm/$releasever/$basearch' >> /etc/yum.repos.d/ltb-project.repo echo 'enabled=1' >> /etc/yum.repos.d/ltb-project.repo echo 'gpgcheck=1' >> /etc/yum.repos.d/ltb-project.repo echo 'gpgkey=https://www.ltb-project.org/documentation/_static/RPM-GPG-KEY-LTB-project' >> /etc/yum.repos.d/ltb-project.repo rpm --import https://www.ltb-project.org/documentation/_static/RPM-GPG-KEY-LTB-project - name: Enable EPEL for Rocky Linux if: ${{ startsWith(matrix.env.NAME, 'rocky-') }} run: | dnf install -y epel-release - name: Enable PowerTools on Rocky 8 if: ${{ matrix.env.NAME == 'rocky-8' }} run: | dnf install -y yum-utils dnf config-manager --enable PowerTools || : dnf config-manager --enable powertools || : - name: Enable Code Ready Builer on Rocky 9 / 10. if: ${{ matrix.env.NAME == 'rocky-9' || matrix.env.NAME == 'rocky-10' }} run: | dnf install -y yum-utils dnf config-manager --enable crb # For pkill - name: Enable procps-ng on Rocky if: ${{ startsWith(matrix.env.NAME, 'rocky-') }} run: | dnf install -y procps-ng - name: Load RPMs uses: actions/download-artifact@v8 with: name: rpms-${{ matrix.env.NAME }} - name: Install RPMs run: | dnf install -y *.rpm - name: Config check run: | radiusd -XxC # # We now perform some post-install tests that depend on the availability # of the source tree # - name: Install pre-built eapol_test run: | dnf install -y libnl3 make gdb which mv eapol_test /usr/local/bin chmod +x /usr/local/bin/eapol_test - uses: actions/checkout@v6 with: path: freeradius - name: Run the post-install test target run: | echo "top_builddir := $(pwd)" > Make.inc make -C src/tests/ OPENSSL_LIBS=1 EAPOL_TEST_BIN="$(which eapol_test)" $(pwd)/build/tests/eapol_test/eapol_test.mk make -f scripts/ci/package-test.mk package-test working-directory: freeradius - name: Upload radius logs on failure if: ${{ failure() }} uses: actions/upload-artifact@v6 with: name: radius-logs-${{ matrix.env.NAME }}.tgz path: | /var/log/radius freeradius/build/tests/eapol_test # # See above comments for tmate # - name: "Debug: Package dependancies for tmate" run: | dnf install -y xz ln -s /bin/true /bin/apt-get if: ${{ github.ref == 'refs/heads/ci-debug' && failure() }} - name: "Debug: Start tmate" uses: mxschmitt/action-tmate@v3 with: limit-access-to-actor: true sudo: false if: ${{ github.ref == 'refs/heads/ci-debug' && failure() }} freeradius-3.2.10+dfsg/.github/workflows/ci.yml000066400000000000000000000472141522352605200213720ustar00rootroot00000000000000name: CI on: push: branches-ignore: - coverity_scan pull_request: env: PANIC_ACTION: "gdb -batch -x raddb/panic.gdb %e %p 1>&0 2>&0" ALT_OPENSSL: "3.0.8" ALT_OPENSSL_PATH: "/old/3.0" CI: 1 GH_ACTIONS: 1 DEBIAN_FRONTEND: noninteractive APT_OPTS: "-y --no-install-recommends" LDAP_TEST_SERVER: 127.0.0.1 LDAP_TEST_SERVER_PORT: 3890 REST_TEST_SERVER: 127.0.0.1 REST_TEST_SERVER_PORT: 8080 REST_TEST_SERVER_SSL_PORT: 8443 SQL_MYSQL_TEST_SERVER: mariadb SQL_POSTGRESQL_TEST_SERVER: postgres ASAN_OPTIONS: symbolize=1 detect_leaks=1 detect_stack_use_after_return=1 LSAN_OPTIONS: fast_unwind_on_malloc=0:malloc_context_size=50 UBSAN_OPTIONS: print_stacktrace=1 jobs: pre-ci: runs-on: ubuntu-latest outputs: should_skip: ${{ steps.skip_check.outputs.should_skip }} selfhosted: ${{ github.repository_owner == 'FreeRADIUS' && '1' || '0' }} docker_prefix: ${{ github.repository_owner == 'FreeRADIUS' && 'docker.internal.networkradius.com/' || '' }} steps: - id: skip_check uses: fkirc/skip-duplicate-actions@master ci: needs: pre-ci if: ${{ needs.pre-ci.outputs.should_skip != 'true' }} runs-on: ${{ matrix.os.runs_on }} container: image: ${{ matrix.os.docker }} strategy: fail-fast: false matrix: os: # # runs_on - where GitHub will spin up the runner, either # "self-hosted", or the name of a GitHub VM image. # code - the name/version of the OS (for step evaluations below) # docker - the docker image name, if containers are being used # name - used in the job name only # - runs_on: "${{ needs.pre-ci.outputs.selfhosted == '1' && 'self-hosted' || 'ubuntu-24.04' }}" docker: "${{ needs.pre-ci.outputs.selfhosted == '1' && 'docker.internal.networkradius.com/self-hosted' || 'ubuntu:24.04' }}" name: "${{ needs.pre-ci.outputs.selfhosted == '1' && 'self' || 'gh' }}-ubuntu24" code: "ubuntu2404" env: - { CC: gcc, DO_BUILD: yes, LIBS_OPTIONAL: no, LIBS_ALT: no, REPRODUCIBLE: no, SANITIZER: no, BUILD_CFLAGS: "-DWITH_EVAL_DEBUG", NAME: linux-gcc-lean } - { CC: gcc, DO_BUILD: yes, LIBS_OPTIONAL: yes, LIBS_ALT: no, REPRODUCIBLE: no, SANITIZER: no, BUILD_CFLAGS: "-DWITH_EVAL_DEBUG", NAME: linux-gcc } - { CC: gcc, DO_BUILD: yes, LIBS_OPTIONAL: yes, LIBS_ALT: no, REPRODUCIBLE: yes, SANITIZER: no, BUILD_CFLAGS: "-DWITH_EVAL_DEBUG", NAME: linux-gcc-reproducible } - { CC: gcc, DO_BUILD: yes, LIBS_OPTIONAL: yes, LIBS_ALT: no, REPRODUCIBLE: no, SANITIZER: no, BUILD_CFLAGS: "-DWITH_EVAL_DEBUG -O2 -g3", NAME: linux-gcc-O2-g3 } - { CC: clang, DO_BUILD: yes, LIBS_OPTIONAL: no, LIBS_ALT: no, REPRODUCIBLE: no, SANITIZER: no, BUILD_CFLAGS: "-DWITH_EVAL_DEBUG", NAME: linux-clang-lean } - { CC: clang, DO_BUILD: yes, LIBS_OPTIONAL: yes, LIBS_ALT: no, REPRODUCIBLE: no, SANITIZER: no, BUILD_CFLAGS: "-DWITH_EVAL_DEBUG", NAME: linux-clang } - { CC: clang, DO_BUILD: yes, LIBS_OPTIONAL: yes, LIBS_ALT: yes, REPRODUCIBLE: no, SANITIZER: no, BUILD_CFLAGS: "-DWITH_EVAL_DEBUG", NAME: linux-clang-altlibs } - { CC: clang, DO_BUILD: yes, LIBS_OPTIONAL: yes, LIBS_ALT: no, REPRODUCIBLE: yes, SANITIZER: no, BUILD_CFLAGS: "-DWITH_EVAL_DEBUG", NAME: linux-clang-reproducible } - { CC: clang, DO_BUILD: yes, LIBS_OPTIONAL: yes, LIBS_ALT: no, REPRODUCIBLE: no, SANITIZER: yes, BUILD_CFLAGS: "-DWITH_EVAL_DEBUG", NAME: linux-clang-sanitizer } - { CC: clang, DO_BUILD: yes, LIBS_OPTIONAL: yes, LIBS_ALT: no, REPRODUCIBLE: no, SANITIZER: no, BUILD_CFLAGS: "-DWITH_EVAL_DEBUG -O2 -g3", NAME: linux-clang-O2-g3 } env: ${{ matrix.env }} # Test names are used in the branch protection rules in GitHub # If you change the names here, or add additional matrix entries, you # must also amend the branch protection fules. name: "v3.2.x-${{ matrix.os.name }}-${{ matrix.env.NAME }}" # The standard GitHub environment contains PostgreSQL and # MySQL already. However when running on hosted GitHub runners # we need to run separate database containers to provide these. services: mariadb: image: ${{ needs.pre-ci.outputs.docker_prefix }}mariadb env: MARIADB_ALLOW_EMPTY_ROOT_PASSWORD: yes ports: - 3306:3306 options: --health-cmd="mariadb-admin ping" --health-interval 10s --health-timeout 5s --health-retries 10 postgres: image: ${{ needs.pre-ci.outputs.docker_prefix }}postgres env: POSTGRES_HOST_AUTH_METHOD: trust ports: - 5432:5432 options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5 steps: - name: Self-hosted runner container fixes run: | ln -fs /usr/bin/env /usr/local/bin/sudo rm -rf "$HOME"/* - name: Package manager performance improvements run: | sudo sh -c 'echo force-unsafe-io > /etc/dpkg/dpkg.cfg.d/02speedup' if command -v mandb >/dev/null; then echo 'man-db man-db/auto-update boolean false' | sudo debconf-set-selections sudo dpkg-reconfigure man-db fi - name: Freshen APT repo metadata run: | sudo apt-get update - name: Install common build dependencies run: | sudo apt-get install ${APT_OPTS} \ autoconf \ build-essential \ debhelper \ devscripts \ dh-make \ fakeroot \ firebird-dev \ freetds-dev \ gawk \ git \ git-lfs \ gnupg \ libcap-dev \ libcollectdclient-dev \ libcurl4-openssl-dev \ libgdbm-dev \ libhiredis-dev \ libidn11-dev \ libiodbc2 \ libiodbc2-dev \ libjson-c-dev \ libkqueue-dev \ libkrb5-dev \ libldap2-dev \ libmemcached-dev \ libmysqlclient-dev \ libnl-3-dev \ libnl-genl-3-dev \ libpam0g-dev \ libpcap-dev \ libpcre2-dev \ libperl-dev \ libpq-dev \ librdkafka-dev \ libreadline-dev \ libruby \ libsnmp-dev \ libsqlite3-dev \ libssl-dev \ libtalloc-dev \ libunbound-dev \ libwbclient-dev \ libykclient-dev \ libyubikey-dev \ lintian \ pbuilder \ python3-dev \ ruby-dev \ snmp \ software-properties-common \ quilt - name: Install LLVM 15 for 20.04 if: ${{ matrix.os.code == 'ubuntu2404' && matrix.env.CC == 'clang' }} run: | install -d -m 0755 -o root -g root /etc/apt/keyrings wget -O /etc/apt/keyrings/llvm-snapshot.asc https://apt.llvm.org/llvm-snapshot.gpg.key echo "deb [signed-by=/etc/apt/keyrings/llvm-snapshot.asc] http://apt.llvm.org/focal/ llvm-toolchain-focal-15 main" | sudo tee /etc/apt/sources.list.d/llvm-toolchain.list sudo apt-get update sudo apt-get install ${APT_OPTS} clang-15 llvm-15 gdb libclang-rt-15-dev sudo update-alternatives --install /usr/bin/clang clang /usr/bin/clang-15 60 && sudo update-alternatives --set clang /usr/bin/clang-15 sudo update-alternatives --install /usr/bin/llvm-symbolizer llvm-symbolizer /usr/bin/llvm-symbolizer-15 60 && sudo update-alternatives --set llvm-symbolizer /usr/bin/llvm-symbolizer-15 - name: Install GCC if: ${{ matrix.env.CC == 'gcc' }} run: | sudo apt-get install ${APT_OPTS} gcc gdb # # Build using some alternative libraries # # MIT Kerberos -> HEIMDAL Kerberos # # Now runners are Ubuntu 24, OpenSSL 3.0 is default # The sections below are left for future testing with other versions. # # - name: 'Fetch OpenSSL 3.0 SHA' # id: opensslshasum # if: ${{ matrix.env.LIBS_ALT == 'yes' }} # run: | # wget -qO- http://www.openssl.org/source/$ALT_OPENSSL_PATH/openssl-$ALT_OPENSSL.tar.gz.sha256 | sed -ne 's/^\s\+/shasum=/p' >> $GITHUB_OUTPUT # - name: 'Restore OpenSSL 3.0 from the cache' # if: ${{ matrix.env.LIBS_ALT == 'yes' }} # uses: actions/cache@v4 # id: openssl-cache # with: # path: /opt/openssl/ # key: openssl3-${{ steps.opensslshasum.outputs.shasum }} # - name: 'Build OpenSSL 3.0 (if cache stale)' # if: ${{ matrix.env.LIBS_ALT == 'yes' && steps.openssl-cache.outputs.cache-hit != 'true' }} # run: | # cd ~ # wget https://www.openssl.org/source/$ALT_OPENSSL_PATH/openssl-$ALT_OPENSSL.tar.gz # tar xzf openssl-$ALT_OPENSSL.tar.gz # cd openssl-$ALT_OPENSSL # ./Configure --prefix=/opt/openssl --openssldir=. # make -j `nproc` # make install - name: Use alternative libraries if: ${{ matrix.env.LIBS_ALT == 'yes' }} run: | sudo apt-get install ${APT_OPTS} heimdal-dev # echo /opt/openssl/lib64 | sudo tee /etc/ld.so.conf.d/openssl3.conf >/dev/null # sudo ldconfig - name: Show versions run: | printf "$CC: " ; $CC --version printf "\nmake: " ; make --version printf "\nkrb5: " ; krb5-config --all || : [ -d /opt/openssl ] && export PATH=/opt/openssl/bin:$PATH printf "\nopenssl: " ; openssl version - uses: actions/checkout@v6 - name: Build eapol_test run: | if [ -d /opt/openssl ]; then # Used by scripts/ci/eapol_test-build.sh export PATH=/opt/openssl/bin:$PATH export EAPOL_TEST_CFLAGS="-I/opt/openssl/include" export EAPOL_TEST_LDFLAGS="-L/opt/openssl/lib64" fi ./scripts/ci/eapol_test-build.sh - name: Build FreeRADIUS run: | export PATH=$(echo "$PATH" | sed -e 's#:/home/linuxbrew/[^:]\+##g') if [ -d /opt/openssl ]; then export PATH=/opt/openssl/bin:$PATH CONFIG_OPENSSL="--with-openssl-lib-dir=/opt/openssl/lib64 --with-openssl-include-dir=/opt/openssl/include" fi if [ $SANITIZER = "yes" ]; then echo "Enabling sanitizers" enable_sanitizers="--enable-address-sanitizer --enable-undefined-behaviour-sanitizer" if [ "`uname`" != "Darwin" ]; then enable_sanitizers="$enable_sanitizers --enable-leak-sanitizer" fi # TODO: libunbound is broken when built with LSAN/ASAN, let's disable it for now. extra_cflags="--without-rlm_unbound" # Temporary hack just to skip and see the result. # memory leak in rlm_{ldap,rest} and problems in perl+llvm rm -rf src/tests/modules/ldap/ rm -rf src/tests/modules/rest/ # Spurious leak that is not detected with "-m", i.e. not calling dlclose on the module rm -rf src/tests/modules/kafka/ else enable_sanitizers="" extra_cflags="" fi CFLAGS="${BUILD_CFLAGS}" ./configure -C \ --enable-developer \ ${enable_sanitizers} \ $CONFIG_OPENSSL \ $extra_cflags \ --enable-werror \ --prefix=$HOME/freeradius \ --with-threads=$LIBS_OPTIONAL \ --with-udpfromto=$LIBS_OPTIONAL \ --with-openssl=$LIBS_OPTIONAL \ --with-pcre=$LIBS_OPTIONAL \ --enable-reproducible-builds=${REPRODUCIBLE} make -j $(($(nproc) + 1)) - name: clang scan run: | make -j $(($(nproc) + 1)) scan && [ "$(find build/plist/ -name *.html)" = '' ] if: ${{ matrix.env.CC == 'clang' }} - name: "Clang Static Analyzer: Store assets on failure" uses: actions/upload-artifact@v6 with: name: clang-scan.tgz path: build/plist/**/*.html if: ${{ matrix.env.CC == 'clang' && failure() }} - name: Add OpenResty repository shell: bash run: | install -d -m 0755 -o root -g root /etc/apt/keyrings wget -O /etc/apt/keyrings/openresty.asc https://openresty.org/package/pubkey.gpg echo "deb [signed-by=/etc/apt/keyrings/openresty.asc] http://openresty.org/package/ubuntu $(lsb_release -sc) main" | sudo tee /etc/apt/sources.list.d/openresty.list sudo apt-get update - name: Setup git shell: bash run: git config --global --add safe.directory "$GITHUB_WORKSPACE" - name: Install test requisites run: | # Temporarily replace ucf (for config merge) with cp since it's # terribly slow! sudo mv /usr/bin/ucf /usr/bin/ucf.disabled sudo sh -c 'echo "#!/bin/sh" > /usr/bin/ucf' sudo sh -c 'echo "shift && cp -v \$@" >> /usr/bin/ucf' sudo chmod +x /usr/bin/ucf sudo apt-get install ${APT_OPTS} \ apparmor-utils \ ldap-utils \ openresty \ slapd sudo mv -f /usr/bin/ucf.disabled /usr/bin/ucf - name: Database dependencies run: | sudo apt-get install ${APT_OPTS} \ mariadb-client \ postgresql-client slapd - name: Build certificates for REST tests run: | cp -r raddb/certs raddb/restcerts cd ./raddb/restcerts && make ca && make server - name: Setup test databases run: | for i in \ postgresql-setup.sh \ mysql-setup.sh \ openresty-setup.sh \ ldap-setup.sh \ ldap2-setup.sh; do script="./scripts/ci/$i" echo "Calling $i" $script done - name: Configure test database access run: | mysql -h mariadb -uroot -e "CREATE USER 'radius'@'%' IDENTIFIED BY 'radpass';" mysql -u root -h mariadb -e "GRANT ALL ON radius.* TO 'radius'; FLUSH PRIVILEGES;" - name: Run tests run: | [ -d /opt/openssl ] && export PATH=/opt/openssl/bin:$PATH openssl dhparam -out ./raddb/certs/dh -2 128 || \ openssl dhparam -out ./raddb/certs/dh -2 512 || \ true # Activate per-test result recording for the summary table. mkdir -p build/tests && touch build/tests/results.tsv make -k ci-test - name: Test summary if: ${{ always() }} run: | ./scripts/ci/ci-summary.sh build/tests/results.tsv >> "$GITHUB_STEP_SUMMARY" || : - name: Stage failed test logs if: ${{ failure() }} run: | mkdir -p build/tests/failed [ -s build/tests/results.tsv ] && cp build/tests/results.tsv build/tests/failed/ awk -F'\t' '$3=="FAIL"{print $1"\t"$2"\t"$4}' build/tests/results.tsv 2>/dev/null | \ while IFS=$(printf '\t') read -r cat name logf; do [ -n "$logf" ] && [ -f "$logf" ] || continue mkdir -p "build/tests/failed/$cat" cp "$logf" "build/tests/failed/$cat/$name.log" done - name: Upload failed test logs if: ${{ failure() }} uses: actions/upload-artifact@v6 with: name: ci-test-logs-${{ matrix.os.name }}-${{ matrix.env.NAME }} path: build/tests/failed if-no-files-found: ignore - name: Show debug logs on failure if: ${{ failure() }} run: | cat src/tests/radius.log || : # # If the CI has failed and the branch is ci-debug then start a tmate # session. SSH rendezvous point is emited continuously in the job output. # - name: "Debug: Start tmate" uses: mxschmitt/action-tmate@v3 with: limit-access-to-actor: true if: ${{ github.ref == 'refs/heads/ci-debug' && failure() }} ########################################################################################## # FREERADIUS CORE DEVELOPERS ONLY ########################################################################################## # # Direct push access to the main freeradius-server repo has been disabled in an attempt # to keep CI passing reliably. # # The code below will automatically push to the main repository if a commit passes CI in # your fork on a branch that exists in the main repository. # # The code below will only run if PERSONAL_ACCESS_TOKEN is defined in the repository # secrets for your fork of the freeradius-server repo. # # If the above CI checks pass then we auto-merge into the same branch in the # main FR repo (only on push) if the PERSONAL_ACCESS_TOKEN secret is defined, i.e. when # the actor claims to be a FreeRADIUS developer with push access. # # Personal access tokens can be generated via the GitHub website: # # - Click on the Profile menu (top right) # > Settings # > Developer settings # > Personal access tokens # > Generate New Token # - Next, add the following settings and scopes: # Note: FreeRADIUS CI Push # public_repo (checked) # # This will allow any git operations using this PERSONAL_ACCESS_TOKEN to commit code to any # public repository you have access to. # # As this PERSONAL_ACCESS_TOKEN will only ever be accessible from GitHub actions when they are # running from your fork of the FreeRADIUS repo, this shouldn't be a security issue. # # After generating your PERSONAL_ACCESS_TOKEN you will need to add it as a secret to your # repository. # # - Copy your new token # - Click on the Profile menu (top right) # > Your repositories # - Search for freeradius-server # > Click freeradius-server # - Click settings in the tabs on the left # - Click secrets in the menu items on the left # - Click New repository secret # - Name: PERSONAL_ACCESS_TOKEN # Value: # - Click Add secret # # Needed because secrets are not available for evaluation in if conditions # at the job level, so we evaluate the existence of the PERSONAL_ACCESS_TOKEN secret # within a step and export the result instead. We also extract the short # branch name here because it's convenient to do so. # merge-preflight: needs: - ci if: ( github.event_name == 'push' ) && ( github.repository_owner != 'FreeRADIUS' ) && ( github.ref == 'refs/heads/master' || github.ref == 'refs/heads/v3.2.x' ) name: "Merge preflight" runs-on: ubuntu-latest steps: - name: "Report whether PERSONAL_ACCESS_TOKEN secret exists" id: merge-preflight run: | [ -z "$PERSONAL_ACCESS_TOKEN" ] || echo "::set-output name=PERSONAL_ACCESS_TOKEN_EXISTS::1" env: PERSONAL_ACCESS_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }} outputs: PERSONAL_ACCESS_TOKEN_EXISTS: ${{ steps.merge-preflight.outputs.PERSONAL_ACCESS_TOKEN_EXISTS }} merge-upstream: needs: - ci - merge-preflight if: needs.merge-preflight.outputs.PERSONAL_ACCESS_TOKEN_EXISTS == '1' runs-on: ubuntu-latest name: "Merge into upstream" steps: - uses: actions/checkout@v6 with: fetch-depth: 0 lfs: false persist-credentials: false # Note: This also opportunistically updates the developer's branch with commits from # the main repository. # This update may fail if the developer has pushed additional commits since the # workflow started. This is normal, and we ignore the failure. - name: "Merge into upstream dev branch and update local branch" run: | BRANCH=${GITHUB_REF#refs/heads/} git remote add upstream https://$USERNAME:$REPO_KEY@github.com/FreeRADIUS/freeradius-server.git git fetch --no-recurse-submodules upstream +refs/heads/*:refs/remotes/upstream/* +refs/tags/*:refs/tags/upstream/* git checkout --progress --force -B upstream-branch "refs/remotes/upstream/$BRANCH" git merge "$BRANCH" --ff-only git push upstream "upstream-branch:$BRANCH" git push origin "$BRANCH" || true env: USERNAME: ${{ github.actor }} REPO_KEY: ${{ secrets.PERSONAL_ACCESS_TOKEN }} freeradius-3.2.10+dfsg/.github/workflows/crossbuild.yml000066400000000000000000000040401522352605200231360ustar00rootroot00000000000000name: Check Crossbuild on: push: branches-ignore: - coverity_scan workflow_dispatch: env: CI: 1 GH_ACTIONS: 1 DEBIAN_FRONTEND: noninteractive APT_OPTS: "-y --no-install-recommends" jobs: # # Generate matrix based on crossbuild docker directories. # gen-matrix: runs-on: ubuntu-latest outputs: matrix: ${{ steps.gen-matrix.outputs.matrix }} steps: - uses: actions/checkout@v6 with: lfs: false - id: gen-matrix name: Generate matrix based on crossbuild targets run: | cd scripts/crossbuild/docker M=$(ls | perl -n -e '{chomp; push @L,"\"$_\""} END{print "{\"env\":[{\"OS\":",join("},{\"OS\":",@L),"}]}"}') echo "Matrix: $M" echo matrix=$M >> $GITHUB_OUTPUT # # Run crossbuild target for each given OS. This will build the # Docker image and run `make test` inside. # crossbuild: needs: - gen-matrix runs-on: ubuntu-latest strategy: fail-fast: false matrix: ${{ fromJson(needs.gen-matrix.outputs.matrix) }} env: ${{ matrix.env }} name: "v3.2.x-${{ matrix.env.OS }}" steps: - uses: actions/checkout@v6 with: fetch-depth: 0${{ ( matrix.env.OS != 'centos7' ) && '1' }} - name: Run crossbuild tests run: | make crossbuild.$OS - name: Show build log if: ${{ success() || failure() }} run: | cat scripts/crossbuild/build/build.$OS - name: Show configure log if: ${{ success() || failure() }} run: | cat scripts/crossbuild/build/configure.$OS - name: Show test log if: ${{ success() || failure() }} run: | cat scripts/crossbuild/build/log.$OS # # If the CI has failed and the branch is ci-debug then start a tmate # session. SSH rendezvous point is emited continuously in the job output. # - name: "Debug: Start tmate" uses: mxschmitt/action-tmate@v3 with: limit-access-to-actor: true if: ${{ github.ref == 'refs/heads/ci-debug' && failure() }} freeradius-3.2.10+dfsg/.github/workflows/docker.yml000066400000000000000000000032761522352605200222460ustar00rootroot00000000000000name: Build Dockerfiles on: push: branches-ignore: - coverity_scan workflow_dispatch: env: CI: 1 GH_ACTIONS: 1 DEBIAN_FRONTEND: noninteractive APT_OPTS: "-y --no-install-recommends" jobs: # # Generate matrix based on docker directories. # gen-matrix: runs-on: ubuntu-latest outputs: matrix: ${{ steps.gen-matrix.outputs.matrix }} steps: - uses: actions/checkout@v6 with: lfs: false - id: gen-matrix name: Generate matrix based on docker targets run: | cd scripts/docker/dists M=$(ls | perl -n -e '{chomp; push @L,"\"$_\""} END{print "{\"env\":[{\"OS\":",join("},{\"OS\":",@L),"}]}"}') echo "Matrix: $M" echo matrix=$M >> $GITHUB_OUTPUT # # Run docker target for each given OS. This will build the # Docker image. # docker: needs: - gen-matrix runs-on: ubuntu-latest strategy: fail-fast: false matrix: ${{ fromJson(needs.gen-matrix.outputs.matrix) }} env: ${{ matrix.env }} name: "v3.2.x-${{ matrix.env.OS }}" steps: - uses: actions/checkout@v6 with: fetch-depth: 1 - name: Regenerate Dockerfile run: | rm scripts/docker/dists/$OS/Dockerfile || true make docker.$OS.regen - name: Build docker image run: | make docker.$OS.build # # If the CI has failed and the branch is ci-debug then start a tmate # session. SSH rendezvous point is emited continuously in the job output. # - name: "Debug: Start tmate" uses: mxschmitt/action-tmate@v3 with: limit-access-to-actor: true if: ${{ github.ref == 'refs/heads/ci-debug' && failure() }} freeradius-3.2.10+dfsg/.github/workflows/dockerhub-dev.yml000066400000000000000000000056141522352605200235170ustar00rootroot00000000000000name: Dockerhub Dev on: push: branches-ignore: - coverity_scan workflow_dispatch: env: CI: 1 GH_ACTIONS: 1 DEBIAN_FRONTEND: noninteractive APT_OPTS: "-y --no-install-recommends" DOCKER_REPOSITORY: freeradius-dev BRANCH: v3.2.x jobs: # # Run docker target for each given OS and ARCH. This will # build the Docker images. # build_docker_images: runs-on: ubuntu-24.04 if: github.repository_owner == 'FreeRADIUS' strategy: matrix: env: - { OS: "ubuntu", ARCH: "linux/amd64", NAME: "amd64" } - { OS: "ubuntu", ARCH: "linux/arm/v7", NAME: "armv7" } - { OS: "ubuntu", ARCH: "linux/arm64/v8", NAME: "arm64v8" } - { OS: "alpine", ARCH: "linux/amd64", NAME: "amd64" } - { OS: "alpine", ARCH: "linux/arm/v6", NAME: "armv6" } - { OS: "alpine", ARCH: "linux/arm/v7", NAME: "armv7" } - { OS: "alpine", ARCH: "linux/arm64/v8", NAME: "arm64v8" } fail-fast: false name: "${{ matrix.env.OS }}-${{ matrix.env.ARCH }}" steps: - uses: actions/checkout@v6 with: fetch-depth: 1 - name: Regenerate Dockerfiles run: | rm scripts/docker/dists/*/Dockerfile || true make docker.regen - name: Install qemu run: | sudo apt-get update sudo apt-get install ${APT_OPTS} qemu-user-static - name: Build docker image run: | make docker-${{ matrix.env.OS }} \ DOCKER_TAG="$DOCKER_REPOSITORY" \ DOCKER_BUILD_ARGS="--no-cache --platform ${{ matrix.env.ARCH }}" \ DOCKER_VERSION="${{ matrix.env.NAME }}-$BRANCH" - name: Docker login uses: docker/login-action@v4 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_PASSWORD }} - name: Push arch image to Docker registry shell: bash run: | make docker-push-${{ matrix.env.OS }} \ DOCKER_TAG="$DOCKER_REPOSITORY" \ DOCKER_VERSION="${{ matrix.env.NAME }}-$BRANCH" manifest: runs-on: ubuntu-24.04 needs: build_docker_images if: github.repository_owner == 'FreeRADIUS' strategy: matrix: env: - { OS: "ubuntu", ARCHS: "amd64 armv7 arm64v8", SUFFIX: "" } - { OS: "alpine", ARCHS: "amd64 armv6 armv7 arm64v8", SUFFIX: "-alpine" } fail-fast: false name: "manifest-${{ matrix.env.OS }}" steps: - uses: actions/checkout@v6 with: fetch-depth: 1 - name: Docker login uses: docker/login-action@v3 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_PASSWORD }} - name: Create manifests shell: bash run: | make docker-ci-manifest \ DOCKER_TAG="$DOCKER_REPOSITORY" \ DOCKER_VERSION="$BRANCH${{ matrix.env.SUFFIX }}" \ DOCKER_ARCHS="${{ matrix.env.ARCHS }}" freeradius-3.2.10+dfsg/.github/workflows/dockerhub-releases.yml000066400000000000000000000140371522352605200245430ustar00rootroot00000000000000name: Dockerhub Releases on: # Rebuild on new release tag... push: tags: - 'release_3_2_*' # ...weekly (to keep docker base OS up-to-date)... schedule: - cron: '30 4 * * 1' # ...or when manually triggered. workflow_dispatch: # Don't run more than one build at the same time concurrency: group: dockerhub-releases-v3.2.x env: CI: 1 GH_ACTIONS: 1 DEBIAN_FRONTEND: noninteractive APT_OPTS: "-y --no-install-recommends" DOCKER_TAG: "freeradius-test" BRANCH: v3.2.x jobs: # # Get list of releases to rebuild # get_release_tags: runs-on: ubuntu-latest outputs: matrix: ${{ steps.gen-matrix.outputs.matrix }} latest_tag: ${{ steps.gen-matrix.outputs.tag }} latest_ver: ${{ steps.gen-matrix.outputs.version }} steps: - uses: actions/checkout@v6 with: fetch-depth: 0 lfs: false - id: gen-matrix name: Generate matrix based on recent release tags run: | TAGS=$(git ls-remote --tags --sort=-committerdate origin 'release_3_2_*' | head -2 | cut -d/ -f3) echo "Tags: $TAGS" M=$(echo "$TAGS" | perl -n -e '{chomp; $Q=$_; s/release_//; s/_/./g; push @L,"\"TAG\":\"$Q\",\"VER\":\"$_\""} END{print "[{",join("},{",@L),"}]"}') T=$(git describe --abbrev=0 --tags) V=$(echo "$T" | perl -pe 's/release_//; s/_/./g') echo "Matrix: $M" echo "Latest tag: $T" echo "Latest version: $V" echo "matrix=$M" >> $GITHUB_OUTPUT echo "tag=$T" >> $GITHUB_OUTPUT echo "version=$V" >> $GITHUB_OUTPUT # # Run docker target for each given OS and ARCH. This will # build the Docker images. # build_docker_images: needs: - get_release_tags runs-on: ubuntu-24.04 if: github.repository_owner == 'FreeRADIUS' strategy: matrix: tag: ${{ fromJson(needs.get_release_tags.outputs.matrix) }} env: - { OS: "ubuntu", ARCH: "linux/amd64", NAME: "amd64" } - { OS: "ubuntu", ARCH: "linux/arm/v7", NAME: "armv7" } - { OS: "ubuntu", ARCH: "linux/arm64/v8", NAME: "arm64v8" } - { OS: "alpine", ARCH: "linux/amd64", NAME: "amd64" } - { OS: "alpine", ARCH: "linux/arm/v6", NAME: "armv6" } - { OS: "alpine", ARCH: "linux/arm/v7", NAME: "armv7" } - { OS: "alpine", ARCH: "linux/arm64/v8", NAME: "arm64v8" } fail-fast: false name: "${{ matrix.tag.TAG }}-${{ matrix.env.OS }}-${{ matrix.env.ARCH }}" steps: - uses: actions/checkout@v6 with: fetch-depth: 0 - name: Regenerate Dockerfiles run: | rm scripts/docker/dists/*/Dockerfile || true make docker.regen - name: Install qemu run: | sudo apt-get update sudo apt-get install ${APT_OPTS} qemu-user-static - name: Build docker image run: | make docker-${{ matrix.env.OS }} \ DOCKER_COMMIT="${{ matrix.tag.TAG }}" \ DOCKER_BUILD_ARGS="--no-cache --platform ${{ matrix.env.ARCH }}" \ DOCKER_TAG="$DOCKER_TAG" \ DOCKER_VERSION="${{ matrix.env.NAME }}-${{ matrix.tag.VER }}" - name: Docker login uses: docker/login-action@v4 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_PASSWORD }} - name: Push arch image to Docker registry shell: bash run: | make docker-push-${{ matrix.env.OS }} \ DOCKER_TAG="$DOCKER_TAG" \ DOCKER_VERSION="${{ matrix.env.NAME }}-${{ matrix.tag.VER }}" manifest: needs: - get_release_tags - build_docker_images runs-on: ubuntu-latest if: github.repository_owner == 'FreeRADIUS' strategy: matrix: tag: ${{ fromJson(needs.get_release_tags.outputs.matrix) }} env: - { OS: "ubuntu", ARCHS: "amd64 armv7 arm64v8", SUFFIX: "" } - { OS: "alpine", ARCHS: "amd64 armv6 armv7 arm64v8", SUFFIX: "-alpine" } fail-fast: false name: "manifest-${{ matrix.tag.VER }}-${{ matrix.env.OS }}" steps: - uses: actions/checkout@v6 with: fetch-depth: 1 - name: Docker login uses: docker/login-action@v4 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_PASSWORD }} - name: Create manifests shell: bash run: | make docker-ci-manifest \ DOCKER_TAG="$DOCKER_TAG" \ DOCKER_VERSION="${{ matrix.tag.VER }}${{ matrix.env.SUFFIX }}" \ DOCKER_ARCHS="${{ matrix.env.ARCHS }}" # # Create/update manifest for latest version # # This maintains the 'latest', 'latest-alpine', 'latest-3.2' and 'latest-3.2-alpine' image tags # latest_manifest: needs: - get_release_tags - build_docker_images runs-on: ubuntu-latest if: github.repository_owner == 'FreeRADIUS' strategy: matrix: env: - { OS: "ubuntu", ARCHS: "amd64 armv7 arm64v8", SUFFIX: "" } - { OS: "alpine", ARCHS: "amd64 armv6 armv7 arm64v8", SUFFIX: "-alpine" } fail-fast: false name: "manifest-${{ matrix.env.OS }}-latest" steps: - uses: actions/checkout@v6 with: fetch-depth: 1 - name: Docker login uses: docker/login-action@v4 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_PASSWORD }} - name: Create 'latest' manifests shell: bash run: | make docker-ci-manifest \ DOCKER_TAG="$DOCKER_TAG" \ DOCKER_VERSION="${{ needs.get_release_tags.outputs.latest_ver }}${{ matrix.env.SUFFIX }}" \ DOCKER_MANIFEST_VERSION="latest${{ matrix.env.SUFFIX }}" \ DOCKER_ARCHS="${{ matrix.env.ARCHS }}" - name: Create 'latest-3.2' manifests shell: bash run: | make docker-ci-manifest \ DOCKER_TAG="$DOCKER_TAG" \ DOCKER_VERSION="${{ needs.get_release_tags.outputs.latest_ver }}${{ matrix.env.SUFFIX }}" \ DOCKER_MANIFEST_VERSION="latest-3.2${{ matrix.env.SUFFIX }}" \ DOCKER_ARCHS="${{ matrix.env.ARCHS }}" freeradius-3.2.10+dfsg/.gitignore000066400000000000000000000012421522352605200166360ustar00rootroot00000000000000*~ *.o *.a *.buildinfo *.changes *.lo *.loT *.la *.so *.lai *.bz2 *.gz *.sig *.orig *.rej .libs .depends *.log *.substvars *-stamp *.swp *.cache *.dist *.dylib *.rej *.orig *.dSYM *.patch .pc # Editor projects *.kdev4 *.cproject *.project *.bbprojectd # Exuberant ctags tags # Local icon files icon.png # OS specific cruft .DS_Store # Certificates and signing requests *.pem *.der *.csr *.key # Autoconf and libtool output build config.status *confdefs.h *conftest* *confcache Make.inc libtool autom4te.cache aclocal.m4 config.guess config.report config.sub config.h src/main/radattr src/modules/lib/ warnings.txt # Analyzer output /*.plist # rpm packages rpmbuild/ freeradius-3.2.10+dfsg/.travis.yml000066400000000000000000000063011522352605200167600ustar00rootroot00000000000000language: c compiler: - clang - gcc sudo: false cache: apt: true env: global: - PANIC_ACTION="gdb -batch -x raddb/panic.gdb %e %p 1>&0 2>&0" - secure: "H+uQeyOgsIyXtIPPG2VzAG8S/8KYGHlHaWhdiNuz1LM3SMcEKoPqG6o/P+HO8HVvYnA6nelyGuEryV90UfuwGY9YC6A/pqPQvx/gXSso63Zt66XSaiZjulCSm9OV8EB3wyWF7VSQ/ZHcn+L01hIlsQXTqLprMaC33cM0FYPr9fY=" matrix: - DO_BUILD=yes LIBS_OPTIONAL=no LIBS_SHARED=yes REPRODUCIBLE=no BUILD_CFLAGS="-DWITH_EVAL_DEBUG" - DO_BUILD=yes LIBS_OPTIONAL=yes LIBS_SHARED=yes REPRODUCIBLE=no BUILD_CFLAGS="-DWITH_EVAL_DEBUG" - DO_BUILD=yes LIBS_OPTIONAL=yes LIBS_SHARED=yes REPRODUCIBLE=yes BUILD_CFLAGS="-DWITH_EVAL_DEBUG" - DO_BUILD=yes LIBS_OPTIONAL=yes LIBS_SHARED=yes REPRODUCIBLE=no BUILD_CFLAGS="-DWITH_EVAL_DEBUG -O2 -g3" - DO_BUILD=no addons: coverity_scan: project: name: FreeRADIUS/freeradius-server version: v3.2.x description: The FreeRADIUS server project notification_email: freeradius-devel@lists.freeradius.org build_command_prepend: ./configure build_command: make branch_pattern: coverity_scan apt: config: retries: true sources: - couchbase-precise packages: - autoconf - build-essential - debhelper - devscripts - dh-make - doxygen - fakeroot - gdb - graphviz - lintian - pbuilder - python-dev - python3-dev - quilt - libruby - ruby-dev - libcollectdclient-dev - firebird-dev - freetds-dev - libcap-dev - libcouchbase2-libevent - libcouchbase-dev - libcurl4-openssl-dev - libgdbm-dev - libhiredis-dev - libidn11-dev - libiodbc2-dev libiodbc2 - libjson0 - libjson0-dev - libkrb5-dev - libldap2-dev - libmemcached-dev - libmysqlclient-dev - libpam0g-dev - libpcap-dev - libpcre3-dev - libperl-dev - libpq-dev - libreadline-dev - libsnmp-dev - libssl-dev - libtalloc-dev - libtalloc2-dbg - libunbound-dev - libwbclient-dev - libykclient-dev - libyubikey-dev before_install: - $CC --version before_script: # Configure the server - if [ "${DO_BUILD}" = 'yes' ]; then CFLAGS="${BUILD_CFLAGS}" ./configure -C --enable-werror --prefix=$HOME/freeradius --with-shared-libs=$LIBS_SHARED --with-threads=$LIBS_OPTIONAL --with-udpfromto=$LIBS_OPTIONAL --with-openssl=$LIBS_OPTIONAL --with-pcre=$LIBS_OPTIONAL --enable-reproducible-builds=${REPRODUCIBLE}; fi - if [ "${DO_BUILD}" = 'no' ]; then ./configure -C --without-modules; fi # Build the server - if [ "${DO_BUILD}" = 'yes' ]; then make -j8; fi # Run CLANG analyzer if we're building with CLANG - if [ "${DO_BUILD}" = 'yes' -a "${COVERITY_SCAN_BRANCH}" != 1 -a ${CC} = 'clang' ]; then make -j8 scan && [ "$(find build/plist/ -name *.html)" = '' ]; fi script: - if [ "${DO_BUILD}" = 'yes' -a "${COVERITY_SCAN_BRANCH}" != 1 ]; then make ci-test; fi # - if [ "${DO_BUILD}" = 'no' ]; then make deb; fi # Build the doxygen documentation - if [ "${DO_BUILD}" = 'no' ]; then cd doc/source; doxygen 3>&1 1>&2 2>&3 | grep -iv '^warning:' | tee doxygen_stderr.log && [ ! -n "$(cat doxygen_stderr.log)" ]; fi freeradius-3.2.10+dfsg/.vscode/000077500000000000000000000000001522352605200162105ustar00rootroot00000000000000freeradius-3.2.10+dfsg/.vscode/c_cpp_properties.json000066400000000000000000000023361522352605200224470ustar00rootroot00000000000000{ "configurations": [ { "name": "Linux", "includePath": [ "/usr/include/**", "${workspaceFolder}/src/**" ], "forcedInclude": [ "${workspaceFolder}/src/freeradius-devel/autoconf.h", "${workspaceFolder}/src/freeradius-devel/build.h", "${workspaceFolder}/src/freeradius-devel/features.h" ], "defines": [], "compilerPath": "/usr/bin/clang", "cStandard": "c11", "cppStandard": "c++14", "intelliSenseMode": "linux-clang-x64" }, { "name": "Mac", "includePath": [ "${workspaceFolder}/src/**" ], "forcedInclude": [ "${workspaceFolder}/src/freeradius-devel/autoconf.h", "${workspaceFolder}/src/freeradius-devel/build.h", "${workspaceFolder}/src/freeradius-devel/features.h" ], "defines": [], "compilerPath": "/usr/bin/clang", "cStandard": "c11", "cppStandard": "c++14", "intelliSenseMode": "linux-clang-x64" } ], "version": 4 } freeradius-3.2.10+dfsg/.vscode/launch.json000066400000000000000000000123301522352605200203540ustar00rootroot00000000000000{ // Use IntelliSense to learn about possible attributes. // Hover to view descriptions of existing attributes. // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387 "version": "0.2.0", "configurations": [ { "type": "lldb", "request": "launch", "name": "Debug (lldb)", "program": "${workspaceFolder}/build/bin/local/radiusd", "args": [ "-X", "-D", "${workspaceFolder}/share", "-d", "${input:raddb}" ], "cwd": "${workspaceFolder}", "env": { "FR_LIBRARY_PATH": "${workspaceFolder}/build/lib/local/.libs", "DEBUGGER_ATTACHED": "yes" } }, { "type": "cppdbg", "request": "launch", "name": "Debug (gdb)", "program": "${workspaceFolder}/build/bin/local/radiusd", "args": [ "-X", "-D", "${workspaceFolder}/share", "-d", "${input:raddb}" ], "cwd": "${workspaceFolder}", "environment": [ { "name": "FR_LIBRARY_PATH", "value": "${workspaceFolder}/build/lib/local/.libs" }, { "name": "LD_LIBRARY_PATH", "value": "${workspaceFolder}/build/lib/local/.libs" }, { "name": "DEBUGGER_ATTACHED", "value": "yes" } ], "MIMode": "gdb", "setupCommands": [ { "description": "Set solib", "text": "set solib-search-path ${workspaceFolder}" } ] }, { "type": "cppdbg", "request": "launch", "name": "Debug (gdb) threaded", "program": "${workspaceFolder}/build/bin/local/radiusd", "args": [ "-fxxl", "stdout", "-D", "${workspaceFolder}/share", "-d", "${input:raddb}" ], "cwd": "${workspaceFolder}", "environment": [ { "name": "FR_LIBRARY_PATH", "value": "${workspaceFolder}/build/lib/local/.libs" }, { "name": "LD_LIBRARY_PATH", "value": "${workspaceFolder}/build/lib/local/.libs" }, { "name": "DEBUGGER_ATTACHED", "value": "yes" } ], "MIMode": "gdb", "setupCommands": [ { "description": "Set solib", "text": "set solib-search-path ${workspaceFolder}" } ] }, { "type": "cppdbg", "request": "launch", "name": "Keyword Test (gdb)", "program": "${workspaceFolder}/build/bin/local/unittest", "args": [ "-D", "${workspaceFolder}/share", "-d", "${workspaceFolder}/src/tests/keywords/", "-i", "${workspaceFolder}/build/tests/keywords/${input:keyword}.attrs", "-f", "${workspaceFolder}/build/tests/keywords/${input:keyword}.attrs", "-xx" ], "cwd": "${workspaceFolder}", "environment": [ { "name": "FR_LIBRARY_PATH", "value": "${workspaceFolder}/build/lib/local/.libs" }, { "name": "LD_LIBRARY_PATH", "value": "${workspaceFolder}/build/lib/local/.libs" }, { "name": "KEYWORD", "value": "${input:keyword}" }, { "name": "DEBUGGER_ATTACHED", "value": "yes"} ], "MIMode": "gdb", "setupCommands": [ { "description": "Set solib", "text": "set solib-search-path ${workspaceFolder}" } ] } ], "inputs": [ { "id": "raddb", "type": "promptString", "description": "raddb path", "default": "${workspaceFolder}/raddb" }, { "id": "keyword", "type": "promptString", "description": "Keyword to test" } ] } freeradius-3.2.10+dfsg/.vscode/settings.json000066400000000000000000000002071522352605200207420ustar00rootroot00000000000000{ "files.trimTrailingWhitespace": true, "files.insertFinalNewline": true, "[diff]" : { "files.trimTrailingWhitespace": false } } freeradius-3.2.10+dfsg/AGENTS.md000066400000000000000000000035341522352605200161570ustar00rootroot00000000000000# Policy on AI Agents > [!IMPORTANT] > This project does **not** accept pull requests that are fully or > predominantly AI-generated. AI tools may be utilized solely to > assist individual development. > > If we receive an AI PR that _clearly has had zero testing_, then we > will **ban the person who submitted the PR**. > > Submitting a garbage PR isn't just AI slop, it's abuse. AI assistance is fine. But when someone submits a PR, we assume that they understand the submission, and that they accept full responsibility for it. --- ## Recommendations for Using AI AI can be useful in some situations. However, our experience has been that when people ask AI questions about FreeRADIUS, the answers are pretty bad. The advice is either unclear, or is simply wrong. This means that AI should be used to point you in a direction, but you should read the documentation to get the _truthful_ answers: > READ THE DOCS! > > https://www.freeradius.org/documentation/freeradius-server/ AI can help in the following use cases: - Code completion in an editor, - Asking about the structure of the code, - Learning about specific techniques used in the project, - Finding documents, links, and parts of the code that are worth your time - Reviewing human-written code and providing suggestions on things you hadn't thought of, - Creating rough outlines for documentation, Anything AI generated _must_ be reviewed, edited, and approved by a person. ## Disclosure **All AI contributions must be disclosed.** If you use AI in an editor for API suggestions, searching the code, etc., that doesn't need to be disclosed. You are the person writing the code, not the AI. If you use AI to _generate_ code, it **must** be disclosed. The code that AI generates is pretty much always wrong. We need to know if the PR is AI slop, or if it has been reviewed and understood by a person. freeradius-3.2.10+dfsg/CONTRIBUTING000066400000000000000000000115711522352605200165060ustar00rootroot000000000000000.INTRODUCTION The FreeRADIUS project wouldn't exist without contributions from a significant number of developers. We greatly value all comments, defect reports, patches/pull-requests, but must balance individual contributor's desires and practices against what's required for the project to operate efficiently. This document describes best practices when interacting with members of the FreeRADIUS project team via GitHub. If you follow these guidelines, it is very likely that your question, bug report or pull request will be acted on, and in a timely manor. If you choose to ignore these guidelines our response will be a link to this document. 1.GITHUB ISSUE TRACKER The GitHub issue tracker is for non-security related defect reports, feature requests, and pull-requests ONLY. It is not for support requests or questions regarding configuration/operation of the server, they belong on the users mailing list: https://freeradius.org/support/ Raising support requests or questions as issues will result in them being closed and locked. If you continue to raise these questions as issues you will be banned from the FreeRADIUS project's GitHub repositories. Security issues should be reported to security@freeradius.org, especially if they can be remotely exploited. This ensures that patches can be developed before the exploit is made public. 2.BEFORE REPORTING A DEFECT Verify it's still present in the Git HEAD. Checkout the appropriate branch for the version of the server you're working with as listed here (http://doc.freeradius.org), build the server, and attempt to reproduce your issue. The ChangeLog (https://github.com/FreeRADIUS/freeradius-server/blob/v3.2.x/doc/ChangeLog) for the current stable branch may also be used to determine if your issue has already been addressed. The ChangeLog is updated as fixes are made to the server code, and usually reflects the state of the Git HEAD. Do not report non-security defects for EOL branches (as listed on doc.freeradius.org), they will be closed and locked. 3.CONTENTS OF A DEFECT REPORT See doc/bugs (https://github.com/FreeRADIUS/freeradius-server/blob/v3.2.x/doc/bugs) for information on what to include, and how to obtain it. When logging bug reports using the GitHub issue tracker, pay attention to formatting. You should ensure any log output is surrounded by two sets of tripple backticks (```). If you don't do this Github will automatically link your issue to other pre-existing issues when it encounters a # string. 4.PULL REQUESTS AND CODING STANDARDS If you're developing a new feature, module, or writing large amounts of code to fix a defect, contact a member of the FreeRADIUS development team first. For simpler one or two line fixes, go ahead and open a pull-request immediately. The dev team can be contacted via the devel mailing list (https://freeradius.org/support/), or via GitHub by using the GitHub issue tracker. Contacting the dev team gives us the opportunity to offer feedback. We may have a solution to your problem that doesn't require additional code, or may have ideas as to how your problem can be solved in a way that will better fit with the long-term vision for the server. Once you've got the go ahead, read through the coding standards document: https://wiki.freeradius.org/contributing/coding-standards If you're creating a new module you may wish to read the module creation guide: https://wiki.freeradius.org/contributing/Modules3 You may also wish to utilise the doxygen site to review code documentation: http://doc.freeradius.org The doxygen site contains the complete reference of all API functions with doxygen headers, as well as structs, and callback declarations. doc.freeradius.org is updated within one minute of each commit to the master branch of the main freeradius-server repo. Finally, this file was written to be displayed automatically on the GitHub issue tracker, so Git/GitHub knowledge is assumed. If you're wondering what the heck a pull-request is, this document may be of some use: https://wiki.freeradius.org/contributing/GitHub 5.CONTINUOUS INTEGRATION TESTS If possible include test cases in your pull-requests. There are currently three test frameworks for different elements of the server: Unit tests - src/tests/unit/*.txt - Tests for conditions and protocol encoders/decoders. Module tests - src/tests/modules/ - Tests for module functionality. Unlang tests - src/tests/unlang/ - Tests for unlang keywords and functions. See README.* docs in the directories above for basic information on writing test cases. The easiest way to write new tests is to use the existing tests as examples. Tests are run via a GitHub Actions workflow for each pull-request, and on every commit by a develope with repository access. freeradius-3.2.10+dfsg/COPYRIGHT000066400000000000000000000054471522352605200161540ustar00rootroot000000000000001. COPYRIGHT Unless otherwise mentioned, the copyrights described in section 4, below, apply to all files in this distribution. 2. INDIVIDUAL DIRECTORIES 2.1 doc/rfc/ Most of the files in this directory are copyrighted by the Internet Society, Inc. See the contents of the files for details. 2.2 src/lib/ Copyright for files in this directory is held by the contributors. See the contents of the files for details 2.2.1 LICENSE The license for all files in the src/lib directory is the GNU LGPL version 2, which is included with this program in the file src/lib/LICENSE. 3. ALL OTHER FILES Copyright for files in this directory is held by the contributors. See the contents of the files for details. Files without explicit copyright notices are copyright The FreeRADIUS Server Project. See section 4.2 for more information. 3.1 LICENSE The license for all other source code and documentation except the files in src/lib directory is the GNU GPL version 2, which is included with this program in the LICENSE file in this directory. 3.2 LIST OF COPYRIGHT HOLDERS Portions of the source code and documentation included here are copyright by one or more of the following organizations and individuals. This list is not exhaustive. Consult the individual files for more detailed copyright statements. Copyright (C) 1999-2021 The FreeRADIUS Server Project Copyright (C) 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009 Alan DeKok Copyright (C) 1996, 1997, 1999, 2000, 2002, 2003, 2004, 2005 Free Software Foundation, Inc. Copyright (C) 2011-2015 Arran Cudbard-Bell Copyright (C) 2012-2018 Matthew Newton Copyright (C) 2003, 2004, 2005 Kostas Kalevras Copyright (C) 2004 Cladju Consulting, Inc. Copyright (C) 2001, 2002, 2003, 2004, 2005 Google, Inc. Copyright (C) 2003, 2004 Michael Richardson Copyright (C) 2002, 2003, 2004 Novell, Inc. Copyright (C) 2002 Miguel A.L. Paraz Copyright (C) 2002 Simon Ekstrand Copyright (C) 2001 Chad Miller Copyright (C) 2001 hereUare Communications, Inc. Copyright (C) 2000 Jochen Friedrich Copyright (C) 2000, 2002 Miquel van Smoorenburg Copyright (C) 2000 Jeff Carneal Copyright (C) 2000 Alan Curry Copyright (C) 2000 David Kerry Copyright (C) 2000 Dmitri Ageev Copyright (C) 2000 Nathan Neulinger Copyright (C) 2000 Mike Machado Copyright (C) 2000, 2001 Chad Miller Copyright (C) 1997, 1998, 1999 Cistron Internet Services B.V. Copyright (C) 1999 Kunihiro Ishiguro freeradius-3.2.10+dfsg/CREDITS000066400000000000000000000001021522352605200156600ustar00rootroot00000000000000Please see: https://wiki.freeradius.org/project/Acknowledgements freeradius-3.2.10+dfsg/INSTALL.rst000066400000000000000000000161311522352605200165110ustar00rootroot00000000000000Installation ============ 1. INTRODUCTION --------------- Ignore the installation instructions in this file if you have a pre-installed binary package. When upgrading from older versions of FreeRADIUS, you should read ALL of this file, especially the section on "UPGRADING" below which gives information on how to update your configuration. Whether you are installing from source or a pre-built binary package, you should read the section below "RUNNING THE SERVER". 2. SIMPLE INSTALLATION ---------------------- If you do not need to modify the default configuration, then take the following steps to build and install the server:: $ ./configure $ make $ make install 3. CUSTOM INSTALLATION ---------------------- FreeRADIUS has autoconf support. This means you have to run ``./configure``, and then run make. To see which configuration options are supported, run ``./configure --help``, and read it's output. The following list is a selection from the available flags:: --enable-shared[=PKGS] build shared libraries [default=yes] --enable-static[=PKGS] build static libraries [default=yes] --with-logdir=DIR Directory for logfiles [LOCALSTATEDIR/log] --with-radacctdir=PATH Directory for detail files [LOGDIR/radacct] --with-raddbdir=DIR Directory for config files [SYSCONFDIR/raddb] --with-threads Use threads, if available. (default=yes) --with-snmp Compile in SNMP support. (default=yes) --with-dhcp Compile in DHCP support. (default=yes) --with-experimental-modules Use experimental and unstable modules. (default=no) --enable-developer Turns on super-duper-extra-compile-warnings when using gcc, as well as experimental modules. The ``make install`` stage will install the binaries, the 'man' pages, and MAY install the configuration files. If you have not installed a RADIUS server before, then the configuration files for FreeRADIUS will be installed. If you already have a RADIUS server installed, then **FreeRADIUS WILL NOT over-write your current configuration.** The ``make install`` process will warn you about the files it could not install. If you see a warning message about files that could not be installed, then you MUST ensure that the new server is using the new configuration files, and not the old configuration files. The initial output from running in debugging mode (``radiusd -X``) will tell you which configuration files are being used. See UPGRADING above for information about upgrading from older versions. There MAY be changes in the dictionary files which are REQUIRED for a new version of the software. These files will NOT be installed over your current configuration, so you MUST verify and install any problem files by hand, for example using ``diff(1)`` to check for changes. It is EXTREMELY helpful to read the output of both ``./configure``, ``make``, and ``make install``. If a particular module you expected to be installed was not installed, then the output of the ``./configure; make; make install`` sequence will tell you why that module was not installed. Please do NOT post questions to the FreeRADIUS users list without first carefully reading the output of this process. 4. UPGRADING ------------ The installation process will not over-write your existing configuration files. It will, however, warn you about the files it did not install. For users upgrading from any older version to 3.0, it is *NOT* possible to use the older configuration as-is. However, the version 2.x configuration is largely compatible, so upgrading the configuration should not be too difficult. For details on what has changed, see ``raddb/README.rst``. We STRONGLY recommend that 3.0 be installed in a different location than any existing 1.x or 2.x installation. Any local policies can then be migrated gradually to the new 3.0 configuration. The number of differences in the new configuration mean that is is both simpler and safer to migrate your configurations rather than to try and just get the old configuration to work. 5. RUNNING THE SERVER --------------------- If the server builds and installs, but doesn't run correctly, then you should use debugging mode (radiusd -X) to figure out the problem. This is your BEST HOPE for understanding the problem. Read ALL of the messages which are printed to the screen, the answer to your problem will often be in a warning or error message. We really can't emphasize that last sentence enough. Configuring a RADIUS server for complex local authentication isn't a trivial task. Your ONLY method for debugging it is to read the debug messages, where the server will tell you exactly what it's doing, and why. You should then compare its behaviour to what you intended, and edit the configuration files as appropriate. If you don't use debugging mode, and ask questions on the mailing list, then the responses will all tell you to use debugging mode. The server prints out a lot of information in this mode, including suggestions for fixes to common problems. Look especially for "WARNING" in the output, and read the related messages. Since the main developers of FreeRADIUS use debugging mode to track down their configuration problems with the server, it's a good idea for you to use it, too. If you don't, there is little hope for you to solve ANY configuration problem related to the server. To start the server in debugging mode, do:: $ radiusd -X You should see a lot of text printed on the screen as it starts up. If you don't, or if you see error messages, please read the FAQ: http://www.freeradius.org/faq/ If the server says "Ready to process requests.", then it is running properly. From another shell (or another window), type:: $ radtest test test localhost 0 testing123 You should see the server print out more messages as it receives the request, and responds to it. The 'radtest' program should receive the response within a few seconds. It doesn't matter if the authentication request is accepted or rejected, what matters is that the server received the request, and responded to it. You can now edit the configuration files for your local system. You will usually want to start with ``sites-enabled/default``. To set which NASes (clients) can communicate with this server, edit ``clients.conf``. Please read the configuration files carefully, as many configuration options are only documented in comments in the file. Note that is is HIGHLY recommended that you use some sort of version control system to manage your configuration, such as git or Subversion. You should then make small changes to the configuration, checking in and testing as you go. When a config change causes the server to stop working, you will be able to easily step back and find out what update broke the configuraiton. Configuring and running the server MAY be complicated. Many modules have ``man`` pages. See ``man rlm_pap``, or ``man rlm_*`` for information. Please read the documentation in the doc/ directory. The comments in the configuration files also contain a lot of documentation. If you have any additional issues, the FAQ is also a good place to start. freeradius-3.2.10+dfsg/LICENSE000066400000000000000000000431331522352605200156600ustar00rootroot00000000000000 GNU GENERAL PUBLIC LICENSE Version 2, June 1991 Copyright (C) 1989, 1991 Free Software Foundation, Inc. 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Preamble The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change free software--to make sure the software is free for all its users. This General Public License applies to most of the Free Software Foundation's software and to any other program whose authors commit to using it. (Some other Free Software Foundation software is covered by the GNU Library General Public License instead.) You can apply it to your programs, too. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs; and that you know you can do these things. To protect your rights, we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights. These restrictions translate to certain responsibilities for you if you distribute copies of the software, or if you modify it. For example, if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights. We protect your rights with two steps: (1) copyright the software, and (2) offer you this license which gives you legal permission to copy, distribute and/or modify the software. Also, for each author's protection and ours, we want to make certain that everyone understands that there is no warranty for this free software. If the software is modified by someone else and passed on, we want its recipients to know that what they have is not the original, so that any problems introduced by others will not reflect on the original authors' reputations. Finally, any free program is threatened constantly by software patents. We wish to avoid the danger that redistributors of a free program will individually obtain patent licenses, in effect making the program proprietary. To prevent this, we have made it clear that any patent must be licensed for everyone's free use or not licensed at all. The precise terms and conditions for copying, distribution and modification follow. GNU GENERAL PUBLIC LICENSE TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 0. This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License. The "Program", below, refers to any such program or work, and a "work based on the Program" means either the Program or any derivative work under copyright law: that is to say, a work containing the Program or a portion of it, either verbatim or with modifications and/or translated into another language. (Hereinafter, translation is included without limitation in the term "modification".) Each licensee is addressed as "you". Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running the Program is not restricted, and the output from the Program is covered only if its contents constitute a work based on the Program (independent of having been made by running the Program). Whether that is true depends on what the Program does. 1. You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and give any other recipients of the Program a copy of this License along with the Program. You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee. 2. You may modify your copy or copies of the Program or any portion of it, thus forming a work based on the Program, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions: a) You must cause the modified files to carry prominent notices stating that you changed the files and the date of any change. b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License. c) If the modified program normally reads commands interactively when run, you must cause it, when started running for such interactive use in the most ordinary way, to print or display an announcement including an appropriate copyright notice and a notice that there is no warranty (or else, saying that you provide a warranty) and that users may redistribute the program under these conditions, and telling the user how to view a copy of this License. (Exception: if the Program itself is interactive but does not normally print such an announcement, your work based on the Program is not required to print an announcement.) These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it. Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Program. In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License. 3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following: a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, c) Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.) The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable. If distribution of executable or object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place counts as distribution of the source code, even though third parties are not compelled to copy the source along with the object code. 4. You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance. 5. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it. 6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties to this License. 7. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all. For example, if a patent license would not permit royalty-free redistribution of the Program by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program. If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply and the section as a whole is intended to apply in other circumstances. It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system, which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice. This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License. 8. If the distribution and/or use of the Program is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Program under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License. 9. The Free Software Foundation may publish revised and/or new versions of the General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of this License, you may choose any version ever published by the Free Software Foundation. 10. If you wish to incorporate parts of the Program into other free programs whose distribution conditions are different, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally. NO WARRANTY 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. END OF TERMS AND CONDITIONS How to Apply These Terms to Your New Programs If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms. To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively convey the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found. Copyright (C) This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA Also add information on how to contact you by electronic and paper mail. If the program is interactive, make it output a short notice like this when it starts in an interactive mode: Gnomovision version 69, Copyright (C) year name of author Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details. The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, the commands you use may be called something other than `show w' and `show c'; they could even be mouse-clicks or menu items--whatever suits your program. You should also get your employer (if you work as a programmer) or your school, if any, to sign a "copyright disclaimer" for the program, if necessary. Here is a sample; alter the names: Yoyodyne, Inc., hereby disclaims all copyright interest in the program `Gnomovision' (which makes passes at compilers) written by James Hacker. , 1 April 1989 Ty Coon, President of Vice This General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Library General Public License instead of this License. freeradius-3.2.10+dfsg/Make.inc.in000066400000000000000000000123401522352605200166240ustar00rootroot00000000000000# -*- makefile -*- # Make.inc.in # # Version: $Id: a40e6b6543039c8f9c89c49b716056be5b8f3df5 $ # # Location of files. prefix = @prefix@ exec_prefix = @exec_prefix@ sysconfdir = @sysconfdir@ localstatedir = @localstatedir@ libdir = @libdir@ bindir = @bindir@ sbindir = @sbindir@ docdir = @docdir@ mandir = @mandir@ datadir = @datadir@ dictdir = @dictdir@ logdir = @logdir@ includedir = @includedir@ # # In some systems, we don't want to over-write ANY configuration. # So we do: # # $./configure # $ make # $ make -Draddbdir=/tmp/garbage install # # and all of the configuration files go into /tmp/garbage # ifeq "${raddbdir}" "" raddbdir = @raddbdir@ endif modconfdir = @modconfdir@ radacctdir = @radacctdir@ top_builddir = @abs_top_builddir@ top_build_prefix=@abs_top_builddir@/ top_srcdir = @abs_top_srcdir@ datarootdir = @datarootdir@ MAKE = @MAKE@ # Makeflags set within the makefile appear to be additive and override # flags set on the command line and the environmental variables MAKEFLAGS = @FR_MAKEFLAGS@ CC = @CC@ RANLIB = @RANLIB@ INCLUDE = -I. -Isrc \ -include src/freeradius-devel/autoconf.h \ -include src/freeradius-devel/build.h \ -include src/freeradius-devel/features.h \ -include src/freeradius-devel/radpaths.h CFLAGS = $(INCLUDE) -fno-strict-aliasing @CFLAGS@ # # To quiet modern compilers. We're not going to fix warnings in the v3.2.x branch. # #CFLAGS += -Wno-unsafe-buffer-usage -Wno-extra-semi-stmt -Wno-format -Wno-reserved-macro-identifier \ # -Wno-reserved-identifier -Wno-switch-default -Wno-implicit-fallthrough \ # -Wno-default-const-init-field-unsafe -Wno-cast-function-type-strict -Wno-format-pedantic \ # -Wno-declaration-after-statement -Wno-vla -Wno-used-but-marked-unused -Wno-c2x-extensions \ # -Wno-assign-enum -Wno-unused-macros -Wno-disabled-macro-expansion -Wno-class-varargs \ # -Wno-incompatible-function-pointer-types-strict -Wno-bad-function-cast \ # -Wno-compound-token-split-by-macro -Wno-pre-c2x-compat -Wno-incompatible-function-pointer-types CPPFLAGS = @CPPFLAGS@ LIBPREFIX = @LIBPREFIX@ EXEEXT = @EXEEXT@ ACLOCAL = @ACLOCAL@ AUTOCONF = @AUTOCONF@ AUTOHEADER = @AUTOHEADER@ INSTALL = ${top_builddir}/install-sh -c INSTALL_PROGRAM = ${INSTALL} INSTALL_DATA = ${INSTALL} -m 644 INSTALL_SCRIPT = ${INSTALL_PROGRAM} INSTALLSTRIP = @INSTALLSTRIP@ MANSKIP = @MANSKIP@ # # Linker arguments for libraries searched for by the main # configure script. # TALLOC_LIBS = @TALLOC_LIBS@ TALLOC_LDFLAGS = @TALLOC_LDFLAGS@ OPENSSL_LIBS = @OPENSSL_LIBS@ OPENSSL_LDFLAGS = @OPENSSL_LDFLAGS@ OPENSSL_CPPFLAGS = @OPENSSL_CPPFLAGS@ PCAP_LIBS = @PCAP_LIBS@ PCAP_LDFLAGS = @PCAP_LDFLAGS@ COLLECTDC_LIBS = @COLLECTDC_LIBS@ COLLECTDC_LDFLAGS = @COLLECTDC_LDFLAGS@ SYSTEMD_LIBS = @SYSTEMD_LIBS@ SYSTEMD_LDFLAGS = @SYSTEMD_LDFLAGS@ LCRYPT = @CRYPTLIB@ # # OpenSSL libs (if used) must be linked everywhere in order for # the server to work properly on on all platforms. # LIBS = $(OPENSSL_LIBS) $(TALLOC_LIBS) @LIBS@ LDFLAGS = $(OPENSSL_LDFLAGS) $(TALLOC_LDFLAGS) @LDFLAGS@ LOGDIR = ${logdir} RADDBDIR = ${raddbdir} RUNDIR = ${localstatedir}/run/radiusd SBINDIR = ${sbindir} RADIR = ${radacctdir} LIBRADIUS = $(top_builddir)/src/lib/$(LIBPREFIX)freeradius-radius.la $(TALLOC_LIBS) USE_SHARED_LIBS = @USE_SHARED_LIBS@ bm_shared_libs = @USE_SHARED_LIBS@ USE_STATIC_LIBS = @USE_STATIC_LIBS@ bm_static_libs = @USE_STATIC_LIBS@ STATIC_MODULES = @STATIC_MODULES@ LIBREADLINE = @LIBREADLINE@ WITH_DHCP = @WITH_DHCP@ # # Version to use for packaging and other Make related things # RADIUSD_VERSION_STRING = @RADIUSD_VERSION_STRING@ # # This allows dlopen to do runtime checks for version mismatches # between what it was originally linked with, and the library it's # actually loading. # MODULES = @MODULES@ HOSTINFO = @HOSTINFO@ # # If the system has OpenSSL, use it's version of MD4/MD5/SHA1, instead of # using ours. # # We don't use OpenSSL SHA1 by default because src/modules/rlm_eap/libeap/fips186prf.c # needs access to the SHA internals. # ifeq "$(WITH_OPENSSL)" "yes" CFLAGS += -DWITH_OPENSSL_MD4 -DWITH_OPENSSL_MD5 CPPFLAGS := "$(OPENSSL_CPPFLAGS) $(CPPFLAGS)" endif OPENSSL_LIBS = @OPENSSL_LIBS@ ifneq ($(WITH_OPENSSL_MD5),) LIBRADIUS_WITH_OPENSSL = 1 CFLAGS += -DWITH_OPENSSL_MD5 endif ifneq ($(WITH_OPENSSL_SHA1),) LIBRADIUS_WITH_OPENSSL = 1 CFLAGS += -DWITH_OPENSSL_SHA1 endif ifneq ($(LIBRADIUS_WITH_OPENSSL),) ifeq ($(OPENSSL_LIBS),) $(error OPENSSL_LIBS must be define in order to use WITH_OPENSSL_*) else LIBRADIUS += $(OPENSSL_LIBS) endif endif # Path to clang, setting this enables the 'scan.*' build targets # which perform static analysis on various server components. ANALYZE.c := @clang_path@ # # With shared libs, the test binaries are in a different place # AND the method we use to run those binaries changes. # ifeq "$(USE_SHARED_LIBS)" "yes" TESTBINDIR = ./$(BUILD_DIR)/bin/local TESTBIN = FR_LIBRARY_PATH=./build/lib/.libs $(JLIBTOOL) --quiet --mode=execute $(TESTBINDIR) else TESTBINDIR = ./$(BUILD_DIR)/bin TESTBIN = ./$(BUILD_DIR)/bin endif # # For creating documentation via doc/all.mk # ASCIIDOCTOR := @ASCIIDOCTOR@ PANDOC := @PANDOC@ PANDOC_ENGINE := @PANDOC_ENGINE@ DOXYGEN := @DOXYGEN@ GRAPHVIZ_DOT := @GRAPHVIZ_DOT@ ANTORA := @ANTORA@ freeradius-3.2.10+dfsg/Makefile000066400000000000000000000312631522352605200163140ustar00rootroot00000000000000# # Makefile # # NOTE: This top-level Makefile must not # use GNU-make extensions. The lower ones can. # # Version: $Id: 888e74e14f0c371788f74309093b0c2d9e12bf34 $ # # # If we didn't call ./configure just define the version. # RADIUSD_VERSION_STRING := $(shell cat VERSION) # # The default rule is "all". # all: # # Catch people who try to use BSD make # ifeq "0" "1" .error GNU Make is required to build FreeRADIUS endif # # We require Make.inc, UNLESS the target is "make deb" # # Since "make deb" re-runs configure... there's no point in # requiring the developer to run configure *before* making # the debian packages. # ifneq "$(MAKECMDGOALS)" "deb" ifneq "$(MAKECMDGOALS)" "rpm" ifeq "$(findstring docker,$(MAKECMDGOALS))" "" ifeq "$(findstring crossbuild,$(MAKECMDGOALS))" "" $(if $(wildcard Make.inc),,$(error Missing 'Make.inc' Run './configure [options]' and retry)) include Make.inc endif endif endif endif MFLAGS += --no-print-directory # # The version of GNU Make is too old, don't use it (.FEATURES # variable was added in 3.81) # ifndef .FEATURES $(error The build system requires GNU Make 3.81 or later.) endif export DESTDIR := $(R) # # And over-ride all of the other magic. # ifneq "$(MAKECMDGOALS)" "deb" ifneq "$(MAKECMDGOALS)" "rpm" ifeq "$(findstring docker,$(MAKECMDGOALS))" "" ifeq "$(findstring crossbuild,$(MAKECMDGOALS))" "" include scripts/boiler.mk endif endif endif endif # # To work around OpenSSL issues within CI. # .PHONY: raddb/test.conf: @echo 'security {' >> $@ @echo ' allow_vulnerable_openssl = yes' >> $@ @echo '}' >> $@ @echo '$$INCLUDE radiusd.conf' >> $@ # # Run "radiusd -C", looking for errors. # # Only redirect STDOUT, which should contain details of why the test failed. # Don't molest STDERR as this may be used to receive output from a debugger. # $(BUILD_DIR)/tests/radiusd-c: raddb/test.conf ${BUILD_DIR}/bin/radiusd | build.raddb ${Q}$(MAKE) -C raddb/certs ${Q}printf "radiusd -C... " ${Q}if ! $(TESTBIN)/radiusd -XCMd ./raddb -D ./share -n test > $(BUILD_DIR)/tests/radiusd.config.log; then \ rm -f raddb/test.conf; \ cat $(BUILD_DIR)/tests/radiusd.config.log; \ echo "fail"; \ exit 1; \ fi ${Q}rm -f raddb/test.conf ${Q}echo "ok" ${Q}touch $@ test: ${BUILD_DIR}/bin/radiusd ${BUILD_DIR}/bin/radclient tests.unit tests.xlat tests.keywords tests.modules tests.auth test.sql_nas_table $(BUILD_DIR)/tests/radiusd-c | build.raddb ${Q}$(MAKE) -C src/tests tests # # Tests specifically for CI. We do a LOT more than just # the above tests # ci-test: raddb/test.conf test ${Q}$(TESTBIN)/radiusd -xxxv -n test ${Q}rm -f raddb/test.conf ${Q}$(MAKE) install ${Q}perl -p -i -e 's/allow_vulnerable_openssl = no/allow_vulnerable_openssl = yes/' ${raddbdir}/radiusd.conf ${Q}sh ${HOME}/freeradius/etc/raddb/certs ${Q}${sbindir}/radiusd -XC # # The $(R) is a magic variable not defined anywhere in this source. # It's purpose is to allow an admin to create an installation 'tar' # file *without* actually installing it. e.g.: # # $ R=/home/root/tmp make install # $ cd /home/root/tmp # $ tar -cf ~/freeradius-package.tar * # # The 'tar' file can then be un-tar'd on any similar machine. It's a # cheap way of creating packages, without using a package manager. # Many of the platform-specific packaging tools use the $(R) variable # when creating their packages. # # For compatibility with typical GNU packages (e.g. as seen in libltdl), # we make sure DESTDIR is defined. # export DESTDIR := $(R) DICTIONARIES := $(wildcard share/dictionary*) install.share: $(addprefix $(R)$(dictdir)/,$(notdir $(DICTIONARIES))) .PHONY: dictionary.format dictionary.format: $(DICTIONARIES) ${Q}./share/format.pl $(DICTIONARIES) $(R)$(dictdir)/%: share/% @echo INSTALL $(notdir $<) ${Q}$(INSTALL) -m 644 $< $@ MANFILES := $(filter-out $(MANSKIP),$(wildcard man/man*/*.?)) MANDIR := $(wildcard man/man*) install.man: $(subst man/,$(R)$(mandir)/,$(MANFILES)) $(MANDIR): ${Q}echo INSTALL $(patsubst $(R)$(mandir)/%,man/%,$@) ${Q}$(INSTALL) -d -m 755 $@ $(R)$(mandir)/%: man/% | $(dir $@) ${Q}echo INSTALL $(notdir $<) ${Q}sed -e "s,/etc/raddb,$(raddbdir),g" \ -e "s,/usr/local/share,$(datarootdir),g" \ $< > $<.subst ${Q}$(INSTALL) -m 644 $<.subst $@ ${Q}rm $<.subst # # Don't install rlm_test # ALL_INSTALL := $(patsubst %rlm_test.la,,$(ALL_INSTALL)) install: install.share install.man ${Q}$(INSTALL) -d -m 700 $(R)$(logdir) ${Q}$(INSTALL) -d -m 700 $(R)$(radacctdir) ifneq ($(RADMIN),) ifneq ($(RGROUP),) .PHONY: install-chown install-chown: chown -R $(RADMIN) $(R)$(raddbdir) chgrp -R $(RGROUP) $(R)$(raddbdir) chmod u=rwx,g=rx,o= `find $(R)$(raddbdir) -type d -print` chmod u=rw,g=r,o= `find $(R)$(raddbdir) -type f -print` chown -R $(RADMIN) $(R)$(logdir) chgrp -R $(RGROUP) $(R)$(logdir) find $(R)$(logdir) -type d -exec chmod u=rwx,g=rwx,o= {} \; find $(R)$(logdir) -type d -exec chmod g+s {} \; find $(R)$(logdir) -type f -exec chmod u=rw,g=rw,o= {} \; chown -R $(RADMIN) $(R)$(RUNDIR) chgrp -R $(RGROUP) $(R)$(RUNDIR) find $(R)$(RUNDIR) -type d -exec chmod u=rwx,g=rwx,o= {} \; find $(R)$(RUNDIR) -type d -exec chmod g+s {} \; find $(R)$(RUNDIR) -type f -exec chmod u=rw,g=rw,o= {} \; endif endif distclean: clean @-find src/modules -regex .\*/config[.][^.]*\$$ -delete @-find src/modules -name autom4te.cache -exec rm -rf '{}' \; @rm -rf config.cache config.log config.status libtool \ src/include/radpaths.h src/include/stamp-h \ libltdl/config.log libltdl/config.status \ libltdl/libtool autom4te.cache build @-find . ! -name configure.ac -name \*.in -print | \ sed 's/\.in$$//' | \ while read file; do rm -f $$file; done ###################################################################### # # Automatic remaking rules suggested by info:autoconf#Automatic_Remaking # ###################################################################### # # Do these checks ONLY if we're re-building the "configure" # scripts, and ONLY the "configure" scripts. If we leave # these rules enabled by default, then they're run too often. # ifeq "$(MAKECMDGOALS)" "reconfig" CONFIGURE_AC_FILES := $(shell find . -name configure.ac -print) CONFIGURE_FILES := $(patsubst %.ac,%,$(CONFIGURE_AC_FILES)) # # The GNU tools make autoconf=="missing autoconf", which then returns # 0, even when autoconf doesn't exist. This check is to ensure that # we run AUTOCONF only when it exists. # AUTOCONF_EXISTS := $(shell autoconf --version 2>/dev/null) ifeq "$(AUTOCONF_EXISTS)" "" $(error You need to install autoconf to re-build the "configure" scripts) endif # Configure files depend on ".ac" files, and on the top-level macro files # If there are headers, run auto-header, too. src/%configure: src/%configure.ac acinclude.m4 aclocal.m4 $(wildcard $(dir $@)m4/*m4) | src/freeradius-devel @echo AUTOCONF $(dir $@) ${Q}cd $(dir $@) && \ $(ACLOCAL) --force -I $(top_builddir) -I $(top_builddir)/m4 && \ $(AUTOCONF) --force ${Q}if grep AC_CONFIG_HEADERS $@ >/dev/null; then\ echo AUTOHEADER $@ \ cd $(dir $@) && $(AUTOHEADER) --force; \ fi # "%configure" doesn't match "configure" configure: configure.ac $(wildcard ac*.m4) $(wildcard m4/*.m4) @echo AUTOCONF $@ @$(ACLOCAL) --force @$(AUTOCONF) --force src/include/autoconf.h.in: configure.ac @echo AUTOHEADER $@ @$(AUTOHEADER) --force reconfig: $(CONFIGURE_FILES) src/include/autoconf.h.in config.status: configure ./config.status --recheck # target is "reconfig" endif # # If we've already run configure, then add rules which cause the # module-specific "all.mk" files to depend on the mk.in files, and on # the configure script. # ifneq "$(wildcard config.log)" "" CONFIGURE_ARGS := $(shell head -10 config.log | grep '^ \$$' | sed 's/^....//;s:.*configure ::') src/%all.mk: src/%all.mk.in src/%configure ${Q}echo CONFIGURE $(dir $@) ${Q}rm -f ./config.cache $(dir $<)/config.cache ${Q}cd $(dir $<) && ./configure $(CONFIGURE_ARGS) && touch $(notdir $@) endif .PHONY: check-includes check-includes: scripts/min-includes.pl `find . -name "*.c" -print` .PHONY: TAGS TAGS: etags `find src -type f -name '*.[ch]' -print` > $@ # # Make test certificates. # .PHONY: certs certs: ${Q}$(MAKE) -C raddb/certs ###################################################################### # # Make a release. # # Note that "Make.inc" has to be updated with the release number # BEFORE running this command! # ###################################################################### BRANCH = $(shell git rev-parse --abbrev-ref HEAD) freeradius-server-$(RADIUSD_VERSION_STRING).tar.gz: .git/HEAD git archive --format=tar --prefix=freeradius-server-$(RADIUSD_VERSION_STRING)/ $(BRANCH) | gzip > $@ freeradius-server-$(RADIUSD_VERSION_STRING).tar.bz2: .git/HEAD git archive --format=tar --prefix=freeradius-server-$(RADIUSD_VERSION_STRING)/ $(BRANCH) | bzip2 > $@ %.sig: % gpg --local-user packages@freeradius.org -b $< # # High-level targets # .PHONY: dist-check dist-check: redhat/freeradius.spec suse/freeradius.spec debian/changelog ${Q}if [ `grep ^Version: redhat/freeradius.spec | sed 's/.*://;s/ //g'` != "$(RADIUSD_VERSION_STRING)" ]; then \ cat redhat/freeradius.spec | sed 's/^Version:.*/Version: $(RADIUSD_VERSION_STRING)/' > redhat/.foo; \ mv redhat/.foo redhat/freeradius.spec; \ echo redhat/freeradius.spec 'Version' needs to be updated; \ exit 1; \ fi ${Q}if [ `grep ^Version: suse/freeradius.spec | sed 's/.*://;s/ //g'` != "$(RADIUSD_VERSION_STRING)" ]; then \ cat suse/freeradius.spec | sed 's/^Version: .*/Version: $(RADIUSD_VERSION_STRING)/' > suse/.foo; \ mv suse/.foo suse/freeradius.spec; \ echo suse/freeradius.spec 'Version' needs to be updated; \ exit 1; \ fi ${Q}if [ `head -n 1 doc/ChangeLog | awk '/^FreeRADIUS/{print $$2}'` != "$(RADIUSD_VERSION_STRING)" ]; then \ echo doc/ChangeLog needs to be updated; \ exit 1; \ fi ${Q}if [ `head -n 1 debian/changelog | sed 's/.*(//;s/-0).*//;s/-1).*//;s/\+.*//'` != "$(RADIUSD_VERSION_STRING)" ]; then \ echo debian/changelog needs to be updated; \ exit 1; \ fi ${Q}if [ `grep version doc/antora/antora.yml | sed 's/^.*version: //'` != "'$(RADIUSD_VERSION_STRING)'" ]; then \ echo doc/antora/antora.yml needs to be updated with: version '$(RADIUSD_VERSION_STRING)'; \ exit 1; \ fi dist: dist-check freeradius-server-$(RADIUSD_VERSION_STRING).tar.gz freeradius-server-$(RADIUSD_VERSION_STRING).tar.bz2 dist-sign: dist-check freeradius-server-$(RADIUSD_VERSION_STRING).tar.gz.sig freeradius-server-$(RADIUSD_VERSION_STRING).tar.bz2.sig dist-publish: freeradius-server-$(RADIUSD_VERSION_STRING).tar.gz.sig freeradius-server-$(RADIUSD_VERSION_STRING).tar.gz freeradius-server-$(RADIUSD_VERSION_STRING).tar.gz.sig freeradius-server-$(RADIUSD_VERSION_STRING).tar.bz2 freeradius-server-$(RADIUSD_VERSION_STRING).tar.gz.sig freeradius-server-$(RADIUSD_VERSION_STRING).tar.bz2.sig scp $^ freeradius.org@ftp.freeradius.org:public_ftp # # Note that we do NOT do the tagging here! We just print out what # to do! # dist-tag: freeradius-server-$(RADIUSD_VERSION_STRING).tar.gz freeradius-server-$(RADIUSD_VERSION_STRING).tar.bz2 ${Q}echo "git tag release_`echo $(RADIUSD_VERSION_STRING) | tr .- __`" # # Docker-related targets (main Docker images and crossbuild) # ifneq "$(findstring docker,$(MAKECMDGOALS))" "" include scripts/docker/docker.mk endif ifneq "$(findstring crossbuild,$(MAKECMDGOALS))" "" include scripts/crossbuild/crossbuild.mk endif # # Build a Debian package # DEBBUILDEXTRA = --jobs=auto .PHONY: deb deb: fakeroot debian/rules debian/control #clean fakeroot dpkg-buildpackage $(DEBBUILDEXTRA) -b -uc # # Build an RPM package # .PHONY: rpm rpmbuild/SOURCES/freeradius-server-$(RADIUSD_VERSION_STRING).tar.bz2: freeradius-server-$(RADIUSD_VERSION_STRING).tar.bz2 ${Q}mkdir -p $(addprefix rpmbuild/,SOURCES SPECS BUILD RPMS SRPMS BUILDROOT) ${Q}for file in `awk '/^Source...:/ {print $$2}' redhat/freeradius.spec` ; do cp redhat/$$file rpmbuild/SOURCES/$$file ; done ${Q}cp $< $@ rpm: rpmbuild/SOURCES/freeradius-server-$(RADIUSD_VERSION_STRING).tar.bz2 ${Q}if ! yum-builddep -q -C --assumeno redhat/freeradius.spec 1> /dev/null 2>&1; then \ echo "ERROR: Required depdendencies not found, install them with: yum-builddep redhat/freeradius.spec"; \ exit 1; \ fi ${Q}QA_RPATHS=0x0003 rpmbuild --define "_topdir `pwd`/rpmbuild" -bb $(RPMBUILD_FLAGS) redhat/freeradius.spec # # Developer checks # .PHONY: warnings warnings: ${Q}(make clean all 2>&1) | egrep -v '^/|deprecated|^In file included|: In function| from |^HEADER|^CC|^LN|^LINK' > warnings.txt ${Q}@wc -l warnings.txt # # Ensure we're using tabs in the configuration files, # and remove trailing whitespace in source files. # .PHONY: whitespace whitespace: ${Q}for x in $$(git ls-files raddb/ src/); do unexpand $$x > $$x.bak; cp $$x.bak $$x; rm -f $$x.bak;done ${Q}perl -p -i -e 'trim' $$(git ls-files src/) freeradius-3.2.10+dfsg/README.rst000066400000000000000000000161351522352605200163440ustar00rootroot00000000000000The FreeRADIUS server ===================== |BuildStatus|_ |CoverityStatus|_ .. contents:: :local: Introduction ------------ The FreeRADIUS Server Project is a high performance and highly configurable multi-protocol policy server, supporting RADIUS, DHCPv4 and VMPS. It is available under the terms of the GNU GPLv2. Using RADIUS allows authentication and authorization for a network to be centralized, and minimizes the number of changes that have to be done when adding or deleting new users to a network. FreeRADIUS can authenticate users on systems such as 802.1X (WiFi), dialup, PPPoE, VPN's, VoIP, and many others. It supports back-end databases such as MySQL, PostgreSQL, Oracle, Microsoft Active Directory, Redis, OpenLDAP, and many more. It is used daily to authenticate the Internet access for hundreds of millions of people, in sites ranging from 10 to 10 million+ users. Version 3.0 of the server is largely compatible with version 2.x, but we highly recommend that you recreate your configuration, rather than trying to get the older configuration to work. For a list of changes in version 3.0, please see ``doc/ChangeLog``. See ``raddb/README.rst`` for information on what to do to update your configuration. Administrators upgrading from a previous version should install this version in a different location from their existing systems. Any existing configuration should be carefully migrated to the new version, in order to take advantage of the new features which can greatly simply configuration. Please see https://freeradius.org and https://wiki.freeradius.org for more information. Installation ------------ To install the server, please see the INSTALL file in this directory. Configuring the server ---------------------- We understand that the server may be difficult to configure, install, or administer. It is, after all, a complex system with many different configuration possibilities. The most common problem is that people change large amounts of the configuration without understanding what they're doing, and without testing their changes. The preferred method of operation is the following: 1. Start off with the default configuration files. 2. Save a copy of the default configuration: It WORKS. Don't change it! 3. Verify that the server starts - in debugging mode (``radiusd -X``). 4. Send it test packets using "radclient", or a NAS or AP. 5. Verify that the server does what you expect - If it does not work, change the configuration, and go to step (3) - If you're stuck, revert to using the "last working" configuration. - If it works, proceed to step (6). 6. Save a copy of the working configuration, along with a note of what you changed, and why. 7. Make a SMALL change to the configuration. 8. Repeat from step (3). This method will ensure that you have a working configuration that is customized to your site as quickly as possible. While it may seem frustrating to proceed via a series of small steps, the alternative will always take more time. The "fast and loose" way will be MORE frustrating than quickly making forward progress! Debugging the Server -------------------- Run the server in debugging mode, (``radiusd -X``) and READ the output. We cannot emphasize this point strongly enough. The vast majority of problems can be solved by carefully reading the debugging output, which includes WARNINGs about common issues, and suggestions for how they may be fixed. Many questions are answered on the Wiki: https://wiki.freeradius.org Read the configuration files. Many parts of the server are documented only with extensive comments in the configuration files. Search the mailing lists. For example, using Google, searching "site:lists.freeradius.org " will return results from the FreeRADIUS mailing lists. https://freeradius.org/support/ Feedback, Defects, and Community Support ---------------------------------------- If you have any comments, or are having difficulty getting FreeRADIUS to do what you want, please post to the 'freeradius-users' list (see the URL above). The FreeRADIUS mailing list is operated, and contributed to, by the FreeRADIUS community. Users of the list will be more than happy to answer your questions, with the caveat that you've read documentation relevant to your issue first. If you suspect a defect in the server, would like to request a feature, or submit a code patch, please use the GitHub issue tracker for the freeradius-server `repository `_. However, it is nearly always best to raise the issue on the mailing lists first to determine whether it really is a defect or missing feature. Instructions for gathering data for defect reports can be found in ``doc/bugs`` or on the `wiki `_. Under no circumstances should the issue tracker be used for support requests, those questions belong on the user's mailing list. If you post questions related to the server in the issue tracker, the issue will be closed and locked. If you persist in positing questions to the issue tracker you will be banned from all FreeRADIUS project repositories on GitHub. Please do NOT complain that the developers aren't answering your questions quickly enough, or aren't fixing the problems quickly enough. Please do NOT complain if you're told to go read documentation. We recognize that the documentation isn't perfect, but it *does* exist, and reading it can solve most common questions. FreeRADIUS is the cumulative effort of many years of work by many people, and you've gotten it for free. No one is getting paid to answer your questions. This is free software, and the only way it gets better is if you make a contribution back to the project ($$, code, or documentation). We will note that the people who get most upset about any answers to their questions usually do not have any intention of contributing to the project. We will repeat the comments above: no one is getting paid to answer your questions or to fix your bugs. If you don't like the responses you are getting, then fix the bug yourself, or pay someone to address your concerns. Either way, make sure that any fix is contributed back to the project so that no one else runs into the same issue. Books on RADIUS --------------- See ``doc/README`` for more information about FreeRADIUS. There is an O'Reilly book available. It serves as a good introduction for anyone new to RADIUS. However, it is almost 20 years old, and is not much more than a basic introduction to the subject. https://www.amazon.com/exec/obidos/ASIN/0596003226/freeradiusorg-20/ Commercial support ------------------ Technical support, managed systems support, custom deployments, sponsored feature development and many other commercial services are available from `Network RADIUS `_. .. |CoverityStatus| image:: https://scan.coverity.com/projects/58/badge.svg? .. _CoverityStatus: https://scan.coverity.com/projects/58 .. |BuildStatus| image:: https://github.com/FreeRADIUS/freeradius-server/workflows/CI/badge.svg?branch=v3.2.x .. _BuildStatus: https://github.com/FreeRADIUS/freeradius-server/actions?query=workflow%3ACI freeradius-3.2.10+dfsg/VERSION000066400000000000000000000000071522352605200157140ustar00rootroot000000000000003.2.10 freeradius-3.2.10+dfsg/config.guess000066400000000000000000001404501522352605200171700ustar00rootroot00000000000000#! /bin/sh # Attempt to guess a canonical system name. # Copyright 1992-2021 Free Software Foundation, Inc. timestamp='2021-01-01' # This file is free software; you can redistribute it and/or modify it # under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, but # WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, see . # # As a special exception to the GNU General Public License, if you # distribute this file as part of a program that contains a # configuration script generated by Autoconf, you may include it under # the same distribution terms that you use for the rest of that # program. This Exception is an additional permission under section 7 # of the GNU General Public License, version 3 ("GPLv3"). # # Originally written by Per Bothner; maintained since 2000 by Ben Elliston. # # You can get the latest version of this script from: # https://git.savannah.gnu.org/cgit/config.git/plain/config.guess # # Please send patches to . me=$(echo "$0" | sed -e 's,.*/,,') usage="\ Usage: $0 [OPTION] Output the configuration name of the system \`$me' is run on. Options: -h, --help print this help, then exit -t, --time-stamp print date of last modification, then exit -v, --version print version number, then exit Report bugs and patches to ." version="\ GNU config.guess ($timestamp) Originally written by Per Bothner. Copyright 1992-2021 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE." help=" Try \`$me --help' for more information." # Parse command line while test $# -gt 0 ; do case $1 in --time-stamp | --time* | -t ) echo "$timestamp" ; exit ;; --version | -v ) echo "$version" ; exit ;; --help | --h* | -h ) echo "$usage"; exit ;; -- ) # Stop option processing shift; break ;; - ) # Use stdin as input. break ;; -* ) echo "$me: invalid option $1$help" >&2 exit 1 ;; * ) break ;; esac done if test $# != 0; then echo "$me: too many arguments$help" >&2 exit 1 fi # CC_FOR_BUILD -- compiler used by this script. Note that the use of a # compiler to aid in system detection is discouraged as it requires # temporary files to be created and, as you can see below, it is a # headache to deal with in a portable fashion. # Historically, `CC_FOR_BUILD' used to be named `HOST_CC'. We still # use `HOST_CC' if defined, but it is deprecated. # Portable tmp directory creation inspired by the Autoconf team. tmp= # shellcheck disable=SC2172 trap 'test -z "$tmp" || rm -fr "$tmp"' 0 1 2 13 15 set_cc_for_build() { # prevent multiple calls if $tmp is already set test "$tmp" && return 0 : "${TMPDIR=/tmp}" # shellcheck disable=SC2039 { tmp=$( (umask 077 && mktemp -d "$TMPDIR/cgXXXXXX") 2>/dev/null) && test -n "$tmp" && test -d "$tmp" ; } || { test -n "$RANDOM" && tmp=$TMPDIR/cg$$-$RANDOM && (umask 077 && mkdir "$tmp" 2>/dev/null) ; } || { tmp=$TMPDIR/cg-$$ && (umask 077 && mkdir "$tmp" 2>/dev/null) && echo "Warning: creating insecure temp directory" >&2 ; } || { echo "$me: cannot create a temporary directory in $TMPDIR" >&2 ; exit 1 ; } dummy=$tmp/dummy case ${CC_FOR_BUILD-},${HOST_CC-},${CC-} in ,,) echo "int x;" > "$dummy.c" for driver in cc gcc c89 c99 ; do if ($driver -c -o "$dummy.o" "$dummy.c") >/dev/null 2>&1 ; then CC_FOR_BUILD="$driver" break fi done if test x"$CC_FOR_BUILD" = x ; then CC_FOR_BUILD=no_compiler_found fi ;; ,,*) CC_FOR_BUILD=$CC ;; ,*,*) CC_FOR_BUILD=$HOST_CC ;; esac } # This is needed to find uname on a Pyramid OSx when run in the BSD universe. # (ghazi@noc.rutgers.edu 1994-08-24) if test -f /.attbin/uname ; then PATH=$PATH:/.attbin ; export PATH fi UNAME_MACHINE=$( (uname -m) 2>/dev/null) || UNAME_MACHINE=unknown UNAME_RELEASE=$( (uname -r) 2>/dev/null) || UNAME_RELEASE=unknown UNAME_SYSTEM=$( (uname -s) 2>/dev/null) || UNAME_SYSTEM=unknown UNAME_VERSION=$( (uname -v) 2>/dev/null) || UNAME_VERSION=unknown case "$UNAME_SYSTEM" in Linux|GNU|GNU/*) LIBC=unknown set_cc_for_build cat <<-EOF > "$dummy.c" #include #if defined(__UCLIBC__) LIBC=uclibc #elif defined(__dietlibc__) LIBC=dietlibc #elif defined(__GLIBC__) LIBC=gnu #else #include /* First heuristic to detect musl libc. */ #ifdef __DEFINED_va_list LIBC=musl #endif #endif EOF eval "$($CC_FOR_BUILD -E "$dummy.c" 2>/dev/null | grep '^LIBC' | sed 's, ,,g')" # Second heuristic to detect musl libc. if [ "$LIBC" = unknown ] && command -v ldd >/dev/null && ldd --version 2>&1 | grep -q ^musl; then LIBC=musl fi # If the system lacks a compiler, then just pick glibc. # We could probably try harder. if [ "$LIBC" = unknown ]; then LIBC=gnu fi ;; esac # Note: order is significant - the case branches are not exclusive. case "$UNAME_MACHINE:$UNAME_SYSTEM:$UNAME_RELEASE:$UNAME_VERSION" in *:NetBSD:*:*) # NetBSD (nbsd) targets should (where applicable) match one or # more of the tuples: *-*-netbsdelf*, *-*-netbsdaout*, # *-*-netbsdecoff* and *-*-netbsd*. For targets that recently # switched to ELF, *-*-netbsd* would select the old # object file format. This provides both forward # compatibility and a consistent mechanism for selecting the # object file format. # # Note: NetBSD doesn't particularly care about the vendor # portion of the name. We always set it to "unknown". sysctl="sysctl -n hw.machine_arch" UNAME_MACHINE_ARCH=$( (uname -p 2>/dev/null || \ "/sbin/$sysctl" 2>/dev/null || \ "/usr/sbin/$sysctl" 2>/dev/null || \ echo unknown)) case "$UNAME_MACHINE_ARCH" in aarch64eb) machine=aarch64_be-unknown ;; armeb) machine=armeb-unknown ;; arm*) machine=arm-unknown ;; sh3el) machine=shl-unknown ;; sh3eb) machine=sh-unknown ;; sh5el) machine=sh5le-unknown ;; earmv*) arch=$(echo "$UNAME_MACHINE_ARCH" | sed -e 's,^e\(armv[0-9]\).*$,\1,') endian=$(echo "$UNAME_MACHINE_ARCH" | sed -ne 's,^.*\(eb\)$,\1,p') machine="${arch}${endian}"-unknown ;; *) machine="$UNAME_MACHINE_ARCH"-unknown ;; esac # The Operating System including object format, if it has switched # to ELF recently (or will in the future) and ABI. case "$UNAME_MACHINE_ARCH" in earm*) os=netbsdelf ;; arm*|i386|m68k|ns32k|sh3*|sparc|vax) set_cc_for_build if echo __ELF__ | $CC_FOR_BUILD -E - 2>/dev/null \ | grep -q __ELF__ then # Once all utilities can be ECOFF (netbsdecoff) or a.out (netbsdaout). # Return netbsd for either. FIX? os=netbsd else os=netbsdelf fi ;; *) os=netbsd ;; esac # Determine ABI tags. case "$UNAME_MACHINE_ARCH" in earm*) expr='s/^earmv[0-9]/-eabi/;s/eb$//' abi=$(echo "$UNAME_MACHINE_ARCH" | sed -e "$expr") ;; esac # The OS release # Debian GNU/NetBSD machines have a different userland, and # thus, need a distinct triplet. However, they do not need # kernel version information, so it can be replaced with a # suitable tag, in the style of linux-gnu. case "$UNAME_VERSION" in Debian*) release='-gnu' ;; *) release=$(echo "$UNAME_RELEASE" | sed -e 's/[-_].*//' | cut -d. -f1,2) ;; esac # Since CPU_TYPE-MANUFACTURER-KERNEL-OPERATING_SYSTEM: # contains redundant information, the shorter form: # CPU_TYPE-MANUFACTURER-OPERATING_SYSTEM is used. echo "$machine-${os}${release}${abi-}" exit ;; *:Bitrig:*:*) UNAME_MACHINE_ARCH=$(arch | sed 's/Bitrig.//') echo "$UNAME_MACHINE_ARCH"-unknown-bitrig"$UNAME_RELEASE" exit ;; *:OpenBSD:*:*) UNAME_MACHINE_ARCH=$(arch | sed 's/OpenBSD.//') echo "$UNAME_MACHINE_ARCH"-unknown-openbsd"$UNAME_RELEASE" exit ;; *:LibertyBSD:*:*) UNAME_MACHINE_ARCH=$(arch | sed 's/^.*BSD\.//') echo "$UNAME_MACHINE_ARCH"-unknown-libertybsd"$UNAME_RELEASE" exit ;; *:MidnightBSD:*:*) echo "$UNAME_MACHINE"-unknown-midnightbsd"$UNAME_RELEASE" exit ;; *:ekkoBSD:*:*) echo "$UNAME_MACHINE"-unknown-ekkobsd"$UNAME_RELEASE" exit ;; *:SolidBSD:*:*) echo "$UNAME_MACHINE"-unknown-solidbsd"$UNAME_RELEASE" exit ;; *:OS108:*:*) echo "$UNAME_MACHINE"-unknown-os108_"$UNAME_RELEASE" exit ;; macppc:MirBSD:*:*) echo powerpc-unknown-mirbsd"$UNAME_RELEASE" exit ;; *:MirBSD:*:*) echo "$UNAME_MACHINE"-unknown-mirbsd"$UNAME_RELEASE" exit ;; *:Sortix:*:*) echo "$UNAME_MACHINE"-unknown-sortix exit ;; *:Twizzler:*:*) echo "$UNAME_MACHINE"-unknown-twizzler exit ;; *:Redox:*:*) echo "$UNAME_MACHINE"-unknown-redox exit ;; mips:OSF1:*.*) echo mips-dec-osf1 exit ;; alpha:OSF1:*:*) case $UNAME_RELEASE in *4.0) UNAME_RELEASE=$(/usr/sbin/sizer -v | awk '{print $3}') ;; *5.*) UNAME_RELEASE=$(/usr/sbin/sizer -v | awk '{print $4}') ;; esac # According to Compaq, /usr/sbin/psrinfo has been available on # OSF/1 and Tru64 systems produced since 1995. I hope that # covers most systems running today. This code pipes the CPU # types through head -n 1, so we only detect the type of CPU 0. ALPHA_CPU_TYPE=$(/usr/sbin/psrinfo -v | sed -n -e 's/^ The alpha \(.*\) processor.*$/\1/p' | head -n 1) case "$ALPHA_CPU_TYPE" in "EV4 (21064)") UNAME_MACHINE=alpha ;; "EV4.5 (21064)") UNAME_MACHINE=alpha ;; "LCA4 (21066/21068)") UNAME_MACHINE=alpha ;; "EV5 (21164)") UNAME_MACHINE=alphaev5 ;; "EV5.6 (21164A)") UNAME_MACHINE=alphaev56 ;; "EV5.6 (21164PC)") UNAME_MACHINE=alphapca56 ;; "EV5.7 (21164PC)") UNAME_MACHINE=alphapca57 ;; "EV6 (21264)") UNAME_MACHINE=alphaev6 ;; "EV6.7 (21264A)") UNAME_MACHINE=alphaev67 ;; "EV6.8CB (21264C)") UNAME_MACHINE=alphaev68 ;; "EV6.8AL (21264B)") UNAME_MACHINE=alphaev68 ;; "EV6.8CX (21264D)") UNAME_MACHINE=alphaev68 ;; "EV6.9A (21264/EV69A)") UNAME_MACHINE=alphaev69 ;; "EV7 (21364)") UNAME_MACHINE=alphaev7 ;; "EV7.9 (21364A)") UNAME_MACHINE=alphaev79 ;; esac # A Pn.n version is a patched version. # A Vn.n version is a released version. # A Tn.n version is a released field test version. # A Xn.n version is an unreleased experimental baselevel. # 1.2 uses "1.2" for uname -r. echo "$UNAME_MACHINE"-dec-osf"$(echo "$UNAME_RELEASE" | sed -e 's/^[PVTX]//' | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz)" # Reset EXIT trap before exiting to avoid spurious non-zero exit code. exitcode=$? trap '' 0 exit $exitcode ;; Amiga*:UNIX_System_V:4.0:*) echo m68k-unknown-sysv4 exit ;; *:[Aa]miga[Oo][Ss]:*:*) echo "$UNAME_MACHINE"-unknown-amigaos exit ;; *:[Mm]orph[Oo][Ss]:*:*) echo "$UNAME_MACHINE"-unknown-morphos exit ;; *:OS/390:*:*) echo i370-ibm-openedition exit ;; *:z/VM:*:*) echo s390-ibm-zvmoe exit ;; *:OS400:*:*) echo powerpc-ibm-os400 exit ;; arm:RISC*:1.[012]*:*|arm:riscix:1.[012]*:*) echo arm-acorn-riscix"$UNAME_RELEASE" exit ;; arm*:riscos:*:*|arm*:RISCOS:*:*) echo arm-unknown-riscos exit ;; SR2?01:HI-UX/MPP:*:* | SR8000:HI-UX/MPP:*:*) echo hppa1.1-hitachi-hiuxmpp exit ;; Pyramid*:OSx*:*:* | MIS*:OSx*:*:* | MIS*:SMP_DC-OSx*:*:*) # akee@wpdis03.wpafb.af.mil (Earle F. Ake) contributed MIS and NILE. if test "$( (/bin/universe) 2>/dev/null)" = att ; then echo pyramid-pyramid-sysv3 else echo pyramid-pyramid-bsd fi exit ;; NILE*:*:*:dcosx) echo pyramid-pyramid-svr4 exit ;; DRS?6000:unix:4.0:6*) echo sparc-icl-nx6 exit ;; DRS?6000:UNIX_SV:4.2*:7* | DRS?6000:isis:4.2*:7*) case $(/usr/bin/uname -p) in sparc) echo sparc-icl-nx7; exit ;; esac ;; s390x:SunOS:*:*) echo "$UNAME_MACHINE"-ibm-solaris2"$(echo "$UNAME_RELEASE" | sed -e 's/[^.]*//')" exit ;; sun4H:SunOS:5.*:*) echo sparc-hal-solaris2"$(echo "$UNAME_RELEASE"|sed -e 's/[^.]*//')" exit ;; sun4*:SunOS:5.*:* | tadpole*:SunOS:5.*:*) echo sparc-sun-solaris2"$(echo "$UNAME_RELEASE" | sed -e 's/[^.]*//')" exit ;; i86pc:AuroraUX:5.*:* | i86xen:AuroraUX:5.*:*) echo i386-pc-auroraux"$UNAME_RELEASE" exit ;; i86pc:SunOS:5.*:* | i86xen:SunOS:5.*:*) set_cc_for_build SUN_ARCH=i386 # If there is a compiler, see if it is configured for 64-bit objects. # Note that the Sun cc does not turn __LP64__ into 1 like gcc does. # This test works for both compilers. if test "$CC_FOR_BUILD" != no_compiler_found; then if (echo '#ifdef __amd64'; echo IS_64BIT_ARCH; echo '#endif') | \ (CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) | \ grep IS_64BIT_ARCH >/dev/null then SUN_ARCH=x86_64 fi fi echo "$SUN_ARCH"-pc-solaris2"$(echo "$UNAME_RELEASE"|sed -e 's/[^.]*//')" exit ;; sun4*:SunOS:6*:*) # According to config.sub, this is the proper way to canonicalize # SunOS6. Hard to guess exactly what SunOS6 will be like, but # it's likely to be more like Solaris than SunOS4. echo sparc-sun-solaris3"$(echo "$UNAME_RELEASE"|sed -e 's/[^.]*//')" exit ;; sun4*:SunOS:*:*) case "$(/usr/bin/arch -k)" in Series*|S4*) UNAME_RELEASE=$(uname -v) ;; esac # Japanese Language versions have a version number like `4.1.3-JL'. echo sparc-sun-sunos"$(echo "$UNAME_RELEASE"|sed -e 's/-/_/')" exit ;; sun3*:SunOS:*:*) echo m68k-sun-sunos"$UNAME_RELEASE" exit ;; sun*:*:4.2BSD:*) UNAME_RELEASE=$( (sed 1q /etc/motd | awk '{print substr($5,1,3)}') 2>/dev/null) test "x$UNAME_RELEASE" = x && UNAME_RELEASE=3 case "$(/bin/arch)" in sun3) echo m68k-sun-sunos"$UNAME_RELEASE" ;; sun4) echo sparc-sun-sunos"$UNAME_RELEASE" ;; esac exit ;; aushp:SunOS:*:*) echo sparc-auspex-sunos"$UNAME_RELEASE" exit ;; # The situation for MiNT is a little confusing. The machine name # can be virtually everything (everything which is not # "atarist" or "atariste" at least should have a processor # > m68000). The system name ranges from "MiNT" over "FreeMiNT" # to the lowercase version "mint" (or "freemint"). Finally # the system name "TOS" denotes a system which is actually not # MiNT. But MiNT is downward compatible to TOS, so this should # be no problem. atarist[e]:*MiNT:*:* | atarist[e]:*mint:*:* | atarist[e]:*TOS:*:*) echo m68k-atari-mint"$UNAME_RELEASE" exit ;; atari*:*MiNT:*:* | atari*:*mint:*:* | atarist[e]:*TOS:*:*) echo m68k-atari-mint"$UNAME_RELEASE" exit ;; *falcon*:*MiNT:*:* | *falcon*:*mint:*:* | *falcon*:*TOS:*:*) echo m68k-atari-mint"$UNAME_RELEASE" exit ;; milan*:*MiNT:*:* | milan*:*mint:*:* | *milan*:*TOS:*:*) echo m68k-milan-mint"$UNAME_RELEASE" exit ;; hades*:*MiNT:*:* | hades*:*mint:*:* | *hades*:*TOS:*:*) echo m68k-hades-mint"$UNAME_RELEASE" exit ;; *:*MiNT:*:* | *:*mint:*:* | *:*TOS:*:*) echo m68k-unknown-mint"$UNAME_RELEASE" exit ;; m68k:machten:*:*) echo m68k-apple-machten"$UNAME_RELEASE" exit ;; powerpc:machten:*:*) echo powerpc-apple-machten"$UNAME_RELEASE" exit ;; RISC*:Mach:*:*) echo mips-dec-mach_bsd4.3 exit ;; RISC*:ULTRIX:*:*) echo mips-dec-ultrix"$UNAME_RELEASE" exit ;; VAX*:ULTRIX*:*:*) echo vax-dec-ultrix"$UNAME_RELEASE" exit ;; 2020:CLIX:*:* | 2430:CLIX:*:*) echo clipper-intergraph-clix"$UNAME_RELEASE" exit ;; mips:*:*:UMIPS | mips:*:*:RISCos) set_cc_for_build sed 's/^ //' << EOF > "$dummy.c" #ifdef __cplusplus #include /* for printf() prototype */ int main (int argc, char *argv[]) { #else int main (argc, argv) int argc; char *argv[]; { #endif #if defined (host_mips) && defined (MIPSEB) #if defined (SYSTYPE_SYSV) printf ("mips-mips-riscos%ssysv\\n", argv[1]); exit (0); #endif #if defined (SYSTYPE_SVR4) printf ("mips-mips-riscos%ssvr4\\n", argv[1]); exit (0); #endif #if defined (SYSTYPE_BSD43) || defined(SYSTYPE_BSD) printf ("mips-mips-riscos%sbsd\\n", argv[1]); exit (0); #endif #endif exit (-1); } EOF $CC_FOR_BUILD -o "$dummy" "$dummy.c" && dummyarg=$(echo "$UNAME_RELEASE" | sed -n 's/\([0-9]*\).*/\1/p') && SYSTEM_NAME=$("$dummy" "$dummyarg") && { echo "$SYSTEM_NAME"; exit; } echo mips-mips-riscos"$UNAME_RELEASE" exit ;; Motorola:PowerMAX_OS:*:*) echo powerpc-motorola-powermax exit ;; Motorola:*:4.3:PL8-*) echo powerpc-harris-powermax exit ;; Night_Hawk:*:*:PowerMAX_OS | Synergy:PowerMAX_OS:*:*) echo powerpc-harris-powermax exit ;; Night_Hawk:Power_UNIX:*:*) echo powerpc-harris-powerunix exit ;; m88k:CX/UX:7*:*) echo m88k-harris-cxux7 exit ;; m88k:*:4*:R4*) echo m88k-motorola-sysv4 exit ;; m88k:*:3*:R3*) echo m88k-motorola-sysv3 exit ;; AViiON:dgux:*:*) # DG/UX returns AViiON for all architectures UNAME_PROCESSOR=$(/usr/bin/uname -p) if test "$UNAME_PROCESSOR" = mc88100 || test "$UNAME_PROCESSOR" = mc88110 then if test "$TARGET_BINARY_INTERFACE"x = m88kdguxelfx || \ test "$TARGET_BINARY_INTERFACE"x = x then echo m88k-dg-dgux"$UNAME_RELEASE" else echo m88k-dg-dguxbcs"$UNAME_RELEASE" fi else echo i586-dg-dgux"$UNAME_RELEASE" fi exit ;; M88*:DolphinOS:*:*) # DolphinOS (SVR3) echo m88k-dolphin-sysv3 exit ;; M88*:*:R3*:*) # Delta 88k system running SVR3 echo m88k-motorola-sysv3 exit ;; XD88*:*:*:*) # Tektronix XD88 system running UTekV (SVR3) echo m88k-tektronix-sysv3 exit ;; Tek43[0-9][0-9]:UTek:*:*) # Tektronix 4300 system running UTek (BSD) echo m68k-tektronix-bsd exit ;; *:IRIX*:*:*) echo mips-sgi-irix"$(echo "$UNAME_RELEASE"|sed -e 's/-/_/g')" exit ;; ????????:AIX?:[12].1:2) # AIX 2.2.1 or AIX 2.1.1 is RT/PC AIX. echo romp-ibm-aix # uname -m gives an 8 hex-code CPU id exit ;; # Note that: echo "'$(uname -s)'" gives 'AIX ' i*86:AIX:*:*) echo i386-ibm-aix exit ;; ia64:AIX:*:*) if test -x /usr/bin/oslevel ; then IBM_REV=$(/usr/bin/oslevel) else IBM_REV="$UNAME_VERSION.$UNAME_RELEASE" fi echo "$UNAME_MACHINE"-ibm-aix"$IBM_REV" exit ;; *:AIX:2:3) if grep bos325 /usr/include/stdio.h >/dev/null 2>&1; then set_cc_for_build sed 's/^ //' << EOF > "$dummy.c" #include main() { if (!__power_pc()) exit(1); puts("powerpc-ibm-aix3.2.5"); exit(0); } EOF if $CC_FOR_BUILD -o "$dummy" "$dummy.c" && SYSTEM_NAME=$("$dummy") then echo "$SYSTEM_NAME" else echo rs6000-ibm-aix3.2.5 fi elif grep bos324 /usr/include/stdio.h >/dev/null 2>&1; then echo rs6000-ibm-aix3.2.4 else echo rs6000-ibm-aix3.2 fi exit ;; *:AIX:*:[4567]) IBM_CPU_ID=$(/usr/sbin/lsdev -C -c processor -S available | sed 1q | awk '{ print $1 }') if /usr/sbin/lsattr -El "$IBM_CPU_ID" | grep ' POWER' >/dev/null 2>&1; then IBM_ARCH=rs6000 else IBM_ARCH=powerpc fi if test -x /usr/bin/lslpp ; then IBM_REV=$(/usr/bin/lslpp -Lqc bos.rte.libc | awk -F: '{ print $3 }' | sed s/[0-9]*$/0/) else IBM_REV="$UNAME_VERSION.$UNAME_RELEASE" fi echo "$IBM_ARCH"-ibm-aix"$IBM_REV" exit ;; *:AIX:*:*) echo rs6000-ibm-aix exit ;; ibmrt:4.4BSD:*|romp-ibm:4.4BSD:*) echo romp-ibm-bsd4.4 exit ;; ibmrt:*BSD:*|romp-ibm:BSD:*) # covers RT/PC BSD and echo romp-ibm-bsd"$UNAME_RELEASE" # 4.3 with uname added to exit ;; # report: romp-ibm BSD 4.3 *:BOSX:*:*) echo rs6000-bull-bosx exit ;; DPX/2?00:B.O.S.:*:*) echo m68k-bull-sysv3 exit ;; 9000/[34]??:4.3bsd:1.*:*) echo m68k-hp-bsd exit ;; hp300:4.4BSD:*:* | 9000/[34]??:4.3bsd:2.*:*) echo m68k-hp-bsd4.4 exit ;; 9000/[34678]??:HP-UX:*:*) HPUX_REV=$(echo "$UNAME_RELEASE"|sed -e 's/[^.]*.[0B]*//') case "$UNAME_MACHINE" in 9000/31?) HP_ARCH=m68000 ;; 9000/[34]??) HP_ARCH=m68k ;; 9000/[678][0-9][0-9]) if test -x /usr/bin/getconf; then sc_cpu_version=$(/usr/bin/getconf SC_CPU_VERSION 2>/dev/null) sc_kernel_bits=$(/usr/bin/getconf SC_KERNEL_BITS 2>/dev/null) case "$sc_cpu_version" in 523) HP_ARCH=hppa1.0 ;; # CPU_PA_RISC1_0 528) HP_ARCH=hppa1.1 ;; # CPU_PA_RISC1_1 532) # CPU_PA_RISC2_0 case "$sc_kernel_bits" in 32) HP_ARCH=hppa2.0n ;; 64) HP_ARCH=hppa2.0w ;; '') HP_ARCH=hppa2.0 ;; # HP-UX 10.20 esac ;; esac fi if test "$HP_ARCH" = ""; then set_cc_for_build sed 's/^ //' << EOF > "$dummy.c" #define _HPUX_SOURCE #include #include int main () { #if defined(_SC_KERNEL_BITS) long bits = sysconf(_SC_KERNEL_BITS); #endif long cpu = sysconf (_SC_CPU_VERSION); switch (cpu) { case CPU_PA_RISC1_0: puts ("hppa1.0"); break; case CPU_PA_RISC1_1: puts ("hppa1.1"); break; case CPU_PA_RISC2_0: #if defined(_SC_KERNEL_BITS) switch (bits) { case 64: puts ("hppa2.0w"); break; case 32: puts ("hppa2.0n"); break; default: puts ("hppa2.0"); break; } break; #else /* !defined(_SC_KERNEL_BITS) */ puts ("hppa2.0"); break; #endif default: puts ("hppa1.0"); break; } exit (0); } EOF (CCOPTS="" $CC_FOR_BUILD -o "$dummy" "$dummy.c" 2>/dev/null) && HP_ARCH=$("$dummy") test -z "$HP_ARCH" && HP_ARCH=hppa fi ;; esac if test "$HP_ARCH" = hppa2.0w then set_cc_for_build # hppa2.0w-hp-hpux* has a 64-bit kernel and a compiler generating # 32-bit code. hppa64-hp-hpux* has the same kernel and a compiler # generating 64-bit code. GNU and HP use different nomenclature: # # $ CC_FOR_BUILD=cc ./config.guess # => hppa2.0w-hp-hpux11.23 # $ CC_FOR_BUILD="cc +DA2.0w" ./config.guess # => hppa64-hp-hpux11.23 if echo __LP64__ | (CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) | grep -q __LP64__ then HP_ARCH=hppa2.0w else HP_ARCH=hppa64 fi fi echo "$HP_ARCH"-hp-hpux"$HPUX_REV" exit ;; ia64:HP-UX:*:*) HPUX_REV=$(echo "$UNAME_RELEASE"|sed -e 's/[^.]*.[0B]*//') echo ia64-hp-hpux"$HPUX_REV" exit ;; 3050*:HI-UX:*:*) set_cc_for_build sed 's/^ //' << EOF > "$dummy.c" #include int main () { long cpu = sysconf (_SC_CPU_VERSION); /* The order matters, because CPU_IS_HP_MC68K erroneously returns true for CPU_PA_RISC1_0. CPU_IS_PA_RISC returns correct results, however. */ if (CPU_IS_PA_RISC (cpu)) { switch (cpu) { case CPU_PA_RISC1_0: puts ("hppa1.0-hitachi-hiuxwe2"); break; case CPU_PA_RISC1_1: puts ("hppa1.1-hitachi-hiuxwe2"); break; case CPU_PA_RISC2_0: puts ("hppa2.0-hitachi-hiuxwe2"); break; default: puts ("hppa-hitachi-hiuxwe2"); break; } } else if (CPU_IS_HP_MC68K (cpu)) puts ("m68k-hitachi-hiuxwe2"); else puts ("unknown-hitachi-hiuxwe2"); exit (0); } EOF $CC_FOR_BUILD -o "$dummy" "$dummy.c" && SYSTEM_NAME=$("$dummy") && { echo "$SYSTEM_NAME"; exit; } echo unknown-hitachi-hiuxwe2 exit ;; 9000/7??:4.3bsd:*:* | 9000/8?[79]:4.3bsd:*:*) echo hppa1.1-hp-bsd exit ;; 9000/8??:4.3bsd:*:*) echo hppa1.0-hp-bsd exit ;; *9??*:MPE/iX:*:* | *3000*:MPE/iX:*:*) echo hppa1.0-hp-mpeix exit ;; hp7??:OSF1:*:* | hp8?[79]:OSF1:*:*) echo hppa1.1-hp-osf exit ;; hp8??:OSF1:*:*) echo hppa1.0-hp-osf exit ;; i*86:OSF1:*:*) if test -x /usr/sbin/sysversion ; then echo "$UNAME_MACHINE"-unknown-osf1mk else echo "$UNAME_MACHINE"-unknown-osf1 fi exit ;; parisc*:Lites*:*:*) echo hppa1.1-hp-lites exit ;; C1*:ConvexOS:*:* | convex:ConvexOS:C1*:*) echo c1-convex-bsd exit ;; C2*:ConvexOS:*:* | convex:ConvexOS:C2*:*) if getsysinfo -f scalar_acc then echo c32-convex-bsd else echo c2-convex-bsd fi exit ;; C34*:ConvexOS:*:* | convex:ConvexOS:C34*:*) echo c34-convex-bsd exit ;; C38*:ConvexOS:*:* | convex:ConvexOS:C38*:*) echo c38-convex-bsd exit ;; C4*:ConvexOS:*:* | convex:ConvexOS:C4*:*) echo c4-convex-bsd exit ;; CRAY*Y-MP:*:*:*) echo ymp-cray-unicos"$UNAME_RELEASE" | sed -e 's/\.[^.]*$/.X/' exit ;; CRAY*[A-Z]90:*:*:*) echo "$UNAME_MACHINE"-cray-unicos"$UNAME_RELEASE" \ | sed -e 's/CRAY.*\([A-Z]90\)/\1/' \ -e y/ABCDEFGHIJKLMNOPQRSTUVWXYZ/abcdefghijklmnopqrstuvwxyz/ \ -e 's/\.[^.]*$/.X/' exit ;; CRAY*TS:*:*:*) echo t90-cray-unicos"$UNAME_RELEASE" | sed -e 's/\.[^.]*$/.X/' exit ;; CRAY*T3E:*:*:*) echo alphaev5-cray-unicosmk"$UNAME_RELEASE" | sed -e 's/\.[^.]*$/.X/' exit ;; CRAY*SV1:*:*:*) echo sv1-cray-unicos"$UNAME_RELEASE" | sed -e 's/\.[^.]*$/.X/' exit ;; *:UNICOS/mp:*:*) echo craynv-cray-unicosmp"$UNAME_RELEASE" | sed -e 's/\.[^.]*$/.X/' exit ;; F30[01]:UNIX_System_V:*:* | F700:UNIX_System_V:*:*) FUJITSU_PROC=$(uname -m | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz) FUJITSU_SYS=$(uname -p | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/\///') FUJITSU_REL=$(echo "$UNAME_RELEASE" | sed -e 's/ /_/') echo "${FUJITSU_PROC}-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}" exit ;; 5000:UNIX_System_V:4.*:*) FUJITSU_SYS=$(uname -p | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/\///') FUJITSU_REL=$(echo "$UNAME_RELEASE" | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/ /_/') echo "sparc-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}" exit ;; i*86:BSD/386:*:* | i*86:BSD/OS:*:* | *:Ascend\ Embedded/OS:*:*) echo "$UNAME_MACHINE"-pc-bsdi"$UNAME_RELEASE" exit ;; sparc*:BSD/OS:*:*) echo sparc-unknown-bsdi"$UNAME_RELEASE" exit ;; *:BSD/OS:*:*) echo "$UNAME_MACHINE"-unknown-bsdi"$UNAME_RELEASE" exit ;; arm:FreeBSD:*:*) UNAME_PROCESSOR=$(uname -p) set_cc_for_build if echo __ARM_PCS_VFP | $CC_FOR_BUILD -E - 2>/dev/null \ | grep -q __ARM_PCS_VFP then echo "${UNAME_PROCESSOR}"-unknown-freebsd"$(echo ${UNAME_RELEASE}|sed -e 's/[-(].*//')"-gnueabi else echo "${UNAME_PROCESSOR}"-unknown-freebsd"$(echo ${UNAME_RELEASE}|sed -e 's/[-(].*//')"-gnueabihf fi exit ;; *:FreeBSD:*:*) UNAME_PROCESSOR=$(/usr/bin/uname -p) case "$UNAME_PROCESSOR" in amd64) UNAME_PROCESSOR=x86_64 ;; i386) UNAME_PROCESSOR=i586 ;; esac echo "$UNAME_PROCESSOR"-unknown-freebsd"$(echo "$UNAME_RELEASE"|sed -e 's/[-(].*//')" exit ;; i*:CYGWIN*:*) echo "$UNAME_MACHINE"-pc-cygwin exit ;; *:MINGW64*:*) echo "$UNAME_MACHINE"-pc-mingw64 exit ;; *:MINGW*:*) echo "$UNAME_MACHINE"-pc-mingw32 exit ;; *:MSYS*:*) echo "$UNAME_MACHINE"-pc-msys exit ;; i*:PW*:*) echo "$UNAME_MACHINE"-pc-pw32 exit ;; *:Interix*:*) case "$UNAME_MACHINE" in x86) echo i586-pc-interix"$UNAME_RELEASE" exit ;; authenticamd | genuineintel | EM64T) echo x86_64-unknown-interix"$UNAME_RELEASE" exit ;; IA64) echo ia64-unknown-interix"$UNAME_RELEASE" exit ;; esac ;; i*:UWIN*:*) echo "$UNAME_MACHINE"-pc-uwin exit ;; amd64:CYGWIN*:*:* | x86_64:CYGWIN*:*:*) echo x86_64-pc-cygwin exit ;; prep*:SunOS:5.*:*) echo powerpcle-unknown-solaris2"$(echo "$UNAME_RELEASE"|sed -e 's/[^.]*//')" exit ;; *:GNU:*:*) # the GNU system echo "$(echo "$UNAME_MACHINE"|sed -e 's,[-/].*$,,')-unknown-$LIBC$(echo "$UNAME_RELEASE"|sed -e 's,/.*$,,')" exit ;; *:GNU/*:*:*) # other systems with GNU libc and userland echo "$UNAME_MACHINE-unknown-$(echo "$UNAME_SYSTEM" | sed 's,^[^/]*/,,' | tr "[:upper:]" "[:lower:]")$(echo "$UNAME_RELEASE"|sed -e 's/[-(].*//')-$LIBC" exit ;; *:Minix:*:*) echo "$UNAME_MACHINE"-unknown-minix exit ;; aarch64:Linux:*:*) echo "$UNAME_MACHINE"-unknown-linux-"$LIBC" exit ;; aarch64_be:Linux:*:*) UNAME_MACHINE=aarch64_be echo "$UNAME_MACHINE"-unknown-linux-"$LIBC" exit ;; alpha:Linux:*:*) case $(sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' /proc/cpuinfo 2>/dev/null) in EV5) UNAME_MACHINE=alphaev5 ;; EV56) UNAME_MACHINE=alphaev56 ;; PCA56) UNAME_MACHINE=alphapca56 ;; PCA57) UNAME_MACHINE=alphapca56 ;; EV6) UNAME_MACHINE=alphaev6 ;; EV67) UNAME_MACHINE=alphaev67 ;; EV68*) UNAME_MACHINE=alphaev68 ;; esac objdump --private-headers /bin/sh | grep -q ld.so.1 if test "$?" = 0 ; then LIBC=gnulibc1 ; fi echo "$UNAME_MACHINE"-unknown-linux-"$LIBC" exit ;; arc:Linux:*:* | arceb:Linux:*:*) echo "$UNAME_MACHINE"-unknown-linux-"$LIBC" exit ;; arm*:Linux:*:*) set_cc_for_build if echo __ARM_EABI__ | $CC_FOR_BUILD -E - 2>/dev/null \ | grep -q __ARM_EABI__ then echo "$UNAME_MACHINE"-unknown-linux-"$LIBC" else if echo __ARM_PCS_VFP | $CC_FOR_BUILD -E - 2>/dev/null \ | grep -q __ARM_PCS_VFP then echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"eabi else echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"eabihf fi fi exit ;; avr32*:Linux:*:*) echo "$UNAME_MACHINE"-unknown-linux-"$LIBC" exit ;; cris:Linux:*:*) echo "$UNAME_MACHINE"-axis-linux-"$LIBC" exit ;; crisv32:Linux:*:*) echo "$UNAME_MACHINE"-axis-linux-"$LIBC" exit ;; e2k:Linux:*:*) echo "$UNAME_MACHINE"-unknown-linux-"$LIBC" exit ;; frv:Linux:*:*) echo "$UNAME_MACHINE"-unknown-linux-"$LIBC" exit ;; hexagon:Linux:*:*) echo "$UNAME_MACHINE"-unknown-linux-"$LIBC" exit ;; i*86:Linux:*:*) echo "$UNAME_MACHINE"-pc-linux-"$LIBC" exit ;; ia64:Linux:*:*) echo "$UNAME_MACHINE"-unknown-linux-"$LIBC" exit ;; k1om:Linux:*:*) echo "$UNAME_MACHINE"-unknown-linux-"$LIBC" exit ;; loongarch32:Linux:*:* | loongarch64:Linux:*:* | loongarchx32:Linux:*:*) echo "$UNAME_MACHINE"-unknown-linux-"$LIBC" exit ;; m32r*:Linux:*:*) echo "$UNAME_MACHINE"-unknown-linux-"$LIBC" exit ;; m68*:Linux:*:*) echo "$UNAME_MACHINE"-unknown-linux-"$LIBC" exit ;; mips:Linux:*:* | mips64:Linux:*:*) set_cc_for_build IS_GLIBC=0 test x"${LIBC}" = xgnu && IS_GLIBC=1 sed 's/^ //' << EOF > "$dummy.c" #undef CPU #undef mips #undef mipsel #undef mips64 #undef mips64el #if ${IS_GLIBC} && defined(_ABI64) LIBCABI=gnuabi64 #else #if ${IS_GLIBC} && defined(_ABIN32) LIBCABI=gnuabin32 #else LIBCABI=${LIBC} #endif #endif #if ${IS_GLIBC} && defined(__mips64) && defined(__mips_isa_rev) && __mips_isa_rev>=6 CPU=mipsisa64r6 #else #if ${IS_GLIBC} && !defined(__mips64) && defined(__mips_isa_rev) && __mips_isa_rev>=6 CPU=mipsisa32r6 #else #if defined(__mips64) CPU=mips64 #else CPU=mips #endif #endif #endif #if defined(__MIPSEL__) || defined(__MIPSEL) || defined(_MIPSEL) || defined(MIPSEL) MIPS_ENDIAN=el #else #if defined(__MIPSEB__) || defined(__MIPSEB) || defined(_MIPSEB) || defined(MIPSEB) MIPS_ENDIAN= #else MIPS_ENDIAN= #endif #endif EOF eval "$($CC_FOR_BUILD -E "$dummy.c" 2>/dev/null | grep '^CPU\|^MIPS_ENDIAN\|^LIBCABI')" test "x$CPU" != x && { echo "$CPU${MIPS_ENDIAN}-unknown-linux-$LIBCABI"; exit; } ;; mips64el:Linux:*:*) echo "$UNAME_MACHINE"-unknown-linux-"$LIBC" exit ;; openrisc*:Linux:*:*) echo or1k-unknown-linux-"$LIBC" exit ;; or32:Linux:*:* | or1k*:Linux:*:*) echo "$UNAME_MACHINE"-unknown-linux-"$LIBC" exit ;; padre:Linux:*:*) echo sparc-unknown-linux-"$LIBC" exit ;; parisc64:Linux:*:* | hppa64:Linux:*:*) echo hppa64-unknown-linux-"$LIBC" exit ;; parisc:Linux:*:* | hppa:Linux:*:*) # Look for CPU level case $(grep '^cpu[^a-z]*:' /proc/cpuinfo 2>/dev/null | cut -d' ' -f2) in PA7*) echo hppa1.1-unknown-linux-"$LIBC" ;; PA8*) echo hppa2.0-unknown-linux-"$LIBC" ;; *) echo hppa-unknown-linux-"$LIBC" ;; esac exit ;; ppc64:Linux:*:*) echo powerpc64-unknown-linux-"$LIBC" exit ;; ppc:Linux:*:*) echo powerpc-unknown-linux-"$LIBC" exit ;; ppc64le:Linux:*:*) echo powerpc64le-unknown-linux-"$LIBC" exit ;; ppcle:Linux:*:*) echo powerpcle-unknown-linux-"$LIBC" exit ;; riscv32:Linux:*:* | riscv32be:Linux:*:* | riscv64:Linux:*:* | riscv64be:Linux:*:*) echo "$UNAME_MACHINE"-unknown-linux-"$LIBC" exit ;; s390:Linux:*:* | s390x:Linux:*:*) echo "$UNAME_MACHINE"-ibm-linux-"$LIBC" exit ;; sh64*:Linux:*:*) echo "$UNAME_MACHINE"-unknown-linux-"$LIBC" exit ;; sh*:Linux:*:*) echo "$UNAME_MACHINE"-unknown-linux-"$LIBC" exit ;; sparc:Linux:*:* | sparc64:Linux:*:*) echo "$UNAME_MACHINE"-unknown-linux-"$LIBC" exit ;; tile*:Linux:*:*) echo "$UNAME_MACHINE"-unknown-linux-"$LIBC" exit ;; vax:Linux:*:*) echo "$UNAME_MACHINE"-dec-linux-"$LIBC" exit ;; x86_64:Linux:*:*) set_cc_for_build LIBCABI=$LIBC if test "$CC_FOR_BUILD" != no_compiler_found; then if (echo '#ifdef __ILP32__'; echo IS_X32; echo '#endif') | \ (CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) | \ grep IS_X32 >/dev/null then LIBCABI="$LIBC"x32 fi fi echo "$UNAME_MACHINE"-pc-linux-"$LIBCABI" exit ;; xtensa*:Linux:*:*) echo "$UNAME_MACHINE"-unknown-linux-"$LIBC" exit ;; i*86:DYNIX/ptx:4*:*) # ptx 4.0 does uname -s correctly, with DYNIX/ptx in there. # earlier versions are messed up and put the nodename in both # sysname and nodename. echo i386-sequent-sysv4 exit ;; i*86:UNIX_SV:4.2MP:2.*) # Unixware is an offshoot of SVR4, but it has its own version # number series starting with 2... # I am not positive that other SVR4 systems won't match this, # I just have to hope. -- rms. # Use sysv4.2uw... so that sysv4* matches it. echo "$UNAME_MACHINE"-pc-sysv4.2uw"$UNAME_VERSION" exit ;; i*86:OS/2:*:*) # If we were able to find `uname', then EMX Unix compatibility # is probably installed. echo "$UNAME_MACHINE"-pc-os2-emx exit ;; i*86:XTS-300:*:STOP) echo "$UNAME_MACHINE"-unknown-stop exit ;; i*86:atheos:*:*) echo "$UNAME_MACHINE"-unknown-atheos exit ;; i*86:syllable:*:*) echo "$UNAME_MACHINE"-pc-syllable exit ;; i*86:LynxOS:2.*:* | i*86:LynxOS:3.[01]*:* | i*86:LynxOS:4.[02]*:*) echo i386-unknown-lynxos"$UNAME_RELEASE" exit ;; i*86:*DOS:*:*) echo "$UNAME_MACHINE"-pc-msdosdjgpp exit ;; i*86:*:4.*:*) UNAME_REL=$(echo "$UNAME_RELEASE" | sed 's/\/MP$//') if grep Novell /usr/include/link.h >/dev/null 2>/dev/null; then echo "$UNAME_MACHINE"-univel-sysv"$UNAME_REL" else echo "$UNAME_MACHINE"-pc-sysv"$UNAME_REL" fi exit ;; i*86:*:5:[678]*) # UnixWare 7.x, OpenUNIX and OpenServer 6. case $(/bin/uname -X | grep "^Machine") in *486*) UNAME_MACHINE=i486 ;; *Pentium) UNAME_MACHINE=i586 ;; *Pent*|*Celeron) UNAME_MACHINE=i686 ;; esac echo "$UNAME_MACHINE-unknown-sysv${UNAME_RELEASE}${UNAME_SYSTEM}${UNAME_VERSION}" exit ;; i*86:*:3.2:*) if test -f /usr/options/cb.name; then UNAME_REL=$(sed -n 's/.*Version //p' /dev/null >/dev/null ; then UNAME_REL=$( (/bin/uname -X|grep Release|sed -e 's/.*= //')) (/bin/uname -X|grep i80486 >/dev/null) && UNAME_MACHINE=i486 (/bin/uname -X|grep '^Machine.*Pentium' >/dev/null) \ && UNAME_MACHINE=i586 (/bin/uname -X|grep '^Machine.*Pent *II' >/dev/null) \ && UNAME_MACHINE=i686 (/bin/uname -X|grep '^Machine.*Pentium Pro' >/dev/null) \ && UNAME_MACHINE=i686 echo "$UNAME_MACHINE"-pc-sco"$UNAME_REL" else echo "$UNAME_MACHINE"-pc-sysv32 fi exit ;; pc:*:*:*) # Left here for compatibility: # uname -m prints for DJGPP always 'pc', but it prints nothing about # the processor, so we play safe by assuming i586. # Note: whatever this is, it MUST be the same as what config.sub # prints for the "djgpp" host, or else GDB configure will decide that # this is a cross-build. echo i586-pc-msdosdjgpp exit ;; Intel:Mach:3*:*) echo i386-pc-mach3 exit ;; paragon:*:*:*) echo i860-intel-osf1 exit ;; i860:*:4.*:*) # i860-SVR4 if grep Stardent /usr/include/sys/uadmin.h >/dev/null 2>&1 ; then echo i860-stardent-sysv"$UNAME_RELEASE" # Stardent Vistra i860-SVR4 else # Add other i860-SVR4 vendors below as they are discovered. echo i860-unknown-sysv"$UNAME_RELEASE" # Unknown i860-SVR4 fi exit ;; mini*:CTIX:SYS*5:*) # "miniframe" echo m68010-convergent-sysv exit ;; mc68k:UNIX:SYSTEM5:3.51m) echo m68k-convergent-sysv exit ;; M680?0:D-NIX:5.3:*) echo m68k-diab-dnix exit ;; M68*:*:R3V[5678]*:*) test -r /sysV68 && { echo 'm68k-motorola-sysv'; exit; } ;; 3[345]??:*:4.0:3.0 | 3[34]??A:*:4.0:3.0 | 3[34]??,*:*:4.0:3.0 | 3[34]??/*:*:4.0:3.0 | 4400:*:4.0:3.0 | 4850:*:4.0:3.0 | SKA40:*:4.0:3.0 | SDS2:*:4.0:3.0 | SHG2:*:4.0:3.0 | S7501*:*:4.0:3.0) OS_REL='' test -r /etc/.relid \ && OS_REL=.$(sed -n 's/[^ ]* [^ ]* \([0-9][0-9]\).*/\1/p' < /etc/.relid) /bin/uname -p 2>/dev/null | grep 86 >/dev/null \ && { echo i486-ncr-sysv4.3"$OS_REL"; exit; } /bin/uname -p 2>/dev/null | /bin/grep entium >/dev/null \ && { echo i586-ncr-sysv4.3"$OS_REL"; exit; } ;; 3[34]??:*:4.0:* | 3[34]??,*:*:4.0:*) /bin/uname -p 2>/dev/null | grep 86 >/dev/null \ && { echo i486-ncr-sysv4; exit; } ;; NCR*:*:4.2:* | MPRAS*:*:4.2:*) OS_REL='.3' test -r /etc/.relid \ && OS_REL=.$(sed -n 's/[^ ]* [^ ]* \([0-9][0-9]\).*/\1/p' < /etc/.relid) /bin/uname -p 2>/dev/null | grep 86 >/dev/null \ && { echo i486-ncr-sysv4.3"$OS_REL"; exit; } /bin/uname -p 2>/dev/null | /bin/grep entium >/dev/null \ && { echo i586-ncr-sysv4.3"$OS_REL"; exit; } /bin/uname -p 2>/dev/null | /bin/grep pteron >/dev/null \ && { echo i586-ncr-sysv4.3"$OS_REL"; exit; } ;; m68*:LynxOS:2.*:* | m68*:LynxOS:3.0*:*) echo m68k-unknown-lynxos"$UNAME_RELEASE" exit ;; mc68030:UNIX_System_V:4.*:*) echo m68k-atari-sysv4 exit ;; TSUNAMI:LynxOS:2.*:*) echo sparc-unknown-lynxos"$UNAME_RELEASE" exit ;; rs6000:LynxOS:2.*:*) echo rs6000-unknown-lynxos"$UNAME_RELEASE" exit ;; PowerPC:LynxOS:2.*:* | PowerPC:LynxOS:3.[01]*:* | PowerPC:LynxOS:4.[02]*:*) echo powerpc-unknown-lynxos"$UNAME_RELEASE" exit ;; SM[BE]S:UNIX_SV:*:*) echo mips-dde-sysv"$UNAME_RELEASE" exit ;; RM*:ReliantUNIX-*:*:*) echo mips-sni-sysv4 exit ;; RM*:SINIX-*:*:*) echo mips-sni-sysv4 exit ;; *:SINIX-*:*:*) if uname -p 2>/dev/null >/dev/null ; then UNAME_MACHINE=$( (uname -p) 2>/dev/null) echo "$UNAME_MACHINE"-sni-sysv4 else echo ns32k-sni-sysv fi exit ;; PENTIUM:*:4.0*:*) # Unisys `ClearPath HMP IX 4000' SVR4/MP effort # says echo i586-unisys-sysv4 exit ;; *:UNIX_System_V:4*:FTX*) # From Gerald Hewes . # How about differentiating between stratus architectures? -djm echo hppa1.1-stratus-sysv4 exit ;; *:*:*:FTX*) # From seanf@swdc.stratus.com. echo i860-stratus-sysv4 exit ;; i*86:VOS:*:*) # From Paul.Green@stratus.com. echo "$UNAME_MACHINE"-stratus-vos exit ;; *:VOS:*:*) # From Paul.Green@stratus.com. echo hppa1.1-stratus-vos exit ;; mc68*:A/UX:*:*) echo m68k-apple-aux"$UNAME_RELEASE" exit ;; news*:NEWS-OS:6*:*) echo mips-sony-newsos6 exit ;; R[34]000:*System_V*:*:* | R4000:UNIX_SYSV:*:* | R*000:UNIX_SV:*:*) if test -d /usr/nec; then echo mips-nec-sysv"$UNAME_RELEASE" else echo mips-unknown-sysv"$UNAME_RELEASE" fi exit ;; BeBox:BeOS:*:*) # BeOS running on hardware made by Be, PPC only. echo powerpc-be-beos exit ;; BeMac:BeOS:*:*) # BeOS running on Mac or Mac clone, PPC only. echo powerpc-apple-beos exit ;; BePC:BeOS:*:*) # BeOS running on Intel PC compatible. echo i586-pc-beos exit ;; BePC:Haiku:*:*) # Haiku running on Intel PC compatible. echo i586-pc-haiku exit ;; x86_64:Haiku:*:*) echo x86_64-unknown-haiku exit ;; SX-4:SUPER-UX:*:*) echo sx4-nec-superux"$UNAME_RELEASE" exit ;; SX-5:SUPER-UX:*:*) echo sx5-nec-superux"$UNAME_RELEASE" exit ;; SX-6:SUPER-UX:*:*) echo sx6-nec-superux"$UNAME_RELEASE" exit ;; SX-7:SUPER-UX:*:*) echo sx7-nec-superux"$UNAME_RELEASE" exit ;; SX-8:SUPER-UX:*:*) echo sx8-nec-superux"$UNAME_RELEASE" exit ;; SX-8R:SUPER-UX:*:*) echo sx8r-nec-superux"$UNAME_RELEASE" exit ;; SX-ACE:SUPER-UX:*:*) echo sxace-nec-superux"$UNAME_RELEASE" exit ;; Power*:Rhapsody:*:*) echo powerpc-apple-rhapsody"$UNAME_RELEASE" exit ;; *:Rhapsody:*:*) echo "$UNAME_MACHINE"-apple-rhapsody"$UNAME_RELEASE" exit ;; arm64:Darwin:*:*) echo aarch64-apple-darwin"$UNAME_RELEASE" exit ;; *:Darwin:*:*) UNAME_PROCESSOR=$(uname -p) case $UNAME_PROCESSOR in unknown) UNAME_PROCESSOR=powerpc ;; esac if command -v xcode-select > /dev/null 2> /dev/null && \ ! xcode-select --print-path > /dev/null 2> /dev/null ; then # Avoid executing cc if there is no toolchain installed as # cc will be a stub that puts up a graphical alert # prompting the user to install developer tools. CC_FOR_BUILD=no_compiler_found else set_cc_for_build fi if test "$CC_FOR_BUILD" != no_compiler_found; then if (echo '#ifdef __LP64__'; echo IS_64BIT_ARCH; echo '#endif') | \ (CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) | \ grep IS_64BIT_ARCH >/dev/null then case $UNAME_PROCESSOR in i386) UNAME_PROCESSOR=x86_64 ;; powerpc) UNAME_PROCESSOR=powerpc64 ;; esac fi # On 10.4-10.6 one might compile for PowerPC via gcc -arch ppc if (echo '#ifdef __POWERPC__'; echo IS_PPC; echo '#endif') | \ (CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) | \ grep IS_PPC >/dev/null then UNAME_PROCESSOR=powerpc fi elif test "$UNAME_PROCESSOR" = i386 ; then # uname -m returns i386 or x86_64 UNAME_PROCESSOR=$UNAME_MACHINE fi echo "$UNAME_PROCESSOR"-apple-darwin"$UNAME_RELEASE" exit ;; *:procnto*:*:* | *:QNX:[0123456789]*:*) UNAME_PROCESSOR=$(uname -p) if test "$UNAME_PROCESSOR" = x86; then UNAME_PROCESSOR=i386 UNAME_MACHINE=pc fi echo "$UNAME_PROCESSOR"-"$UNAME_MACHINE"-nto-qnx"$UNAME_RELEASE" exit ;; *:QNX:*:4*) echo i386-pc-qnx exit ;; NEO-*:NONSTOP_KERNEL:*:*) echo neo-tandem-nsk"$UNAME_RELEASE" exit ;; NSE-*:NONSTOP_KERNEL:*:*) echo nse-tandem-nsk"$UNAME_RELEASE" exit ;; NSR-*:NONSTOP_KERNEL:*:*) echo nsr-tandem-nsk"$UNAME_RELEASE" exit ;; NSV-*:NONSTOP_KERNEL:*:*) echo nsv-tandem-nsk"$UNAME_RELEASE" exit ;; NSX-*:NONSTOP_KERNEL:*:*) echo nsx-tandem-nsk"$UNAME_RELEASE" exit ;; *:NonStop-UX:*:*) echo mips-compaq-nonstopux exit ;; BS2000:POSIX*:*:*) echo bs2000-siemens-sysv exit ;; DS/*:UNIX_System_V:*:*) echo "$UNAME_MACHINE"-"$UNAME_SYSTEM"-"$UNAME_RELEASE" exit ;; *:Plan9:*:*) # "uname -m" is not consistent, so use $cputype instead. 386 # is converted to i386 for consistency with other x86 # operating systems. # shellcheck disable=SC2154 if test "$cputype" = 386; then UNAME_MACHINE=i386 else UNAME_MACHINE="$cputype" fi echo "$UNAME_MACHINE"-unknown-plan9 exit ;; *:TOPS-10:*:*) echo pdp10-unknown-tops10 exit ;; *:TENEX:*:*) echo pdp10-unknown-tenex exit ;; KS10:TOPS-20:*:* | KL10:TOPS-20:*:* | TYPE4:TOPS-20:*:*) echo pdp10-dec-tops20 exit ;; XKL-1:TOPS-20:*:* | TYPE5:TOPS-20:*:*) echo pdp10-xkl-tops20 exit ;; *:TOPS-20:*:*) echo pdp10-unknown-tops20 exit ;; *:ITS:*:*) echo pdp10-unknown-its exit ;; SEI:*:*:SEIUX) echo mips-sei-seiux"$UNAME_RELEASE" exit ;; *:DragonFly:*:*) echo "$UNAME_MACHINE"-unknown-dragonfly"$(echo "$UNAME_RELEASE"|sed -e 's/[-(].*//')" exit ;; *:*VMS:*:*) UNAME_MACHINE=$( (uname -p) 2>/dev/null) case "$UNAME_MACHINE" in A*) echo alpha-dec-vms ; exit ;; I*) echo ia64-dec-vms ; exit ;; V*) echo vax-dec-vms ; exit ;; esac ;; *:XENIX:*:SysV) echo i386-pc-xenix exit ;; i*86:skyos:*:*) echo "$UNAME_MACHINE"-pc-skyos"$(echo "$UNAME_RELEASE" | sed -e 's/ .*$//')" exit ;; i*86:rdos:*:*) echo "$UNAME_MACHINE"-pc-rdos exit ;; i*86:AROS:*:*) echo "$UNAME_MACHINE"-pc-aros exit ;; x86_64:VMkernel:*:*) echo "$UNAME_MACHINE"-unknown-esx exit ;; amd64:Isilon\ OneFS:*:*) echo x86_64-unknown-onefs exit ;; *:Unleashed:*:*) echo "$UNAME_MACHINE"-unknown-unleashed"$UNAME_RELEASE" exit ;; esac # No uname command or uname output not recognized. set_cc_for_build cat > "$dummy.c" < #include #endif #if defined(ultrix) || defined(_ultrix) || defined(__ultrix) || defined(__ultrix__) #if defined (vax) || defined (__vax) || defined (__vax__) || defined(mips) || defined(__mips) || defined(__mips__) || defined(MIPS) || defined(__MIPS__) #include #if defined(_SIZE_T_) || defined(SIGLOST) #include #endif #endif #endif main () { #if defined (sony) #if defined (MIPSEB) /* BFD wants "bsd" instead of "newsos". Perhaps BFD should be changed, I don't know.... */ printf ("mips-sony-bsd\n"); exit (0); #else #include printf ("m68k-sony-newsos%s\n", #ifdef NEWSOS4 "4" #else "" #endif ); exit (0); #endif #endif #if defined (NeXT) #if !defined (__ARCHITECTURE__) #define __ARCHITECTURE__ "m68k" #endif int version; version=$( (hostinfo | sed -n 's/.*NeXT Mach \([0-9]*\).*/\1/p') 2>/dev/null); if (version < 4) printf ("%s-next-nextstep%d\n", __ARCHITECTURE__, version); else printf ("%s-next-openstep%d\n", __ARCHITECTURE__, version); exit (0); #endif #if defined (MULTIMAX) || defined (n16) #if defined (UMAXV) printf ("ns32k-encore-sysv\n"); exit (0); #else #if defined (CMU) printf ("ns32k-encore-mach\n"); exit (0); #else printf ("ns32k-encore-bsd\n"); exit (0); #endif #endif #endif #if defined (__386BSD__) printf ("i386-pc-bsd\n"); exit (0); #endif #if defined (sequent) #if defined (i386) printf ("i386-sequent-dynix\n"); exit (0); #endif #if defined (ns32000) printf ("ns32k-sequent-dynix\n"); exit (0); #endif #endif #if defined (_SEQUENT_) struct utsname un; uname(&un); if (strncmp(un.version, "V2", 2) == 0) { printf ("i386-sequent-ptx2\n"); exit (0); } if (strncmp(un.version, "V1", 2) == 0) { /* XXX is V1 correct? */ printf ("i386-sequent-ptx1\n"); exit (0); } printf ("i386-sequent-ptx\n"); exit (0); #endif #if defined (vax) #if !defined (ultrix) #include #if defined (BSD) #if BSD == 43 printf ("vax-dec-bsd4.3\n"); exit (0); #else #if BSD == 199006 printf ("vax-dec-bsd4.3reno\n"); exit (0); #else printf ("vax-dec-bsd\n"); exit (0); #endif #endif #else printf ("vax-dec-bsd\n"); exit (0); #endif #else #if defined(_SIZE_T_) || defined(SIGLOST) struct utsname un; uname (&un); printf ("vax-dec-ultrix%s\n", un.release); exit (0); #else printf ("vax-dec-ultrix\n"); exit (0); #endif #endif #endif #if defined(ultrix) || defined(_ultrix) || defined(__ultrix) || defined(__ultrix__) #if defined(mips) || defined(__mips) || defined(__mips__) || defined(MIPS) || defined(__MIPS__) #if defined(_SIZE_T_) || defined(SIGLOST) struct utsname *un; uname (&un); printf ("mips-dec-ultrix%s\n", un.release); exit (0); #else printf ("mips-dec-ultrix\n"); exit (0); #endif #endif #endif #if defined (alliant) && defined (i860) printf ("i860-alliant-bsd\n"); exit (0); #endif exit (1); } EOF $CC_FOR_BUILD -o "$dummy" "$dummy.c" 2>/dev/null && SYSTEM_NAME=$($dummy) && { echo "$SYSTEM_NAME"; exit; } # Apollos put the system type in the environment. test -d /usr/apollo && { echo "$ISP-apollo-$SYSTYPE"; exit; } echo "$0: unable to guess system type" >&2 case "$UNAME_MACHINE:$UNAME_SYSTEM" in mips:Linux | mips64:Linux) # If we got here on MIPS GNU/Linux, output extra information. cat >&2 <&2 <&2 </dev/null || echo unknown) uname -r = $( (uname -r) 2>/dev/null || echo unknown) uname -s = $( (uname -s) 2>/dev/null || echo unknown) uname -v = $( (uname -v) 2>/dev/null || echo unknown) /usr/bin/uname -p = $( (/usr/bin/uname -p) 2>/dev/null) /bin/uname -X = $( (/bin/uname -X) 2>/dev/null) hostinfo = $( (hostinfo) 2>/dev/null) /bin/universe = $( (/bin/universe) 2>/dev/null) /usr/bin/arch -k = $( (/usr/bin/arch -k) 2>/dev/null) /bin/arch = $( (/bin/arch) 2>/dev/null) /usr/bin/oslevel = $( (/usr/bin/oslevel) 2>/dev/null) /usr/convex/getsysinfo = $( (/usr/convex/getsysinfo) 2>/dev/null) UNAME_MACHINE = "$UNAME_MACHINE" UNAME_RELEASE = "$UNAME_RELEASE" UNAME_SYSTEM = "$UNAME_SYSTEM" UNAME_VERSION = "$UNAME_VERSION" EOF fi exit 1 # Local variables: # eval: (add-hook 'before-save-hook 'time-stamp) # time-stamp-start: "timestamp='" # time-stamp-format: "%:y-%02m-%02d" # time-stamp-end: "'" # End: freeradius-3.2.10+dfsg/config.sub000066400000000000000000001027561522352605200166420ustar00rootroot00000000000000#! /bin/sh # Configuration validation subroutine script. # Copyright 1992-2021 Free Software Foundation, Inc. timestamp='2021-01-01' # This file is free software; you can redistribute it and/or modify it # under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, but # WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, see . # # As a special exception to the GNU General Public License, if you # distribute this file as part of a program that contains a # configuration script generated by Autoconf, you may include it under # the same distribution terms that you use for the rest of that # program. This Exception is an additional permission under section 7 # of the GNU General Public License, version 3 ("GPLv3"). # Please send patches to . # # Configuration subroutine to validate and canonicalize a configuration type. # Supply the specified configuration type as an argument. # If it is invalid, we print an error message on stderr and exit with code 1. # Otherwise, we print the canonical config type on stdout and succeed. # You can get the latest version of this script from: # https://git.savannah.gnu.org/cgit/config.git/plain/config.sub # This file is supposed to be the same for all GNU packages # and recognize all the CPU types, system types and aliases # that are meaningful with *any* GNU software. # Each package is responsible for reporting which valid configurations # it does not support. The user should be able to distinguish # a failure to support a valid configuration from a meaningless # configuration. # The goal of this file is to map all the various variations of a given # machine specification into a single specification in the form: # CPU_TYPE-MANUFACTURER-OPERATING_SYSTEM # or in some cases, the newer four-part form: # CPU_TYPE-MANUFACTURER-KERNEL-OPERATING_SYSTEM # It is wrong to echo any other type of specification. me=$(echo "$0" | sed -e 's,.*/,,') usage="\ Usage: $0 [OPTION] CPU-MFR-OPSYS or ALIAS Canonicalize a configuration name. Options: -h, --help print this help, then exit -t, --time-stamp print date of last modification, then exit -v, --version print version number, then exit Report bugs and patches to ." version="\ GNU config.sub ($timestamp) Copyright 1992-2021 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE." help=" Try \`$me --help' for more information." # Parse command line while test $# -gt 0 ; do case $1 in --time-stamp | --time* | -t ) echo "$timestamp" ; exit ;; --version | -v ) echo "$version" ; exit ;; --help | --h* | -h ) echo "$usage"; exit ;; -- ) # Stop option processing shift; break ;; - ) # Use stdin as input. break ;; -* ) echo "$me: invalid option $1$help" >&2 exit 1 ;; *local*) # First pass through any local machine types. echo "$1" exit ;; * ) break ;; esac done case $# in 0) echo "$me: missing argument$help" >&2 exit 1;; 1) ;; *) echo "$me: too many arguments$help" >&2 exit 1;; esac # Split fields of configuration type # shellcheck disable=SC2162 IFS="-" read field1 field2 field3 field4 <&2 exit 1 ;; *-*-*-*) basic_machine=$field1-$field2 basic_os=$field3-$field4 ;; *-*-*) # Ambiguous whether COMPANY is present, or skipped and KERNEL-OS is two # parts maybe_os=$field2-$field3 case $maybe_os in nto-qnx* | linux-* | uclinux-uclibc* \ | uclinux-gnu* | kfreebsd*-gnu* | knetbsd*-gnu* | netbsd*-gnu* \ | netbsd*-eabi* | kopensolaris*-gnu* | cloudabi*-eabi* \ | storm-chaos* | os2-emx* | rtmk-nova*) basic_machine=$field1 basic_os=$maybe_os ;; android-linux) basic_machine=$field1-unknown basic_os=linux-android ;; *) basic_machine=$field1-$field2 basic_os=$field3 ;; esac ;; *-*) # A lone config we happen to match not fitting any pattern case $field1-$field2 in decstation-3100) basic_machine=mips-dec basic_os= ;; *-*) # Second component is usually, but not always the OS case $field2 in # Prevent following clause from handling this valid os sun*os*) basic_machine=$field1 basic_os=$field2 ;; # Manufacturers dec* | mips* | sequent* | encore* | pc533* | sgi* | sony* \ | att* | 7300* | 3300* | delta* | motorola* | sun[234]* \ | unicom* | ibm* | next | hp | isi* | apollo | altos* \ | convergent* | ncr* | news | 32* | 3600* | 3100* \ | hitachi* | c[123]* | convex* | sun | crds | omron* | dg \ | ultra | tti* | harris | dolphin | highlevel | gould \ | cbm | ns | masscomp | apple | axis | knuth | cray \ | microblaze* | sim | cisco \ | oki | wec | wrs | winbond) basic_machine=$field1-$field2 basic_os= ;; *) basic_machine=$field1 basic_os=$field2 ;; esac ;; esac ;; *) # Convert single-component short-hands not valid as part of # multi-component configurations. case $field1 in 386bsd) basic_machine=i386-pc basic_os=bsd ;; a29khif) basic_machine=a29k-amd basic_os=udi ;; adobe68k) basic_machine=m68010-adobe basic_os=scout ;; alliant) basic_machine=fx80-alliant basic_os= ;; altos | altos3068) basic_machine=m68k-altos basic_os= ;; am29k) basic_machine=a29k-none basic_os=bsd ;; amdahl) basic_machine=580-amdahl basic_os=sysv ;; amiga) basic_machine=m68k-unknown basic_os= ;; amigaos | amigados) basic_machine=m68k-unknown basic_os=amigaos ;; amigaunix | amix) basic_machine=m68k-unknown basic_os=sysv4 ;; apollo68) basic_machine=m68k-apollo basic_os=sysv ;; apollo68bsd) basic_machine=m68k-apollo basic_os=bsd ;; aros) basic_machine=i386-pc basic_os=aros ;; aux) basic_machine=m68k-apple basic_os=aux ;; balance) basic_machine=ns32k-sequent basic_os=dynix ;; blackfin) basic_machine=bfin-unknown basic_os=linux ;; cegcc) basic_machine=arm-unknown basic_os=cegcc ;; convex-c1) basic_machine=c1-convex basic_os=bsd ;; convex-c2) basic_machine=c2-convex basic_os=bsd ;; convex-c32) basic_machine=c32-convex basic_os=bsd ;; convex-c34) basic_machine=c34-convex basic_os=bsd ;; convex-c38) basic_machine=c38-convex basic_os=bsd ;; cray) basic_machine=j90-cray basic_os=unicos ;; crds | unos) basic_machine=m68k-crds basic_os= ;; da30) basic_machine=m68k-da30 basic_os= ;; decstation | pmax | pmin | dec3100 | decstatn) basic_machine=mips-dec basic_os= ;; delta88) basic_machine=m88k-motorola basic_os=sysv3 ;; dicos) basic_machine=i686-pc basic_os=dicos ;; djgpp) basic_machine=i586-pc basic_os=msdosdjgpp ;; ebmon29k) basic_machine=a29k-amd basic_os=ebmon ;; es1800 | OSE68k | ose68k | ose | OSE) basic_machine=m68k-ericsson basic_os=ose ;; gmicro) basic_machine=tron-gmicro basic_os=sysv ;; go32) basic_machine=i386-pc basic_os=go32 ;; h8300hms) basic_machine=h8300-hitachi basic_os=hms ;; h8300xray) basic_machine=h8300-hitachi basic_os=xray ;; h8500hms) basic_machine=h8500-hitachi basic_os=hms ;; harris) basic_machine=m88k-harris basic_os=sysv3 ;; hp300 | hp300hpux) basic_machine=m68k-hp basic_os=hpux ;; hp300bsd) basic_machine=m68k-hp basic_os=bsd ;; hppaosf) basic_machine=hppa1.1-hp basic_os=osf ;; hppro) basic_machine=hppa1.1-hp basic_os=proelf ;; i386mach) basic_machine=i386-mach basic_os=mach ;; isi68 | isi) basic_machine=m68k-isi basic_os=sysv ;; m68knommu) basic_machine=m68k-unknown basic_os=linux ;; magnum | m3230) basic_machine=mips-mips basic_os=sysv ;; merlin) basic_machine=ns32k-utek basic_os=sysv ;; mingw64) basic_machine=x86_64-pc basic_os=mingw64 ;; mingw32) basic_machine=i686-pc basic_os=mingw32 ;; mingw32ce) basic_machine=arm-unknown basic_os=mingw32ce ;; monitor) basic_machine=m68k-rom68k basic_os=coff ;; morphos) basic_machine=powerpc-unknown basic_os=morphos ;; moxiebox) basic_machine=moxie-unknown basic_os=moxiebox ;; msdos) basic_machine=i386-pc basic_os=msdos ;; msys) basic_machine=i686-pc basic_os=msys ;; mvs) basic_machine=i370-ibm basic_os=mvs ;; nacl) basic_machine=le32-unknown basic_os=nacl ;; ncr3000) basic_machine=i486-ncr basic_os=sysv4 ;; netbsd386) basic_machine=i386-pc basic_os=netbsd ;; netwinder) basic_machine=armv4l-rebel basic_os=linux ;; news | news700 | news800 | news900) basic_machine=m68k-sony basic_os=newsos ;; news1000) basic_machine=m68030-sony basic_os=newsos ;; necv70) basic_machine=v70-nec basic_os=sysv ;; nh3000) basic_machine=m68k-harris basic_os=cxux ;; nh[45]000) basic_machine=m88k-harris basic_os=cxux ;; nindy960) basic_machine=i960-intel basic_os=nindy ;; mon960) basic_machine=i960-intel basic_os=mon960 ;; nonstopux) basic_machine=mips-compaq basic_os=nonstopux ;; os400) basic_machine=powerpc-ibm basic_os=os400 ;; OSE68000 | ose68000) basic_machine=m68000-ericsson basic_os=ose ;; os68k) basic_machine=m68k-none basic_os=os68k ;; paragon) basic_machine=i860-intel basic_os=osf ;; parisc) basic_machine=hppa-unknown basic_os=linux ;; psp) basic_machine=mipsallegrexel-sony basic_os=psp ;; pw32) basic_machine=i586-unknown basic_os=pw32 ;; rdos | rdos64) basic_machine=x86_64-pc basic_os=rdos ;; rdos32) basic_machine=i386-pc basic_os=rdos ;; rom68k) basic_machine=m68k-rom68k basic_os=coff ;; sa29200) basic_machine=a29k-amd basic_os=udi ;; sei) basic_machine=mips-sei basic_os=seiux ;; sequent) basic_machine=i386-sequent basic_os= ;; sps7) basic_machine=m68k-bull basic_os=sysv2 ;; st2000) basic_machine=m68k-tandem basic_os= ;; stratus) basic_machine=i860-stratus basic_os=sysv4 ;; sun2) basic_machine=m68000-sun basic_os= ;; sun2os3) basic_machine=m68000-sun basic_os=sunos3 ;; sun2os4) basic_machine=m68000-sun basic_os=sunos4 ;; sun3) basic_machine=m68k-sun basic_os= ;; sun3os3) basic_machine=m68k-sun basic_os=sunos3 ;; sun3os4) basic_machine=m68k-sun basic_os=sunos4 ;; sun4) basic_machine=sparc-sun basic_os= ;; sun4os3) basic_machine=sparc-sun basic_os=sunos3 ;; sun4os4) basic_machine=sparc-sun basic_os=sunos4 ;; sun4sol2) basic_machine=sparc-sun basic_os=solaris2 ;; sun386 | sun386i | roadrunner) basic_machine=i386-sun basic_os= ;; sv1) basic_machine=sv1-cray basic_os=unicos ;; symmetry) basic_machine=i386-sequent basic_os=dynix ;; t3e) basic_machine=alphaev5-cray basic_os=unicos ;; t90) basic_machine=t90-cray basic_os=unicos ;; toad1) basic_machine=pdp10-xkl basic_os=tops20 ;; tpf) basic_machine=s390x-ibm basic_os=tpf ;; udi29k) basic_machine=a29k-amd basic_os=udi ;; ultra3) basic_machine=a29k-nyu basic_os=sym1 ;; v810 | necv810) basic_machine=v810-nec basic_os=none ;; vaxv) basic_machine=vax-dec basic_os=sysv ;; vms) basic_machine=vax-dec basic_os=vms ;; vsta) basic_machine=i386-pc basic_os=vsta ;; vxworks960) basic_machine=i960-wrs basic_os=vxworks ;; vxworks68) basic_machine=m68k-wrs basic_os=vxworks ;; vxworks29k) basic_machine=a29k-wrs basic_os=vxworks ;; xbox) basic_machine=i686-pc basic_os=mingw32 ;; ymp) basic_machine=ymp-cray basic_os=unicos ;; *) basic_machine=$1 basic_os= ;; esac ;; esac # Decode 1-component or ad-hoc basic machines case $basic_machine in # Here we handle the default manufacturer of certain CPU types. It is in # some cases the only manufacturer, in others, it is the most popular. w89k) cpu=hppa1.1 vendor=winbond ;; op50n) cpu=hppa1.1 vendor=oki ;; op60c) cpu=hppa1.1 vendor=oki ;; ibm*) cpu=i370 vendor=ibm ;; orion105) cpu=clipper vendor=highlevel ;; mac | mpw | mac-mpw) cpu=m68k vendor=apple ;; pmac | pmac-mpw) cpu=powerpc vendor=apple ;; # Recognize the various machine names and aliases which stand # for a CPU type and a company and sometimes even an OS. 3b1 | 7300 | 7300-att | att-7300 | pc7300 | safari | unixpc) cpu=m68000 vendor=att ;; 3b*) cpu=we32k vendor=att ;; bluegene*) cpu=powerpc vendor=ibm basic_os=cnk ;; decsystem10* | dec10*) cpu=pdp10 vendor=dec basic_os=tops10 ;; decsystem20* | dec20*) cpu=pdp10 vendor=dec basic_os=tops20 ;; delta | 3300 | motorola-3300 | motorola-delta \ | 3300-motorola | delta-motorola) cpu=m68k vendor=motorola ;; dpx2*) cpu=m68k vendor=bull basic_os=sysv3 ;; encore | umax | mmax) cpu=ns32k vendor=encore ;; elxsi) cpu=elxsi vendor=elxsi basic_os=${basic_os:-bsd} ;; fx2800) cpu=i860 vendor=alliant ;; genix) cpu=ns32k vendor=ns ;; h3050r* | hiux*) cpu=hppa1.1 vendor=hitachi basic_os=hiuxwe2 ;; hp3k9[0-9][0-9] | hp9[0-9][0-9]) cpu=hppa1.0 vendor=hp ;; hp9k2[0-9][0-9] | hp9k31[0-9]) cpu=m68000 vendor=hp ;; hp9k3[2-9][0-9]) cpu=m68k vendor=hp ;; hp9k6[0-9][0-9] | hp6[0-9][0-9]) cpu=hppa1.0 vendor=hp ;; hp9k7[0-79][0-9] | hp7[0-79][0-9]) cpu=hppa1.1 vendor=hp ;; hp9k78[0-9] | hp78[0-9]) # FIXME: really hppa2.0-hp cpu=hppa1.1 vendor=hp ;; hp9k8[67]1 | hp8[67]1 | hp9k80[24] | hp80[24] | hp9k8[78]9 | hp8[78]9 | hp9k893 | hp893) # FIXME: really hppa2.0-hp cpu=hppa1.1 vendor=hp ;; hp9k8[0-9][13679] | hp8[0-9][13679]) cpu=hppa1.1 vendor=hp ;; hp9k8[0-9][0-9] | hp8[0-9][0-9]) cpu=hppa1.0 vendor=hp ;; i*86v32) cpu=$(echo "$1" | sed -e 's/86.*/86/') vendor=pc basic_os=sysv32 ;; i*86v4*) cpu=$(echo "$1" | sed -e 's/86.*/86/') vendor=pc basic_os=sysv4 ;; i*86v) cpu=$(echo "$1" | sed -e 's/86.*/86/') vendor=pc basic_os=sysv ;; i*86sol2) cpu=$(echo "$1" | sed -e 's/86.*/86/') vendor=pc basic_os=solaris2 ;; j90 | j90-cray) cpu=j90 vendor=cray basic_os=${basic_os:-unicos} ;; iris | iris4d) cpu=mips vendor=sgi case $basic_os in irix*) ;; *) basic_os=irix4 ;; esac ;; miniframe) cpu=m68000 vendor=convergent ;; *mint | mint[0-9]* | *MiNT | *MiNT[0-9]*) cpu=m68k vendor=atari basic_os=mint ;; news-3600 | risc-news) cpu=mips vendor=sony basic_os=newsos ;; next | m*-next) cpu=m68k vendor=next case $basic_os in openstep*) ;; nextstep*) ;; ns2*) basic_os=nextstep2 ;; *) basic_os=nextstep3 ;; esac ;; np1) cpu=np1 vendor=gould ;; op50n-* | op60c-*) cpu=hppa1.1 vendor=oki basic_os=proelf ;; pa-hitachi) cpu=hppa1.1 vendor=hitachi basic_os=hiuxwe2 ;; pbd) cpu=sparc vendor=tti ;; pbb) cpu=m68k vendor=tti ;; pc532) cpu=ns32k vendor=pc532 ;; pn) cpu=pn vendor=gould ;; power) cpu=power vendor=ibm ;; ps2) cpu=i386 vendor=ibm ;; rm[46]00) cpu=mips vendor=siemens ;; rtpc | rtpc-*) cpu=romp vendor=ibm ;; sde) cpu=mipsisa32 vendor=sde basic_os=${basic_os:-elf} ;; simso-wrs) cpu=sparclite vendor=wrs basic_os=vxworks ;; tower | tower-32) cpu=m68k vendor=ncr ;; vpp*|vx|vx-*) cpu=f301 vendor=fujitsu ;; w65) cpu=w65 vendor=wdc ;; w89k-*) cpu=hppa1.1 vendor=winbond basic_os=proelf ;; none) cpu=none vendor=none ;; leon|leon[3-9]) cpu=sparc vendor=$basic_machine ;; leon-*|leon[3-9]-*) cpu=sparc vendor=$(echo "$basic_machine" | sed 's/-.*//') ;; *-*) # shellcheck disable=SC2162 IFS="-" read cpu vendor <&2 exit 1 ;; esac ;; esac # Here we canonicalize certain aliases for manufacturers. case $vendor in digital*) vendor=dec ;; commodore*) vendor=cbm ;; *) ;; esac # Decode manufacturer-specific aliases for certain operating systems. if test x$basic_os != x then # First recognize some ad-hoc caes, or perhaps split kernel-os, or else just # set os. case $basic_os in gnu/linux*) kernel=linux os=$(echo $basic_os | sed -e 's|gnu/linux|gnu|') ;; os2-emx) kernel=os2 os=$(echo $basic_os | sed -e 's|os2-emx|emx|') ;; nto-qnx*) kernel=nto os=$(echo $basic_os | sed -e 's|nto-qnx|qnx|') ;; *-*) # shellcheck disable=SC2162 IFS="-" read kernel os <&2 exit 1 ;; esac # As a final step for OS-related things, validate the OS-kernel combination # (given a valid OS), if there is a kernel. case $kernel-$os in linux-gnu* | linux-dietlibc* | linux-android* | linux-newlib* | linux-musl* | linux-uclibc* ) ;; uclinux-uclibc* ) ;; -dietlibc* | -newlib* | -musl* | -uclibc* ) # These are just libc implementations, not actual OSes, and thus # require a kernel. echo "Invalid configuration \`$1': libc \`$os' needs explicit kernel." 1>&2 exit 1 ;; kfreebsd*-gnu* | kopensolaris*-gnu*) ;; nto-qnx*) ;; os2-emx) ;; *-eabi* | *-gnueabi*) ;; -*) # Blank kernel with real OS is always fine. ;; *-*) echo "Invalid configuration \`$1': Kernel \`$kernel' not known to work with OS \`$os'." 1>&2 exit 1 ;; esac # Here we handle the case where we know the os, and the CPU type, but not the # manufacturer. We pick the logical manufacturer. case $vendor in unknown) case $cpu-$os in *-riscix*) vendor=acorn ;; *-sunos*) vendor=sun ;; *-cnk* | *-aix*) vendor=ibm ;; *-beos*) vendor=be ;; *-hpux*) vendor=hp ;; *-mpeix*) vendor=hp ;; *-hiux*) vendor=hitachi ;; *-unos*) vendor=crds ;; *-dgux*) vendor=dg ;; *-luna*) vendor=omron ;; *-genix*) vendor=ns ;; *-clix*) vendor=intergraph ;; *-mvs* | *-opened*) vendor=ibm ;; *-os400*) vendor=ibm ;; s390-* | s390x-*) vendor=ibm ;; *-ptx*) vendor=sequent ;; *-tpf*) vendor=ibm ;; *-vxsim* | *-vxworks* | *-windiss*) vendor=wrs ;; *-aux*) vendor=apple ;; *-hms*) vendor=hitachi ;; *-mpw* | *-macos*) vendor=apple ;; *-*mint | *-mint[0-9]* | *-*MiNT | *-MiNT[0-9]*) vendor=atari ;; *-vos*) vendor=stratus ;; esac ;; esac echo "$cpu-$vendor-${kernel:+$kernel-}$os" exit # Local variables: # eval: (add-hook 'before-save-hook 'time-stamp) # time-stamp-start: "timestamp='" # time-stamp-format: "%:y-%02m-%02d" # time-stamp-end: "'" # End: freeradius-3.2.10+dfsg/configure000077500000000000000000015234321522352605200165700ustar00rootroot00000000000000#! /bin/sh # Guess values for system-dependent variables and create Makefiles. # Generated by GNU Autoconf 2.71 for freeradius $Id: f7ffabd4b1bb160bebf78c82d28f9e016645e4c9 $. # # Report bugs to . # # # Copyright (C) 1992-1996, 1998-2017, 2020-2021 Free Software Foundation, # Inc. # # # This configure script is free software; the Free Software Foundation # gives unlimited permission to copy, distribute and modify it. ## -------------------- ## ## M4sh Initialization. ## ## -------------------- ## # Be more Bourne compatible DUALCASE=1; export DUALCASE # for MKS sh as_nop=: if test ${ZSH_VERSION+y} && (emulate sh) >/dev/null 2>&1 then : emulate sh NULLCMD=: # Pre-4.2 versions of Zsh do word splitting on ${1+"$@"}, which # is contrary to our usage. Disable this feature. alias -g '${1+"$@"}'='"$@"' setopt NO_GLOB_SUBST else $as_nop case `(set -o) 2>/dev/null` in #( *posix*) : set -o posix ;; #( *) : ;; esac fi # Reset variables that may have inherited troublesome values from # the environment. # IFS needs to be set, to space, tab, and newline, in precisely that order. # (If _AS_PATH_WALK were called with IFS unset, it would have the # side effect of setting IFS to empty, thus disabling word splitting.) # Quoting is to prevent editors from complaining about space-tab. as_nl=' ' export as_nl IFS=" "" $as_nl" PS1='$ ' PS2='> ' PS4='+ ' # Ensure predictable behavior from utilities with locale-dependent output. LC_ALL=C export LC_ALL LANGUAGE=C export LANGUAGE # We cannot yet rely on "unset" to work, but we need these variables # to be unset--not just set to an empty or harmless value--now, to # avoid bugs in old shells (e.g. pre-3.0 UWIN ksh). This construct # also avoids known problems related to "unset" and subshell syntax # in other old shells (e.g. bash 2.01 and pdksh 5.2.14). for as_var in BASH_ENV ENV MAIL MAILPATH CDPATH do eval test \${$as_var+y} \ && ( (unset $as_var) || exit 1) >/dev/null 2>&1 && unset $as_var || : done # Ensure that fds 0, 1, and 2 are open. if (exec 3>&0) 2>/dev/null; then :; else exec 0&1) 2>/dev/null; then :; else exec 1>/dev/null; fi if (exec 3>&2) ; then :; else exec 2>/dev/null; fi # The user is always right. if ${PATH_SEPARATOR+false} :; then PATH_SEPARATOR=: (PATH='/bin;/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 && { (PATH='/bin:/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 || PATH_SEPARATOR=';' } fi # Find who we are. Look in the path if we contain no directory separator. as_myself= case $0 in #(( *[\\/]* ) as_myself=$0 ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS case $as_dir in #((( '') as_dir=./ ;; */) ;; *) as_dir=$as_dir/ ;; esac test -r "$as_dir$0" && as_myself=$as_dir$0 && break done IFS=$as_save_IFS ;; esac # We did not find ourselves, most probably we were run as `sh COMMAND' # in which case we are not to be found in the path. if test "x$as_myself" = x; then as_myself=$0 fi if test ! -f "$as_myself"; then printf "%s\n" "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2 exit 1 fi # Use a proper internal environment variable to ensure we don't fall # into an infinite loop, continuously re-executing ourselves. if test x"${_as_can_reexec}" != xno && test "x$CONFIG_SHELL" != x; then _as_can_reexec=no; export _as_can_reexec; # We cannot yet assume a decent shell, so we have to provide a # neutralization value for shells without unset; and this also # works around shells that cannot unset nonexistent variables. # Preserve -v and -x to the replacement shell. BASH_ENV=/dev/null ENV=/dev/null (unset BASH_ENV) >/dev/null 2>&1 && unset BASH_ENV ENV case $- in # (((( *v*x* | *x*v* ) as_opts=-vx ;; *v* ) as_opts=-v ;; *x* ) as_opts=-x ;; * ) as_opts= ;; esac exec $CONFIG_SHELL $as_opts "$as_myself" ${1+"$@"} # Admittedly, this is quite paranoid, since all the known shells bail # out after a failed `exec'. printf "%s\n" "$0: could not re-execute with $CONFIG_SHELL" >&2 exit 255 fi # We don't want this to propagate to other subprocesses. { _as_can_reexec=; unset _as_can_reexec;} if test "x$CONFIG_SHELL" = x; then as_bourne_compatible="as_nop=: if test \${ZSH_VERSION+y} && (emulate sh) >/dev/null 2>&1 then : emulate sh NULLCMD=: # Pre-4.2 versions of Zsh do word splitting on \${1+\"\$@\"}, which # is contrary to our usage. Disable this feature. alias -g '\${1+\"\$@\"}'='\"\$@\"' setopt NO_GLOB_SUBST else \$as_nop case \`(set -o) 2>/dev/null\` in #( *posix*) : set -o posix ;; #( *) : ;; esac fi " as_required="as_fn_return () { (exit \$1); } as_fn_success () { as_fn_return 0; } as_fn_failure () { as_fn_return 1; } as_fn_ret_success () { return 0; } as_fn_ret_failure () { return 1; } exitcode=0 as_fn_success || { exitcode=1; echo as_fn_success failed.; } as_fn_failure && { exitcode=1; echo as_fn_failure succeeded.; } as_fn_ret_success || { exitcode=1; echo as_fn_ret_success failed.; } as_fn_ret_failure && { exitcode=1; echo as_fn_ret_failure succeeded.; } if ( set x; as_fn_ret_success y && test x = \"\$1\" ) then : else \$as_nop exitcode=1; echo positional parameters were not saved. fi test x\$exitcode = x0 || exit 1 blah=\$(echo \$(echo blah)) test x\"\$blah\" = xblah || exit 1 test -x / || exit 1" as_suggested=" as_lineno_1=";as_suggested=$as_suggested$LINENO;as_suggested=$as_suggested" as_lineno_1a=\$LINENO as_lineno_2=";as_suggested=$as_suggested$LINENO;as_suggested=$as_suggested" as_lineno_2a=\$LINENO eval 'test \"x\$as_lineno_1'\$as_run'\" != \"x\$as_lineno_2'\$as_run'\" && test \"x\`expr \$as_lineno_1'\$as_run' + 1\`\" = \"x\$as_lineno_2'\$as_run'\"' || exit 1 test \$(( 1 + 1 )) = 2 || exit 1" if (eval "$as_required") 2>/dev/null then : as_have_required=yes else $as_nop as_have_required=no fi if test x$as_have_required = xyes && (eval "$as_suggested") 2>/dev/null then : else $as_nop as_save_IFS=$IFS; IFS=$PATH_SEPARATOR as_found=false for as_dir in /bin$PATH_SEPARATOR/usr/bin$PATH_SEPARATOR$PATH do IFS=$as_save_IFS case $as_dir in #((( '') as_dir=./ ;; */) ;; *) as_dir=$as_dir/ ;; esac as_found=: case $as_dir in #( /*) for as_base in sh bash ksh sh5; do # Try only shells that exist, to save several forks. as_shell=$as_dir$as_base if { test -f "$as_shell" || test -f "$as_shell.exe"; } && as_run=a "$as_shell" -c "$as_bourne_compatible""$as_required" 2>/dev/null then : CONFIG_SHELL=$as_shell as_have_required=yes if as_run=a "$as_shell" -c "$as_bourne_compatible""$as_suggested" 2>/dev/null then : break 2 fi fi done;; esac as_found=false done IFS=$as_save_IFS if $as_found then : else $as_nop if { test -f "$SHELL" || test -f "$SHELL.exe"; } && as_run=a "$SHELL" -c "$as_bourne_compatible""$as_required" 2>/dev/null then : CONFIG_SHELL=$SHELL as_have_required=yes fi fi if test "x$CONFIG_SHELL" != x then : export CONFIG_SHELL # We cannot yet assume a decent shell, so we have to provide a # neutralization value for shells without unset; and this also # works around shells that cannot unset nonexistent variables. # Preserve -v and -x to the replacement shell. BASH_ENV=/dev/null ENV=/dev/null (unset BASH_ENV) >/dev/null 2>&1 && unset BASH_ENV ENV case $- in # (((( *v*x* | *x*v* ) as_opts=-vx ;; *v* ) as_opts=-v ;; *x* ) as_opts=-x ;; * ) as_opts= ;; esac exec $CONFIG_SHELL $as_opts "$as_myself" ${1+"$@"} # Admittedly, this is quite paranoid, since all the known shells bail # out after a failed `exec'. printf "%s\n" "$0: could not re-execute with $CONFIG_SHELL" >&2 exit 255 fi if test x$as_have_required = xno then : printf "%s\n" "$0: This script requires a shell more modern than all" printf "%s\n" "$0: the shells that I found on your system." if test ${ZSH_VERSION+y} ; then printf "%s\n" "$0: In particular, zsh $ZSH_VERSION has bugs and should" printf "%s\n" "$0: be upgraded to zsh 4.3.4 or later." else printf "%s\n" "$0: Please tell bug-autoconf@gnu.org and $0: http://bugs.freeradius.org about your system, including $0: any error possibly output before this message. Then $0: install a modern shell, or manually run the script $0: under such a shell if you do have one." fi exit 1 fi fi fi SHELL=${CONFIG_SHELL-/bin/sh} export SHELL # Unset more variables known to interfere with behavior of common tools. CLICOLOR_FORCE= GREP_OPTIONS= unset CLICOLOR_FORCE GREP_OPTIONS ## --------------------- ## ## M4sh Shell Functions. ## ## --------------------- ## # as_fn_unset VAR # --------------- # Portably unset VAR. as_fn_unset () { { eval $1=; unset $1;} } as_unset=as_fn_unset # as_fn_set_status STATUS # ----------------------- # Set $? to STATUS, without forking. as_fn_set_status () { return $1 } # as_fn_set_status # as_fn_exit STATUS # ----------------- # Exit the shell with STATUS, even in a "trap 0" or "set -e" context. as_fn_exit () { set +e as_fn_set_status $1 exit $1 } # as_fn_exit # as_fn_nop # --------- # Do nothing but, unlike ":", preserve the value of $?. as_fn_nop () { return $? } as_nop=as_fn_nop # as_fn_mkdir_p # ------------- # Create "$as_dir" as a directory, including parents if necessary. as_fn_mkdir_p () { case $as_dir in #( -*) as_dir=./$as_dir;; esac test -d "$as_dir" || eval $as_mkdir_p || { as_dirs= while :; do case $as_dir in #( *\'*) as_qdir=`printf "%s\n" "$as_dir" | sed "s/'/'\\\\\\\\''/g"`;; #'( *) as_qdir=$as_dir;; esac as_dirs="'$as_qdir' $as_dirs" as_dir=`$as_dirname -- "$as_dir" || $as_expr X"$as_dir" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ X"$as_dir" : 'X\(//\)[^/]' \| \ X"$as_dir" : 'X\(//\)$' \| \ X"$as_dir" : 'X\(/\)' \| . 2>/dev/null || printf "%s\n" X"$as_dir" | sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/ q } /^X\(\/\/\)[^/].*/{ s//\1/ q } /^X\(\/\/\)$/{ s//\1/ q } /^X\(\/\).*/{ s//\1/ q } s/.*/./; q'` test -d "$as_dir" && break done test -z "$as_dirs" || eval "mkdir $as_dirs" } || test -d "$as_dir" || as_fn_error $? "cannot create directory $as_dir" } # as_fn_mkdir_p # as_fn_executable_p FILE # ----------------------- # Test if FILE is an executable regular file. as_fn_executable_p () { test -f "$1" && test -x "$1" } # as_fn_executable_p # as_fn_append VAR VALUE # ---------------------- # Append the text in VALUE to the end of the definition contained in VAR. Take # advantage of any shell optimizations that allow amortized linear growth over # repeated appends, instead of the typical quadratic growth present in naive # implementations. if (eval "as_var=1; as_var+=2; test x\$as_var = x12") 2>/dev/null then : eval 'as_fn_append () { eval $1+=\$2 }' else $as_nop as_fn_append () { eval $1=\$$1\$2 } fi # as_fn_append # as_fn_arith ARG... # ------------------ # Perform arithmetic evaluation on the ARGs, and store the result in the # global $as_val. Take advantage of shells that can avoid forks. The arguments # must be portable across $(()) and expr. if (eval "test \$(( 1 + 1 )) = 2") 2>/dev/null then : eval 'as_fn_arith () { as_val=$(( $* )) }' else $as_nop as_fn_arith () { as_val=`expr "$@" || test $? -eq 1` } fi # as_fn_arith # as_fn_nop # --------- # Do nothing but, unlike ":", preserve the value of $?. as_fn_nop () { return $? } as_nop=as_fn_nop # as_fn_error STATUS ERROR [LINENO LOG_FD] # ---------------------------------------- # Output "`basename $0`: error: ERROR" to stderr. If LINENO and LOG_FD are # provided, also output the error to LOG_FD, referencing LINENO. Then exit the # script with STATUS, using 1 if that was 0. as_fn_error () { as_status=$1; test $as_status -eq 0 && as_status=1 if test "$4"; then as_lineno=${as_lineno-"$3"} as_lineno_stack=as_lineno_stack=$as_lineno_stack printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: $2" >&$4 fi printf "%s\n" "$as_me: error: $2" >&2 as_fn_exit $as_status } # as_fn_error if expr a : '\(a\)' >/dev/null 2>&1 && test "X`expr 00001 : '.*\(...\)'`" = X001; then as_expr=expr else as_expr=false fi if (basename -- /) >/dev/null 2>&1 && test "X`basename -- / 2>&1`" = "X/"; then as_basename=basename else as_basename=false fi if (as_dir=`dirname -- /` && test "X$as_dir" = X/) >/dev/null 2>&1; then as_dirname=dirname else as_dirname=false fi as_me=`$as_basename -- "$0" || $as_expr X/"$0" : '.*/\([^/][^/]*\)/*$' \| \ X"$0" : 'X\(//\)$' \| \ X"$0" : 'X\(/\)' \| . 2>/dev/null || printf "%s\n" X/"$0" | sed '/^.*\/\([^/][^/]*\)\/*$/{ s//\1/ q } /^X\/\(\/\/\)$/{ s//\1/ q } /^X\/\(\/\).*/{ s//\1/ q } s/.*/./; q'` # Avoid depending upon Character Ranges. as_cr_letters='abcdefghijklmnopqrstuvwxyz' as_cr_LETTERS='ABCDEFGHIJKLMNOPQRSTUVWXYZ' as_cr_Letters=$as_cr_letters$as_cr_LETTERS as_cr_digits='0123456789' as_cr_alnum=$as_cr_Letters$as_cr_digits as_lineno_1=$LINENO as_lineno_1a=$LINENO as_lineno_2=$LINENO as_lineno_2a=$LINENO eval 'test "x$as_lineno_1'$as_run'" != "x$as_lineno_2'$as_run'" && test "x`expr $as_lineno_1'$as_run' + 1`" = "x$as_lineno_2'$as_run'"' || { # Blame Lee E. McMahon (1931-1989) for sed's syntax. :-) sed -n ' p /[$]LINENO/= ' <$as_myself | sed ' s/[$]LINENO.*/&-/ t lineno b :lineno N :loop s/[$]LINENO\([^'$as_cr_alnum'_].*\n\)\(.*\)/\2\1\2/ t loop s/-\n.*// ' >$as_me.lineno && chmod +x "$as_me.lineno" || { printf "%s\n" "$as_me: error: cannot create $as_me.lineno; rerun with a POSIX shell" >&2; as_fn_exit 1; } # If we had to re-execute with $CONFIG_SHELL, we're ensured to have # already done that, so ensure we don't try to do so again and fall # in an infinite loop. This has already happened in practice. _as_can_reexec=no; export _as_can_reexec # Don't try to exec as it changes $[0], causing all sort of problems # (the dirname of $[0] is not the place where we might find the # original and so on. Autoconf is especially sensitive to this). . "./$as_me.lineno" # Exit status is that of the last command. exit } # Determine whether it's possible to make 'echo' print without a newline. # These variables are no longer used directly by Autoconf, but are AC_SUBSTed # for compatibility with existing Makefiles. ECHO_C= ECHO_N= ECHO_T= case `echo -n x` in #((((( -n*) case `echo 'xy\c'` in *c*) ECHO_T=' ';; # ECHO_T is single tab character. xy) ECHO_C='\c';; *) echo `echo ksh88 bug on AIX 6.1` > /dev/null ECHO_T=' ';; esac;; *) ECHO_N='-n';; esac # For backward compatibility with old third-party macros, we provide # the shell variables $as_echo and $as_echo_n. New code should use # AS_ECHO(["message"]) and AS_ECHO_N(["message"]), respectively. as_echo='printf %s\n' as_echo_n='printf %s' rm -f conf$$ conf$$.exe conf$$.file if test -d conf$$.dir; then rm -f conf$$.dir/conf$$.file else rm -f conf$$.dir mkdir conf$$.dir 2>/dev/null fi if (echo >conf$$.file) 2>/dev/null; then if ln -s conf$$.file conf$$ 2>/dev/null; then as_ln_s='ln -s' # ... but there are two gotchas: # 1) On MSYS, both `ln -s file dir' and `ln file dir' fail. # 2) DJGPP < 2.04 has no symlinks; `ln -s' creates a wrapper executable. # In both cases, we have to default to `cp -pR'. ln -s conf$$.file conf$$.dir 2>/dev/null && test ! -f conf$$.exe || as_ln_s='cp -pR' elif ln conf$$.file conf$$ 2>/dev/null; then as_ln_s=ln else as_ln_s='cp -pR' fi else as_ln_s='cp -pR' fi rm -f conf$$ conf$$.exe conf$$.dir/conf$$.file conf$$.file rmdir conf$$.dir 2>/dev/null if mkdir -p . 2>/dev/null; then as_mkdir_p='mkdir -p "$as_dir"' else test -d ./-p && rmdir ./-p as_mkdir_p=false fi as_test_x='test -x' as_executable_p=as_fn_executable_p # Sed expression to map a string onto a valid CPP name. as_tr_cpp="eval sed 'y%*$as_cr_letters%P$as_cr_LETTERS%;s%[^_$as_cr_alnum]%_%g'" # Sed expression to map a string onto a valid variable name. as_tr_sh="eval sed 'y%*+%pp%;s%[^_$as_cr_alnum]%_%g'" test -n "$DJDIR" || exec 7<&0 &1 # Name of the host. # hostname on some systems (SVR3.2, old GNU/Linux) returns a bogus exit status, # so uname gets run too. ac_hostname=`(hostname || uname -n) 2>/dev/null | sed 1q` # # Initializations. # ac_default_prefix=/usr/local ac_clean_files= ac_config_libobj_dir=. LIBOBJS= cross_compiling=no subdirs= MFLAGS= MAKEFLAGS= # Identity of this package. PACKAGE_NAME='freeradius' PACKAGE_TARNAME='freeradius' PACKAGE_VERSION='$Id: f7ffabd4b1bb160bebf78c82d28f9e016645e4c9 $' PACKAGE_STRING='freeradius $Id: f7ffabd4b1bb160bebf78c82d28f9e016645e4c9 $' PACKAGE_BUGREPORT='http://bugs.freeradius.org' PACKAGE_URL='http://www.freeradius.org' ac_unique_file="src/main/radiusd.c" # Factoring default headers for most tests. ac_includes_default="\ #include #ifdef HAVE_STDIO_H # include #endif #ifdef HAVE_STDLIB_H # include #endif #ifdef HAVE_STRING_H # include #endif #ifdef HAVE_INTTYPES_H # include #endif #ifdef HAVE_STDINT_H # include #endif #ifdef HAVE_STRINGS_H # include #endif #ifdef HAVE_SYS_TYPES_H # include #endif #ifdef HAVE_SYS_STAT_H # include #endif #ifdef HAVE_UNISTD_H # include #endif" ac_header_c_list= enable_option_checking=no ac_subst_vars='LTLIBOBJS LIBOBJS MANSKIP STATIC_MODULES USE_STATIC_LIBS USE_SHARED_LIBS INSTALLSTRIP MODULES subdirs HOSTINFO CRYPTLIB LIBPREFIX COLLECTDC_LDFLAGS COLLECTDC_LIBS PCAP_LDFLAGS PCAP_LIBS OPENSSL_CPPFLAGS OPENSSL_LDFLAGS OPENSSL_LIBS SYSTEMD_LDFLAGS SYSTEMD_LIBS LIBREADLINE TALLOC_LDFLAGS TALLOC_LIBS DIRNAME AUTOHEADER AUTOCONF ACLOCAL LAST RUSERS SNMPWALK SNMPGET openssl_version_check_config WITH_RADLAST WITH_DHCP modconfdir dictdir raddbdir radacctdir logdir GIT FR_MAKEFLAGS MAKE GMAKE clang_path RANLIB EGREP GREP CPP ac_ct_CXX CXXFLAGS CXX OBJEXT EXEEXT ac_ct_CC CPPFLAGS LDFLAGS CFLAGS CC target_os target_vendor target_cpu target host_os host_vendor host_cpu host build_os build_vendor build_cpu build ANTORA GRAPHVIZ_DOT DOXYGEN PERL PANDOC_ENGINE PANDOC ASCIIDOCTOR RADIUSD_VERSION_STRING target_alias host_alias build_alias LIBS ECHO_T ECHO_N ECHO_C DEFS mandir localedir libdir psdir pdfdir dvidir htmldir infodir docdir oldincludedir includedir runstatedir localstatedir sharedstatedir sysconfdir datadir datarootdir libexecdir sbindir bindir program_transform_name prefix exec_prefix PACKAGE_URL PACKAGE_BUGREPORT PACKAGE_STRING PACKAGE_VERSION PACKAGE_TARNAME PACKAGE_NAME PATH_SEPARATOR SHELL' ac_subst_files='' ac_user_opts=' enable_option_checking enable_developer enable_verify_ptr enable_fips_workaround enable_largefile enable_strict_dependencies enable_werror with_docdir with_logdir with_radacctdir with_raddbdir with_dictdir with_ascend_binary with_radiusv11 with_threads with_tcp with_vmps with_dhcp with_radlast with_static_modules with_shared_libs with_modules with_experimental_modules with_udpfromto with_rlm_FOO_lib_dir with_rlm_FOO_include_dir with_openssl with_openssl_lib_dir with_openssl_include_dir enable_openssl_version_check enable_reproducible_builds enable_fuzzer enable_address_sanitizer enable_leak_sanitizer enable_thread_sanitizer enable_undefined_behaviour_sanitizer with_talloc_lib_dir with_talloc_include_dir with_pcap_lib_dir with_pcap_include_dir with_collectdclient_lib_dir with_collectdclient_include_dir with_cap_lib_dir with_cap_include_dir with_systemd with_systemd_lib_dir with_systemd_include_dir with_execinfo_lib_dir with_execinfo_include_dir with_pcre with_pcre_lib_dir with_pcre_include_dir with_regex ' ac_precious_vars='build_alias host_alias target_alias CC CFLAGS LDFLAGS LIBS CPPFLAGS CXX CXXFLAGS CCC CPP' ac_subdirs_all='$mysubdirs' # Initialize some variables set by options. ac_init_help= ac_init_version=false ac_unrecognized_opts= ac_unrecognized_sep= # The variables have the same names as the options, with # dashes changed to underlines. cache_file=/dev/null exec_prefix=NONE no_create= no_recursion= prefix=NONE program_prefix=NONE program_suffix=NONE program_transform_name=s,x,x, silent= site= srcdir= verbose= x_includes=NONE x_libraries=NONE # Installation directory options. # These are left unexpanded so users can "make install exec_prefix=/foo" # and all the variables that are supposed to be based on exec_prefix # by default will actually change. # Use braces instead of parens because sh, perl, etc. also accept them. # (The list follows the same order as the GNU Coding Standards.) bindir='${exec_prefix}/bin' sbindir='${exec_prefix}/sbin' libexecdir='${exec_prefix}/libexec' datarootdir='${prefix}/share' datadir='${datarootdir}' sysconfdir='${prefix}/etc' sharedstatedir='${prefix}/com' localstatedir='${prefix}/var' runstatedir='${localstatedir}/run' includedir='${prefix}/include' oldincludedir='/usr/include' docdir='${datarootdir}/doc/${PACKAGE_TARNAME}' infodir='${datarootdir}/info' htmldir='${docdir}' dvidir='${docdir}' pdfdir='${docdir}' psdir='${docdir}' libdir='${exec_prefix}/lib' localedir='${datarootdir}/locale' mandir='${datarootdir}/man' ac_prev= ac_dashdash= for ac_option do # If the previous option needs an argument, assign it. if test -n "$ac_prev"; then eval $ac_prev=\$ac_option ac_prev= continue fi case $ac_option in *=?*) ac_optarg=`expr "X$ac_option" : '[^=]*=\(.*\)'` ;; *=) ac_optarg= ;; *) ac_optarg=yes ;; esac case $ac_dashdash$ac_option in --) ac_dashdash=yes ;; -bindir | --bindir | --bindi | --bind | --bin | --bi) ac_prev=bindir ;; -bindir=* | --bindir=* | --bindi=* | --bind=* | --bin=* | --bi=*) bindir=$ac_optarg ;; -build | --build | --buil | --bui | --bu) ac_prev=build_alias ;; -build=* | --build=* | --buil=* | --bui=* | --bu=*) build_alias=$ac_optarg ;; -cache-file | --cache-file | --cache-fil | --cache-fi \ | --cache-f | --cache- | --cache | --cach | --cac | --ca | --c) ac_prev=cache_file ;; -cache-file=* | --cache-file=* | --cache-fil=* | --cache-fi=* \ | --cache-f=* | --cache-=* | --cache=* | --cach=* | --cac=* | --ca=* | --c=*) cache_file=$ac_optarg ;; --config-cache | -C) cache_file=config.cache ;; -datadir | --datadir | --datadi | --datad) ac_prev=datadir ;; -datadir=* | --datadir=* | --datadi=* | --datad=*) datadir=$ac_optarg ;; -datarootdir | --datarootdir | --datarootdi | --datarootd | --dataroot \ | --dataroo | --dataro | --datar) ac_prev=datarootdir ;; -datarootdir=* | --datarootdir=* | --datarootdi=* | --datarootd=* \ | --dataroot=* | --dataroo=* | --dataro=* | --datar=*) datarootdir=$ac_optarg ;; -disable-* | --disable-*) ac_useropt=`expr "x$ac_option" : 'x-*disable-\(.*\)'` # Reject names that are not valid shell variable names. expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null && as_fn_error $? "invalid feature name: \`$ac_useropt'" ac_useropt_orig=$ac_useropt ac_useropt=`printf "%s\n" "$ac_useropt" | sed 's/[-+.]/_/g'` case $ac_user_opts in *" "enable_$ac_useropt" "*) ;; *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--disable-$ac_useropt_orig" ac_unrecognized_sep=', ';; esac eval enable_$ac_useropt=no ;; -docdir | --docdir | --docdi | --doc | --do) ac_prev=docdir ;; -docdir=* | --docdir=* | --docdi=* | --doc=* | --do=*) docdir=$ac_optarg ;; -dvidir | --dvidir | --dvidi | --dvid | --dvi | --dv) ac_prev=dvidir ;; -dvidir=* | --dvidir=* | --dvidi=* | --dvid=* | --dvi=* | --dv=*) dvidir=$ac_optarg ;; -enable-* | --enable-*) ac_useropt=`expr "x$ac_option" : 'x-*enable-\([^=]*\)'` # Reject names that are not valid shell variable names. expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null && as_fn_error $? "invalid feature name: \`$ac_useropt'" ac_useropt_orig=$ac_useropt ac_useropt=`printf "%s\n" "$ac_useropt" | sed 's/[-+.]/_/g'` case $ac_user_opts in *" "enable_$ac_useropt" "*) ;; *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--enable-$ac_useropt_orig" ac_unrecognized_sep=', ';; esac eval enable_$ac_useropt=\$ac_optarg ;; -exec-prefix | --exec_prefix | --exec-prefix | --exec-prefi \ | --exec-pref | --exec-pre | --exec-pr | --exec-p | --exec- \ | --exec | --exe | --ex) ac_prev=exec_prefix ;; -exec-prefix=* | --exec_prefix=* | --exec-prefix=* | --exec-prefi=* \ | --exec-pref=* | --exec-pre=* | --exec-pr=* | --exec-p=* | --exec-=* \ | --exec=* | --exe=* | --ex=*) exec_prefix=$ac_optarg ;; -gas | --gas | --ga | --g) # Obsolete; use --with-gas. with_gas=yes ;; -help | --help | --hel | --he | -h) ac_init_help=long ;; -help=r* | --help=r* | --hel=r* | --he=r* | -hr*) ac_init_help=recursive ;; -help=s* | --help=s* | --hel=s* | --he=s* | -hs*) ac_init_help=short ;; -host | --host | --hos | --ho) ac_prev=host_alias ;; -host=* | --host=* | --hos=* | --ho=*) host_alias=$ac_optarg ;; -htmldir | --htmldir | --htmldi | --htmld | --html | --htm | --ht) ac_prev=htmldir ;; -htmldir=* | --htmldir=* | --htmldi=* | --htmld=* | --html=* | --htm=* \ | --ht=*) htmldir=$ac_optarg ;; -includedir | --includedir | --includedi | --included | --include \ | --includ | --inclu | --incl | --inc) ac_prev=includedir ;; -includedir=* | --includedir=* | --includedi=* | --included=* | --include=* \ | --includ=* | --inclu=* | --incl=* | --inc=*) includedir=$ac_optarg ;; -infodir | --infodir | --infodi | --infod | --info | --inf) ac_prev=infodir ;; -infodir=* | --infodir=* | --infodi=* | --infod=* | --info=* | --inf=*) infodir=$ac_optarg ;; -libdir | --libdir | --libdi | --libd) ac_prev=libdir ;; -libdir=* | --libdir=* | --libdi=* | --libd=*) libdir=$ac_optarg ;; -libexecdir | --libexecdir | --libexecdi | --libexecd | --libexec \ | --libexe | --libex | --libe) ac_prev=libexecdir ;; -libexecdir=* | --libexecdir=* | --libexecdi=* | --libexecd=* | --libexec=* \ | --libexe=* | --libex=* | --libe=*) libexecdir=$ac_optarg ;; -localedir | --localedir | --localedi | --localed | --locale) ac_prev=localedir ;; -localedir=* | --localedir=* | --localedi=* | --localed=* | --locale=*) localedir=$ac_optarg ;; -localstatedir | --localstatedir | --localstatedi | --localstated \ | --localstate | --localstat | --localsta | --localst | --locals) ac_prev=localstatedir ;; -localstatedir=* | --localstatedir=* | --localstatedi=* | --localstated=* \ | --localstate=* | --localstat=* | --localsta=* | --localst=* | --locals=*) localstatedir=$ac_optarg ;; -mandir | --mandir | --mandi | --mand | --man | --ma | --m) ac_prev=mandir ;; -mandir=* | --mandir=* | --mandi=* | --mand=* | --man=* | --ma=* | --m=*) mandir=$ac_optarg ;; -nfp | --nfp | --nf) # Obsolete; use --without-fp. with_fp=no ;; -no-create | --no-create | --no-creat | --no-crea | --no-cre \ | --no-cr | --no-c | -n) no_create=yes ;; -no-recursion | --no-recursion | --no-recursio | --no-recursi \ | --no-recurs | --no-recur | --no-recu | --no-rec | --no-re | --no-r) no_recursion=yes ;; -oldincludedir | --oldincludedir | --oldincludedi | --oldincluded \ | --oldinclude | --oldinclud | --oldinclu | --oldincl | --oldinc \ | --oldin | --oldi | --old | --ol | --o) ac_prev=oldincludedir ;; -oldincludedir=* | --oldincludedir=* | --oldincludedi=* | --oldincluded=* \ | --oldinclude=* | --oldinclud=* | --oldinclu=* | --oldincl=* | --oldinc=* \ | --oldin=* | --oldi=* | --old=* | --ol=* | --o=*) oldincludedir=$ac_optarg ;; -prefix | --prefix | --prefi | --pref | --pre | --pr | --p) ac_prev=prefix ;; -prefix=* | --prefix=* | --prefi=* | --pref=* | --pre=* | --pr=* | --p=*) prefix=$ac_optarg ;; -program-prefix | --program-prefix | --program-prefi | --program-pref \ | --program-pre | --program-pr | --program-p) ac_prev=program_prefix ;; -program-prefix=* | --program-prefix=* | --program-prefi=* \ | --program-pref=* | --program-pre=* | --program-pr=* | --program-p=*) program_prefix=$ac_optarg ;; -program-suffix | --program-suffix | --program-suffi | --program-suff \ | --program-suf | --program-su | --program-s) ac_prev=program_suffix ;; -program-suffix=* | --program-suffix=* | --program-suffi=* \ | --program-suff=* | --program-suf=* | --program-su=* | --program-s=*) program_suffix=$ac_optarg ;; -program-transform-name | --program-transform-name \ | --program-transform-nam | --program-transform-na \ | --program-transform-n | --program-transform- \ | --program-transform | --program-transfor \ | --program-transfo | --program-transf \ | --program-trans | --program-tran \ | --progr-tra | --program-tr | --program-t) ac_prev=program_transform_name ;; -program-transform-name=* | --program-transform-name=* \ | --program-transform-nam=* | --program-transform-na=* \ | --program-transform-n=* | --program-transform-=* \ | --program-transform=* | --program-transfor=* \ | --program-transfo=* | --program-transf=* \ | --program-trans=* | --program-tran=* \ | --progr-tra=* | --program-tr=* | --program-t=*) program_transform_name=$ac_optarg ;; -pdfdir | --pdfdir | --pdfdi | --pdfd | --pdf | --pd) ac_prev=pdfdir ;; -pdfdir=* | --pdfdir=* | --pdfdi=* | --pdfd=* | --pdf=* | --pd=*) pdfdir=$ac_optarg ;; -psdir | --psdir | --psdi | --psd | --ps) ac_prev=psdir ;; -psdir=* | --psdir=* | --psdi=* | --psd=* | --ps=*) psdir=$ac_optarg ;; -q | -quiet | --quiet | --quie | --qui | --qu | --q \ | -silent | --silent | --silen | --sile | --sil) silent=yes ;; -runstatedir | --runstatedir | --runstatedi | --runstated \ | --runstate | --runstat | --runsta | --runst | --runs \ | --run | --ru | --r) ac_prev=runstatedir ;; -runstatedir=* | --runstatedir=* | --runstatedi=* | --runstated=* \ | --runstate=* | --runstat=* | --runsta=* | --runst=* | --runs=* \ | --run=* | --ru=* | --r=*) runstatedir=$ac_optarg ;; -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) ac_prev=sbindir ;; -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ | --sbi=* | --sb=*) sbindir=$ac_optarg ;; -sharedstatedir | --sharedstatedir | --sharedstatedi \ | --sharedstated | --sharedstate | --sharedstat | --sharedsta \ | --sharedst | --shareds | --shared | --share | --shar \ | --sha | --sh) ac_prev=sharedstatedir ;; -sharedstatedir=* | --sharedstatedir=* | --sharedstatedi=* \ | --sharedstated=* | --sharedstate=* | --sharedstat=* | --sharedsta=* \ | --sharedst=* | --shareds=* | --shared=* | --share=* | --shar=* \ | --sha=* | --sh=*) sharedstatedir=$ac_optarg ;; -site | --site | --sit) ac_prev=site ;; -site=* | --site=* | --sit=*) site=$ac_optarg ;; -srcdir | --srcdir | --srcdi | --srcd | --src | --sr) ac_prev=srcdir ;; -srcdir=* | --srcdir=* | --srcdi=* | --srcd=* | --src=* | --sr=*) srcdir=$ac_optarg ;; -sysconfdir | --sysconfdir | --sysconfdi | --sysconfd | --sysconf \ | --syscon | --sysco | --sysc | --sys | --sy) ac_prev=sysconfdir ;; -sysconfdir=* | --sysconfdir=* | --sysconfdi=* | --sysconfd=* | --sysconf=* \ | --syscon=* | --sysco=* | --sysc=* | --sys=* | --sy=*) sysconfdir=$ac_optarg ;; -target | --target | --targe | --targ | --tar | --ta | --t) ac_prev=target_alias ;; -target=* | --target=* | --targe=* | --targ=* | --tar=* | --ta=* | --t=*) target_alias=$ac_optarg ;; -v | -verbose | --verbose | --verbos | --verbo | --verb) verbose=yes ;; -version | --version | --versio | --versi | --vers | -V) ac_init_version=: ;; -with-* | --with-*) ac_useropt=`expr "x$ac_option" : 'x-*with-\([^=]*\)'` # Reject names that are not valid shell variable names. expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null && as_fn_error $? "invalid package name: \`$ac_useropt'" ac_useropt_orig=$ac_useropt ac_useropt=`printf "%s\n" "$ac_useropt" | sed 's/[-+.]/_/g'` case $ac_user_opts in *" "with_$ac_useropt" "*) ;; *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--with-$ac_useropt_orig" ac_unrecognized_sep=', ';; esac eval with_$ac_useropt=\$ac_optarg ;; -without-* | --without-*) ac_useropt=`expr "x$ac_option" : 'x-*without-\(.*\)'` # Reject names that are not valid shell variable names. expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null && as_fn_error $? "invalid package name: \`$ac_useropt'" ac_useropt_orig=$ac_useropt ac_useropt=`printf "%s\n" "$ac_useropt" | sed 's/[-+.]/_/g'` case $ac_user_opts in *" "with_$ac_useropt" "*) ;; *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--without-$ac_useropt_orig" ac_unrecognized_sep=', ';; esac eval with_$ac_useropt=no ;; --x) # Obsolete; use --with-x. with_x=yes ;; -x-includes | --x-includes | --x-include | --x-includ | --x-inclu \ | --x-incl | --x-inc | --x-in | --x-i) ac_prev=x_includes ;; -x-includes=* | --x-includes=* | --x-include=* | --x-includ=* | --x-inclu=* \ | --x-incl=* | --x-inc=* | --x-in=* | --x-i=*) x_includes=$ac_optarg ;; -x-libraries | --x-libraries | --x-librarie | --x-librari \ | --x-librar | --x-libra | --x-libr | --x-lib | --x-li | --x-l) ac_prev=x_libraries ;; -x-libraries=* | --x-libraries=* | --x-librarie=* | --x-librari=* \ | --x-librar=* | --x-libra=* | --x-libr=* | --x-lib=* | --x-li=* | --x-l=*) x_libraries=$ac_optarg ;; -*) as_fn_error $? "unrecognized option: \`$ac_option' Try \`$0 --help' for more information" ;; *=*) ac_envvar=`expr "x$ac_option" : 'x\([^=]*\)='` # Reject names that are not valid shell variable names. case $ac_envvar in #( '' | [0-9]* | *[!_$as_cr_alnum]* ) as_fn_error $? "invalid variable name: \`$ac_envvar'" ;; esac eval $ac_envvar=\$ac_optarg export $ac_envvar ;; *) # FIXME: should be removed in autoconf 3.0. printf "%s\n" "$as_me: WARNING: you should use --build, --host, --target" >&2 expr "x$ac_option" : ".*[^-._$as_cr_alnum]" >/dev/null && printf "%s\n" "$as_me: WARNING: invalid host type: $ac_option" >&2 : "${build_alias=$ac_option} ${host_alias=$ac_option} ${target_alias=$ac_option}" ;; esac done if test -n "$ac_prev"; then ac_option=--`echo $ac_prev | sed 's/_/-/g'` as_fn_error $? "missing argument to $ac_option" fi if test -n "$ac_unrecognized_opts"; then case $enable_option_checking in no) ;; fatal) as_fn_error $? "unrecognized options: $ac_unrecognized_opts" ;; *) printf "%s\n" "$as_me: WARNING: unrecognized options: $ac_unrecognized_opts" >&2 ;; esac fi # Check all directory arguments for consistency. for ac_var in exec_prefix prefix bindir sbindir libexecdir datarootdir \ datadir sysconfdir sharedstatedir localstatedir includedir \ oldincludedir docdir infodir htmldir dvidir pdfdir psdir \ libdir localedir mandir runstatedir do eval ac_val=\$$ac_var # Remove trailing slashes. case $ac_val in */ ) ac_val=`expr "X$ac_val" : 'X\(.*[^/]\)' \| "X$ac_val" : 'X\(.*\)'` eval $ac_var=\$ac_val;; esac # Be sure to have absolute directory names. case $ac_val in [\\/$]* | ?:[\\/]* ) continue;; NONE | '' ) case $ac_var in *prefix ) continue;; esac;; esac as_fn_error $? "expected an absolute directory name for --$ac_var: $ac_val" done # There might be people who depend on the old broken behavior: `$host' # used to hold the argument of --host etc. # FIXME: To remove some day. build=$build_alias host=$host_alias target=$target_alias # FIXME: To remove some day. if test "x$host_alias" != x; then if test "x$build_alias" = x; then cross_compiling=maybe elif test "x$build_alias" != "x$host_alias"; then cross_compiling=yes fi fi ac_tool_prefix= test -n "$host_alias" && ac_tool_prefix=$host_alias- test "$silent" = yes && exec 6>/dev/null ac_pwd=`pwd` && test -n "$ac_pwd" && ac_ls_di=`ls -di .` && ac_pwd_ls_di=`cd "$ac_pwd" && ls -di .` || as_fn_error $? "working directory cannot be determined" test "X$ac_ls_di" = "X$ac_pwd_ls_di" || as_fn_error $? "pwd does not report name of working directory" # Find the source files, if location was not specified. if test -z "$srcdir"; then ac_srcdir_defaulted=yes # Try the directory containing this script, then the parent directory. ac_confdir=`$as_dirname -- "$as_myself" || $as_expr X"$as_myself" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ X"$as_myself" : 'X\(//\)[^/]' \| \ X"$as_myself" : 'X\(//\)$' \| \ X"$as_myself" : 'X\(/\)' \| . 2>/dev/null || printf "%s\n" X"$as_myself" | sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/ q } /^X\(\/\/\)[^/].*/{ s//\1/ q } /^X\(\/\/\)$/{ s//\1/ q } /^X\(\/\).*/{ s//\1/ q } s/.*/./; q'` srcdir=$ac_confdir if test ! -r "$srcdir/$ac_unique_file"; then srcdir=.. fi else ac_srcdir_defaulted=no fi if test ! -r "$srcdir/$ac_unique_file"; then test "$ac_srcdir_defaulted" = yes && srcdir="$ac_confdir or .." as_fn_error $? "cannot find sources ($ac_unique_file) in $srcdir" fi ac_msg="sources are in $srcdir, but \`cd $srcdir' does not work" ac_abs_confdir=`( cd "$srcdir" && test -r "./$ac_unique_file" || as_fn_error $? "$ac_msg" pwd)` # When building in place, set srcdir=. if test "$ac_abs_confdir" = "$ac_pwd"; then srcdir=. fi # Remove unnecessary trailing slashes from srcdir. # Double slashes in file names in object file debugging info # mess up M-x gdb in Emacs. case $srcdir in */) srcdir=`expr "X$srcdir" : 'X\(.*[^/]\)' \| "X$srcdir" : 'X\(.*\)'`;; esac for ac_var in $ac_precious_vars; do eval ac_env_${ac_var}_set=\${${ac_var}+set} eval ac_env_${ac_var}_value=\$${ac_var} eval ac_cv_env_${ac_var}_set=\${${ac_var}+set} eval ac_cv_env_${ac_var}_value=\$${ac_var} done # # Report the --help message. # if test "$ac_init_help" = "long"; then # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF \`configure' configures freeradius $Id: f7ffabd4b1bb160bebf78c82d28f9e016645e4c9 $ to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... To assign environment variables (e.g., CC, CFLAGS...), specify them as VAR=VALUE. See below for descriptions of some of the useful variables. Defaults for the options are specified in brackets. Configuration: -h, --help display this help and exit --help=short display options specific to this package --help=recursive display the short help of all the included packages -V, --version display version information and exit -q, --quiet, --silent do not print \`checking ...' messages --cache-file=FILE cache test results in FILE [disabled] -C, --config-cache alias for \`--cache-file=config.cache' -n, --no-create do not create output files --srcdir=DIR find the sources in DIR [configure dir or \`..'] Installation directories: --prefix=PREFIX install architecture-independent files in PREFIX [$ac_default_prefix] --exec-prefix=EPREFIX install architecture-dependent files in EPREFIX [PREFIX] By default, \`make install' will install all the files in \`$ac_default_prefix/bin', \`$ac_default_prefix/lib' etc. You can specify an installation prefix other than \`$ac_default_prefix' using \`--prefix', for instance \`--prefix=\$HOME'. For better control, use the options below. Fine tuning of the installation directories: --bindir=DIR user executables [EPREFIX/bin] --sbindir=DIR system admin executables [EPREFIX/sbin] --libexecdir=DIR program executables [EPREFIX/libexec] --sysconfdir=DIR read-only single-machine data [PREFIX/etc] --sharedstatedir=DIR modifiable architecture-independent data [PREFIX/com] --localstatedir=DIR modifiable single-machine data [PREFIX/var] --runstatedir=DIR modifiable per-process data [LOCALSTATEDIR/run] --libdir=DIR object code libraries [EPREFIX/lib] --includedir=DIR C header files [PREFIX/include] --oldincludedir=DIR C header files for non-gcc [/usr/include] --datarootdir=DIR read-only arch.-independent data root [PREFIX/share] --datadir=DIR read-only architecture-independent data [DATAROOTDIR] --infodir=DIR info documentation [DATAROOTDIR/info] --localedir=DIR locale-dependent data [DATAROOTDIR/locale] --mandir=DIR man documentation [DATAROOTDIR/man] --docdir=DIR documentation root [DATAROOTDIR/doc/freeradius] --htmldir=DIR html documentation [DOCDIR] --dvidir=DIR dvi documentation [DOCDIR] --pdfdir=DIR pdf documentation [DOCDIR] --psdir=DIR ps documentation [DOCDIR] _ACEOF cat <<\_ACEOF System types: --build=BUILD configure for building on BUILD [guessed] --host=HOST cross-compile to build programs to run on HOST [BUILD] --target=TARGET configure for building compilers for TARGET [HOST] _ACEOF fi if test -n "$ac_init_help"; then case $ac_init_help in short | recursive ) echo "Configuration of freeradius $Id: f7ffabd4b1bb160bebf78c82d28f9e016645e4c9 $:";; esac cat <<\_ACEOF Optional Features: --disable-option-checking ignore unrecognized --enable/--with options --disable-FEATURE do not include FEATURE (same as --enable-FEATURE=no) --enable-FEATURE[=ARG] include FEATURE [ARG=yes] --enable-developer enables features of interest to developers. --disable-verify-ptr disables WITH_VERIFY_PTR developer build option. --enable-fips-workaround enables local MD4, MD5, etc. functionality to avoid OpenSSL FIPS issues. --disable-largefile omit support for large files --enable-strict-dependencies fail configure on lack of module dependancy. --enable-werror causes the build to fail if any warnings are generated. --disable-openssl-version-check disable vulnerable OpenSSL version check --enable-reproducible-builds ensure the build does not change each time --enable-fuzzer build with support for a fuzzer --enable-address-sanitizer build with support for address sanitizer. --enable-leak-sanitizer build with support for leak sanitizer. --enable-thread-sanitizer build with support for thread sanitizer. --enable-undefined-behaviour-sanitizer build with support for undefined behaviour sanitizer. Optional Packages: --with-PACKAGE[=ARG] use PACKAGE [ARG=yes] --without-PACKAGE do not use PACKAGE (same as --with-PACKAGE=no) --with-docdir=DIR directory for documentation DATADIR/doc/freeradius --with-logdir=DIR directory for logfiles LOCALSTATEDIR/log/radius --with-radacctdir=DIR directory for detail files LOGDIR/radacct --with-raddbdir=DIR directory for config files SYSCONFDIR/raddb --with-dictdir=DIR directory for dictionary files DATAROOTDIR/freeradius --with-ascend-binary include support for Ascend binary filter attributes (default=yes) --with-radiusv11 compile in RADIUSv11 support. (default=no) --with-threads use threads, if available. (default=yes) --with-tcp compile in TCP support. (default=yes) --with-vmps compile in VMPS support. (default=yes) --with-dhcp compile in DHCP support. (default=yes) --with-radlast install radlast --with-static-modules=QUOTED-MODULE-LIST --with-shared-libs build dynamic libraries and link against them. (default=yes) --with-modules=QUOTED-MODULE-LIST --with-experimental-modules use experimental and unstable modules. (default=no, unless --enable-developer=yes) --with-udpfromto compile in UDPFROMTO support. (default=yes) --with-rlm-FOO-lib-dir=DIR directory in which to look for library files used by module FOO --with-rlm-FOO-include-dir=DIR directory in which to look for include files used by module FOO --with-openssl use OpenSSL. (default=yes) --with-openssl-lib-dir=DIR directory to look for OpenSSL library files --with-openssl-include-dir=DIR directory to look for OpenSSL include files --with-talloc-lib-dir=DIR directory in which to look for talloc library files --with-talloc-include-dir=DIR directory in which to look for talloc include files --with-pcap-lib-dir=DIR directory in which to look for pcap library files --with-pcap-include-dir=DIR directory in which to look for pcap include files --with-collectdclient-lib-dir=DIR directory in which to look for collectdclient library files --with-collectdclient-include-dir=DIR directory in which to look for collectdclient include files --with-cap-lib-dir=DIR directory in which to look for cap library files --with-cap-include-dir=DIR directory in which to look for cap include files --with-systemd add systemd support, if available (default=no) --with-systemd-lib-dir=DIR directory to look for systemd library files --with-systemd-include-dir=DIR directory to look for systemd include files --with-execinfo-lib-dir=DIR directory in which to look for execinfo library files --with-execinfo-include-dir=DIR directory in which to look for execinfo include files --with-pcre use libpcre (if available). (default=yes) --with-pcre-lib-dir=DIR directory in which to look for pcre library files --with-pcre-include-dir=DIR directory in which to look for pcre include files --with-regex Whether to build with regular expressions (default=yes) Some influential environment variables: CC C compiler command CFLAGS C compiler flags LDFLAGS linker flags, e.g. -L if you have libraries in a nonstandard directory LIBS libraries to pass to the linker, e.g. -l CPPFLAGS (Objective) C/C++ preprocessor flags, e.g. -I if you have headers in a nonstandard directory CXX C++ compiler command CXXFLAGS C++ compiler flags CPP C preprocessor Use these variables to override the choices made by `configure' or to help it to find libraries and programs with nonstandard names/locations. Report bugs to . freeradius home page: . _ACEOF ac_status=$? fi if test "$ac_init_help" = "recursive"; then # If there are subdirs, report their specific --help. for ac_dir in : $ac_subdirs_all; do test "x$ac_dir" = x: && continue test -d "$ac_dir" || { cd "$srcdir" && ac_pwd=`pwd` && srcdir=. && test -d "$ac_dir"; } || continue ac_builddir=. case "$ac_dir" in .) ac_dir_suffix= ac_top_builddir_sub=. ac_top_build_prefix= ;; *) ac_dir_suffix=/`printf "%s\n" "$ac_dir" | sed 's|^\.[\\/]||'` # A ".." for each directory in $ac_dir_suffix. ac_top_builddir_sub=`printf "%s\n" "$ac_dir_suffix" | sed 's|/[^\\/]*|/..|g;s|/||'` case $ac_top_builddir_sub in "") ac_top_builddir_sub=. ac_top_build_prefix= ;; *) ac_top_build_prefix=$ac_top_builddir_sub/ ;; esac ;; esac ac_abs_top_builddir=$ac_pwd ac_abs_builddir=$ac_pwd$ac_dir_suffix # for backward compatibility: ac_top_builddir=$ac_top_build_prefix case $srcdir in .) # We are building in place. ac_srcdir=. ac_top_srcdir=$ac_top_builddir_sub ac_abs_top_srcdir=$ac_pwd ;; [\\/]* | ?:[\\/]* ) # Absolute name. ac_srcdir=$srcdir$ac_dir_suffix; ac_top_srcdir=$srcdir ac_abs_top_srcdir=$srcdir ;; *) # Relative name. ac_srcdir=$ac_top_build_prefix$srcdir$ac_dir_suffix ac_top_srcdir=$ac_top_build_prefix$srcdir ac_abs_top_srcdir=$ac_pwd/$srcdir ;; esac ac_abs_srcdir=$ac_abs_top_srcdir$ac_dir_suffix cd "$ac_dir" || { ac_status=$?; continue; } # Check for configure.gnu first; this name is used for a wrapper for # Metaconfig's "Configure" on case-insensitive file systems. if test -f "$ac_srcdir/configure.gnu"; then echo && $SHELL "$ac_srcdir/configure.gnu" --help=recursive elif test -f "$ac_srcdir/configure"; then echo && $SHELL "$ac_srcdir/configure" --help=recursive else printf "%s\n" "$as_me: WARNING: no configuration information is in $ac_dir" >&2 fi || ac_status=$? cd "$ac_pwd" || { ac_status=$?; break; } done fi test -n "$ac_init_help" && exit $ac_status if $ac_init_version; then cat <<\_ACEOF freeradius configure $Id: f7ffabd4b1bb160bebf78c82d28f9e016645e4c9 $ generated by GNU Autoconf 2.71 Copyright (C) 2021 Free Software Foundation, Inc. This configure script is free software; the Free Software Foundation gives unlimited permission to copy, distribute and modify it. _ACEOF exit fi ## ------------------------ ## ## Autoconf initialization. ## ## ------------------------ ## # ac_fn_c_try_compile LINENO # -------------------------- # Try to compile conftest.$ac_ext, and return whether this succeeded. ac_fn_c_try_compile () { as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack rm -f conftest.$ac_objext conftest.beam if { { ac_try="$ac_compile" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" printf "%s\n" "$ac_try_echo"; } >&5 (eval "$ac_compile") 2>conftest.err ac_status=$? if test -s conftest.err; then grep -v '^ *+' conftest.err >conftest.er1 cat conftest.er1 >&5 mv -f conftest.er1 conftest.err fi printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } && { test -z "$ac_c_werror_flag" || test ! -s conftest.err } && test -s conftest.$ac_objext then : ac_retval=0 else $as_nop printf "%s\n" "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 ac_retval=1 fi eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno as_fn_set_status $ac_retval } # ac_fn_c_try_compile # ac_fn_cxx_try_compile LINENO # ---------------------------- # Try to compile conftest.$ac_ext, and return whether this succeeded. ac_fn_cxx_try_compile () { as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack rm -f conftest.$ac_objext conftest.beam if { { ac_try="$ac_compile" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" printf "%s\n" "$ac_try_echo"; } >&5 (eval "$ac_compile") 2>conftest.err ac_status=$? if test -s conftest.err; then grep -v '^ *+' conftest.err >conftest.er1 cat conftest.er1 >&5 mv -f conftest.er1 conftest.err fi printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } && { test -z "$ac_cxx_werror_flag" || test ! -s conftest.err } && test -s conftest.$ac_objext then : ac_retval=0 else $as_nop printf "%s\n" "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 ac_retval=1 fi eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno as_fn_set_status $ac_retval } # ac_fn_cxx_try_compile # ac_fn_c_check_header_compile LINENO HEADER VAR INCLUDES # ------------------------------------------------------- # Tests whether HEADER exists and can be compiled using the include files in # INCLUDES, setting the cache variable VAR accordingly. ac_fn_c_check_header_compile () { as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $2" >&5 printf %s "checking for $2... " >&6; } if eval test \${$3+y} then : printf %s "(cached) " >&6 else $as_nop cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ $4 #include <$2> _ACEOF if ac_fn_c_try_compile "$LINENO" then : eval "$3=yes" else $as_nop eval "$3=no" fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext fi eval ac_res=\$$3 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5 printf "%s\n" "$ac_res" >&6; } eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno } # ac_fn_c_check_header_compile # ac_fn_c_try_cpp LINENO # ---------------------- # Try to preprocess conftest.$ac_ext, and return whether this succeeded. ac_fn_c_try_cpp () { as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack if { { ac_try="$ac_cpp conftest.$ac_ext" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" printf "%s\n" "$ac_try_echo"; } >&5 (eval "$ac_cpp conftest.$ac_ext") 2>conftest.err ac_status=$? if test -s conftest.err; then grep -v '^ *+' conftest.err >conftest.er1 cat conftest.er1 >&5 mv -f conftest.er1 conftest.err fi printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } > conftest.i && { test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" || test ! -s conftest.err } then : ac_retval=0 else $as_nop printf "%s\n" "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 ac_retval=1 fi eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno as_fn_set_status $ac_retval } # ac_fn_c_try_cpp # ac_fn_c_try_run LINENO # ---------------------- # Try to run conftest.$ac_ext, and return whether this succeeded. Assumes that # executables *can* be run. ac_fn_c_try_run () { as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack if { { ac_try="$ac_link" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" printf "%s\n" "$ac_try_echo"; } >&5 (eval "$ac_link") 2>&5 ac_status=$? printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } && { ac_try='./conftest$ac_exeext' { { case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" printf "%s\n" "$ac_try_echo"; } >&5 (eval "$ac_try") 2>&5 ac_status=$? printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; } then : ac_retval=0 else $as_nop printf "%s\n" "$as_me: program exited with status $ac_status" >&5 printf "%s\n" "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 ac_retval=$ac_status fi rm -rf conftest.dSYM conftest_ipa8_conftest.oo eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno as_fn_set_status $ac_retval } # ac_fn_c_try_run # ac_fn_c_try_link LINENO # ----------------------- # Try to link conftest.$ac_ext, and return whether this succeeded. ac_fn_c_try_link () { as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack rm -f conftest.$ac_objext conftest.beam conftest$ac_exeext if { { ac_try="$ac_link" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" printf "%s\n" "$ac_try_echo"; } >&5 (eval "$ac_link") 2>conftest.err ac_status=$? if test -s conftest.err; then grep -v '^ *+' conftest.err >conftest.er1 cat conftest.er1 >&5 mv -f conftest.er1 conftest.err fi printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } && { test -z "$ac_c_werror_flag" || test ! -s conftest.err } && test -s conftest$ac_exeext && { test "$cross_compiling" = yes || test -x conftest$ac_exeext } then : ac_retval=0 else $as_nop printf "%s\n" "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 ac_retval=1 fi # Delete the IPA/IPO (Inter Procedural Analysis/Optimization) information # created by the PGI compiler (conftest_ipa8_conftest.oo), as it would # interfere with the next link command; also delete a directory that is # left behind by Apple's compiler. We do this before executing the actions. rm -rf conftest.dSYM conftest_ipa8_conftest.oo eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno as_fn_set_status $ac_retval } # ac_fn_c_try_link # ac_fn_c_check_func LINENO FUNC VAR # ---------------------------------- # Tests whether FUNC exists, setting the cache variable VAR accordingly ac_fn_c_check_func () { as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $2" >&5 printf %s "checking for $2... " >&6; } if eval test \${$3+y} then : printf %s "(cached) " >&6 else $as_nop cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Define $2 to an innocuous variant, in case declares $2. For example, HP-UX 11i declares gettimeofday. */ #define $2 innocuous_$2 /* System header to define __stub macros and hopefully few prototypes, which can conflict with char $2 (); below. */ #include #undef $2 /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char $2 (); /* The GNU C library defines this for functions which it implements to always fail with ENOSYS. Some functions are actually named something starting with __ and the normal name is an alias. */ #if defined __stub_$2 || defined __stub___$2 choke me #endif int main (void) { return $2 (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : eval "$3=yes" else $as_nop eval "$3=no" fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext fi eval ac_res=\$$3 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5 printf "%s\n" "$ac_res" >&6; } eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno } # ac_fn_c_check_func # ac_fn_c_check_type LINENO TYPE VAR INCLUDES # ------------------------------------------- # Tests whether TYPE exists after having included INCLUDES, setting cache # variable VAR accordingly. ac_fn_c_check_type () { as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $2" >&5 printf %s "checking for $2... " >&6; } if eval test \${$3+y} then : printf %s "(cached) " >&6 else $as_nop eval "$3=no" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ $4 int main (void) { if (sizeof ($2)) return 0; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ $4 int main (void) { if (sizeof (($2))) return 0; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : else $as_nop eval "$3=yes" fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext fi eval ac_res=\$$3 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5 printf "%s\n" "$ac_res" >&6; } eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno } # ac_fn_c_check_type # ac_fn_check_decl LINENO SYMBOL VAR INCLUDES EXTRA-OPTIONS FLAG-VAR # ------------------------------------------------------------------ # Tests whether SYMBOL is declared in INCLUDES, setting cache variable VAR # accordingly. Pass EXTRA-OPTIONS to the compiler, using FLAG-VAR. ac_fn_check_decl () { as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack as_decl_name=`echo $2|sed 's/ *(.*//'` { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether $as_decl_name is declared" >&5 printf %s "checking whether $as_decl_name is declared... " >&6; } if eval test \${$3+y} then : printf %s "(cached) " >&6 else $as_nop as_decl_use=`echo $2|sed -e 's/(/((/' -e 's/)/) 0&/' -e 's/,/) 0& (/g'` eval ac_save_FLAGS=\$$6 as_fn_append $6 " $5" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ $4 int main (void) { #ifndef $as_decl_name #ifdef __cplusplus (void) $as_decl_use; #else (void) $as_decl_name; #endif #endif ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : eval "$3=yes" else $as_nop eval "$3=no" fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext eval $6=\$ac_save_FLAGS fi eval ac_res=\$$3 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5 printf "%s\n" "$ac_res" >&6; } eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno } # ac_fn_check_decl ac_configure_args_raw= for ac_arg do case $ac_arg in *\'*) ac_arg=`printf "%s\n" "$ac_arg" | sed "s/'/'\\\\\\\\''/g"` ;; esac as_fn_append ac_configure_args_raw " '$ac_arg'" done case $ac_configure_args_raw in *$as_nl*) ac_safe_unquote= ;; *) ac_unsafe_z='|&;<>()$`\\"*?[ '' ' # This string ends in space, tab. ac_unsafe_a="$ac_unsafe_z#~" ac_safe_unquote="s/ '\\([^$ac_unsafe_a][^$ac_unsafe_z]*\\)'/ \\1/g" ac_configure_args_raw=` printf "%s\n" "$ac_configure_args_raw" | sed "$ac_safe_unquote"`;; esac cat >config.log <<_ACEOF This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. It was created by freeradius $as_me $Id: f7ffabd4b1bb160bebf78c82d28f9e016645e4c9 $, which was generated by GNU Autoconf 2.71. Invocation command line was $ $0$ac_configure_args_raw _ACEOF exec 5>>config.log { cat <<_ASUNAME ## --------- ## ## Platform. ## ## --------- ## hostname = `(hostname || uname -n) 2>/dev/null | sed 1q` uname -m = `(uname -m) 2>/dev/null || echo unknown` uname -r = `(uname -r) 2>/dev/null || echo unknown` uname -s = `(uname -s) 2>/dev/null || echo unknown` uname -v = `(uname -v) 2>/dev/null || echo unknown` /usr/bin/uname -p = `(/usr/bin/uname -p) 2>/dev/null || echo unknown` /bin/uname -X = `(/bin/uname -X) 2>/dev/null || echo unknown` /bin/arch = `(/bin/arch) 2>/dev/null || echo unknown` /usr/bin/arch -k = `(/usr/bin/arch -k) 2>/dev/null || echo unknown` /usr/convex/getsysinfo = `(/usr/convex/getsysinfo) 2>/dev/null || echo unknown` /usr/bin/hostinfo = `(/usr/bin/hostinfo) 2>/dev/null || echo unknown` /bin/machine = `(/bin/machine) 2>/dev/null || echo unknown` /usr/bin/oslevel = `(/usr/bin/oslevel) 2>/dev/null || echo unknown` /bin/universe = `(/bin/universe) 2>/dev/null || echo unknown` _ASUNAME as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS case $as_dir in #((( '') as_dir=./ ;; */) ;; *) as_dir=$as_dir/ ;; esac printf "%s\n" "PATH: $as_dir" done IFS=$as_save_IFS } >&5 cat >&5 <<_ACEOF ## ----------- ## ## Core tests. ## ## ----------- ## _ACEOF # Keep a trace of the command line. # Strip out --no-create and --no-recursion so they do not pile up. # Strip out --silent because we don't want to record it for future runs. # Also quote any args containing shell meta-characters. # Make two passes to allow for proper duplicate-argument suppression. ac_configure_args= ac_configure_args0= ac_configure_args1= ac_must_keep_next=false for ac_pass in 1 2 do for ac_arg do case $ac_arg in -no-create | --no-c* | -n | -no-recursion | --no-r*) continue ;; -q | -quiet | --quiet | --quie | --qui | --qu | --q \ | -silent | --silent | --silen | --sile | --sil) continue ;; *\'*) ac_arg=`printf "%s\n" "$ac_arg" | sed "s/'/'\\\\\\\\''/g"` ;; esac case $ac_pass in 1) as_fn_append ac_configure_args0 " '$ac_arg'" ;; 2) as_fn_append ac_configure_args1 " '$ac_arg'" if test $ac_must_keep_next = true; then ac_must_keep_next=false # Got value, back to normal. else case $ac_arg in *=* | --config-cache | -C | -disable-* | --disable-* \ | -enable-* | --enable-* | -gas | --g* | -nfp | --nf* \ | -q | -quiet | --q* | -silent | --sil* | -v | -verb* \ | -with-* | --with-* | -without-* | --without-* | --x) case "$ac_configure_args0 " in "$ac_configure_args1"*" '$ac_arg' "* ) continue ;; esac ;; -* ) ac_must_keep_next=true ;; esac fi as_fn_append ac_configure_args " '$ac_arg'" ;; esac done done { ac_configure_args0=; unset ac_configure_args0;} { ac_configure_args1=; unset ac_configure_args1;} # When interrupted or exit'd, cleanup temporary files, and complete # config.log. We remove comments because anyway the quotes in there # would cause problems or look ugly. # WARNING: Use '\'' to represent an apostrophe within the trap. # WARNING: Do not start the trap code with a newline, due to a FreeBSD 4.0 bug. trap 'exit_status=$? # Sanitize IFS. IFS=" "" $as_nl" # Save into config.log some information that might help in debugging. { echo printf "%s\n" "## ---------------- ## ## Cache variables. ## ## ---------------- ##" echo # The following way of writing the cache mishandles newlines in values, ( for ac_var in `(set) 2>&1 | sed -n '\''s/^\([a-zA-Z_][a-zA-Z0-9_]*\)=.*/\1/p'\''`; do eval ac_val=\$$ac_var case $ac_val in #( *${as_nl}*) case $ac_var in #( *_cv_*) { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: cache variable $ac_var contains a newline" >&5 printf "%s\n" "$as_me: WARNING: cache variable $ac_var contains a newline" >&2;} ;; esac case $ac_var in #( _ | IFS | as_nl) ;; #( BASH_ARGV | BASH_SOURCE) eval $ac_var= ;; #( *) { eval $ac_var=; unset $ac_var;} ;; esac ;; esac done (set) 2>&1 | case $as_nl`(ac_space='\'' '\''; set) 2>&1` in #( *${as_nl}ac_space=\ *) sed -n \ "s/'\''/'\''\\\\'\'''\''/g; s/^\\([_$as_cr_alnum]*_cv_[_$as_cr_alnum]*\\)=\\(.*\\)/\\1='\''\\2'\''/p" ;; #( *) sed -n "/^[_$as_cr_alnum]*_cv_[_$as_cr_alnum]*=/p" ;; esac | sort ) echo printf "%s\n" "## ----------------- ## ## Output variables. ## ## ----------------- ##" echo for ac_var in $ac_subst_vars do eval ac_val=\$$ac_var case $ac_val in *\'\''*) ac_val=`printf "%s\n" "$ac_val" | sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;; esac printf "%s\n" "$ac_var='\''$ac_val'\''" done | sort echo if test -n "$ac_subst_files"; then printf "%s\n" "## ------------------- ## ## File substitutions. ## ## ------------------- ##" echo for ac_var in $ac_subst_files do eval ac_val=\$$ac_var case $ac_val in *\'\''*) ac_val=`printf "%s\n" "$ac_val" | sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;; esac printf "%s\n" "$ac_var='\''$ac_val'\''" done | sort echo fi if test -s confdefs.h; then printf "%s\n" "## ----------- ## ## confdefs.h. ## ## ----------- ##" echo cat confdefs.h echo fi test "$ac_signal" != 0 && printf "%s\n" "$as_me: caught signal $ac_signal" printf "%s\n" "$as_me: exit $exit_status" } >&5 rm -f core *.core core.conftest.* && rm -f -r conftest* confdefs* conf$$* $ac_clean_files && exit $exit_status ' 0 for ac_signal in 1 2 13 15; do trap 'ac_signal='$ac_signal'; as_fn_exit 1' $ac_signal done ac_signal=0 # confdefs.h avoids OS command line length limits that DEFS can exceed. rm -f -r conftest* confdefs.h printf "%s\n" "/* confdefs.h */" > confdefs.h # Predefined preprocessor variables. printf "%s\n" "#define PACKAGE_NAME \"$PACKAGE_NAME\"" >>confdefs.h printf "%s\n" "#define PACKAGE_TARNAME \"$PACKAGE_TARNAME\"" >>confdefs.h printf "%s\n" "#define PACKAGE_VERSION \"$PACKAGE_VERSION\"" >>confdefs.h printf "%s\n" "#define PACKAGE_STRING \"$PACKAGE_STRING\"" >>confdefs.h printf "%s\n" "#define PACKAGE_BUGREPORT \"$PACKAGE_BUGREPORT\"" >>confdefs.h printf "%s\n" "#define PACKAGE_URL \"$PACKAGE_URL\"" >>confdefs.h # Let the site file select an alternate cache file if it wants to. # Prefer an explicitly selected file to automatically selected ones. if test -n "$CONFIG_SITE"; then ac_site_files="$CONFIG_SITE" elif test "x$prefix" != xNONE; then ac_site_files="$prefix/share/config.site $prefix/etc/config.site" else ac_site_files="$ac_default_prefix/share/config.site $ac_default_prefix/etc/config.site" fi for ac_site_file in $ac_site_files do case $ac_site_file in #( */*) : ;; #( *) : ac_site_file=./$ac_site_file ;; esac if test -f "$ac_site_file" && test -r "$ac_site_file"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: loading site script $ac_site_file" >&5 printf "%s\n" "$as_me: loading site script $ac_site_file" >&6;} sed 's/^/| /' "$ac_site_file" >&5 . "$ac_site_file" \ || { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "failed to load site script $ac_site_file See \`config.log' for more details" "$LINENO" 5; } fi done if test -r "$cache_file"; then # Some versions of bash will fail to source /dev/null (special files # actually), so we avoid doing that. DJGPP emulates it as a regular file. if test /dev/null != "$cache_file" && test -f "$cache_file"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: loading cache $cache_file" >&5 printf "%s\n" "$as_me: loading cache $cache_file" >&6;} case $cache_file in [\\/]* | ?:[\\/]* ) . "$cache_file";; *) . "./$cache_file";; esac fi else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: creating cache $cache_file" >&5 printf "%s\n" "$as_me: creating cache $cache_file" >&6;} >$cache_file fi # Test code for whether the C compiler supports C89 (global declarations) ac_c_conftest_c89_globals=' /* Does the compiler advertise C89 conformance? Do not test the value of __STDC__, because some compilers set it to 0 while being otherwise adequately conformant. */ #if !defined __STDC__ # error "Compiler does not advertise C89 conformance" #endif #include #include struct stat; /* Most of the following tests are stolen from RCS 5.7 src/conf.sh. */ struct buf { int x; }; struct buf * (*rcsopen) (struct buf *, struct stat *, int); static char *e (p, i) char **p; int i; { return p[i]; } static char *f (char * (*g) (char **, int), char **p, ...) { char *s; va_list v; va_start (v,p); s = g (p, va_arg (v,int)); va_end (v); return s; } /* OSF 4.0 Compaq cc is some sort of almost-ANSI by default. It has function prototypes and stuff, but not \xHH hex character constants. These do not provoke an error unfortunately, instead are silently treated as an "x". The following induces an error, until -std is added to get proper ANSI mode. Curiously \x00 != x always comes out true, for an array size at least. It is necessary to write \x00 == 0 to get something that is true only with -std. */ int osf4_cc_array ['\''\x00'\'' == 0 ? 1 : -1]; /* IBM C 6 for AIX is almost-ANSI by default, but it replaces macro parameters inside strings and character constants. */ #define FOO(x) '\''x'\'' int xlc6_cc_array[FOO(a) == '\''x'\'' ? 1 : -1]; int test (int i, double x); struct s1 {int (*f) (int a);}; struct s2 {int (*f) (double a);}; int pairnames (int, char **, int *(*)(struct buf *, struct stat *, int), int, int);' # Test code for whether the C compiler supports C89 (body of main). ac_c_conftest_c89_main=' ok |= (argc == 0 || f (e, argv, 0) != argv[0] || f (e, argv, 1) != argv[1]); ' # Test code for whether the C compiler supports C99 (global declarations) ac_c_conftest_c99_globals=' // Does the compiler advertise C99 conformance? #if !defined __STDC_VERSION__ || __STDC_VERSION__ < 199901L # error "Compiler does not advertise C99 conformance" #endif #include extern int puts (const char *); extern int printf (const char *, ...); extern int dprintf (int, const char *, ...); extern void *malloc (size_t); // Check varargs macros. These examples are taken from C99 6.10.3.5. // dprintf is used instead of fprintf to avoid needing to declare // FILE and stderr. #define debug(...) dprintf (2, __VA_ARGS__) #define showlist(...) puts (#__VA_ARGS__) #define report(test,...) ((test) ? puts (#test) : printf (__VA_ARGS__)) static void test_varargs_macros (void) { int x = 1234; int y = 5678; debug ("Flag"); debug ("X = %d\n", x); showlist (The first, second, and third items.); report (x>y, "x is %d but y is %d", x, y); } // Check long long types. #define BIG64 18446744073709551615ull #define BIG32 4294967295ul #define BIG_OK (BIG64 / BIG32 == 4294967297ull && BIG64 % BIG32 == 0) #if !BIG_OK #error "your preprocessor is broken" #endif #if BIG_OK #else #error "your preprocessor is broken" #endif static long long int bignum = -9223372036854775807LL; static unsigned long long int ubignum = BIG64; struct incomplete_array { int datasize; double data[]; }; struct named_init { int number; const wchar_t *name; double average; }; typedef const char *ccp; static inline int test_restrict (ccp restrict text) { // See if C++-style comments work. // Iterate through items via the restricted pointer. // Also check for declarations in for loops. for (unsigned int i = 0; *(text+i) != '\''\0'\''; ++i) continue; return 0; } // Check varargs and va_copy. static bool test_varargs (const char *format, ...) { va_list args; va_start (args, format); va_list args_copy; va_copy (args_copy, args); const char *str = ""; int number = 0; float fnumber = 0; while (*format) { switch (*format++) { case '\''s'\'': // string str = va_arg (args_copy, const char *); break; case '\''d'\'': // int number = va_arg (args_copy, int); break; case '\''f'\'': // float fnumber = va_arg (args_copy, double); break; default: break; } } va_end (args_copy); va_end (args); return *str && number && fnumber; } ' # Test code for whether the C compiler supports C99 (body of main). ac_c_conftest_c99_main=' // Check bool. _Bool success = false; success |= (argc != 0); // Check restrict. if (test_restrict ("String literal") == 0) success = true; char *restrict newvar = "Another string"; // Check varargs. success &= test_varargs ("s, d'\'' f .", "string", 65, 34.234); test_varargs_macros (); // Check flexible array members. struct incomplete_array *ia = malloc (sizeof (struct incomplete_array) + (sizeof (double) * 10)); ia->datasize = 10; for (int i = 0; i < ia->datasize; ++i) ia->data[i] = i * 1.234; // Check named initializers. struct named_init ni = { .number = 34, .name = L"Test wide string", .average = 543.34343, }; ni.number = 58; int dynamic_array[ni.number]; dynamic_array[0] = argv[0][0]; dynamic_array[ni.number - 1] = 543; // work around unused variable warnings ok |= (!success || bignum == 0LL || ubignum == 0uLL || newvar[0] == '\''x'\'' || dynamic_array[ni.number - 1] != 543); ' # Test code for whether the C compiler supports C11 (global declarations) ac_c_conftest_c11_globals=' // Does the compiler advertise C11 conformance? #if !defined __STDC_VERSION__ || __STDC_VERSION__ < 201112L # error "Compiler does not advertise C11 conformance" #endif // Check _Alignas. char _Alignas (double) aligned_as_double; char _Alignas (0) no_special_alignment; extern char aligned_as_int; char _Alignas (0) _Alignas (int) aligned_as_int; // Check _Alignof. enum { int_alignment = _Alignof (int), int_array_alignment = _Alignof (int[100]), char_alignment = _Alignof (char) }; _Static_assert (0 < -_Alignof (int), "_Alignof is signed"); // Check _Noreturn. int _Noreturn does_not_return (void) { for (;;) continue; } // Check _Static_assert. struct test_static_assert { int x; _Static_assert (sizeof (int) <= sizeof (long int), "_Static_assert does not work in struct"); long int y; }; // Check UTF-8 literals. #define u8 syntax error! char const utf8_literal[] = u8"happens to be ASCII" "another string"; // Check duplicate typedefs. typedef long *long_ptr; typedef long int *long_ptr; typedef long_ptr long_ptr; // Anonymous structures and unions -- taken from C11 6.7.2.1 Example 1. struct anonymous { union { struct { int i; int j; }; struct { int k; long int l; } w; }; int m; } v1; ' # Test code for whether the C compiler supports C11 (body of main). ac_c_conftest_c11_main=' _Static_assert ((offsetof (struct anonymous, i) == offsetof (struct anonymous, w.k)), "Anonymous union alignment botch"); v1.i = 2; v1.w.k = 5; ok |= v1.i != 5; ' # Test code for whether the C compiler supports C11 (complete). ac_c_conftest_c11_program="${ac_c_conftest_c89_globals} ${ac_c_conftest_c99_globals} ${ac_c_conftest_c11_globals} int main (int argc, char **argv) { int ok = 0; ${ac_c_conftest_c89_main} ${ac_c_conftest_c99_main} ${ac_c_conftest_c11_main} return ok; } " # Test code for whether the C compiler supports C99 (complete). ac_c_conftest_c99_program="${ac_c_conftest_c89_globals} ${ac_c_conftest_c99_globals} int main (int argc, char **argv) { int ok = 0; ${ac_c_conftest_c89_main} ${ac_c_conftest_c99_main} return ok; } " # Test code for whether the C compiler supports C89 (complete). ac_c_conftest_c89_program="${ac_c_conftest_c89_globals} int main (int argc, char **argv) { int ok = 0; ${ac_c_conftest_c89_main} return ok; } " # Test code for whether the C++ compiler supports C++98 (global declarations) ac_cxx_conftest_cxx98_globals=' // Does the compiler advertise C++98 conformance? #if !defined __cplusplus || __cplusplus < 199711L # error "Compiler does not advertise C++98 conformance" #endif // These inclusions are to reject old compilers that // lack the unsuffixed header files. #include #include // and are *not* freestanding headers in C++98. extern void assert (int); namespace std { extern int strcmp (const char *, const char *); } // Namespaces, exceptions, and templates were all added after "C++ 2.0". using std::exception; using std::strcmp; namespace { void test_exception_syntax() { try { throw "test"; } catch (const char *s) { // Extra parentheses suppress a warning when building autoconf itself, // due to lint rules shared with more typical C programs. assert (!(strcmp) (s, "test")); } } template struct test_template { T const val; explicit test_template(T t) : val(t) {} template T add(U u) { return static_cast(u) + val; } }; } // anonymous namespace ' # Test code for whether the C++ compiler supports C++98 (body of main) ac_cxx_conftest_cxx98_main=' assert (argc); assert (! argv[0]); { test_exception_syntax (); test_template tt (2.0); assert (tt.add (4) == 6.0); assert (true && !false); } ' # Test code for whether the C++ compiler supports C++11 (global declarations) ac_cxx_conftest_cxx11_globals=' // Does the compiler advertise C++ 2011 conformance? #if !defined __cplusplus || __cplusplus < 201103L # error "Compiler does not advertise C++11 conformance" #endif namespace cxx11test { constexpr int get_val() { return 20; } struct testinit { int i; double d; }; class delegate { public: delegate(int n) : n(n) {} delegate(): delegate(2354) {} virtual int getval() { return this->n; }; protected: int n; }; class overridden : public delegate { public: overridden(int n): delegate(n) {} virtual int getval() override final { return this->n * 2; } }; class nocopy { public: nocopy(int i): i(i) {} nocopy() = default; nocopy(const nocopy&) = delete; nocopy & operator=(const nocopy&) = delete; private: int i; }; // for testing lambda expressions template Ret eval(Fn f, Ret v) { return f(v); } // for testing variadic templates and trailing return types template auto sum(V first) -> V { return first; } template auto sum(V first, Args... rest) -> V { return first + sum(rest...); } } ' # Test code for whether the C++ compiler supports C++11 (body of main) ac_cxx_conftest_cxx11_main=' { // Test auto and decltype auto a1 = 6538; auto a2 = 48573953.4; auto a3 = "String literal"; int total = 0; for (auto i = a3; *i; ++i) { total += *i; } decltype(a2) a4 = 34895.034; } { // Test constexpr short sa[cxx11test::get_val()] = { 0 }; } { // Test initializer lists cxx11test::testinit il = { 4323, 435234.23544 }; } { // Test range-based for int array[] = {9, 7, 13, 15, 4, 18, 12, 10, 5, 3, 14, 19, 17, 8, 6, 20, 16, 2, 11, 1}; for (auto &x : array) { x += 23; } } { // Test lambda expressions using cxx11test::eval; assert (eval ([](int x) { return x*2; }, 21) == 42); double d = 2.0; assert (eval ([&](double x) { return d += x; }, 3.0) == 5.0); assert (d == 5.0); assert (eval ([=](double x) mutable { return d += x; }, 4.0) == 9.0); assert (d == 5.0); } { // Test use of variadic templates using cxx11test::sum; auto a = sum(1); auto b = sum(1, 2); auto c = sum(1.0, 2.0, 3.0); } { // Test constructor delegation cxx11test::delegate d1; cxx11test::delegate d2(); cxx11test::delegate d3(45); } { // Test override and final cxx11test::overridden o1(55464); } { // Test nullptr char *c = nullptr; } { // Test template brackets test_template<::test_template> v(test_template(12)); } { // Unicode literals char const *utf8 = u8"UTF-8 string \u2500"; char16_t const *utf16 = u"UTF-8 string \u2500"; char32_t const *utf32 = U"UTF-32 string \u2500"; } ' # Test code for whether the C compiler supports C++11 (complete). ac_cxx_conftest_cxx11_program="${ac_cxx_conftest_cxx98_globals} ${ac_cxx_conftest_cxx11_globals} int main (int argc, char **argv) { int ok = 0; ${ac_cxx_conftest_cxx98_main} ${ac_cxx_conftest_cxx11_main} return ok; } " # Test code for whether the C compiler supports C++98 (complete). ac_cxx_conftest_cxx98_program="${ac_cxx_conftest_cxx98_globals} int main (int argc, char **argv) { int ok = 0; ${ac_cxx_conftest_cxx98_main} return ok; } " as_fn_append ac_header_c_list " stdio.h stdio_h HAVE_STDIO_H" as_fn_append ac_header_c_list " stdlib.h stdlib_h HAVE_STDLIB_H" as_fn_append ac_header_c_list " string.h string_h HAVE_STRING_H" as_fn_append ac_header_c_list " inttypes.h inttypes_h HAVE_INTTYPES_H" as_fn_append ac_header_c_list " stdint.h stdint_h HAVE_STDINT_H" as_fn_append ac_header_c_list " strings.h strings_h HAVE_STRINGS_H" as_fn_append ac_header_c_list " sys/stat.h sys_stat_h HAVE_SYS_STAT_H" as_fn_append ac_header_c_list " sys/types.h sys_types_h HAVE_SYS_TYPES_H" as_fn_append ac_header_c_list " unistd.h unistd_h HAVE_UNISTD_H" as_fn_append ac_header_c_list " wchar.h wchar_h HAVE_WCHAR_H" as_fn_append ac_header_c_list " minix/config.h minix_config_h HAVE_MINIX_CONFIG_H" as_fn_append ac_header_c_list " sys/time.h sys_time_h HAVE_SYS_TIME_H" # Auxiliary files required by this configure script. ac_aux_files="missing config.guess config.sub" # Locations in which to look for auxiliary files. ac_aux_dir_candidates="${srcdir}${PATH_SEPARATOR}${srcdir}/..${PATH_SEPARATOR}${srcdir}/../.." # Search for a directory containing all of the required auxiliary files, # $ac_aux_files, from the $PATH-style list $ac_aux_dir_candidates. # If we don't find one directory that contains all the files we need, # we report the set of missing files from the *first* directory in # $ac_aux_dir_candidates and give up. ac_missing_aux_files="" ac_first_candidate=: printf "%s\n" "$as_me:${as_lineno-$LINENO}: looking for aux files: $ac_aux_files" >&5 as_save_IFS=$IFS; IFS=$PATH_SEPARATOR as_found=false for as_dir in $ac_aux_dir_candidates do IFS=$as_save_IFS case $as_dir in #((( '') as_dir=./ ;; */) ;; *) as_dir=$as_dir/ ;; esac as_found=: printf "%s\n" "$as_me:${as_lineno-$LINENO}: trying $as_dir" >&5 ac_aux_dir_found=yes ac_install_sh= for ac_aux in $ac_aux_files do # As a special case, if "install-sh" is required, that requirement # can be satisfied by any of "install-sh", "install.sh", or "shtool", # and $ac_install_sh is set appropriately for whichever one is found. if test x"$ac_aux" = x"install-sh" then if test -f "${as_dir}install-sh"; then printf "%s\n" "$as_me:${as_lineno-$LINENO}: ${as_dir}install-sh found" >&5 ac_install_sh="${as_dir}install-sh -c" elif test -f "${as_dir}install.sh"; then printf "%s\n" "$as_me:${as_lineno-$LINENO}: ${as_dir}install.sh found" >&5 ac_install_sh="${as_dir}install.sh -c" elif test -f "${as_dir}shtool"; then printf "%s\n" "$as_me:${as_lineno-$LINENO}: ${as_dir}shtool found" >&5 ac_install_sh="${as_dir}shtool install -c" else ac_aux_dir_found=no if $ac_first_candidate; then ac_missing_aux_files="${ac_missing_aux_files} install-sh" else break fi fi else if test -f "${as_dir}${ac_aux}"; then printf "%s\n" "$as_me:${as_lineno-$LINENO}: ${as_dir}${ac_aux} found" >&5 else ac_aux_dir_found=no if $ac_first_candidate; then ac_missing_aux_files="${ac_missing_aux_files} ${ac_aux}" else break fi fi fi done if test "$ac_aux_dir_found" = yes; then ac_aux_dir="$as_dir" break fi ac_first_candidate=false as_found=false done IFS=$as_save_IFS if $as_found then : else $as_nop as_fn_error $? "cannot find required auxiliary files:$ac_missing_aux_files" "$LINENO" 5 fi # These three variables are undocumented and unsupported, # and are intended to be withdrawn in a future Autoconf release. # They can cause serious problems if a builder's source tree is in a directory # whose full name contains unusual characters. if test -f "${ac_aux_dir}config.guess"; then ac_config_guess="$SHELL ${ac_aux_dir}config.guess" fi if test -f "${ac_aux_dir}config.sub"; then ac_config_sub="$SHELL ${ac_aux_dir}config.sub" fi if test -f "$ac_aux_dir/configure"; then ac_configure="$SHELL ${ac_aux_dir}configure" fi # Check that the precious variables saved in the cache have kept the same # value. ac_cache_corrupted=false for ac_var in $ac_precious_vars; do eval ac_old_set=\$ac_cv_env_${ac_var}_set eval ac_new_set=\$ac_env_${ac_var}_set eval ac_old_val=\$ac_cv_env_${ac_var}_value eval ac_new_val=\$ac_env_${ac_var}_value case $ac_old_set,$ac_new_set in set,) { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&5 printf "%s\n" "$as_me: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&2;} ac_cache_corrupted=: ;; ,set) { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' was not set in the previous run" >&5 printf "%s\n" "$as_me: error: \`$ac_var' was not set in the previous run" >&2;} ac_cache_corrupted=: ;; ,);; *) if test "x$ac_old_val" != "x$ac_new_val"; then # differences in whitespace do not lead to failure. ac_old_val_w=`echo x $ac_old_val` ac_new_val_w=`echo x $ac_new_val` if test "$ac_old_val_w" != "$ac_new_val_w"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' has changed since the previous run:" >&5 printf "%s\n" "$as_me: error: \`$ac_var' has changed since the previous run:" >&2;} ac_cache_corrupted=: else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: warning: ignoring whitespace changes in \`$ac_var' since the previous run:" >&5 printf "%s\n" "$as_me: warning: ignoring whitespace changes in \`$ac_var' since the previous run:" >&2;} eval $ac_var=\$ac_old_val fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: former value: \`$ac_old_val'" >&5 printf "%s\n" "$as_me: former value: \`$ac_old_val'" >&2;} { printf "%s\n" "$as_me:${as_lineno-$LINENO}: current value: \`$ac_new_val'" >&5 printf "%s\n" "$as_me: current value: \`$ac_new_val'" >&2;} fi;; esac # Pass precious variables to config.status. if test "$ac_new_set" = set; then case $ac_new_val in *\'*) ac_arg=$ac_var=`printf "%s\n" "$ac_new_val" | sed "s/'/'\\\\\\\\''/g"` ;; *) ac_arg=$ac_var=$ac_new_val ;; esac case " $ac_configure_args " in *" '$ac_arg' "*) ;; # Avoid dups. Use of quotes ensures accuracy. *) as_fn_append ac_configure_args " '$ac_arg'" ;; esac fi done if $ac_cache_corrupted; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;} { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: changes in the environment can compromise the build" >&5 printf "%s\n" "$as_me: error: changes in the environment can compromise the build" >&2;} as_fn_error $? "run \`${MAKE-make} distclean' and/or \`rm $cache_file' and start over" "$LINENO" 5 fi ## -------------------- ## ## Main body of script. ## ## -------------------- ## ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu ac_config_headers="$ac_config_headers src/include/autoconf.h" RADIUSD_MAJOR_VERSION=`cat VERSION | cut -f1 -d.` RADIUSD_MINOR_VERSION=`cat VERSION | cut -f2 -d.` RADIUSD_INCRM_VERSION=`cat VERSION | cut -f3 -d. | sed 's/[\.-].*$//'` RADIUSD_VERSION=`printf "%02i%02i%02i" $RADIUSD_MAJOR_VERSION $RADIUSD_MINOR_VERSION $RADIUSD_INCRM_VERSION` RADIUSD_VERSION_STRING=`cat VERSION` printf "%s\n" "#define RADIUSD_VERSION ${RADIUSD_VERSION}" >>confdefs.h printf "%s\n" "#define RADIUSD_VERSION_STRING \"${RADIUSD_VERSION_STRING}\"" >>confdefs.h unset ASAN_OPTIONS unset LSAN_OPTIONS # Extract the first word of "asciidoctor", so it can be a program name with args. set dummy asciidoctor; ac_word=$2 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 printf %s "checking for $ac_word... " >&6; } if test ${ac_cv_path_ASCIIDOCTOR+y} then : printf %s "(cached) " >&6 else $as_nop case $ASCIIDOCTOR in [\\/]* | ?:[\\/]*) ac_cv_path_ASCIIDOCTOR="$ASCIIDOCTOR" # Let the user override the test with a path. ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS case $as_dir in #((( '') as_dir=./ ;; */) ;; *) as_dir=$as_dir/ ;; esac for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then ac_cv_path_ASCIIDOCTOR="$as_dir$ac_word$ac_exec_ext" printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS ;; esac fi ASCIIDOCTOR=$ac_cv_path_ASCIIDOCTOR if test -n "$ASCIIDOCTOR"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ASCIIDOCTOR" >&5 printf "%s\n" "$ASCIIDOCTOR" >&6; } else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi if test "x$ac_cv_path_ASCIIDOCTOR" = "x"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: asciidoctor not found - Please install if you want build the docs" >&5 printf "%s\n" "$as_me: WARNING: asciidoctor not found - Please install if you want build the docs" >&2;} fi # Extract the first word of "pandoc", so it can be a program name with args. set dummy pandoc; ac_word=$2 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 printf %s "checking for $ac_word... " >&6; } if test ${ac_cv_path_PANDOC+y} then : printf %s "(cached) " >&6 else $as_nop case $PANDOC in [\\/]* | ?:[\\/]*) ac_cv_path_PANDOC="$PANDOC" # Let the user override the test with a path. ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS case $as_dir in #((( '') as_dir=./ ;; */) ;; *) as_dir=$as_dir/ ;; esac for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then ac_cv_path_PANDOC="$as_dir$ac_word$ac_exec_ext" printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS ;; esac fi PANDOC=$ac_cv_path_PANDOC if test -n "$PANDOC"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $PANDOC" >&5 printf "%s\n" "$PANDOC" >&6; } else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi if test "x$ac_cv_path_PANDOC" = "x"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: pandoc not found - Please install if you want build the docs" >&5 printf "%s\n" "$as_me: WARNING: pandoc not found - Please install if you want build the docs" >&2;} else # # Pandoc v2 onwards renamed --latex-engine to --pdf-engine # if pandoc --help 2>&1 | grep -q "latex-engine"; then PANDOC_ENGINE=latex else PANDOC_ENGINE=pdf fi fi # pandoc and asciidoctor is defined? then check it. if test "x$ac_cv_path_PANDOC" != "x" && test "x$ac_cv_path_ASCIIDOCTOR" != "x"; then # Make sure we have perl if test -z "$PERL"; then # Extract the first word of "perl", so it can be a program name with args. set dummy perl; ac_word=$2 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 printf %s "checking for $ac_word... " >&6; } if test ${ac_cv_prog_PERL+y} then : printf %s "(cached) " >&6 else $as_nop if test -n "$PERL"; then ac_cv_prog_PERL="$PERL" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS case $as_dir in #((( '') as_dir=./ ;; */) ;; *) as_dir=$as_dir/ ;; esac for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then ac_cv_prog_PERL="perl" printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi PERL=$ac_cv_prog_PERL if test -n "$PERL"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $PERL" >&5 printf "%s\n" "$PERL" >&6; } else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi fi if test "x$PERL" != x; then ax_perl_modules_failed=0 for ax_perl_module in 'JSON' ; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for perl module $ax_perl_module" >&5 printf %s "checking for perl module $ax_perl_module... " >&6; } # Would be nice to log result here, but can't rely on autoconf internals $PERL -e "use $ax_perl_module; exit" > /dev/null 2>&1 if test $? -ne 0; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; }; ax_perl_modules_failed=1 else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: ok" >&5 printf "%s\n" "ok" >&6; }; fi done # Run optional shell commands if test "$ax_perl_modules_failed" = 0; then : else : { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: Perl JSON module not found - Please install if you want build the docs" >&5 printf "%s\n" "$as_me: WARNING: Perl JSON module not found - Please install if you want build the docs" >&2;} fi else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: could not find perl" >&5 printf "%s\n" "$as_me: WARNING: could not find perl" >&2;} fi fi # Extract the first word of "doxygen", so it can be a program name with args. set dummy doxygen; ac_word=$2 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 printf %s "checking for $ac_word... " >&6; } if test ${ac_cv_path_DOXYGEN+y} then : printf %s "(cached) " >&6 else $as_nop case $DOXYGEN in [\\/]* | ?:[\\/]*) ac_cv_path_DOXYGEN="$DOXYGEN" # Let the user override the test with a path. ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS case $as_dir in #((( '') as_dir=./ ;; */) ;; *) as_dir=$as_dir/ ;; esac for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then ac_cv_path_DOXYGEN="$as_dir$ac_word$ac_exec_ext" printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS ;; esac fi DOXYGEN=$ac_cv_path_DOXYGEN if test -n "$DOXYGEN"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $DOXYGEN" >&5 printf "%s\n" "$DOXYGEN" >&6; } else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi if test "x$ac_cv_path_DOXYGEN" != "x"; then # Extract the first word of "dot", so it can be a program name with args. set dummy dot; ac_word=$2 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 printf %s "checking for $ac_word... " >&6; } if test ${ac_cv_path_GRAPHVIZ_DOT+y} then : printf %s "(cached) " >&6 else $as_nop case $GRAPHVIZ_DOT in [\\/]* | ?:[\\/]*) ac_cv_path_GRAPHVIZ_DOT="$GRAPHVIZ_DOT" # Let the user override the test with a path. ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS case $as_dir in #((( '') as_dir=./ ;; */) ;; *) as_dir=$as_dir/ ;; esac for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then ac_cv_path_GRAPHVIZ_DOT="$as_dir$ac_word$ac_exec_ext" printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS ;; esac fi GRAPHVIZ_DOT=$ac_cv_path_GRAPHVIZ_DOT if test -n "$GRAPHVIZ_DOT"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $GRAPHVIZ_DOT" >&5 printf "%s\n" "$GRAPHVIZ_DOT" >&6; } else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi if test "x$ac_cv_path_GRAPHVIZ_DOT" = "x"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: dot not found - Please install the graphviz if you want to build the docs/source" >&5 printf "%s\n" "$as_me: WARNING: dot not found - Please install the graphviz if you want to build the docs/source" >&2;} fi else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: doxygen not found - Please install if you want build the docs/source" >&5 printf "%s\n" "$as_me: WARNING: doxygen not found - Please install if you want build the docs/source" >&2;} fi # Extract the first word of "antora", so it can be a program name with args. set dummy antora; ac_word=$2 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 printf %s "checking for $ac_word... " >&6; } if test ${ac_cv_path_ANTORA+y} then : printf %s "(cached) " >&6 else $as_nop case $ANTORA in [\\/]* | ?:[\\/]*) ac_cv_path_ANTORA="$ANTORA" # Let the user override the test with a path. ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS case $as_dir in #((( '') as_dir=./ ;; */) ;; *) as_dir=$as_dir/ ;; esac for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then ac_cv_path_ANTORA="$as_dir$ac_word$ac_exec_ext" printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS ;; esac fi ANTORA=$ac_cv_path_ANTORA if test -n "$ANTORA"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ANTORA" >&5 printf "%s\n" "$ANTORA" >&6; } else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi if test "x$ac_cv_path_ANTORA" = "x"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: antora not found - Please install if you want build the site" >&5 printf "%s\n" "$as_me: WARNING: antora not found - Please install if you want build the site" >&2;} fi # Check whether --enable-developer was given. if test ${enable_developer+y} then : enableval=$enable_developer; case "$enableval" in no) developer=no ;; *) developer=yes esac fi if test -d $srcdir/.git; then if test "x$developer" != "xno"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: found .git directory, enabling developer build implicitly, disable with --disable-developer" >&5 printf "%s\n" "$as_me: found .git directory, enabling developer build implicitly, disable with --disable-developer" >&6;} developer="yes" fi fi if test "x$developer" = "xyes"; then : ${CFLAGS=-g3} fi # Check whether --enable-verify-ptr was given. if test ${enable_verify_ptr+y} then : enableval=$enable_verify_ptr; case "$enableval" in no) verify_ptr="" ;; *) verify_ptr="-DWITH_VERIFY_PTR=1" esac else $as_nop verify_ptr="-DWITH_VERIFY_PTR=1" fi # Check whether --enable-fips-workaround was given. if test ${enable_fips_workaround+y} then : enableval=$enable_fips_workaround; case "$enableval" in no) ;; *) CFLAGS="$CFLAGS -DWITH_FIPS=1" esac fi # Make sure we can run config.sub. $SHELL "${ac_aux_dir}config.sub" sun4 >/dev/null 2>&1 || as_fn_error $? "cannot run $SHELL ${ac_aux_dir}config.sub" "$LINENO" 5 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking build system type" >&5 printf %s "checking build system type... " >&6; } if test ${ac_cv_build+y} then : printf %s "(cached) " >&6 else $as_nop ac_build_alias=$build_alias test "x$ac_build_alias" = x && ac_build_alias=`$SHELL "${ac_aux_dir}config.guess"` test "x$ac_build_alias" = x && as_fn_error $? "cannot guess build type; you must specify one" "$LINENO" 5 ac_cv_build=`$SHELL "${ac_aux_dir}config.sub" $ac_build_alias` || as_fn_error $? "$SHELL ${ac_aux_dir}config.sub $ac_build_alias failed" "$LINENO" 5 fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_build" >&5 printf "%s\n" "$ac_cv_build" >&6; } case $ac_cv_build in *-*-*) ;; *) as_fn_error $? "invalid value of canonical build" "$LINENO" 5;; esac build=$ac_cv_build ac_save_IFS=$IFS; IFS='-' set x $ac_cv_build shift build_cpu=$1 build_vendor=$2 shift; shift # Remember, the first character of IFS is used to create $*, # except with old shells: build_os=$* IFS=$ac_save_IFS case $build_os in *\ *) build_os=`echo "$build_os" | sed 's/ /-/g'`;; esac { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking host system type" >&5 printf %s "checking host system type... " >&6; } if test ${ac_cv_host+y} then : printf %s "(cached) " >&6 else $as_nop if test "x$host_alias" = x; then ac_cv_host=$ac_cv_build else ac_cv_host=`$SHELL "${ac_aux_dir}config.sub" $host_alias` || as_fn_error $? "$SHELL ${ac_aux_dir}config.sub $host_alias failed" "$LINENO" 5 fi fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_host" >&5 printf "%s\n" "$ac_cv_host" >&6; } case $ac_cv_host in *-*-*) ;; *) as_fn_error $? "invalid value of canonical host" "$LINENO" 5;; esac host=$ac_cv_host ac_save_IFS=$IFS; IFS='-' set x $ac_cv_host shift host_cpu=$1 host_vendor=$2 shift; shift # Remember, the first character of IFS is used to create $*, # except with old shells: host_os=$* IFS=$ac_save_IFS case $host_os in *\ *) host_os=`echo "$host_os" | sed 's/ /-/g'`;; esac { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking target system type" >&5 printf %s "checking target system type... " >&6; } if test ${ac_cv_target+y} then : printf %s "(cached) " >&6 else $as_nop if test "x$target_alias" = x; then ac_cv_target=$ac_cv_host else ac_cv_target=`$SHELL "${ac_aux_dir}config.sub" $target_alias` || as_fn_error $? "$SHELL ${ac_aux_dir}config.sub $target_alias failed" "$LINENO" 5 fi fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_target" >&5 printf "%s\n" "$ac_cv_target" >&6; } case $ac_cv_target in *-*-*) ;; *) as_fn_error $? "invalid value of canonical target" "$LINENO" 5;; esac target=$ac_cv_target ac_save_IFS=$IFS; IFS='-' set x $ac_cv_target shift target_cpu=$1 target_vendor=$2 shift; shift # Remember, the first character of IFS is used to create $*, # except with old shells: target_os=$* IFS=$ac_save_IFS case $target_os in *\ *) target_os=`echo "$target_os" | sed 's/ /-/g'`;; esac # The aliases save the names the user supplied, while $host etc. # will get canonicalized. test -n "$target_alias" && test "$program_prefix$program_suffix$program_transform_name" = \ NONENONEs,x,x, && program_prefix=${target_alias}- case "$host" in *-darwin*) CFLAGS="$CFLAGS -DDARWIN" LDFLAGS="-L/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/lib $LDFLAGS" LIBS="-F /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/System/Library/Frameworks/ -framework DirectoryService $LIBS" ;; esac ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu if test -n "$ac_tool_prefix"; then # Extract the first word of "${ac_tool_prefix}gcc", so it can be a program name with args. set dummy ${ac_tool_prefix}gcc; ac_word=$2 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 printf %s "checking for $ac_word... " >&6; } if test ${ac_cv_prog_CC+y} then : printf %s "(cached) " >&6 else $as_nop if test -n "$CC"; then ac_cv_prog_CC="$CC" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS case $as_dir in #((( '') as_dir=./ ;; */) ;; *) as_dir=$as_dir/ ;; esac for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then ac_cv_prog_CC="${ac_tool_prefix}gcc" printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi CC=$ac_cv_prog_CC if test -n "$CC"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $CC" >&5 printf "%s\n" "$CC" >&6; } else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi fi if test -z "$ac_cv_prog_CC"; then ac_ct_CC=$CC # Extract the first word of "gcc", so it can be a program name with args. set dummy gcc; ac_word=$2 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 printf %s "checking for $ac_word... " >&6; } if test ${ac_cv_prog_ac_ct_CC+y} then : printf %s "(cached) " >&6 else $as_nop if test -n "$ac_ct_CC"; then ac_cv_prog_ac_ct_CC="$ac_ct_CC" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS case $as_dir in #((( '') as_dir=./ ;; */) ;; *) as_dir=$as_dir/ ;; esac for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then ac_cv_prog_ac_ct_CC="gcc" printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_CC=$ac_cv_prog_ac_ct_CC if test -n "$ac_ct_CC"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5 printf "%s\n" "$ac_ct_CC" >&6; } else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi if test "x$ac_ct_CC" = x; then CC="" else case $cross_compiling:$ac_tool_warned in yes:) { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac CC=$ac_ct_CC fi else CC="$ac_cv_prog_CC" fi if test -z "$CC"; then if test -n "$ac_tool_prefix"; then # Extract the first word of "${ac_tool_prefix}cc", so it can be a program name with args. set dummy ${ac_tool_prefix}cc; ac_word=$2 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 printf %s "checking for $ac_word... " >&6; } if test ${ac_cv_prog_CC+y} then : printf %s "(cached) " >&6 else $as_nop if test -n "$CC"; then ac_cv_prog_CC="$CC" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS case $as_dir in #((( '') as_dir=./ ;; */) ;; *) as_dir=$as_dir/ ;; esac for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then ac_cv_prog_CC="${ac_tool_prefix}cc" printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi CC=$ac_cv_prog_CC if test -n "$CC"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $CC" >&5 printf "%s\n" "$CC" >&6; } else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi fi fi if test -z "$CC"; then # Extract the first word of "cc", so it can be a program name with args. set dummy cc; ac_word=$2 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 printf %s "checking for $ac_word... " >&6; } if test ${ac_cv_prog_CC+y} then : printf %s "(cached) " >&6 else $as_nop if test -n "$CC"; then ac_cv_prog_CC="$CC" # Let the user override the test. else ac_prog_rejected=no as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS case $as_dir in #((( '') as_dir=./ ;; */) ;; *) as_dir=$as_dir/ ;; esac for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then if test "$as_dir$ac_word$ac_exec_ext" = "/usr/ucb/cc"; then ac_prog_rejected=yes continue fi ac_cv_prog_CC="cc" printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS if test $ac_prog_rejected = yes; then # We found a bogon in the path, so make sure we never use it. set dummy $ac_cv_prog_CC shift if test $# != 0; then # We chose a different compiler from the bogus one. # However, it has the same basename, so the bogon will be chosen # first if we set CC to just the basename; use the full file name. shift ac_cv_prog_CC="$as_dir$ac_word${1+' '}$@" fi fi fi fi CC=$ac_cv_prog_CC if test -n "$CC"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $CC" >&5 printf "%s\n" "$CC" >&6; } else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi fi if test -z "$CC"; then if test -n "$ac_tool_prefix"; then for ac_prog in cl.exe do # Extract the first word of "$ac_tool_prefix$ac_prog", so it can be a program name with args. set dummy $ac_tool_prefix$ac_prog; ac_word=$2 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 printf %s "checking for $ac_word... " >&6; } if test ${ac_cv_prog_CC+y} then : printf %s "(cached) " >&6 else $as_nop if test -n "$CC"; then ac_cv_prog_CC="$CC" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS case $as_dir in #((( '') as_dir=./ ;; */) ;; *) as_dir=$as_dir/ ;; esac for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then ac_cv_prog_CC="$ac_tool_prefix$ac_prog" printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi CC=$ac_cv_prog_CC if test -n "$CC"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $CC" >&5 printf "%s\n" "$CC" >&6; } else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi test -n "$CC" && break done fi if test -z "$CC"; then ac_ct_CC=$CC for ac_prog in cl.exe do # Extract the first word of "$ac_prog", so it can be a program name with args. set dummy $ac_prog; ac_word=$2 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 printf %s "checking for $ac_word... " >&6; } if test ${ac_cv_prog_ac_ct_CC+y} then : printf %s "(cached) " >&6 else $as_nop if test -n "$ac_ct_CC"; then ac_cv_prog_ac_ct_CC="$ac_ct_CC" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS case $as_dir in #((( '') as_dir=./ ;; */) ;; *) as_dir=$as_dir/ ;; esac for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then ac_cv_prog_ac_ct_CC="$ac_prog" printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_CC=$ac_cv_prog_ac_ct_CC if test -n "$ac_ct_CC"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5 printf "%s\n" "$ac_ct_CC" >&6; } else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi test -n "$ac_ct_CC" && break done if test "x$ac_ct_CC" = x; then CC="" else case $cross_compiling:$ac_tool_warned in yes:) { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac CC=$ac_ct_CC fi fi fi if test -z "$CC"; then if test -n "$ac_tool_prefix"; then # Extract the first word of "${ac_tool_prefix}clang", so it can be a program name with args. set dummy ${ac_tool_prefix}clang; ac_word=$2 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 printf %s "checking for $ac_word... " >&6; } if test ${ac_cv_prog_CC+y} then : printf %s "(cached) " >&6 else $as_nop if test -n "$CC"; then ac_cv_prog_CC="$CC" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS case $as_dir in #((( '') as_dir=./ ;; */) ;; *) as_dir=$as_dir/ ;; esac for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then ac_cv_prog_CC="${ac_tool_prefix}clang" printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi CC=$ac_cv_prog_CC if test -n "$CC"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $CC" >&5 printf "%s\n" "$CC" >&6; } else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi fi if test -z "$ac_cv_prog_CC"; then ac_ct_CC=$CC # Extract the first word of "clang", so it can be a program name with args. set dummy clang; ac_word=$2 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 printf %s "checking for $ac_word... " >&6; } if test ${ac_cv_prog_ac_ct_CC+y} then : printf %s "(cached) " >&6 else $as_nop if test -n "$ac_ct_CC"; then ac_cv_prog_ac_ct_CC="$ac_ct_CC" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS case $as_dir in #((( '') as_dir=./ ;; */) ;; *) as_dir=$as_dir/ ;; esac for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then ac_cv_prog_ac_ct_CC="clang" printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_CC=$ac_cv_prog_ac_ct_CC if test -n "$ac_ct_CC"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5 printf "%s\n" "$ac_ct_CC" >&6; } else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi if test "x$ac_ct_CC" = x; then CC="" else case $cross_compiling:$ac_tool_warned in yes:) { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac CC=$ac_ct_CC fi else CC="$ac_cv_prog_CC" fi fi test -z "$CC" && { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "no acceptable C compiler found in \$PATH See \`config.log' for more details" "$LINENO" 5; } # Provide some information about the compiler. printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for C compiler version" >&5 set X $ac_compile ac_compiler=$2 for ac_option in --version -v -V -qversion -version; do { { ac_try="$ac_compiler $ac_option >&5" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" printf "%s\n" "$ac_try_echo"; } >&5 (eval "$ac_compiler $ac_option >&5") 2>conftest.err ac_status=$? if test -s conftest.err; then sed '10a\ ... rest of stderr output deleted ... 10q' conftest.err >conftest.er1 cat conftest.er1 >&5 fi rm -f conftest.er1 conftest.err printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } done cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main (void) { ; return 0; } _ACEOF ac_clean_files_save=$ac_clean_files ac_clean_files="$ac_clean_files a.out a.out.dSYM a.exe b.out" # Try to create an executable without -o first, disregard a.out. # It will help us diagnose broken compilers, and finding out an intuition # of exeext. { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the C compiler works" >&5 printf %s "checking whether the C compiler works... " >&6; } ac_link_default=`printf "%s\n" "$ac_link" | sed 's/ -o *conftest[^ ]*//'` # The possible output files: ac_files="a.out conftest.exe conftest a.exe a_out.exe b.out conftest.*" ac_rmfiles= for ac_file in $ac_files do case $ac_file in *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) ;; * ) ac_rmfiles="$ac_rmfiles $ac_file";; esac done rm -f $ac_rmfiles if { { ac_try="$ac_link_default" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" printf "%s\n" "$ac_try_echo"; } >&5 (eval "$ac_link_default") 2>&5 ac_status=$? printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } then : # Autoconf-2.13 could set the ac_cv_exeext variable to `no'. # So ignore a value of `no', otherwise this would lead to `EXEEXT = no' # in a Makefile. We should not override ac_cv_exeext if it was cached, # so that the user can short-circuit this test for compilers unknown to # Autoconf. for ac_file in $ac_files '' do test -f "$ac_file" || continue case $ac_file in *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) ;; [ab].out ) # We found the default executable, but exeext='' is most # certainly right. break;; *.* ) if test ${ac_cv_exeext+y} && test "$ac_cv_exeext" != no; then :; else ac_cv_exeext=`expr "$ac_file" : '[^.]*\(\..*\)'` fi # We set ac_cv_exeext here because the later test for it is not # safe: cross compilers may not add the suffix if given an `-o' # argument, so we may need to know it at that point already. # Even if this section looks crufty: it has the advantage of # actually working. break;; * ) break;; esac done test "$ac_cv_exeext" = no && ac_cv_exeext= else $as_nop ac_file='' fi if test -z "$ac_file" then : { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } printf "%s\n" "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error 77 "C compiler cannot create executables See \`config.log' for more details" "$LINENO" 5; } else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for C compiler default output file name" >&5 printf %s "checking for C compiler default output file name... " >&6; } { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_file" >&5 printf "%s\n" "$ac_file" >&6; } ac_exeext=$ac_cv_exeext rm -f -r a.out a.out.dSYM a.exe conftest$ac_cv_exeext b.out ac_clean_files=$ac_clean_files_save { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for suffix of executables" >&5 printf %s "checking for suffix of executables... " >&6; } if { { ac_try="$ac_link" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" printf "%s\n" "$ac_try_echo"; } >&5 (eval "$ac_link") 2>&5 ac_status=$? printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } then : # If both `conftest.exe' and `conftest' are `present' (well, observable) # catch `conftest.exe'. For instance with Cygwin, `ls conftest' will # work properly (i.e., refer to `conftest.exe'), while it won't with # `rm'. for ac_file in conftest.exe conftest conftest.*; do test -f "$ac_file" || continue case $ac_file in *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) ;; *.* ) ac_cv_exeext=`expr "$ac_file" : '[^.]*\(\..*\)'` break;; * ) break;; esac done else $as_nop { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "cannot compute suffix of executables: cannot compile and link See \`config.log' for more details" "$LINENO" 5; } fi rm -f conftest conftest$ac_cv_exeext { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_exeext" >&5 printf "%s\n" "$ac_cv_exeext" >&6; } rm -f conftest.$ac_ext EXEEXT=$ac_cv_exeext ac_exeext=$EXEEXT cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { FILE *f = fopen ("conftest.out", "w"); return ferror (f) || fclose (f) != 0; ; return 0; } _ACEOF ac_clean_files="$ac_clean_files conftest.out" # Check that the compiler produces executables we can run. If not, either # the compiler is broken, or we cross compile. { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether we are cross compiling" >&5 printf %s "checking whether we are cross compiling... " >&6; } if test "$cross_compiling" != yes; then { { ac_try="$ac_link" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" printf "%s\n" "$ac_try_echo"; } >&5 (eval "$ac_link") 2>&5 ac_status=$? printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } if { ac_try='./conftest$ac_cv_exeext' { { case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" printf "%s\n" "$ac_try_echo"; } >&5 (eval "$ac_try") 2>&5 ac_status=$? printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; }; then cross_compiling=no else if test "$cross_compiling" = maybe; then cross_compiling=yes else { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error 77 "cannot run C compiled programs. If you meant to cross compile, use \`--host'. See \`config.log' for more details" "$LINENO" 5; } fi fi fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $cross_compiling" >&5 printf "%s\n" "$cross_compiling" >&6; } rm -f conftest.$ac_ext conftest$ac_cv_exeext conftest.out ac_clean_files=$ac_clean_files_save { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for suffix of object files" >&5 printf %s "checking for suffix of object files... " >&6; } if test ${ac_cv_objext+y} then : printf %s "(cached) " >&6 else $as_nop cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main (void) { ; return 0; } _ACEOF rm -f conftest.o conftest.obj if { { ac_try="$ac_compile" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" printf "%s\n" "$ac_try_echo"; } >&5 (eval "$ac_compile") 2>&5 ac_status=$? printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } then : for ac_file in conftest.o conftest.obj conftest.*; do test -f "$ac_file" || continue; case $ac_file in *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM ) ;; *) ac_cv_objext=`expr "$ac_file" : '.*\.\(.*\)'` break;; esac done else $as_nop printf "%s\n" "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "cannot compute suffix of object files: cannot compile See \`config.log' for more details" "$LINENO" 5; } fi rm -f conftest.$ac_cv_objext conftest.$ac_ext fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_objext" >&5 printf "%s\n" "$ac_cv_objext" >&6; } OBJEXT=$ac_cv_objext ac_objext=$OBJEXT { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the compiler supports GNU C" >&5 printf %s "checking whether the compiler supports GNU C... " >&6; } if test ${ac_cv_c_compiler_gnu+y} then : printf %s "(cached) " >&6 else $as_nop cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main (void) { #ifndef __GNUC__ choke me #endif ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : ac_compiler_gnu=yes else $as_nop ac_compiler_gnu=no fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext ac_cv_c_compiler_gnu=$ac_compiler_gnu fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_compiler_gnu" >&5 printf "%s\n" "$ac_cv_c_compiler_gnu" >&6; } ac_compiler_gnu=$ac_cv_c_compiler_gnu if test $ac_compiler_gnu = yes; then GCC=yes else GCC= fi ac_test_CFLAGS=${CFLAGS+y} ac_save_CFLAGS=$CFLAGS { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether $CC accepts -g" >&5 printf %s "checking whether $CC accepts -g... " >&6; } if test ${ac_cv_prog_cc_g+y} then : printf %s "(cached) " >&6 else $as_nop ac_save_c_werror_flag=$ac_c_werror_flag ac_c_werror_flag=yes ac_cv_prog_cc_g=no CFLAGS="-g" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main (void) { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : ac_cv_prog_cc_g=yes else $as_nop CFLAGS="" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main (void) { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : else $as_nop ac_c_werror_flag=$ac_save_c_werror_flag CFLAGS="-g" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main (void) { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : ac_cv_prog_cc_g=yes fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext ac_c_werror_flag=$ac_save_c_werror_flag fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_g" >&5 printf "%s\n" "$ac_cv_prog_cc_g" >&6; } if test $ac_test_CFLAGS; then CFLAGS=$ac_save_CFLAGS elif test $ac_cv_prog_cc_g = yes; then if test "$GCC" = yes; then CFLAGS="-g -O2" else CFLAGS="-g" fi else if test "$GCC" = yes; then CFLAGS="-O2" else CFLAGS= fi fi ac_prog_cc_stdc=no if test x$ac_prog_cc_stdc = xno then : { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $CC option to enable C11 features" >&5 printf %s "checking for $CC option to enable C11 features... " >&6; } if test ${ac_cv_prog_cc_c11+y} then : printf %s "(cached) " >&6 else $as_nop ac_cv_prog_cc_c11=no ac_save_CC=$CC cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ $ac_c_conftest_c11_program _ACEOF for ac_arg in '' -std=gnu11 do CC="$ac_save_CC $ac_arg" if ac_fn_c_try_compile "$LINENO" then : ac_cv_prog_cc_c11=$ac_arg fi rm -f core conftest.err conftest.$ac_objext conftest.beam test "x$ac_cv_prog_cc_c11" != "xno" && break done rm -f conftest.$ac_ext CC=$ac_save_CC fi if test "x$ac_cv_prog_cc_c11" = xno then : { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: unsupported" >&5 printf "%s\n" "unsupported" >&6; } else $as_nop if test "x$ac_cv_prog_cc_c11" = x then : { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: none needed" >&5 printf "%s\n" "none needed" >&6; } else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_c11" >&5 printf "%s\n" "$ac_cv_prog_cc_c11" >&6; } CC="$CC $ac_cv_prog_cc_c11" fi ac_cv_prog_cc_stdc=$ac_cv_prog_cc_c11 ac_prog_cc_stdc=c11 fi fi if test x$ac_prog_cc_stdc = xno then : { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $CC option to enable C99 features" >&5 printf %s "checking for $CC option to enable C99 features... " >&6; } if test ${ac_cv_prog_cc_c99+y} then : printf %s "(cached) " >&6 else $as_nop ac_cv_prog_cc_c99=no ac_save_CC=$CC cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ $ac_c_conftest_c99_program _ACEOF for ac_arg in '' -std=gnu99 -std=c99 -c99 -qlanglvl=extc1x -qlanglvl=extc99 -AC99 -D_STDC_C99= do CC="$ac_save_CC $ac_arg" if ac_fn_c_try_compile "$LINENO" then : ac_cv_prog_cc_c99=$ac_arg fi rm -f core conftest.err conftest.$ac_objext conftest.beam test "x$ac_cv_prog_cc_c99" != "xno" && break done rm -f conftest.$ac_ext CC=$ac_save_CC fi if test "x$ac_cv_prog_cc_c99" = xno then : { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: unsupported" >&5 printf "%s\n" "unsupported" >&6; } else $as_nop if test "x$ac_cv_prog_cc_c99" = x then : { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: none needed" >&5 printf "%s\n" "none needed" >&6; } else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_c99" >&5 printf "%s\n" "$ac_cv_prog_cc_c99" >&6; } CC="$CC $ac_cv_prog_cc_c99" fi ac_cv_prog_cc_stdc=$ac_cv_prog_cc_c99 ac_prog_cc_stdc=c99 fi fi if test x$ac_prog_cc_stdc = xno then : { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $CC option to enable C89 features" >&5 printf %s "checking for $CC option to enable C89 features... " >&6; } if test ${ac_cv_prog_cc_c89+y} then : printf %s "(cached) " >&6 else $as_nop ac_cv_prog_cc_c89=no ac_save_CC=$CC cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ $ac_c_conftest_c89_program _ACEOF for ac_arg in '' -qlanglvl=extc89 -qlanglvl=ansi -std -Ae "-Aa -D_HPUX_SOURCE" "-Xc -D__EXTENSIONS__" do CC="$ac_save_CC $ac_arg" if ac_fn_c_try_compile "$LINENO" then : ac_cv_prog_cc_c89=$ac_arg fi rm -f core conftest.err conftest.$ac_objext conftest.beam test "x$ac_cv_prog_cc_c89" != "xno" && break done rm -f conftest.$ac_ext CC=$ac_save_CC fi if test "x$ac_cv_prog_cc_c89" = xno then : { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: unsupported" >&5 printf "%s\n" "unsupported" >&6; } else $as_nop if test "x$ac_cv_prog_cc_c89" = x then : { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: none needed" >&5 printf "%s\n" "none needed" >&6; } else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_c89" >&5 printf "%s\n" "$ac_cv_prog_cc_c89" >&6; } CC="$CC $ac_cv_prog_cc_c89" fi ac_cv_prog_cc_stdc=$ac_cv_prog_cc_c89 ac_prog_cc_stdc=c89 fi fi ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu ac_ext=cpp ac_cpp='$CXXCPP $CPPFLAGS' ac_compile='$CXX -c $CXXFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CXX -o conftest$ac_exeext $CXXFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_cxx_compiler_gnu if test -z "$CXX"; then if test -n "$CCC"; then CXX=$CCC else if test -n "$ac_tool_prefix"; then for ac_prog in g++ c++ gpp aCC CC cxx cc++ cl.exe FCC KCC RCC xlC_r xlC clang++ do # Extract the first word of "$ac_tool_prefix$ac_prog", so it can be a program name with args. set dummy $ac_tool_prefix$ac_prog; ac_word=$2 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 printf %s "checking for $ac_word... " >&6; } if test ${ac_cv_prog_CXX+y} then : printf %s "(cached) " >&6 else $as_nop if test -n "$CXX"; then ac_cv_prog_CXX="$CXX" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS case $as_dir in #((( '') as_dir=./ ;; */) ;; *) as_dir=$as_dir/ ;; esac for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then ac_cv_prog_CXX="$ac_tool_prefix$ac_prog" printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi CXX=$ac_cv_prog_CXX if test -n "$CXX"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $CXX" >&5 printf "%s\n" "$CXX" >&6; } else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi test -n "$CXX" && break done fi if test -z "$CXX"; then ac_ct_CXX=$CXX for ac_prog in g++ c++ gpp aCC CC cxx cc++ cl.exe FCC KCC RCC xlC_r xlC clang++ do # Extract the first word of "$ac_prog", so it can be a program name with args. set dummy $ac_prog; ac_word=$2 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 printf %s "checking for $ac_word... " >&6; } if test ${ac_cv_prog_ac_ct_CXX+y} then : printf %s "(cached) " >&6 else $as_nop if test -n "$ac_ct_CXX"; then ac_cv_prog_ac_ct_CXX="$ac_ct_CXX" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS case $as_dir in #((( '') as_dir=./ ;; */) ;; *) as_dir=$as_dir/ ;; esac for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then ac_cv_prog_ac_ct_CXX="$ac_prog" printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_CXX=$ac_cv_prog_ac_ct_CXX if test -n "$ac_ct_CXX"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CXX" >&5 printf "%s\n" "$ac_ct_CXX" >&6; } else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi test -n "$ac_ct_CXX" && break done if test "x$ac_ct_CXX" = x; then CXX="g++" else case $cross_compiling:$ac_tool_warned in yes:) { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac CXX=$ac_ct_CXX fi fi fi fi # Provide some information about the compiler. printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for C++ compiler version" >&5 set X $ac_compile ac_compiler=$2 for ac_option in --version -v -V -qversion; do { { ac_try="$ac_compiler $ac_option >&5" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" printf "%s\n" "$ac_try_echo"; } >&5 (eval "$ac_compiler $ac_option >&5") 2>conftest.err ac_status=$? if test -s conftest.err; then sed '10a\ ... rest of stderr output deleted ... 10q' conftest.err >conftest.er1 cat conftest.er1 >&5 fi rm -f conftest.er1 conftest.err printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } done { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the compiler supports GNU C++" >&5 printf %s "checking whether the compiler supports GNU C++... " >&6; } if test ${ac_cv_cxx_compiler_gnu+y} then : printf %s "(cached) " >&6 else $as_nop cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main (void) { #ifndef __GNUC__ choke me #endif ; return 0; } _ACEOF if ac_fn_cxx_try_compile "$LINENO" then : ac_compiler_gnu=yes else $as_nop ac_compiler_gnu=no fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext ac_cv_cxx_compiler_gnu=$ac_compiler_gnu fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_cxx_compiler_gnu" >&5 printf "%s\n" "$ac_cv_cxx_compiler_gnu" >&6; } ac_compiler_gnu=$ac_cv_cxx_compiler_gnu if test $ac_compiler_gnu = yes; then GXX=yes else GXX= fi ac_test_CXXFLAGS=${CXXFLAGS+y} ac_save_CXXFLAGS=$CXXFLAGS { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether $CXX accepts -g" >&5 printf %s "checking whether $CXX accepts -g... " >&6; } if test ${ac_cv_prog_cxx_g+y} then : printf %s "(cached) " >&6 else $as_nop ac_save_cxx_werror_flag=$ac_cxx_werror_flag ac_cxx_werror_flag=yes ac_cv_prog_cxx_g=no CXXFLAGS="-g" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main (void) { ; return 0; } _ACEOF if ac_fn_cxx_try_compile "$LINENO" then : ac_cv_prog_cxx_g=yes else $as_nop CXXFLAGS="" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main (void) { ; return 0; } _ACEOF if ac_fn_cxx_try_compile "$LINENO" then : else $as_nop ac_cxx_werror_flag=$ac_save_cxx_werror_flag CXXFLAGS="-g" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main (void) { ; return 0; } _ACEOF if ac_fn_cxx_try_compile "$LINENO" then : ac_cv_prog_cxx_g=yes fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext ac_cxx_werror_flag=$ac_save_cxx_werror_flag fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cxx_g" >&5 printf "%s\n" "$ac_cv_prog_cxx_g" >&6; } if test $ac_test_CXXFLAGS; then CXXFLAGS=$ac_save_CXXFLAGS elif test $ac_cv_prog_cxx_g = yes; then if test "$GXX" = yes; then CXXFLAGS="-g -O2" else CXXFLAGS="-g" fi else if test "$GXX" = yes; then CXXFLAGS="-O2" else CXXFLAGS= fi fi ac_prog_cxx_stdcxx=no if test x$ac_prog_cxx_stdcxx = xno then : { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $CXX option to enable C++11 features" >&5 printf %s "checking for $CXX option to enable C++11 features... " >&6; } if test ${ac_cv_prog_cxx_11+y} then : printf %s "(cached) " >&6 else $as_nop ac_cv_prog_cxx_11=no ac_save_CXX=$CXX cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ $ac_cxx_conftest_cxx11_program _ACEOF for ac_arg in '' -std=gnu++11 -std=gnu++0x -std=c++11 -std=c++0x -qlanglvl=extended0x -AA do CXX="$ac_save_CXX $ac_arg" if ac_fn_cxx_try_compile "$LINENO" then : ac_cv_prog_cxx_cxx11=$ac_arg fi rm -f core conftest.err conftest.$ac_objext conftest.beam test "x$ac_cv_prog_cxx_cxx11" != "xno" && break done rm -f conftest.$ac_ext CXX=$ac_save_CXX fi if test "x$ac_cv_prog_cxx_cxx11" = xno then : { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: unsupported" >&5 printf "%s\n" "unsupported" >&6; } else $as_nop if test "x$ac_cv_prog_cxx_cxx11" = x then : { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: none needed" >&5 printf "%s\n" "none needed" >&6; } else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cxx_cxx11" >&5 printf "%s\n" "$ac_cv_prog_cxx_cxx11" >&6; } CXX="$CXX $ac_cv_prog_cxx_cxx11" fi ac_cv_prog_cxx_stdcxx=$ac_cv_prog_cxx_cxx11 ac_prog_cxx_stdcxx=cxx11 fi fi if test x$ac_prog_cxx_stdcxx = xno then : { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $CXX option to enable C++98 features" >&5 printf %s "checking for $CXX option to enable C++98 features... " >&6; } if test ${ac_cv_prog_cxx_98+y} then : printf %s "(cached) " >&6 else $as_nop ac_cv_prog_cxx_98=no ac_save_CXX=$CXX cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ $ac_cxx_conftest_cxx98_program _ACEOF for ac_arg in '' -std=gnu++98 -std=c++98 -qlanglvl=extended -AA do CXX="$ac_save_CXX $ac_arg" if ac_fn_cxx_try_compile "$LINENO" then : ac_cv_prog_cxx_cxx98=$ac_arg fi rm -f core conftest.err conftest.$ac_objext conftest.beam test "x$ac_cv_prog_cxx_cxx98" != "xno" && break done rm -f conftest.$ac_ext CXX=$ac_save_CXX fi if test "x$ac_cv_prog_cxx_cxx98" = xno then : { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: unsupported" >&5 printf "%s\n" "unsupported" >&6; } else $as_nop if test "x$ac_cv_prog_cxx_cxx98" = x then : { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: none needed" >&5 printf "%s\n" "none needed" >&6; } else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cxx_cxx98" >&5 printf "%s\n" "$ac_cv_prog_cxx_cxx98" >&6; } CXX="$CXX $ac_cv_prog_cxx_cxx98" fi ac_cv_prog_cxx_stdcxx=$ac_cv_prog_cxx_cxx98 ac_prog_cxx_stdcxx=cxx98 fi fi ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu ac_header= ac_cache= for ac_item in $ac_header_c_list do if test $ac_cache; then ac_fn_c_check_header_compile "$LINENO" $ac_header ac_cv_header_$ac_cache "$ac_includes_default" if eval test \"x\$ac_cv_header_$ac_cache\" = xyes; then printf "%s\n" "#define $ac_item 1" >> confdefs.h fi ac_header= ac_cache= elif test $ac_header; then ac_cache=$ac_item else ac_header=$ac_item fi done if test $ac_cv_header_stdlib_h = yes && test $ac_cv_header_string_h = yes then : printf "%s\n" "#define STDC_HEADERS 1" >>confdefs.h fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether it is safe to define __EXTENSIONS__" >&5 printf %s "checking whether it is safe to define __EXTENSIONS__... " >&6; } if test ${ac_cv_safe_to_define___extensions__+y} then : printf %s "(cached) " >&6 else $as_nop cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ # define __EXTENSIONS__ 1 $ac_includes_default int main (void) { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : ac_cv_safe_to_define___extensions__=yes else $as_nop ac_cv_safe_to_define___extensions__=no fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_safe_to_define___extensions__" >&5 printf "%s\n" "$ac_cv_safe_to_define___extensions__" >&6; } { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether _XOPEN_SOURCE should be defined" >&5 printf %s "checking whether _XOPEN_SOURCE should be defined... " >&6; } if test ${ac_cv_should_define__xopen_source+y} then : printf %s "(cached) " >&6 else $as_nop ac_cv_should_define__xopen_source=no if test $ac_cv_header_wchar_h = yes then : cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include mbstate_t x; int main (void) { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : else $as_nop cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #define _XOPEN_SOURCE 500 #include mbstate_t x; int main (void) { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : ac_cv_should_define__xopen_source=yes fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext fi fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_should_define__xopen_source" >&5 printf "%s\n" "$ac_cv_should_define__xopen_source" >&6; } printf "%s\n" "#define _ALL_SOURCE 1" >>confdefs.h printf "%s\n" "#define _DARWIN_C_SOURCE 1" >>confdefs.h printf "%s\n" "#define _GNU_SOURCE 1" >>confdefs.h printf "%s\n" "#define _HPUX_ALT_XOPEN_SOCKET_API 1" >>confdefs.h printf "%s\n" "#define _NETBSD_SOURCE 1" >>confdefs.h printf "%s\n" "#define _OPENBSD_SOURCE 1" >>confdefs.h printf "%s\n" "#define _POSIX_PTHREAD_SEMANTICS 1" >>confdefs.h printf "%s\n" "#define __STDC_WANT_IEC_60559_ATTRIBS_EXT__ 1" >>confdefs.h printf "%s\n" "#define __STDC_WANT_IEC_60559_BFP_EXT__ 1" >>confdefs.h printf "%s\n" "#define __STDC_WANT_IEC_60559_DFP_EXT__ 1" >>confdefs.h printf "%s\n" "#define __STDC_WANT_IEC_60559_FUNCS_EXT__ 1" >>confdefs.h printf "%s\n" "#define __STDC_WANT_IEC_60559_TYPES_EXT__ 1" >>confdefs.h printf "%s\n" "#define __STDC_WANT_LIB_EXT2__ 1" >>confdefs.h printf "%s\n" "#define __STDC_WANT_MATH_SPEC_FUNCS__ 1" >>confdefs.h printf "%s\n" "#define _TANDEM_SOURCE 1" >>confdefs.h if test $ac_cv_header_minix_config_h = yes then : MINIX=yes printf "%s\n" "#define _MINIX 1" >>confdefs.h printf "%s\n" "#define _POSIX_SOURCE 1" >>confdefs.h printf "%s\n" "#define _POSIX_1_SOURCE 2" >>confdefs.h else $as_nop MINIX= fi if test $ac_cv_safe_to_define___extensions__ = yes then : printf "%s\n" "#define __EXTENSIONS__ 1" >>confdefs.h fi if test $ac_cv_should_define__xopen_source = yes then : printf "%s\n" "#define _XOPEN_SOURCE 500" >>confdefs.h fi ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking how to run the C preprocessor" >&5 printf %s "checking how to run the C preprocessor... " >&6; } # On Suns, sometimes $CPP names a directory. if test -n "$CPP" && test -d "$CPP"; then CPP= fi if test -z "$CPP"; then if test ${ac_cv_prog_CPP+y} then : printf %s "(cached) " >&6 else $as_nop # Double quotes because $CC needs to be expanded for CPP in "$CC -E" "$CC -E -traditional-cpp" cpp /lib/cpp do ac_preproc_ok=false for ac_c_preproc_warn_flag in '' yes do # Use a header file that comes with gcc, so configuring glibc # with a fresh cross-compiler works. # On the NeXT, cc -E runs the code through the compiler's parser, # not just through cpp. "Syntax error" is here to catch this case. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include Syntax error _ACEOF if ac_fn_c_try_cpp "$LINENO" then : else $as_nop # Broken: fails on valid input. continue fi rm -f conftest.err conftest.i conftest.$ac_ext # OK, works on sane cases. Now check whether nonexistent headers # can be detected and how. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include _ACEOF if ac_fn_c_try_cpp "$LINENO" then : # Broken: success on invalid input. continue else $as_nop # Passes both tests. ac_preproc_ok=: break fi rm -f conftest.err conftest.i conftest.$ac_ext done # Because of `break', _AC_PREPROC_IFELSE's cleaning code was skipped. rm -f conftest.i conftest.err conftest.$ac_ext if $ac_preproc_ok then : break fi done ac_cv_prog_CPP=$CPP fi CPP=$ac_cv_prog_CPP else ac_cv_prog_CPP=$CPP fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $CPP" >&5 printf "%s\n" "$CPP" >&6; } ac_preproc_ok=false for ac_c_preproc_warn_flag in '' yes do # Use a header file that comes with gcc, so configuring glibc # with a fresh cross-compiler works. # On the NeXT, cc -E runs the code through the compiler's parser, # not just through cpp. "Syntax error" is here to catch this case. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include Syntax error _ACEOF if ac_fn_c_try_cpp "$LINENO" then : else $as_nop # Broken: fails on valid input. continue fi rm -f conftest.err conftest.i conftest.$ac_ext # OK, works on sane cases. Now check whether nonexistent headers # can be detected and how. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include _ACEOF if ac_fn_c_try_cpp "$LINENO" then : # Broken: success on invalid input. continue else $as_nop # Passes both tests. ac_preproc_ok=: break fi rm -f conftest.err conftest.i conftest.$ac_ext done # Because of `break', _AC_PREPROC_IFELSE's cleaning code was skipped. rm -f conftest.i conftest.err conftest.$ac_ext if $ac_preproc_ok then : else $as_nop { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "C preprocessor \"$CPP\" fails sanity check See \`config.log' for more details" "$LINENO" 5; } fi ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for grep that handles long lines and -e" >&5 printf %s "checking for grep that handles long lines and -e... " >&6; } if test ${ac_cv_path_GREP+y} then : printf %s "(cached) " >&6 else $as_nop if test -z "$GREP"; then ac_path_GREP_found=false # Loop through the user's path and test for each of PROGNAME-LIST as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH$PATH_SEPARATOR/usr/xpg4/bin do IFS=$as_save_IFS case $as_dir in #((( '') as_dir=./ ;; */) ;; *) as_dir=$as_dir/ ;; esac for ac_prog in grep ggrep do for ac_exec_ext in '' $ac_executable_extensions; do ac_path_GREP="$as_dir$ac_prog$ac_exec_ext" as_fn_executable_p "$ac_path_GREP" || continue # Check for GNU ac_path_GREP and select it if it is found. # Check for GNU $ac_path_GREP case `"$ac_path_GREP" --version 2>&1` in *GNU*) ac_cv_path_GREP="$ac_path_GREP" ac_path_GREP_found=:;; *) ac_count=0 printf %s 0123456789 >"conftest.in" while : do cat "conftest.in" "conftest.in" >"conftest.tmp" mv "conftest.tmp" "conftest.in" cp "conftest.in" "conftest.nl" printf "%s\n" 'GREP' >> "conftest.nl" "$ac_path_GREP" -e 'GREP$' -e '-(cannot match)-' < "conftest.nl" >"conftest.out" 2>/dev/null || break diff "conftest.out" "conftest.nl" >/dev/null 2>&1 || break as_fn_arith $ac_count + 1 && ac_count=$as_val if test $ac_count -gt ${ac_path_GREP_max-0}; then # Best one so far, save it but keep looking for a better one ac_cv_path_GREP="$ac_path_GREP" ac_path_GREP_max=$ac_count fi # 10*(2^10) chars as input seems more than enough test $ac_count -gt 10 && break done rm -f conftest.in conftest.tmp conftest.nl conftest.out;; esac $ac_path_GREP_found && break 3 done done done IFS=$as_save_IFS if test -z "$ac_cv_path_GREP"; then as_fn_error $? "no acceptable grep could be found in $PATH$PATH_SEPARATOR/usr/xpg4/bin" "$LINENO" 5 fi else ac_cv_path_GREP=$GREP fi fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_GREP" >&5 printf "%s\n" "$ac_cv_path_GREP" >&6; } GREP="$ac_cv_path_GREP" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for egrep" >&5 printf %s "checking for egrep... " >&6; } if test ${ac_cv_path_EGREP+y} then : printf %s "(cached) " >&6 else $as_nop if echo a | $GREP -E '(a|b)' >/dev/null 2>&1 then ac_cv_path_EGREP="$GREP -E" else if test -z "$EGREP"; then ac_path_EGREP_found=false # Loop through the user's path and test for each of PROGNAME-LIST as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH$PATH_SEPARATOR/usr/xpg4/bin do IFS=$as_save_IFS case $as_dir in #((( '') as_dir=./ ;; */) ;; *) as_dir=$as_dir/ ;; esac for ac_prog in egrep do for ac_exec_ext in '' $ac_executable_extensions; do ac_path_EGREP="$as_dir$ac_prog$ac_exec_ext" as_fn_executable_p "$ac_path_EGREP" || continue # Check for GNU ac_path_EGREP and select it if it is found. # Check for GNU $ac_path_EGREP case `"$ac_path_EGREP" --version 2>&1` in *GNU*) ac_cv_path_EGREP="$ac_path_EGREP" ac_path_EGREP_found=:;; *) ac_count=0 printf %s 0123456789 >"conftest.in" while : do cat "conftest.in" "conftest.in" >"conftest.tmp" mv "conftest.tmp" "conftest.in" cp "conftest.in" "conftest.nl" printf "%s\n" 'EGREP' >> "conftest.nl" "$ac_path_EGREP" 'EGREP$' < "conftest.nl" >"conftest.out" 2>/dev/null || break diff "conftest.out" "conftest.nl" >/dev/null 2>&1 || break as_fn_arith $ac_count + 1 && ac_count=$as_val if test $ac_count -gt ${ac_path_EGREP_max-0}; then # Best one so far, save it but keep looking for a better one ac_cv_path_EGREP="$ac_path_EGREP" ac_path_EGREP_max=$ac_count fi # 10*(2^10) chars as input seems more than enough test $ac_count -gt 10 && break done rm -f conftest.in conftest.tmp conftest.nl conftest.out;; esac $ac_path_EGREP_found && break 3 done done done IFS=$as_save_IFS if test -z "$ac_cv_path_EGREP"; then as_fn_error $? "no acceptable egrep could be found in $PATH$PATH_SEPARATOR/usr/xpg4/bin" "$LINENO" 5 fi else ac_cv_path_EGREP=$EGREP fi fi fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_EGREP" >&5 printf "%s\n" "$ac_cv_path_EGREP" >&6; } EGREP="$ac_cv_path_EGREP" if test $ac_cv_c_compiler_gnu = yes; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether $CC needs -traditional" >&5 printf %s "checking whether $CC needs -traditional... " >&6; } if test ${ac_cv_prog_gcc_traditional+y} then : printf %s "(cached) " >&6 else $as_nop ac_pattern="Autoconf.*'x'" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include Autoconf TIOCGETP _ACEOF if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | $EGREP "$ac_pattern" >/dev/null 2>&1 then : ac_cv_prog_gcc_traditional=yes else $as_nop ac_cv_prog_gcc_traditional=no fi rm -rf conftest* if test $ac_cv_prog_gcc_traditional = no; then cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include Autoconf TCGETA _ACEOF if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | $EGREP "$ac_pattern" >/dev/null 2>&1 then : ac_cv_prog_gcc_traditional=yes fi rm -rf conftest* fi fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_gcc_traditional" >&5 printf "%s\n" "$ac_cv_prog_gcc_traditional" >&6; } if test $ac_cv_prog_gcc_traditional = yes; then CC="$CC -traditional" fi fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether we are using SUNPro C" >&5 printf %s "checking whether we are using SUNPro C... " >&6; } if test ${ac_cv_prog_suncc+y} then : printf %s "(cached) " >&6 else $as_nop cat > conftest.c <&5 (eval $ac_try) 2>&5 ac_status=$? printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; } | egrep yes >/dev/null 2>&1; then ac_cv_prog_suncc=yes else ac_cv_prog_suncc=no fi fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_suncc" >&5 printf "%s\n" "$ac_cv_prog_suncc" >&6; } if test -n "$ac_tool_prefix"; then # Extract the first word of "${ac_tool_prefix}ranlib", so it can be a program name with args. set dummy ${ac_tool_prefix}ranlib; ac_word=$2 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 printf %s "checking for $ac_word... " >&6; } if test ${ac_cv_prog_RANLIB+y} then : printf %s "(cached) " >&6 else $as_nop if test -n "$RANLIB"; then ac_cv_prog_RANLIB="$RANLIB" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS case $as_dir in #((( '') as_dir=./ ;; */) ;; *) as_dir=$as_dir/ ;; esac for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then ac_cv_prog_RANLIB="${ac_tool_prefix}ranlib" printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi RANLIB=$ac_cv_prog_RANLIB if test -n "$RANLIB"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $RANLIB" >&5 printf "%s\n" "$RANLIB" >&6; } else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi fi if test -z "$ac_cv_prog_RANLIB"; then ac_ct_RANLIB=$RANLIB # Extract the first word of "ranlib", so it can be a program name with args. set dummy ranlib; ac_word=$2 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 printf %s "checking for $ac_word... " >&6; } if test ${ac_cv_prog_ac_ct_RANLIB+y} then : printf %s "(cached) " >&6 else $as_nop if test -n "$ac_ct_RANLIB"; then ac_cv_prog_ac_ct_RANLIB="$ac_ct_RANLIB" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS case $as_dir in #((( '') as_dir=./ ;; */) ;; *) as_dir=$as_dir/ ;; esac for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then ac_cv_prog_ac_ct_RANLIB="ranlib" printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_RANLIB=$ac_cv_prog_ac_ct_RANLIB if test -n "$ac_ct_RANLIB"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_RANLIB" >&5 printf "%s\n" "$ac_ct_RANLIB" >&6; } else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi if test "x$ac_ct_RANLIB" = x; then RANLIB=":" else case $cross_compiling:$ac_tool_warned in yes:) { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac RANLIB=$ac_ct_RANLIB fi else RANLIB="$ac_cv_prog_RANLIB" fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking if compiler is clang" >&5 printf %s "checking if compiler is clang... " >&6; } if test ${ax_cv_cc_clang+y} then : printf %s "(cached) " >&6 else $as_nop cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main (void) { #ifndef __clang__ not clang #endif ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : ax_cv_cc_clang=yes else $as_nop ax_cv_cc_clang=no fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_cc_clang" >&5 printf "%s\n" "$ax_cv_cc_clang" >&6; } if test "x$ax_cv_cc_clang" = "xyes"; then clang_path="$CC" else clang_path="" fi if test "x$GCC" = "xyes"; then CFLAGS="$CFLAGS -Wall -std=c99 -D_GNU_SOURCE" fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for the compiler flag \"-Wno-unknown-warning-option\"" >&5 printf %s "checking for the compiler flag \"-Wno-unknown-warning-option\"... " >&6; } if test ${ax_cv_cc_no_unknown_warning_option_flag+y} then : printf %s "(cached) " >&6 else $as_nop CFLAGS_SAVED=$CFLAGS CFLAGS="-Werror -Wno-unknown-warning-option" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main (void) { /* * gcc will happily accept -Wno-unknown-warning-option * only emitting an error about it, if an error ocurrs in the source file. */ #if defined(__GNUC__) && !defined(__clang__) gcc sucks #endif return 0; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : ax_cv_cc_no_unknown_warning_option_flag=yes else $as_nop ax_cv_cc_no_unknown_warning_option_flag=no fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext CFLAGS="$CFLAGS_SAVED" fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_cc_no_unknown_warning_option_flag" >&5 printf "%s\n" "$ax_cv_cc_no_unknown_warning_option_flag" >&6; } if test "x$ax_cv_cc_no_unknown_warning_option_flag" = "xyes"; then CFLAGS="$CFLAGS -Wno-unknown-warning-option" fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for the compiler flag \"-Qunused-arguments\"" >&5 printf %s "checking for the compiler flag \"-Qunused-arguments\"... " >&6; } if test ${ax_cv_cc_qunused_arguments_flag+y} then : printf %s "(cached) " >&6 else $as_nop CFLAGS_SAVED=$CFLAGS CFLAGS="$CFLAGS -Werror -Qunused-arguments -foobar" ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main (void) { return 0; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : ax_cv_cc_qunused_arguments_flag="yes" else $as_nop ax_cv_cc_qunused_arguments_flag="no" fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu CFLAGS="$CFLAGS_SAVED" fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_cc_qunused_arguments_flag" >&5 printf "%s\n" "$ax_cv_cc_qunused_arguments_flag" >&6; } if test "x$ax_cv_cc_qunused_arguments_flag" = "xyes"; then CFLAGS="$CFLAGS -Qunused-arguments" LDFLAGS="$LDFLAGS -Qunused-arguments" fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for the compiler flag \"-Wno-date-time\"" >&5 printf %s "checking for the compiler flag \"-Wno-date-time\"... " >&6; } if test ${ax_cv_cc_no_date_time_flag+y} then : printf %s "(cached) " >&6 else $as_nop CFLAGS_SAVED=$CFLAGS CFLAGS="$CFLAGS -Werror -Wno-date-time" ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main (void) { return 0; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : ax_cv_cc_no_date_time_flag="yes" else $as_nop ax_cv_cc_no_date_time_flag="no" fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu CFLAGS="$CFLAGS_SAVED" fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_cc_no_date_time_flag" >&5 printf "%s\n" "$ax_cv_cc_no_date_time_flag" >&6; } # Check whether --enable-largefile was given. if test ${enable_largefile+y} then : enableval=$enable_largefile; fi if test "$enable_largefile" != no; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for special C compiler options needed for large files" >&5 printf %s "checking for special C compiler options needed for large files... " >&6; } if test ${ac_cv_sys_largefile_CC+y} then : printf %s "(cached) " >&6 else $as_nop ac_cv_sys_largefile_CC=no if test "$GCC" != yes; then ac_save_CC=$CC while :; do # IRIX 6.2 and later do not support large files by default, # so use the C compiler's -n32 option if that helps. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include /* Check that off_t can represent 2**63 - 1 correctly. We can't simply define LARGE_OFF_T to be 9223372036854775807, since some C++ compilers masquerading as C compilers incorrectly reject 9223372036854775807. */ #define LARGE_OFF_T (((off_t) 1 << 31 << 31) - 1 + ((off_t) 1 << 31 << 31)) int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721 && LARGE_OFF_T % 2147483647 == 1) ? 1 : -1]; int main (void) { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : break fi rm -f core conftest.err conftest.$ac_objext conftest.beam CC="$CC -n32" if ac_fn_c_try_compile "$LINENO" then : ac_cv_sys_largefile_CC=' -n32'; break fi rm -f core conftest.err conftest.$ac_objext conftest.beam break done CC=$ac_save_CC rm -f conftest.$ac_ext fi fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_sys_largefile_CC" >&5 printf "%s\n" "$ac_cv_sys_largefile_CC" >&6; } if test "$ac_cv_sys_largefile_CC" != no; then CC=$CC$ac_cv_sys_largefile_CC fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for _FILE_OFFSET_BITS value needed for large files" >&5 printf %s "checking for _FILE_OFFSET_BITS value needed for large files... " >&6; } if test ${ac_cv_sys_file_offset_bits+y} then : printf %s "(cached) " >&6 else $as_nop while :; do cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include /* Check that off_t can represent 2**63 - 1 correctly. We can't simply define LARGE_OFF_T to be 9223372036854775807, since some C++ compilers masquerading as C compilers incorrectly reject 9223372036854775807. */ #define LARGE_OFF_T (((off_t) 1 << 31 << 31) - 1 + ((off_t) 1 << 31 << 31)) int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721 && LARGE_OFF_T % 2147483647 == 1) ? 1 : -1]; int main (void) { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : ac_cv_sys_file_offset_bits=no; break fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #define _FILE_OFFSET_BITS 64 #include /* Check that off_t can represent 2**63 - 1 correctly. We can't simply define LARGE_OFF_T to be 9223372036854775807, since some C++ compilers masquerading as C compilers incorrectly reject 9223372036854775807. */ #define LARGE_OFF_T (((off_t) 1 << 31 << 31) - 1 + ((off_t) 1 << 31 << 31)) int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721 && LARGE_OFF_T % 2147483647 == 1) ? 1 : -1]; int main (void) { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : ac_cv_sys_file_offset_bits=64; break fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext ac_cv_sys_file_offset_bits=unknown break done fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_sys_file_offset_bits" >&5 printf "%s\n" "$ac_cv_sys_file_offset_bits" >&6; } case $ac_cv_sys_file_offset_bits in #( no | unknown) ;; *) printf "%s\n" "#define _FILE_OFFSET_BITS $ac_cv_sys_file_offset_bits" >>confdefs.h ;; esac rm -rf conftest* if test $ac_cv_sys_file_offset_bits = unknown; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for _LARGE_FILES value needed for large files" >&5 printf %s "checking for _LARGE_FILES value needed for large files... " >&6; } if test ${ac_cv_sys_large_files+y} then : printf %s "(cached) " >&6 else $as_nop while :; do cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include /* Check that off_t can represent 2**63 - 1 correctly. We can't simply define LARGE_OFF_T to be 9223372036854775807, since some C++ compilers masquerading as C compilers incorrectly reject 9223372036854775807. */ #define LARGE_OFF_T (((off_t) 1 << 31 << 31) - 1 + ((off_t) 1 << 31 << 31)) int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721 && LARGE_OFF_T % 2147483647 == 1) ? 1 : -1]; int main (void) { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : ac_cv_sys_large_files=no; break fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #define _LARGE_FILES 1 #include /* Check that off_t can represent 2**63 - 1 correctly. We can't simply define LARGE_OFF_T to be 9223372036854775807, since some C++ compilers masquerading as C compilers incorrectly reject 9223372036854775807. */ #define LARGE_OFF_T (((off_t) 1 << 31 << 31) - 1 + ((off_t) 1 << 31 << 31)) int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721 && LARGE_OFF_T % 2147483647 == 1) ? 1 : -1]; int main (void) { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : ac_cv_sys_large_files=1; break fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext ac_cv_sys_large_files=unknown break done fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_sys_large_files" >&5 printf "%s\n" "$ac_cv_sys_large_files" >&6; } case $ac_cv_sys_large_files in #( no | unknown) ;; *) printf "%s\n" "#define _LARGE_FILES $ac_cv_sys_large_files" >>confdefs.h ;; esac rm -rf conftest* fi fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether byte ordering is bigendian" >&5 printf %s "checking whether byte ordering is bigendian... " >&6; } if test ${ac_cv_c_bigendian+y} then : printf %s "(cached) " >&6 else $as_nop ac_cv_c_bigendian=unknown # See if we're dealing with a universal compiler. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #ifndef __APPLE_CC__ not a universal capable compiler #endif typedef int dummy; _ACEOF if ac_fn_c_try_compile "$LINENO" then : # Check for potential -arch flags. It is not universal unless # there are at least two -arch flags with different values. ac_arch= ac_prev= for ac_word in $CC $CFLAGS $CPPFLAGS $LDFLAGS; do if test -n "$ac_prev"; then case $ac_word in i?86 | x86_64 | ppc | ppc64) if test -z "$ac_arch" || test "$ac_arch" = "$ac_word"; then ac_arch=$ac_word else ac_cv_c_bigendian=universal break fi ;; esac ac_prev= elif test "x$ac_word" = "x-arch"; then ac_prev=arch fi done fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext if test $ac_cv_c_bigendian = unknown; then # See if sys/param.h defines the BYTE_ORDER macro. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include int main (void) { #if ! (defined BYTE_ORDER && defined BIG_ENDIAN \ && defined LITTLE_ENDIAN && BYTE_ORDER && BIG_ENDIAN \ && LITTLE_ENDIAN) bogus endian macros #endif ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : # It does; now see whether it defined to BIG_ENDIAN or not. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include int main (void) { #if BYTE_ORDER != BIG_ENDIAN not big endian #endif ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : ac_cv_c_bigendian=yes else $as_nop ac_cv_c_bigendian=no fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext fi if test $ac_cv_c_bigendian = unknown; then # See if defines _LITTLE_ENDIAN or _BIG_ENDIAN (e.g., Solaris). cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { #if ! (defined _LITTLE_ENDIAN || defined _BIG_ENDIAN) bogus endian macros #endif ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : # It does; now see whether it defined to _BIG_ENDIAN or not. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { #ifndef _BIG_ENDIAN not big endian #endif ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : ac_cv_c_bigendian=yes else $as_nop ac_cv_c_bigendian=no fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext fi if test $ac_cv_c_bigendian = unknown; then # Compile a test program. if test "$cross_compiling" = yes then : # Try to guess by grepping values from an object file. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ unsigned short int ascii_mm[] = { 0x4249, 0x4765, 0x6E44, 0x6961, 0x6E53, 0x7953, 0 }; unsigned short int ascii_ii[] = { 0x694C, 0x5454, 0x656C, 0x6E45, 0x6944, 0x6E61, 0 }; int use_ascii (int i) { return ascii_mm[i] + ascii_ii[i]; } unsigned short int ebcdic_ii[] = { 0x89D3, 0xE3E3, 0x8593, 0x95C5, 0x89C4, 0x9581, 0 }; unsigned short int ebcdic_mm[] = { 0xC2C9, 0xC785, 0x95C4, 0x8981, 0x95E2, 0xA8E2, 0 }; int use_ebcdic (int i) { return ebcdic_mm[i] + ebcdic_ii[i]; } extern int foo; int main (void) { return use_ascii (foo) == use_ebcdic (foo); ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : if grep BIGenDianSyS conftest.$ac_objext >/dev/null; then ac_cv_c_bigendian=yes fi if grep LiTTleEnDian conftest.$ac_objext >/dev/null ; then if test "$ac_cv_c_bigendian" = unknown; then ac_cv_c_bigendian=no else # finding both strings is unlikely to happen, but who knows? ac_cv_c_bigendian=unknown fi fi fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext else $as_nop cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ $ac_includes_default int main (void) { /* Are we little or big endian? From Harbison&Steele. */ union { long int l; char c[sizeof (long int)]; } u; u.l = 1; return u.c[sizeof (long int) - 1] == 1; ; return 0; } _ACEOF if ac_fn_c_try_run "$LINENO" then : ac_cv_c_bigendian=no else $as_nop ac_cv_c_bigendian=yes fi rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \ conftest.$ac_objext conftest.beam conftest.$ac_ext fi fi fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_bigendian" >&5 printf "%s\n" "$ac_cv_c_bigendian" >&6; } case $ac_cv_c_bigendian in #( yes) printf "%s\n" "#define FR_BIG_ENDIAN 1" >>confdefs.h ;; #( no) printf "%s\n" "#define FR_LITTLE_ENDIAN 1" >>confdefs.h ;; #( universal) printf "%s\n" "#define AC_APPLE_UNIVERSAL_BUILD 1" >>confdefs.h ;; #( *) as_fn_error $? "unknown endianness presetting ac_cv_c_bigendian=no (or yes) will help" "$LINENO" 5 ;; esac # Extract the first word of "gmake", so it can be a program name with args. set dummy gmake; ac_word=$2 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 printf %s "checking for $ac_word... " >&6; } if test ${ac_cv_prog_GMAKE+y} then : printf %s "(cached) " >&6 else $as_nop if test -n "$GMAKE"; then ac_cv_prog_GMAKE="$GMAKE" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS case $as_dir in #((( '') as_dir=./ ;; */) ;; *) as_dir=$as_dir/ ;; esac for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then ac_cv_prog_GMAKE="yes" printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS test -z "$ac_cv_prog_GMAKE" && ac_cv_prog_GMAKE="no" fi fi GMAKE=$ac_cv_prog_GMAKE if test -n "$GMAKE"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $GMAKE" >&5 printf "%s\n" "$GMAKE" >&6; } else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi if test $GMAKE = no; then # Extract the first word of "make", so it can be a program name with args. set dummy make; ac_word=$2 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 printf %s "checking for $ac_word... " >&6; } if test ${ac_cv_path_MAKE+y} then : printf %s "(cached) " >&6 else $as_nop case $MAKE in [\\/]* | ?:[\\/]*) ac_cv_path_MAKE="$MAKE" # Let the user override the test with a path. ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS case $as_dir in #((( '') as_dir=./ ;; */) ;; *) as_dir=$as_dir/ ;; esac for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then ac_cv_path_MAKE="$as_dir$ac_word$ac_exec_ext" printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS test -z "$ac_cv_path_MAKE" && ac_cv_path_MAKE="/usr/local/bin/make" ;; esac fi MAKE=$ac_cv_path_MAKE if test -n "$MAKE"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $MAKE" >&5 printf "%s\n" "$MAKE" >&6; } else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi else # Extract the first word of "gmake", so it can be a program name with args. set dummy gmake; ac_word=$2 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 printf %s "checking for $ac_word... " >&6; } if test ${ac_cv_path_MAKE+y} then : printf %s "(cached) " >&6 else $as_nop case $MAKE in [\\/]* | ?:[\\/]*) ac_cv_path_MAKE="$MAKE" # Let the user override the test with a path. ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS case $as_dir in #((( '') as_dir=./ ;; */) ;; *) as_dir=$as_dir/ ;; esac for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then ac_cv_path_MAKE="$as_dir$ac_word$ac_exec_ext" printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS test -z "$ac_cv_path_MAKE" && ac_cv_path_MAKE="/usr/local/gnu/bin/make" ;; esac fi MAKE=$ac_cv_path_MAKE if test -n "$MAKE"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $MAKE" >&5 printf "%s\n" "$MAKE" >&6; } else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi fi makever=`$ac_cv_path_MAKE --version 2>&1 | grep "GNU Make"` if test -z "$makever"; then as_fn_error $? "GNU Make is not installed. Please download and install it from ftp://prep.ai.mit.edu/pub/gnu/make/ before continuing." "$LINENO" 5 fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking number of system cores" >&5 printf %s "checking number of system cores... " >&6; } if test ${ax_cv_system_cores+y} then : printf %s "(cached) " >&6 else $as_nop ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu if test "$cross_compiling" = yes then : ax_cv_system_cores= else $as_nop cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include #ifdef _WIN32 # include #elif MACOS # include # include #else # include #endif int main (int argc, char *argv[]) { uint32_t count; #ifdef WIN32 SYSTEM_INFO sysinfo; GetSystemInfo(&sysinfo); count = sysinfo.dwNumberOfProcessors; #elif MACOS int nm[2]; size_t len = 4; nm[0] = CTL_HW; nm[1] = HW_AVAILCPU; sysctl(nm, 2, &count, &len, NULL, 0); if(count < 1) { nm[1] = HW_NCPU; sysctl(nm, 2, &count, &len, NULL, 0); if(count < 1) { count = 1; } } #else count = sysconf(_SC_NPROCESSORS_ONLN); #endif return count; } _ACEOF if ac_fn_c_try_run "$LINENO" then : ax_cv_system_cores=$? else $as_nop ax_cv_system_cores=$? fi rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \ conftest.$ac_objext conftest.beam conftest.$ac_ext fi ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_system_cores" >&5 printf "%s\n" "$ax_cv_system_cores" >&6; } # Extract the first word of "git", so it can be a program name with args. set dummy git; ac_word=$2 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 printf %s "checking for $ac_word... " >&6; } if test ${ac_cv_prog_GIT+y} then : printf %s "(cached) " >&6 else $as_nop if test -n "$GIT"; then ac_cv_prog_GIT="$GIT" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS case $as_dir in #((( '') as_dir=./ ;; */) ;; *) as_dir=$as_dir/ ;; esac for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then ac_cv_prog_GIT="yes" printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS test -z "$ac_cv_prog_GIT" && ac_cv_prog_GIT="no" fi fi GIT=$ac_cv_prog_GIT if test -n "$GIT"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $GIT" >&5 printf "%s\n" "$GIT" >&6; } else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi # Check whether --enable-strict-dependencies was given. if test ${enable_strict_dependencies+y} then : enableval=$enable_strict_dependencies; fi # Check whether --enable-werror was given. if test ${enable_werror+y} then : enableval=$enable_werror; case "$enableval" in no) werror=no ;; *) werror=yes esac fi docdir='${datadir}/doc/freeradius' { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking docdir" >&5 printf %s "checking docdir... " >&6; } # Check whether --with-docdir was given. if test ${with_docdir+y} then : withval=$with_docdir; case "$withval" in no) docdir=no ;; yes) ;; [\\/$]* | ?:[\\/]* ) docdir="$withval" ;; *) as_fn_error $? "expected an absolute directory name for --with-docdir: $withval" "$LINENO" 5 ;; esac fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $docdir" >&5 printf "%s\n" "$docdir" >&6; } if test "x$docdir" = xno; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: Documentation files will NOT be installed." >&5 printf "%s\n" "$as_me: WARNING: Documentation files will NOT be installed." >&2;} fi logdir='${localstatedir}/log/radius' { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking logdir" >&5 printf %s "checking logdir... " >&6; } # Check whether --with-logdir was given. if test ${with_logdir+y} then : withval=$with_logdir; case "$withval" in no) as_fn_error $? "Need logdir" "$LINENO" 5 ;; yes) ;; [\\/$]* | ?:[\\/]* ) logdir="$withval" ;; *) as_fn_error $? "expected an absolute directory name for --with-logdir: $withval" "$LINENO" 5 ;; esac fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $logdir" >&5 printf "%s\n" "$logdir" >&6; } radacctdir='${logdir}/radacct' { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking radacctdir" >&5 printf %s "checking radacctdir... " >&6; } # Check whether --with-radacctdir was given. if test ${with_radacctdir+y} then : withval=$with_radacctdir; case "$withval" in no) as_fn_error $? "Need radacctdir" "$LINENO" 5 ;; yes) ;; [\\/$]* | ?:[\\/]* ) radacctdir="$withval" ;; *) as_fn_error $? "expected an absolute directory name for --with-radacctdir: $withval" "$LINENO" 5 ;; esac fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $radacctdir" >&5 printf "%s\n" "$radacctdir" >&6; } raddbdir='${sysconfdir}/raddb' { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking raddbdir" >&5 printf %s "checking raddbdir... " >&6; } # Check whether --with-raddbdir was given. if test ${with_raddbdir+y} then : withval=$with_raddbdir; case "$withval" in no) as_fn_error $? "Need raddbdir" "$LINENO" 5 ;; yes) ;; [\\/$]* | ?:[\\/]* ) raddbdir="$withval" ;; *) as_fn_error $? "expected an absolute directory name for --with-raddbdir: $withval" "$LINENO" 5 ;; esac fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $raddbdir" >&5 printf "%s\n" "$raddbdir" >&6; } dictdir='${datarootdir}/freeradius' { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking dictdir" >&5 printf %s "checking dictdir... " >&6; } # Check whether --with-dictdir was given. if test ${with_dictdir+y} then : withval=$with_dictdir; case "$withval" in no) as_fn_error $? "Need dictdir" "$LINENO" 5 ;; yes) ;; [\\/$]* | ?:[\\/]* ) dictdir="$withval" ;; *) as_fn_error $? "expected an absolute directory name for --with-dictdir: $withval" "$LINENO" 5 ;; esac fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $dictdir" >&5 printf "%s\n" "$dictdir" >&6; } modconfdir='${raddbdir}/mods-config' WITH_ASCEND_BINARY=yes # Check whether --with-ascend-binary was given. if test ${with_ascend_binary+y} then : withval=$with_ascend_binary; case "$withval" in yes) ;; *) WITH_ASCEND_BINARY=no esac fi if test "x$WITH_ASCEND_BINARY" = "xyes"; then printf "%s\n" "#define WITH_ASCEND_BINARY 1" >>confdefs.h fi WITH_RADIUSV11= # Check whether --with-radiusv11 was given. if test ${with_radiusv11+y} then : withval=$with_radiusv11; case "$withval" in yes) WITH_RADIUSV11=yes ;; *) ;; esac fi if test "x$WITH_RADIUSCV11" = "xyes"; then printf "%s\n" "#define WITH_RADIUSV11 1" >>confdefs.h fi WITH_THREADS=yes # Check whether --with-threads was given. if test ${with_threads+y} then : withval=$with_threads; case "$withval" in yes) ;; *) WITH_THREADS=no esac fi WITH_TCP=yes # Check whether --with-tcp was given. if test ${with_tcp+y} then : withval=$with_tcp; case "$withval" in yes) ;; *) WITH_TCP=no esac fi if test "x$WITH_TCP" = "xyes"; then printf "%s\n" "#define WITH_TCP 1" >>confdefs.h fi WITH_VMPS=yes # Check whether --with-vmps was given. if test ${with_vmps+y} then : withval=$with_vmps; case "$withval" in yes) ;; *) WITH_VMPS=no esac fi if test "x$WITH_VMPS" = "xyes"; then printf "%s\n" "#define WITH_VMPS 1" >>confdefs.h fi WITH_DHCP=yes # Check whether --with-dhcp was given. if test ${with_dhcp+y} then : withval=$with_dhcp; case "$withval" in yes) ;; *) WITH_DHCP=no esac fi if test "x$WITH_DHCP" = "xyes"; then printf "%s\n" "#define WITH_DHCP 1" >>confdefs.h fi MANSKIP= WITH_RADLAST= # Check whether --with-radlast was given. if test ${with_radlast+y} then : withval=$with_radlast; case "$withval" in yes) WITH_RADLAST=yes ;; *) WITH_RADLAST=no esac fi STATIC_MODULES= # Check whether --with-static_modules was given. if test ${with_static_modules+y} then : withval=$with_static_modules; for i in $withval; do STATIC_MODULES="$STATIC_MODULES -dlpreopen ../modules/rlm_$i/rlm_$i.la" done fi USE_SHARED_LIBS=yes # Check whether --with-shared-libs was given. if test ${with_shared_libs+y} then : withval=$with_shared_libs; case "$withval" in no) USE_SHARED_LIBS=no ;; *) esac fi MODULES= # Check whether --with-modules was given. if test ${with_modules+y} then : withval=$with_modules; for i in $withval; do MODULES="$MODULES $i" done fi EXPERIMENTAL= # Check whether --with-experimental-modules was given. if test ${with_experimental_modules+y} then : withval=$with_experimental_modules; case "$withval" in yes) EXPERIMENTAL=yes ;; no) EXPERIMENTAL=no ;; *) esac fi WITH_UDPFROMTO=yes # Check whether --with-udpfromto was given. if test ${with_udpfromto+y} then : withval=$with_udpfromto; case "$withval" in yes) WITH_UDPFROMTO=yes ;; *) WITH_UDPFROMTO=no esac fi if test "x$WITH_UDPFROMTO" = "xyes"; then printf "%s\n" "#define WITH_UDPFROMTO /**/" >>confdefs.h fi # Check whether --with-rlm-FOO-lib-dir was given. if test ${with_rlm_FOO_lib_dir+y} then : withval=$with_rlm_FOO_lib_dir; case "$withval" in *) ;; esac fi # Check whether --with-rlm-FOO-include-dir was given. if test ${with_rlm_FOO_include_dir+y} then : withval=$with_rlm_FOO_include_dir; case "$withval" in *) ;; esac fi WITH_OPENSSL=yes # Check whether --with-openssl was given. if test ${with_openssl+y} then : withval=$with_openssl; case "$withval" in no) WITH_OPENSSL=no ;; *) WITH_OPENSSL=yes ;; esac fi if test "x$WITH_THREADS" = "xno"; then if test "x$WITH_OPENSSL" = "xyes"; then as_fn_error $? "Threads are required when using OpenSSL, use --with-threads=yes" "$LINENO" 5 fi fi openssl_lib_dir= # Check whether --with-openssl-lib-dir was given. if test ${with_openssl_lib_dir+y} then : withval=$with_openssl_lib_dir; case "$withval" in *) openssl_lib_dir="$withval" ;; esac fi openssl_include_dir= # Check whether --with-openssl-include-dir was given. if test ${with_openssl_include_dir+y} then : withval=$with_openssl_include_dir; case "$withval" in *) openssl_include_dir="$withval" ;; esac fi # Check whether --enable-openssl-version-check was given. if test ${enable_openssl_version_check+y} then : enableval=$enable_openssl_version_check; fi if test "x$enable_openssl_version_check" != "xno"; then printf "%s\n" "#define ENABLE_OPENSSL_VERSION_CHECK 1" >>confdefs.h openssl_version_check_config="\ # # allow_vulnerable_openssl: Allow the server to start with # versions of OpenSSL known to have critical vulnerabilities. # # This check is based on the version number reported by libssl # and may not reflect patches applied to libssl by # distribution maintainers. # allow_vulnerable_openssl = no" else openssl_version_check_config= fi # Check whether --enable-reproducible-builds was given. if test ${enable_reproducible_builds+y} then : enableval=$enable_reproducible_builds; case "$enableval" in yes) printf "%s\n" "#define ENABLE_REPRODUCIBLE_BUILDS 1" >>confdefs.h reproducible_builds=yes ;; *) reproducible_builds=no esac fi # Check whether --enable-fuzzer was given. if test ${enable_fuzzer+y} then : enableval=$enable_fuzzer; case "$enableval" in no) fuzzer=no ;; *) fuzzer=yes esac fi # Check whether --enable-address-sanitizer was given. if test ${enable_address_sanitizer+y} then : enableval=$enable_address_sanitizer; case "$enableval" in no) address_sanitizer=no ;; *) address_sanitizer=yes esac fi # Check whether --enable-leak-sanitizer was given. if test ${enable_leak_sanitizer+y} then : enableval=$enable_leak_sanitizer; case "$enableval" in no) leak_sanitizer=no ;; *) leak_sanitizer=yes esac fi # Check whether --enable-thread-sanitizer was given. if test ${enable_thread_sanitizer+y} then : enableval=$enable_thread_sanitizer; case "$enableval" in no) thread_sanitizer=no ;; *) thread_sanitizer=yes esac fi # Check whether --enable-undefined-behaviour-sanitizer was given. if test ${enable_undefined_behaviour_sanitizer+y} then : enableval=$enable_undefined_behaviour_sanitizer; case "$enableval" in no) undefined_behaviour_sanitizer=no ;; *) undefined_behaviour_sanitizer=yes esac fi CHECKRAD=checkrad # Extract the first word of "perl", so it can be a program name with args. set dummy perl; ac_word=$2 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 printf %s "checking for $ac_word... " >&6; } if test ${ac_cv_path_PERL+y} then : printf %s "(cached) " >&6 else $as_nop case $PERL in [\\/]* | ?:[\\/]*) ac_cv_path_PERL="$PERL" # Let the user override the test with a path. ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS case $as_dir in #((( '') as_dir=./ ;; */) ;; *) as_dir=$as_dir/ ;; esac for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then ac_cv_path_PERL="$as_dir$ac_word$ac_exec_ext" printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS test -z "$ac_cv_path_PERL" && ac_cv_path_PERL="/usr/local/bin/perl" ;; esac fi PERL=$ac_cv_path_PERL if test -n "$PERL"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $PERL" >&5 printf "%s\n" "$PERL" >&6; } else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi if test "x$ac_cv_path_PERL" = "x"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: perl not found - Simultaneous-Use and checkrad may not work" >&5 printf "%s\n" "$as_me: WARNING: perl not found - Simultaneous-Use and checkrad may not work" >&2;} fi # Extract the first word of "snmpget", so it can be a program name with args. set dummy snmpget; ac_word=$2 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 printf %s "checking for $ac_word... " >&6; } if test ${ac_cv_path_SNMPGET+y} then : printf %s "(cached) " >&6 else $as_nop case $SNMPGET in [\\/]* | ?:[\\/]*) ac_cv_path_SNMPGET="$SNMPGET" # Let the user override the test with a path. ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS case $as_dir in #((( '') as_dir=./ ;; */) ;; *) as_dir=$as_dir/ ;; esac for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then ac_cv_path_SNMPGET="$as_dir$ac_word$ac_exec_ext" printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS ;; esac fi SNMPGET=$ac_cv_path_SNMPGET if test -n "$SNMPGET"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $SNMPGET" >&5 printf "%s\n" "$SNMPGET" >&6; } else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi if test "x$ac_cv_path_SNMPGET" = "x"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: snmpget not found - Simultaneous-Use and checkrad may not work" >&5 printf "%s\n" "$as_me: WARNING: snmpget not found - Simultaneous-Use and checkrad may not work" >&2;} fi # Extract the first word of "snmpwalk", so it can be a program name with args. set dummy snmpwalk; ac_word=$2 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 printf %s "checking for $ac_word... " >&6; } if test ${ac_cv_path_SNMPWALK+y} then : printf %s "(cached) " >&6 else $as_nop case $SNMPWALK in [\\/]* | ?:[\\/]*) ac_cv_path_SNMPWALK="$SNMPWALK" # Let the user override the test with a path. ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS case $as_dir in #((( '') as_dir=./ ;; */) ;; *) as_dir=$as_dir/ ;; esac for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then ac_cv_path_SNMPWALK="$as_dir$ac_word$ac_exec_ext" printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS ;; esac fi SNMPWALK=$ac_cv_path_SNMPWALK if test -n "$SNMPWALK"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $SNMPWALK" >&5 printf "%s\n" "$SNMPWALK" >&6; } else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi if test "x$ac_cv_path_SNMPWALK" = "x"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: snmpwalk not found - Simultaneous-Use and checkrad may not work" >&5 printf "%s\n" "$as_me: WARNING: snmpwalk not found - Simultaneous-Use and checkrad may not work" >&2;} fi # Extract the first word of "rusers", so it can be a program name with args. set dummy rusers; ac_word=$2 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 printf %s "checking for $ac_word... " >&6; } if test ${ac_cv_path_RUSERS+y} then : printf %s "(cached) " >&6 else $as_nop case $RUSERS in [\\/]* | ?:[\\/]*) ac_cv_path_RUSERS="$RUSERS" # Let the user override the test with a path. ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS case $as_dir in #((( '') as_dir=./ ;; */) ;; *) as_dir=$as_dir/ ;; esac for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then ac_cv_path_RUSERS="$as_dir$ac_word$ac_exec_ext" printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS test -z "$ac_cv_path_RUSERS" && ac_cv_path_RUSERS="/usr/bin/rusers" ;; esac fi RUSERS=$ac_cv_path_RUSERS if test -n "$RUSERS"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $RUSERS" >&5 printf "%s\n" "$RUSERS" >&6; } else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi if test "x$WITH_RADLAST" = "x"; then # Extract the first word of "last", so it can be a program name with args. set dummy last; ac_word=$2 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 printf %s "checking for $ac_word... " >&6; } if test ${ac_cv_prog_LAST+y} then : printf %s "(cached) " >&6 else $as_nop if test -n "$LAST"; then ac_cv_prog_LAST="$LAST" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS case $as_dir in #((( '') as_dir=./ ;; */) ;; *) as_dir=$as_dir/ ;; esac for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then ac_cv_prog_LAST="yes" printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS test -z "$ac_cv_prog_LAST" && ac_cv_prog_LAST="no" fi fi LAST=$ac_cv_prog_LAST if test -n "$LAST"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $LAST" >&5 printf "%s\n" "$LAST" >&6; } else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi WITH_RADLAST="$LAST" fi if test "x$WITH_RADLAST" != "xyes"; then MANSKIP="$MANSKIP man/man1/radlast.1" fi missing_dir=`cd $ac_aux_dir && pwd` # Expand $ac_aux_dir to an absolute path. am_aux_dir=`cd "$ac_aux_dir" && pwd` if test x"${MISSING+set}" != xset; then MISSING="\${SHELL} '$am_aux_dir/missing'" fi # Use eval to expand $SHELL if eval "$MISSING --is-lightweight"; then am_missing_run="$MISSING " else am_missing_run= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: 'missing' script is too old or missing" >&5 printf "%s\n" "$as_me: WARNING: 'missing' script is too old or missing" >&2;} fi ACLOCAL=${ACLOCAL-"${am_missing_run}aclocal"} AUTOCONF=${AUTOCONF-"${am_missing_run}autoconf"} AUTOHEADER=${AUTOHEADER-"${am_missing_run}autoheader"} # Extract the first word of "dirname", so it can be a program name with args. set dummy dirname; ac_word=$2 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 printf %s "checking for $ac_word... " >&6; } if test ${ac_cv_path_DIRNAME+y} then : printf %s "(cached) " >&6 else $as_nop case $DIRNAME in [\\/]* | ?:[\\/]*) ac_cv_path_DIRNAME="$DIRNAME" # Let the user override the test with a path. ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS case $as_dir in #((( '') as_dir=./ ;; */) ;; *) as_dir=$as_dir/ ;; esac for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then ac_cv_path_DIRNAME="$as_dir$ac_word$ac_exec_ext" printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS ;; esac fi DIRNAME=$ac_cv_path_DIRNAME if test -n "$DIRNAME"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $DIRNAME" >&5 printf "%s\n" "$DIRNAME" >&6; } else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi # Extract the first word of "grep", so it can be a program name with args. set dummy grep; ac_word=$2 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 printf %s "checking for $ac_word... " >&6; } if test ${ac_cv_path_GREP+y} then : printf %s "(cached) " >&6 else $as_nop case $GREP in [\\/]* | ?:[\\/]*) ac_cv_path_GREP="$GREP" # Let the user override the test with a path. ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS case $as_dir in #((( '') as_dir=./ ;; */) ;; *) as_dir=$as_dir/ ;; esac for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then ac_cv_path_GREP="$as_dir$ac_word$ac_exec_ext" printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS ;; esac fi GREP=$ac_cv_path_GREP if test -n "$GREP"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $GREP" >&5 printf "%s\n" "$GREP" >&6; } else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi talloc_lib_dir= # Check whether --with-talloc-lib-dir was given. if test ${with_talloc_lib_dir+y} then : withval=$with_talloc_lib_dir; case "$withval" in no) as_fn_error $? "Need talloc-lib-dir" "$LINENO" 5 ;; yes) ;; *) talloc_lib_dir="$withval" ;; esac fi talloc_include_dir= # Check whether --with-talloc-include-dir was given. if test ${with_talloc_include_dir+y} then : withval=$with_talloc_include_dir; case "$withval" in no) as_fn_error $? "Need talloc-include-dir" "$LINENO" 5 ;; yes) ;; *) talloc_include_dir="$withval" ;; esac fi smart_try_dir="$talloc_lib_dir" sm_lib_safe=`echo "talloc" | sed 'y%./+-%__p_%'` sm_func_safe=`echo "_talloc" | sed 'y%./+-%__p_%'` old_LIBS="$LIBS" old_CPPFLAGS="$CPPFLAGS" smart_lib= smart_ldflags= smart_lib_dir= if test "x$smart_try_dir" != "x"; then for try in $smart_try_dir; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for _talloc in -ltalloc in $try" >&5 printf %s "checking for _talloc in -ltalloc in $try... " >&6; } LIBS="-ltalloc $old_LIBS" CPPFLAGS="-L$try -Wl,-rpath,$try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ extern char _talloc(); int main (void) { _talloc() ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : smart_lib="-ltalloc" smart_ldflags="-L$try -Wl,-rpath,$try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext done LIBS="$old_LIBS" CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_lib" = "x"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for _talloc in -ltalloc" >&5 printf %s "checking for _talloc in -ltalloc... " >&6; } LIBS="-ltalloc $old_LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ extern char _talloc(); int main (void) { _talloc() ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : smart_lib="-ltalloc" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext LIBS="$old_LIBS" fi if test "x$smart_lib" = "x"; then for try in /usr/local/lib /opt/lib; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for _talloc in -ltalloc in $try" >&5 printf %s "checking for _talloc in -ltalloc in $try... " >&6; } LIBS="-ltalloc $old_LIBS" CPPFLAGS="-L$try -Wl,-rpath,$try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ extern char _talloc(); int main (void) { _talloc() ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : smart_lib="-ltalloc" smart_ldflags="-L$try -Wl,-rpath,$try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext done LIBS="$old_LIBS" CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_lib" != "x"; then eval "ac_cv_lib_${sm_lib_safe}_${sm_func_safe}=yes" LIBS="$smart_ldflags $smart_lib $old_LIBS" SMART_LIBS="$smart_ldflags $smart_lib $SMART_LIBS" fi if test "x$ac_cv_lib_talloc__talloc" != "xyes"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: talloc library not found. Use --with-talloc-lib-dir=." >&5 printf "%s\n" "$as_me: WARNING: talloc library not found. Use --with-talloc-lib-dir=." >&2;} as_fn_error $? "FreeRADIUS requires libtalloc" "$LINENO" 5 fi TALLOC_LIBS="${smart_lib}" TALLOC_LDFLAGS="${smart_ldflags}" LIBS="$old_LIBS" old_CFLAGS=$CFLAGS if test "x$WITH_THREADS" = "xyes"; then if test $ac_cv_prog_suncc = "yes"; then CFLAGS="$CFLAGS -mt" fi for ac_header in pthread.h do : ac_fn_c_check_header_compile "$LINENO" "pthread.h" "ac_cv_header_pthread_h" "$ac_includes_default" if test "x$ac_cv_header_pthread_h" = xyes then : printf "%s\n" "#define HAVE_PTHREAD_H 1" >>confdefs.h else $as_nop WITH_THREADS="no" fail=pthread.h fi done if test "x$WITH_THREADS" != "xno"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for pthread_create in -lpthread" >&5 printf %s "checking for pthread_create in -lpthread... " >&6; } if test ${ac_cv_lib_pthread_pthread_create+y} then : printf %s "(cached) " >&6 else $as_nop ac_check_lib_save_LIBS=$LIBS LIBS="-lpthread $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ char pthread_create (); int main (void) { return pthread_create (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : ac_cv_lib_pthread_pthread_create=yes else $as_nop ac_cv_lib_pthread_pthread_create=no fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_pthread_pthread_create" >&5 printf "%s\n" "$ac_cv_lib_pthread_pthread_create" >&6; } if test "x$ac_cv_lib_pthread_pthread_create" = xyes then : HAVE_LPTHREAD='yes' CFLAGS="$CFLAGS -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS" LIBS="-lpthread $LIBS" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for the compiler flag \"-pthread\"" >&5 printf %s "checking for the compiler flag \"-pthread\"... " >&6; } if test ${ax_cv_cc_pthread_flag+y} then : printf %s "(cached) " >&6 else $as_nop CFLAGS_SAVED=$CFLAGS CFLAGS="$CFLAGS -Werror -pthread" ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main (void) { return 0; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : ax_cv_cc_pthread_flag="yes" else $as_nop ax_cv_cc_pthread_flag="no" fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu CFLAGS="$CFLAGS_SAVED" fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_cc_pthread_flag" >&5 printf "%s\n" "$ax_cv_cc_pthread_flag" >&6; } if test "x$ax_cv_cc_pthread_flag" != 'xyes'; then CFLAGS="$CFLAGS -pthread" fi fi if test "x$HAVE_LPTHREAD" != "xyes"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for pthread_create in -lc_r" >&5 printf %s "checking for pthread_create in -lc_r... " >&6; } if test ${ac_cv_lib_c_r_pthread_create+y} then : printf %s "(cached) " >&6 else $as_nop ac_check_lib_save_LIBS=$LIBS LIBS="-lc_r $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ char pthread_create (); int main (void) { return pthread_create (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : ac_cv_lib_c_r_pthread_create=yes else $as_nop ac_cv_lib_c_r_pthread_create=no fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_c_r_pthread_create" >&5 printf "%s\n" "$ac_cv_lib_c_r_pthread_create" >&6; } if test "x$ac_cv_lib_c_r_pthread_create" = xyes then : CFLAGS="$CFLAGS -D_THREAD_SAFE" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for the compiler flag \"-pthread\"" >&5 printf %s "checking for the compiler flag \"-pthread\"... " >&6; } if test ${ax_cv_cc_pthread_flag+y} then : printf %s "(cached) " >&6 else $as_nop CFLAGS_SAVED=$CFLAGS CFLAGS="$CFLAGS -Werror -pthread" ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main (void) { return 0; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : ax_cv_cc_pthread_flag="yes" else $as_nop ax_cv_cc_pthread_flag="no" fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu CFLAGS="$CFLAGS_SAVED" fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_cc_pthread_flag" >&5 printf "%s\n" "$ax_cv_cc_pthread_flag" >&6; } if test "x$ax_cv_cc_pthread_flag" != 'xyes'; then LIBS="-lc_r $LIBS" else CFLAGS="$CFLAGS -pthread" fi else $as_nop fail=-lc_r or -lpthread fi fi fi if test "x$WITH_THREADS" != "xyes"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: silently not building with thread support." >&5 printf "%s\n" "$as_me: WARNING: silently not building with thread support." >&2;} { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: FAILURE: thread support requires: $fail." >&5 printf "%s\n" "$as_me: WARNING: FAILURE: thread support requires: $fail." >&2;} else printf "%s\n" "#define WITH_THREADS 1" >>confdefs.h fi fi if test "x$WITH_THREADS" != "xyes"; then CFLAGS=$old_CFLAGS ac_cv_header_pthread_h="no" WITH_THREADS=no else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for library containing sem_init" >&5 printf %s "checking for library containing sem_init... " >&6; } if test ${ac_cv_search_sem_init+y} then : printf %s "(cached) " >&6 else $as_nop ac_func_search_save_LIBS=$LIBS cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ char sem_init (); int main (void) { return sem_init (); ; return 0; } _ACEOF for ac_lib in '' pthread sem posix4 rt semaphore do if test -z "$ac_lib"; then ac_res="none required" else ac_res=-l$ac_lib LIBS="-l$ac_lib $ac_func_search_save_LIBS" fi if ac_fn_c_try_link "$LINENO" then : ac_cv_search_sem_init=$ac_res fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext if test ${ac_cv_search_sem_init+y} then : break fi done if test ${ac_cv_search_sem_init+y} then : else $as_nop ac_cv_search_sem_init=no fi rm conftest.$ac_ext LIBS=$ac_func_search_save_LIBS fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_sem_init" >&5 printf "%s\n" "$ac_cv_search_sem_init" >&6; } ac_res=$ac_cv_search_sem_init if test "$ac_res" != no then : test "$ac_res" = "none required" || LIBS="$ac_res $LIBS" else $as_nop as_fn_error $? "-lsem not found. You may want to download it from ftp://ftp.to.gd-es.com/pub/BSDI/libsem.tar.bz2 or https://www.freeradius.org/ftp/pub/radius/contrib/libsem.tar.gz" "$LINENO" 5 fi fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for dlopen in -ldl" >&5 printf %s "checking for dlopen in -ldl... " >&6; } if test ${ac_cv_lib_dl_dlopen+y} then : printf %s "(cached) " >&6 else $as_nop ac_check_lib_save_LIBS=$LIBS LIBS="-ldl $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ char dlopen (); int main (void) { return dlopen (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : ac_cv_lib_dl_dlopen=yes else $as_nop ac_cv_lib_dl_dlopen=no fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_dl_dlopen" >&5 printf "%s\n" "$ac_cv_lib_dl_dlopen" >&6; } if test "x$ac_cv_lib_dl_dlopen" = xyes then : printf "%s\n" "#define HAVE_LIBDL 1" >>confdefs.h LIBS="-ldl $LIBS" fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for getsockname in -lsocket" >&5 printf %s "checking for getsockname in -lsocket... " >&6; } if test ${ac_cv_lib_socket_getsockname+y} then : printf %s "(cached) " >&6 else $as_nop ac_check_lib_save_LIBS=$LIBS LIBS="-lsocket $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ char getsockname (); int main (void) { return getsockname (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : ac_cv_lib_socket_getsockname=yes else $as_nop ac_cv_lib_socket_getsockname=no fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_socket_getsockname" >&5 printf "%s\n" "$ac_cv_lib_socket_getsockname" >&6; } if test "x$ac_cv_lib_socket_getsockname" = xyes then : printf "%s\n" "#define HAVE_LIBSOCKET 1" >>confdefs.h LIBS="-lsocket $LIBS" fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for inet_aton in -lresolv" >&5 printf %s "checking for inet_aton in -lresolv... " >&6; } if test ${ac_cv_lib_resolv_inet_aton+y} then : printf %s "(cached) " >&6 else $as_nop ac_check_lib_save_LIBS=$LIBS LIBS="-lresolv $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ char inet_aton (); int main (void) { return inet_aton (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : ac_cv_lib_resolv_inet_aton=yes else $as_nop ac_cv_lib_resolv_inet_aton=no fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_resolv_inet_aton" >&5 printf "%s\n" "$ac_cv_lib_resolv_inet_aton" >&6; } if test "x$ac_cv_lib_resolv_inet_aton" = xyes then : printf "%s\n" "#define HAVE_LIBRESOLV 1" >>confdefs.h LIBS="-lresolv $LIBS" fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for inet_ntoa in -lnsl" >&5 printf %s "checking for inet_ntoa in -lnsl... " >&6; } if test ${ac_cv_lib_nsl_inet_ntoa+y} then : printf %s "(cached) " >&6 else $as_nop ac_check_lib_save_LIBS=$LIBS LIBS="-lnsl $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ char inet_ntoa (); int main (void) { return inet_ntoa (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : ac_cv_lib_nsl_inet_ntoa=yes else $as_nop ac_cv_lib_nsl_inet_ntoa=no fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_nsl_inet_ntoa" >&5 printf "%s\n" "$ac_cv_lib_nsl_inet_ntoa" >&6; } if test "x$ac_cv_lib_nsl_inet_ntoa" = xyes then : printf "%s\n" "#define HAVE_LIBNSL 1" >>confdefs.h LIBS="-lnsl $LIBS" fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for htonl in -lws2_32" >&5 printf %s "checking for htonl in -lws2_32... " >&6; } if test ${ac_cv_lib_ws2_32_htonl+y} then : printf %s "(cached) " >&6 else $as_nop ac_check_lib_save_LIBS=$LIBS LIBS="-lws2_32 $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ char htonl (); int main (void) { return htonl (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : ac_cv_lib_ws2_32_htonl=yes else $as_nop ac_cv_lib_ws2_32_htonl=no fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_ws2_32_htonl" >&5 printf "%s\n" "$ac_cv_lib_ws2_32_htonl" >&6; } if test "x$ac_cv_lib_ws2_32_htonl" = xyes then : printf "%s\n" "#define HAVE_LIBWS2_32 1" >>confdefs.h LIBS="-lws2_32 $LIBS" fi pcap_lib_dir= # Check whether --with-pcap-lib-dir was given. if test ${with_pcap_lib_dir+y} then : withval=$with_pcap_lib_dir; case "$withval" in no) as_fn_error $? "Need pcap-lib-dir" "$LINENO" 5 ;; yes) ;; *) pcap_lib_dir="$withval" ;; esac fi pcap_include_dir= # Check whether --with-pcap-include-dir was given. if test ${with_pcap_include_dir+y} then : withval=$with_pcap_include_dir; case "$withval" in no) as_fn_error $? "Need pcap-include-dir" "$LINENO" 5 ;; yes) ;; *) pcap_include_dir="$withval" ;; esac fi smart_try_dir="$pcap_lib_dir" sm_lib_safe=`echo "pcap" | sed 'y%./+-%__p_%'` sm_func_safe=`echo "pcap_open_live" | sed 'y%./+-%__p_%'` old_LIBS="$LIBS" old_CPPFLAGS="$CPPFLAGS" smart_lib= smart_ldflags= smart_lib_dir= if test "x$smart_try_dir" != "x"; then for try in $smart_try_dir; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for pcap_open_live in -lpcap in $try" >&5 printf %s "checking for pcap_open_live in -lpcap in $try... " >&6; } LIBS="-lpcap $old_LIBS" CPPFLAGS="-L$try -Wl,-rpath,$try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ extern char pcap_open_live(); int main (void) { pcap_open_live() ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : smart_lib="-lpcap" smart_ldflags="-L$try -Wl,-rpath,$try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext done LIBS="$old_LIBS" CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_lib" = "x"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for pcap_open_live in -lpcap" >&5 printf %s "checking for pcap_open_live in -lpcap... " >&6; } LIBS="-lpcap $old_LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ extern char pcap_open_live(); int main (void) { pcap_open_live() ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : smart_lib="-lpcap" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext LIBS="$old_LIBS" fi if test "x$smart_lib" = "x"; then for try in /usr/local/lib /opt/lib; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for pcap_open_live in -lpcap in $try" >&5 printf %s "checking for pcap_open_live in -lpcap in $try... " >&6; } LIBS="-lpcap $old_LIBS" CPPFLAGS="-L$try -Wl,-rpath,$try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ extern char pcap_open_live(); int main (void) { pcap_open_live() ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : smart_lib="-lpcap" smart_ldflags="-L$try -Wl,-rpath,$try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext done LIBS="$old_LIBS" CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_lib" != "x"; then eval "ac_cv_lib_${sm_lib_safe}_${sm_func_safe}=yes" LIBS="$smart_ldflags $smart_lib $old_LIBS" SMART_LIBS="$smart_ldflags $smart_lib $SMART_LIBS" fi if test "x$ac_cv_lib_pcap_pcap_open_live" != "xyes"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: pcap library not found, silently disabling the RADIUS sniffer, and ARP listener. Use --with-pcap-lib-dir=." >&5 printf "%s\n" "$as_me: WARNING: pcap library not found, silently disabling the RADIUS sniffer, and ARP listener. Use --with-pcap-lib-dir=." >&2;} else ac_fn_c_check_func "$LINENO" "pcap_fopen_offline" "ac_cv_func_pcap_fopen_offline" if test "x$ac_cv_func_pcap_fopen_offline" = xyes then : printf "%s\n" "#define HAVE_PCAP_FOPEN_OFFLINE 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "pcap_dump_fopen" "ac_cv_func_pcap_dump_fopen" if test "x$ac_cv_func_pcap_dump_fopen" = xyes then : printf "%s\n" "#define HAVE_PCAP_DUMP_FOPEN 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "pcap_create" "ac_cv_func_pcap_create" if test "x$ac_cv_func_pcap_create" = xyes then : printf "%s\n" "#define HAVE_PCAP_CREATE 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "pcap_activate" "ac_cv_func_pcap_activate" if test "x$ac_cv_func_pcap_activate" = xyes then : printf "%s\n" "#define HAVE_PCAP_ACTIVATE 1" >>confdefs.h fi PCAP_LIBS="${smart_lib}" PCAP_LDFLAGS="${smart_ldflags}" fi LIBS="${old_LIBS}" collectdclient_lib_dir= # Check whether --with-collectdclient-lib-dir was given. if test ${with_collectdclient_lib_dir+y} then : withval=$with_collectdclient_lib_dir; case "$withval" in no) as_fn_error $? "Need collectdclient-lib-dir" "$LINENO" 5 ;; yes) ;; *) collectdclient_lib_dir="$withval" ;; esac fi collectdclient_include_dir= # Check whether --with-collectdclient-include-dir was given. if test ${with_collectdclient_include_dir+y} then : withval=$with_collectdclient_include_dir; case "$withval" in no) as_fn_error $? "Need collectdclient-include-dir" "$LINENO" 5 ;; yes) ;; *) collectdclient_include_dir="$withval" ;; esac fi smart_try_dir="$collectdclient_lib_dir" sm_lib_safe=`echo "collectdclient" | sed 'y%./+-%__p_%'` sm_func_safe=`echo "lcc_connect" | sed 'y%./+-%__p_%'` old_LIBS="$LIBS" old_CPPFLAGS="$CPPFLAGS" smart_lib= smart_ldflags= smart_lib_dir= if test "x$smart_try_dir" != "x"; then for try in $smart_try_dir; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for lcc_connect in -lcollectdclient in $try" >&5 printf %s "checking for lcc_connect in -lcollectdclient in $try... " >&6; } LIBS="-lcollectdclient $old_LIBS" CPPFLAGS="-L$try -Wl,-rpath,$try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ extern char lcc_connect(); int main (void) { lcc_connect() ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : smart_lib="-lcollectdclient" smart_ldflags="-L$try -Wl,-rpath,$try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext done LIBS="$old_LIBS" CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_lib" = "x"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for lcc_connect in -lcollectdclient" >&5 printf %s "checking for lcc_connect in -lcollectdclient... " >&6; } LIBS="-lcollectdclient $old_LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ extern char lcc_connect(); int main (void) { lcc_connect() ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : smart_lib="-lcollectdclient" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext LIBS="$old_LIBS" fi if test "x$smart_lib" = "x"; then for try in /usr/local/lib /opt/lib; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for lcc_connect in -lcollectdclient in $try" >&5 printf %s "checking for lcc_connect in -lcollectdclient in $try... " >&6; } LIBS="-lcollectdclient $old_LIBS" CPPFLAGS="-L$try -Wl,-rpath,$try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ extern char lcc_connect(); int main (void) { lcc_connect() ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : smart_lib="-lcollectdclient" smart_ldflags="-L$try -Wl,-rpath,$try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext done LIBS="$old_LIBS" CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_lib" != "x"; then eval "ac_cv_lib_${sm_lib_safe}_${sm_func_safe}=yes" LIBS="$smart_ldflags $smart_lib $old_LIBS" SMART_LIBS="$smart_ldflags $smart_lib $SMART_LIBS" fi if test "x$ac_cv_lib_collectdclient_lcc_connect" != "xyes"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: collectdclient library not found. Use --with-collectdclient-lib-dir=." >&5 printf "%s\n" "$as_me: WARNING: collectdclient library not found. Use --with-collectdclient-lib-dir=." >&2;} else COLLECTDC_LIBS="${smart_lib}" COLLECTDC_LDFLAGS="${smart_ldflags}" fi LIBS="${old_LIBS}" cap_lib_dir= # Check whether --with-cap-lib-dir was given. if test ${with_cap_lib_dir+y} then : withval=$with_cap_lib_dir; case "$withval" in no) as_fn_error $? "Need cap-lib-dir" "$LINENO" 5 ;; yes) ;; *) cap_lib_dir="$withval" ;; esac fi cap_include_dir= # Check whether --with-cap-include-dir was given. if test ${with_cap_include_dir+y} then : withval=$with_cap_include_dir; case "$withval" in no) as_fn_error $? "Need cap-include-dir" "$LINENO" 5 ;; yes) ;; *) cap_include_dir="$withval" ;; esac fi smart_try_dir="$cap_lib_dir" sm_lib_safe=`echo "cap" | sed 'y%./+-%__p_%'` sm_func_safe=`echo "cap_get_proc" | sed 'y%./+-%__p_%'` old_LIBS="$LIBS" old_CPPFLAGS="$CPPFLAGS" smart_lib= smart_ldflags= smart_lib_dir= if test "x$smart_try_dir" != "x"; then for try in $smart_try_dir; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for cap_get_proc in -lcap in $try" >&5 printf %s "checking for cap_get_proc in -lcap in $try... " >&6; } LIBS="-lcap $old_LIBS" CPPFLAGS="-L$try -Wl,-rpath,$try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ extern char cap_get_proc(); int main (void) { cap_get_proc() ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : smart_lib="-lcap" smart_ldflags="-L$try -Wl,-rpath,$try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext done LIBS="$old_LIBS" CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_lib" = "x"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for cap_get_proc in -lcap" >&5 printf %s "checking for cap_get_proc in -lcap... " >&6; } LIBS="-lcap $old_LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ extern char cap_get_proc(); int main (void) { cap_get_proc() ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : smart_lib="-lcap" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext LIBS="$old_LIBS" fi if test "x$smart_lib" = "x"; then for try in /usr/local/lib /opt/lib; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for cap_get_proc in -lcap in $try" >&5 printf %s "checking for cap_get_proc in -lcap in $try... " >&6; } LIBS="-lcap $old_LIBS" CPPFLAGS="-L$try -Wl,-rpath,$try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ extern char cap_get_proc(); int main (void) { cap_get_proc() ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : smart_lib="-lcap" smart_ldflags="-L$try -Wl,-rpath,$try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext done LIBS="$old_LIBS" CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_lib" != "x"; then eval "ac_cv_lib_${sm_lib_safe}_${sm_func_safe}=yes" LIBS="$smart_ldflags $smart_lib $old_LIBS" SMART_LIBS="$smart_ldflags $smart_lib $SMART_LIBS" fi if test "x$ac_cv_lib_cap_cap_get_proc" != "xyes"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: cap library not found, debugger checks will not be enabled. Use --with-cap-lib-dir=." >&5 printf "%s\n" "$as_me: WARNING: cap library not found, debugger checks will not be enabled. Use --with-cap-lib-dir=." >&2;} else printf "%s\n" "#define HAVE_LIBCAP 1" >>confdefs.h HAVE_LIBCAP=1 fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for a readline compatible library" >&5 printf %s "checking for a readline compatible library... " >&6; } if test ${vl_cv_lib_readline+y} then : printf %s "(cached) " >&6 else $as_nop ORIG_LIBS="$LIBS" for readline_lib in readline edit editline; do for termcap_lib in "" termcap curses ncurses; do if test -z "$termcap_lib"; then TRY_LIB="-l$readline_lib" else TRY_LIB="-l$readline_lib -l$termcap_lib" fi LIBS="$ORIG_LIBS $TRY_LIB" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ char readline (); int main (void) { return readline (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : vl_cv_lib_readline="$TRY_LIB" fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext if test -n "$vl_cv_lib_readline"; then break fi done if test -n "$vl_cv_lib_readline"; then break fi done if test -z "$vl_cv_lib_readline"; then vl_cv_lib_readline="no" LIBS="$ORIG_LIBS" fi fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $vl_cv_lib_readline" >&5 printf "%s\n" "$vl_cv_lib_readline" >&6; } if test "$vl_cv_lib_readline" != "no"; then LIBREADLINE="$vl_cv_lib_readline" printf "%s\n" "#define HAVE_LIBREADLINE 1" >>confdefs.h ac_fn_c_check_header_compile "$LINENO" "readline.h" "ac_cv_header_readline_h" "$ac_includes_default" if test "x$ac_cv_header_readline_h" = xyes then : printf "%s\n" "#define HAVE_READLINE_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "readline/readline.h" "ac_cv_header_readline_readline_h" "$ac_includes_default" if test "x$ac_cv_header_readline_readline_h" = xyes then : printf "%s\n" "#define HAVE_READLINE_READLINE_H 1" >>confdefs.h fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether readline supports history" >&5 printf %s "checking whether readline supports history... " >&6; } if test ${vl_cv_lib_readline_history+y} then : printf %s "(cached) " >&6 else $as_nop vl_cv_lib_readline_history="no" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ char add_history (); int main (void) { return add_history (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : vl_cv_lib_readline_history="yes" fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $vl_cv_lib_readline_history" >&5 printf "%s\n" "$vl_cv_lib_readline_history" >&6; } if test "$vl_cv_lib_readline_history" = "yes"; then printf "%s\n" "#define HAVE_READLINE_HISTORY 1" >>confdefs.h ac_fn_c_check_header_compile "$LINENO" "history.h" "ac_cv_header_history_h" "$ac_includes_default" if test "x$ac_cv_header_history_h" = xyes then : printf "%s\n" "#define HAVE_HISTORY_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "readline/history.h" "ac_cv_header_readline_history_h" "$ac_includes_default" if test "x$ac_cv_header_readline_history_h" = xyes then : printf "%s\n" "#define HAVE_READLINE_HISTORY_H 1" >>confdefs.h fi fi fi # Check whether --with-systemd was given. if test ${with_systemd+y} then : withval=$with_systemd; case "$withval" in no) WITH_SYSTEMD=no ;; *) WITH_SYSTEMD=yes esac else $as_nop WITH_SYSTEMD=no fi systemd_lib_dir= # Check whether --with-systemd-lib-dir was given. if test ${with_systemd_lib_dir+y} then : withval=$with_systemd_lib_dir; case "$withval" in *) systemd_lib_dir="$withval" ;; esac fi systemd_include_dir= # Check whether --with-systemd-include-dir was given. if test ${with_systemd_include_dir+y} then : withval=$with_systemd_include_dir; case "$withval" in *) systemd_include_dir="$withval" ;; esac fi if test "x$WITH_SYSTEMD" = xyes; then smart_try_dir="$systemd_lib_dir" sm_lib_safe=`echo "systemd" | sed 'y%./+-%__p_%'` sm_func_safe=`echo "sd_notify" | sed 'y%./+-%__p_%'` old_LIBS="$LIBS" old_CPPFLAGS="$CPPFLAGS" smart_lib= smart_ldflags= smart_lib_dir= if test "x$smart_try_dir" != "x"; then for try in $smart_try_dir; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for sd_notify in -lsystemd in $try" >&5 printf %s "checking for sd_notify in -lsystemd in $try... " >&6; } LIBS="-lsystemd $old_LIBS" CPPFLAGS="-L$try -Wl,-rpath,$try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ extern char sd_notify(); int main (void) { sd_notify() ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : smart_lib="-lsystemd" smart_ldflags="-L$try -Wl,-rpath,$try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext done LIBS="$old_LIBS" CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_lib" = "x"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for sd_notify in -lsystemd" >&5 printf %s "checking for sd_notify in -lsystemd... " >&6; } LIBS="-lsystemd $old_LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ extern char sd_notify(); int main (void) { sd_notify() ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : smart_lib="-lsystemd" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext LIBS="$old_LIBS" fi if test "x$smart_lib" = "x"; then for try in /usr/local/lib /opt/lib; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for sd_notify in -lsystemd in $try" >&5 printf %s "checking for sd_notify in -lsystemd in $try... " >&6; } LIBS="-lsystemd $old_LIBS" CPPFLAGS="-L$try -Wl,-rpath,$try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ extern char sd_notify(); int main (void) { sd_notify() ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : smart_lib="-lsystemd" smart_ldflags="-L$try -Wl,-rpath,$try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext done LIBS="$old_LIBS" CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_lib" != "x"; then eval "ac_cv_lib_${sm_lib_safe}_${sm_func_safe}=yes" LIBS="$smart_ldflags $smart_lib $old_LIBS" SMART_LIBS="$smart_ldflags $smart_lib $SMART_LIBS" fi if test "x$ac_cv_lib_systemd_sd_notify" != "xyes"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: systemd library not found. Use --with-systemd-lib-dir=." >&5 printf "%s\n" "$as_me: WARNING: systemd library not found. Use --with-systemd-lib-dir=." >&2;} else printf "%s\n" "#define HAVE_SYSTEMD 1" >>confdefs.h HAVE_SYSTEMD=1 SYSTEMD_LIBS="${smart_lib}" SYSTEMD_LDFLAGS="${smart_ldflags}" fi LIBS="${old_LIBS}" fi if test "x$HAVE_SYSTEMD" = x; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: skipping test for systemd watchdog" >&5 printf "%s\n" "$as_me: skipping test for systemd watchdog" >&6;} else smart_try_dir="$systemd_lib_dir" sm_lib_safe=`echo "systemd" | sed 'y%./+-%__p_%'` sm_func_safe=`echo "sd_watchdog_enabled" | sed 'y%./+-%__p_%'` old_LIBS="$LIBS" old_CPPFLAGS="$CPPFLAGS" smart_lib= smart_ldflags= smart_lib_dir= if test "x$smart_try_dir" != "x"; then for try in $smart_try_dir; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for sd_watchdog_enabled in -lsystemd in $try" >&5 printf %s "checking for sd_watchdog_enabled in -lsystemd in $try... " >&6; } LIBS="-lsystemd $old_LIBS" CPPFLAGS="-L$try -Wl,-rpath,$try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ extern char sd_watchdog_enabled(); int main (void) { sd_watchdog_enabled() ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : smart_lib="-lsystemd" smart_ldflags="-L$try -Wl,-rpath,$try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext done LIBS="$old_LIBS" CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_lib" = "x"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for sd_watchdog_enabled in -lsystemd" >&5 printf %s "checking for sd_watchdog_enabled in -lsystemd... " >&6; } LIBS="-lsystemd $old_LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ extern char sd_watchdog_enabled(); int main (void) { sd_watchdog_enabled() ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : smart_lib="-lsystemd" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext LIBS="$old_LIBS" fi if test "x$smart_lib" = "x"; then for try in /usr/local/lib /opt/lib; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for sd_watchdog_enabled in -lsystemd in $try" >&5 printf %s "checking for sd_watchdog_enabled in -lsystemd in $try... " >&6; } LIBS="-lsystemd $old_LIBS" CPPFLAGS="-L$try -Wl,-rpath,$try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ extern char sd_watchdog_enabled(); int main (void) { sd_watchdog_enabled() ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : smart_lib="-lsystemd" smart_ldflags="-L$try -Wl,-rpath,$try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext done LIBS="$old_LIBS" CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_lib" != "x"; then eval "ac_cv_lib_${sm_lib_safe}_${sm_func_safe}=yes" LIBS="$smart_ldflags $smart_lib $old_LIBS" SMART_LIBS="$smart_ldflags $smart_lib $SMART_LIBS" fi if test "x$ac_cv_lib_systemd_sd_watchdog_enabled" != "xyes"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: systemd watchdog is only available from systemd 209." >&5 printf "%s\n" "$as_me: WARNING: systemd watchdog is only available from systemd 209." >&2;} else printf "%s\n" "#define HAVE_SYSTEMD_WATCHDOG 1" >>confdefs.h fi LIBS="${old_LIBS}" fi if test "x$WITH_SYSTEMD" != xyes || test "x$SYSTEMD_LIBS" = x; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: skipping test for systemd/sd-daemon.h." >&5 printf "%s\n" "$as_me: skipping test for systemd/sd-daemon.h." >&6;} else smart_try_dir="$systemd_include_dir" ac_safe=`echo "systemd/sd-daemon.h" | sed 'y%./+-%__pm%'` old_CPPFLAGS="$CPPFLAGS" smart_include= smart_include_dir="/usr/local/include /opt/include" _smart_try_dir= _smart_include_dir= for _prefix in $smart_prefix ""; do for _dir in $smart_try_dir; do _smart_try_dir="${_smart_try_dir} ${_dir}/${_prefix}" done for _dir in $smart_include_dir; do _smart_include_dir="${_smart_include_dir} ${_dir}/${_prefix}" done done if test "x$_smart_try_dir" != "x"; then for try in $_smart_try_dir; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for systemd/sd-daemon.h in $try" >&5 printf %s "checking for systemd/sd-daemon.h in $try... " >&6; } CPPFLAGS="-isystem $try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include="-isystem $try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext done CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_include" = "x"; then for _prefix in $smart_prefix; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for ${_prefix}/systemd/sd-daemon.h" >&5 printf %s "checking for ${_prefix}/systemd/sd-daemon.h... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include="-isystem ${_prefix}/" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext done fi if test "x$smart_include" = "x"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for systemd/sd-daemon.h" >&5 printf %s "checking for systemd/sd-daemon.h... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include=" " { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext fi if test "x$smart_include" = "x"; then for try in $_smart_include_dir; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for systemd/sd-daemon.h in $try" >&5 printf %s "checking for systemd/sd-daemon.h in $try... " >&6; } CPPFLAGS="-isystem $try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include="-isystem $try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext done CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_include" != "x"; then eval "ac_cv_header_$ac_safe=yes" CPPFLAGS="$smart_include $old_CPPFLAGS" SMART_CPPFLAGS="$smart_include $SMART_CPPFLAGS" fi smart_prefix= if test "x$ac_cv_header_systemd_sdmdaemon_h" = "xyes"; then printf "%s\n" "#define HAVE_SYSTEMD_SD_DAEMON_H 1" >>confdefs.h else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: systemd headers not found. Use --with-systemd-include-dir=." >&5 printf "%s\n" "$as_me: WARNING: systemd headers not found. Use --with-systemd-include-dir=." >&2;} fi fi smart_try_dir="$talloc_include_dir" ac_safe=`echo "talloc.h" | sed 'y%./+-%__pm%'` old_CPPFLAGS="$CPPFLAGS" smart_include= smart_include_dir="/usr/local/include /opt/include" _smart_try_dir= _smart_include_dir= for _prefix in $smart_prefix ""; do for _dir in $smart_try_dir; do _smart_try_dir="${_smart_try_dir} ${_dir}/${_prefix}" done for _dir in $smart_include_dir; do _smart_include_dir="${_smart_include_dir} ${_dir}/${_prefix}" done done if test "x$_smart_try_dir" != "x"; then for try in $_smart_try_dir; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for talloc.h in $try" >&5 printf %s "checking for talloc.h in $try... " >&6; } CPPFLAGS="-isystem $try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include="-isystem $try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext done CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_include" = "x"; then for _prefix in $smart_prefix; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for ${_prefix}/talloc.h" >&5 printf %s "checking for ${_prefix}/talloc.h... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include="-isystem ${_prefix}/" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext done fi if test "x$smart_include" = "x"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for talloc.h" >&5 printf %s "checking for talloc.h... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include=" " { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext fi if test "x$smart_include" = "x"; then for try in $_smart_include_dir; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for talloc.h in $try" >&5 printf %s "checking for talloc.h in $try... " >&6; } CPPFLAGS="-isystem $try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include="-isystem $try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext done CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_include" != "x"; then eval "ac_cv_header_$ac_safe=yes" CPPFLAGS="$smart_include $old_CPPFLAGS" SMART_CPPFLAGS="$smart_include $SMART_CPPFLAGS" fi smart_prefix= if test "x$ac_cv_header_talloc_h" != "xyes"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: talloc headers not found. Use --with-talloc-include-dir=." >&5 printf "%s\n" "$as_me: WARNING: talloc headers not found. Use --with-talloc-include-dir=." >&2;} as_fn_error $? "FreeRADIUS requires libtalloc" "$LINENO" 5 fi case "$host" in *-interix*) CFLAGS="$CFLAGS -D_ALL_SOURCE" ;; *-darwin*) printf "%s\n" "#define __APPLE_USE_RFC_3542 1" >>confdefs.h ;; esac ac_header_dirent=no for ac_hdr in dirent.h sys/ndir.h sys/dir.h ndir.h; do as_ac_Header=`printf "%s\n" "ac_cv_header_dirent_$ac_hdr" | $as_tr_sh` { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_hdr that defines DIR" >&5 printf %s "checking for $ac_hdr that defines DIR... " >&6; } if eval test \${$as_ac_Header+y} then : printf %s "(cached) " >&6 else $as_nop cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include <$ac_hdr> int main (void) { if ((DIR *) 0) return 0; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : eval "$as_ac_Header=yes" else $as_nop eval "$as_ac_Header=no" fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext fi eval ac_res=\$$as_ac_Header { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5 printf "%s\n" "$ac_res" >&6; } if eval test \"x\$"$as_ac_Header"\" = x"yes" then : cat >>confdefs.h <<_ACEOF #define `printf "%s\n" "HAVE_$ac_hdr" | $as_tr_cpp` 1 _ACEOF ac_header_dirent=$ac_hdr; break fi done # Two versions of opendir et al. are in -ldir and -lx on SCO Xenix. if test $ac_header_dirent = dirent.h; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for library containing opendir" >&5 printf %s "checking for library containing opendir... " >&6; } if test ${ac_cv_search_opendir+y} then : printf %s "(cached) " >&6 else $as_nop ac_func_search_save_LIBS=$LIBS cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ char opendir (); int main (void) { return opendir (); ; return 0; } _ACEOF for ac_lib in '' dir do if test -z "$ac_lib"; then ac_res="none required" else ac_res=-l$ac_lib LIBS="-l$ac_lib $ac_func_search_save_LIBS" fi if ac_fn_c_try_link "$LINENO" then : ac_cv_search_opendir=$ac_res fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext if test ${ac_cv_search_opendir+y} then : break fi done if test ${ac_cv_search_opendir+y} then : else $as_nop ac_cv_search_opendir=no fi rm conftest.$ac_ext LIBS=$ac_func_search_save_LIBS fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_opendir" >&5 printf "%s\n" "$ac_cv_search_opendir" >&6; } ac_res=$ac_cv_search_opendir if test "$ac_res" != no then : test "$ac_res" = "none required" || LIBS="$ac_res $LIBS" fi else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for library containing opendir" >&5 printf %s "checking for library containing opendir... " >&6; } if test ${ac_cv_search_opendir+y} then : printf %s "(cached) " >&6 else $as_nop ac_func_search_save_LIBS=$LIBS cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ char opendir (); int main (void) { return opendir (); ; return 0; } _ACEOF for ac_lib in '' x do if test -z "$ac_lib"; then ac_res="none required" else ac_res=-l$ac_lib LIBS="-l$ac_lib $ac_func_search_save_LIBS" fi if ac_fn_c_try_link "$LINENO" then : ac_cv_search_opendir=$ac_res fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext if test ${ac_cv_search_opendir+y} then : break fi done if test ${ac_cv_search_opendir+y} then : else $as_nop ac_cv_search_opendir=no fi rm conftest.$ac_ext LIBS=$ac_func_search_save_LIBS fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_opendir" >&5 printf "%s\n" "$ac_cv_search_opendir" >&6; } ac_res=$ac_cv_search_opendir if test "$ac_res" != no then : test "$ac_res" = "none required" || LIBS="$ac_res $LIBS" fi fi # Autoupdate added the next two lines to ensure that your configure # script's behavior did not change. They are probably safe to remove. { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for egrep" >&5 printf %s "checking for egrep... " >&6; } if test ${ac_cv_path_EGREP+y} then : printf %s "(cached) " >&6 else $as_nop if echo a | $GREP -E '(a|b)' >/dev/null 2>&1 then ac_cv_path_EGREP="$GREP -E" else if test -z "$EGREP"; then ac_path_EGREP_found=false # Loop through the user's path and test for each of PROGNAME-LIST as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH$PATH_SEPARATOR/usr/xpg4/bin do IFS=$as_save_IFS case $as_dir in #((( '') as_dir=./ ;; */) ;; *) as_dir=$as_dir/ ;; esac for ac_prog in egrep do for ac_exec_ext in '' $ac_executable_extensions; do ac_path_EGREP="$as_dir$ac_prog$ac_exec_ext" as_fn_executable_p "$ac_path_EGREP" || continue # Check for GNU ac_path_EGREP and select it if it is found. # Check for GNU $ac_path_EGREP case `"$ac_path_EGREP" --version 2>&1` in *GNU*) ac_cv_path_EGREP="$ac_path_EGREP" ac_path_EGREP_found=:;; *) ac_count=0 printf %s 0123456789 >"conftest.in" while : do cat "conftest.in" "conftest.in" >"conftest.tmp" mv "conftest.tmp" "conftest.in" cp "conftest.in" "conftest.nl" printf "%s\n" 'EGREP' >> "conftest.nl" "$ac_path_EGREP" 'EGREP$' < "conftest.nl" >"conftest.out" 2>/dev/null || break diff "conftest.out" "conftest.nl" >/dev/null 2>&1 || break as_fn_arith $ac_count + 1 && ac_count=$as_val if test $ac_count -gt ${ac_path_EGREP_max-0}; then # Best one so far, save it but keep looking for a better one ac_cv_path_EGREP="$ac_path_EGREP" ac_path_EGREP_max=$ac_count fi # 10*(2^10) chars as input seems more than enough test $ac_count -gt 10 && break done rm -f conftest.in conftest.tmp conftest.nl conftest.out;; esac $ac_path_EGREP_found && break 3 done done done IFS=$as_save_IFS if test -z "$ac_cv_path_EGREP"; then as_fn_error $? "no acceptable egrep could be found in $PATH$PATH_SEPARATOR/usr/xpg4/bin" "$LINENO" 5 fi else ac_cv_path_EGREP=$EGREP fi fi fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_EGREP" >&5 printf "%s\n" "$ac_cv_path_EGREP" >&6; } EGREP="$ac_cv_path_EGREP" # Obsolete code to be removed. if test $ac_cv_header_sys_time_h = yes; then printf "%s\n" "#define TIME_WITH_SYS_TIME 1" >>confdefs.h fi # End of obsolete code. { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for sys/wait.h that is POSIX.1 compatible" >&5 printf %s "checking for sys/wait.h that is POSIX.1 compatible... " >&6; } if test ${ac_cv_header_sys_wait_h+y} then : printf %s "(cached) " >&6 else $as_nop cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include #ifndef WEXITSTATUS # define WEXITSTATUS(stat_val) ((unsigned int) (stat_val) >> 8) #endif #ifndef WIFEXITED # define WIFEXITED(stat_val) (((stat_val) & 255) == 0) #endif int main (void) { int s; wait (&s); s = WIFEXITED (s) ? WEXITSTATUS (s) : 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : ac_cv_header_sys_wait_h=yes else $as_nop ac_cv_header_sys_wait_h=no fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_header_sys_wait_h" >&5 printf "%s\n" "$ac_cv_header_sys_wait_h" >&6; } if test $ac_cv_header_sys_wait_h = yes; then printf "%s\n" "#define HAVE_SYS_WAIT_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "arpa/inet.h" "ac_cv_header_arpa_inet_h" "$ac_includes_default" if test "x$ac_cv_header_arpa_inet_h" = xyes then : printf "%s\n" "#define HAVE_ARPA_INET_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "crypt.h" "ac_cv_header_crypt_h" "$ac_includes_default" if test "x$ac_cv_header_crypt_h" = xyes then : printf "%s\n" "#define HAVE_CRYPT_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "dlfcn.h" "ac_cv_header_dlfcn_h" "$ac_includes_default" if test "x$ac_cv_header_dlfcn_h" = xyes then : printf "%s\n" "#define HAVE_DLFCN_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "errno.h" "ac_cv_header_errno_h" "$ac_includes_default" if test "x$ac_cv_header_errno_h" = xyes then : printf "%s\n" "#define HAVE_ERRNO_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "fcntl.h" "ac_cv_header_fcntl_h" "$ac_includes_default" if test "x$ac_cv_header_fcntl_h" = xyes then : printf "%s\n" "#define HAVE_FCNTL_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "features.h" "ac_cv_header_features_h" "$ac_includes_default" if test "x$ac_cv_header_features_h" = xyes then : printf "%s\n" "#define HAVE_FEATURES_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "fnmatch.h" "ac_cv_header_fnmatch_h" "$ac_includes_default" if test "x$ac_cv_header_fnmatch_h" = xyes then : printf "%s\n" "#define HAVE_FNMATCH_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "getopt.h" "ac_cv_header_getopt_h" "$ac_includes_default" if test "x$ac_cv_header_getopt_h" = xyes then : printf "%s\n" "#define HAVE_GETOPT_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "glob.h" "ac_cv_header_glob_h" "$ac_includes_default" if test "x$ac_cv_header_glob_h" = xyes then : printf "%s\n" "#define HAVE_GLOB_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "grp.h" "ac_cv_header_grp_h" "$ac_includes_default" if test "x$ac_cv_header_grp_h" = xyes then : printf "%s\n" "#define HAVE_GRP_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "inttypes.h" "ac_cv_header_inttypes_h" "$ac_includes_default" if test "x$ac_cv_header_inttypes_h" = xyes then : printf "%s\n" "#define HAVE_INTTYPES_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "limits.h" "ac_cv_header_limits_h" "$ac_includes_default" if test "x$ac_cv_header_limits_h" = xyes then : printf "%s\n" "#define HAVE_LIMITS_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "linux/if_packet.h" "ac_cv_header_linux_if_packet_h" "$ac_includes_default" if test "x$ac_cv_header_linux_if_packet_h" = xyes then : printf "%s\n" "#define HAVE_LINUX_IF_PACKET_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "malloc.h" "ac_cv_header_malloc_h" "$ac_includes_default" if test "x$ac_cv_header_malloc_h" = xyes then : printf "%s\n" "#define HAVE_MALLOC_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "netdb.h" "ac_cv_header_netdb_h" "$ac_includes_default" if test "x$ac_cv_header_netdb_h" = xyes then : printf "%s\n" "#define HAVE_NETDB_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "netinet/in.h" "ac_cv_header_netinet_in_h" "$ac_includes_default" if test "x$ac_cv_header_netinet_in_h" = xyes then : printf "%s\n" "#define HAVE_NETINET_IN_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "prot.h" "ac_cv_header_prot_h" "$ac_includes_default" if test "x$ac_cv_header_prot_h" = xyes then : printf "%s\n" "#define HAVE_PROT_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "pwd.h" "ac_cv_header_pwd_h" "$ac_includes_default" if test "x$ac_cv_header_pwd_h" = xyes then : printf "%s\n" "#define HAVE_PWD_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "resource.h" "ac_cv_header_resource_h" "$ac_includes_default" if test "x$ac_cv_header_resource_h" = xyes then : printf "%s\n" "#define HAVE_RESOURCE_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "semaphore.h" "ac_cv_header_semaphore_h" "$ac_includes_default" if test "x$ac_cv_header_semaphore_h" = xyes then : printf "%s\n" "#define HAVE_SEMAPHORE_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "sia.h" "ac_cv_header_sia_h" "$ac_includes_default" if test "x$ac_cv_header_sia_h" = xyes then : printf "%s\n" "#define HAVE_SIA_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "siad.h" "ac_cv_header_siad_h" "$ac_includes_default" if test "x$ac_cv_header_siad_h" = xyes then : printf "%s\n" "#define HAVE_SIAD_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "signal.h" "ac_cv_header_signal_h" "$ac_includes_default" if test "x$ac_cv_header_signal_h" = xyes then : printf "%s\n" "#define HAVE_SIGNAL_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "stdatomic.h" "ac_cv_header_stdatomic_h" "$ac_includes_default" if test "x$ac_cv_header_stdatomic_h" = xyes then : printf "%s\n" "#define HAVE_STDATOMIC_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "stdalign.h" "ac_cv_header_stdalign_h" "$ac_includes_default" if test "x$ac_cv_header_stdalign_h" = xyes then : printf "%s\n" "#define HAVE_STDALIGN_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "stdbool.h" "ac_cv_header_stdbool_h" "$ac_includes_default" if test "x$ac_cv_header_stdbool_h" = xyes then : printf "%s\n" "#define HAVE_STDBOOL_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "stddef.h" "ac_cv_header_stddef_h" "$ac_includes_default" if test "x$ac_cv_header_stddef_h" = xyes then : printf "%s\n" "#define HAVE_STDDEF_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "stdint.h" "ac_cv_header_stdint_h" "$ac_includes_default" if test "x$ac_cv_header_stdint_h" = xyes then : printf "%s\n" "#define HAVE_STDINT_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "stdio.h" "ac_cv_header_stdio_h" "$ac_includes_default" if test "x$ac_cv_header_stdio_h" = xyes then : printf "%s\n" "#define HAVE_STDIO_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "sys/event.h" "ac_cv_header_sys_event_h" "$ac_includes_default" if test "x$ac_cv_header_sys_event_h" = xyes then : printf "%s\n" "#define HAVE_SYS_EVENT_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "sys/fcntl.h" "ac_cv_header_sys_fcntl_h" "$ac_includes_default" if test "x$ac_cv_header_sys_fcntl_h" = xyes then : printf "%s\n" "#define HAVE_SYS_FCNTL_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "sys/prctl.h" "ac_cv_header_sys_prctl_h" "$ac_includes_default" if test "x$ac_cv_header_sys_prctl_h" = xyes then : printf "%s\n" "#define HAVE_SYS_PRCTL_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "sys/procctl.h" "ac_cv_header_sys_procctl_h" "$ac_includes_default" if test "x$ac_cv_header_sys_procctl_h" = xyes then : printf "%s\n" "#define HAVE_SYS_PROCCTL_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "sys/ptrace.h" "ac_cv_header_sys_ptrace_h" "$ac_includes_default" if test "x$ac_cv_header_sys_ptrace_h" = xyes then : printf "%s\n" "#define HAVE_SYS_PTRACE_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "sys/resource.h" "ac_cv_header_sys_resource_h" "$ac_includes_default" if test "x$ac_cv_header_sys_resource_h" = xyes then : printf "%s\n" "#define HAVE_SYS_RESOURCE_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "sys/security.h" "ac_cv_header_sys_security_h" "$ac_includes_default" if test "x$ac_cv_header_sys_security_h" = xyes then : printf "%s\n" "#define HAVE_SYS_SECURITY_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "sys/select.h" "ac_cv_header_sys_select_h" "$ac_includes_default" if test "x$ac_cv_header_sys_select_h" = xyes then : printf "%s\n" "#define HAVE_SYS_SELECT_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "sys/socket.h" "ac_cv_header_sys_socket_h" "$ac_includes_default" if test "x$ac_cv_header_sys_socket_h" = xyes then : printf "%s\n" "#define HAVE_SYS_SOCKET_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "sys/time.h" "ac_cv_header_sys_time_h" "$ac_includes_default" if test "x$ac_cv_header_sys_time_h" = xyes then : printf "%s\n" "#define HAVE_SYS_TIME_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "sys/types.h" "ac_cv_header_sys_types_h" "$ac_includes_default" if test "x$ac_cv_header_sys_types_h" = xyes then : printf "%s\n" "#define HAVE_SYS_TYPES_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "sys/un.h" "ac_cv_header_sys_un_h" "$ac_includes_default" if test "x$ac_cv_header_sys_un_h" = xyes then : printf "%s\n" "#define HAVE_SYS_UN_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "sys/wait.h" "ac_cv_header_sys_wait_h" "$ac_includes_default" if test "x$ac_cv_header_sys_wait_h" = xyes then : printf "%s\n" "#define HAVE_SYS_WAIT_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "syslog.h" "ac_cv_header_syslog_h" "$ac_includes_default" if test "x$ac_cv_header_syslog_h" = xyes then : printf "%s\n" "#define HAVE_SYSLOG_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "unistd.h" "ac_cv_header_unistd_h" "$ac_includes_default" if test "x$ac_cv_header_unistd_h" = xyes then : printf "%s\n" "#define HAVE_UNISTD_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "utime.h" "ac_cv_header_utime_h" "$ac_includes_default" if test "x$ac_cv_header_utime_h" = xyes then : printf "%s\n" "#define HAVE_UTIME_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "utmp.h" "ac_cv_header_utmp_h" "$ac_includes_default" if test "x$ac_cv_header_utmp_h" = xyes then : printf "%s\n" "#define HAVE_UTMP_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "utmpx.h" "ac_cv_header_utmpx_h" "$ac_includes_default" if test "x$ac_cv_header_utmpx_h" = xyes then : printf "%s\n" "#define HAVE_UTMPX_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "winsock.h" "ac_cv_header_winsock_h" "$ac_includes_default" if test "x$ac_cv_header_winsock_h" = xyes then : printf "%s\n" "#define HAVE_WINSOCK_H 1" >>confdefs.h fi ac_fn_c_check_header_compile "$LINENO" "net/if.h" "ac_cv_header_net_if_h" " #ifdef HAVE_SYS_SOCKET_H # include #endif " if test "x$ac_cv_header_net_if_h" = xyes then : printf "%s\n" "#define HAVE_NET_IF_H 1" >>confdefs.h fi if test "x$ac_cv_header_sys_security_h" = "xyes" && test "x$ac_cv_header_prot_h" = "xyes" then printf "%s\n" "#define OSFC2 /**/" >>confdefs.h fi if test "x$ac_cv_header_sia_h" = "xyes" && test "x$ac_cv_header_siad_h" = "xyes" then printf "%s\n" "#define OSFSIA /**/" >>confdefs.h fi if test "x$WITH_OPENSSL" = xyes; then OLD_LIBS="$LIBS" CFLAGS="$CFLAGS -DOPENSSL_NO_KRB5" smart_try_dir="$openssl_lib_dir" sm_lib_safe=`echo "crypto" | sed 'y%./+-%__p_%'` sm_func_safe=`echo "DH_new" | sed 'y%./+-%__p_%'` old_LIBS="$LIBS" old_CPPFLAGS="$CPPFLAGS" smart_lib= smart_ldflags= smart_lib_dir= if test "x$smart_try_dir" != "x"; then for try in $smart_try_dir; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for DH_new in -lcrypto in $try" >&5 printf %s "checking for DH_new in -lcrypto in $try... " >&6; } LIBS="-lcrypto $old_LIBS" CPPFLAGS="-L$try -Wl,-rpath,$try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ extern char DH_new(); int main (void) { DH_new() ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : smart_lib="-lcrypto" smart_ldflags="-L$try -Wl,-rpath,$try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext done LIBS="$old_LIBS" CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_lib" = "x"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for DH_new in -lcrypto" >&5 printf %s "checking for DH_new in -lcrypto... " >&6; } LIBS="-lcrypto $old_LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ extern char DH_new(); int main (void) { DH_new() ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : smart_lib="-lcrypto" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext LIBS="$old_LIBS" fi if test "x$smart_lib" = "x"; then for try in /usr/local/lib /opt/lib; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for DH_new in -lcrypto in $try" >&5 printf %s "checking for DH_new in -lcrypto in $try... " >&6; } LIBS="-lcrypto $old_LIBS" CPPFLAGS="-L$try -Wl,-rpath,$try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ extern char DH_new(); int main (void) { DH_new() ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : smart_lib="-lcrypto" smart_ldflags="-L$try -Wl,-rpath,$try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext done LIBS="$old_LIBS" CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_lib" != "x"; then eval "ac_cv_lib_${sm_lib_safe}_${sm_func_safe}=yes" LIBS="$smart_ldflags $smart_lib $old_LIBS" SMART_LIBS="$smart_ldflags $smart_lib $SMART_LIBS" fi if test "x$ac_cv_lib_crypto_DH_new" = "xyes"; then printf "%s\n" "#define HAVE_LIBCRYPTO 1" >>confdefs.h OPENSSL_LIBS="$smart_lib" OPENSSL_LDFLAGS="$smart_ldflags" sm_lib_safe=`echo "ssl" | sed 'y%./+-%__p_%'` sm_func_safe=`echo "SSL_new" | sed 'y%./+-%__p_%'` old_LIBS="$LIBS" old_CPPFLAGS="$CPPFLAGS" smart_lib= smart_ldflags= smart_lib_dir= if test "x$smart_try_dir" != "x"; then for try in $smart_try_dir; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for SSL_new in -lssl in $try" >&5 printf %s "checking for SSL_new in -lssl in $try... " >&6; } LIBS="-lssl $old_LIBS" CPPFLAGS="-L$try -Wl,-rpath,$try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ extern char SSL_new(); int main (void) { SSL_new() ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : smart_lib="-lssl" smart_ldflags="-L$try -Wl,-rpath,$try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext done LIBS="$old_LIBS" CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_lib" = "x"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for SSL_new in -lssl" >&5 printf %s "checking for SSL_new in -lssl... " >&6; } LIBS="-lssl $old_LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ extern char SSL_new(); int main (void) { SSL_new() ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : smart_lib="-lssl" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext LIBS="$old_LIBS" fi if test "x$smart_lib" = "x"; then for try in /usr/local/lib /opt/lib; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for SSL_new in -lssl in $try" >&5 printf %s "checking for SSL_new in -lssl in $try... " >&6; } LIBS="-lssl $old_LIBS" CPPFLAGS="-L$try -Wl,-rpath,$try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ extern char SSL_new(); int main (void) { SSL_new() ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : smart_lib="-lssl" smart_ldflags="-L$try -Wl,-rpath,$try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext done LIBS="$old_LIBS" CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_lib" != "x"; then eval "ac_cv_lib_${sm_lib_safe}_${sm_func_safe}=yes" LIBS="$smart_ldflags $smart_lib $old_LIBS" SMART_LIBS="$smart_ldflags $smart_lib $SMART_LIBS" fi if test "x$ac_cv_lib_ssl_SSL_new" != "xyes"; then { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "failed linking to libssl. Use --with-openssl-lib-dir=, or --with-openssl=no (builds without OpenSSL) See \`config.log' for more details" "$LINENO" 5; } else printf "%s\n" "#define HAVE_LIBSSL 1" >>confdefs.h OPENSSL_LIBS="$OPENSSL_LIBS $smart_lib" if test "$OPENSSL_LDFLAGS" != "$smart_ldflags"; then { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "\"inconsistent LDFLAGS between -lssl '$smart_ldflags' and -lcrypto '$OPENSSL_LDFLAGS'\" See \`config.log' for more details" "$LINENO" 5; } fi fi else { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "failed linking to libcrypto. Use --with-openssl-lib-dir=, or --with-openssl=no (builds without OpenSSL) See \`config.log' for more details" "$LINENO" 5; } fi smart_try_dir="$openssl_include_dir" ac_safe=`echo "openssl/ssl.h" | sed 'y%./+-%__pm%'` old_CPPFLAGS="$CPPFLAGS" smart_include= smart_include_dir="/usr/local/include /opt/include" _smart_try_dir= _smart_include_dir= for _prefix in $smart_prefix ""; do for _dir in $smart_try_dir; do _smart_try_dir="${_smart_try_dir} ${_dir}/${_prefix}" done for _dir in $smart_include_dir; do _smart_include_dir="${_smart_include_dir} ${_dir}/${_prefix}" done done if test "x$_smart_try_dir" != "x"; then for try in $_smart_try_dir; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for openssl/ssl.h in $try" >&5 printf %s "checking for openssl/ssl.h in $try... " >&6; } CPPFLAGS="-isystem $try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include="-isystem $try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext done CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_include" = "x"; then for _prefix in $smart_prefix; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for ${_prefix}/openssl/ssl.h" >&5 printf %s "checking for ${_prefix}/openssl/ssl.h... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include="-isystem ${_prefix}/" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext done fi if test "x$smart_include" = "x"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for openssl/ssl.h" >&5 printf %s "checking for openssl/ssl.h... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include=" " { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext fi if test "x$smart_include" = "x"; then for try in $_smart_include_dir; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for openssl/ssl.h in $try" >&5 printf %s "checking for openssl/ssl.h in $try... " >&6; } CPPFLAGS="-isystem $try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include="-isystem $try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext done CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_include" != "x"; then eval "ac_cv_header_$ac_safe=yes" CPPFLAGS="$smart_include $old_CPPFLAGS" SMART_CPPFLAGS="$smart_include $SMART_CPPFLAGS" fi smart_prefix= if test "x$ac_cv_header_openssl_ssl_h" = "xyes"; then printf "%s\n" "#define HAVE_OPENSSL_SSL_H 1" >>confdefs.h for ac_header in openssl/asn1.h openssl/conf.h openssl/crypto.h openssl/err.h openssl/evp.h openssl/hmac.h openssl/md5.h openssl/md4.h openssl/rand.h openssl/sha.h openssl/ssl.h openssl/ocsp.h openssl/engine.h do : as_ac_Header=`printf "%s\n" "ac_cv_header_$ac_header" | $as_tr_sh` ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default" if eval test \"x\$"$as_ac_Header"\" = x"yes" then : cat >>confdefs.h <<_ACEOF #define `printf "%s\n" "HAVE_$ac_header" | $as_tr_cpp` 1 _ACEOF OPENSSL_CPPFLAGS="$smart_include" else $as_nop { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "failed locating OpenSSL headers. Use --with-openssl-include-dir=, or --with-openssl=no (builds without OpenSSL) See \`config.log' for more details" "$LINENO" 5; } fi done { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for OpenSSL version >= 1.0.2" >&5 printf %s "checking for OpenSSL version >= 1.0.2... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #if (OPENSSL_VERSION_NUMBER >= 0x10002000L) yes #endif _ACEOF if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | $EGREP "yes" >/dev/null 2>&1 then : { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "OpenSSL version too old See \`config.log' for more details" "$LINENO" 5; } fi rm -rf conftest* old_CPPFLAGS="$CPPFLAGS" CPPFLAGS="$OPENSSL_CPPFLAGS $CPPFLAGS" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking OpenSSL library and header version consistency" >&5 printf %s "checking OpenSSL library and header version consistency... " >&6; } if test "$cross_compiling" = yes then : { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: cross-compiling (assuming yes)" >&5 printf "%s\n" "cross-compiling (assuming yes)" >&6; } else $as_nop cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include #include int main (void) { printf("library: %lx header: %lx... ", (unsigned long) SSLeay(), (unsigned long) OPENSSL_VERSION_NUMBER); if (SSLeay() == OPENSSL_VERSION_NUMBER) { return 0; } else { return 1; } ; return 0; } _ACEOF if ac_fn_c_try_run "$LINENO" then : { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "OpenSSL library version does not match header version See \`config.log' for more details" "$LINENO" 5; } fi rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \ conftest.$ac_objext conftest.beam conftest.$ac_ext fi ac_fn_c_check_func "$LINENO" "SSL_get_client_random" "ac_cv_func_SSL_get_client_random" if test "x$ac_cv_func_SSL_get_client_random" = xyes then : printf "%s\n" "#define HAVE_SSL_GET_CLIENT_RANDOM 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "SSL_get_server_random" "ac_cv_func_SSL_get_server_random" if test "x$ac_cv_func_SSL_get_server_random" = xyes then : printf "%s\n" "#define HAVE_SSL_GET_SERVER_RANDOM 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "SSL_SESSION_get_master_key" "ac_cv_func_SSL_SESSION_get_master_key" if test "x$ac_cv_func_SSL_SESSION_get_master_key" = xyes then : printf "%s\n" "#define HAVE_SSL_SESSION_GET_MASTER_KEY 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "HMAC_CTX_new" "ac_cv_func_HMAC_CTX_new" if test "x$ac_cv_func_HMAC_CTX_new" = xyes then : printf "%s\n" "#define HAVE_HMAC_CTX_NEW 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "HMAC_CTX_free" "ac_cv_func_HMAC_CTX_free" if test "x$ac_cv_func_HMAC_CTX_free" = xyes then : printf "%s\n" "#define HAVE_HMAC_CTX_FREE 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "ASN1_STRING_get0_data" "ac_cv_func_ASN1_STRING_get0_data" if test "x$ac_cv_func_ASN1_STRING_get0_data" = xyes then : printf "%s\n" "#define HAVE_ASN1_STRING_GET0_DATA 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "CONF_modules_load_file" "ac_cv_func_CONF_modules_load_file" if test "x$ac_cv_func_CONF_modules_load_file" = xyes then : printf "%s\n" "#define HAVE_CONF_MODULES_LOAD_FILE 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "CRYPTO_set_id_callback" "ac_cv_func_CRYPTO_set_id_callback" if test "x$ac_cv_func_CRYPTO_set_id_callback" = xyes then : printf "%s\n" "#define HAVE_CRYPTO_SET_ID_CALLBACK 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "CRYPTO_set_locking_callback" "ac_cv_func_CRYPTO_set_locking_callback" if test "x$ac_cv_func_CRYPTO_set_locking_callback" = xyes then : printf "%s\n" "#define HAVE_CRYPTO_SET_LOCKING_CALLBACK 1" >>confdefs.h fi CPPFLAGS="$old_CPPFLAGS" fi LIBS="$OLD_LIBS" export OPENSSL_LIBS OPENSSL_LDFLAGS OPENSSL_CPPFLAGS fi if test "x$PCAP_LIBS" = x; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: skipping test for pcap.h." >&5 printf "%s\n" "$as_me: skipping test for pcap.h." >&6;} else smart_try_dir="$pcap_include_dir" ac_safe=`echo "pcap.h" | sed 'y%./+-%__pm%'` old_CPPFLAGS="$CPPFLAGS" smart_include= smart_include_dir="/usr/local/include /opt/include" _smart_try_dir= _smart_include_dir= for _prefix in $smart_prefix ""; do for _dir in $smart_try_dir; do _smart_try_dir="${_smart_try_dir} ${_dir}/${_prefix}" done for _dir in $smart_include_dir; do _smart_include_dir="${_smart_include_dir} ${_dir}/${_prefix}" done done if test "x$_smart_try_dir" != "x"; then for try in $_smart_try_dir; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for pcap.h in $try" >&5 printf %s "checking for pcap.h in $try... " >&6; } CPPFLAGS="-isystem $try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include="-isystem $try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext done CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_include" = "x"; then for _prefix in $smart_prefix; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for ${_prefix}/pcap.h" >&5 printf %s "checking for ${_prefix}/pcap.h... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include="-isystem ${_prefix}/" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext done fi if test "x$smart_include" = "x"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for pcap.h" >&5 printf %s "checking for pcap.h... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include=" " { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext fi if test "x$smart_include" = "x"; then for try in $_smart_include_dir; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for pcap.h in $try" >&5 printf %s "checking for pcap.h in $try... " >&6; } CPPFLAGS="-isystem $try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include="-isystem $try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext done CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_include" != "x"; then eval "ac_cv_header_$ac_safe=yes" CPPFLAGS="$smart_include $old_CPPFLAGS" SMART_CPPFLAGS="$smart_include $SMART_CPPFLAGS" fi smart_prefix= if test "x$ac_cv_header_pcap_h" = "xyes" && test "x$ac_cv_lib_pcap_pcap_open_live" = "xyes"; then printf "%s\n" "#define HAVE_LIBPCAP 1" >>confdefs.h else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: pcap headers not found, silently disabling the RADIUS sniffer, and ARP listener. Use --with-pcap-include-dir=." >&5 printf "%s\n" "$as_me: WARNING: pcap headers not found, silently disabling the RADIUS sniffer, and ARP listener. Use --with-pcap-include-dir=." >&2;} fi fi if test "x$COLLECTDC_LIBS" = x; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: skipping test for collectd/client.h." >&5 printf "%s\n" "$as_me: skipping test for collectd/client.h." >&6;} else smart_try_dir="$collectdclient_include_dir" ac_safe=`echo "collectd/client.h" | sed 'y%./+-%__pm%'` old_CPPFLAGS="$CPPFLAGS" smart_include= smart_include_dir="/usr/local/include /opt/include" _smart_try_dir= _smart_include_dir= for _prefix in $smart_prefix ""; do for _dir in $smart_try_dir; do _smart_try_dir="${_smart_try_dir} ${_dir}/${_prefix}" done for _dir in $smart_include_dir; do _smart_include_dir="${_smart_include_dir} ${_dir}/${_prefix}" done done if test "x$_smart_try_dir" != "x"; then for try in $_smart_try_dir; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for collectd/client.h in $try" >&5 printf %s "checking for collectd/client.h in $try... " >&6; } CPPFLAGS="-isystem $try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include="-isystem $try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext done CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_include" = "x"; then for _prefix in $smart_prefix; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for ${_prefix}/collectd/client.h" >&5 printf %s "checking for ${_prefix}/collectd/client.h... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include="-isystem ${_prefix}/" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext done fi if test "x$smart_include" = "x"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for collectd/client.h" >&5 printf %s "checking for collectd/client.h... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include=" " { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext fi if test "x$smart_include" = "x"; then for try in $_smart_include_dir; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for collectd/client.h in $try" >&5 printf %s "checking for collectd/client.h in $try... " >&6; } CPPFLAGS="-isystem $try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include="-isystem $try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext done CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_include" != "x"; then eval "ac_cv_header_$ac_safe=yes" CPPFLAGS="$smart_include $old_CPPFLAGS" SMART_CPPFLAGS="$smart_include $SMART_CPPFLAGS" fi smart_prefix= if test "x$ac_cv_header_collectd_client_h" = "xyes"; then printf "%s\n" "#define HAVE_COLLECTDC_H 1" >>confdefs.h else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: collectdclient headers not found. Use --with-collectdclient-include-dir=." >&5 printf "%s\n" "$as_me: WARNING: collectdclient headers not found. Use --with-collectdclient-include-dir=." >&2;} fi fi if test "x$HAVE_LIBCAP" = x; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: skipping test for cap.h." >&5 printf "%s\n" "$as_me: skipping test for cap.h." >&6;} else smart_try_dir="$cap_include_dir" ac_safe=`echo "sys/capability.h" | sed 'y%./+-%__pm%'` old_CPPFLAGS="$CPPFLAGS" smart_include= smart_include_dir="/usr/local/include /opt/include" _smart_try_dir= _smart_include_dir= for _prefix in $smart_prefix ""; do for _dir in $smart_try_dir; do _smart_try_dir="${_smart_try_dir} ${_dir}/${_prefix}" done for _dir in $smart_include_dir; do _smart_include_dir="${_smart_include_dir} ${_dir}/${_prefix}" done done if test "x$_smart_try_dir" != "x"; then for try in $_smart_try_dir; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for sys/capability.h in $try" >&5 printf %s "checking for sys/capability.h in $try... " >&6; } CPPFLAGS="-isystem $try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include="-isystem $try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext done CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_include" = "x"; then for _prefix in $smart_prefix; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for ${_prefix}/sys/capability.h" >&5 printf %s "checking for ${_prefix}/sys/capability.h... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include="-isystem ${_prefix}/" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext done fi if test "x$smart_include" = "x"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for sys/capability.h" >&5 printf %s "checking for sys/capability.h... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include=" " { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext fi if test "x$smart_include" = "x"; then for try in $_smart_include_dir; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for sys/capability.h in $try" >&5 printf %s "checking for sys/capability.h in $try... " >&6; } CPPFLAGS="-isystem $try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include="-isystem $try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext done CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_include" != "x"; then eval "ac_cv_header_$ac_safe=yes" CPPFLAGS="$smart_include $old_CPPFLAGS" SMART_CPPFLAGS="$smart_include $SMART_CPPFLAGS" fi smart_prefix= if test "x$ac_cv_header_sys_capability_h" = "xyes"; then printf "%s\n" "#define HAVE_CAPABILITY_H 1" >>confdefs.h else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: cap headers not found, will not perform debugger checks. Use --with-cap-include-dir=." >&5 printf "%s\n" "$as_me: WARNING: cap headers not found, will not perform debugger checks. Use --with-cap-include-dir=." >&2;} fi fi ac_fn_c_check_type "$LINENO" "off_t" "ac_cv_type_off_t" "$ac_includes_default" if test "x$ac_cv_type_off_t" = xyes then : else $as_nop printf "%s\n" "#define off_t long int" >>confdefs.h fi ac_fn_c_check_type "$LINENO" "pid_t" "ac_cv_type_pid_t" "$ac_includes_default " if test "x$ac_cv_type_pid_t" = xyes then : else $as_nop cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #if defined _WIN64 && !defined __CYGWIN__ LLP64 #endif int main (void) { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : ac_pid_type='int' else $as_nop ac_pid_type='__int64' fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext printf "%s\n" "#define pid_t $ac_pid_type" >>confdefs.h fi ac_fn_c_check_type "$LINENO" "size_t" "ac_cv_type_size_t" "$ac_includes_default" if test "x$ac_cv_type_size_t" = xyes then : else $as_nop printf "%s\n" "#define size_t unsigned int" >>confdefs.h fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for uid_t in sys/types.h" >&5 printf %s "checking for uid_t in sys/types.h... " >&6; } if test ${ac_cv_type_uid_t+y} then : printf %s "(cached) " >&6 else $as_nop cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include _ACEOF if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | $EGREP "uid_t" >/dev/null 2>&1 then : ac_cv_type_uid_t=yes else $as_nop ac_cv_type_uid_t=no fi rm -rf conftest* fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_type_uid_t" >&5 printf "%s\n" "$ac_cv_type_uid_t" >&6; } if test $ac_cv_type_uid_t = no; then printf "%s\n" "#define uid_t int" >>confdefs.h printf "%s\n" "#define gid_t int" >>confdefs.h fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for socklen_t" >&5 printf %s "checking for socklen_t... " >&6; } if test ${ac_cv_type_socklen_t+y} then : printf %s "(cached) " >&6 else $as_nop ac_cv_type_socklen_t=no cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #ifdef HAVE_SYS_TYPES_H # include #endif #ifdef HAVE_SYS_SOCKET_H # include #endif int main (void) { socklen_t foo ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : ac_cv_type_socklen_t=yes fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_type_socklen_t" >&5 printf "%s\n" "$ac_cv_type_socklen_t" >&6; } if test "$ac_cv_type_socklen_t" != "yes"; then printf "%s\n" "#define socklen_t int" >>confdefs.h fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for uint8_t" >&5 printf %s "checking for uint8_t... " >&6; } if test ${ac_cv_type_uint8_t+y} then : printf %s "(cached) " >&6 else $as_nop ac_cv_type_uint8_t=no cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #ifdef HAVE_INTTYPES_H # include #endif #ifdef HAVE_STDINT_H # include #endif int main (void) { uint8_t foo ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : ac_cv_type_uint8_t=yes fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_type_uint8_t" >&5 printf "%s\n" "$ac_cv_type_uint8_t" >&6; } if test "$ac_cv_type_uint8_t" != "yes"; then printf "%s\n" "#define uint8_t unsigned char" >>confdefs.h fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for uint16_t" >&5 printf %s "checking for uint16_t... " >&6; } if test ${ac_cv_type_uint16_t+y} then : printf %s "(cached) " >&6 else $as_nop ac_cv_type_uint16_t=no cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #ifdef HAVE_INTTYPES_H # include #endif #ifdef HAVE_STDINT_H # include #endif int main (void) { uint16_t foo ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : ac_cv_type_uint16_t=yes fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_type_uint16_t" >&5 printf "%s\n" "$ac_cv_type_uint16_t" >&6; } if test "$ac_cv_type_uint16_t" != "yes"; then printf "%s\n" "#define uint16_t unsigned short" >>confdefs.h fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for uint32_t" >&5 printf %s "checking for uint32_t... " >&6; } if test ${ac_cv_type_uint32_t+y} then : printf %s "(cached) " >&6 else $as_nop ac_cv_type_uint32_t=no cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #ifdef HAVE_INTTYPES_H # include #endif #ifdef HAVE_STDINT_H # include #endif int main (void) { uint32_t foo ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : ac_cv_type_uint32_t=yes fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_type_uint32_t" >&5 printf "%s\n" "$ac_cv_type_uint32_t" >&6; } if test "$ac_cv_type_uint32_t" != "yes"; then printf "%s\n" "#define uint32_t unsigned int" >>confdefs.h fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for uint64_t" >&5 printf %s "checking for uint64_t... " >&6; } if test ${ac_cv_type_uint64_t+y} then : printf %s "(cached) " >&6 else $as_nop ac_cv_type_uint64_t=no cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #ifdef HAVE_INTTYPES_H # include #endif #ifdef HAVE_STDINT_H # include #endif int main (void) { uint64_t foo ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : ac_cv_type_uint64_t=yes fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_type_uint64_t" >&5 printf "%s\n" "$ac_cv_type_uint64_t" >&6; } if test "$ac_cv_type_uint64_t" != "yes"; then printf "%s\n" "#define uint64_t unsigned long long" >>confdefs.h fi ac_fn_c_check_type "$LINENO" "__uint128_t" "ac_cv_type___uint128_t" "$ac_includes_default" if test "x$ac_cv_type___uint128_t" = xyes then : printf "%s\n" "#define HAVE___UINT128_T 1" >>confdefs.h fi ac_fn_c_check_type "$LINENO" "uint128_t" "ac_cv_type_uint128_t" " #ifdef HAVE_INTTYPES_H # include #endif #ifdef HAVE_STDINT_H # include #endif " if test "x$ac_cv_type_uint128_t" = xyes then : printf "%s\n" "#define HAVE_UINT128_T 1" >>confdefs.h fi ac_fn_c_check_type "$LINENO" "struct in6_addr" "ac_cv_type_struct_in6_addr" " #ifdef HAVE_NETINET_IN_H # include #endif " if test "x$ac_cv_type_struct_in6_addr" = xyes then : printf "%s\n" "#define HAVE_STRUCT_IN6_ADDR 1" >>confdefs.h fi ac_fn_c_check_type "$LINENO" "struct sockaddr_storage" "ac_cv_type_struct_sockaddr_storage" " #ifdef HAVE_NETINET_IN_H # include #endif #ifdef HAVE_SYS_SOCKET_H # include #endif " if test "x$ac_cv_type_struct_sockaddr_storage" = xyes then : printf "%s\n" "#define HAVE_STRUCT_SOCKADDR_STORAGE 1" >>confdefs.h fi ac_fn_c_check_type "$LINENO" "struct sockaddr_in6" "ac_cv_type_struct_sockaddr_in6" " #ifdef HAVE_NETINET_IN_H # include #endif " if test "x$ac_cv_type_struct_sockaddr_in6" = xyes then : printf "%s\n" "#define HAVE_STRUCT_SOCKADDR_IN6 1" >>confdefs.h fi ac_fn_c_check_type "$LINENO" "struct addrinfo" "ac_cv_type_struct_addrinfo" " #ifdef HAVE_SYS_TYPES_H # include #endif #ifdef HAVE_SYS_SOCKET_H # include #endif #ifdef HAVE_NETDB_H # include #endif " if test "x$ac_cv_type_struct_addrinfo" = xyes then : printf "%s\n" "#define HAVE_STRUCT_ADDRINFO 1" >>confdefs.h fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking if sig_t is defined" >&5 printf %s "checking if sig_t is defined... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #ifdef HAVE_SIGNAL_H # include #endif int main (void) { sig_t func; return 0; ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } printf "%s\n" "#define HAVE_SIG_T 1" >>confdefs.h else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext ac_fn_c_check_func "$LINENO" "bindat" "ac_cv_func_bindat" if test "x$ac_cv_func_bindat" = xyes then : printf "%s\n" "#define HAVE_BINDAT 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "clock_gettime" "ac_cv_func_clock_gettime" if test "x$ac_cv_func_clock_gettime" = xyes then : printf "%s\n" "#define HAVE_CLOCK_GETTIME 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "closefrom" "ac_cv_func_closefrom" if test "x$ac_cv_func_closefrom" = xyes then : printf "%s\n" "#define HAVE_CLOSEFROM 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "ctime_r" "ac_cv_func_ctime_r" if test "x$ac_cv_func_ctime_r" = xyes then : printf "%s\n" "#define HAVE_CTIME_R 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "dladdr" "ac_cv_func_dladdr" if test "x$ac_cv_func_dladdr" = xyes then : printf "%s\n" "#define HAVE_DLADDR 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "fcntl" "ac_cv_func_fcntl" if test "x$ac_cv_func_fcntl" = xyes then : printf "%s\n" "#define HAVE_FCNTL 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "fopencookie" "ac_cv_func_fopencookie" if test "x$ac_cv_func_fopencookie" = xyes then : printf "%s\n" "#define HAVE_FOPENCOOKIE 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "funopen" "ac_cv_func_funopen" if test "x$ac_cv_func_funopen" = xyes then : printf "%s\n" "#define HAVE_FUNOPEN 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "getaddrinfo" "ac_cv_func_getaddrinfo" if test "x$ac_cv_func_getaddrinfo" = xyes then : printf "%s\n" "#define HAVE_GETADDRINFO 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "getnameinfo" "ac_cv_func_getnameinfo" if test "x$ac_cv_func_getnameinfo" = xyes then : printf "%s\n" "#define HAVE_GETNAMEINFO 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "getopt_long" "ac_cv_func_getopt_long" if test "x$ac_cv_func_getopt_long" = xyes then : printf "%s\n" "#define HAVE_GETOPT_LONG 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "getpeereid" "ac_cv_func_getpeereid" if test "x$ac_cv_func_getpeereid" = xyes then : printf "%s\n" "#define HAVE_GETPEEREID 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "getresuid" "ac_cv_func_getresuid" if test "x$ac_cv_func_getresuid" = xyes then : printf "%s\n" "#define HAVE_GETRESUID 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "gettimeofday" "ac_cv_func_gettimeofday" if test "x$ac_cv_func_gettimeofday" = xyes then : printf "%s\n" "#define HAVE_GETTIMEOFDAY 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "getusershell" "ac_cv_func_getusershell" if test "x$ac_cv_func_getusershell" = xyes then : printf "%s\n" "#define HAVE_GETUSERSHELL 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "gmtime_r" "ac_cv_func_gmtime_r" if test "x$ac_cv_func_gmtime_r" = xyes then : printf "%s\n" "#define HAVE_GMTIME_R 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "if_indextoname" "ac_cv_func_if_indextoname" if test "x$ac_cv_func_if_indextoname" = xyes then : printf "%s\n" "#define HAVE_IF_INDEXTONAME 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "inet_aton" "ac_cv_func_inet_aton" if test "x$ac_cv_func_inet_aton" = xyes then : printf "%s\n" "#define HAVE_INET_ATON 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "inet_ntop" "ac_cv_func_inet_ntop" if test "x$ac_cv_func_inet_ntop" = xyes then : printf "%s\n" "#define HAVE_INET_NTOP 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "inet_pton" "ac_cv_func_inet_pton" if test "x$ac_cv_func_inet_pton" = xyes then : printf "%s\n" "#define HAVE_INET_PTON 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "initgroups" "ac_cv_func_initgroups" if test "x$ac_cv_func_initgroups" = xyes then : printf "%s\n" "#define HAVE_INITGROUPS 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "kqueue" "ac_cv_func_kqueue" if test "x$ac_cv_func_kqueue" = xyes then : printf "%s\n" "#define HAVE_KQUEUE 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "localtime_r" "ac_cv_func_localtime_r" if test "x$ac_cv_func_localtime_r" = xyes then : printf "%s\n" "#define HAVE_LOCALTIME_R 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "mallopt" "ac_cv_func_mallopt" if test "x$ac_cv_func_mallopt" = xyes then : printf "%s\n" "#define HAVE_MALLOPT 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "mkdirat" "ac_cv_func_mkdirat" if test "x$ac_cv_func_mkdirat" = xyes then : printf "%s\n" "#define HAVE_MKDIRAT 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "openat" "ac_cv_func_openat" if test "x$ac_cv_func_openat" = xyes then : printf "%s\n" "#define HAVE_OPENAT 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "pthread_sigmask" "ac_cv_func_pthread_sigmask" if test "x$ac_cv_func_pthread_sigmask" = xyes then : printf "%s\n" "#define HAVE_PTHREAD_SIGMASK 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "setlinebuf" "ac_cv_func_setlinebuf" if test "x$ac_cv_func_setlinebuf" = xyes then : printf "%s\n" "#define HAVE_SETLINEBUF 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "setresuid" "ac_cv_func_setresuid" if test "x$ac_cv_func_setresuid" = xyes then : printf "%s\n" "#define HAVE_SETRESUID 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "setsid" "ac_cv_func_setsid" if test "x$ac_cv_func_setsid" = xyes then : printf "%s\n" "#define HAVE_SETSID 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "setuid" "ac_cv_func_setuid" if test "x$ac_cv_func_setuid" = xyes then : printf "%s\n" "#define HAVE_SETUID 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "setvbuf" "ac_cv_func_setvbuf" if test "x$ac_cv_func_setvbuf" = xyes then : printf "%s\n" "#define HAVE_SETVBUF 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "sigaction" "ac_cv_func_sigaction" if test "x$ac_cv_func_sigaction" = xyes then : printf "%s\n" "#define HAVE_SIGACTION 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "sigprocmask" "ac_cv_func_sigprocmask" if test "x$ac_cv_func_sigprocmask" = xyes then : printf "%s\n" "#define HAVE_SIGPROCMASK 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "snprintf" "ac_cv_func_snprintf" if test "x$ac_cv_func_snprintf" = xyes then : printf "%s\n" "#define HAVE_SNPRINTF 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "strcasecmp" "ac_cv_func_strcasecmp" if test "x$ac_cv_func_strcasecmp" = xyes then : printf "%s\n" "#define HAVE_STRCASECMP 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "strlcat" "ac_cv_func_strlcat" if test "x$ac_cv_func_strlcat" = xyes then : printf "%s\n" "#define HAVE_STRLCAT 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "strlcpy" "ac_cv_func_strlcpy" if test "x$ac_cv_func_strlcpy" = xyes then : printf "%s\n" "#define HAVE_STRLCPY 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "strncasecmp" "ac_cv_func_strncasecmp" if test "x$ac_cv_func_strncasecmp" = xyes then : printf "%s\n" "#define HAVE_STRNCASECMP 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "strsep" "ac_cv_func_strsep" if test "x$ac_cv_func_strsep" = xyes then : printf "%s\n" "#define HAVE_STRSEP 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "strsignal" "ac_cv_func_strsignal" if test "x$ac_cv_func_strsignal" = xyes then : printf "%s\n" "#define HAVE_STRSIGNAL 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "unlinkat" "ac_cv_func_unlinkat" if test "x$ac_cv_func_unlinkat" = xyes then : printf "%s\n" "#define HAVE_UNLINKAT 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "vdprintf" "ac_cv_func_vdprintf" if test "x$ac_cv_func_vdprintf" = xyes then : printf "%s\n" "#define HAVE_VDPRINTF 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "vsnprintf" "ac_cv_func_vsnprintf" if test "x$ac_cv_func_vsnprintf" = xyes then : printf "%s\n" "#define HAVE_VSNPRINTF 1" >>confdefs.h fi if test "x$ac_cv_header_utmpx_h" = "xyes"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for ut_xtime in struct utmpx" >&5 printf %s "checking for ut_xtime in struct utmpx... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #ifdef HAVE_STDDEF_H #include #endif #ifndef offsetof #define offsetof(TYPE, MEMBER) ((int) &((TYPE *)0)->MEMBER) #endif int main (void) { int foo = offsetof(struct utmpx, ut_xtime) ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : has_element=" " else $as_nop has_element= fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext ac_safe_type=`echo "struct utmpx" | sed 'y% %_%'` if test "x$has_element" != "x"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } eval "ac_cv_type_${ac_safe_type}_has_ut_xtime=yes" else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } eval "ac_cv_type_${ac_safe_type}_has_ut_xtime=" fi if test "x$ac_cv_type_struct_utmpx_has_ut_xtime" = "x"; then printf "%s\n" "#define ut_xtime ut_tv.tv_sec" >>confdefs.h fi fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for ipi_addr in struct in_pktinfo" >&5 printf %s "checking for ipi_addr in struct in_pktinfo... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #ifdef HAVE_STDDEF_H #include #endif #ifndef offsetof #define offsetof(TYPE, MEMBER) ((int) &((TYPE *)0)->MEMBER) #endif int main (void) { int foo = offsetof(struct in_pktinfo, ipi_addr) ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : has_element=" " else $as_nop has_element= fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext ac_safe_type=`echo "struct in_pktinfo" | sed 'y% %_%'` if test "x$has_element" != "x"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } eval "ac_cv_type_${ac_safe_type}_has_ipi_addr=yes" else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } eval "ac_cv_type_${ac_safe_type}_has_ipi_addr=" fi if test "x$ac_cv_type_struct_in_pktinfo_has_ipi_addr" = "xyes"; then printf "%s\n" "#define HAVE_IP_PKTINFO /**/" >>confdefs.h fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for ipi6_addr in struct in6_pktinfo" >&5 printf %s "checking for ipi6_addr in struct in6_pktinfo... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #ifdef HAVE_STDDEF_H #include #endif #ifndef offsetof #define offsetof(TYPE, MEMBER) ((int) &((TYPE *)0)->MEMBER) #endif int main (void) { int foo = offsetof(struct in6_pktinfo, ipi6_addr) ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : has_element=" " else $as_nop has_element= fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext ac_safe_type=`echo "struct in6_pktinfo" | sed 'y% %_%'` if test "x$has_element" != "x"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } eval "ac_cv_type_${ac_safe_type}_has_ipi6_addr=yes" else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } eval "ac_cv_type_${ac_safe_type}_has_ipi6_addr=" fi if test "x$ac_cv_type_struct_in6_pktinfo_has_ipi6_addr" = "xyes"; then printf "%s\n" "#define HAVE_IN6_PKTINFO /**/" >>confdefs.h fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking if htonll is defined" >&5 printf %s "checking if htonll is defined... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include int main (void) { return htonll(0); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } printf "%s\n" "#define HAVE_HTONLL 1" >>confdefs.h else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking if htonlll is defined" >&5 printf %s "checking if htonlll is defined... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include int main (void) { return htonlll(0); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } printf "%s\n" "#define HAVE_HTONLLL 1" >>confdefs.h else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for an ANSI C-conforming const" >&5 printf %s "checking for an ANSI C-conforming const... " >&6; } if test ${ac_cv_c_const+y} then : printf %s "(cached) " >&6 else $as_nop cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main (void) { #ifndef __cplusplus /* Ultrix mips cc rejects this sort of thing. */ typedef int charset[2]; const charset cs = { 0, 0 }; /* SunOS 4.1.1 cc rejects this. */ char const *const *pcpcc; char **ppc; /* NEC SVR4.0.2 mips cc rejects this. */ struct point {int x, y;}; static struct point const zero = {0,0}; /* IBM XL C 1.02.0.0 rejects this. It does not let you subtract one const X* pointer from another in an arm of an if-expression whose if-part is not a constant expression */ const char *g = "string"; pcpcc = &g + (g ? g-g : 0); /* HPUX 7.0 cc rejects these. */ ++pcpcc; ppc = (char**) pcpcc; pcpcc = (char const *const *) ppc; { /* SCO 3.2v4 cc rejects this sort of thing. */ char tx; char *t = &tx; char const *s = 0 ? (char *) 0 : (char const *) 0; *t++ = 0; if (s) return 0; } { /* Someone thinks the Sun supposedly-ANSI compiler will reject this. */ int x[] = {25, 17}; const int *foo = &x[0]; ++foo; } { /* Sun SC1.0 ANSI compiler rejects this -- but not the above. */ typedef const int *iptr; iptr p = 0; ++p; } { /* IBM XL C 1.02.0.0 rejects this sort of thing, saying "k.c", line 2.27: 1506-025 (S) Operand must be a modifiable lvalue. */ struct s { int j; const int *ap[3]; } bx; struct s *b = &bx; b->j = 5; } { /* ULTRIX-32 V3.1 (Rev 9) vcc rejects this */ const int foo = 10; if (!foo) return 0; } return !cs[0] && !zero.x; #endif ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : ac_cv_c_const=yes else $as_nop ac_cv_c_const=no fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_const" >&5 printf "%s\n" "$ac_cv_c_const" >&6; } if test $ac_cv_c_const = no; then printf "%s\n" "#define const /**/" >>confdefs.h fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking type of OS" >&5 printf %s "checking type of OS... " >&6; } OS=`uname -s` { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $OS" >&5 printf "%s\n" "$OS" >&6; } if test "$OS" = "OS/2"; then LIBPREFIX= else LIBPREFIX=lib fi if test "x$developer" = "xyes"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Setting additional developer CFLAGS" >&5 printf "%s\n" "$as_me: Setting additional developer CFLAGS" >&6;} { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for the compiler flag \"-Wdocumentation\"" >&5 printf %s "checking for the compiler flag \"-Wdocumentation\"... " >&6; } if test ${ax_cv_cc_wdocumentation_flag+y} then : printf %s "(cached) " >&6 else $as_nop CFLAGS_SAVED=$CFLAGS CFLAGS="$CFLAGS -Werror -Wdocumentation" ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main (void) { return 0; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : ax_cv_cc_wdocumentation_flag="yes" else $as_nop ax_cv_cc_wdocumentation_flag="no" fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu CFLAGS="$CFLAGS_SAVED" fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_cc_wdocumentation_flag" >&5 printf "%s\n" "$ax_cv_cc_wdocumentation_flag" >&6; } if test "x$ax_cv_cc_wdocumentation_flag" = "xyes"; then devcflags="-Wdocumentation" printf "%s\n" "#define HAVE_WDOCUMENTATION 1" >>confdefs.h fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for the compiler flag \"-Weverything\"" >&5 printf %s "checking for the compiler flag \"-Weverything\"... " >&6; } if test ${ax_cv_cc_weverything_flag+y} then : printf %s "(cached) " >&6 else $as_nop CFLAGS_SAVED=$CFLAGS CFLAGS="$CFLAGS -Werror -Weverything -Wno-reserved-id-macro -Wno-unused-macros -Wno-unreachable-code-return -Wno-poison-system-directories" ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main (void) { return 0; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : ax_cv_cc_weverything_flag="yes" else $as_nop ax_cv_cc_weverything_flag="no" fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu CFLAGS="$CFLAGS_SAVED" fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_cc_weverything_flag" >&5 printf "%s\n" "$ax_cv_cc_weverything_flag" >&6; } if test "x$ax_cv_cc_weverything_flag" = "xyes"; then devcflags="$devcflags -W -Weverything -Wformat=2 -Wno-missing-field-initializers -Wno-date-time -Wno-padded -Wno-gnu-zero-variadic-macro-arguments -Wno-shorten-64-to-32 -Wno-sign-conversion -Wno-conversion -Wno-switch-enum -Wno-gnu-statement-expression -Wno-extended-offsetof -Wno-cast-align -Wno-documentation-unknown-command -Wno-covered-switch-default -Wno-packed $verify_ptr" else if test "x$GCC" = "xyes"; then devcflags="$devcflags -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -Wformat-y2k -Wno-format-extra-args -Wno-format-zero-length -Wno-cast-align -Wformat-nonliteral -Wformat-security -Wformat=2 $verify_ptr" INSTALLSTRIP="" fi fi fsanitizeflags= if test "x$fuzzer" = "xyes" && test "x$ax_cv_cc_clang" = "xyes"; then fsanitizeflags="$fsanitizeflags,fuzzer-no-link" fi if test "x$address_sanitizer" = "xyes"; then devcflags="$devcflags -fno-omit-frame-pointer -fno-optimize-sibling-calls" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for the compiler flag \"-fsanitize-address-use-after-scope\"" >&5 printf %s "checking for the compiler flag \"-fsanitize-address-use-after-scope\"... " >&6; } if test ${ax_cv_cc_sanitize_address_use_after_scope+y} then : printf %s "(cached) " >&6 else $as_nop CFLAGS_SAVED=$CFLAGS CFLAGS="$CFLAGS -Werror -fsanitize=address -fsanitize-address-use-after-scope" ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main (void) { return 0; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : ax_cv_cc_sanitize_address_use_after_scope="yes" else $as_nop ax_cv_cc_sanitize_address_use_after_scope="no" fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu CFLAGS="$CFLAGS_SAVED" fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_cc_sanitize_address_use_after_scope" >&5 printf "%s\n" "$ax_cv_cc_sanitize_address_use_after_scope" >&6; } if test "x$ax_cv_cc_sanitize_address_use_after_scope" = "xyes"; then devcflags="$devcflags -fsanitize-address-use-after-scope" fi ac_fn_c_check_header_compile "$LINENO" "sanitizer/lsan_interface.h" "ac_cv_header_sanitizer_lsan_interface_h" "$ac_includes_default" if test "x$ac_cv_header_sanitizer_lsan_interface_h" = xyes then : printf "%s\n" "#define HAVE_SANITIZER_LSAN_INTERFACE_H 1" >>confdefs.h fi fsanitizeflags="$fsanitizeflags,address" fi if test "x$leak_sanitizer" = "xyes"; then fsanitizeflags="$fsanitizeflags,leak" fi if test "x$thread_sanitizer" = "xyes"; then fsanitizeflags="$fsanitizeflags,thread" fi if test "x$undefined_behaviour_sanitizer" = "xyes"; then devcflags="$devcflags -fno-sanitize-recover=undefined -fno-omit-frame-pointer" devldflags="$devldflags -fno-sanitize-recover=undefined" fsanitizeflags="$fsanitizeflags,undefined" fi if test "x$fsanitizeflags" != "x"; then fsanitizeflags="$(echo $fsanitizeflags | sed 's/^,*//')" devcflags="-fsanitize=$fsanitizeflags $devcflags" devldflags="-fsanitize=$fsanitizeflags $devldflags" fi devcflags="$(echo $devcflags | sed -e 's/\\t//g;s/ //g')" devldflags="$(echo $devldflags | sed -e 's/\\t//g;s/ //g')" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Developer CFLAGS are \"$devcflags\"" >&5 printf "%s\n" "$as_me: Developer CFLAGS are \"$devcflags\"" >&6;} { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Developer LDFLAGS are \"$devldflags\"" >&5 printf "%s\n" "$as_me: Developer LDFLAGS are \"$devldflags\"" >&6;} if test "x$EXPERIMENTAL" != "xno"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: is developer build, enabling experimental modules implicitly, disable with --without-experimental-modules" >&5 printf "%s\n" "$as_me: is developer build, enabling experimental modules implicitly, disable with --without-experimental-modules" >&6;} EXPERIMENTAL=yes fi else devcflags="" devldflags="" CFLAGS="$CFLAGS -DNDEBUG" INSTALLSTRIP="" fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking if building with -DNDEBUG" >&5 printf %s "checking if building with -DNDEBUG... " >&6; } if echo "$CFLAGS" | grep '\-DNDEBUG' > /dev/null; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } printf "%s\n" "#define WITH_NDEBUG 1" >>confdefs.h else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi export EXPERIMENTAL if test -d $srcdir/.git -a "x$GIT" = "xyes"; then RADIUSD_VERSION_COMMIT=`git log --pretty=format:'%h' -n 1 | cut -c1-9` printf "%s\n" "#define RADIUSD_VERSION_COMMIT ${RADIUSD_VERSION_COMMIT}" >>confdefs.h fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for __thread support in compiler" >&5 printf %s "checking for __thread support in compiler... " >&6; } if test "$cross_compiling" = yes then : have_tls=no else $as_nop cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ static __thread int val; int main(int argc, char **argv) { val = 0; return val; } _ACEOF if ac_fn_c_try_run "$LINENO" then : have_tls=yes else $as_nop have_tls=no fi rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \ conftest.$ac_objext conftest.beam conftest.$ac_ext fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $have_tls" >&5 printf "%s\n" "$have_tls" >&6; } if test "x$have_tls" = "xyes"; then printf "%s\n" "#define TLS_STORAGE_CLASS __thread" >>confdefs.h fi if test "x$have_tls" = "xno"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for __declspec(thread) support in compiler" >&5 printf %s "checking for __declspec(thread) support in compiler... " >&6; } if test "$cross_compiling" = yes then : have_tls=no else $as_nop cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ static _Thread_local int val; int main(int argc, char **argv) { val = 0; return val; } _ACEOF if ac_fn_c_try_run "$LINENO" then : have_tls=yes else $as_nop have_tls=no fi rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \ conftest.$ac_objext conftest.beam conftest.$ac_ext fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $have_tls" >&5 printf "%s\n" "$have_tls" >&6; } if test "x$have_tls" = "xyes"; then printf "%s\n" "#define TLS_STORAGE_CLASS __declspec(thread)" >>confdefs.h fi fi if test "x$have_tls" = "xno"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for _Thread_local support in compiler" >&5 printf %s "checking for _Thread_local support in compiler... " >&6; } if test "$cross_compiling" = yes then : have_tls=no else $as_nop cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ static _Thread_local int val; int main(int argc, char **argv) { val = 0; return val; } _ACEOF if ac_fn_c_try_run "$LINENO" then : have_tls=yes else $as_nop have_tls=no fi rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \ conftest.$ac_objext conftest.beam conftest.$ac_ext fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $have_tls" >&5 printf "%s\n" "$have_tls" >&6; } if test "x$have_tls" = "xyes"; then printf "%s\n" "#define TLS_STORAGE_CLASS _Thread_local" >>confdefs.h fi fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for __builtin_choose_expr support in compiler" >&5 printf %s "checking for __builtin_choose_expr support in compiler... " >&6; } if test ${ax_cv_cc_builtin_choose_expr+y} then : printf %s "(cached) " >&6 else $as_nop if test "$cross_compiling" = yes then : { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "cannot run test program while cross compiling See \`config.log' for more details" "$LINENO" 5; } else $as_nop cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main(int argc, char **argv) { if ((argc < 0) || !argv) return 1; /* -Werror=unused-parameter */ return __builtin_choose_expr(0, 1, 0); } _ACEOF if ac_fn_c_try_run "$LINENO" then : ax_cv_cc_builtin_choose_expr=yes else $as_nop ax_cv_cc_builtin_choose_expr=no fi rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \ conftest.$ac_objext conftest.beam conftest.$ac_ext fi fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_cc_builtin_choose_expr" >&5 printf "%s\n" "$ax_cv_cc_builtin_choose_expr" >&6; } if test "x$ax_cv_cc_builtin_choose_expr" = "xyes"; then printf "%s\n" "#define HAVE_BUILTIN_CHOOSE_EXPR 1" >>confdefs.h fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for __builtin_types_compatible_p support in compiler" >&5 printf %s "checking for __builtin_types_compatible_p support in compiler... " >&6; } if test ${ax_cv_cc_builtin_types_compatible_p+y} then : printf %s "(cached) " >&6 else $as_nop if test "$cross_compiling" = yes then : { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "cannot run test program while cross compiling See \`config.log' for more details" "$LINENO" 5; } else $as_nop cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main(int argc, char **argv) { if ((argc < 0) || !argv) return 1; /* -Werror=unused-parameter */ return !(__builtin_types_compatible_p(char *, char *)); } _ACEOF if ac_fn_c_try_run "$LINENO" then : ax_cv_cc_builtin_types_compatible_p=yes else $as_nop ax_cv_cc_builtin_types_compatible_p=no fi rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \ conftest.$ac_objext conftest.beam conftest.$ac_ext fi fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_cc_builtin_types_compatible_p" >&5 printf "%s\n" "$ax_cv_cc_builtin_types_compatible_p" >&6; } if test "x$ax_cv_cc_builtin_types_compatible_p" = "xyes"; then printf "%s\n" "#define HAVE_BUILTIN_TYPES_COMPATIBLE_P 1" >>confdefs.h fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for __builtin_bswap64 support in compiler" >&5 printf %s "checking for __builtin_bswap64 support in compiler... " >&6; } if test ${ax_cv_cc_builtin_bswap64+y} then : printf %s "(cached) " >&6 else $as_nop if test "$cross_compiling" = yes then : { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "cannot run test program while cross compiling See \`config.log' for more details" "$LINENO" 5; } else $as_nop cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main(int argc, char **argv) { if ((argc < 0) || !argv) return 1; /* -Werror=unused-parameter */ return (__builtin_bswap64(0)); } _ACEOF if ac_fn_c_try_run "$LINENO" then : ax_cv_cc_builtin_bswap64=yes else $as_nop ax_cv_cc_builtin_bswap64=no fi rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \ conftest.$ac_objext conftest.beam conftest.$ac_ext fi fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_cc_builtin_bswap64" >&5 printf "%s\n" "$ax_cv_cc_builtin_bswap64" >&6; } if test "x$ax_cv_cc_builtin_bswap64" = "xyes"; then printf "%s\n" "#define HAVE_BUILTIN_BSWAP_64 1" >>confdefs.h fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for __attribute__((__bounded__)) support in compiler" >&5 printf %s "checking for __attribute__((__bounded__)) support in compiler... " >&6; } if test ${ax_cv_cc_bounded_attribute+y} then : printf %s "(cached) " >&6 else $as_nop CFLAGS_SAVED=$CFLAGS CFLAGS="$CFLAGS -Werror" if test "$cross_compiling" = yes then : { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "cannot run test program while cross compiling See \`config.log' for more details" "$LINENO" 5; } else $as_nop cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ void test(char *buff) __attribute__ ((__bounded__ (__string__, 1, 1))); int main(int argc, char **argv) { if ((argc < 0) || !argv) return 1; /* -Werror=unused-parameter */ return 0; } _ACEOF if ac_fn_c_try_run "$LINENO" then : ax_cv_cc_bounded_attribute=yes else $as_nop ax_cv_cc_bounded_attribute=no fi rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \ conftest.$ac_objext conftest.beam conftest.$ac_ext fi CFLAGS="$CFLAGS_SAVED" fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_cc_bounded_attribute" >&5 printf "%s\n" "$ax_cv_cc_bounded_attribute" >&6; } if test "x$ax_cv_cc_bounded_attribute" = "xyes"; then printf "%s\n" "#define HAVE_ATTRIBUTE_BOUNDED 1" >>confdefs.h fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for talloc_set_memlimit in -ltalloc" >&5 printf %s "checking for talloc_set_memlimit in -ltalloc... " >&6; } if test ${ac_cv_lib_talloc_talloc_set_memlimit+y} then : printf %s "(cached) " >&6 else $as_nop ac_check_lib_save_LIBS=$LIBS LIBS="-ltalloc $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ char talloc_set_memlimit (); int main (void) { return talloc_set_memlimit (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : ac_cv_lib_talloc_talloc_set_memlimit=yes else $as_nop ac_cv_lib_talloc_talloc_set_memlimit=no fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_talloc_talloc_set_memlimit" >&5 printf "%s\n" "$ac_cv_lib_talloc_talloc_set_memlimit" >&6; } if test "x$ac_cv_lib_talloc_talloc_set_memlimit" = xyes then : printf "%s\n" "#define HAVE_TALLOC_SET_MEMLIMIT 1" >>confdefs.h fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for crypt in -lcrypt" >&5 printf %s "checking for crypt in -lcrypt... " >&6; } if test ${ac_cv_lib_crypt_crypt+y} then : printf %s "(cached) " >&6 else $as_nop ac_check_lib_save_LIBS=$LIBS LIBS="-lcrypt $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ char crypt (); int main (void) { return crypt (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : ac_cv_lib_crypt_crypt=yes else $as_nop ac_cv_lib_crypt_crypt=no fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_crypt_crypt" >&5 printf "%s\n" "$ac_cv_lib_crypt_crypt" >&6; } if test "x$ac_cv_lib_crypt_crypt" = xyes then : CRYPTLIB="-lcrypt" fi if test "$CRYPTLIB" != ""; then printf "%s\n" "#define HAVE_CRYPT /**/" >>confdefs.h else ac_fn_c_check_func "$LINENO" "crypt" "ac_cv_func_crypt" if test "x$ac_cv_func_crypt" = xyes then : printf "%s\n" "#define HAVE_CRYPT /**/" >>confdefs.h fi fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for crypt_r in -lcrypt" >&5 printf %s "checking for crypt_r in -lcrypt... " >&6; } if test ${ac_cv_lib_crypt_crypt_r+y} then : printf %s "(cached) " >&6 else $as_nop ac_check_lib_save_LIBS=$LIBS LIBS="-lcrypt $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ char crypt_r (); int main (void) { return crypt_r (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : ac_cv_lib_crypt_crypt_r=yes else $as_nop ac_cv_lib_crypt_crypt_r=no fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_crypt_crypt_r" >&5 printf "%s\n" "$ac_cv_lib_crypt_crypt_r" >&6; } if test "x$ac_cv_lib_crypt_crypt_r" = xyes then : printf "%s\n" "#define HAVE_CRYPT_R /**/" >>confdefs.h fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for setkey in -lcipher" >&5 printf %s "checking for setkey in -lcipher... " >&6; } if test ${ac_cv_lib_cipher_setkey+y} then : printf %s "(cached) " >&6 else $as_nop ac_check_lib_save_LIBS=$LIBS LIBS="-lcipher $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ char setkey (); int main (void) { return setkey (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : ac_cv_lib_cipher_setkey=yes else $as_nop ac_cv_lib_cipher_setkey=no fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_cipher_setkey" >&5 printf "%s\n" "$ac_cv_lib_cipher_setkey" >&6; } if test "x$ac_cv_lib_cipher_setkey" = xyes then : CRYPTLIB="${CRYPTLIB} -lcipher" fi execinfo_lib_dir= # Check whether --with-execinfo-lib-dir was given. if test ${with_execinfo_lib_dir+y} then : withval=$with_execinfo_lib_dir; case "$withval" in no) as_fn_error $? "Need execinfo-lib-dir" "$LINENO" 5 ;; yes) ;; *) execinfo_lib_dir="$withval" ;; esac fi execinfo_include_dir= # Check whether --with-execinfo-include-dir was given. if test ${with_execinfo_include_dir+y} then : withval=$with_execinfo_include_dir; case "$withval" in no) as_fn_error $? "Need execinfo-include-dir" "$LINENO" 5 ;; yes) ;; *) execinfo_include_dir="$withval" ;; esac fi smart_try_dir=$execinfo_include_dir ac_safe=`echo "execinfo.h" | sed 'y%./+-%__pm%'` old_CPPFLAGS="$CPPFLAGS" smart_include= smart_include_dir="/usr/local/include /opt/include" _smart_try_dir= _smart_include_dir= for _prefix in $smart_prefix ""; do for _dir in $smart_try_dir; do _smart_try_dir="${_smart_try_dir} ${_dir}/${_prefix}" done for _dir in $smart_include_dir; do _smart_include_dir="${_smart_include_dir} ${_dir}/${_prefix}" done done if test "x$_smart_try_dir" != "x"; then for try in $_smart_try_dir; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for execinfo.h in $try" >&5 printf %s "checking for execinfo.h in $try... " >&6; } CPPFLAGS="-isystem $try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include="-isystem $try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext done CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_include" = "x"; then for _prefix in $smart_prefix; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for ${_prefix}/execinfo.h" >&5 printf %s "checking for ${_prefix}/execinfo.h... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include="-isystem ${_prefix}/" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext done fi if test "x$smart_include" = "x"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for execinfo.h" >&5 printf %s "checking for execinfo.h... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include=" " { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext fi if test "x$smart_include" = "x"; then for try in $_smart_include_dir; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for execinfo.h in $try" >&5 printf %s "checking for execinfo.h in $try... " >&6; } CPPFLAGS="-isystem $try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include="-isystem $try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext done CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_include" != "x"; then eval "ac_cv_header_$ac_safe=yes" CPPFLAGS="$smart_include $old_CPPFLAGS" SMART_CPPFLAGS="$smart_include $SMART_CPPFLAGS" fi smart_prefix= if test "x$ac_cv_header_execinfo_h" = "xyes"; then smart_try_dir=$execinfo_lib_dir sm_lib_safe=`echo "execinfo" | sed 'y%./+-%__p_%'` sm_func_safe=`echo "backtrace_symbols" | sed 'y%./+-%__p_%'` old_LIBS="$LIBS" old_CPPFLAGS="$CPPFLAGS" smart_lib= smart_ldflags= smart_lib_dir= if test "x$smart_try_dir" != "x"; then for try in $smart_try_dir; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for backtrace_symbols in -lexecinfo in $try" >&5 printf %s "checking for backtrace_symbols in -lexecinfo in $try... " >&6; } LIBS="-lexecinfo $old_LIBS" CPPFLAGS="-L$try -Wl,-rpath,$try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ extern char backtrace_symbols(); int main (void) { backtrace_symbols() ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : smart_lib="-lexecinfo" smart_ldflags="-L$try -Wl,-rpath,$try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext done LIBS="$old_LIBS" CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_lib" = "x"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for backtrace_symbols in -lexecinfo" >&5 printf %s "checking for backtrace_symbols in -lexecinfo... " >&6; } LIBS="-lexecinfo $old_LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ extern char backtrace_symbols(); int main (void) { backtrace_symbols() ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : smart_lib="-lexecinfo" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext LIBS="$old_LIBS" fi if test "x$smart_lib" = "x"; then for try in /usr/local/lib /opt/lib; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for backtrace_symbols in -lexecinfo in $try" >&5 printf %s "checking for backtrace_symbols in -lexecinfo in $try... " >&6; } LIBS="-lexecinfo $old_LIBS" CPPFLAGS="-L$try -Wl,-rpath,$try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ extern char backtrace_symbols(); int main (void) { backtrace_symbols() ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : smart_lib="-lexecinfo" smart_ldflags="-L$try -Wl,-rpath,$try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext done LIBS="$old_LIBS" CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_lib" != "x"; then eval "ac_cv_lib_${sm_lib_safe}_${sm_func_safe}=yes" LIBS="$smart_ldflags $smart_lib $old_LIBS" SMART_LIBS="$smart_ldflags $smart_lib $SMART_LIBS" fi if test "x$ac_cv_lib_execinfo_backtrace_symbols" != "xyes"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking if execinfo provided as part of libc" >&5 printf %s "checking if execinfo provided as part of libc... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { void *sym[1]; backtrace_symbols(&sym, sizeof(sym)) ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } ac_cv_lib_execinfo_backtrace_symbols="yes" else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext fi if test "x$ac_cv_lib_execinfo_backtrace_symbols" = "xyes"; then printf "%s\n" "#define HAVE_EXECINFO 1" >>confdefs.h fi fi PCRE=yes # Check whether --with-pcre was given. if test ${with_pcre+y} then : withval=$with_pcre; case "$withval" in no) PCRE=no ;; yes) PCRE=yes ;; esac fi pcre_lib_dir= # Check whether --with-pcre-lib-dir was given. if test ${with_pcre_lib_dir+y} then : withval=$with_pcre_lib_dir; case "$withval" in no) as_fn_error $? "Need pcre-lib-dir" "$LINENO" 5 ;; yes) ;; *) pcre_lib_dir="$withval" ;; esac fi pcre_include_dir= # Check whether --with-pcre-include-dir was given. if test ${with_pcre_include_dir+y} then : withval=$with_pcre_include_dir; case "$withval" in no) as_fn_error $? "Need pcre-include-dir" "$LINENO" 5 ;; yes) ;; *) pcre_include_dir="$withval" ;; esac fi REGEX= # Check whether --with-regex was given. if test ${with_regex+y} then : withval=$with_regex; case "$withval" in no) REGEX=no ;; *) ;; esac fi if test "x$REGEX" != "xno" && test "x$PCRE" != "xno"; then smart_try_dir=$pcre_include_dir ac_safe=`echo "pcre.h" | sed 'y%./+-%__pm%'` old_CPPFLAGS="$CPPFLAGS" smart_include= smart_include_dir="/usr/local/include /opt/include" _smart_try_dir= _smart_include_dir= for _prefix in $smart_prefix ""; do for _dir in $smart_try_dir; do _smart_try_dir="${_smart_try_dir} ${_dir}/${_prefix}" done for _dir in $smart_include_dir; do _smart_include_dir="${_smart_include_dir} ${_dir}/${_prefix}" done done if test "x$_smart_try_dir" != "x"; then for try in $_smart_try_dir; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for pcre.h in $try" >&5 printf %s "checking for pcre.h in $try... " >&6; } CPPFLAGS="-isystem $try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include="-isystem $try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext done CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_include" = "x"; then for _prefix in $smart_prefix; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for ${_prefix}/pcre.h" >&5 printf %s "checking for ${_prefix}/pcre.h... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include="-isystem ${_prefix}/" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext done fi if test "x$smart_include" = "x"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for pcre.h" >&5 printf %s "checking for pcre.h... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include=" " { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext fi if test "x$smart_include" = "x"; then for try in $_smart_include_dir; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for pcre.h in $try" >&5 printf %s "checking for pcre.h in $try... " >&6; } CPPFLAGS="-isystem $try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include="-isystem $try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext done CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_include" != "x"; then eval "ac_cv_header_$ac_safe=yes" CPPFLAGS="$smart_include $old_CPPFLAGS" SMART_CPPFLAGS="$smart_include $SMART_CPPFLAGS" fi smart_prefix= if test "x$ac_cv_header_pcre_h" = "xyes"; then smart_try_dir=$pcre_lib_dir sm_lib_safe=`echo "pcre" | sed 'y%./+-%__p_%'` sm_func_safe=`echo "pcre_compile" | sed 'y%./+-%__p_%'` old_LIBS="$LIBS" old_CPPFLAGS="$CPPFLAGS" smart_lib= smart_ldflags= smart_lib_dir= if test "x$smart_try_dir" != "x"; then for try in $smart_try_dir; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for pcre_compile in -lpcre in $try" >&5 printf %s "checking for pcre_compile in -lpcre in $try... " >&6; } LIBS="-lpcre $old_LIBS" CPPFLAGS="-L$try -Wl,-rpath,$try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ extern char pcre_compile(); int main (void) { pcre_compile() ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : smart_lib="-lpcre" smart_ldflags="-L$try -Wl,-rpath,$try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext done LIBS="$old_LIBS" CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_lib" = "x"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for pcre_compile in -lpcre" >&5 printf %s "checking for pcre_compile in -lpcre... " >&6; } LIBS="-lpcre $old_LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ extern char pcre_compile(); int main (void) { pcre_compile() ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : smart_lib="-lpcre" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext LIBS="$old_LIBS" fi if test "x$smart_lib" = "x"; then for try in /usr/local/lib /opt/lib; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for pcre_compile in -lpcre in $try" >&5 printf %s "checking for pcre_compile in -lpcre in $try... " >&6; } LIBS="-lpcre $old_LIBS" CPPFLAGS="-L$try -Wl,-rpath,$try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ extern char pcre_compile(); int main (void) { pcre_compile() ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : smart_lib="-lpcre" smart_ldflags="-L$try -Wl,-rpath,$try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext done LIBS="$old_LIBS" CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_lib" != "x"; then eval "ac_cv_lib_${sm_lib_safe}_${sm_func_safe}=yes" LIBS="$smart_ldflags $smart_lib $old_LIBS" SMART_LIBS="$smart_ldflags $smart_lib $SMART_LIBS" fi if test "x$ac_cv_lib_pcre_pcre_compile" = "xyes"; then REGEX=yes printf "%s\n" "#define HAVE_PCRE 1" >>confdefs.h printf "%s\n" "#define HAVE_BINSAFE_REGEX 1" >>confdefs.h fi fi fi if test "x$REGEX" = "x" && test "x$PCRE" != "xno"; then smart_try_dir=$pcre_include_dir ac_safe=`echo "pcre2.h" | sed 'y%./+-%__pm%'` old_CPPFLAGS="$CPPFLAGS" smart_include= smart_include_dir="/usr/local/include /opt/include" _smart_try_dir= _smart_include_dir= for _prefix in $smart_prefix ""; do for _dir in $smart_try_dir; do _smart_try_dir="${_smart_try_dir} ${_dir}/${_prefix}" done for _dir in $smart_include_dir; do _smart_include_dir="${_smart_include_dir} ${_dir}/${_prefix}" done done if test "x$_smart_try_dir" != "x"; then for try in $_smart_try_dir; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for pcre2.h in $try" >&5 printf %s "checking for pcre2.h in $try... " >&6; } CPPFLAGS="-isystem $try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #define PCRE2_CODE_UNIT_WIDTH (8) #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include="-isystem $try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext done CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_include" = "x"; then for _prefix in $smart_prefix; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for ${_prefix}/pcre2.h" >&5 printf %s "checking for ${_prefix}/pcre2.h... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #define PCRE2_CODE_UNIT_WIDTH (8) #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include="-isystem ${_prefix}/" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext done fi if test "x$smart_include" = "x"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for pcre2.h" >&5 printf %s "checking for pcre2.h... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #define PCRE2_CODE_UNIT_WIDTH (8) #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include=" " { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext fi if test "x$smart_include" = "x"; then for try in $_smart_include_dir; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for pcre2.h in $try" >&5 printf %s "checking for pcre2.h in $try... " >&6; } CPPFLAGS="-isystem $try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #define PCRE2_CODE_UNIT_WIDTH (8) #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include="-isystem $try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext done CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_include" != "x"; then eval "ac_cv_header_$ac_safe=yes" CPPFLAGS="$smart_include $old_CPPFLAGS" SMART_CPPFLAGS="$smart_include $SMART_CPPFLAGS" fi smart_prefix= if test "x$ac_cv_header_pcre2_h" = "xyes"; then smart_try_dir=$pcre_lib_dir sm_lib_safe=`echo "pcre2-8" | sed 'y%./+-%__p_%'` sm_func_safe=`echo "pcre2_compile_8" | sed 'y%./+-%__p_%'` old_LIBS="$LIBS" old_CPPFLAGS="$CPPFLAGS" smart_lib= smart_ldflags= smart_lib_dir= if test "x$smart_try_dir" != "x"; then for try in $smart_try_dir; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for pcre2_compile_8 in -lpcre2-8 in $try" >&5 printf %s "checking for pcre2_compile_8 in -lpcre2-8 in $try... " >&6; } LIBS="-lpcre2-8 $old_LIBS" CPPFLAGS="-L$try -Wl,-rpath,$try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ extern char pcre2_compile_8(); int main (void) { pcre2_compile_8() ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : smart_lib="-lpcre2-8" smart_ldflags="-L$try -Wl,-rpath,$try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext done LIBS="$old_LIBS" CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_lib" = "x"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for pcre2_compile_8 in -lpcre2-8" >&5 printf %s "checking for pcre2_compile_8 in -lpcre2-8... " >&6; } LIBS="-lpcre2-8 $old_LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ extern char pcre2_compile_8(); int main (void) { pcre2_compile_8() ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : smart_lib="-lpcre2-8" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext LIBS="$old_LIBS" fi if test "x$smart_lib" = "x"; then for try in /usr/local/lib /opt/lib; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for pcre2_compile_8 in -lpcre2-8 in $try" >&5 printf %s "checking for pcre2_compile_8 in -lpcre2-8 in $try... " >&6; } LIBS="-lpcre2-8 $old_LIBS" CPPFLAGS="-L$try -Wl,-rpath,$try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ extern char pcre2_compile_8(); int main (void) { pcre2_compile_8() ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : smart_lib="-lpcre2-8" smart_ldflags="-L$try -Wl,-rpath,$try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext done LIBS="$old_LIBS" CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_lib" != "x"; then eval "ac_cv_lib_${sm_lib_safe}_${sm_func_safe}=yes" LIBS="$smart_ldflags $smart_lib $old_LIBS" SMART_LIBS="$smart_ldflags $smart_lib $SMART_LIBS" fi if test "x$ac_cv_lib_pcre2_8_pcre2_compile_8" = "xyes"; then REGEX=yes printf "%s\n" "#define HAVE_PCRE2 1" >>confdefs.h printf "%s\n" "#define HAVE_BINSAFE_REGEX 1" >>confdefs.h fi fi fi if test "x$REGEX" = "x"; then smart_try_dir= ac_safe=`echo "regex.h" | sed 'y%./+-%__pm%'` old_CPPFLAGS="$CPPFLAGS" smart_include= smart_include_dir="/usr/local/include /opt/include" _smart_try_dir= _smart_include_dir= for _prefix in $smart_prefix ""; do for _dir in $smart_try_dir; do _smart_try_dir="${_smart_try_dir} ${_dir}/${_prefix}" done for _dir in $smart_include_dir; do _smart_include_dir="${_smart_include_dir} ${_dir}/${_prefix}" done done if test "x$_smart_try_dir" != "x"; then for try in $_smart_try_dir; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for regex.h in $try" >&5 printf %s "checking for regex.h in $try... " >&6; } CPPFLAGS="-isystem $try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include="-isystem $try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext done CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_include" = "x"; then for _prefix in $smart_prefix; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for ${_prefix}/regex.h" >&5 printf %s "checking for ${_prefix}/regex.h... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include="-isystem ${_prefix}/" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext done fi if test "x$smart_include" = "x"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for regex.h" >&5 printf %s "checking for regex.h... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include=" " { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext fi if test "x$smart_include" = "x"; then for try in $_smart_include_dir; do { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for regex.h in $try" >&5 printf %s "checking for regex.h in $try... " >&6; } CPPFLAGS="-isystem $try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { int a = 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : smart_include="-isystem $try" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } break else $as_nop smart_include= { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext done CPPFLAGS="$old_CPPFLAGS" fi if test "x$smart_include" != "x"; then eval "ac_cv_header_$ac_safe=yes" CPPFLAGS="$smart_include $old_CPPFLAGS" SMART_CPPFLAGS="$smart_include $SMART_CPPFLAGS" fi smart_prefix= if test "x$ac_cv_header_regex_h" = "xyes"; then REGEX=yes { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for extended regular expressions" >&5 printf %s "checking for extended regular expressions... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #ifdef REG_EXTENDED yes #endif _ACEOF if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | $EGREP "yes" >/dev/null 2>&1 then : { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } printf "%s\n" "#define HAVE_REG_EXTENDED 1" >>confdefs.h else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -rf conftest* { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for regcomp in -lregex" >&5 printf %s "checking for regcomp in -lregex... " >&6; } if test ${ac_cv_lib_regex_regcomp+y} then : printf %s "(cached) " >&6 else $as_nop ac_check_lib_save_LIBS=$LIBS LIBS="-lregex $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ char regcomp (); int main (void) { return regcomp (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : ac_cv_lib_regex_regcomp=yes else $as_nop ac_cv_lib_regex_regcomp=no fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_regex_regcomp" >&5 printf "%s\n" "$ac_cv_lib_regex_regcomp" >&6; } if test "x$ac_cv_lib_regex_regcomp" = xyes then : LIBS="-lregex $LIBS" fi ac_fn_c_check_func "$LINENO" "regncomp" "ac_cv_func_regncomp" if test "x$ac_cv_func_regncomp" = xyes then : printf "%s\n" "#define HAVE_REGNCOMP 1" >>confdefs.h fi ac_fn_c_check_func "$LINENO" "regnexec" "ac_cv_func_regnexec" if test "x$ac_cv_func_regnexec" = xyes then : printf "%s\n" "#define HAVE_REGNEXEC 1" >>confdefs.h fi if test x"$ac_cv_func_regncomp" = x"yes" && test x"$ac_cv_func_regnexec" = x"yes"; then printf "%s\n" "#define HAVE_BINSAFE_REGEX 1" >>confdefs.h fi fi fi # # Some platforms require an explicit -latomic # { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for library containing __atomic_load_4" >&5 printf %s "checking for library containing __atomic_load_4... " >&6; } if test ${ac_cv_search___atomic_load_4+y} then : printf %s "(cached) " >&6 else $as_nop ac_func_search_save_LIBS=$LIBS cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ char __atomic_load_4 (); int main (void) { return __atomic_load_4 (); ; return 0; } _ACEOF for ac_lib in '' atomic do if test -z "$ac_lib"; then ac_res="none required" else ac_res=-l$ac_lib LIBS="-l$ac_lib $ac_func_search_save_LIBS" fi if ac_fn_c_try_link "$LINENO" then : ac_cv_search___atomic_load_4=$ac_res fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext if test ${ac_cv_search___atomic_load_4+y} then : break fi done if test ${ac_cv_search___atomic_load_4+y} then : else $as_nop ac_cv_search___atomic_load_4=no fi rm conftest.$ac_ext LIBS=$ac_func_search_save_LIBS fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search___atomic_load_4" >&5 printf "%s\n" "$ac_cv_search___atomic_load_4" >&6; } ac_res=$ac_cv_search___atomic_load_4 if test "$ac_res" != no then : test "$ac_res" = "none required" || LIBS="$ac_res $LIBS" fi if test "x$REGEX" = "xyes"; then printf "%s\n" "#define HAVE_REGEX 1" >>confdefs.h fi printf "%s\n" "#define GNUSTYLE 1" >>confdefs.h printf "%s\n" "#define SYSVSTYLE 2" >>confdefs.h printf "%s\n" "#define BSDSTYLE 3" >>confdefs.h gethostbyaddrrstyle="" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking gethostbyaddr_r() syntax" >&5 printf %s "checking gethostbyaddr_r() syntax... " >&6; } case "$host" in *-freebsd*) { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $CC options needed to detect all undeclared functions" >&5 printf %s "checking for $CC options needed to detect all undeclared functions... " >&6; } if test ${ac_cv_c_undeclared_builtin_options+y} then : printf %s "(cached) " >&6 else $as_nop ac_save_CFLAGS=$CFLAGS ac_cv_c_undeclared_builtin_options='cannot detect' for ac_arg in '' -fno-builtin; do CFLAGS="$ac_save_CFLAGS $ac_arg" # This test program should *not* compile successfully. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main (void) { (void) strchr; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : else $as_nop # This test program should compile successfully. # No library function is consistently available on # freestanding implementations, so test against a dummy # declaration. Include always-available headers on the # off chance that they somehow elicit warnings. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include #include #include extern void ac_decl (int, char *); int main (void) { (void) ac_decl (0, (char *) 0); (void) ac_decl; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO" then : if test x"$ac_arg" = x then : ac_cv_c_undeclared_builtin_options='none needed' else $as_nop ac_cv_c_undeclared_builtin_options=$ac_arg fi break fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext fi rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext done CFLAGS=$ac_save_CFLAGS fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_undeclared_builtin_options" >&5 printf "%s\n" "$ac_cv_c_undeclared_builtin_options" >&6; } case $ac_cv_c_undeclared_builtin_options in #( 'cannot detect') : { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "cannot make $CC report undeclared builtins See \`config.log' for more details" "$LINENO" 5; } ;; #( 'none needed') : ac_c_undeclared_builtin_options='' ;; #( *) : ac_c_undeclared_builtin_options=$ac_cv_c_undeclared_builtin_options ;; esac ac_fn_check_decl "$LINENO" "gethostbyaddr_r" "ac_cv_have_decl_gethostbyaddr_r" " #ifdef HAVE_NETDB_H #include #endif " "$ac_c_undeclared_builtin_options" "CFLAGS" if test "x$ac_cv_have_decl_gethostbyaddr_r" = xyes then : ac_have_decl=1 else $as_nop ac_have_decl=0 fi printf "%s\n" "#define HAVE_DECL_GETHOSTBYADDR_R $ac_have_decl" >>confdefs.h if test $ac_have_decl = 1 then : else $as_nop printf "%s\n" "#define GETHOSTBYADDRRSTYLE BSDSTYLE" >>confdefs.h gethostbyaddrrstyle=BSD { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: FreeBSD overridden to BSD-style" >&5 printf "%s\n" "$as_me: WARNING: FreeBSD overridden to BSD-style" >&2;} fi ;; esac if test "x$gethostbyaddrrstyle" = "x"; then cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include int main (void) { gethostbyaddr_r(NULL, 0, 0, NULL, NULL, 0, NULL, NULL) ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : printf "%s\n" "#define GETHOSTBYADDRRSTYLE GNUSTYLE" >>confdefs.h gethostbyaddrrstyle=GNU fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext fi if test "x$gethostbyaddrrstyle" = "x"; then cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include int main (void) { gethostbyaddr_r(NULL, 0, 0, NULL, NULL, 0, NULL) ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : printf "%s\n" "#define GETHOSTBYADDRRSTYLE SYSVSTYLE" >>confdefs.h gethostbyaddrrstyle=SYSV fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext fi if test "x$gethostbyaddrrstyle" = "x"; then cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include int main (void) { gethostbyaddr(NULL, 0, 0) ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : printf "%s\n" "#define GETHOSTBYADDRRSTYLE BSDSTYLE" >>confdefs.h gethostbyaddrrstyle=BSD fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext fi if test "x$gethostbyaddrrstyle" = "x"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: none! It must not exist, here." >&5 printf "%s\n" "none! It must not exist, here." >&6; } else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: ${gethostbyaddrrstyle}-style" >&5 printf "%s\n" "${gethostbyaddrrstyle}-style" >&6; } fi if test "x$gethostbyaddrrstyle" = "xBSD"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: ****** BSD-style gethostbyaddr might NOT be thread-safe! ****** " >&5 printf "%s\n" "$as_me: WARNING: ****** BSD-style gethostbyaddr might NOT be thread-safe! ****** " >&2;} fi gethostbynamerstyle="" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking gethostbyname_r() syntax" >&5 printf %s "checking gethostbyname_r() syntax... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include int main (void) { gethostbyname_r(NULL, NULL, NULL, 0, NULL, NULL) ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : printf "%s\n" "#define GETHOSTBYNAMERSTYLE GNUSTYLE" >>confdefs.h gethostbynamerstyle=GNU fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext if test "x$gethostbynamerstyle" = "x"; then cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include int main (void) { gethostbyname_r(NULL, NULL, NULL, 0, NULL) ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : printf "%s\n" "#define GETHOSTBYNAMERSTYLE SYSVSTYLE" >>confdefs.h gethostbynamerstyle=SYSV fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext fi if test "x$gethostbynamerstyle" = "x"; then cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include int main (void) { gethostbyname(NULL) ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : printf "%s\n" "#define GETHOSTBYNAMERSTYLE BSDSTYLE" >>confdefs.h gethostbynamerstyle=BSD fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext fi if test "x$gethostbynamerstyle" = "x"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: none! It must not exist, here." >&5 printf "%s\n" "none! It must not exist, here." >&6; } else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: ${gethostbynamerstyle}-style" >&5 printf "%s\n" "${gethostbynamerstyle}-style" >&6; } fi if test "x$gethostbynamerstyle" = "xBSD"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: ****** BSD-style gethostbyname might NOT be thread-safe! ****** " >&5 printf "%s\n" "$as_me: WARNING: ****** BSD-style gethostbyname might NOT be thread-safe! ****** " >&2;} fi if test "x$ac_cv_header_pwd_h" = "xyes"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking getpwnam_r" >&5 printf %s "checking getpwnam_r... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include #include int main (void) { getpwnam_r(NULL, NULL, NULL, 0, NULL) ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } printf "%s\n" "#define HAVE_GETPWNAM_R 1" >>confdefs.h else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext fi if test "x$ac_cv_header_grp_h" = "xyes"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking getgrnam_r" >&5 printf %s "checking getgrnam_r... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include #include int main (void) { getgrnam_r(NULL, NULL, NULL, 0, NULL) ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 printf "%s\n" "yes" >&6; } printf "%s\n" "#define HAVE_GETGRNAM_R 1" >>confdefs.h else $as_nop { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext fi printf "%s\n" "#define POSIXSTYLE 1" >>confdefs.h printf "%s\n" "#define SOLARISSTYLE 2" >>confdefs.h ctimerstyle="" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking ctime_r() syntax" >&5 printf %s "checking ctime_r() syntax... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { ctime_r(NULL, NULL, 0) ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : printf "%s\n" "#define CTIMERSTYLE SOLARISSTYLE" >>confdefs.h ctimerstyle="SOLARIS" fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext if test "x$ctimerstyle" = "x"; then cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main (void) { ctime_r(NULL, NULL) ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : printf "%s\n" "#define CTIMERSTYLE POSIXSTYLE" >>confdefs.h ctimerstyle="POSIX" fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext fi if test "x$ctimerstyle" = "x"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: none! It must not exist, here." >&5 printf "%s\n" "none! It must not exist, here." >&6; } else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: ${ctimerstyle}-style" >&5 printf "%s\n" "${ctimerstyle}-style" >&6; } fi HOSTINFO=$host top_builddir=`pwd` export top_builddir { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: top_builddir=$top_builddir" >&5 printf "%s\n" "top_builddir=$top_builddir" >&6; } if test "x$EXPERIMENTAL" = "xyes"; then for foo in `ls -1 "${srcdir}"/src/modules | grep rlm_`; do MODULES="$MODULES $foo" done else for foo in `cat "${srcdir}"/src/modules/stable`; do MODULES="$MODULES $foo" done fi mysubdirs="" for bar in $MODULES; do if test -f "${srcdir}"/src/modules/$bar/configure; then mysubdirs="$mysubdirs src/modules/$bar" fi done subdirs="$subdirs $mysubdirs" if test "x$ax_cv_cc_no_date_time_flag" = "xyes" && test "x$reproducible_builds" != "xyes"; then CFLAGS="-Wno-date-time $CFLAGS" fi CFLAGS="$CFLAGS $devcflags" LDFLAGS="$LDFLAGS $devldflags" if test "x$werror" = "xyes"; then CFLAGS="-Werror $CFLAGS" fi ac_config_commands="$ac_config_commands stamp-h" ac_config_commands="$ac_config_commands build-radpaths-h" ac_config_commands="$ac_config_commands main-chmod" ac_config_commands="$ac_config_commands scripts-chmod" USE_STATIC_LIBS="yes" ac_config_files="$ac_config_files ./Make.inc ./src/include/build-radpaths-h ./src/main/radsniff.mk ./src/main/radlast.mk ./src/main/checkrad ./src/main/radlast ./src/main/radtest ./scripts/rc.radiusd ./scripts/cron/radiusd.cron.daily ./scripts/cron/radiusd.cron.monthly ./scripts/cryptpasswd ./raddb/radrelay.conf ./raddb/radiusd.conf" cat >confcache <<\_ACEOF # This file is a shell script that caches the results of configure # tests run on this system so they can be shared between configure # scripts and configure runs, see configure's option --config-cache. # It is not useful on other systems. If it contains results you don't # want to keep, you may remove or edit it. # # config.status only pays attention to the cache file if you give it # the --recheck option to rerun configure. # # `ac_cv_env_foo' variables (set or unset) will be overridden when # loading this file, other *unset* `ac_cv_foo' will be assigned the # following values. _ACEOF # The following way of writing the cache mishandles newlines in values, # but we know of no workaround that is simple, portable, and efficient. # So, we kill variables containing newlines. # Ultrix sh set writes to stderr and can't be redirected directly, # and sets the high bit in the cache file unless we assign to the vars. ( for ac_var in `(set) 2>&1 | sed -n 's/^\([a-zA-Z_][a-zA-Z0-9_]*\)=.*/\1/p'`; do eval ac_val=\$$ac_var case $ac_val in #( *${as_nl}*) case $ac_var in #( *_cv_*) { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: cache variable $ac_var contains a newline" >&5 printf "%s\n" "$as_me: WARNING: cache variable $ac_var contains a newline" >&2;} ;; esac case $ac_var in #( _ | IFS | as_nl) ;; #( BASH_ARGV | BASH_SOURCE) eval $ac_var= ;; #( *) { eval $ac_var=; unset $ac_var;} ;; esac ;; esac done (set) 2>&1 | case $as_nl`(ac_space=' '; set) 2>&1` in #( *${as_nl}ac_space=\ *) # `set' does not quote correctly, so add quotes: double-quote # substitution turns \\\\ into \\, and sed turns \\ into \. sed -n \ "s/'/'\\\\''/g; s/^\\([_$as_cr_alnum]*_cv_[_$as_cr_alnum]*\\)=\\(.*\\)/\\1='\\2'/p" ;; #( *) # `set' quotes correctly as required by POSIX, so do not add quotes. sed -n "/^[_$as_cr_alnum]*_cv_[_$as_cr_alnum]*=/p" ;; esac | sort ) | sed ' /^ac_cv_env_/b end t clear :clear s/^\([^=]*\)=\(.*[{}].*\)$/test ${\1+y} || &/ t end s/^\([^=]*\)=\(.*\)$/\1=${\1=\2}/ :end' >>confcache if diff "$cache_file" confcache >/dev/null 2>&1; then :; else if test -w "$cache_file"; then if test "x$cache_file" != "x/dev/null"; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: updating cache $cache_file" >&5 printf "%s\n" "$as_me: updating cache $cache_file" >&6;} if test ! -f "$cache_file" || test -h "$cache_file"; then cat confcache >"$cache_file" else case $cache_file in #( */* | ?:*) mv -f confcache "$cache_file"$$ && mv -f "$cache_file"$$ "$cache_file" ;; #( *) mv -f confcache "$cache_file" ;; esac fi fi else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: not updating unwritable cache $cache_file" >&5 printf "%s\n" "$as_me: not updating unwritable cache $cache_file" >&6;} fi fi rm -f confcache test "x$prefix" = xNONE && prefix=$ac_default_prefix # Let make expand exec_prefix. test "x$exec_prefix" = xNONE && exec_prefix='${prefix}' DEFS=-DHAVE_CONFIG_H ac_libobjs= ac_ltlibobjs= U= for ac_i in : $LIBOBJS; do test "x$ac_i" = x: && continue # 1. Remove the extension, and $U if already installed. ac_script='s/\$U\././;s/\.o$//;s/\.obj$//' ac_i=`printf "%s\n" "$ac_i" | sed "$ac_script"` # 2. Prepend LIBOBJDIR. When used with automake>=1.10 LIBOBJDIR # will be set to the directory where LIBOBJS objects are built. as_fn_append ac_libobjs " \${LIBOBJDIR}$ac_i\$U.$ac_objext" as_fn_append ac_ltlibobjs " \${LIBOBJDIR}$ac_i"'$U.lo' done LIBOBJS=$ac_libobjs LTLIBOBJS=$ac_ltlibobjs : "${CONFIG_STATUS=./config.status}" ac_write_fail=0 ac_clean_files_save=$ac_clean_files ac_clean_files="$ac_clean_files $CONFIG_STATUS" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: creating $CONFIG_STATUS" >&5 printf "%s\n" "$as_me: creating $CONFIG_STATUS" >&6;} as_write_fail=0 cat >$CONFIG_STATUS <<_ASEOF || as_write_fail=1 #! $SHELL # Generated by $as_me. # Run this file to recreate the current configuration. # Compiler output produced by configure, useful for debugging # configure, is in config.log if it exists. debug=false ac_cs_recheck=false ac_cs_silent=false SHELL=\${CONFIG_SHELL-$SHELL} export SHELL _ASEOF cat >>$CONFIG_STATUS <<\_ASEOF || as_write_fail=1 ## -------------------- ## ## M4sh Initialization. ## ## -------------------- ## # Be more Bourne compatible DUALCASE=1; export DUALCASE # for MKS sh as_nop=: if test ${ZSH_VERSION+y} && (emulate sh) >/dev/null 2>&1 then : emulate sh NULLCMD=: # Pre-4.2 versions of Zsh do word splitting on ${1+"$@"}, which # is contrary to our usage. Disable this feature. alias -g '${1+"$@"}'='"$@"' setopt NO_GLOB_SUBST else $as_nop case `(set -o) 2>/dev/null` in #( *posix*) : set -o posix ;; #( *) : ;; esac fi # Reset variables that may have inherited troublesome values from # the environment. # IFS needs to be set, to space, tab, and newline, in precisely that order. # (If _AS_PATH_WALK were called with IFS unset, it would have the # side effect of setting IFS to empty, thus disabling word splitting.) # Quoting is to prevent editors from complaining about space-tab. as_nl=' ' export as_nl IFS=" "" $as_nl" PS1='$ ' PS2='> ' PS4='+ ' # Ensure predictable behavior from utilities with locale-dependent output. LC_ALL=C export LC_ALL LANGUAGE=C export LANGUAGE # We cannot yet rely on "unset" to work, but we need these variables # to be unset--not just set to an empty or harmless value--now, to # avoid bugs in old shells (e.g. pre-3.0 UWIN ksh). This construct # also avoids known problems related to "unset" and subshell syntax # in other old shells (e.g. bash 2.01 and pdksh 5.2.14). for as_var in BASH_ENV ENV MAIL MAILPATH CDPATH do eval test \${$as_var+y} \ && ( (unset $as_var) || exit 1) >/dev/null 2>&1 && unset $as_var || : done # Ensure that fds 0, 1, and 2 are open. if (exec 3>&0) 2>/dev/null; then :; else exec 0&1) 2>/dev/null; then :; else exec 1>/dev/null; fi if (exec 3>&2) ; then :; else exec 2>/dev/null; fi # The user is always right. if ${PATH_SEPARATOR+false} :; then PATH_SEPARATOR=: (PATH='/bin;/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 && { (PATH='/bin:/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 || PATH_SEPARATOR=';' } fi # Find who we are. Look in the path if we contain no directory separator. as_myself= case $0 in #(( *[\\/]* ) as_myself=$0 ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS case $as_dir in #((( '') as_dir=./ ;; */) ;; *) as_dir=$as_dir/ ;; esac test -r "$as_dir$0" && as_myself=$as_dir$0 && break done IFS=$as_save_IFS ;; esac # We did not find ourselves, most probably we were run as `sh COMMAND' # in which case we are not to be found in the path. if test "x$as_myself" = x; then as_myself=$0 fi if test ! -f "$as_myself"; then printf "%s\n" "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2 exit 1 fi # as_fn_error STATUS ERROR [LINENO LOG_FD] # ---------------------------------------- # Output "`basename $0`: error: ERROR" to stderr. If LINENO and LOG_FD are # provided, also output the error to LOG_FD, referencing LINENO. Then exit the # script with STATUS, using 1 if that was 0. as_fn_error () { as_status=$1; test $as_status -eq 0 && as_status=1 if test "$4"; then as_lineno=${as_lineno-"$3"} as_lineno_stack=as_lineno_stack=$as_lineno_stack printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: $2" >&$4 fi printf "%s\n" "$as_me: error: $2" >&2 as_fn_exit $as_status } # as_fn_error # as_fn_set_status STATUS # ----------------------- # Set $? to STATUS, without forking. as_fn_set_status () { return $1 } # as_fn_set_status # as_fn_exit STATUS # ----------------- # Exit the shell with STATUS, even in a "trap 0" or "set -e" context. as_fn_exit () { set +e as_fn_set_status $1 exit $1 } # as_fn_exit # as_fn_unset VAR # --------------- # Portably unset VAR. as_fn_unset () { { eval $1=; unset $1;} } as_unset=as_fn_unset # as_fn_append VAR VALUE # ---------------------- # Append the text in VALUE to the end of the definition contained in VAR. Take # advantage of any shell optimizations that allow amortized linear growth over # repeated appends, instead of the typical quadratic growth present in naive # implementations. if (eval "as_var=1; as_var+=2; test x\$as_var = x12") 2>/dev/null then : eval 'as_fn_append () { eval $1+=\$2 }' else $as_nop as_fn_append () { eval $1=\$$1\$2 } fi # as_fn_append # as_fn_arith ARG... # ------------------ # Perform arithmetic evaluation on the ARGs, and store the result in the # global $as_val. Take advantage of shells that can avoid forks. The arguments # must be portable across $(()) and expr. if (eval "test \$(( 1 + 1 )) = 2") 2>/dev/null then : eval 'as_fn_arith () { as_val=$(( $* )) }' else $as_nop as_fn_arith () { as_val=`expr "$@" || test $? -eq 1` } fi # as_fn_arith if expr a : '\(a\)' >/dev/null 2>&1 && test "X`expr 00001 : '.*\(...\)'`" = X001; then as_expr=expr else as_expr=false fi if (basename -- /) >/dev/null 2>&1 && test "X`basename -- / 2>&1`" = "X/"; then as_basename=basename else as_basename=false fi if (as_dir=`dirname -- /` && test "X$as_dir" = X/) >/dev/null 2>&1; then as_dirname=dirname else as_dirname=false fi as_me=`$as_basename -- "$0" || $as_expr X/"$0" : '.*/\([^/][^/]*\)/*$' \| \ X"$0" : 'X\(//\)$' \| \ X"$0" : 'X\(/\)' \| . 2>/dev/null || printf "%s\n" X/"$0" | sed '/^.*\/\([^/][^/]*\)\/*$/{ s//\1/ q } /^X\/\(\/\/\)$/{ s//\1/ q } /^X\/\(\/\).*/{ s//\1/ q } s/.*/./; q'` # Avoid depending upon Character Ranges. as_cr_letters='abcdefghijklmnopqrstuvwxyz' as_cr_LETTERS='ABCDEFGHIJKLMNOPQRSTUVWXYZ' as_cr_Letters=$as_cr_letters$as_cr_LETTERS as_cr_digits='0123456789' as_cr_alnum=$as_cr_Letters$as_cr_digits # Determine whether it's possible to make 'echo' print without a newline. # These variables are no longer used directly by Autoconf, but are AC_SUBSTed # for compatibility with existing Makefiles. ECHO_C= ECHO_N= ECHO_T= case `echo -n x` in #((((( -n*) case `echo 'xy\c'` in *c*) ECHO_T=' ';; # ECHO_T is single tab character. xy) ECHO_C='\c';; *) echo `echo ksh88 bug on AIX 6.1` > /dev/null ECHO_T=' ';; esac;; *) ECHO_N='-n';; esac # For backward compatibility with old third-party macros, we provide # the shell variables $as_echo and $as_echo_n. New code should use # AS_ECHO(["message"]) and AS_ECHO_N(["message"]), respectively. as_echo='printf %s\n' as_echo_n='printf %s' rm -f conf$$ conf$$.exe conf$$.file if test -d conf$$.dir; then rm -f conf$$.dir/conf$$.file else rm -f conf$$.dir mkdir conf$$.dir 2>/dev/null fi if (echo >conf$$.file) 2>/dev/null; then if ln -s conf$$.file conf$$ 2>/dev/null; then as_ln_s='ln -s' # ... but there are two gotchas: # 1) On MSYS, both `ln -s file dir' and `ln file dir' fail. # 2) DJGPP < 2.04 has no symlinks; `ln -s' creates a wrapper executable. # In both cases, we have to default to `cp -pR'. ln -s conf$$.file conf$$.dir 2>/dev/null && test ! -f conf$$.exe || as_ln_s='cp -pR' elif ln conf$$.file conf$$ 2>/dev/null; then as_ln_s=ln else as_ln_s='cp -pR' fi else as_ln_s='cp -pR' fi rm -f conf$$ conf$$.exe conf$$.dir/conf$$.file conf$$.file rmdir conf$$.dir 2>/dev/null # as_fn_mkdir_p # ------------- # Create "$as_dir" as a directory, including parents if necessary. as_fn_mkdir_p () { case $as_dir in #( -*) as_dir=./$as_dir;; esac test -d "$as_dir" || eval $as_mkdir_p || { as_dirs= while :; do case $as_dir in #( *\'*) as_qdir=`printf "%s\n" "$as_dir" | sed "s/'/'\\\\\\\\''/g"`;; #'( *) as_qdir=$as_dir;; esac as_dirs="'$as_qdir' $as_dirs" as_dir=`$as_dirname -- "$as_dir" || $as_expr X"$as_dir" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ X"$as_dir" : 'X\(//\)[^/]' \| \ X"$as_dir" : 'X\(//\)$' \| \ X"$as_dir" : 'X\(/\)' \| . 2>/dev/null || printf "%s\n" X"$as_dir" | sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/ q } /^X\(\/\/\)[^/].*/{ s//\1/ q } /^X\(\/\/\)$/{ s//\1/ q } /^X\(\/\).*/{ s//\1/ q } s/.*/./; q'` test -d "$as_dir" && break done test -z "$as_dirs" || eval "mkdir $as_dirs" } || test -d "$as_dir" || as_fn_error $? "cannot create directory $as_dir" } # as_fn_mkdir_p if mkdir -p . 2>/dev/null; then as_mkdir_p='mkdir -p "$as_dir"' else test -d ./-p && rmdir ./-p as_mkdir_p=false fi # as_fn_executable_p FILE # ----------------------- # Test if FILE is an executable regular file. as_fn_executable_p () { test -f "$1" && test -x "$1" } # as_fn_executable_p as_test_x='test -x' as_executable_p=as_fn_executable_p # Sed expression to map a string onto a valid CPP name. as_tr_cpp="eval sed 'y%*$as_cr_letters%P$as_cr_LETTERS%;s%[^_$as_cr_alnum]%_%g'" # Sed expression to map a string onto a valid variable name. as_tr_sh="eval sed 'y%*+%pp%;s%[^_$as_cr_alnum]%_%g'" exec 6>&1 ## ----------------------------------- ## ## Main body of $CONFIG_STATUS script. ## ## ----------------------------------- ## _ASEOF test $as_write_fail = 0 && chmod +x $CONFIG_STATUS || ac_write_fail=1 cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 # Save the log message, to keep $0 and so on meaningful, and to # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" This file was extended by freeradius $as_me $Id: f7ffabd4b1bb160bebf78c82d28f9e016645e4c9 $, which was generated by GNU Autoconf 2.71. Invocation command line was CONFIG_FILES = $CONFIG_FILES CONFIG_HEADERS = $CONFIG_HEADERS CONFIG_LINKS = $CONFIG_LINKS CONFIG_COMMANDS = $CONFIG_COMMANDS $ $0 $@ on `(hostname || uname -n) 2>/dev/null | sed 1q` " _ACEOF case $ac_config_files in *" "*) set x $ac_config_files; shift; ac_config_files=$*;; esac case $ac_config_headers in *" "*) set x $ac_config_headers; shift; ac_config_headers=$*;; esac cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 # Files that config.status was made for. config_files="$ac_config_files" config_headers="$ac_config_headers" config_commands="$ac_config_commands" _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 ac_cs_usage="\ \`$as_me' instantiates files and other configuration actions from templates according to the current configuration. Unless the files and actions are specified as TAGs, all are instantiated by default. Usage: $0 [OPTION]... [TAG]... -h, --help print this help, then exit -V, --version print version number and configuration settings, then exit --config print configuration, then exit -q, --quiet, --silent do not print progress messages -d, --debug don't remove temporary files --recheck update $as_me by reconfiguring in the same conditions --file=FILE[:TEMPLATE] instantiate the configuration file FILE --header=FILE[:TEMPLATE] instantiate the configuration header FILE Configuration files: $config_files Configuration headers: $config_headers Configuration commands: $config_commands Report bugs to . freeradius home page: ." _ACEOF ac_cs_config=`printf "%s\n" "$ac_configure_args" | sed "$ac_safe_unquote"` ac_cs_config_escaped=`printf "%s\n" "$ac_cs_config" | sed "s/^ //; s/'/'\\\\\\\\''/g"` cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config='$ac_cs_config_escaped' ac_cs_version="\\ freeradius config.status $Id: f7ffabd4b1bb160bebf78c82d28f9e016645e4c9 $ configured by $0, generated by GNU Autoconf 2.71, with options \\"\$ac_cs_config\\" Copyright (C) 2021 Free Software Foundation, Inc. This config.status script is free software; the Free Software Foundation gives unlimited permission to copy, distribute and modify it." ac_pwd='$ac_pwd' srcdir='$srcdir' test -n "\$AWK" || AWK=awk _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 # The default lists apply if the user does not specify any file. ac_need_defaults=: while test $# != 0 do case $1 in --*=?*) ac_option=`expr "X$1" : 'X\([^=]*\)='` ac_optarg=`expr "X$1" : 'X[^=]*=\(.*\)'` ac_shift=: ;; --*=) ac_option=`expr "X$1" : 'X\([^=]*\)='` ac_optarg= ac_shift=: ;; *) ac_option=$1 ac_optarg=$2 ac_shift=shift ;; esac case $ac_option in # Handling of the options. -recheck | --recheck | --rechec | --reche | --rech | --rec | --re | --r) ac_cs_recheck=: ;; --version | --versio | --versi | --vers | --ver | --ve | --v | -V ) printf "%s\n" "$ac_cs_version"; exit ;; --config | --confi | --conf | --con | --co | --c ) printf "%s\n" "$ac_cs_config"; exit ;; --debug | --debu | --deb | --de | --d | -d ) debug=: ;; --file | --fil | --fi | --f ) $ac_shift case $ac_optarg in *\'*) ac_optarg=`printf "%s\n" "$ac_optarg" | sed "s/'/'\\\\\\\\''/g"` ;; '') as_fn_error $? "missing file argument" ;; esac as_fn_append CONFIG_FILES " '$ac_optarg'" ac_need_defaults=false;; --header | --heade | --head | --hea ) $ac_shift case $ac_optarg in *\'*) ac_optarg=`printf "%s\n" "$ac_optarg" | sed "s/'/'\\\\\\\\''/g"` ;; esac as_fn_append CONFIG_HEADERS " '$ac_optarg'" ac_need_defaults=false;; --he | --h) # Conflict between --help and --header as_fn_error $? "ambiguous option: \`$1' Try \`$0 --help' for more information.";; --help | --hel | -h ) printf "%s\n" "$ac_cs_usage"; exit ;; -q | -quiet | --quiet | --quie | --qui | --qu | --q \ | -silent | --silent | --silen | --sile | --sil | --si | --s) ac_cs_silent=: ;; # This is an error. -*) as_fn_error $? "unrecognized option: \`$1' Try \`$0 --help' for more information." ;; *) as_fn_append ac_config_targets " $1" ac_need_defaults=false ;; esac shift done ac_configure_extra_args= if $ac_cs_silent; then exec 6>/dev/null ac_configure_extra_args="$ac_configure_extra_args --silent" fi _ACEOF cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 if \$ac_cs_recheck; then set X $SHELL '$0' $ac_configure_args \$ac_configure_extra_args --no-create --no-recursion shift \printf "%s\n" "running CONFIG_SHELL=$SHELL \$*" >&6 CONFIG_SHELL='$SHELL' export CONFIG_SHELL exec "\$@" fi _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 exec 5>>config.log { echo sed 'h;s/./-/g;s/^.../## /;s/...$/ ##/;p;x;p;x' <<_ASBOX ## Running $as_me. ## _ASBOX printf "%s\n" "$ac_log" } >&5 _ACEOF cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 # Handling of arguments. for ac_config_target in $ac_config_targets do case $ac_config_target in "src/include/autoconf.h") CONFIG_HEADERS="$CONFIG_HEADERS src/include/autoconf.h" ;; "stamp-h") CONFIG_COMMANDS="$CONFIG_COMMANDS stamp-h" ;; "build-radpaths-h") CONFIG_COMMANDS="$CONFIG_COMMANDS build-radpaths-h" ;; "main-chmod") CONFIG_COMMANDS="$CONFIG_COMMANDS main-chmod" ;; "scripts-chmod") CONFIG_COMMANDS="$CONFIG_COMMANDS scripts-chmod" ;; "./Make.inc") CONFIG_FILES="$CONFIG_FILES ./Make.inc" ;; "./src/include/build-radpaths-h") CONFIG_FILES="$CONFIG_FILES ./src/include/build-radpaths-h" ;; "./src/main/radsniff.mk") CONFIG_FILES="$CONFIG_FILES ./src/main/radsniff.mk" ;; "./src/main/radlast.mk") CONFIG_FILES="$CONFIG_FILES ./src/main/radlast.mk" ;; "./src/main/checkrad") CONFIG_FILES="$CONFIG_FILES ./src/main/checkrad" ;; "./src/main/radlast") CONFIG_FILES="$CONFIG_FILES ./src/main/radlast" ;; "./src/main/radtest") CONFIG_FILES="$CONFIG_FILES ./src/main/radtest" ;; "./scripts/rc.radiusd") CONFIG_FILES="$CONFIG_FILES ./scripts/rc.radiusd" ;; "./scripts/cron/radiusd.cron.daily") CONFIG_FILES="$CONFIG_FILES ./scripts/cron/radiusd.cron.daily" ;; "./scripts/cron/radiusd.cron.monthly") CONFIG_FILES="$CONFIG_FILES ./scripts/cron/radiusd.cron.monthly" ;; "./scripts/cryptpasswd") CONFIG_FILES="$CONFIG_FILES ./scripts/cryptpasswd" ;; "./raddb/radrelay.conf") CONFIG_FILES="$CONFIG_FILES ./raddb/radrelay.conf" ;; "./raddb/radiusd.conf") CONFIG_FILES="$CONFIG_FILES ./raddb/radiusd.conf" ;; *) as_fn_error $? "invalid argument: \`$ac_config_target'" "$LINENO" 5;; esac done # If the user did not use the arguments to specify the items to instantiate, # then the envvar interface is used. Set only those that are not. # We use the long form for the default assignment because of an extremely # bizarre bug on SunOS 4.1.3. if $ac_need_defaults; then test ${CONFIG_FILES+y} || CONFIG_FILES=$config_files test ${CONFIG_HEADERS+y} || CONFIG_HEADERS=$config_headers test ${CONFIG_COMMANDS+y} || CONFIG_COMMANDS=$config_commands fi # Have a temporary directory for convenience. Make it in the build tree # simply because there is no reason against having it here, and in addition, # creating and moving files from /tmp can sometimes cause problems. # Hook for its removal unless debugging. # Note that there is a small window in which the directory will not be cleaned: # after its creation but before its name has been assigned to `$tmp'. $debug || { tmp= ac_tmp= trap 'exit_status=$? : "${ac_tmp:=$tmp}" { test ! -d "$ac_tmp" || rm -fr "$ac_tmp"; } && exit $exit_status ' 0 trap 'as_fn_exit 1' 1 2 13 15 } # Create a (secure) tmp directory for tmp files. { tmp=`(umask 077 && mktemp -d "./confXXXXXX") 2>/dev/null` && test -d "$tmp" } || { tmp=./conf$$-$RANDOM (umask 077 && mkdir "$tmp") } || as_fn_error $? "cannot create a temporary directory in ." "$LINENO" 5 ac_tmp=$tmp # Set up the scripts for CONFIG_FILES section. # No need to generate them if there are no CONFIG_FILES. # This happens for instance with `./config.status config.h'. if test -n "$CONFIG_FILES"; then ac_cr=`echo X | tr X '\015'` # On cygwin, bash can eat \r inside `` if the user requested igncr. # But we know of no other shell where ac_cr would be empty at this # point, so we can use a bashism as a fallback. if test "x$ac_cr" = x; then eval ac_cr=\$\'\\r\' fi ac_cs_awk_cr=`$AWK 'BEGIN { print "a\rb" }' /dev/null` if test "$ac_cs_awk_cr" = "a${ac_cr}b"; then ac_cs_awk_cr='\\r' else ac_cs_awk_cr=$ac_cr fi echo 'BEGIN {' >"$ac_tmp/subs1.awk" && _ACEOF { echo "cat >conf$$subs.awk <<_ACEOF" && echo "$ac_subst_vars" | sed 's/.*/&!$&$ac_delim/' && echo "_ACEOF" } >conf$$subs.sh || as_fn_error $? "could not make $CONFIG_STATUS" "$LINENO" 5 ac_delim_num=`echo "$ac_subst_vars" | grep -c '^'` ac_delim='%!_!# ' for ac_last_try in false false false false false :; do . ./conf$$subs.sh || as_fn_error $? "could not make $CONFIG_STATUS" "$LINENO" 5 ac_delim_n=`sed -n "s/.*$ac_delim\$/X/p" conf$$subs.awk | grep -c X` if test $ac_delim_n = $ac_delim_num; then break elif $ac_last_try; then as_fn_error $? "could not make $CONFIG_STATUS" "$LINENO" 5 else ac_delim="$ac_delim!$ac_delim _$ac_delim!! " fi done rm -f conf$$subs.sh cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 cat >>"\$ac_tmp/subs1.awk" <<\\_ACAWK && _ACEOF sed -n ' h s/^/S["/; s/!.*/"]=/ p g s/^[^!]*!// :repl t repl s/'"$ac_delim"'$// t delim :nl h s/\(.\{148\}\)..*/\1/ t more1 s/["\\]/\\&/g; s/^/"/; s/$/\\n"\\/ p n b repl :more1 s/["\\]/\\&/g; s/^/"/; s/$/"\\/ p g s/.\{148\}// t nl :delim h s/\(.\{148\}\)..*/\1/ t more2 s/["\\]/\\&/g; s/^/"/; s/$/"/ p b :more2 s/["\\]/\\&/g; s/^/"/; s/$/"\\/ p g s/.\{148\}// t delim ' >$CONFIG_STATUS || ac_write_fail=1 rm -f conf$$subs.awk cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 _ACAWK cat >>"\$ac_tmp/subs1.awk" <<_ACAWK && for (key in S) S_is_set[key] = 1 FS = "" } { line = $ 0 nfields = split(line, field, "@") substed = 0 len = length(field[1]) for (i = 2; i < nfields; i++) { key = field[i] keylen = length(key) if (S_is_set[key]) { value = S[key] line = substr(line, 1, len) "" value "" substr(line, len + keylen + 3) len += length(value) + length(field[++i]) substed = 1 } else len += 1 + keylen } print line } _ACAWK _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 if sed "s/$ac_cr//" < /dev/null > /dev/null 2>&1; then sed "s/$ac_cr\$//; s/$ac_cr/$ac_cs_awk_cr/g" else cat fi < "$ac_tmp/subs1.awk" > "$ac_tmp/subs.awk" \ || as_fn_error $? "could not setup config files machinery" "$LINENO" 5 _ACEOF # VPATH may cause trouble with some makes, so we remove sole $(srcdir), # ${srcdir} and @srcdir@ entries from VPATH if srcdir is ".", strip leading and # trailing colons and then remove the whole line if VPATH becomes empty # (actually we leave an empty line to preserve line numbers). if test "x$srcdir" = x.; then ac_vpsub='/^[ ]*VPATH[ ]*=[ ]*/{ h s/// s/^/:/ s/[ ]*$/:/ s/:\$(srcdir):/:/g s/:\${srcdir}:/:/g s/:@srcdir@:/:/g s/^:*// s/:*$// x s/\(=[ ]*\).*/\1/ G s/\n// s/^[^=]*=[ ]*$// }' fi cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 fi # test -n "$CONFIG_FILES" # Set up the scripts for CONFIG_HEADERS section. # No need to generate them if there are no CONFIG_HEADERS. # This happens for instance with `./config.status Makefile'. if test -n "$CONFIG_HEADERS"; then cat >"$ac_tmp/defines.awk" <<\_ACAWK || BEGIN { _ACEOF # Transform confdefs.h into an awk script `defines.awk', embedded as # here-document in config.status, that substitutes the proper values into # config.h.in to produce config.h. # Create a delimiter string that does not exist in confdefs.h, to ease # handling of long lines. ac_delim='%!_!# ' for ac_last_try in false false :; do ac_tt=`sed -n "/$ac_delim/p" confdefs.h` if test -z "$ac_tt"; then break elif $ac_last_try; then as_fn_error $? "could not make $CONFIG_HEADERS" "$LINENO" 5 else ac_delim="$ac_delim!$ac_delim _$ac_delim!! " fi done # For the awk script, D is an array of macro values keyed by name, # likewise P contains macro parameters if any. Preserve backslash # newline sequences. ac_word_re=[_$as_cr_Letters][_$as_cr_alnum]* sed -n ' s/.\{148\}/&'"$ac_delim"'/g t rset :rset s/^[ ]*#[ ]*define[ ][ ]*/ / t def d :def s/\\$// t bsnl s/["\\]/\\&/g s/^ \('"$ac_word_re"'\)\(([^()]*)\)[ ]*\(.*\)/P["\1"]="\2"\ D["\1"]=" \3"/p s/^ \('"$ac_word_re"'\)[ ]*\(.*\)/D["\1"]=" \2"/p d :bsnl s/["\\]/\\&/g s/^ \('"$ac_word_re"'\)\(([^()]*)\)[ ]*\(.*\)/P["\1"]="\2"\ D["\1"]=" \3\\\\\\n"\\/p t cont s/^ \('"$ac_word_re"'\)[ ]*\(.*\)/D["\1"]=" \2\\\\\\n"\\/p t cont d :cont n s/.\{148\}/&'"$ac_delim"'/g t clear :clear s/\\$// t bsnlc s/["\\]/\\&/g; s/^/"/; s/$/"/p d :bsnlc s/["\\]/\\&/g; s/^/"/; s/$/\\\\\\n"\\/p b cont ' >$CONFIG_STATUS || ac_write_fail=1 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 for (key in D) D_is_set[key] = 1 FS = "" } /^[\t ]*#[\t ]*(define|undef)[\t ]+$ac_word_re([\t (]|\$)/ { line = \$ 0 split(line, arg, " ") if (arg[1] == "#") { defundef = arg[2] mac1 = arg[3] } else { defundef = substr(arg[1], 2) mac1 = arg[2] } split(mac1, mac2, "(") #) macro = mac2[1] prefix = substr(line, 1, index(line, defundef) - 1) if (D_is_set[macro]) { # Preserve the white space surrounding the "#". print prefix "define", macro P[macro] D[macro] next } else { # Replace #undef with comments. This is necessary, for example, # in the case of _POSIX_SOURCE, which is predefined and required # on some systems where configure will not decide to define it. if (defundef == "undef") { print "/*", prefix defundef, macro, "*/" next } } } { print } _ACAWK _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 as_fn_error $? "could not setup config headers machinery" "$LINENO" 5 fi # test -n "$CONFIG_HEADERS" eval set X " :F $CONFIG_FILES :H $CONFIG_HEADERS :C $CONFIG_COMMANDS" shift for ac_tag do case $ac_tag in :[FHLC]) ac_mode=$ac_tag; continue;; esac case $ac_mode$ac_tag in :[FHL]*:*);; :L* | :C*:*) as_fn_error $? "invalid tag \`$ac_tag'" "$LINENO" 5;; :[FH]-) ac_tag=-:-;; :[FH]*) ac_tag=$ac_tag:$ac_tag.in;; esac ac_save_IFS=$IFS IFS=: set x $ac_tag IFS=$ac_save_IFS shift ac_file=$1 shift case $ac_mode in :L) ac_source=$1;; :[FH]) ac_file_inputs= for ac_f do case $ac_f in -) ac_f="$ac_tmp/stdin";; *) # Look for the file first in the build tree, then in the source tree # (if the path is not absolute). The absolute path cannot be DOS-style, # because $ac_f cannot contain `:'. test -f "$ac_f" || case $ac_f in [\\/$]*) false;; *) test -f "$srcdir/$ac_f" && ac_f="$srcdir/$ac_f";; esac || as_fn_error 1 "cannot find input file: \`$ac_f'" "$LINENO" 5;; esac case $ac_f in *\'*) ac_f=`printf "%s\n" "$ac_f" | sed "s/'/'\\\\\\\\''/g"`;; esac as_fn_append ac_file_inputs " '$ac_f'" done # Let's still pretend it is `configure' which instantiates (i.e., don't # use $as_me), people would be surprised to read: # /* config.h. Generated by config.status. */ configure_input='Generated from '` printf "%s\n" "$*" | sed 's|^[^:]*/||;s|:[^:]*/|, |g' `' by configure.' if test x"$ac_file" != x-; then configure_input="$ac_file. $configure_input" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: creating $ac_file" >&5 printf "%s\n" "$as_me: creating $ac_file" >&6;} fi # Neutralize special characters interpreted by sed in replacement strings. case $configure_input in #( *\&* | *\|* | *\\* ) ac_sed_conf_input=`printf "%s\n" "$configure_input" | sed 's/[\\\\&|]/\\\\&/g'`;; #( *) ac_sed_conf_input=$configure_input;; esac case $ac_tag in *:-:* | *:-) cat >"$ac_tmp/stdin" \ || as_fn_error $? "could not create $ac_file" "$LINENO" 5 ;; esac ;; esac ac_dir=`$as_dirname -- "$ac_file" || $as_expr X"$ac_file" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ X"$ac_file" : 'X\(//\)[^/]' \| \ X"$ac_file" : 'X\(//\)$' \| \ X"$ac_file" : 'X\(/\)' \| . 2>/dev/null || printf "%s\n" X"$ac_file" | sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/ q } /^X\(\/\/\)[^/].*/{ s//\1/ q } /^X\(\/\/\)$/{ s//\1/ q } /^X\(\/\).*/{ s//\1/ q } s/.*/./; q'` as_dir="$ac_dir"; as_fn_mkdir_p ac_builddir=. case "$ac_dir" in .) ac_dir_suffix= ac_top_builddir_sub=. ac_top_build_prefix= ;; *) ac_dir_suffix=/`printf "%s\n" "$ac_dir" | sed 's|^\.[\\/]||'` # A ".." for each directory in $ac_dir_suffix. ac_top_builddir_sub=`printf "%s\n" "$ac_dir_suffix" | sed 's|/[^\\/]*|/..|g;s|/||'` case $ac_top_builddir_sub in "") ac_top_builddir_sub=. ac_top_build_prefix= ;; *) ac_top_build_prefix=$ac_top_builddir_sub/ ;; esac ;; esac ac_abs_top_builddir=$ac_pwd ac_abs_builddir=$ac_pwd$ac_dir_suffix # for backward compatibility: ac_top_builddir=$ac_top_build_prefix case $srcdir in .) # We are building in place. ac_srcdir=. ac_top_srcdir=$ac_top_builddir_sub ac_abs_top_srcdir=$ac_pwd ;; [\\/]* | ?:[\\/]* ) # Absolute name. ac_srcdir=$srcdir$ac_dir_suffix; ac_top_srcdir=$srcdir ac_abs_top_srcdir=$srcdir ;; *) # Relative name. ac_srcdir=$ac_top_build_prefix$srcdir$ac_dir_suffix ac_top_srcdir=$ac_top_build_prefix$srcdir ac_abs_top_srcdir=$ac_pwd/$srcdir ;; esac ac_abs_srcdir=$ac_abs_top_srcdir$ac_dir_suffix case $ac_mode in :F) # # CONFIG_FILE # _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 # If the template does not know about datarootdir, expand it. # FIXME: This hack should be removed a few years after 2.60. ac_datarootdir_hack=; ac_datarootdir_seen= ac_sed_dataroot=' /datarootdir/ { p q } /@datadir@/p /@docdir@/p /@infodir@/p /@localedir@/p /@mandir@/p' case `eval "sed -n \"\$ac_sed_dataroot\" $ac_file_inputs"` in *datarootdir*) ac_datarootdir_seen=yes;; *@datadir@*|*@docdir@*|*@infodir@*|*@localedir@*|*@mandir@*) { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&5 printf "%s\n" "$as_me: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&2;} _ACEOF cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_datarootdir_hack=' s&@datadir@&$datadir&g s&@docdir@&$docdir&g s&@infodir@&$infodir&g s&@localedir@&$localedir&g s&@mandir@&$mandir&g s&\\\${datarootdir}&$datarootdir&g' ;; esac _ACEOF # Neutralize VPATH when `$srcdir' = `.'. # Shell code in configure.ac might set extrasub. # FIXME: do we really want to maintain this feature? cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_sed_extra="$ac_vpsub $extrasub _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 :t /@[a-zA-Z_][a-zA-Z_0-9]*@/!b s|@configure_input@|$ac_sed_conf_input|;t t s&@top_builddir@&$ac_top_builddir_sub&;t t s&@top_build_prefix@&$ac_top_build_prefix&;t t s&@srcdir@&$ac_srcdir&;t t s&@abs_srcdir@&$ac_abs_srcdir&;t t s&@top_srcdir@&$ac_top_srcdir&;t t s&@abs_top_srcdir@&$ac_abs_top_srcdir&;t t s&@builddir@&$ac_builddir&;t t s&@abs_builddir@&$ac_abs_builddir&;t t s&@abs_top_builddir@&$ac_abs_top_builddir&;t t $ac_datarootdir_hack " eval sed \"\$ac_sed_extra\" "$ac_file_inputs" | $AWK -f "$ac_tmp/subs.awk" \ >$ac_tmp/out || as_fn_error $? "could not create $ac_file" "$LINENO" 5 test -z "$ac_datarootdir_hack$ac_datarootdir_seen" && { ac_out=`sed -n '/\${datarootdir}/p' "$ac_tmp/out"`; test -n "$ac_out"; } && { ac_out=`sed -n '/^[ ]*datarootdir[ ]*:*=/p' \ "$ac_tmp/out"`; test -z "$ac_out"; } && { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: $ac_file contains a reference to the variable \`datarootdir' which seems to be undefined. Please make sure it is defined" >&5 printf "%s\n" "$as_me: WARNING: $ac_file contains a reference to the variable \`datarootdir' which seems to be undefined. Please make sure it is defined" >&2;} rm -f "$ac_tmp/stdin" case $ac_file in -) cat "$ac_tmp/out" && rm -f "$ac_tmp/out";; *) rm -f "$ac_file" && mv "$ac_tmp/out" "$ac_file";; esac \ || as_fn_error $? "could not create $ac_file" "$LINENO" 5 ;; :H) # # CONFIG_HEADER # if test x"$ac_file" != x-; then { printf "%s\n" "/* $configure_input */" >&1 \ && eval '$AWK -f "$ac_tmp/defines.awk"' "$ac_file_inputs" } >"$ac_tmp/config.h" \ || as_fn_error $? "could not create $ac_file" "$LINENO" 5 if diff "$ac_file" "$ac_tmp/config.h" >/dev/null 2>&1; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: $ac_file is unchanged" >&5 printf "%s\n" "$as_me: $ac_file is unchanged" >&6;} else rm -f "$ac_file" mv "$ac_tmp/config.h" "$ac_file" \ || as_fn_error $? "could not create $ac_file" "$LINENO" 5 fi else printf "%s\n" "/* $configure_input */" >&1 \ && eval '$AWK -f "$ac_tmp/defines.awk"' "$ac_file_inputs" \ || as_fn_error $? "could not create -" "$LINENO" 5 fi ;; :C) { printf "%s\n" "$as_me:${as_lineno-$LINENO}: executing $ac_file commands" >&5 printf "%s\n" "$as_me: executing $ac_file commands" >&6;} ;; esac case $ac_file$ac_mode in "stamp-h":C) echo timestamp > src/include/stamp-h ;; "build-radpaths-h":C) (cd ./src/include && /bin/sh ./build-radpaths-h) ;; "main-chmod":C) (cd ./src/main && chmod +x checkrad radlast radtest) ;; "scripts-chmod":C) (cd ./scripts && chmod +x rc.radiusd cron/radiusd.cron.daily cron/radiusd.cron.monthly cryptpasswd) ;; esac done # for ac_tag as_fn_exit 0 _ACEOF ac_clean_files=$ac_clean_files_save test $ac_write_fail = 0 || as_fn_error $? "write failure creating $CONFIG_STATUS" "$LINENO" 5 # configure is writing to config.log, and then calls config.status. # config.status does its own redirection, appending to config.log. # Unfortunately, on DOS this fails, as config.log is still kept open # by configure, so config.status won't be able to write to it; its # output is simply discarded. So we exec the FD to /dev/null, # effectively closing config.log, so it can be properly (re)opened and # appended to by config.status. When coming back to configure, we # need to make the FD available again. if test "$no_create" != yes; then ac_cs_success=: ac_config_status_args= test "$silent" = yes && ac_config_status_args="$ac_config_status_args --quiet" exec 5>/dev/null $SHELL $CONFIG_STATUS $ac_config_status_args || ac_cs_success=false exec 5>>config.log # Use ||, not &&, to avoid exiting from the if with $? = 1, which # would make configure fail if this is the last instruction. $ac_cs_success || as_fn_exit 1 fi # # CONFIG_SUBDIRS section. # if test "$no_recursion" != yes; then # Remove --cache-file, --srcdir, and --disable-option-checking arguments # so they do not pile up. ac_sub_configure_args= ac_prev= eval "set x $ac_configure_args" shift for ac_arg do if test -n "$ac_prev"; then ac_prev= continue fi case $ac_arg in -cache-file | --cache-file | --cache-fil | --cache-fi \ | --cache-f | --cache- | --cache | --cach | --cac | --ca | --c) ac_prev=cache_file ;; -cache-file=* | --cache-file=* | --cache-fil=* | --cache-fi=* \ | --cache-f=* | --cache-=* | --cache=* | --cach=* | --cac=* | --ca=* \ | --c=*) ;; --config-cache | -C) ;; -srcdir | --srcdir | --srcdi | --srcd | --src | --sr) ac_prev=srcdir ;; -srcdir=* | --srcdir=* | --srcdi=* | --srcd=* | --src=* | --sr=*) ;; -prefix | --prefix | --prefi | --pref | --pre | --pr | --p) ac_prev=prefix ;; -prefix=* | --prefix=* | --prefi=* | --pref=* | --pre=* | --pr=* | --p=*) ;; --disable-option-checking) ;; *) case $ac_arg in *\'*) ac_arg=`printf "%s\n" "$ac_arg" | sed "s/'/'\\\\\\\\''/g"` ;; esac as_fn_append ac_sub_configure_args " '$ac_arg'" ;; esac done # Always prepend --prefix to ensure using the same prefix # in subdir configurations. ac_arg="--prefix=$prefix" case $ac_arg in *\'*) ac_arg=`printf "%s\n" "$ac_arg" | sed "s/'/'\\\\\\\\''/g"` ;; esac ac_sub_configure_args="'$ac_arg' $ac_sub_configure_args" # Pass --silent if test "$silent" = yes; then ac_sub_configure_args="--silent $ac_sub_configure_args" fi # Always prepend --disable-option-checking to silence warnings, since # different subdirs can have different --enable and --with options. ac_sub_configure_args="--disable-option-checking $ac_sub_configure_args" ac_popdir=`pwd` for ac_dir in : $subdirs; do test "x$ac_dir" = x: && continue # Do not complain, so a configure script can configure whichever # parts of a large source tree are present. test -d "$srcdir/$ac_dir" || continue ac_msg="=== configuring in $ac_dir (`pwd`/$ac_dir)" printf "%s\n" "$as_me:${as_lineno-$LINENO}: $ac_msg" >&5 printf "%s\n" "$ac_msg" >&6 as_dir="$ac_dir"; as_fn_mkdir_p ac_builddir=. case "$ac_dir" in .) ac_dir_suffix= ac_top_builddir_sub=. ac_top_build_prefix= ;; *) ac_dir_suffix=/`printf "%s\n" "$ac_dir" | sed 's|^\.[\\/]||'` # A ".." for each directory in $ac_dir_suffix. ac_top_builddir_sub=`printf "%s\n" "$ac_dir_suffix" | sed 's|/[^\\/]*|/..|g;s|/||'` case $ac_top_builddir_sub in "") ac_top_builddir_sub=. ac_top_build_prefix= ;; *) ac_top_build_prefix=$ac_top_builddir_sub/ ;; esac ;; esac ac_abs_top_builddir=$ac_pwd ac_abs_builddir=$ac_pwd$ac_dir_suffix # for backward compatibility: ac_top_builddir=$ac_top_build_prefix case $srcdir in .) # We are building in place. ac_srcdir=. ac_top_srcdir=$ac_top_builddir_sub ac_abs_top_srcdir=$ac_pwd ;; [\\/]* | ?:[\\/]* ) # Absolute name. ac_srcdir=$srcdir$ac_dir_suffix; ac_top_srcdir=$srcdir ac_abs_top_srcdir=$srcdir ;; *) # Relative name. ac_srcdir=$ac_top_build_prefix$srcdir$ac_dir_suffix ac_top_srcdir=$ac_top_build_prefix$srcdir ac_abs_top_srcdir=$ac_pwd/$srcdir ;; esac ac_abs_srcdir=$ac_abs_top_srcdir$ac_dir_suffix cd "$ac_dir" # Check for configure.gnu first; this name is used for a wrapper for # Metaconfig's "Configure" on case-insensitive file systems. if test -f "$ac_srcdir/configure.gnu"; then ac_sub_configure=$ac_srcdir/configure.gnu elif test -f "$ac_srcdir/configure"; then ac_sub_configure=$ac_srcdir/configure else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: no configuration information is in $ac_dir" >&5 printf "%s\n" "$as_me: WARNING: no configuration information is in $ac_dir" >&2;} ac_sub_configure= fi # The recursion is here. if test -n "$ac_sub_configure"; then # Make the cache file name correct relative to the subdirectory. case $cache_file in [\\/]* | ?:[\\/]* ) ac_sub_cache_file=$cache_file ;; *) # Relative name. ac_sub_cache_file=$ac_top_build_prefix$cache_file ;; esac { printf "%s\n" "$as_me:${as_lineno-$LINENO}: running $SHELL $ac_sub_configure $ac_sub_configure_args --cache-file=$ac_sub_cache_file --srcdir=$ac_srcdir" >&5 printf "%s\n" "$as_me: running $SHELL $ac_sub_configure $ac_sub_configure_args --cache-file=$ac_sub_cache_file --srcdir=$ac_srcdir" >&6;} # The eval makes quoting arguments work. eval "\$SHELL \"\$ac_sub_configure\" $ac_sub_configure_args \ --cache-file=\"\$ac_sub_cache_file\" --srcdir=\"\$ac_srcdir\"" || as_fn_error $? "$ac_sub_configure failed for $ac_dir" "$LINENO" 5 fi cd "$ac_popdir" done fi if test -n "$ac_unrecognized_opts" && test "$enable_option_checking" != no; then { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: unrecognized options: $ac_unrecognized_opts" >&5 printf "%s\n" "$as_me: WARNING: unrecognized options: $ac_unrecognized_opts" >&2;} fi module_list=$(find src/modules/ -type d -name 'rlm_*' -print | sort) echo echo Module configure status report echo ------------------------------ for module in $module_list; do module_name="$(basename $module)" module_print="$(echo "$module_name ........................" | cut -c 1-25)" module_status="OK" if test -r $module/configure.ac; then if test -r $module/config.report; then module_status=$(cat $module/config.report) fi fi $as_echo "$module_print $module_status" done freeradius-3.2.10+dfsg/configure.ac000066400000000000000000002075371522352605200171530ustar00rootroot00000000000000dnl ############################################################# dnl # dnl # For information about autoconf, see: dnl # dnl # http://www.gnu.org/software/autoconf/ dnl # dnl # The recommended order is: dnl # dnl # AC_INIT dnl # 0. checks for compiler, libtool, and command line options dnl # 1. checks for programs dnl # 2. checks for libraries dnl # 3. checks for header files dnl # 4. checks for typedefs dnl # 5. checks for structures and functions dnl # 6. checks for compiler characteristics dnl # 7. checks for library functions dnl # 8. checks for system services dnl # AC_OUTPUT dnl # dnl ############################################################# AC_PREREQ([2.69]) export CFLAGS LIBS LDFLAGS CPPFLAGS AC_INIT([freeradius],[$Id: f560c31c219918bc67ed7fc4063786755688fa85 $],[http://bugs.freeradius.org],[],[http://www.freeradius.org]) AC_CONFIG_MACRO_DIR([m4]) AC_CONFIG_SRCDIR([src/main/radiusd.c]) AC_CONFIG_HEADER([src/include/autoconf.h]) dnl ############################################################# dnl # dnl # Custom hackery to discover version at configure time dnl # dnl ############################################################# RADIUSD_MAJOR_VERSION=`cat VERSION | cut -f1 -d.` RADIUSD_MINOR_VERSION=`cat VERSION | cut -f2 -d.` RADIUSD_INCRM_VERSION=`cat VERSION | cut -f3 -d. | sed 's/[[\.-]].*$//'` RADIUSD_VERSION=`printf "%02i%02i%02i" $RADIUSD_MAJOR_VERSION $RADIUSD_MINOR_VERSION $RADIUSD_INCRM_VERSION` dnl # dnl # Still useful for custom builds dnl # RADIUSD_VERSION_STRING=`cat VERSION` dnl # dnl # Add definitions to Make.inc as it's used by various build targets dnl # AC_SUBST([RADIUSD_VERSION_STRING]) dnl # dnl # Add definitions to autoconf.h, so that the headers that we install dnl # contain the version number of the server. dnl # AC_DEFINE_UNQUOTED([RADIUSD_VERSION], [${RADIUSD_VERSION}], [Version integer in format ]) AC_DEFINE_UNQUOTED([RADIUSD_VERSION_STRING], ["${RADIUSD_VERSION_STRING}"], [Raw version string from VERSION file]) dnl ############################################################# dnl # dnl # Override some of the default autoconf variables such as dnl # CFLAGS if were building in developer mode dnl # dnl ############################################################# dnl # dnl # Unset ASAN_OPTIONS and LSAN_OPTIONS so they don't interfere dnl # with the build process. dnl # unset ASAN_OPTIONS unset LSAN_OPTIONS dnl # dnl # check for JSON.pm, ASCIIDOCTOR and pandoc dnl # AC_PATH_PROG(ASCIIDOCTOR, asciidoctor) if test "x$ac_cv_path_ASCIIDOCTOR" = "x"; then AC_MSG_WARN([asciidoctor not found - Please install if you want build the docs]) fi AC_PATH_PROG(PANDOC, pandoc) if test "x$ac_cv_path_PANDOC" = "x"; then AC_MSG_WARN([pandoc not found - Please install if you want build the docs]) else # # Pandoc v2 onwards renamed --latex-engine to --pdf-engine # if pandoc --help 2>&1 | grep -q "latex-engine"; then PANDOC_ENGINE=latex else PANDOC_ENGINE=pdf fi AC_SUBST(PANDOC_ENGINE) fi # pandoc and asciidoctor is defined? then check it. if test "x$ac_cv_path_PANDOC" != "x" && test "x$ac_cv_path_ASCIIDOCTOR" != "x"; then AX_PROG_PERL_MODULES(JSON, , AC_MSG_WARN([Perl JSON module not found - Please install if you want build the docs])) fi dnl # dnl # check for doxygen dnl # AC_PATH_PROG(DOXYGEN, doxygen) if test "x$ac_cv_path_DOXYGEN" != "x"; then AC_PATH_PROG(GRAPHVIZ_DOT, dot) if test "x$ac_cv_path_GRAPHVIZ_DOT" = "x"; then AC_MSG_WARN([dot not found - Please install the graphviz if you want to build the docs/source]) fi else AC_MSG_WARN([doxygen not found - Please install if you want build the docs/source]) fi dnl # dnl # check for Antora dnl # AC_PATH_PROG(ANTORA, antora) if test "x$ac_cv_path_ANTORA" = "x"; then AC_MSG_WARN([antora not found - Please install if you want build the site]) fi dnl # dnl # Enable developer features like debugging symbols. dnl # These checks must be done before expanding the AC_PROG_CC dnl # and AC_PROG_CXX macros. dnl # AC_ARG_ENABLE(developer, [ --enable-developer enables features of interest to developers.], [ case "$enableval" in no) developer=no ;; *) developer=yes esac ] ) dnl # dnl # Turn on the developer flag when taken from a git checkout (not a release) dnl # if test -d $srcdir/.git; then if test "x$developer" != "xno"; then AC_MSG_NOTICE([found .git directory, enabling developer build implicitly, disable with --disable-developer]) developer="yes" fi fi dnl # dnl # Autoconf sets -O2 and -g by default, but this is a PITA for debugging dnl # so we remove the defaults if were building in developer mode, and set dnl # -g3 so nice things like macro values are included. Other arguments are dnl # added later when we know what compiler were using. dnl # if test "x$developer" = "xyes"; then : ${CFLAGS=-g3} fi dnl # dnl # The developer option WITH_VERIFY_PTR significantly scews profiling so dnl # we allow it to be disabled. dnl # AC_ARG_ENABLE(verify-ptr, [ --disable-verify-ptr disables WITH_VERIFY_PTR developer build option.], [ case "$enableval" in no) verify_ptr="" ;; *) verify_ptr="-DWITH_VERIFY_PTR=1" esac ], [ verify_ptr="-DWITH_VERIFY_PTR=1" ], ) dnl # dnl # Hard-code FIPS support/ dnl # AC_ARG_ENABLE(fips-workaround, [ --enable-fips-workaround enables local MD4, MD5, etc. functionality to avoid OpenSSL FIPS issues.], [ case "$enableval" in no) ;; *) CFLAGS="$CFLAGS -DWITH_FIPS=1" esac ], [ ], ) dnl ############################################################# dnl # dnl # 0. Checks for compiler, libtool, and command line options. dnl # dnl ############################################################# dnl # dnl # Get system information dnl # AC_CANONICAL_TARGET dnl # dnl # clang etc. on OSX no longer searches the default paths for things, dnl # so we have to add them back in. dnl # case "$host" in *-darwin*) CFLAGS="$CFLAGS -DDARWIN" LDFLAGS="-L/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/lib $LDFLAGS" LIBS="-F /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/System/Library/Frameworks/ -framework DirectoryService $LIBS" ;; esac dnl # dnl # Check for GNU cc dnl # AC_PROG_CC AC_PROG_CXX dnl # dnl # check for AIX, to allow us to use some BSD functions dnl # must be before macros that call the compiler. dnl # AC_USE_SYSTEM_EXTENSIONS AC_PROG_GCC_TRADITIONAL AC_PROG_CC_SUNPRO AC_PROG_RANLIB dnl # dnl # Definitive check for whether the compiler is clang dnl # AX_CC_IS_CLANG if test "x$ax_cv_cc_clang" = "xyes"; then AC_SUBST(clang_path, "$CC") else AC_SUBST(clang_path, "") fi dnl # dnl # Set Default CFLAGS for GCC compatible compilers dnl # if test "x$GCC" = "xyes"; then CFLAGS="$CFLAGS -Wall -std=c99 -D_GNU_SOURCE" fi dnl # dnl # -Wno-unknown-warning-option means the compiler doesn't complain about diag pragmas dnl # for warnings it doesn't understand. This may sound like a bad idea, but consider dnl # the number of different compiler versions we build under, and the fact that the dnl # more anally retentive warnings are likely to be added in later versions. dnl # AX_CC_NO_UNKNOWN_WARNING_OPTION_FLAG if test "x$ax_cv_cc_no_unknown_warning_option_flag" = "xyes"; then CFLAGS="$CFLAGS -Wno-unknown-warning-option" fi dnl # dnl # -Qunused-arguments means the compiler won't complain about unsupported arguments dnl # AX_CC_QUNUSED_ARGUMENTS_FLAG if test "x$ax_cv_cc_qunused_arguments_flag" = "xyes"; then CFLAGS="$CFLAGS -Qunused-arguments" LDFLAGS="$LDFLAGS -Qunused-arguments" fi dnl # dnl # Check for presence of -Wno-date-time warning. Older compilers dnl # don't have it, and newer compilers warn without it... dnl # AX_CC_NO_DATE_TIME_FLAG dnl # dnl # Compile in large (2G+) file support. dnl # AC_SYS_LARGEFILE dnl # dnl # check for system bytesex dnl # AC_DEFINES WORDS_BIGENDIAN dnl # AC_C_BIGENDIAN( [AC_DEFINE(FR_BIG_ENDIAN, 1, [Define if your processor stores words with the most significant byte first])], [AC_DEFINE(FR_LITTLE_ENDIAN, 1, [Define if your processor stores words with the least significant byte first])] ) dnl # dnl # Find GNU Make. dnl # AC_CHECK_PROG(GMAKE, gmake, yes, no) if test $GMAKE = no; then AC_PATH_PROG(MAKE, make, /usr/local/bin/make) else AC_PATH_PROG(MAKE, gmake, /usr/local/gnu/bin/make) fi makever=`$ac_cv_path_MAKE --version 2>&1 | grep "GNU Make"` if test -z "$makever"; then AC_MSG_ERROR([GNU Make is not installed. Please download and install it from ftp://prep.ai.mit.edu/pub/gnu/make/ before continuing.]) fi dnl # dnl # autoconf explicitly sets MAKEFLAGS and MFLAGS to '' even though we dnl # didn't tell it to, so we have to use FR_MAKEFLAGS. dnl # dnl # determine the number of cores available and set the number of build dnl # processes appropriately. dnl # AX_SYSTEM_CORES dnl # Temporarily disabled because test and installation targets do not dnl # have dependencies set up correctly for multiple build processes. dnl if test "x$ax_cv_system_cores" != "x"; then dnl : ${FR_MAKEFLAGS=-j$ax_cv_system_cores} dnl fi AC_SUBST(FR_MAKEFLAGS) dnl # dnl # See if we have Git. dnl # AC_CHECK_PROG(GIT, git, yes, no) dnl Put this in later, when all distributed modules use autoconf. dnl AC_ARG_WITH(disablemodulefoo, dnl [ --without-rlm_foo Disables module compilation. Module list:] dnl esyscmd([find src/modules -type d -name rlm_\* -print |\ dnl sed -e 's%src/modules/.*/% (sub)- %; s%.*/%- %' |\ dnl awk '{print " "$0}'])) AC_ARG_ENABLE(strict-dependencies, [ --enable-strict-dependencies fail configure on lack of module dependancy.]) AC_ARG_ENABLE(werror, [ --enable-werror causes the build to fail if any warnings are generated.], [ case "$enableval" in no) werror=no ;; *) werror=yes esac ] ) dnl # dnl # extra argument: --with-docdir dnl # docdir='${datadir}/doc/freeradius' AC_MSG_CHECKING([docdir]) AC_ARG_WITH(docdir, [ --with-docdir=DIR directory for documentation [DATADIR/doc/freeradius] ], [ case "$withval" in no) docdir=no ;; yes) ;; [[\\/$]]* | ?:[[\\/]]* ) docdir="$withval" ;; *) AC_MSG_ERROR([expected an absolute directory name for --with-docdir: $withval]) ;; esac ] ) AC_SUBST(docdir) AC_MSG_RESULT($docdir) if test "x$docdir" = xno; then AC_MSG_WARN([Documentation files will NOT be installed.]) fi dnl # dnl # extra argument: --with-logdir dnl # logdir='${localstatedir}/log/radius' AC_MSG_CHECKING(logdir) AC_ARG_WITH(logdir, [ --with-logdir=DIR directory for logfiles [LOCALSTATEDIR/log/radius] ], [ case "$withval" in no) AC_MSG_ERROR([Need logdir]) ;; yes) ;; [[\\/$]]* | ?:[[\\/]]* ) logdir="$withval" ;; *) AC_MSG_ERROR([expected an absolute directory name for --with-logdir: $withval]) ;; esac ] ) AC_SUBST(logdir) AC_MSG_RESULT($logdir) dnl # dnl # extra argument: --with-radacctdir dnl # radacctdir='${logdir}/radacct' AC_MSG_CHECKING(radacctdir) AC_ARG_WITH(radacctdir, [ --with-radacctdir=DIR directory for detail files [LOGDIR/radacct] ], [ case "$withval" in no) AC_MSG_ERROR([Need radacctdir]) ;; yes) ;; [[\\/$]]* | ?:[[\\/]]* ) radacctdir="$withval" ;; *) AC_MSG_ERROR([expected an absolute directory name for --with-radacctdir: $withval]) ;; esac ] ) AC_SUBST(radacctdir) AC_MSG_RESULT($radacctdir) dnl # dnl # extra argument: --with-raddbdir dnl # raddbdir='${sysconfdir}/raddb' AC_MSG_CHECKING(raddbdir) AC_ARG_WITH(raddbdir, [ --with-raddbdir=DIR directory for config files [SYSCONFDIR/raddb] ], [ case "$withval" in no) AC_MSG_ERROR([Need raddbdir]) ;; yes) ;; [[\\/$]]* | ?:[[\\/]]* ) raddbdir="$withval" ;; *) AC_MSG_ERROR([expected an absolute directory name for --with-raddbdir: $withval]) ;; esac ] ) AC_SUBST(raddbdir) AC_MSG_RESULT($raddbdir) dnl # dnl # extra argument: --with-dictdir dnl # dictdir='${datarootdir}/freeradius' AC_MSG_CHECKING(dictdir) AC_ARG_WITH(dictdir, [ --with-dictdir=DIR directory for dictionary files [DATAROOTDIR/freeradius] ], [ case "$withval" in no) AC_MSG_ERROR([Need dictdir]) ;; yes) ;; [[\\/$]]* | ?:[[\\/]]* ) dictdir="$withval" ;; *) AC_MSG_ERROR([expected an absolute directory name for --with-dictdir: $withval]) ;; esac ] ) AC_SUBST(dictdir) AC_MSG_RESULT($dictdir) modconfdir='${raddbdir}/mods-config' AC_SUBST(modconfdir) dnl # dnl # extra argument: --with-ascend-binary dnl # WITH_ASCEND_BINARY=yes AC_ARG_WITH(ascend-binary, [ --with-ascend-binary include support for Ascend binary filter attributes (default=yes)], [ case "$withval" in yes) ;; *) WITH_ASCEND_BINARY=no esac ] ) if test "x$WITH_ASCEND_BINARY" = "xyes"; then AC_DEFINE(WITH_ASCEND_BINARY, [1], [include support for Ascend binary filter attributes]) fi dnl # dnl # extra argument: --with-radiusv11 dnl # WITH_RADIUSV11= AC_ARG_WITH(radiusv11, [ --with-radiusv11 compile in RADIUSv11 support. (default=no)], [ case "$withval" in yes) WITH_RADIUSV11=yes ;; *) ;; esac ] ) if test "x$WITH_RADIUSCV11" = "xyes"; then AC_DEFINE(WITH_RADIUSV11, [1], [define if you want RADIUSv11 support (For RADSec et al)]) fi dnl # dnl # extra argument: --with-threads dnl # WITH_THREADS=yes AC_ARG_WITH(threads, [ --with-threads use threads, if available. (default=yes) ], [ case "$withval" in yes) ;; *) WITH_THREADS=no esac ] ) dnl # dnl # extra argument: --with-tcp dnl # WITH_TCP=yes AC_ARG_WITH(tcp, [ --with-tcp compile in TCP support. (default=yes)], [ case "$withval" in yes) ;; *) WITH_TCP=no esac ] ) if test "x$WITH_TCP" = "xyes"; then AC_DEFINE(WITH_TCP, [1], [define if you want TCP support (For RADSec et al)]) fi dnl # dnl # extra argument: --with-vmps dnl # WITH_VMPS=yes AC_ARG_WITH(vmps, [ --with-vmps compile in VMPS support. (default=yes)], [ case "$withval" in yes) ;; *) WITH_VMPS=no esac ] ) if test "x$WITH_VMPS" = "xyes"; then AC_DEFINE(WITH_VMPS, [1], [define if you want VMPS support]) fi dnl # dnl # extra argument: --with-dhcp dnl # WITH_DHCP=yes AC_ARG_WITH(dhcp, [ --with-dhcp compile in DHCP support. (default=yes)], [ case "$withval" in yes) ;; *) WITH_DHCP=no esac ] ) if test "x$WITH_DHCP" = "xyes"; then AC_DEFINE(WITH_DHCP, [1], [define if you want DHCP support]) fi AC_SUBST(WITH_DHCP) dnl # dnl # extra argument: --with-radlast dnl # MANSKIP= WITH_RADLAST= AC_ARG_WITH(radlast, [ --with-radlast install radlast], [ case "$withval" in yes) WITH_RADLAST=yes ;; *) WITH_RADLAST=no esac ] ) AC_SUBST(WITH_RADLAST) dnl # dnl # Allow the user to specify a list of modules to be linked dnl # statically to the server. dnl # STATIC_MODULES= AC_ARG_WITH(static_modules, [ --with-static-modules=QUOTED-MODULE-LIST],[ for i in $withval; do STATIC_MODULES="$STATIC_MODULES -dlpreopen ../modules/rlm_$i/rlm_$i.la" done ]) USE_SHARED_LIBS=yes AC_ARG_WITH(shared-libs, [AS_HELP_STRING([--with-shared-libs ], [build dynamic libraries and link against them. (default=yes)])], [ case "$withval" in no) USE_SHARED_LIBS=no ;; *) esac ]) MODULES= AC_ARG_WITH(modules, [ --with-modules=QUOTED-MODULE-LIST],[ for i in $withval; do MODULES="$MODULES $i" done ]) dnl # dnl # extra argument: --with-experimental-modules dnl # EXPERIMENTAL= AC_ARG_WITH(experimental-modules, [AS_HELP_STRING([--with-experimental-modules], [use experimental and unstable modules. (default=no, unless --enable-developer=yes)])], [ case "$withval" in yes) EXPERIMENTAL=yes ;; no) EXPERIMENTAL=no ;; *) esac ] ) dnl # dnl # extra argument: --with-udpfromto dnl # WITH_UDPFROMTO=yes AC_ARG_WITH(udpfromto, [ --with-udpfromto compile in UDPFROMTO support. (default=yes)], [ case "$withval" in yes) WITH_UDPFROMTO=yes ;; *) WITH_UDPFROMTO=no esac ] ) if test "x$WITH_UDPFROMTO" = "xyes"; then AC_DEFINE(WITH_UDPFROMTO, [], [define if you want udpfromto]) fi dnl # dnl # These next two arguments don't actually do anything. They're dnl # place holders so that the top-level configure script can tell dnl # the user how to configure lower-level modules dnl # dnl # dnl # extra argument: --with-rlm-FOO-lib-dir dnl # AC_ARG_WITH(rlm-FOO-lib-dir, [AS_HELP_STRING([--with-rlm-FOO-lib-dir=DIR], [directory in which to look for library files used by module FOO])], [ case "$withval" in *) ;; esac ] ) dnl # dnl # extra argument: --with-rlm-FOO-include-dir dnl # AC_ARG_WITH(rlm-FOO-include-dir, [AS_HELP_STRING([--with-rlm-FOO-include-dir=DIR], [directory in which to look for include files used by module FOO])], [ case "$withval" in *) ;; esac ] ) dnl # dnl # extra argument: --with-openssl dnl # WITH_OPENSSL=yes AC_ARG_WITH(openssl, [ --with-openssl use OpenSSL. (default=yes)], [ case "$withval" in no) WITH_OPENSSL=no ;; *) WITH_OPENSSL=yes ;; esac ] ) if test "x$WITH_THREADS" = "xno"; then if test "x$WITH_OPENSSL" = "xyes"; then AC_MSG_ERROR([[Threads are required when using OpenSSL, use --with-threads=yes]]) fi fi dnl # dnl # extra argument: --with-openssl-lib-dir=dir dnl # openssl_lib_dir= AC_ARG_WITH(openssl-lib-dir, [AS_HELP_STRING([--with-openssl-lib-dir=DIR], [directory to look for OpenSSL library files])], [ case "$withval" in *) openssl_lib_dir="$withval" ;; esac ] ) dnl # dnl # extra argument: --with-openssl-includes=dir dnl # openssl_include_dir= AC_ARG_WITH(openssl-include-dir, [AS_HELP_STRING([--with-openssl-include-dir=DIR], [directory to look for OpenSSL include files])], [ case "$withval" in *) openssl_include_dir="$withval" ;; esac ] ) dnl # dnl # extra argument: --disable-openssl-version-check dnl # AC_ARG_ENABLE(openssl-version-check, [AS_HELP_STRING([--disable-openssl-version-check], [disable vulnerable OpenSSL version check])] ) if test "x$enable_openssl_version_check" != "xno"; then AC_DEFINE(ENABLE_OPENSSL_VERSION_CHECK, [1], [Define to 1 to have OpenSSL version check enabled]) openssl_version_check_config="\ # # allow_vulnerable_openssl: Allow the server to start with # versions of OpenSSL known to have critical vulnerabilities. # # This check is based on the version number reported by libssl # and may not reflect patches applied to libssl by # distribution maintainers. # allow_vulnerable_openssl = no" else openssl_version_check_config= fi AC_SUBST([openssl_version_check_config]) dnl # dnl # extra argument: --enable-reproducible-builds dnl # AC_ARG_ENABLE(reproducible-builds, [AS_HELP_STRING([--enable-reproducible-builds], [ensure the build does not change each time])], [ case "$enableval" in yes) AC_DEFINE(ENABLE_REPRODUCIBLE_BUILDS, [1], [Define to ensure each build is the same]) reproducible_builds=yes ;; *) reproducible_builds=no esac ] ) dnl # dnl # Enable the -fsanitize=fuzzer and link in the address sanitizer dnl # libraries. dnl # AC_ARG_ENABLE(fuzzer, [AS_HELP_STRING([--enable-fuzzer], [build with support for a fuzzer])], [ case "$enableval" in no) fuzzer=no ;; *) fuzzer=yes esac ] ) dnl # dnl # Enable the -fsanitize=address and link in the address sanitizer dnl # libraries. dnl # AC_ARG_ENABLE(address-sanitizer, [AS_HELP_STRING([--enable-address-sanitizer], [build with support for address sanitizer.])], [ case "$enableval" in no) address_sanitizer=no ;; *) address_sanitizer=yes esac ] ) dnl # dnl # Enable -fsanitize=leak and link in the leak sanitizer dnl # libraries. dnl # AC_ARG_ENABLE(leak-sanitizer, [AS_HELP_STRING([--enable-leak-sanitizer], [build with support for leak sanitizer.])], [ case "$enableval" in no) leak_sanitizer=no ;; *) leak_sanitizer=yes esac ] ) dnl # dnl # Enable -fsanitize=thread and link in the thread sanitizer dnl # libraries. dnl # AC_ARG_ENABLE(thread-sanitizer, [AS_HELP_STRING([--enable-thread-sanitizer], [build with support for thread sanitizer.])], [ case "$enableval" in no) thread_sanitizer=no ;; *) thread_sanitizer=yes esac ] ) dnl # dnl # Enable the -fsanitize=undefined and link in the address sanitizer dnl # libraries. dnl # AC_ARG_ENABLE(undefined-behaviour-sanitizer, [AS_HELP_STRING([--enable-undefined-behaviour-sanitizer], [build with support for undefined behaviour sanitizer.])], [ case "$enableval" in no) undefined_behaviour_sanitizer=no ;; *) undefined_behaviour_sanitizer=yes esac ] ) dnl ############################################################# dnl # dnl # 1. Checks for programs dnl # dnl ############################################################# CHECKRAD=checkrad AC_PATH_PROG(PERL, perl, /usr/local/bin/perl) if test "x$ac_cv_path_PERL" = "x"; then AC_MSG_WARN([perl not found - Simultaneous-Use and checkrad may not work]) fi AC_PATH_PROG(SNMPGET, snmpget) if test "x$ac_cv_path_SNMPGET" = "x"; then AC_MSG_WARN([snmpget not found - Simultaneous-Use and checkrad may not work]) fi AC_PATH_PROG(SNMPWALK, snmpwalk) if test "x$ac_cv_path_SNMPWALK" = "x"; then AC_MSG_WARN([snmpwalk not found - Simultaneous-Use and checkrad may not work]) fi AC_PATH_PROG(RUSERS, rusers, /usr/bin/rusers) dnl # dnl # radlast depends on last dnl # if test "x$WITH_RADLAST" = "x"; then AC_CHECK_PROG(LAST, last, yes, no) WITH_RADLAST="$LAST" fi if test "x$WITH_RADLAST" != "xyes"; then MANSKIP="$MANSKIP man/man1/radlast.1" fi dnl # dnl # FIXME This is truly gross. dnl # missing_dir=`cd $ac_aux_dir && pwd` AM_MISSING_PROG(ACLOCAL, aclocal, $missing_dir) AM_MISSING_PROG(AUTOCONF, autoconf, $missing_dir) AM_MISSING_PROG(AUTOHEADER, autoheader, $missing_dir) AC_PATH_PROG(DIRNAME,dirname) AC_PATH_PROG(GREP,grep) dnl ############################################################# dnl # dnl # 2. Checks for libraries dnl # dnl ############################################################# dnl Check for talloc dnl extra argument: --with-talloc-lib-dir=DIR talloc_lib_dir= AC_ARG_WITH(talloc-lib-dir, [AS_HELP_STRING([--with-talloc-lib-dir=DIR], [directory in which to look for talloc library files])], [case "$withval" in no) AC_MSG_ERROR([Need talloc-lib-dir]) ;; yes) ;; *) talloc_lib_dir="$withval" ;; esac]) dnl extra argument: --with-talloc-include-dir=DIR talloc_include_dir= AC_ARG_WITH(talloc-include-dir, [AS_HELP_STRING([--with-talloc-include-dir=DIR], [directory in which to look for talloc include files])], [case "$withval" in no) AC_MSG_ERROR([Need talloc-include-dir]) ;; yes) ;; *) talloc_include_dir="$withval" ;; esac]) smart_try_dir="$talloc_lib_dir" FR_SMART_CHECK_LIB(talloc, _talloc) if test "x$ac_cv_lib_talloc__talloc" != "xyes"; then AC_MSG_WARN([talloc library not found. Use --with-talloc-lib-dir=.]) AC_MSG_ERROR([FreeRADIUS requires libtalloc]) fi TALLOC_LIBS="${smart_lib}" TALLOC_LDFLAGS="${smart_ldflags}" AC_SUBST(TALLOC_LIBS) AC_SUBST(TALLOC_LDFLAGS) LIBS="$old_LIBS" dnl # dnl # If using pthreads, check for -lpthread (posix) or -lc_r (*BSD) dnl # old_CFLAGS=$CFLAGS if test "x$WITH_THREADS" = "xyes"; then if test $ac_cv_prog_suncc = "yes"; then CFLAGS="$CFLAGS -mt" fi AC_CHECK_HEADERS(pthread.h, [], [ WITH_THREADS="no" fail=[pthread.h] ]) dnl # dnl # pthread stuff is usually in -lpthread dnl # or in -lc_r, on *BSD dnl # dnl # On Some systems, we need extra pre-processor flags, to get them to dnl # to do the threading properly. dnl # if test "x$WITH_THREADS" != "xno"; then AC_CHECK_LIB(pthread, pthread_create, [ HAVE_LPTHREAD='yes' CFLAGS="$CFLAGS -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS" LIBS="-lpthread $LIBS" dnl # dnl # -pthread should add all required CPP definitions and linker dnl # arguments. But not all compilers support it, or some compilers dnl # only support it on certain platforms. dnl # AX_CC_PTHREAD_FLAG if test "x$ax_cv_cc_pthread_flag" != 'xyes'; then CFLAGS="$CFLAGS -pthread" fi ] ) dnl # dnl # Check for libc_r which used to be the threading library used dnl # for FreeBSD. Internet says it may be deprecated, but if we dnl # can't find lpthread it's probably worth checking. dnl # if test "x$HAVE_LPTHREAD" != "xyes"; then AC_CHECK_LIB(c_r, pthread_create, [ CFLAGS="$CFLAGS -D_THREAD_SAFE" dnl # dnl # -pthread should add all required CPP definitions and linker dnl # arguments. But not all compilers support it, or some compilers dnl # only support it on certain platforms. dnl # AX_CC_PTHREAD_FLAG if test "x$ax_cv_cc_pthread_flag" != 'xyes'; then LIBS="-lc_r $LIBS" else CFLAGS="$CFLAGS -pthread" fi ], [ fail=[-lc_r or -lpthread] ] ) fi fi if test "x$WITH_THREADS" != "xyes"; then AC_MSG_WARN([silently not building with thread support.]) AC_MSG_WARN([FAILURE: thread support requires: $fail.]) else AC_DEFINE(WITH_THREADS, [1], [define if you want thread support]) fi fi dnl # dnl # If we have NO pthread libraries, remove any knowledge of threads. dnl # if test "x$WITH_THREADS" != "xyes"; then CFLAGS=$old_CFLAGS ac_cv_header_pthread_h="no" WITH_THREADS=no else dnl # dnl # We need sem_init() and friends, as they're the friendliest dnl # semaphore functions for threading. dnl # dnl # HP/UX requires linking with librt, too, to get the sem_* symbols. dnl # Some systems have them in -lsem dnl # Solaris has them in -lposix4 dnl # NetBSD has them in -lsemaphore dnl # AC_SEARCH_LIBS(sem_init, pthread sem posix4 rt semaphore, [], [AC_MSG_ERROR([[-lsem not found. You may want to download it from ftp://ftp.to.gd-es.com/pub/BSDI/libsem.tar.bz2 or https://www.freeradius.org/ftp/pub/radius/contrib/libsem.tar.gz]])] ) fi dnl # dnl # Check if we have -ldl dnl # AC_CHECK_LIB(dl, dlopen) dnl # dnl # Check if we need -lsocket dnl # AC_CHECK_LIB(socket, getsockname) dnl # dnl # Check for -lresolv dnl # This library may be needed later. dnl # AC_CHECK_LIB(resolv, inet_aton) dnl # dnl # Check if we need -lnsl. Usually if we want to dnl # link against -lsocket we need to include -lnsl as well. dnl # AC_CHECK_LIB(nsl, inet_ntoa) AC_CHECK_LIB(ws2_32, htonl) dnl # dnl # Check the pcap library for the RADIUS sniffer. dnl # dnl extra argument: --with-pcap-lib-dir=DIR pcap_lib_dir= AC_ARG_WITH(pcap-lib-dir, [AS_HELP_STRING([--with-pcap-lib-dir=DIR], [directory in which to look for pcap library files])], [case "$withval" in no) AC_MSG_ERROR([Need pcap-lib-dir]) ;; yes) ;; *) pcap_lib_dir="$withval" ;; esac]) dnl extra argument: --with-pcap-include-dir=DIR pcap_include_dir= AC_ARG_WITH(pcap-include-dir, [AS_HELP_STRING([--with-pcap-include-dir=DIR], [directory in which to look for pcap include files])], [case "$withval" in no) AC_MSG_ERROR([Need pcap-include-dir]) ;; yes) ;; *) pcap_include_dir="$withval" ;; esac]) smart_try_dir="$pcap_lib_dir" FR_SMART_CHECK_LIB(pcap, pcap_open_live) if test "x$ac_cv_lib_pcap_pcap_open_live" != "xyes"; then AC_MSG_WARN([pcap library not found, silently disabling the RADIUS sniffer, and ARP listener. Use --with-pcap-lib-dir=.]) else AC_CHECK_FUNCS(\ pcap_fopen_offline \ pcap_dump_fopen \ pcap_create \ pcap_activate ) PCAP_LIBS="${smart_lib}" PCAP_LDFLAGS="${smart_ldflags}" fi dnl Set by FR_SMART_CHECK_LIB LIBS="${old_LIBS}" dnl Check for collectdclient dnl extra argument: --with-collectdclient-lib-dir=DIR collectdclient_lib_dir= AC_ARG_WITH(collectdclient-lib-dir, [AS_HELP_STRING([--with-collectdclient-lib-dir=DIR], [directory in which to look for collectdclient library files])], [case "$withval" in no) AC_MSG_ERROR([Need collectdclient-lib-dir]) ;; yes) ;; *) collectdclient_lib_dir="$withval" ;; esac]) dnl extra argument: --with-collectdclient-include-dir=DIR collectdclient_include_dir= AC_ARG_WITH(collectdclient-include-dir, [AS_HELP_STRING([--with-collectdclient-include-dir=DIR], [directory in which to look for collectdclient include files])], [case "$withval" in no) AC_MSG_ERROR([Need collectdclient-include-dir]) ;; yes) ;; *) collectdclient_include_dir="$withval" ;; esac]) smart_try_dir="$collectdclient_lib_dir" FR_SMART_CHECK_LIB(collectdclient, lcc_connect) if test "x$ac_cv_lib_collectdclient_lcc_connect" != "xyes"; then AC_MSG_WARN([collectdclient library not found. Use --with-collectdclient-lib-dir=.]) else COLLECTDC_LIBS="${smart_lib}" COLLECTDC_LDFLAGS="${smart_ldflags}" fi dnl Set by FR_SMART_CHECKLIB LIBS="${old_LIBS}" dnl Check for cap dnl extra argument: --with-cap-lib-dir=DIR cap_lib_dir= AC_ARG_WITH(cap-lib-dir, [AS_HELP_STRING([--with-cap-lib-dir=DIR], [directory in which to look for cap library files])], [case "$withval" in no) AC_MSG_ERROR([Need cap-lib-dir]) ;; yes) ;; *) cap_lib_dir="$withval" ;; esac]) dnl extra argument: --with-cap-include-dir=DIR cap_include_dir= AC_ARG_WITH(cap-include-dir, [AS_HELP_STRING([--with-cap-include-dir=DIR], [directory in which to look for cap include files])], [case "$withval" in no) AC_MSG_ERROR([Need cap-include-dir]) ;; yes) ;; *) cap_include_dir="$withval" ;; esac]) smart_try_dir="$cap_lib_dir" FR_SMART_CHECK_LIB(cap, cap_get_proc) if test "x$ac_cv_lib_cap_cap_get_proc" != "xyes"; then AC_MSG_WARN([cap library not found, debugger checks will not be enabled. Use --with-cap-lib-dir=.]) else AC_DEFINE(HAVE_LIBCAP, 1, [Define to 1 if you have the `cap' library (-lcap).] ) HAVE_LIBCAP=1 fi dnl # dnl # Check for libreadline dnl # VL_LIB_READLINE dnl # dnl # Checks for systemd dnl # dnl # extra argument: --with-systemd dnl # AC_ARG_WITH([systemd], AS_HELP_STRING([--with-systemd], [add systemd support, if available (default=no)]), [ case "$withval" in no) WITH_SYSTEMD=no ;; *) WITH_SYSTEMD=yes esac ], [WITH_SYSTEMD=no]) dnl # dnl # extra argument: --systemd-lib-dir=dir dnl # systemd_lib_dir= AC_ARG_WITH(systemd-lib-dir, [AS_HELP_STRING([--with-systemd-lib-dir=DIR], [directory to look for systemd library files])], [ case "$withval" in *) systemd_lib_dir="$withval" ;; esac ] ) dnl # dnl # extra argument: --with-systemd-includes=dir dnl # systemd_include_dir= AC_ARG_WITH(systemd-include-dir, [AS_HELP_STRING([--with-systemd-include-dir=DIR], [directory to look for systemd include files])], [ case "$withval" in *) systemd_include_dir="$withval" ;; esac ] ) if test "x$WITH_SYSTEMD" = xyes; then smart_try_dir="$systemd_lib_dir" FR_SMART_CHECK_LIB(systemd, sd_notify) if test "x$ac_cv_lib_systemd_sd_notify" != "xyes"; then AC_MSG_WARN([systemd library not found. Use --with-systemd-lib-dir=.]) else AC_DEFINE([HAVE_SYSTEMD], [1], [Define to 1 if you have the `systemd' library (-lsystemd).] ) HAVE_SYSTEMD=1 SYSTEMD_LIBS="${smart_lib}" SYSTEMD_LDFLAGS="${smart_ldflags}" fi dnl Set by FR_SMART_CHECKLIB LIBS="${old_LIBS}" fi if test "x$HAVE_SYSTEMD" = x; then AC_MSG_NOTICE([skipping test for systemd watchdog]) else smart_try_dir="$systemd_lib_dir" FR_SMART_CHECK_LIB(systemd, sd_watchdog_enabled) if test "x$ac_cv_lib_systemd_sd_watchdog_enabled" != "xyes"; then AC_MSG_WARN([systemd watchdog is only available from systemd 209.]) else AC_DEFINE([HAVE_SYSTEMD_WATCHDOG], [1], [Define to 1 if you have watchdog support in the `systemd' library (-lsystemd).] ) fi dnl Set by FR_SMART_CHECKLIB LIBS="${old_LIBS}" fi dnl # dnl # Check for the systemd headers dnl # if test "x$WITH_SYSTEMD" != xyes || test "x$SYSTEMD_LIBS" = x; then AC_MSG_NOTICE([skipping test for systemd/sd-daemon.h.]) else smart_try_dir="$systemd_include_dir" FR_SMART_CHECK_INCLUDE([systemd/sd-daemon.h]) if test "x$ac_cv_header_systemd_sdmdaemon_h" = "xyes"; then AC_DEFINE(HAVE_SYSTEMD_SD_DAEMON_H, 1, [Define to 1 if you have the header file.]) AC_SUBST(SYSTEMD_LIBS) AC_SUBST(SYSTEMD_LDFLAGS) else AC_MSG_WARN([systemd headers not found. Use --with-systemd-include-dir=.]) fi fi dnl ############################################################# dnl # dnl # 3. Checks for header files dnl # dnl ############################################################# dnl # dnl # Check for talloc header files dnl # smart_try_dir="$talloc_include_dir" FR_SMART_CHECK_INCLUDE([talloc.h]) if test "x$ac_cv_header_talloc_h" != "xyes"; then AC_MSG_WARN([talloc headers not found. Use --with-talloc-include-dir=.]) AC_MSG_ERROR([FreeRADIUS requires libtalloc]) fi dnl # dnl # Interix requires us to set -D_ALL_SOURCE, otherwise dnl # getopt will be #included, but won't link. dnl # dnl # On the other hand, it's 20222. Interix has likely been dead for a decade. :( dnl # case "$host" in *-interix*) CFLAGS="$CFLAGS -D_ALL_SOURCE" ;; *-darwin*) AC_DEFINE([__APPLE_USE_RFC_3542], 1, [Force OSX >= 10.7 Lion to use RFC2292 IPv6 socket options]) ;; esac AC_HEADER_DIRENT AC_HEADER_STDC AC_HEADER_TIME AC_HEADER_SYS_WAIT AC_CHECK_HEADERS( \ arpa/inet.h \ crypt.h \ dlfcn.h \ errno.h \ fcntl.h \ features.h \ fnmatch.h \ getopt.h \ glob.h \ grp.h \ inttypes.h \ limits.h \ linux/if_packet.h \ malloc.h \ netdb.h \ netinet/in.h \ prot.h \ pwd.h \ resource.h \ semaphore.h \ sia.h \ siad.h \ signal.h \ stdatomic.h \ stdalign.h \ stdbool.h \ stddef.h \ stdint.h \ stdio.h \ sys/event.h \ sys/fcntl.h \ sys/prctl.h \ sys/procctl.h \ sys/ptrace.h \ sys/resource.h \ sys/security.h \ sys/select.h \ sys/socket.h \ sys/time.h \ sys/types.h \ sys/un.h \ sys/wait.h \ syslog.h \ unistd.h \ utime.h \ utmp.h \ utmpx.h \ winsock.h ) dnl # dnl # FreeBSD requires sys/socket.h before net/if.h dnl # AC_CHECK_HEADERS(net/if.h, [], [], [ #ifdef HAVE_SYS_SOCKET_H # include #endif ] ) dnl # dnl # other checks which require headers dnl # if test "x$ac_cv_header_sys_security_h" = "xyes" && test "x$ac_cv_header_prot_h" = "xyes" then AC_DEFINE(OSFC2, [], [define if you have OSFC2 authentication]) fi if test "x$ac_cv_header_sia_h" = "xyes" && test "x$ac_cv_header_siad_h" = "xyes" then AC_DEFINE(OSFSIA, [], [define if you have OSFSIA authentication]) fi dnl # dnl # Were we told to use OpenSSL, if we were and we find an error, call AC_MSG_FAILURE and exit dnl # if test "x$WITH_OPENSSL" = xyes; then OLD_LIBS="$LIBS" dnl # dnl # Apparently OpenSSL will attempt to build with kerberos if we don't pass this?! dnl # CFLAGS="$CFLAGS -DOPENSSL_NO_KRB5" dnl # dnl # Check we can link to libcrypto and libssl dnl # smart_try_dir="$openssl_lib_dir" FR_SMART_CHECK_LIB(crypto, DH_new) if test "x$ac_cv_lib_crypto_DH_new" = "xyes"; then AC_DEFINE(HAVE_LIBCRYPTO, 1, [Define to 1 if you have the `crypto' library (-lcrypto).]) OPENSSL_LIBS="$smart_lib" OPENSSL_LDFLAGS="$smart_ldflags" FR_SMART_CHECK_LIB(ssl, SSL_new) if test "x$ac_cv_lib_ssl_SSL_new" != "xyes"; then AC_MSG_FAILURE([failed linking to libssl. Use --with-openssl-lib-dir=, or --with-openssl=no (builds without OpenSSL)]) else AC_DEFINE(HAVE_LIBSSL, 1, [Define to 1 if you have the `ssl' library (-lssl).]) OPENSSL_LIBS="$OPENSSL_LIBS $smart_lib" if test "$OPENSSL_LDFLAGS" != "$smart_ldflags"; then AC_MSG_FAILURE(["inconsistent LDFLAGS between -lssl '$smart_ldflags' and -lcrypto '$OPENSSL_LDFLAGS'"]) fi fi else AC_MSG_FAILURE([failed linking to libcrypto. Use --with-openssl-lib-dir=, or --with-openssl=no (builds without OpenSSL)]) fi smart_try_dir="$openssl_include_dir" FR_SMART_CHECK_INCLUDE(openssl/ssl.h) if test "x$ac_cv_header_openssl_ssl_h" = "xyes"; then AC_DEFINE(HAVE_OPENSSL_SSL_H, 1, [Define to 1 if you have the header file.]) AC_CHECK_HEADERS( \ openssl/asn1.h \ openssl/conf.h \ openssl/crypto.h \ openssl/err.h \ openssl/evp.h \ openssl/hmac.h \ openssl/md5.h \ openssl/md4.h \ openssl/rand.h \ openssl/sha.h \ openssl/ssl.h \ openssl/ocsp.h \ openssl/engine.h, [ OPENSSL_CPPFLAGS="$smart_include" ], [ AC_MSG_FAILURE([failed locating OpenSSL headers. Use --with-openssl-include-dir=, or --with-openssl=no (builds without OpenSSL)]) ] ) AC_MSG_CHECKING([for OpenSSL version >= 1.0.2]) AC_EGREP_CPP(yes, [#include #if (OPENSSL_VERSION_NUMBER >= 0x10002000L) yes #endif ], [ AC_MSG_RESULT(yes) ], [ AC_MSG_RESULT(no) AC_MSG_FAILURE([OpenSSL version too old]) ] ) dnl # dnl # CPPFLAGS are passed to the compiler first, so we use dnl # them to ensure things like --sysroot don't override the dnl # library location we discovered previously. dnl # old_CPPFLAGS="$CPPFLAGS" CPPFLAGS="$OPENSSL_CPPFLAGS $CPPFLAGS" dnl # dnl # Now check that the header versions match the library dnl # AC_MSG_CHECKING([OpenSSL library and header version consistency]) AC_RUN_IFELSE( [AC_LANG_PROGRAM( [[ #include #include #include ]], [[ printf("library: %lx header: %lx... ", (unsigned long) SSLeay(), (unsigned long) OPENSSL_VERSION_NUMBER); if (SSLeay() == OPENSSL_VERSION_NUMBER) { return 0; } else { return 1; } ]] )], [ AC_MSG_RESULT(yes) ], [ AC_MSG_RESULT(no) AC_MSG_FAILURE([OpenSSL library version does not match header version]) ], [ AC_MSG_RESULT([cross-compiling (assuming yes)]) ] ) dnl # dnl # Check if the new HMAC_CTX interface is defined dnl # AC_CHECK_FUNCS( \ SSL_get_client_random \ SSL_get_server_random \ SSL_SESSION_get_master_key \ HMAC_CTX_new \ HMAC_CTX_free \ ASN1_STRING_get0_data \ CONF_modules_load_file \ CRYPTO_set_id_callback \ CRYPTO_set_locking_callback ) CPPFLAGS="$old_CPPFLAGS" fi LIBS="$OLD_LIBS" AC_SUBST(OPENSSL_LIBS) AC_SUBST(OPENSSL_LDFLAGS) AC_SUBST(OPENSSL_CPPFLAGS) export OPENSSL_LIBS OPENSSL_LDFLAGS OPENSSL_CPPFLAGS fi dnl # dnl # Check the pcap includes for the RADIUS sniffer. dnl # if test "x$PCAP_LIBS" = x; then AC_MSG_NOTICE([skipping test for pcap.h.]) else dnl # dnl # Check for pcap header files dnl # smart_try_dir="$pcap_include_dir" FR_SMART_CHECK_INCLUDE([pcap.h]) if test "x$ac_cv_header_pcap_h" = "xyes" && test "x$ac_cv_lib_pcap_pcap_open_live" = "xyes"; then AC_DEFINE(HAVE_LIBPCAP, 1, [Define to 1 if you have the `pcap' library (-lpcap) and header file .]) AC_SUBST(PCAP_LIBS) AC_SUBST(PCAP_LDFLAGS) else AC_MSG_WARN([pcap headers not found, silently disabling the RADIUS sniffer, and ARP listener. Use --with-pcap-include-dir=.]) fi fi dnl Check for collectd-client if test "x$COLLECTDC_LIBS" = x; then AC_MSG_NOTICE([skipping test for collectd/client.h.]) else dnl # dnl # Check for collectd-client header files dnl # smart_try_dir="$collectdclient_include_dir" FR_SMART_CHECK_INCLUDE([collectd/client.h]) if test "x$ac_cv_header_collectd_client_h" = "xyes"; then AC_DEFINE(HAVE_COLLECTDC_H, 1, [Define to 1 if you have the `collectdclient' library (-lcollectdclient).]) AC_SUBST(COLLECTDC_LIBS) AC_SUBST(COLLECTDC_LDFLAGS) else AC_MSG_WARN([collectdclient headers not found. Use --with-collectdclient-include-dir=.]) fi fi dnl # dnl # Check the CAP includes for debugger checks dnl # if test "x$HAVE_LIBCAP" = x; then AC_MSG_NOTICE([skipping test for cap.h.]) else dnl # dnl # Check for CAP header files dnl # smart_try_dir="$cap_include_dir" FR_SMART_CHECK_INCLUDE([sys/capability.h]) if test "x$ac_cv_header_sys_capability_h" = "xyes"; then AC_DEFINE(HAVE_CAPABILITY_H, 1, [Define to 1 if you have the header file.]) else AC_MSG_WARN([cap headers not found, will not perform debugger checks. Use --with-cap-include-dir=.]) fi fi dnl ############################################################# dnl # dnl # 4. Checks for typedefs dnl # dnl ############################################################# dnl # dnl # Ensure that these are defined dnl # AC_TYPE_OFF_T AC_TYPE_PID_T AC_TYPE_SIZE_T AC_TYPE_UID_T dnl # dnl # Check for socklen_t dnl # FR_CHECK_TYPE_INCLUDE( [ #ifdef HAVE_SYS_TYPES_H # include #endif #ifdef HAVE_SYS_SOCKET_H # include #endif ], socklen_t, int, [socklen_t is generally 'int' on systems which don't use it] ) dnl # dnl # Check for uint8_t dnl # FR_CHECK_TYPE_INCLUDE( [ #ifdef HAVE_INTTYPES_H # include #endif #ifdef HAVE_STDINT_H # include #endif ], uint8_t, unsigned char, [uint8_t should be the canonical 'octet' for network traffic] ) dnl # dnl # Check for uint16_t dnl # FR_CHECK_TYPE_INCLUDE( [ #ifdef HAVE_INTTYPES_H # include #endif #ifdef HAVE_STDINT_H # include #endif ], uint16_t, unsigned short, [uint16_t should be the canonical '2 octets' for network traffic] ) dnl # dnl # Check for uint32_t dnl # FR_CHECK_TYPE_INCLUDE( [ #ifdef HAVE_INTTYPES_H # include #endif #ifdef HAVE_STDINT_H # include #endif ], uint32_t, unsigned int, [uint32_t should be the canonical 'network integer'] ) dnl # dnl # Check for uint64_t dnl # FR_CHECK_TYPE_INCLUDE( [ #ifdef HAVE_INTTYPES_H # include #endif #ifdef HAVE_STDINT_H # include #endif ], uint64_t, unsigned long long, [uint64_t is required for larger counters] ) dnl # dnl # Check for __uint128_t (compiler builtin) dnl # AC_CHECK_TYPE(__uint128_t, AC_DEFINE(HAVE___UINT128_T, 1, [compiler specific 128 bit unsigned integer]), [], []) dnl # dnl # Check for uint128_t (fictitious future data type) dnl # AC_CHECK_TYPE(uint128_t, AC_DEFINE(HAVE_UINT128_T, 1, [128 bit unsigned integer]), [], [ #ifdef HAVE_INTTYPES_H # include #endif #ifdef HAVE_STDINT_H # include #endif ] ) AC_CHECK_TYPE(struct in6_addr, AC_DEFINE(HAVE_STRUCT_IN6_ADDR, 1, [IPv6 address structure]), [], [ #ifdef HAVE_NETINET_IN_H # include #endif ] ) AC_CHECK_TYPE(struct sockaddr_storage, AC_DEFINE(HAVE_STRUCT_SOCKADDR_STORAGE, 1, [Generic socket addresses]), [], [ #ifdef HAVE_NETINET_IN_H # include #endif #ifdef HAVE_SYS_SOCKET_H # include #endif ]) AC_CHECK_TYPE(struct sockaddr_in6, AC_DEFINE(HAVE_STRUCT_SOCKADDR_IN6, 1, [IPv6 socket addresses]), [], [ #ifdef HAVE_NETINET_IN_H # include #endif ]) AC_CHECK_TYPE(struct addrinfo, AC_DEFINE(HAVE_STRUCT_ADDRINFO, 1, [Generic DNS lookups]), [], [ #ifdef HAVE_SYS_TYPES_H # include #endif #ifdef HAVE_SYS_SOCKET_H # include #endif #ifdef HAVE_NETDB_H # include #endif ] ) dnl # dnl # Check for sig_t dnl # dnl # FR_CHECK_TYPE_INCLUDE doesn't work for callbacks as it doesn't produce typedefs dnl # AC_MSG_CHECKING([if sig_t is defined]) AC_LINK_IFELSE( [AC_LANG_PROGRAM( [[ #ifdef HAVE_SIGNAL_H # include #endif ]], [[ sig_t func; return 0; ]] )], [ AC_MSG_RESULT(yes) AC_DEFINE(HAVE_SIG_T, 1, [Define if the type sig_t is defined by signal.h]) ], [ AC_MSG_RESULT(no) ] ) dnl ############################################################# dnl # dnl # 5. Checks for structures and functions dnl # dnl ############################################################# AC_CHECK_FUNCS( \ bindat \ clock_gettime \ closefrom \ ctime_r \ dladdr \ fcntl \ fopencookie \ funopen \ getaddrinfo \ getnameinfo \ getopt_long \ getpeereid \ getresuid \ gettimeofday \ getusershell \ gmtime_r \ if_indextoname \ inet_aton \ inet_ntop \ inet_pton \ initgroups \ kqueue \ localtime_r \ mallopt \ mkdirat \ openat \ pthread_sigmask \ setlinebuf \ setresuid \ setsid \ setuid \ setvbuf \ sigaction \ sigprocmask \ snprintf \ strcasecmp \ strlcat \ strlcpy \ strncasecmp \ strsep \ strsignal \ unlinkat \ vdprintf \ vsnprintf ) dnl # dnl # Check if we have utmpx.h dnl # if so, check if struct utmpx has entry ut_xtime dnl # if not, set it to define ut_xtime = ut_tv.tv_sec dnl # if test "x$ac_cv_header_utmpx_h" = "xyes"; then FR_CHECK_STRUCT_HAS_MEMBER([#include ], [struct utmpx], ut_xtime) if test "x$ac_cv_type_struct_utmpx_has_ut_xtime" = "x"; then AC_DEFINE(ut_xtime, ut_tv.tv_sec, [define to something if you don't have ut_xtime in struct utmpx]) fi fi dnl # dnl # struct ip_pktinfo dnl # FR_CHECK_STRUCT_HAS_MEMBER([#include ], [struct in_pktinfo], ipi_addr) if test "x$ac_cv_type_struct_in_pktinfo_has_ipi_addr" = "xyes"; then AC_DEFINE(HAVE_IP_PKTINFO, [], [define if you have IP_PKTINFO (Linux)]) fi dnl # dnl # struct in6_pktinfo dnl # FR_CHECK_STRUCT_HAS_MEMBER([#include ], [struct in6_pktinfo], ipi6_addr) if test "x$ac_cv_type_struct_in6_pktinfo_has_ipi6_addr" = "xyes"; then AC_DEFINE(HAVE_IN6_PKTINFO, [], [define if you have IN6_PKTINFO (Linux)]) fi dnl # dnl # Check for htonll and htonlll dnl # AC_MSG_CHECKING([if htonll is defined]) AC_LINK_IFELSE( [AC_LANG_PROGRAM( [[ #include #include ]], [[ return htonll(0); ]] )], [ AC_MSG_RESULT(yes) AC_DEFINE(HAVE_HTONLL, 1, [Define if the function (or macro) htonll exists.]) ], [ AC_MSG_RESULT(no) ] ) AC_MSG_CHECKING([if htonlll is defined]) AC_LINK_IFELSE( [AC_LANG_PROGRAM( [[ #include #include ]], [[ return htonlll(0); ]] )], [ AC_MSG_RESULT(yes) AC_DEFINE(HAVE_HTONLLL, 1, [Define if the function (or macro) htonlll exists.]) ], [ AC_MSG_RESULT(no) ] ) dnl ############################################################# dnl # dnl # 6. Checks for compiler characteristics dnl # dnl ############################################################# dnl # dnl # Ensure that these are defined dnl # AC_C_CONST dnl # dnl # See if this is OS/2 dnl # AC_MSG_CHECKING([type of OS]) OS=`uname -s` AC_MSG_RESULT($OS) if test "$OS" = "OS/2"; then LIBPREFIX= else LIBPREFIX=lib fi AC_SUBST(LIBPREFIX) if test "x$developer" = "xyes"; then AC_MSG_NOTICE([Setting additional developer CFLAGS]) dnl # dnl # Tell the compiler to parse doxygen documentation and verify it against function and variable declarations dnl # AX_CC_WDOCUMENTATION_FLAG if test "x$ax_cv_cc_wdocumentation_flag" = "xyes"; then devcflags="-Wdocumentation" AC_DEFINE([HAVE_WDOCUMENTATION],1,[Define if the compiler supports -Wdocumentation]) fi dnl # dnl # If we have -Weverything, it really means *everything* unlike -Wall dnl # It's so verbose we need to turn off warnings which aren't useful. dnl # dnl # -Wno-cast-function-type-strict -Wno-format-pedantic -Wno-declaration-after-statement -Wno-vla -Wno-used-but-marked-unused -Wno-c2x-extensions -Wno-assign-enum -Wno-unused-macros -Wno-disabled-macro-expansion -Wno-class-varargs -Wno-incompatible-function-pointer-types-strict -Wno-bad-function-cast -Wcompound-token-split-by-macro AX_CC_WEVERYTHING_FLAG if test "x$ax_cv_cc_weverything_flag" = "xyes"; then devcflags="$devcflags -W -Weverything -Wformat=2 -Wno-missing-field-initializers -Wno-date-time -Wno-padded -Wno-gnu-zero-variadic-macro-arguments -Wno-shorten-64-to-32 -Wno-sign-conversion -Wno-conversion -Wno-switch-enum -Wno-gnu-statement-expression -Wno-extended-offsetof -Wno-cast-align -Wno-documentation-unknown-command -Wno-covered-switch-default -Wno-packed $verify_ptr" else if test "x$GCC" = "xyes"; then devcflags="$devcflags -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -Wformat-y2k -Wno-format-extra-args -Wno-format-zero-length -Wno-cast-align -Wformat-nonliteral -Wformat-security -Wformat=2 $verify_ptr" INSTALLSTRIP="" fi fi dnl # dnl # Can't use mutliple -fsanitize flags, so we need to combine dnl # the values into one. dnl # fsanitizeflags= dnl # dnl # If running with clang, add in FUZZER dnl # if test "x$fuzzer" = "xyes" && test "x$ax_cv_cc_clang" = "xyes"; then dnl # dnl # -fsanitize=fuzzer - Build with fuzzer support dnl # fsanitizeflags="$fsanitizeflags,fuzzer-no-link" fi dnl # dnl # Add in ASAN dnl # if test "x$address_sanitizer" = "xyes"; then dnl # dnl # -fsanitize=address - Build with address sanitizer support dnl # -fno-omit-frame-pointer - Always keep the frame pointer in a register dnl # -fno-optimize-sibling-calls - Don't optimize away tail recursion. dnl # devcflags="$devcflags -fno-omit-frame-pointer -fno-optimize-sibling-calls" AX_CC_SANITZE_ADDRESS_USE_AFTER_SCOPE_FLAG if test "x$ax_cv_cc_sanitize_address_use_after_scope" = "xyes"; then devcflags="$devcflags -fsanitize-address-use-after-scope" fi AC_CHECK_HEADERS(sanitizer/lsan_interface.h) fsanitizeflags="$fsanitizeflags,address" fi dnl # dnl # Add in LSAN dnl # if test "x$leak_sanitizer" = "xyes"; then dnl # dnl # -fsanitize=leak - Build with lsan support dnl # fsanitizeflags="$fsanitizeflags,leak" fi dnl # dnl # Add in TSAN dnl # if test "x$thread_sanitizer" = "xyes"; then dnl # dnl # -fsanitize=thread - Build with tsan support dnl # fsanitizeflags="$fsanitizeflags,thread" fi dnl # dnl # Add in UBSAN dnl # if test "x$undefined_behaviour_sanitizer" = "xyes"; then dnl # dnl # -fsanitize=undefined - Build with ubsan support dnl # -fno-omit-frame-pointer - Always keep the frame pointer in a register dnl # devcflags="$devcflags -fno-sanitize-recover=undefined -fno-omit-frame-pointer" devldflags="$devldflags -fno-sanitize-recover=undefined" fsanitizeflags="$fsanitizeflags,undefined" fi if test "x$fsanitizeflags" != "x"; then fsanitizeflags="$(echo $fsanitizeflags | sed 's/^,*//')" devcflags="-fsanitize=$fsanitizeflags $devcflags" devldflags="-fsanitize=$fsanitizeflags $devldflags" fi dnl # dnl # Clean the flags up dnl # devcflags="$(echo $devcflags | sed -e 's/\\t//g;s/ //g')" devldflags="$(echo $devldflags | sed -e 's/\\t//g;s/ //g')" AC_MSG_NOTICE([Developer CFLAGS are "$devcflags"]) AC_MSG_NOTICE([Developer LDFLAGS are "$devldflags"]) dnl # dnl # Enable experimental modules (we want to know if code changes breaks one of them) dnl # if test "x$EXPERIMENTAL" != "xno"; then AC_MSG_NOTICE([is developer build, enabling experimental modules implicitly, disable with --without-experimental-modules]) EXPERIMENTAL=yes fi else devcflags="" devldflags="" CFLAGS="$CFLAGS -DNDEBUG" INSTALLSTRIP="" fi dnl # dnl # May of been set outside of this configure script dnl # AC_MSG_CHECKING([if building with -DNDEBUG]) if echo "$CFLAGS" | grep '\-DNDEBUG' > /dev/null; then AC_MSG_RESULT([yes]) AC_DEFINE([WITH_NDEBUG], [1], [define if the server was built with -DNDEBUG]) else AC_MSG_RESULT([no]) fi export EXPERIMENTAL dnl # dnl # append the current git hash onto the version string dnl # if test -d $srcdir/.git -a "x$GIT" = "xyes"; then RADIUSD_VERSION_COMMIT=`git log --pretty=format:'%h' -n 1 | cut -c1-9` AC_DEFINE_UNQUOTED([RADIUSD_VERSION_COMMIT],[${RADIUSD_VERSION_COMMIT}],[Commit HEAD at time of configuring]) fi dnl # dnl # check for some compiler features dnl # FR_TLS FR_HAVE_BUILTIN_CHOOSE_EXPR FR_HAVE_BUILTIN_TYPES_COMPATIBLE_P FR_HAVE_BUILTIN_BSWAP64 FR_HAVE_BOUNDED_ATTRIBUTE dnl ############################################################# dnl # dnl # 7. Checks for library functions dnl # dnl ############################################################# dnl # dnl # Check for talloc_set_memlimit dnl # This was only included in version 2.0.8 dnl # AC_CHECK_LIB(talloc, talloc_set_memlimit, [ AC_DEFINE(HAVE_TALLOC_SET_MEMLIMIT, 1, [Define to 1 if you have the function talloc_set_memlimit.]) ] ) dnl # dnl # Check for libcrypt dnl # We use crypt(3) which may be in libc, or in libcrypt (eg FreeBSD) dnl # AC_CHECK_LIB(crypt, crypt, CRYPTLIB="-lcrypt" ) if test "$CRYPTLIB" != ""; then AC_DEFINE(HAVE_CRYPT, [], [Do we have the crypt function]) else AC_CHECK_FUNC(crypt, AC_DEFINE(HAVE_CRYPT, [], [Do we have the crypt function])) fi dnl crypt_r is the GNU thread-safe version AC_CHECK_LIB(crypt, crypt_r, AC_DEFINE(HAVE_CRYPT_R, [], [Do we have the crypt_r function])) dnl Check for libcipher AC_CHECK_LIB(cipher, setkey, CRYPTLIB="${CRYPTLIB} -lcipher" ) AC_SUBST(CRYPTLIB) dnl # dnl # Check for libexecinfo support, on some systems this is built into libc dnl # on others it's a separate library. dnl # dnl extra argument: --with-execinfo-lib-dir execinfo_lib_dir= AC_ARG_WITH(execinfo-lib-dir, [AS_HELP_STRING([--with-execinfo-lib-dir=DIR], [directory in which to look for execinfo library files])], [ case "$withval" in no) AC_MSG_ERROR([Need execinfo-lib-dir]) ;; yes) ;; *) execinfo_lib_dir="$withval" ;; esac ] ) dnl extra argument: --with-execinfo-include-dir execinfo_include_dir= AC_ARG_WITH(execinfo-include-dir, [AS_HELP_STRING([--with-execinfo-include-dir=DIR], [directory in which to look for execinfo include files])], [ case "$withval" in no) AC_MSG_ERROR([Need execinfo-include-dir]) ;; yes) ;; *) execinfo_include_dir="$withval" ;; esac ] ) dnl # dnl # Look for execinfo.h and symbols dnl # smart_try_dir=$execinfo_include_dir FR_SMART_CHECK_INCLUDE(execinfo.h) if test "x$ac_cv_header_execinfo_h" = "xyes"; then smart_try_dir=$execinfo_lib_dir FR_SMART_CHECK_LIB(execinfo, backtrace_symbols) if test "x$ac_cv_lib_execinfo_backtrace_symbols" != "xyes"; then dnl # Might be provided as part of libc AC_MSG_CHECKING([if execinfo provided as part of libc]) AC_LINK_IFELSE([AC_LANG_PROGRAM([[ #include ]], [[ void *sym[1]; backtrace_symbols(&sym, sizeof(sym)) ]])],[ AC_MSG_RESULT(yes) ac_cv_lib_execinfo_backtrace_symbols="yes" ],[ AC_MSG_RESULT(no) ]) fi if test "x$ac_cv_lib_execinfo_backtrace_symbols" = "xyes"; then AC_DEFINE(HAVE_EXECINFO, [1], [define this if we have and symbols]) fi fi dnl # dnl # Check for regular expression support. dnl # dnl extra argument: --with-pcre PCRE=yes AC_ARG_WITH(pcre, [AS_HELP_STRING([--with-pcre], [use libpcre (if available). (default=yes)])], [ case "$withval" in no) PCRE=no ;; yes) PCRE=yes ;; esac ] ) dnl extra argument: --with-pcre-lib-dir pcre_lib_dir= AC_ARG_WITH(pcre-lib-dir, [AS_HELP_STRING([--with-pcre-lib-dir=DIR], [directory in which to look for pcre library files])], [ case "$withval" in no) AC_MSG_ERROR(Need pcre-lib-dir) ;; yes) ;; *) pcre_lib_dir="$withval" ;; esac ] ) dnl extra argument: --with-pcre-include-dir pcre_include_dir= AC_ARG_WITH(pcre-include-dir, [AS_HELP_STRING([--with-pcre-include-dir=DIR], [directory in which to look for pcre include files])], [ case "$withval" in no) AC_MSG_ERROR(Need pcre-include-dir) ;; yes) ;; *) pcre_include_dir="$withval" ;; esac ] ) dnl extra argument: --with-regex REGEX= AC_ARG_WITH(regex, [AS_HELP_STRING([--with-regex], [Whether to build with regular expressions (default=yes)])], [ case "$withval" in no) REGEX=no ;; *) ;; esac ] ) dnl # dnl # First look for PCRE dnl # if test "x$REGEX" != "xno" && test "x$PCRE" != "xno"; then smart_try_dir=$pcre_include_dir FR_SMART_CHECK_INCLUDE(pcre.h) if test "x$ac_cv_header_pcre_h" = "xyes"; then smart_try_dir=$pcre_lib_dir FR_SMART_CHECK_LIB(pcre, pcre_compile) if test "x$ac_cv_lib_pcre_pcre_compile" = "xyes"; then REGEX=yes AC_DEFINE(HAVE_PCRE, [1], [define this if we have libpcre]) AC_DEFINE(HAVE_BINSAFE_REGEX, 1, [Define if we have a binary safe regular expression library]) fi fi fi dnl # dnl # If no PCRE, look for PCRE2 dnl # if test "x$REGEX" = "x" && test "x$PCRE" != "xno"; then smart_try_dir=$pcre_include_dir FR_SMART_CHECK_INCLUDE(pcre2.h,[#define PCRE2_CODE_UNIT_WIDTH (8)]) if test "x$ac_cv_header_pcre2_h" = "xyes"; then smart_try_dir=$pcre_lib_dir FR_SMART_CHECK_LIB(pcre2-8, pcre2_compile_8) if test "x$ac_cv_lib_pcre2_8_pcre2_compile_8" = "xyes"; then REGEX=yes AC_DEFINE(HAVE_PCRE2, [1], [define this if we have libpcre2]) AC_DEFINE(HAVE_BINSAFE_REGEX, 1, [Define if we have a binary safe regular expression library]) fi fi fi dnl # dnl # If no PCRE2 or PCRE, fallback to POSIX regular expressions dnl # if test "x$REGEX" = "x"; then smart_try_dir= FR_SMART_CHECK_INCLUDE(regex.h) if test "x$ac_cv_header_regex_h" = "xyes"; then REGEX=yes AC_MSG_CHECKING([for extended regular expressions]) AC_EGREP_CPP(yes, [ #include #ifdef REG_EXTENDED yes #endif ], [ AC_MSG_RESULT(yes) AC_DEFINE(HAVE_REG_EXTENDED, [1], [define this if we have REG_EXTENDED (from )]) ], [ AC_MSG_RESULT(no) ] ) dnl # dnl # Some platforms require the regex library to be linked explicitly dnl # AC_CHECK_LIB(regex, regcomp, [ LIBS="-lregex $LIBS" ] ) dnl # dnl # Check for some BSD extensions which allow normal regexes to be dnl # binary safe. dnl # AC_CHECK_FUNCS(\ regncomp \ regnexec ) if test x"$ac_cv_func_regncomp" = x"yes" && test x"$ac_cv_func_regnexec" = x"yes"; then AC_DEFINE(HAVE_BINSAFE_REGEX, 1, [Define if we have a binary safe regular expression library]) fi fi fi # # Some platforms require an explicit -latomic # AC_SEARCH_LIBS([__atomic_load_4], [atomic]) if test "x$REGEX" = "xyes"; then AC_DEFINE(HAVE_REGEX, 1, [Define if we have any regular expression library]) fi dnl # dnl # Check the style of gethostbyaddr, in order of preference dnl # GNU (_r eight args) dnl # AC_DEFINE(GNUSTYLE, [1], [GNU-Style get*byaddr_r]) dnl # dnl # SYSV (_r six args) dnl # AC_DEFINE(SYSVSTYLE, [2], [SYSV-Style get*byaddr_r]) dnl # dnl # BSD (three args, may not be thread safe) dnl # AC_DEFINE(BSDSTYLE, [3], [BSD-Style get*byaddr_r]) dnl # dnl # Tru64 has BSD version, but it is thread safe dnl # http://h30097.www3.hp.com/docs/base_doc/DOCUMENTATION/V51B_HTML/MAN/MAN3/1739____.HTM dnl # We need #stdio.h to define NULL on FreeBSD (at least) dnl # gethostbyaddrrstyle="" AC_MSG_CHECKING([gethostbyaddr_r() syntax]) case "$host" in *-freebsd*) dnl # dnl # With FreeBSD, check if there's a prototype for gethostbyaddr_r. dnl # Some versions (FreeBSD 5.1?) have a symbol but no prototype - so we dnl # override this test to BSDSTYLE. FreeBSD 6.2 and up have proper GNU dnl # style support. dnl # AC_CHECK_DECLS([gethostbyaddr_r], [], [ AC_DEFINE(GETHOSTBYADDRRSTYLE, BSDSTYLE, [style of gethostbyaddr_r functions ]) gethostbyaddrrstyle=BSD AC_MSG_WARN([FreeBSD overridden to BSD-style]) ], [ #ifdef HAVE_NETDB_H #include #endif ]) ;; esac if test "x$gethostbyaddrrstyle" = "x"; then AC_LINK_IFELSE([AC_LANG_PROGRAM([[ #include #include ]], [[ gethostbyaddr_r(NULL, 0, 0, NULL, NULL, 0, NULL, NULL) ]])],[ AC_DEFINE(GETHOSTBYADDRRSTYLE, GNUSTYLE, [style of gethostbyaddr_r functions ]) gethostbyaddrrstyle=GNU ],[]) fi if test "x$gethostbyaddrrstyle" = "x"; then AC_LINK_IFELSE([AC_LANG_PROGRAM([[ #include #include ]], [[ gethostbyaddr_r(NULL, 0, 0, NULL, NULL, 0, NULL) ]])],[ AC_DEFINE(GETHOSTBYADDRRSTYLE, SYSVSTYLE, [style of gethostbyaddr_r functions ]) gethostbyaddrrstyle=SYSV ],[]) fi if test "x$gethostbyaddrrstyle" = "x"; then AC_LINK_IFELSE([AC_LANG_PROGRAM([[ #include #include ]], [[ gethostbyaddr(NULL, 0, 0) ]])],[ AC_DEFINE(GETHOSTBYADDRRSTYLE, BSDSTYLE, [style of gethostbyaddr_r functions ]) gethostbyaddrrstyle=BSD ],[]) fi if test "x$gethostbyaddrrstyle" = "x"; then AC_MSG_RESULT([none! It must not exist, here.]) else AC_MSG_RESULT([${gethostbyaddrrstyle}-style]) fi if test "x$gethostbyaddrrstyle" = "xBSD"; then AC_MSG_WARN([ ****** BSD-style gethostbyaddr might NOT be thread-safe! ****** ]) fi dnl # dnl # Check the style of gethostbyname, in order of preference dnl # GNU (_r seven args) dnl # SYSV (_r five args) dnl # BSD (two args, may not be thread safe) dnl # Tru64 has BSD version, but it _is_ thread safe dnl # http://h30097.www3.hp.com/docs/base_doc/DOCUMENTATION/V51B_HTML/MAN/MAN3/1946____.HTM dnl # We need #stdio.h to define NULL on FreeBSD (at least) dnl # gethostbynamerstyle="" AC_MSG_CHECKING([gethostbyname_r() syntax]) AC_LINK_IFELSE([AC_LANG_PROGRAM([[ #include #include ]], [[ gethostbyname_r(NULL, NULL, NULL, 0, NULL, NULL) ]])],[ AC_DEFINE(GETHOSTBYNAMERSTYLE, GNUSTYLE, [style of gethostbyname_r functions ]) gethostbynamerstyle=GNU ],[]) if test "x$gethostbynamerstyle" = "x"; then AC_LINK_IFELSE([AC_LANG_PROGRAM([[ #include #include ]], [[ gethostbyname_r(NULL, NULL, NULL, 0, NULL) ]])],[ AC_DEFINE(GETHOSTBYNAMERSTYLE, SYSVSTYLE, [style of gethostbyname_r functions ]) gethostbynamerstyle=SYSV ],[]) fi if test "x$gethostbynamerstyle" = "x"; then AC_LINK_IFELSE([AC_LANG_PROGRAM([[ #include #include ]], [[ gethostbyname(NULL) ]])],[ AC_DEFINE(GETHOSTBYNAMERSTYLE, BSDSTYLE, [style of gethostbyname_r functions ]) gethostbynamerstyle=BSD ],[]) fi if test "x$gethostbynamerstyle" = "x"; then AC_MSG_RESULT([none! It must not exist, here.]) else AC_MSG_RESULT([${gethostbynamerstyle}-style]) fi if test "x$gethostbynamerstyle" = "xBSD"; then AC_MSG_WARN([ ****** BSD-style gethostbyname might NOT be thread-safe! ****** ]) fi dnl # dnl # Check for thread-safe getpwnam_r and getgrnam_r dnl # if test "x$ac_cv_header_pwd_h" = "xyes"; then AC_MSG_CHECKING([getpwnam_r]) AC_LINK_IFELSE([AC_LANG_PROGRAM([[ #include #include #include ]], [[ getpwnam_r(NULL, NULL, NULL, 0, NULL) ]])],[ AC_MSG_RESULT([yes]) AC_DEFINE(HAVE_GETPWNAM_R, 1, [Define to 1 if you have the getpwnam_r.] ) ],[ AC_MSG_RESULT(no) ]) fi if test "x$ac_cv_header_grp_h" = "xyes"; then AC_MSG_CHECKING([getgrnam_r]) AC_LINK_IFELSE([AC_LANG_PROGRAM([[ #include #include #include ]], [[ getgrnam_r(NULL, NULL, NULL, 0, NULL) ]])],[ AC_MSG_RESULT([yes]) AC_DEFINE(HAVE_GETGRNAM_R, 1, [Define to 1 if you have the getgrnam_r.] ) ],[ AC_MSG_RESULT(no) ]) fi dnl # dnl # Check for non-posix solaris ctime_r (extra buflen int arg) dnl # AC_DEFINE(POSIXSTYLE, [1], [Posix-Style ctime_r]) AC_DEFINE(SOLARISSTYLE, [2], [Solaris-Style ctime_r]) ctimerstyle="" AC_MSG_CHECKING([ctime_r() syntax]) AC_LINK_IFELSE([AC_LANG_PROGRAM([[ #include ]], [[ ctime_r(NULL, NULL, 0) ]])],[ AC_DEFINE(CTIMERSTYLE, SOLARISSTYLE, [style of ctime_r function]) ctimerstyle="SOLARIS" ],[]) if test "x$ctimerstyle" = "x"; then AC_LINK_IFELSE([AC_LANG_PROGRAM([[ #include ]], [[ ctime_r(NULL, NULL) ]])],[ AC_DEFINE(CTIMERSTYLE, POSIXSTYLE, [style of ctime_r function]) ctimerstyle="POSIX" ],[]) fi if test "x$ctimerstyle" = "x"; then AC_MSG_RESULT([none! It must not exist, here.]) else AC_MSG_RESULT([${ctimerstyle}-style]) fi AC_SUBST(HOSTINFO, $host) dnl ############################################################# dnl # dnl # 8. Checks for system services dnl # dnl ############################################################# dnl # dnl # Figure out where libtool is located, dnl # top_builddir=`pwd` export top_builddir AC_MSG_RESULT([top_builddir=$top_builddir]) dnl # AC_SUBST(top_builddir) dnl # dnl # import libtool stuff dnl # dnl ############################################################# dnl # dnl # Configure in any module directories. dnl # dnl ############################################################# dnl ############################################################ dnl # Remove any conflicting definitions if autoconf.h dnl # is being included by a module. dnl ############################################################# AH_BOTTOM([#include ]) dnl ############################################################ dnl # make modules by list dnl ############################################################# if test "x$EXPERIMENTAL" = "xyes"; then for foo in `ls -1 "${srcdir}"/src/modules | grep rlm_`; do MODULES="$MODULES $foo" done else dnl # dnl # make ONLY the stable modules dnl # for foo in `cat "${srcdir}"/src/modules/stable`; do MODULES="$MODULES $foo" done fi dnl ############################################################ dnl # Add autoconf subdirs, based on the module list we dnl # previously created. dnl ############################################################# mysubdirs="" for bar in $MODULES; do if test -f "${srcdir}"/src/modules/$bar/configure; then mysubdirs="$mysubdirs src/modules/$bar" fi done dnl # dnl # Don't change the variable name here. Autoconf goes bonkers dnl # if you do. dnl # AC_CONFIG_SUBDIRS($mysubdirs) AC_SUBST(MODULES) dnl # dnl # If reproducible builds are not enabled, disable dnl # -Wdate-time so the compiler doesn't croak. dnl # if test "x$ax_cv_cc_no_date_time_flag" = "xyes" && test "x$reproducible_builds" != "xyes"; then CFLAGS="-Wno-date-time $CFLAGS" fi dnl ############################################################# dnl # dnl # Add $devcflags, $devldflags and -Werror last, so they don't dnl # interfere with autoconf's test programs. dnl # dnl ############################################################# CFLAGS="$CFLAGS $devcflags" LDFLAGS="$LDFLAGS $devldflags" if test "x$werror" = "xyes"; then CFLAGS="-Werror $CFLAGS" fi dnl ############################################################# dnl # dnl # And finally, output the results. dnl # dnl ############################################################# AC_CONFIG_COMMANDS([stamp-h], [echo timestamp > src/include/stamp-h]) AC_CONFIG_COMMANDS([build-radpaths-h], [(cd ./src/include && /bin/sh ./build-radpaths-h)]) AC_CONFIG_COMMANDS([main-chmod], [(cd ./src/main && chmod +x checkrad radlast radtest)]) AC_CONFIG_COMMANDS([scripts-chmod], [(cd ./scripts && chmod +x rc.radiusd cron/radiusd.cron.daily cron/radiusd.cron.monthly cryptpasswd)]) dnl # dnl # Substitute whatever libraries we found to be necessary dnl # AC_SUBST(LIBS) AC_SUBST(INSTALLSTRIP) AC_SUBST(USE_SHARED_LIBS) USE_STATIC_LIBS="yes" AC_SUBST(USE_STATIC_LIBS) AC_SUBST(STATIC_MODULES) AC_SUBST(MANSKIP) AC_CONFIG_FILES([\ ./Make.inc \ ./src/include/build-radpaths-h \ ./src/main/radsniff.mk \ ./src/main/radlast.mk \ ./src/main/checkrad \ ./src/main/radlast \ ./src/main/radtest \ ./scripts/rc.radiusd \ ./scripts/cron/radiusd.cron.daily \ ./scripts/cron/radiusd.cron.monthly \ ./scripts/cryptpasswd \ ./raddb/radrelay.conf \ ./raddb/radiusd.conf ]) AC_OUTPUT FR_MODULE_REPORT freeradius-3.2.10+dfsg/doc/000077500000000000000000000000001522352605200154145ustar00rootroot00000000000000freeradius-3.2.10+dfsg/doc/.gitignore000066400000000000000000000000071522352605200174010ustar00rootroot00000000000000_build freeradius-3.2.10+dfsg/doc/ChangeLog000066400000000000000000000654351522352605200172030ustar00rootroot00000000000000FreeRADIUS 3.2.10 Wed 03 Jun 2026 12:00:00 UTC urgency=high Configuration changes Feature improvements Bug fixes * Correct bug where detail file reader would not read files. Patch from Bjørn Mork. Fixes #5870 FreeRADIUS 3.2.9 Mon 01 Jun 2026 12:00:00 UTC urgency=low Configuration changes * Add "protocol_error = yes" configuration to clients. If set, the server can return Protocol-Error responses to the client. * radclient can now suppress Message-Authenticator in Access-Request, when the input packet contains "Message-Authenticator !* ANY" Don't use this in production! * Set "suppress_secrets = true" by default. * Add "connect_fail_interval" to home_server configuration. If a connection fails, the server will wait this time before trying to connect again. * Add "certificate_fail_interval" to home_server configuration. If a connection succeeds but the home_server certificate is invalid, the server will wait this time before trying to connect again. * Add `update` section to home_server configuration. Status-Server packets can therefore be customized. * Add "cipher_suites" to tls{} configuration. See raddb/sites-available/tls. This is mainly used to set the cipher suites for TLS-PSK with TLS 1.3. Feature improvements * Initial implementation of Protocol-Failure as per IETF draft. The functionality is disabled by default, but can be enabled via new configuration flags. * Always allow Protocol-Error packet as valid response to any packet. * Add Error-Cause attributes to CoA-NAK and Disconnect-NAK * added filter_username_nai to policy.d/filter, mainly for use in eduroam. * Updates to VSCode default configuration. * Cleanups and add log messages for rlm_proxy_rate_limit. * allow 389ds legacy PBKDF2_SHA256 to use arbitrary iteration count. (#5654) * amend policy insert_acct_class/acct_unique to work in environments with multiple Class attributes (#5337) * Tweak sqlippool messages to make them clearer. * Print log message if the server receives a correct authenticated proxy response packet, but which has an unexpected code. e.g. received Access-Accept in response to an Accounting-Request. * New installations now set "suppress_secrets=true" by default. The server also prints messages in debug mode which explains why the secrets are being suppressed. * Allow parallel build for Debian. Fixes #5774. * Add RTBrick and other dictionaries. * Add documentation for ntlm_auth and spaces in passwords. Addresses #5654. Bug fixes * Many minor bug fixes and cleanups. * Fixes to RadSec. * Many other fixes to socket and event handling, which enable increased scalability. * Fix issues found with EAP-MSCHAPv2, EAP-PWD, and EAP-MD5. * Fix run_dir (#5637) and MemoryLimit (#5639) * Disable the PCRE JIT at run time if it can't allocate executable memory. * Set selinux boolean to allow PCRE2 JIT * If you set the clock 25 years in the future, don't spam systemd. Fixes #5642 * Don't load the OpenSSL legacy provider when built with --enable-fips-workaround. Fixes #5644. * Address potential leaks when opening many RADIUS/TLS proxy sockets. * Encode multiple DHCP Option 82 as one option, instead of as multiple options. * Update the rlm_cache_redis driver to reconnect on connection failure. Fixes #5651. * Tweaks to the processing state machine to handle more corner cases / race conditions. Thanks to Paul Dekkers for testing. * Don't close the main listen socket for TCP. Fixes #5661. * Fix rlm_dspk to properly support dynamic filenames. * Don't crash in corner cases when running Post-Proxy-Type Fail. * Use correct name offsets in proxy_rate_limit. Fixes #5675. * push fallback virtual server to child thread. Fixes #5679. * Correct corner case in hash table. Fixes #5680. * Allow new proxy sockets after reaching "too many sockets", when we close an existing proxy connection. Fixes #5964. * fix consistent load balancing. Fixes #5770. * Address pthread APIs. Fixes #5772. * install headers needed to build modules. Fixes #5778. * Initialize scope in IPv6 address lookups. Fixes #5798. * Don't load legacy provider on --enable-fips-workaround. Fixes #5775. * Hoist mutex lock in TLS sockets. Fixes #5480 * Fix occasional EAP-PWD authentication failure. * Fix memcache storing of dates. * Add more debugging information for TEAP. TEAP has limited utility, due to the incompleteness of the spec, and the severe limitations of the Windows TEAP supplicant. * Return stats for "auth+acct" home servers. Fixes #5866. FreeRADIUS 3.2.8 Wed 20 Aug 2025 12:00:00 UTC urgency=low Configuration changes * Replace dictionary.infinera with the correct one. * Update dictionary.alteon Feature improvements * Add support for automated fuzzing. This doesn't affect normal operations, but it does allow for testing of the RADIUS decoder. * Allow tagged attributes to use ":V" as a tag in some cases. The tag is then read from the value which is being assigned to the attribute. This functionality is allowed in 'update' sections, including 'update' in module configurations. See mods-available/ldap for an example. * Add kafka module. See mods-available/kafka. * Allow &control:Packet-SRC-IP-Address to be used when proxying needs a given source address. * Change lower limit for reject_delay to 0.5s. Apparently some NASes will panic and go crazy with a 1s reject_delay. * Rate limit complaints when limiting new connections. * Update raddb/certs/Makefile to support DER output. * Elapsed statistics for packets do not include proxy timers, which helps clarify where any issues are. The total time is still available by adding "our" time to the "proxy" time. * Added kafka module. See mods-available/kafka. * json module can now print dates as integers. See mods-available/json * The debug output now points to the online documentation in many cases, when there are syntax errors in the configuration. * Add support for 389ds password hashes. Patch from Gerald Vogt. * reject_delay does not _add_ a delay, but instead ensures that the reject is delayed for _at least_ that time. This change means that reject_delay can be set in more situations, including for proxies. * Add delay_proxy_rejects. By default, proxied rejects are not delayed. Setting this flag means that reject_delay is applied to proxied rejects, too. * The proxy_rate_limit module can now be listed in the "authorize" section. * Update dpsk module to be faster, and be easier to configure with databases. See mods-available/dpsk Bug fixes * Move assertion in thread / queue code, which only affects debug builds. Fixes #5512. * Update CRL checks to avoid crash in some cases. Fixes #5515 * More tweaks to the TEAP code. * Allow building when OpenSSL is missing PSK. Fixes #5520 * Move assertion so that it isn't triggered when the incoming queue is full, and the server is blocked. Fixes #5512 * Fix crash when multiple certs are used along with CRL distribution points. Fixes #5515 * Fix typo in rlm_cache which could cause crashes. Fixes #5522 * Be more forgiving about '%' in strings. Fixes #5525. * Move assertion in threading code. * Fixes to interaction with python interpreter * Don't crash when setting client hostname in RADIUS/TLS. Fixes #5552 * Ignore ".dpkg*" and ".rpm*" files when loading configuration directories. Package managers can leave these around. * Complain more loudly if all of the "authorize" etc. sections have been removed, but the server is still configured to process Access-Request packets. * Use OCIStmtPrepare2 to prepare Oracle queries. Fixes #5540 * Allow dynamic clients with TCP listeners. FreeRADIUS 3.2.7 Fri 31 Jan 2025 12:00:00 UTC urgency=low Configuration changes * The dpsk module now supports dynamic expansion of the "filename" parameter. * radiusd.conf now contains an "unlang" section, which controls new behavior for the "return" statement. * New configuration parameters for TEAP which makes it much easier to configure. See the "teap" section of the "eap" module. * Change idle timeout for incoming radsec connections, to better match behavior of radsecproxy. * python2 and rlm_couchbase are no longer available in the alpine docker image. * utmp files are becoming obsolete due to 32-bit time. unix/radwtmp have been commented out in the default config and "radlast" is no longer installed if "last" is not present on the system. Feature improvements * Print MD5 hash of the configuration files in debug mode. This helps people track configuration changes. * Add support for IPv6 to "abinary" type. The fields are the same as for "ip", but use "ipv6", and IPv6 formatted addresses. * Update radclient to make it clear that Message-Authenticator is added to all Access-Request packets, even if the input file does not contain it. * Add support for Subject AltName URI. Closes #5450. * Add python_path_mode option to python3 module. * Relax checks on OpenSSL minor versions for OpenSSL 3.x. * Add API for deleting dynamic home servers. * set SO_KEEPALIVE on outbound sockets, so firewalls are less likly to close TCP connections. * Allow querying of statistics when home_server has src_ipaddr set. See FreeRADIUS-Stats-Server-Src-IP-Address. Fixes #5483 * Update dictionary "man" page. Fixes #4346. * Change jlibtool to use --show-config, to avoid conflicts with clang --config. Fixes #5442. * RADIUS/TLS clients now support a "tls' subsection. For connections from this client, this section is used in preference to the "listen" TLS settings. This allows a server to easily present different identities to different clients. * RADIUS/TLS has been updated for TLS-PSK and TLS 1.3. Tested with radsecproxy. Bug fixes * For EAP-TLS, send TLS start without a length field. Some clients refuse to do EAP-TLS when this field exists. * Avoid blocking TLS sockets on corner cases during session setup. * Update home server stats * Correct error message about untrusted certs. Fixes #5466. * Use PyEval_RestoreThread to swap to main thread. Fixes #5111 * Don't run Python detach function on config check * Fix a number of issues with TLS connections and "check_client_connections = yes". * Be more careful about managing the incoming queue when databases block the server. The server will still be unable to make progress, but it should crash less. Whether or not this is a good thing is unknown. * Better handler single-character expansions. Fixes #2216. * Correct calculation of EAP length in pre-proxy. Fixes #5486. * Don't segfault when using detail listeners. Fixes #5485 * Add check for Couchbase v2, rlm_couchbase won't build on v3. FreeRADIUS 3.2.6 Sat 24 Aug 2024 12:00:00 UTC urgency=low Configuration changes * require_message_authenticator=auto and limit_proxy_state=auto are not applied for wildcard clients. This likely will leave your network in an insecure state. Upgrade all clients! Feature improvements * Allow for "auth+acct" dynamic home servers. * Allow for setting "Home-Server-Pool", etc. for proxying accounting packets, just like authentication packets. * Fix spelling in starent SN[1]-Subscriber-Acct-Mode attribute value. Patch from John Thacker. * Update dictionary.iea. Patch from John Thacker. * Add warning for secrets that are too short. * More debugging for SSL ciphers. Patch from Nick Porter. * Update 3GPP dictionary. Patch from Nick Porter. * Fix ZTE dictionary. * Make radsecret more portable and avoid extra dependencies. * Add timestamp for Client-Lost so we don't think it's 1970. Patch from Alexander Clouter. #5353 Bug fixes * Dynamic clients now inherit require_message_authenticator and limit_proxy_state from dynamic client {...} definition. * Fix radsecret build rules to better support parallel builds. * Checkpoint systems should be reconfigured for the BlastRADIUS attack: https://support.checkpoint.com/results/sk/sk182516 The Checkpoint systems drop packets containing Message-Authenticator, which violates the RFCs and is completely ridiculous. * Fix duplicate CoA packet issue. #5397 * Several fixes in the event code * Don't leak memory in rlm_sql_sqlite. #5392 * Don't stop processing RadSec data too early. FreeRADIUS 3.2.5 Tue 09 Jul 2024 12:00:00 UTC urgency=high Configuration changes * BlastRADIUS mitigations have been added to the "security" section. See "require_message_authenticator" and also "limit_proxy_state". * BlastRADIUS mitigations have been added to radclient. See "man radclient", and the "-b" option. Feature improvements * TOTP now supports TOTP-Time-Offset for tokens with times that are out of sync. See mods-available/totp * radclient now supports forcing the Request Authenticator and ID for Access-Request packets. * Update dictionary.3gpp. * Update advice on shared secrets, including suggesting a secure method for generating useful secrets. Bug fixes * Allow proxying by pool / home server name to work with auth+acct servers * Fix OpenSSL API usage which sometimes caused crash in MS-CHAP Previously it would either always crash immediately, or never crash. * Fix packet statistics. Stop double counting some packets, and track packet statistics even if a socket is closed. * Reverted patch in TTLS which broke compatibility with some systems. * Don't crash in debug mode when multiple intermediate certs are used Patch from Alexander Chernikov. FreeRADIUS 3.2.4 Wed 29 May 2024 12:00:00 EDT urgency=low Configuration changes * Better handle backslashes in strings in the configuration files. If the configuration items contain backslashes, then behavior may change. However, the previous behavior didn't work as expected, and therefore is not likely to be used. * reject_delay no longer applies to proxied packets. All servers should now set "reject_delay = 1" for security and scalability. * %{randstr:...} now returns the requested amount of data, instead of one too many bytes. Feature improvements * Preliminary support for TEAP. * Update EAP module pre_proxy checks to make them less restrictive. This prevents the "middle box" effect from affecting future traffic. * Many fixes and updates for Docker images * Add dpsk module. See mods-available/dpsk * Print out what cause the TLS operations to be made, such as the EAP method name (peap, ttls, etc), or RADIUS/TLS listen / proxy socket. * Add auto_escape to sample SQL module config * Add 'if not exists' to mysql create table queries. ref #5032 (#5137) * Update dictionary.aruba; add dictionary.tplink, dictionary.alphion * Allow for 'encrypt=1' attributes to be longer than 128 characters. * Added "radsecret" program which generates strong secrets. See the top of the "clients.conf" file for more information. * radclient now prints packets as hex when using -xxx. * Added "-t timeout" to radsniff. It will stop processing packets after seconds. * Support "interface = ..." on OSX and other *BSD which have IP_BOUND_IF. * The detail module now has a "dates_as_integer" configuration item. See mods-available/detail for more information. * Add lookback/lookforward steps and more configuration to totp. See mods-available/totp. * Add "time_since" xlat to calculate elapsed time in seconds, milliseconds and microseconds. * Support "Post-Auth-Type Challenge" in the inner tunnel. Patch from Alexander Clouter. PR #5320. * Add "proxy_dedup_window". See radiusd.conf. * Document KRB5_CLIENT_KTNAME in the "env" section of radiusd.conf. * Add "dedup_key" for misbehaving supplicants. See mods-available/eap Bug fixes * Fix corner case with empty defaults in rlm_files. Fixes #5035 * When we have multiple attributes of the same name, always use the canonical attribute * Make FreeRADIUS-Server-EMA* attributes work again for home server exponential moving average statistics. * Don't send the global server stats when asked for client stats. They use the same attributes, so the result is confusing. * Fix multiple typos in MongoDB query.conf (#5130) * Add define for illumos. Fixes #5135 * Add client configuration for TLS PSK. * Permit originate CoA after proxying to an internal virtual server * Use virtual server "default" when passed "-i" and "-p" on the command line. * Fix locking issues with rlm_python3. * The detail file reader will catch bad times in the file, and will not update Acct-Delay-Time with extreme values. * Fix issue where Message-Authenticator was calculated incorrectly for CoA / Disconnect ACK and NAK packets. * Update Python thread and error handling. Fixes #5208. * Fix handling of Session-State when proxying. Fixes #5288. * Run relevant post-proxy Fail-* section on CoA / Disconnect timeout. * Add "limit" section to AWS health check configurtion. Fixes 35300. * Use MAX in sqlite queries instead of GREATEST. * Fix typo in Mongo queries. Fixes #5301. * Fix occasional crash with bad home servers. Fixes #5308. * Minor bug fixes to the SQL freetds modules. * Fix blocking issue with RADIUS/TLS connection checks. * Fix run-time crash on configuration typos of %{substr ...} instead of %{substr:...} Fixes #5321. * Fix crash with TLS Status-Server requests. Fixes #5326. FreeRADIUS 3.2.3 Fri 26 May 2023 12:00:00 EDT urgency=low Configuration changes * The rlm_ldap and rlm_sql modules now have a "max_retries" configuration item in the pool section. This sets a limit on how many times an operation will be retried if it fails indicating a connection issue. * Added "check_crl" configuration to rlm_ldap. This only works with OpenSSL. Many Linux distributions use other TLS libraries, which won't work. * Note that rlm_ldap does not support "-=" operators. The documentation disagreed with the code, so we fixed the documentation. * If checkrad is called from SQL Simultaneous-Use checks it will now be passed NAS-Port-Id (as stored in the database), rather than NAS-Port. Feature improvements * Add "max_retries" for connection pools. Fixes #4908. Patch from Nick Porter. * Update dictionary.ciena, dictionary.huawei, dictionary.wifialliance and dictionary.wispr; add dictionary.eleven. * You can now list "eap" in the "pre-proxy" section. If the packet contains a malformed EAP message, then the request will be rejected. The home server will either reject (or discard) this packet anyways, so this change can only help with large proxy scenarios. * Show warnings if libldap is not using OpenSSL. * Support RADIUS/1.1. See https://datatracker.ietf.org/doc/draft-dekok-radext-radiusv11/ Disabled by default, can be enabled by passing `--with-radiusv11` to the configure script. For now, this is for testing interoperability. * Add extra sanity checks for malformed EAP attributes. * More TLS debugging output * Clear old module instance data before HUP reload. Avoids burst memory use when e.g. using large data files with rlm_files. Patch from Nick Porter. * `rlm_cache_redis` is now included in the freeradius-redis packages. * Separate out python2/python3 in Debian Packages. Previously python 2 or 3 was built depending on the system default which led to confusion. We now build both freeradius-python2 and freeradius-python3 packages where possible. Bug fixes * Don't leak MD contexts with OpenSSL 3.0. * Increase internal buffer size for TLS connections, which can help with high-load proxies. * Send Status-Server checks for TLS connections * Give descriptive error if "update CoA" is used with "fake" packets, as it won't work. i.e. inner-tunnel and virtual home servers. * Many small ASAN / LSAN fixes from Jorge Pereira. * Close inbound RADIUS/TLS socket on TLS errors. When a home server sees a TLS error, it will now close the socket, so proxies do not have an open (but dead) TLS connection. * Fix mutex locking issues on inbound RADIUS/TLS connections. This change avoids random issues with "bad record mac". * Improve REST encoding loop. Patch from Herwin Weststrate. Closes #4950 * Correctly report the LDAP group a user was found in. Fixes #3084. Patch from Nick Porter. * Force correct packet type when running Post-Auth-Type. Helps with #4980 * Fix small leak in Client-Lost code. Patch from Terry Burton. PR #4996 * Fix TCP socket statistics. Closes #4990 * Use NAS-Port-Id instead of NAS-Port during SQL simultaneous-use checks. Helps with #5010 FreeRADIUS 3.2.2 Thu 16 Feb 2023 12:00:00 EDT urgency=low Configuration changes * The linelog module now has a "header" configuration item, which places a header in any new file it creates. * The ldap module now supports setting "cipher_list". See mods-available/ldap. * Add "connect_timeout" for outgoing TLS sockets. Helps with #3501. * Add config section for xlats in rlm_rest and an option to control REST body data encoding. Patches by Nick Porter. * Allow Operator-Name and Called-Station-Id in attr_filter when proxying. Helps with less work in Eduroam configurations. * Ensure that the AcctUpdateTime field in SQL is always updated. This is so that we can track when the last packet arrived. * Update the default configuration to reply to NAS when accounting proxying fails, but we still write to the detail file. Feature improvements * The "configure" process now gives a much clearer report when it's finished. Patches by Matthew Newton. * Fallback to "uname -n" on missing "hostname". Fixes #4771 * Export thread details in radmin "stats threads". Fixes #4770 * Improve queries for processing radacct into periodic usage data. Fix from Nick Porter. * Update dictionary.juniper * Add dictionary.calix * Fix dictionary.rfc6519 DS-Lite-Tunnel-Name to be "octets" * Update documentation for robust-proxy-accounting, and be more aggressive about sending packets. * Add per-module README.md files in the source. * Add default Visual Studio configuration for developers. * Postgres can now automatically use alternate queries for errors other than duplicate keys. * %{listen:TLS-PSK-Identity} is now set when using PSK and psk_query This helps the server track the identity of the client which is connecting. * Include thread stats in Status-Server attributes. Fixes #4870. * Mark rlm_unbound stable and add to packages. Patches by Nick Porter. * Remove broken/unsupported Dockerfiles for centos8 and debian9. * Ensure Docker containers have stable uid/gid. Patches from Terry Burton. Bug fixes * Preliminary support for non-blocking TLS sockets. Helps with #3501. * Fix support for partial certificate chains after adding reload support. Fixes #4753 * Fix handling of debug_condition. * Clean up home server states, and re-sync with the dictionaries. * Correct certificate order when creating TLS-* attributes. Fixes #4785 * Update use of isalpha() etc. so broken configurations have less impact on the server. * Outgoing TLS sockets now set SNI correctly from the "hostname" configuration item. * Support Apple Homebrew on the M1. Fixes #4754 * Better error messages when %{listen:TLS-...} is used. * Getting statistics via Status-Server can now be done within a virtual server. Fixes #4868 * Make TTLS+MS-CHAP work with TLS 1.3. Fixes #4878. * Fix md5 xlat memory leak when using OpenSSL 3. Fix by Terry Burton. FreeRADIUS 3.2.1 Mon 03 Oct 2022 12:00:00 EDT urgency=low Feature improvements * Add dictionary.ciena, dictionary.nile, and DHCPv4 dictionaries. * Add simultaneous-use queries for MS SQL. * Add radmin command for "stats pool " Which prints out statistics about the connection pools * Client statistics now shows "conflicts", to count conflicting packets. * New optional "lightweight accounting-on/off" strategy. When refreshing queries.conf you should also add the new nasreload table and corresponding GRANTs to your DB schema. * Add TLS-Client-Cert-X509v3-Certificate-Policies, which helps with Eduroam. Suggested by Stefan Winter. * Allow auth+acct for TCP sockets, too. * Add rlm_cache_redis. See raddb/mods-available/cache for details * Allow radmin to look up home servers by name, too. * Ensure that dynamic clients don't create loops on duplicates. Reported by Sam Yee. * Removed rlm_sqlhpwippool. There was no documentation, no configuration, and the module was ~15 years old with no one using it. * Marked rlm_python3 as stable. * Add sigalgs_list. See raddb/mods-available/eap. Patch from Boris Lytochkin. * For rlm_linelog, when opening files in /dev, look at "permissions" to see whether to open them r/w. * More flexibility for dynamic home servers. See doc/configuration/dynamic_home_servers.md and raddb/home_servers/README.md * Allow setting of application_name for PostgreSQL. See mods-available/sql. Bug fixes * Correct test for open sessions in radacct for MS SQL. * The linelog module now opens /dev/stdout in "write-only" mode if the permissions are set to "u+w" (0002). * Various fixes to rlm_unbound from Nick Porter. * PEAP now correctly runs Post-Auth-Type Accept * Create "TLS-Cert-*" for outbound Radsec, instead of TLS-Client-Cert-* Fixes #4698. See sites-available/tls, and fix_cert_order. * Minor updates and fixes to CI, Dockerfiles and packaging. * Fix rlm_python3 build with python >= 3.10. Fixes #4441 FreeRADIUS 3.2.0 Thu 21 Apr 2022 12:00:00 EDT urgency=low Configuration changes * "correct_escapes" has been removed, and is always set to "true" internally. Configuration changes may be required if you are using configurations from before 3.0.5. Other than this difference, 3.2.x is compatible with 3.0.x, and configurations from 3.0.x can be simply copied into a system running 3.2.x. Feature improvements * All features from 3.0.x are included in the 3.2.x releases. In addition: * Support PEAP and TTLS with TLS 1.3. This has been tested with wpa_supplicant and Windows 11. * Add 'reset_day' and '%%r' parameter for rlm_sqlcounter to specify which day of the month the counter should be reset. * Partial backport of rlm_json from v4, providing the json_encode xlat. See mods-available/json for documentation. * Support for haproxy "PROXY" protocol. See sites-available/tls, "proxy_protocol" and doc/antora/modules/howto/pages/protocols/proxy/ * Support for sending CoA-Request and Disconnect-Request packets in "reverse" down RadSec tunnels. Experimental for now, and undocumented. * It is now possible to run a virtual server when saving / loading TLS cache attributes. See sites-available/tls-cache for more information. * Removed the "cram" module. It was undocumented, and used old and insecure authentication methods. * Remove the "otp" module. The "otpd" program it needs is no longer available, and the module has not been usable since at least 2015. * All features from 3.0.x are included in the 3.2.x releases. * 3.2.0 requires OpenSSL 1.0.2 or greater. Bug fixes * All bug fixes from 3.0.x are included in the 3.2.x releases. freeradius-3.2.10+dfsg/doc/Makefile.sphinx000066400000000000000000000063451522352605200203740ustar00rootroot00000000000000# Makefile for Sphinx documentation # # You can set these variables from the command line. SPHINXOPTS = SPHINXBUILD = sphinx-build PAPER = BUILDDIR = _build # Internal variables. PAPEROPT_a4 = -D latex_paper_size=a4 PAPEROPT_letter = -D latex_paper_size=letter ALLSPHINXOPTS = -d $(BUILDDIR)/doctrees $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) . .PHONY: help clean html dirhtml pickle json htmlhelp qthelp latex changes linkcheck doctest help: @echo "Please use \`make ' where is one of" @echo " html to make standalone HTML files" @echo " dirhtml to make HTML files named index.html in directories" @echo " pdf to make standalone PDF files" @echo " pickle to make pickle files" @echo " json to make JSON files" @echo " htmlhelp to make HTML files and a HTML help project" @echo " qthelp to make HTML files and a qthelp project" @echo " latex to make LaTeX files, you can set PAPER=a4 or PAPER=letter" @echo " changes to make an overview of all changed/added/deprecated items" @echo " linkcheck to check all external links for integrity" @echo " doctest to run all doctests embedded in the documentation (if enabled)" clean: -rm -rf $(BUILDDIR)/* html: $(SPHINXBUILD) -b html $(ALLSPHINXOPTS) $(BUILDDIR)/html @echo @echo "Build finished. The HTML pages are in $(BUILDDIR)/html." dirhtml: $(SPHINXBUILD) -b dirhtml $(ALLSPHINXOPTS) $(BUILDDIR)/dirhtml @echo @echo "Build finished. The HTML pages are in $(BUILDDIR)/dirhtml." pdf: $(SPHINXBUILD) -b pdf $(ALLSPHINXOPTS) _build/pdf @echo @echo "Build finished. The PDFs are in _build/pdf." pickle: $(SPHINXBUILD) -b pickle $(ALLSPHINXOPTS) $(BUILDDIR)/pickle @echo @echo "Build finished; now you can process the pickle files." json: $(SPHINXBUILD) -b json $(ALLSPHINXOPTS) $(BUILDDIR)/json @echo @echo "Build finished; now you can process the JSON files." htmlhelp: $(SPHINXBUILD) -b htmlhelp $(ALLSPHINXOPTS) $(BUILDDIR)/htmlhelp @echo @echo "Build finished; now you can run HTML Help Workshop with the" \ ".hhp project file in $(BUILDDIR)/htmlhelp." qthelp: $(SPHINXBUILD) -b qthelp $(ALLSPHINXOPTS) $(BUILDDIR)/qthelp @echo @echo "Build finished; now you can run "qcollectiongenerator" with the" \ ".qhcp project file in $(BUILDDIR)/qthelp, like this:" @echo "# qcollectiongenerator $(BUILDDIR)/qthelp/FreeRADIUS.qhcp" @echo "To view the help file:" @echo "# assistant -collectionFile $(BUILDDIR)/qthelp/FreeRADIUS.qhc" latex: $(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex @echo @echo "Build finished; the LaTeX files are in $(BUILDDIR)/latex." @echo "Run \`make all-pdf' or \`make all-ps' in that directory to" \ "run these through (pdf)latex." changes: $(SPHINXBUILD) -b changes $(ALLSPHINXOPTS) $(BUILDDIR)/changes @echo @echo "The overview file is in $(BUILDDIR)/changes." linkcheck: $(SPHINXBUILD) -b linkcheck $(ALLSPHINXOPTS) $(BUILDDIR)/linkcheck @echo @echo "Link check complete; look for any errors in the above output " \ "or in $(BUILDDIR)/linkcheck/output.txt." doctest: $(SPHINXBUILD) -b doctest $(ALLSPHINXOPTS) $(BUILDDIR)/doctest @echo "Testing of doctests in the sources finished, look at the " \ "results in $(BUILDDIR)/doctest/output.txt." freeradius-3.2.10+dfsg/doc/README000066400000000000000000000131441522352605200162770ustar00rootroot000000000000001. INTRO The FreeRADIUS Server Project is a high performance and highly configurable multi-protocol policy server, supporting RADIUS, DHCPv4 and VMPS. It is available under the terms of the GNU GPLv2. All code in this server was written for this project. 2. INSTALLATION See the INSTALL file, in the parent directory. 3. CONFIGURATION FILES Much of the server documentation is included only in the comments in the configuration files. Reading the configuration files is REQUIRED to fully understand how to create complex configurations of the server. 3a. 'clients.conf' Make sure the clients (NAS, switches, access points etc) are set up to use the host radiusd is running on as authentication and accounting host. Configure these clients with a "radius secret", which should also be entered into the client definition in /etc/raddb/clients.conf. See also the manual page for clients.conf(5). 3b. 'users' Users may be defined in the "users" file (raddb/mods-config/files/authorize). All entries are processed in the order as they appear in the file. If an entry matches the username, radiusd will stop scanning the users file (unless the attribute "Fall-Through = Yes" is set). You can uses spaces in usernames by escaping them with \ or by using quotes. For example, "joe user" or joe\ user. The 'users' file is read by the "rlm_files" module. 3c. NEW RADIUS ATTRIBUTES (to be used in the USERS file). Name Type Descr. ---- ---- ------ Simultaneous-Use integer Max. number of concurrent logins Fall-Through integer Yes/No Login-Time string Defines when user may login. Current-Time string Allows you to perform time-based checks when a request is received. Login-Time defines the time span a user may login to the system. The format of a so-called time string is like the format used by UUCP. A time string may be a list of simple time strings separated by "|" or ",". Each simple time string must begin with a day definition. That can be just one day, multiple days, or a range of days separated by a hyphen. A day is Mo, Tu, We, Th, Fr, Sa or Su, or Wk for Mo-Fr. "Any" or "Al" means all days. After that a range of hours follows in hhmm-hhmm format. For example, "Wk2305-0855,Sa,Su2305-1655". radiusd calculates the number of seconds left in the time span, and sets the Session-Timeout to that number of seconds. So if someones Login-Time is "Al0800-1800" and she logs in at 17:30, Session-Timeout is set to 1800 seconds so that she is kicked off at 18:00. 4. LOG FILES 4a. /var/log/radius/radutmp In this file the currently logged in users are held. The program "radwho" reads this file and gives you a summary. Rogue sessions can be deleted from this file with the "radzap" program. 4b. /var/log/radius/radwtmp This file is "wtmp" compatible and keeps a history of all radius logins/ logouts. This file can be read with the "last" program, and other Unix accounting programs (such as "ac" and "sac") can be used to produce a summary. 4c. /var/log/radius/radius.log All RADIUS informational, diagnostic and error messages are logged in this file, including all login attempts. 4d. /var/log/radius/radacct//detail This is the original radius logfile, as written by all the Livingston radius servers. It's only created if the directory /var/log/radius/radacct exists. For more configuration options on the detail file please see raddb/mods-available/detail as it expands upon this greatly. 5. MORE INFO, SUPPORT The latest version of FreeRADIUS is always available from the git repository hosted on GitHub at https://github.com/FreeRADIUS/freeradius-server or see http://freeradius.org/git/ for more information. There are two mailing lists for users and developers. General user, administrator and configuration issues should be discussed on the users list at: http://lists.freeradius.org/mailman/listinfo/freeradius-users When asking for help on the users list, be sure the include a detailed and clear description of the problem, together with full debug output from FreeRADIUS, obtained by running radiusd -X Developers only discussion is to be had on the devel list: http://lists.freeradius.org/mailman/listinfo/freeradius-devel Please do not raise general configuration issues here. 6. OTHER INFORMATION The files in other directories are: debian/ Files to build Debian Linux packages. doc/ Various snippets of documentation doc/rfc/ Copies of the RFC's. If you have Perl, do a 'make' in that directory, and look at the HTML output. man/ Unix Manual pages for the server, configuration files, and associated utilities. mibs/ SNMP Mibs for the server. raddb/ Default configuration files for the server. redhat/ Files to build RedHat RPM packages. scripts/ Sample scripts for startup and maintenance. share/ Attribute dictionaries. src/ Source code src/main source code for the daemon and associated utilities src/lib source code for the RADIUS library src/include header files src/modules dynamic plug-in modules src/tests test harness used by "make test" suse/ Files to build SuSE RPM packages. If you have ANY problems, concerns, or surprises when running the server, then run it in debugging mode, as root, from the command line: # radiusd -X It will produce a large number of messages. The answers to many questions, and the solution to many problems, can usually be found in these messages. For further details, see: https://freeradius.org/documentation/ and the 'bugs' file, in this directory. $Date$ freeradius-3.2.10+dfsg/doc/all.mk000066400000000000000000000023721522352605200165210ustar00rootroot00000000000000ifneq "$(docdir)" "no" install: install.doc clean: clean.doc DOCDIRS := $(patsubst doc/%,$(R)$(docdir)/%,$(filter-out doc/source%,$(shell find doc -type d))) DOCFILES := $(filter-out %~ %/all.mk %.gitignore doc/rfc/update.sh doc/source/%,$(shell find doc -type f)) DOCINSTALL := $(patsubst doc/%,$(R)$(docdir)/%,$(DOCFILES)) # Create the directories $(DOCDIRS): @echo INSTALL $(patsubst $(R)$(docdir)/%,doc/%,$@) @$(INSTALL) -d -m 755 $@ # Files depend on directories (order only). # We don't care if the directories change. $(DOCINSTALL): | $(DOCDIRS) # Wildcard installation rule $(R)$(docdir)/%: doc/% | $(dir $@) @echo INSTALL $< @$(INSTALL) -m 644 $< $@ install.doc: $(DOCINSTALL) .PHONY: clean.doc clean.doc: @rm -rf doc/*~ doc/rfc/*~ build/docsite # # Deal with these later # DOCRST := $(wildcard *.rst) %.html: %.rst @rst2html.py $^ > $@ .PHONY: html html: $(DOCRST:.rst=.html) # # antora rebuilds the entire documentation site on each run # so we need to pick a single file to compare dependency # timestamps against. # # we use sitemap.xml as it'll be regenerated on every antora # run. # build/docsite/sitemap.xml: $(ADOC_FILES) @echo ANTORA site.yml ${Q}$(ANTORA) $(ANTORA_FLAGS) site.yml docsite: build/docsite/sitemap.xml endif freeradius-3.2.10+dfsg/doc/antora/000077500000000000000000000000001522352605200167005ustar00rootroot00000000000000freeradius-3.2.10+dfsg/doc/antora/antora.yml000066400000000000000000000007131522352605200207100ustar00rootroot00000000000000# # Metadata for the freeradius-server component # Examples of other components are the PAM module, # apache module, and the client library. # name: freeradius-server title: The FreeRADIUS Server version: '3.2.10' start_page: ROOT:index.adoc nav: - modules/ROOT/nav.adoc - modules/installation/nav.adoc - modules/concepts/nav.adoc - modules/howto/nav.adoc - modules/tutorials/nav.adoc - modules/unlang/nav.adoc - modules/developers/nav.adoc freeradius-3.2.10+dfsg/doc/antora/modules/000077500000000000000000000000001522352605200203505ustar00rootroot00000000000000freeradius-3.2.10+dfsg/doc/antora/modules/ROOT/000077500000000000000000000000001522352605200211335ustar00rootroot00000000000000freeradius-3.2.10+dfsg/doc/antora/modules/ROOT/assets/000077500000000000000000000000001522352605200224355ustar00rootroot00000000000000freeradius-3.2.10+dfsg/doc/antora/modules/ROOT/assets/images/000077500000000000000000000000001522352605200237025ustar00rootroot00000000000000freeradius-3.2.10+dfsg/doc/antora/modules/ROOT/assets/images/favicon.png000066400000000000000000000100111522352605200260260ustar00rootroot00000000000000‰PNG  IHDR  ‹Ïg-bKGDÿÿÿ ½§“¾IDATxÚí tSÕ†ƒ* š´T -"ƒå(VD…'<Åi1‰•²ž*"Ês—CÕ§8Ufh›6 Q‘BA) Xd²Œ•67¥L¡mé°ß9'MšNá&9÷¦ÉÝÿZ{%M“»Ú³¿œaŸ½Ï%…B¡P( …B¡P( …B¡P( …B¡P( …B¡P( …B¡P(ÊãjFüô÷ý níÛ߀M‚RVþú.Ä?hñ×¥P+¢vvšþn4}Wl(Tƒ‚£a-!#¢µ'áH·ûé£_ƒo ¼‰ø =Ý\â§û³p ˜~ñŽÄ–FUC·õþæp¸Ûp8±GCFøiúUVF·wíÆßÔÛ®—»,º:VAm)iÙ>[_ËàÁˆf°hÚË™í€ bšõùÅ=á`Œ ƒè1¡å-;êϹ\C–G{ÐÉ|¾ˆÒ|GîèM;X¼*ûsK×Í“'t:ÔóÞ‚æmô ºú,/XPZèõHÈè6‚vź¢}çÅvÎèÔ]w^àê³J>,·íÔ½äËðŽˆ³ïÒoeS_¾½¢E{=x¼Úv‡e_T€îÖ_’º¤Ø÷qqhÖhÀ«i~º}¤uÐ?Ðq^«Þ×ÐÕj {IJ9ÖƒƒB*+3ªá[ðigh kœðÕ–Û·Ezƒünë@Ã$ãé΃‘¯0휙–ÔÅßšùaЬ¾±Ãgoyè‡D\‹NnT¢±ôr_9 ë»émð¡^Ÿ½¥óÇÐïžT«`Ÿ¤[Á…r÷älnXÔÅ[á³·u¤uH †ôúëé°:Ô¹í®š6nt¨ ÀùŸtöùX’Chèu‰ð¹\P„€í.›¾À¹±>`•§_ÎÁ[À…Þìü¦>XgXn¥×#LòÔĶ© K£W¦¤s4 ð06,³i ªöâAߊ÷r,®å¯;£¦c4 Õ2éû1„®mPV_¡=ÝFs9ÐI Jâ±QM÷z,Fç¯+÷¤#4  Å.óÝ –<«Yê{TÍõ@Ï™¹ª$@à Ö*Ïÿ¤E·Ð¹x¸v1lrKU‚@)ö€³+|jÖR» ‡ÑFØ„zÔNa¥Ûfó×™@ÚVÒºc7 ‡kÚÞȨþºÐcVfÉ*¢»RÚí C:WÅ @Çû¿J^?‡eË°œz²$@ÿ iÜ]»²³T ˠˆô$°C(ÍÙ€zÔ¬ôMµ=,èN"€5ÐwèТjX.F=<,· Ô.ˆm:vâ ˜ Ð{|X–‘A=)¦Àø¯Â±ö;õA_ ç8ÐÒLK•\A} tm;˜·u…’Pv(œ—evïŒà`½`ñÓIë&½~ôVç:§_Ý=ïAÅ&¿êP›ªÝ•²¿n`}õÀöÇqØ[áïá0øÑÇu˱‘Ñ2‹–·ùÍË/hŽ}uí {Ãë…Ïj¥tX~ú©N 7rPw =‰dÄ4 1_™²È{«€|¶Èìß,Èplßíòi*wWym!ñô#¦8H‡€tˆð¢.V&K ÉXÙ,ªN˜em¬oÓáõ]/ßÌr:/œ0.Èí‘@ŽòâçÀæì’(©cqé@þc2îc Œ¢»³±ì9K¼—c‹=M§ôËJb¨n¸Ä¯Ãl€±ÅGP7‡Ã‰ÍÕ?/I¯lrmVèÿéó8@Õ¦ ¥¼—c‹:VP†’½cmÄ°žÁ5 K¯>«ô`õëw,O…´=#À¸s43d; H«90á· °äd!¤+Œ‹W¸±ç쵘=àfcŽç¤C7í™»TºlKá=䉥š\ð“Úó¿?6t…o?è\ãX¶ôÝClÏÇm\-“B‹¤LÙ ÜDúæXœ/©¹bïýš~æQ0Æn2ìwæŽ%<ˆÏŽ±Ã^NØü¯Î®H+ZD= ù{Ù ›¹õCÛóÄ/ÉvzsÚCN“Ï<û, :ÆŽ Ó¦M£Ñ¹¹¹²@,«XJ{ÆæI‚†èïYzE}9жÔáÐ^ïؤ€ÔhðÈ™¹BVî©Žýì Ýÿ÷sŸ›$š®êè¨ä½¼ç G Úĉ!33Sˆ…”ÄA©çÄÍÙJû¹w€´«½Å¼{9õ4óFï|/é›s†mH²—²{$.÷@Ûkw®Úæй//Y}ûöuŸÕzõêóæ̓ÊÊÊ«BÈÞñÁ—Ä.ZXHˆ…‹¬âMpTT`ð%ò]É.>ZÃ)‘«S`þö)°'}8|¸õ}þZüŽ‰6_O™Õ C§,\É¡’Ÿ½MŸ>ÊËËeõ†ß/¿z~é[¶+QNnÑ#j鑘$¹b‹ß߇"áÝÔë}O̲Ÿ wïÞNÃgµØØXÙ‹”·ö_áäyë@5•h^.×9­“Ã]«·4z´òôïßßeø¬¶~ýzY²áø-gECx¡P@)W„ãš&˜`̸܆YTTÉ‚0¯´B|/¸4︤ŠL­E9íÕÅ«…Àgµ… ÊŠ?;’/@ƒù~„C Ì}D8ì::$?6dˆP‡.À’ŠJq1B 4áPgþ7R„Ã^Œß$>«I’$Â7ö ]|Žp¨ÒJ¯‹pØä7ÞRÀÔÔTÙf”‰0AJ@8TéM3ÝuÛj0`€" ÙÒQšŠë×"ª,B¤/ÜuÖàätEàc¶hÑ"pFƒ· Û¦ÛŠp¨‚™ã®³&}¿V1×®]뀱—D Á{uVÁsÝuÖ´¸ïp×®]Nh”ŠDõ€é‡—øæ¬ÙŠÀ ………N¸ét1¨9¿œ«€“&MgõC.¨9ߘ½T·oßî4€†l‚5ૺ•ýRŸEGGƒ+˜ƒz €}7… ƒ¯_¿~••å€wÿtÔ€ÌJË+x2©»ð±$Ö´´4—à»B#Ñ·â@•vBæ‹pØþ¿¯ðtúÙ³]_³<ÂÝ»wƒ«Ú{¡TäVÜ^„C@ô¹3ÏÂòåËÞš5j?~ÜÑÓ;þÙJ‡:îå4–jU~~>ÄÅÅÁ°aÃÆùbbb %%EV1’#+ž”z…3®E@”TÂImèJQNû7=é >™Ífضm$''ÃâÅ‹aݺu|¨•›ñ,GÑ»óÄgEÇ›† $ÊÎÿÞí4–¥¶Žå—)s¾L‚”„(¶ú•ÚÓF.í´6«rxv²Zº\^ ~+r<èÈ<a-#4£»Q)§ ýù<¨ ›6 L¿jÈŽñº” ÍM¿FTèÅaýð¯y dGÈ®=fWžÒðUç.Îj…ð¸«$©zÓÔ:£Õë—‹§]ó¾ÍgÕ‚Ïj™$1ç^„ÈYÍ€¦$^º›$˜¿¢XªöA‘méœðÈ%q v†`€¢s>‡VÉ&Óƒ¢©wa‘¥§=Ü«´¡Ñ-¶u<šŸ(ýÕN,eÃåÙâr—Á;C?;jg4†ÿÅb¦|úxˆÚÔ–Ðö~$åÜ©MðØüÄ2¯+otGåÖ®¡‹†ôÔ"Cs=Š˜*ô86åÁÜ@-!ÚêõØY&^ã š!›géö«ãøâh>7öœ½æÁaV„] #Q-ô|×ÓoÜ>/v”/Ûyb8ÕÑÇ·Ò¤éèèF=¯ðíÕ­ S­Ð\5ÇçtðÕ­´»ÐÁ^` ¦ñ¾šHð:Ø Ì`ŽõÑÐ4 ì fþÒW|ëNõM—ž¹‘þƒÅèàÆ>4GúpÚlD'7j;Σ>«e§Â°lÔ6Ì÷wCL£EÖu  ³YÚÙN0ÿ‹ï?:79ÞÁcT ’ aiÐÊùI©‰Òe'>SJÛuh¢­Œ£Ù§ß§`©§QNQH7ÓØá×–øáɶü3ñæ;²«-"r ëro IæGxLµ£A:AWR§¥8meÂ4$–vÏêžoy•½ä„ìªö£ÃdÖÎìåR±ÃÅ„úŠ7…Ó¡ø,‚%Û.Ñ¡¸‚#d9{ ÏUC¨\IÁÇžÐpMóÍÆa×m3CvOÊáÄXº7‚ÚdËÊ—žuçõ"^Ö#­ºÅÅÚÞÏð›²Õ²fµ,ûÖª)@8<²‘Šx…\‚ùvmÁ—$ ¢ÿxBÐh¬Âø¸VævQü,;tzãÛE1d?æÛðýpâ:/ØJËàY;–Ìt·Ïm®¾V†@h¦;T-|yø/¨‰˜a×[V_Á®ë‹•Žé)wĈ·}•à°Ñ§äñeK@W«Õ¤ª´ŸA:éËæ*N`)F>Ùš†òUªòå¿âÐ5˵¿SGù*€–…\$_­*×~ƒ«`ç+¹6Û’V}@¦¥™mªÎùÃCÎ;¥Ó’+ªÁþ¢×{©F%—¬¾æhÁznòýƒ¹O=éáÎÝ?6}ÊÓúë óÐ’ÌÑÊRÚÀÓ¯ÜiÓ3¾{0‘¸½àLÚØo“%9þ Ï35 mta56¦I®ÝÊŒfÊ$ewÅl˜ú³5~©ú†÷“U¹¥Uk´AVú™×hûýä0òÀ·Eéݧ|zûMn>`¢ù KN ô0 7ô%Ƭv®­´À:Š?q3?œÝ¶%ƒ°Ê9Íõxª…z@ˆjV æGÝ Ä¾­ €Ò;n]‹š£¼@So7O}Q¡нk%e÷BçzƒØé îÄíÏÇ `|Î=n\«˜ÏÝ„Îõš`·´ÚEGgÕõˆíÖ¸ž ¾ êUÃ0=À¥zbÓ˜š éy7«ÎÆ ¸-O5wG§z_/ø¶Ó7i©èvwA“h\ãzìú¬7sâéèLow¶i¦ÌÃ0 õi³ ×Of¨àY+µe9+;YÖçÙ-5wnŸÏÅYôŸ¥kÕ Ò~~X¦ÃÏK?»|×rG_ƒéIúž 2¹‰'m |H¬7bÛ|l»e³»±ËšO²mB§®ä{×r´ÌÊÿë6¤ñt : U;¶8ÃÉXâ{Øh(q²Ühñ=a%Ÿwúô­Pì Y=½ÃxÝ£EèÏæõ¼&…R\, ™íl°Ô&öÈ~F¡P( …B¡P( …B¡P( …B¡P( …B¡P(Ê3ú?(ÎH,½àH‡IEND®B`‚freeradius-3.2.10+dfsg/doc/antora/modules/ROOT/assets/images/favicon.svg000066400000000000000000000112221522352605200260460ustar00rootroot00000000000000 freeradius-3.2.10+dfsg/doc/antora/modules/ROOT/assets/images/networkradius.png000066400000000000000000000157261522352605200273240ustar00rootroot00000000000000‰PNG  IHDRªjtfügAMA± üa cHRMz&€„ú€èu0ê`:˜pœºQ< pHYs  šœ iTXtXML:com.adobe.xmp 2 1 1 2 E*“5IDAThí[{xUŵ_³ç• $X%€Rz½‚öú®‚‚TÄ~·WƒJòhíWÚÚVkýZ×^{{ë­­~µM•$ ’ÖV­¯$@”hŪ} V±â ’79É9g¿æþÖì}Â!"Eå¿›ùØ9{ϬY3³æ7ëµ7D£eTÇERPÅf]]—÷Ç5t#Y| b$Áèó¨þ‰ 5-t‡éÊ·4éÝ“ˆ¬qäŠb"oÅ'ù‹q…¥†=ºV¨h"­‰È…ò˜aÆrë¥ù¦’¯R§v>&‘`3“„À À±¯^w#ÆY€µóÜá2ð ¼P›'ßÂõ5Š–,äÒ;Ã46¶Qî‰h­È!Gþî_¾UÅxÕë¿–ÿ§€°éB²íÿäE›(^ÅíDUkçBä7c|¸:€,¯8Ï7âÙRu1÷zª[9„{¢ÅuÓÉÿ ½gbÚyÚ*Š/}“–­=R¢üÏ¿b !¤,©TBäÉÛiÓò‡Â!c%§•ýT½ö €ô.Dò—‘h°<Ù?U‚UZ–GW;Ã7#JlX$MÇ8²HíTš’k)Ç»9C–€vÍ!>=ã\3/ÿ,ÃJÔ–ß»í¶%çB¸ ÒäXM3J5Ó$wp(í8†ÉõìçMK «ÅÄ5~)o3Úâ³ëÎÓBѻݽÎÙ¦F'4–‚âWWŒœ)Mq,u8X<¶ò-ýƒásÉôÍðBmÅf¤:Pš**¼Î5mj–®gÛÀ+Á«JÅ´Õ¢)Î@DQnÊu‹M<Ÿb…¥”LY Á´¹?ß{î7ž[¨qùmj•9…ß;6g™&€€a=`.œ¸öwéVer§ïòO™ äŒàõGfMŠ?újúrJ]`\I Ë÷€` Eóg+PXC]ŠW¤ E ÊÉÁrìÔê(3…ÓDš¹€B¼å˜³íÜH×Ô¤OC#žªø¨11Væàs`d Ü‘aqØ/ËW•çB 0¯‹ÈIV@Nexž„À*—/$/Ã3ÄÇb¹q½‹ùzHSyÖ›8hÍ$õiã’¿ù¤¾öf‰dº¢%]+ útʈÆÎtRƒ?Fã×™€ÙIǶ]×áÅ궋*?†"Ö¼ã¢Ý¡Hž÷‡…ŸO2H¹]&òâ F,§ˆ©c¥T¿a3›(¦WåXê ¥Y32ߌN ëíÝÉqkÿ€G ¥hZ(€¿´æUB‡\X!Ka˜JÙ´@*•S\G–t’ì$Ftll*N@¬*…`€À`YÞ„ »Ÿâؼò8ž¹x_Tb%€O§Ô[ž2ºzýIôÀÂ÷¨SÑá‹ ìšš"S›“‹6 c¤`ÏFÿÿD}5Àf«ù°ö°\<ÍRu T¶¡´’5? étÒhO¹úÆW)¦Ò˜Ï·¼R¸r”!Òƒs¢7]ö>¾¨¾fþ5бÂÌ´IMø'Ùt“ƒž¦›«J7<µ}ûây¿ÆÒ˜VƒO‡q\ÍrB‘¨ìþ§'JDgÒë¹0)´#=h•6´¼#5mC{åÅMzÄ•®k¸éTn Z5³¡ù2HÙ_ï9Ð] ó¢I¡uýz|Àx=;åV chßÝ^sÉMÐì®a_’(‚ƒiã-!wÈrŒ¼ïîO{3£©žq¨‹öôÁ÷ü³úOŸ­¾è5ÿÄ ofcëáÉK° EÀeÂÙïIo—Æóa­¦æ †$šÙØr+Æeáâ€ÉWÚéãÃÊ4j½Ð0)Îo)·Hm^庅Ðvo>6y*¨÷P[Ü¡Ê;ó±! ”Q?ž?CZ–Åš‹ç =‡_/àûé:O"¾‚L×Pü<ºa:@Êó˜¯Öõº†ÍF_›û}5ýï ‡'»xhcbnçƒÆ¡ñät²ÓØU¸l§ÆeeÃ]VÔšd…tºo™²¨è{ôL¤´)¬hÍú ¡ ¿Ö‘®ý†î[؇Ö?S~´RS; ¢X‚IM!a~‡ÄkP³×Æ@Ñ´_”ßûÛVùAlr†@è¢Û.ß¼-×M[™ycÎ`%£G¢8´plû Hã²²ÆÖ«£ÖïÝÒTw]×ÈÉí:'݃ÃäzÛ!¬J3¿0-N^Þà/ÂÖT ¾)”“Gö@/•7n»Ë²í"ÓÝ`ä!«·{¯.¢?p }sxLá\'99³[%`AÒ¤‡Ãç[ó.Ú°eÆÖÅï+­o½Y…oº²þdÄr)Õõþ¬Ì7-Ø7.­™7XZß|›‘“3ÏÕêïe-W÷ÁHž;Hk¸^«ÿ=±Û8 ¬5‚""åñd&ÍÙßô+@РÚ@4mXÛƒ/ªÀ_Ê=°ô݀˪¬»ý~ åd,½5y<ÎyV¿€ò#ýð”5¬?.kp9Ö`yæNŒÿÕ-ÙJ¶NjÁø=Tü€ÔSþmRn‚ r2YC_"ÇYCU랦Ûa_Ã>îÃ&wSÚ éC¾+6åktš05F!k Ùv1€9£œùÍ‚B<k-$3F”îg-üïªw8PEàH°qòhHºN;ÞIÊ»2ZãÈ4¢ÊïgÙº˜ŠkAþZ¦ÓŠÚ„þ³f²º lyw£ú/+ïÍ"€”£ÉAv—PÄ;= jgÀ À âÏP*/{Boe:îÃ0Ž’6û;¬ @gòÏ-Û«ç^ —Wï\¸ÐHþÀæW@¹Ãëæ ÷ )ì™®~IœþÓ´P„¤m²à=•Xì/ïúÇUÛ«/¹ÛØ‚`ë`ôIŸk|¼šÇA&Ȩ\™×kO~¦jη=ÍwsX“ÃRœ&4ñ_Ü MIW^Ç å€ð¥ŽŽÌ!cX LÑ\Ü ¨í@rúÛØ |"z†¦Lù#ó¡ªÚ1öE¼ŸÐ6 òÕ¯x-¯ðâ 5ò°A_T´ê϶‚èõt>B±ùχ”L ;ßÊ5 è"Fh¢XLäû&Ÿ\·ß2Àü,îtS:é¨Åâ€]•×{b¾)¬]Øà7È0§¢u6„‚ ‘„Xë=Û‚+AŸÊ ôr{å‚ÞÒ-PÍÌÇrgET&ßs¥ºaË(£Œ#¿‚ÿâ›ÉïáEbfZ怵+´û¼²­×=S9g}9Í2ÚØdŠS3¡-þ‚ÖÁéX 3q€ *ûz`Å{*êm‚¥tU0G„¡ÈIé晊 tñ p”rÚsÒiøÝ z̖ׄ!T#5ÝÀ‘?Švžzî2è±$/Ù Uq8À;w šPÂù6ð*‡_E:‚Ý)C~Ö¤ò³ Ú¨ò²ñ…Å *)iÃVÏÀ:1ʃù… " c>@øç  Zƒkùƒ¨zªê>àlHÊ0ÖgÐ^z”Zö$|q7\ `’ƒ£WúÀÒ fqCÛéþkw¢ÑŸKr¾(‡û¨\OÂp£œî»eŠ.Ô#±2¬ÜGÈTÇ›"gjáûØd6Á€¬ó²žkTQ¾Þ ™"æšVóâyƒ—?úb¬/ÝÃéÌ6Ç• fÜ÷äÛFÈÈiýÕ¶ÊÙ½e -Ïa³§b¸bhcÝ úÇ ©—Á](ò\hl(-ônQÓ“8u¬É‘×’²†æ“íÍÏíGžñT¶Ì0<Ø€mÙžq˜å¡>’¸'æƒñÆù+„ô¼fFValnøå¬M­»ÚÍþÃôø椆J.X\h ðÝî††Ü 7+­)ôoRMíCT¿°×~‡¯Ôß øôNêió Ñ<9÷y°Ž4Ηp–†›”¢üxÇñÌ{0Ã^C¾2ÒMÐÛ»h㪃´¨Î׶LÍcí«É·ÐŽ'h¡“ãÆ©ò>P1h¯où`WûŽìƒÙAëÆR˜_bè° . Px M'(²gÅi1ö“UÉHÒbPc_µö4zpßkÔ¸â9´ðõ É`ã9Û¿kHõøêÈ„ÈÐ~ª_¼/ÃQý^{GicÆÒ=x!ApIHý°Â¹$TC>ýå„úõ-_ÆÛDs¢2`§xr±æyÖVø¬·@á1“ùŒ\S‘IA93Z=zù¹›Kš #0Õ€¦Ñ¾Œ½^î¹2!5÷sèׇÉ?ãY©Ü3ò T¹;™Ü³#›²`*‚(\'1 ‘Oa!@æòO‚m>™D%Hm=o¤“8 Æ‚Ͳö‚b«;jM€€cø€@S.àtMLÊï%íô©ð…çyé´‰ùÝW¾iÛ €•“ó\ ÉX.¼üÀ47.oA”Û ð^‚JLLÿ>èæ‘k–E Ƨݔg- »¿Ê¹N%t€°'¤RÊCº‰è‡hbÙ°= ^_ #ƒ»:€ãYw©zögx+ø⃔Ÿ¥ƒ{Û)\ò6\ŽÉÐÚì’|í׃'˃}´4r±a?ÛŽnª\·þàz˜Z!øîƒ5Ÿâ‰¢Zëy5^æý¾zÀvYØW­^Çs¿…*'´’\Û`¶ÓÆ/ï ÀÍ@ã럗¯á ^_î™ñEdËJð™J•k«hãò_ó[1‚Pòc^¢0T€Ü,Ö”êìÈášK<üÄü¹¯–Öoù¦‘›{¯Ð5Ýé?XèJ=o{ͼ­á­`ñ-Dÿ1UÈ)06 r† ÕÓ)5IXç¤÷êáH·´Fª§³?9¶`/¡™öVÙÈÍ™¹y”ìØ÷:GÚàýv¨pìyZØêézK¸a¨<[sÉ‹H%ý|n†¦eM„t 0 \8C‰ß `û]icë4°SÀ©«(RXo¦¸‘PÁx¥|¬ÞžOí‹”ØR{k†RÉ¿…ÆŽ×BáIwíòœÚ–‹_Z9·ì d®,ob²/¢ƒ¢y?A  ¢ðoÕÚ¯€è $ÒQ^ƒÝÏ(f‚þXˆ‡˜Jeþ…~!-Zw>ä&(Z€>}Q€Ê(óôñƒÜ›Ý@ý/ÞJÕq5Æ@bóáÖ>ˆ”uøœq‹ªïY n¤PÎ8¥Ñ9ïË[ÌEÓÒƒ/c^ßó+à†°e<¶$Õèrè&ä[ÿGUf'ü3 ]Tw&º~WÉÞ Ïß9ÊrT­ü£Qb<É}¼tä]ݺÌêï A!¹¦!vs=´­VWçˆþáþzHRï¤æš… EgÙý§Ã @e‹H8ê)¿Fæv:Øý0€ã¡ûŠ ÿ™òÞVz£äK˜àl.Xï¡ß/)ÑÓ€Vøæ^»¢åW¥êMž¼¡§ÚYŒ>0´:¢ÁG“¿¢þ÷w°laªYó¢°9[×ë¢ùJ𼯕…ÖŠ1®P`J‘+@Ò™KÃÒ§hÉ=øHdðrèŸÏB6@3Š ÷ÉÁ—NiëQjRÚyo D÷v´!ýMÁ¼Øo”Zäú&ÞýEõe ƒÀ¿Ïúëé0×hÞ"¶† ø|€ì Ì æÏ…·²Dü€:ÖÚêE ·ƒ­²$šÝÅ< A›¿‘ñÓ0ƒ#”Ghñ«¸sjlŽV2'ðh4#Úâ0ÇqßG;Ôrh>˜7ËíÂËPuÌ# >ǘˆ03,†;\õÑnÏÚGcàS2¿Îã¨ë=EÊóær9gxð›))×";à„ƒ½¦Ò8‡É‘ù¨U yó2óçG|@@†Áw‰œÇq³ŒWv°›LDuVot«º¶§ŸöF°b³Ô;‹ÛÀ!¼!œ­SîÉÜFmj"ÅÓ:e简G †(ÚŸì,DM2ûceÅ{x£mxlð-ŸðAÏãl²Ëÿ°£b¾«DáO 4„@.Tgžþœ9Ýà+okƒí8|.j-<&ÖÈE¥¨˜oLùó/‡&Ì>œ³Î‘7·ñ)|Ïe$­ªÄΔÇu*ž&gÊÑ3óçºìÂ|¸Niäl…ñ.Üžõÿ‹Ô\yÜgõjŸ+”‘ßfÖôacfóÌžSæžû+?µnbºŠ÷J4_ºHiL5r°Öš ›Ü¢aP«ÛàWÜ{ Ïc‹ñÁô£ª=# òûŒþ•ÀG–@¬™ŽÕkOÁ-üMq:~ùÅÌDüábg8ƒ7ö\â=¾oÁ7x-;®¾ŠÏß_FòÎÔþŽJàãIÚ­ ëh…i2ÖçÃèÑd@­(ÿztî-iµ5lIEND®B`‚freeradius-3.2.10+dfsg/doc/antora/modules/ROOT/nav.adoc000066400000000000000000000001031522352605200225410ustar00rootroot00000000000000* xref:index.adoc[Introduction] ** xref:radiusd_x.adoc[radiusd -X] freeradius-3.2.10+dfsg/doc/antora/modules/ROOT/pages/000077500000000000000000000000001522352605200222325ustar00rootroot00000000000000freeradius-3.2.10+dfsg/doc/antora/modules/ROOT/pages/directories.adoc000066400000000000000000000047031522352605200254020ustar00rootroot00000000000000= Directories The directories in the server source are laid out ad follows: == Documentation [width="100%",cols="50%,50%",options="header",] |=== | Directory | Description | `doc/` | Various snippets of documentation. | `doc/introduction/` | Concepts and introduction to FreeRADIUS. | `doc/raddb/` | HTML versions of the configuration files. | `doc/developers/` | Developer documentation for internal APIs | `doc/unlang/` | The unlang processing language. | `doc/upgrade/` | How to upgrade from version 3 to version 4. | `doc/rfc/` | Copies of the RFC’s. If you have Perl, do a `make` in that directory, and look at the HTML output. | `doc/antora/` | Metadata and documentation source files to build an Antora based documentation site. | `doc/doxygen/` | Files to build a Doxygen site from the source code. | `man/` | Unix Manual pages for the server, configuration files, and associated utilities. |=== == Utility [cols=",",options="header",] |=== |Directory | Description | `mibs/` | SNMP Mibs for the server. | `scripts/` | Sample scripts for startup and maintenance. |=== == Configuration [width="100%",cols="50%,50%",options="header",] |=== | Directory | Description | `raddb/` | Sample configuration files for the server. | `raddb/mods-available` | Module configuration files. | `raddb/mods-enabled` | Directory containing symlinks to `raddb/mods-available`. Controls which modules are enabled. | `raddb/sites-available` | Virtual servers. | `raddb/sites-enabled` | Directory containing symlinks to `raddb/sites-available`. Control which virtual servers are enabled. |=== == Packaging [cols=",",options="header",] |=== |Directory | Description | `debian/` | Files to build a `freeradius` Debian Linux package. | `redhat/` | Additional files for a RedHat Linux system. | `suse/` | Additional files for a SuSE (UnitedLinux) system. |=== == Source [cols=",",options="header",] |=== |Directory | Description | `src/` | Source code. | `src/bin/` | Source code for the daemon and associated utilities. | `src/lib/` | Source code for various utility libraries. | `src/include/` | Header files. | `src/protocols/` | Dynamic frontend plug-in modules. | `src/modules/` | Dynamic backend plug-in modules. |=== freeradius-3.2.10+dfsg/doc/antora/modules/ROOT/pages/index.adoc000066400000000000000000000147061522352605200242010ustar00rootroot00000000000000= Introduction This is the documentation for FreeRADIUS, version 3. The documentation is available under the Creative Commons Non-Commercial license, as given in the `LICENSE` file in this directory. FreeRADIUS is a complex piece of software with many configuration options. However, we have taken great care to make the default configuration work in most circumstances. The result is that for most simple systems, it is easy to install and configure the server. For those situations, this documentation will serve to answer basic questions about functionality, configuration, etc. For more complex requirements, FreeRADIUS can be difficult to configure. The reason for this difficulty is that the server can do almost anything, which means that there are a near-infinite number of ways to configure it. The question for an administrator, then, is what piece of the configuration to change, and how to change it. This documentation will answer those questions. The FreeRADIUS team has put substantial effort into writing the documentation for this release. Everything in the server is fully documented, and there are many `Howto` guides available. include::ROOT:partial$externaldoc.adoc[] The documentation is split into sections by subject area, oganized by desired outcome. At a high level, the subject areas describe: * xref:installation:index.adoc[Install and Upgrade] Guides. * xref:concepts:index.adoc[Concepts] provides an high level explanation for newcomers . * The syntax of the xref:unlang:index.adoc[Unlang] Policy Language. * The https://github.com/FreeRADIUS/freeradius-server/tree/v3.2.x/raddb[configuration files] located in `/etc/raddb/`, or `/etc/freeradius/`. * Various xref:howto:index.adoc[Howto Guides] gives step-by-step instructions on how to complete tasks. * xref:developers:index.adoc[Developers] documentation outlines coding standards, raising defects, and using GitHub. This organization means that for example, the `ldap` module has documention located in multiple places. We feel that organizing the documentation by desired *goal* is better than the alternatives. Within each section, the documentation is split into small pages, which are generally no more than a few screens worth of information. We feel that having multiple small pages with cross-links is more helpful than having a smaller number of enormous pages. This division ensures that (for example) the `Howto` guides are split into a series of small steps, each of which can be performed quickly. We hope that this extended documentation will address any lingering concerns about the quality of the FreeRADIUS documentation. == Changes From Earlier Versions Administrators who have version 2 and wish to upgrade to version 3 should read the xref:installation:upgrade.adoc[Upgrade to v3] documentation. That documentation explains the differences between the two versions, and how an existing configuration can be reproduced in the latest release. We do *not* recommend using version 2 configuration files with version 3. The configuration files are *not* compatible across a major version upgrade. == Getting Started with FreeRADIUS FreeRADIUS can be installed using the pre-built packages available from https://packages.inkbridgenetworks.com/[InkBridge Networks]. That page contains packages for all common OS distributions. New packages are available as soon as a new version has been released. Packages for older releases are also available for historical purposes. FreeRADIUS can also be installed from the source code. Please see the xref:installation:index.adoc[Installation Guide] for instructions. [WARNING] ==== Many Operating System distributions ship versions of FreeRADIUS which are years out of date. Those versions may contain bugs which have been fixed in newer releases. We recommend using the https://packages.inkbridgenetworks.com/[InkBridge Networks] packages where possible. ==== Administrators who are new to FreeRADIUS should read the xref:concepts:index.adoc[Concepts] section as it describes the key components behind FreeRADIUS. It is vital for newcomers to understand these concepts, as the rest of the documentation assumes familiarity with them. A detailed xref:unlang:index.adoc[Unlang] reference guide is also available. This section describes the syntax and functionality of the keywords, data types, etc. used in the `unlang` processing language. All of the https://github.com/FreeRADIUS/freeradius-server/tree/v3.2.x/raddb[configuration files] are available in GitHub. For specific problem solving, we recommend the xref:howto:index.adoc[Howto] guides. These guides give instructions for reaching high-level goals, or for configuring and testing individual https://github.com/FreeRADIUS/freeradius-server/tree/v3.2.x/doc/modules[modules]. There is also xref:developers:index.adoc[Developers] documentation. This section documents the APIs for developers. Most people can bypass this section. == Debugging If you have ANY problems, concerns, or surprises when running the server, the the server should be run in debugging mode as root, from the command line: ``` # radiusd -X ``` It will produce a large number of messages. The answers to many questions, and the solution to many problems, can usually be found in these messages. When run in a terminal window, error messages will be shown in red text, and warning messages will be shown in yellow text. For other use-cases, please look for `ERROR` or `WARNING` in the debug output. In many cases, those messages describe exactly what is going wrong, and how to fix it. For further details, about the debug output see the refer to the https://www.freeradius.org/documentation/freeradius-server/3.2.8/radiusd_x.html[debug output] page on the http://www.freeradius.org[freeradius org] website. == Getting Help We also recommend joining the http://lists.freeradius.org/mailman/listinfo/freeradius-users[mailing list] in order to ask questions and receive answers. The developers are not on Stack Overflow, IRC, or other web sites. While the FreeRADIUS source is available on https://github.com/FreeRADIUS/freeradius-server/[GitHub, window="_blank"], questions posted there will not be answered. Before posting to the list, please read the https://www.freeradius.org/documentation/freeradius-server/3.2.8/radiusd_x.html[debugging] page. That page explains how to run the server in debugging mode; how to understand the debug output; and what information to post to the list. Commercial support for FreeRADIUS is available from https://packages.inkbridgenetworks.com/[InkBridge Networks]. freeradius-3.2.10+dfsg/doc/antora/modules/ROOT/pages/radiusd_x.adoc000066400000000000000000000644121522352605200250530ustar00rootroot00000000000000# `radiusd -X` This page explains How to use how use `radiusd` in debug mode and how to read the output of `radiusd -X` (debug mode). The first part of the debug output is the *startup* text. Once the server is started, it prints `Ready to receive requests`. The next part of the debug output is the *packet processing* text. Both parts need to be read (and posted to the list!) in order to solve issues. ## If it doesn't start If the server does not start up correctly, *the debug output will tell you why*. It will produce long descriptive error messages, telling you exactly what's wrong. In some cases, it will tell you how to fix it. Look for messages like *Error* or *Warning*. If you are running the server in a terminal console, those messages will appear in red or yellow. It should be simple to scroll through the output, ignoring most of it, and looking for red *Error* text. Fixing those errors will usually allow the server to start correctly. ## Startup text We start the server with `-X`. This option gives us the best combination of useful output, and readable output. Adding more `-x` gives *more complex output*, not *more useful output*. $ radiusd -X 2>&1 | tee debugfile The server prints out the version number, copyright, and license information: FreeRADIUS Version 3.0.17 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Next, it prints out messages relating to debuggers (e.g. gdb). These messages are intended for developers, and can generally be ignored by everyone else. Getting debug state failed: ptrace capability not set. If debugger detection is required run as root or: setcap cap_sys_ptrace+ep ### Reading the configuration files The next block of messages is about the configuration files. The server prints out the name of each configuration file it loads. This output lets you check that the server is loading the files which you think it's loading. One common issue is that people install multiple versions of the server, and then edit one file while the server is loading a different one. Reading the debug output will let you verify that you're editing the right file. Starting - reading configuration files ... It then reads the dictionaries. It does not print out the name of every dictionary file it reads, as there are over 100 files, but they are never the less still loaded. including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary Next is loads the main `radiusd.conf` file, and some associated ones like `proxy.conf` and `clients.conf` including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf It now loads all of the modules. The module configuration is usually stored in `raddb/mods-enabled/`, with one module configuration per file in that directory. Sometimes the module you're using does not seem to be loaded or used. In that case, you should check this section to see that the file is loaded. including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/date including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/replicate Next, some policies are loaded. These policies are ones which the server uses (for example) to canonicalize user names, and to do things like attribute re-writes, sanity checks, etc. including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/moonshot-targeted-ids including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/abfab-tr including configuration file /etc/raddb/policy.d/operator-name including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/accounting including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel ### Server Configuration Once all of the configuration files are loaded, the server prints out the configuration it is parsing. Note that it *only prints out what it is using*. I.e. you can put `foo = bar` into `radiusd.conf`, and the server will load it, but will not print it out in the debug output. The result is that if you set a configuration item, *it will be printed out in the debug output*. You should verify that this is the case, especially if it looks like the server is not using the setting you edited. If the configuration item does not appear in the debug output, *then the server is not using it.* This is the "main" server configuration: main { name = "radiusd" Which directories the server is using, prefix = "/" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib" radacctdir = "/var/log/radius/radacct" Next we have some generic configuration settings which don't belong anywhere else. hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/sbin/checkrad" debug_level = 0 proxy_requests = yes And the logging configuration. log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } The security settings. security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "yes" } } At this point, the server is well on it's way to running. ### Proxy Configuration The server now loads its proxy configuration, as was defined in `proxy.conf`: radiusd: #### Loading Realms and Home Servers #### The over all proxy configuration is loaded. proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } Followed by `home_server` configurations. home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } Followed by `home_server_pool` configurations. home_server_pool my_auth_failover { type = fail-over home_server = localhost } Followed by `realm` configurations. realm example.com { auth_pool = my_auth_failover } realm LOCAL { } realm int { virtual_server = inner-tunnel } ### Clients It now loads individual clients: radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } ### Auth-Type The server then creates `Auth-Type`, as set in the virtual servers. These `Auth-Type` names and values are used by the modules, so they need to be created now. # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP ### Modules When the server read the module configuration file above (from `raddb/mods-enabled`), that meant just reding the contents of the file. It is now ready to load the dynamic library which reads that configuration, and which parses the configuration to determine what to do with it. Each module will print out it's configuration, along with any errors or warnings it sees when it is loading itself. radiusd: #### Instantiating modules #### modules { Here is loads the `pap` module. There are multiple lines being printed at each stage of the process. First, it discovers it has to load the `pap` module, and decides to do that. # Loaded module rlm_pap Second, it tells you which files is used to read the `pap` module configuration. # Loading module "pap" from file /etc/raddb/mods-enabled/pap Finally, it prints out the configuration that is used by the `pap` module. pap { normalise = yes } When you are editing a module configuration, it is good to check the debug output for that module, to see: * was the module loaded? * is it using the file you edited? * are the configuration changes you made showing up in the debug output? Some modules like `expiration` do not have any configuration items, and therefore don't print out any configuration when they are loaded. # Loaded module rlm_expiration # Loading module "expiration" from file /etc/raddb/mods-enabled/expiration This module loads the `users` file. # Loaded module rlm_files # Loading module "files" from file /etc/raddb/mods-enabled/files files { filename = "/etc/raddb/mods-config/files/authorize" acctusersfile = "/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy" } The server loads a large number of modules, so we will omit them here. Finally, it is done loading all modules, and prints this: } # modules ### Virtual Servers Next, it loads "virtual servers". radiusd: #### Loading Virtual Servers #### It prints out the server, and name, along with which file it was loaded from. server default { # from file /etc/raddb/sites-enabled/default It then double-checks the various processing sections. # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} The `sql` module is in the default configuration, even if the `sql` module is not enabled. This warning message is then printed out. It can be ignored, or, in a production environment where you don't use `sql`, you can just remove references to `sql` from the virtual servers. Ignoring "sql" (see raddb/mods-available/README.rst) # Loading post-proxy {...} # Loading post-auth {...} } # server default server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} # Loading session {...} # Loading post-auth {...} In some situations, it tells you where the configuration can be simplified. # Skipping contents of 'if' as it is always 'false' -- /etc/raddb/sites-enabled/inner-tunnel:335 } # server inner-tunnel ### Listen Sections After loading all of the virtual servers, it then opens the various network sockets used to read and write packets. radiusd: #### Opening IP addresses and Ports #### First, it prints out the configuration for the listen sections. listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } After reading all of the configuration, it opens the ports, and prints out a list of IP addresses and ports which it is using. Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on proxy address * port 39556 Listening on proxy address :: port 52609 And we finally get to this line. Ready to process requests Once this has been printed, the debug output changes to packet processing. Note that if *nothing* is ever printed after this line, then the server is not receiving any packets. No amount of changing the server configuration will solve that problem. Instead, you must fix the firewall, SeLinux configuration, network routing, etc. so that the OS delivers RADIUS packets to the server. ## Packet Processing Each line (or most of them) of the packet processing output starts with a request number, e.g. `(0)`. This number lets you track debug messages which are all for one packet. Messages from different packets may be inter-mingled, due to threading or proxying. Prefixing the messages with a number allows the messages to be easily differentiated. ### Receiving a packet The first message for a packet tells you what type of packet was received, what it's RADIUS ID is, and the source / destination IP / port information. (0) Received Access-Request Id 104 from 127.0.0.1:33278 to 127.0.0.1:1812 length 73 After that, it prints out all of the attributes which were received in the packet. (0) User-Name = "bob" (0) User-Password = "wrongpassword" (0) NAS-IP-Address = 127.0.1.1 (0) NAS-Port = 0 (0) Message-Authenticator = 0x3d27116b37323e4f629b4e8217fc25c8 Note that if an attribute is not printed here, then *it does not exist*. If you need the packet to contain an attribute, then you must **fix the NAS** so that the NAS sends the attribute. Once the packet is received, it is run through the various processing sections of the server. For Access-Request packets, these are `authorize`, `authenticate`, and `post-auth`. (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { The `authorize` section contains a number of modules, along with unlang keywords like `if`, `update`, etc. Each module prints out what it is doing, and why. For example, the `suffix` module here is looking for `User-Name` attributes which contain `user@domain`. (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "bob", looking up realm NULL (0) suffix: No such realm "NULL" The server core then prints out the "return code" of the module. See `man unlang` for a deeper explanation of return codes. (0) [suffix] = noop (0) [files] = noop The `authorize` section also has a return code. (0) } # authorize = noop In this case, the user is unknown, so they will be rejected. (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user The packet is processed through the `Post-Auth-Type REJECT` section (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { That section contains more modules and unlang statements. Here, the `attr_filter` module is removing attributes which are forbidden from appearing in an Access-Reject packet. (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> bob (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop Finally, the `Post-Auth-Type REJECT` section is done. (0) } # Post-Auth-Type REJECT = updated Since this is an Access-Reject, it is delayed for one second to prevent password attacks. The `reject_delay` configuration above control this delay. (0) Delaying response for 1.000000 seconds The server then sleeps for a while, waking up periodically to deal with internal book-keeping. Waking up in 0.3 seconds. Waking up in 0.6 seconds. Finally after a one-second delay, the server wakes up and sends the Access-Reject packet. (0) Sending delayed response The IP / port printed here is the mirror of the one printed for the Access-Request, above. This indicates that it's a reply to an earlier request. (0) Sent Access-Reject Id 104 from 127.0.0.1:1812 to 127.0.0.1:33278 length 20 If there are any attributes in the reply packet, they will be printed here. In this case, there are non. Note that you **should** check the reply attributes to see if the server is sending the reply you expect. If it is not sending the correct reply. you will need to fix the configuration to do so. If it is sending the correct reply, but the user is not getting the expected service, then the problem is the NAS. No amount of changing the server configuration will make the NAS behave. The server then sleeps for a while: Waking up in 3.9 seconds. And then cleans up the request and it's associated response. This delay is controlled by `cleanup_delay`, which was seen earlier in the debug output. (0) Cleaning up request packet ID 104 with timestamp +23 Since there's nothing more to do, we're back to this message. Ready to process requests The debug log has another packet, which we will skip, as it's largely the same as the previous one. (1) Received Access-Request Id 146 from 127.0.0.1:40967 to 127.0.0.1:1812 length 73 (1) User-Name = "bob" (1) User-Password = "wrongagain" (1) NAS-IP-Address = 127.0.1.1 (1) NAS-Port = 0 The debug log then shows a successful authentication. The input packet is largely the same, but has a different `User-Name` and `User-Password` attribute. (2) Received Access-Request Id 135 from 127.0.0.1:40344 to 127.0.0.1:1812 length 77 (2) User-Name = "bob@int" (2) User-Password = "test" (2) NAS-IP-Address = 127.0.1.1 (2) NAS-Port = 0 The `Message-Authenticator` attribute is a cryptographic signature of the packet, and has no other meaning. (2) Message-Authenticator = 0x3b3f4cf11005dcccfe78bb4a5830dd52 We start the `authorize` section again/ (2) # Executing section authorize from file /etc/raddb/sites-enabled/default (2) authorize { This time the `suffix` module does find a suffix. (2) suffix: Checking for suffix after "@" (2) suffix: Looking up realm "int" for User-Name = "bob@int" The realm `int` is defined above in the `realm` configuration. (2) suffix: Found realm "int" The `suffix` module splits the `User-Name` into a `Stripped-User-Name` and `Realm` attributes. The `Stripped-User-Name` is used by subsequent modules to match the user's name. (2) suffix: Adding Stripped-User-Name = "bob" (2) suffix: Adding Realm = "int" (2) suffix: Proxying request from user bob to realm int (2) suffix: Preparing to proxy authentication request to realm "int" (2) [suffix] = updated (2) [files] = noop (2) } # authorize = updated (2) Starting proxy to home server (null) port 1812 This configuration has been changed from the default configuration to proxy packets to the `inner-tunnel` virtual server. This change was done here strictly for demonstration purposes. It is not necessary (and you should not do it!) in normal configurations. Proxying to virtual server inner-tunnel (2) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (2) authorize { The `files` module matches the user name and realm, at `line 1` of the `users` file. This output lets you know exactly which entry was matched. If the server does not do what you expect it to do, you should read `line 1` of the `users` file (or whatever entry matched), to verify that the entry is what you expect it to be. (2) files: users: Matched entry bob@int at line 1 (2) [files] = ok The `pap` module sees the `Cleartext-Password` which was set in the `users` file, along with the `User-Password` that came from the packet. The module then sets `Auth-Type := PAP`. This is so that the `authenticate` section will run the `pap` module, which will then authenticate the user. (2) [pap] = updated (2) } # authorize = updated It now runs `Auth-Type PAP` (2) Found Auth-Type = PAP (2) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (2) Auth-Type PAP { The `pap` module tells you that everything is OK. (2) pap: Login attempt with password (2) pap: Comparing with "known good" Cleartext-Password (2) pap: User authenticated successfully (2) [pap] = ok (2) } # Auth-Type PAP = ok It now runs the normal `post-auth` section (2) # Executing section post-auth from file /etc/raddb/sites-enabled/inner-tunnel (2) post-auth { (2) update reply { (2) Reply-Message := "hello" (2) } # update reply = noop (2) if (0) { (2) if (0) -> FALSE (2) } # post-auth = noop (2) Finished internally proxied request. (2) Clearing existing &reply: attributes Because this is a proxied request, it now runs the `post-proxy` section of the `default` virtual server. (2) # Executing section post-proxy from file /etc/raddb/sites-enabled/default (2) post-proxy { (2) policy debug_reply { (2) if ("%{debug_attr:reply:}" == '') { (2) Attributes matching "reply:" (2) EXPAND %{debug_attr:reply:} (2) --> (2) if ("%{debug_attr:reply:}" == '') -> TRUE (2) if ("%{debug_attr:reply:}" == '') { (2) [noop] = noop (2) } # if ("%{debug_attr:reply:}" == '') = noop (2) } # policy debug_reply = noop (2) } # post-proxy = noop This `Auth-Type = Accept` is added by the server code when proxying. Since the proxied request returned an Access-Accept, the `default` virtual server treats that as a successful authentication. (2) Found Auth-Type = Accept (2) Auth-Type = Accept, accepting the user It then runs the `post-auth` section from the `default` virtual server. (2) # Executing section post-auth from file /etc/raddb/sites-enabled/default (2) post-auth { (2) update { (2) No attributes updated (2) } # update = noop (2) [exec] = noop (2) policy remove_reply_message_if_eap { (2) if (&reply:EAP-Message && &reply:Reply-Message) { (2) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (2) else { (2) [noop] = noop (2) } # else = noop (2) } # policy remove_reply_message_if_eap = noop (2) } # post-auth = noop And finally returns an Access-Accept to the client. The `Reply-Message` here was take from `line 1` of the `users` file, when it matched above. (2) Sent Access-Accept Id 135 from 127.0.0.1:1812 to 127.0.0.1:40344 length 0 (2) Reply-Message := "hello" (2) Finished request Waking up in 4.9 seconds. (2) Cleaning up request packet ID 135 with timestamp +74 Ready to process requests ^C That is a *lot* of information to go through. We hope that this page has been useful. freeradius-3.2.10+dfsg/doc/antora/modules/ROOT/partials/000077500000000000000000000000001522352605200227525ustar00rootroot00000000000000freeradius-3.2.10+dfsg/doc/antora/modules/ROOT/partials/externaldoc.adoc000066400000000000000000000005521522352605200261140ustar00rootroot00000000000000[NOTE] ==== Some of the information on this page is located on external sites. You may be redirected to https://github.com/FreeRADIUS[FreeRADIUS Project GitHub], https://www.freeradius.org/[FreeRADIUS org], or the https://www.inkbridgenetworks.com/[InkBridge Networks] websites. Other external references may also be used such as vendor or technical sites. ==== freeradius-3.2.10+dfsg/doc/antora/modules/ROOT/partials/mailinglist.adoc000066400000000000000000000023341522352605200261200ustar00rootroot00000000000000Please see the following for a description of the FreeRADIUS mailing lists. For normal discussion of the server and how to use it, subscribe to the FreeRADIUS user-list. Only subscribe to the development list if you are interested in writing software for the new server. [cols="1,3"] |=== |Mailing List|Description |mailto:freeradius-announce@lists.freeradius.org[freeradius-announce] |Announcements about FreeRADIUS, including new versions and security issues, are made here. |mailto:freeradius-users@lists.freeradius.org[freeradius-users] |This list is for all users of FreeRADIUS and deals with general questions related to FreeRADIUS. |mailto:freeradius-devel@lists.freeradius.org[freeradius-devel] |This list is for developers who are writing code for FreeRADIUS. The content is highly technical and is not suited to the average user. If you looking to contribute code, please join this list. |https://lists.freeradius.org/pipermail/freeradius-users/[User Mailing List Archive] |An archive of all previous posts and emails from the users' email list. |https://lists.freeradius.org/pipermail/freeradius-devel/[Developer Mailing List Archive] |An archive of all previous posts and emails from the developement users' email list. |=== freeradius-3.2.10+dfsg/doc/antora/modules/concepts/000077500000000000000000000000001522352605200221665ustar00rootroot00000000000000freeradius-3.2.10+dfsg/doc/antora/modules/concepts/images/000077500000000000000000000000001522352605200234335ustar00rootroot00000000000000freeradius-3.2.10+dfsg/doc/antora/modules/concepts/images/request_flow.svg000066400000000000000000001020051522352605200266710ustar00rootroot00000000000000 Produced by OmniGraffle 6.2 2015-04-15 01:50:58 +0000Canvas 1Railroadmodule xmodule yserver {}Post-Proxy-Type Fail {}Authenticate {}module zAuth-Type z {}Listener proto aAuthor Arran Cudbard-BellCopyright 2014-2015 The FreeRADIUS projectCreative commons license CC BYAuth-Type y {}Auth-Type x {}Post-Proxy {}Listener proto aRequest flow FreeRADIUS 2.2.x-3.0.xPost-Auth-Type Reject {}Post-Auth {}Reject path is followed if the rcode set for a section when the request leaves, is not ok or updatedPre-Proxy-Type x {}Pre-Proxy-Type z {}Pre-Proxy-Type y {}Autz-Type a {}Autz-Type b {}Autz-Type c {}Pre-Proxy {}Authorize {} freeradius-3.2.10+dfsg/doc/antora/modules/concepts/nav.adoc000066400000000000000000000017431522352605200236070ustar00rootroot00000000000000* xref:index.adoc[Concepts] ** xref:overview.adoc[Overview] *** xref:freeradius.adoc[What is FreeRADIUS?] *** xref:aaa/aaa.adoc[Authentication Authorization Accounting (AAA)] **** xref:aaa/authz.adoc[Authorization] **** xref:aaa/authn.adoc[Authentication] **** xref:aaa/acct.adoc[Accounting] *** xref:components/architecture.adoc[RADIUS System Components] **** xref:components/nas.adoc[Network Access Server (NAS)] **** xref:components/radius_servers.adoc[RADIUS Server] ***** xref:components/radius_servers.adoc#policy[Server Policies] **** xref:components/datastore.adoc[Datastores] *** xref:session/radius_session.adoc[RADIUS Sessions] **** xref:session/radius_session_msg.adoc[Messages] **** xref:session/processing.adoc[Processing] ** xref:protocol/authproto.adoc[Protocols] ** xref:modules/ldap/authentication.adoc[Authentication with LDAP] *** xref:modules/ldap/password_storage.adoc[Password Storage] *** xref:modules/ldap/novell.adoc[Integrate Novell] ** xref:resources.adoc[Resources] freeradius-3.2.10+dfsg/doc/antora/modules/concepts/pages/000077500000000000000000000000001522352605200232655ustar00rootroot00000000000000freeradius-3.2.10+dfsg/doc/antora/modules/concepts/pages/aaa.adoc000066400000000000000000000045071522352605200246450ustar00rootroot00000000000000= AAA == Authorization, Authentication, and Accounting request handling There are a lot of questions about misconfigured FreeRADIUS servers because of misunderstanding of FreeRADIUS operations. This document explains how the server operates. Normally there are two steps in processing an authentication request coming from a NAS in FreeRADIUS: authorization and authentication. If we use FreeRADIUS as a proxy to re-send the request to another RADIUS server there will be additional steps. === Authorization Authorization is the process of finding and returning information about what the user is allowed to do. For example, finding out what kind of authentication methods they are allowed to run, and what VLAN the user should be placed into. Authorization modules generally "get data" from somewhere, e.g. `ldap`, `sql`, `files`, etc. The authentication method is usually determined when the server gets the users credentials from a database. Once the credentials are available, the server can authenticate the user. === Authentication Authentication is simply a process of comparing user’s credentials in request with the "known good" credentials retrieved from a database. Authentication usually deals with password encryption. The modules `pap`, `chap`, `mschap`, etc. do authentication. Some modules do both authentication and limited authorization. For example, the `mschap` module authenticates MS-CHAP credentials, but it may also be used as an authorization module, which verifies that request contains `MS-CHAP` related attribute. If so, the module instructs the server to use `mschap` for authentication, too These dual modules are usually related to protocol-specific attributes, such as the `pap` module for the `User-Password` attribute, `chap` for `CHAP-Password`, `mschap` for `MS-CHAP-*`, etc. === Request Processing When the server processes requests, it manages four xref:unlang:list.adoc[attribute lists]: `request`:: attributes taken from the received packet `reply`:: attributes which will be sent in the reply `control`:: attributes used to control how the server operates. These are never sent in a packet `session-state`:: attributes which are saved and restroed across multiple request / reply exchanges. All of these lists are available to all modules. All of these lists are available in xref:unlang:index.adoc[Unlang]. freeradius-3.2.10+dfsg/doc/antora/modules/concepts/pages/aaa/000077500000000000000000000000001522352605200240075ustar00rootroot00000000000000freeradius-3.2.10+dfsg/doc/antora/modules/concepts/pages/aaa/aaa.adoc000066400000000000000000000074151522352605200253700ustar00rootroot00000000000000= Authorization, Authentication, and Accounting (AAA) RADIUS is one of a number of Authentication, Authorization, and Accounting (AAA) protocols. Other examples of AAA protocols include TACACS+ and Diameter. AAA defines an architecture that authenticates and grants Authorization to users and accounts for their activity. When AAA is not used, the network architecture is "open", where anyone can gain access and do anything, without any tracking. The open network architecture is commonly used in small businesses, where access to an office can be physically controlled. The open network architecture is poorly suited to ISPs, where access needs to be strictly controlled and accounted for. It is possible to incorporate only a portion of AAA in a system. For example, if a company is not concerned about billing users for their network usage, they may decide to both authenticate and authorise users, but ignore user activity and not deal with accounting. Similarly, a monitoring system will look for unusual user activity (accounting), but may delegate the authentication and Authorization decisions to another part of the network. Without AAA, a network administrator would have to statically configure a network. Even in the earliest days of dialup access, network administrators found a static model inadequate. AAA ensures the flexibility of network policies. AAA also gives network administrators the ability to move systems; without AAA, they would have to clearly define connectivity options. Today, the proliferation of mobile devices, diverse network consumers, and varied network access methods combine to create an environment that places greater demands on AAA. AAA has a part to play in almost all the ways we access a network: wireless hotspots use AAA for security; partitioned networks require AAA to enforce access; all forms of remote access use AAA to authorise remote users. The following sections describe each part of the AAA solution, and how each one works. == AAA request handling AAA request handling refers to the process by which a system manages xref:aaa/authn.adoc[authentication], xref:aaa/authz.adoc[Authorization], and xref:aaa/acct.adoc[accounting] (AAA) services for users accessing computer resources or network services. This process involves verifying user identities, granting access based on permissions, and tracking their activities for auditing or billing purposes. Normally there are two steps in processing an authentication request coming from a NAS in FreeRADIUS: Authorization and authentication. If we use FreeRADIUS as a proxy to re-send the request to another RADIUS server there will be additional steps. === Authentication vs. Authorization The following analogy illustrates the difference between Authentication and Authorization: Imagine you are driving a car and you are stopped by a police officer. The officer asks you to provide a piece of identification to identify yourself. You could, for example, use your passport, driver’s license, or ID card to prove or *authenticate* who you are. In terms of the RADIUS protocol, the authentication process identifies the user as someone who is allowed to access the network. The police officer may also ask you to prove that you are authorized to drive. In this case, there is only one document - a driver’s license - that proves that you are permitted or *authorized* to drive a car. The Authorization process combines the policy on the RADIUS server and the information in the request from the NAS. The NAS may add additional information to the request, such as the user’s Media Access Control (MAC) address. The NAS sends the information to the server, where an Authorization decision is made. // Copyright (C) 2025 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/concepts/pages/aaa/acct.adoc000066400000000000000000000026771522352605200255650ustar00rootroot00000000000000= Accounting Accounting refers to the recording of resources a user consumes during the time they are on the network. The information gathered can include the amount of system time used, the amount of data sent, or the quantity of data received by the user during a session. During a network session, the NAS periodically sends an accounting of user activity to the server. This accounting is a summary, and the collected data is used for billing purposes. ISPs are a large consumer of accounting data, because each user is billed for every minute of network access. However, corporations have not, historically, relied on network accounting information gathered by RADIUS because employees were not traditionally billed for network access. As their need for ongoing network monitoring increases, though, so does the need to store and process accounting information. The accounting summary sent by the NAS to the server does not include detailed information such as web sites visited or even how many bytes were transferred using a particular protocol (SMTP, HTTP, and so forth). That type of detailed information is only available to the NAS, and it does not send that data to the server. If detailed information about user activity is required, network administrators can obtain it through other protocols such as sFlow or NetFlow. Network administrators may find it difficult to tie the pieces together to get a more comprehensive understanding of user activity. freeradius-3.2.10+dfsg/doc/antora/modules/concepts/pages/aaa/authn.adoc000066400000000000000000000035071522352605200257630ustar00rootroot00000000000000= Authentication Authentication refers to the process of validating the identity of the user by matching the credentials supplied by the user (for example, name, password) to those configured on the AAA server (for example, name, password). If the credentials match, the user is authenticated and gains access to the network. If the credentials do not match, authentication fails, and network access is denied. Authentication can also fail if user credentials are entered incorrectly. For example, site policy may allow a user network access from an on-site location using a cleartext password. However, if the same password is entered by the user from a remote location, access may be denied. An ISP can also choose to deny network access to authenticated users if the users’ account has been suspended. An administrator can choose to permit limited network access to unknown users, as well. For example, an administrator can provide access to an area where the user can purchase additional network connectivity. This last example is most often seen in for-pay WiFi hotspots. Authentication is simply a process of comparing user’s credentials in request with the "known good" credentials retrieved from a database. Authentication usually deals with password encryption. The modules `pap`, `chap`, `mschap`, etc. do authentication. Some modules do both authentication and limited authorisation. For example, the `mschap` module authenticates MS-CHAP credentials, but it may also be used as an authorisation module, which verifies that request contains `MS-CHAP` related attribute. If so, the module instructs the server to use `mschap` for authentication, too These dual modules are usually related to protocol-specific attributes, such as the `pap` module for the `User-Password` attribute, `chap` for `CHAP-Password`, `mschap` for `MS-CHAP-*`, etc. freeradius-3.2.10+dfsg/doc/antora/modules/concepts/pages/aaa/authz.adoc000066400000000000000000000042741522352605200260010ustar00rootroot00000000000000= Authorisation Authorisation is the process of finding and returning information about what the user is allowed to do. For example, finding out what kind of authentication methods they are allowed to run, and what VLAN the user should be placed into. Authorisation modules generally "get data" from somewhere, e.g. `ldap`, `sql`, `files`, etc. The authentication method is usually determined when the server gets the users credentials from a database. Once the credentials are available, the server can authenticate the user. Authorisation refers to the process of determining what permissions are granted to the user. For example, the user may or may not be permitted certain kinds of network access or allowed to issue certain commands. The NAS sends a “request†- a packet of information about the user - and the RADIUS server either grants or denies authorisation based solely on information in the “request†sent by the NAS.In each case, the RADIUS server manages the authorisation policy and the NAS enforces the policy. The NAS “request†is really a set of statements. For example, the NAS may send the RADIUS server a “request†containing the following user information: ``` “user name is Bob†“password is Hello†“ip address is 192.02.34†``` Once the server receives the request, it uses that information to figure out what properties the user should have (i.e. “Bob†is saying he/she has IP address 192.0.2.34, do the server records contradict this statement?). The server then sends a reply to the NAS. The reply contains a series of statements about what properties the user should have: ``` "user name is Bob" "ip address is 192.0.2.78" ``` [NOTE] ==== The RADIUS server can’t request further information from the NAS. In contrast with SQL systems, RADIUS is limited in that it cannot make complicated queries. In SQL, queries such as "SELECT name from table where ipaddress = 192.02.34" are common. RADIUS does not have that capability. Instead, RADIUS only makes statements about what is, and what should be. ==== Upon receipt of a reply from the server, the NAS tries to enforce those properties on the user. properties cannot be enforced, the NAS closes the connection. freeradius-3.2.10+dfsg/doc/antora/modules/concepts/pages/components/000077500000000000000000000000001522352605200254525ustar00rootroot00000000000000freeradius-3.2.10+dfsg/doc/antora/modules/concepts/pages/components/architecture.adoc000066400000000000000000000046641522352605200307760ustar00rootroot00000000000000= RADIUS System Components RADIUS is a network protocol, a system that defines rules and conventions for communication between network devices. Like many protocols, RADIUS uses a client-server model. A RADIUS client (also called a Network Access Server (NAS) ) sends requests to a RADIUS server. The RADIUS server then processes the request and sends back a response. Common NAS products include wireless access points such as the Linksys WRT54G and dial-up equipment commonly available from large network manufacturers. Common RADIUS server products include Cisco ACS, Microsoft IAS, Juniper, Open Systems Radiator, and FreeRADIUS. The RADIUS protocol shares the general concept of client-server communication with many other protocols such as HTTP and SMTP, the specifics of RADIUS communications differ. This section describes the RADIUS system in more detail, including the specific roles of the NAS, the server, and datastores such as MySQL and Lightweight Directory Access Protocol (LDAP). This section describes the RADIUS system in more detail, including the specific roles of the NAS, the server, and datastores such as MySQL and Lightweight Directory Access Protocol (LDAP). .Examples of System Components [opts="headers, autowidth"] |=== | *Component* | *Description* | *Examples* | User or a device | Requests access to the network.| Laptop, tablet, modem, mobile, or VOIP phone. | Network Access Server (NAS)| Provides access to the network for the user or device. | Switch, wireless access point (WAP), or VPN terminator. | Authentication Server | Receives authentication requests from the NAS and returns authentication results to the NAS. Optionally requests user and configuration information from the datastore. The server may also return configuration parameters to the NAS. Receives accounting information from the NAS. | FreeRADIUS, Radiator, Network Policy Server (NPS), or an Internet Authentication Service (IAS). | Optional datastore such as a database or directory containing user authentication and authorisation information.| RADIUS server communicates with the datastore using a database API or LDAP. | SQL Database, Kerberos Service Server, or an LDAP Directory. |=== // Copyright (C) 2025 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/concepts/pages/components/datastore.adoc000066400000000000000000000040151522352605200302700ustar00rootroot00000000000000= Datastore Datastores (i.e., databases or directories) permit the storage and retrieval of data. They have limited decision-making capabilities. While stored procedures are possible in most databases, they are rarely used when simple data storage is required. The key differences between RADIUS servers and datastores are the way they support policies and authentication. The role of a data store in the authentication process is to provide data to a RADIUS server. The server then uses an authentication method to authenticate the user. When a RADIUS server authenticates a user or stores accounting data for that user, it reads from or writes to a database or directory.User information (i.e., user name, password, credit amount) and session data (i.e., total session time and statistics for total traffic to and from the user) are stored on this database or directory. In many respects, the RADIUS protocol is similar to a remote database query language. Specifically, while an SQL or LDAP database stores user data, that database cannot be queried directly by the NAS. Instead, the NAS sends a request to the server, which in turn queries the database. This simplification of the normal database query language means that it is easy to add authentication and accounting to an NAS instead of implementing a full-featured SQL client, which would be very resource intensive and costly. .Comparison of Datastores and RADIUS Servers [opts="headers, autowidth"] |=== | *Datastore* | *RADIUS Server* | Stores authentication and authorisation data | Processes data retrieved from the datastore. | Rarely implements policies. | Implements policies. | Supports basic authentication queries, such as LDAP “bind as user†| Support authentication protocols that include CHAP, MS-CHAP, MS-CHAPv2, and 802.1X (EAP, EAP-TLS, PEAP, EAP-TTLS, EAP-MD5). |=== // Copyright (C) 2025 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/concepts/pages/components/nas.adoc000066400000000000000000000051441522352605200270670ustar00rootroot00000000000000= Network Access Server A Network Access Server (NAS) is a system that provides access to a network. In some cases, it's also known as a Terminal Server or Remote Access Server (RAS). The NAS is meant to act as a gateway to guard access to a protected resource. This can be anything from a telephone network, to printers, to the Internet. The client connects to the NAS. The NAS then connects to another resource asking whether the client's supplied credentials are valid. Based on that answer the NAS then allows or disallows access to the protected resource. The NAS contains no information about what clients can connect or what credentials are valid. All the NAS does is send the credentials the client supplied to a resource which does know how to process the credentials. == Examples The above translates into different implementations for different uses. Here are some examples. - The most common use would be for access to the Internet. A user opens their browser. The NAS detects that the user is not currently authorized to have access to the Internet, so the NAS prompts the user for their username and password. The user supplies them and sends them back to the NAS. The NAS then uses RADIUS to connect to an AAA server (in this case, it is running FreeRADIUS) and passes off the username and password to the FreeRADIUS server. The FreeRADIUS server searches through its resources and finds that the credentials are valid and notifies the NAS they are valid. The NAS then grants the user access to the internet. - Another use of a NAS would be in VoIP. However, instead of using a username and password, many times a phone number or IP Address are used. If the phone number is a valid customer then the call can be completed. Other uses might be if the phone number has long distance access or is a telephone card and has minutes left. == Associated Protocols Although not required, NAS are almost exclusively used with AAA servers. Of the AAA protocols available, RADIUS tends to be the most widely used. DIAMETER is a new protocol which extends on RADIUS by providing error handling and inter-domain communications which is starting to be implimented in some high end NAS. == More Information - https://datatracker.ietf.org/doc/html/rfc2881[RFC 2881] Network Access Server Requirements Next Generation NAS Model - https://datatracker.ietf.org/doc/html/rfc2881[RFC 2882] Network Access Servers Requirements: Extended RADIUS Practices // Copyright (C) 2025 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/concepts/pages/components/policy.adoc000066400000000000000000000041341522352605200276030ustar00rootroot00000000000000= Server Policies The RADIUS server processes an NAS request based on the following criteria: * Contents of the NAS request. * Information available locally to the RADUS server (flat files, SQL, LDAP). The limitations inherent in the above processing criteria mean that the server can't negotiate with a NAS to request more information. The server takes what the NAS sends and returns either an acknowledgment or a non-acknowledgment. The RADIUS server has no control over the content of the request that the NAS sends. When the RADIUS server receives the request from the NAS, it uses local policies to decide how best to respond to the NAS request. The policies may be simple, such as “accept anyone with a correct user name and passwordâ€. More complex policies may be “allow basic users to request premium services in non-premium hours, except for Sundays and holidays, if their payment status is currentâ€. In all cases, the policies must be designed, implemented, and deployed by the network administrator. because policies are based on the contents of the NAS requests. Note that the NAS documentation does not always describe the content of the NAS requests. The only way for a network administrator to determine the NAS request content is to set up a test network. Test logins will result in the receipt of requests by the server. The administrator can then examine these requests to determine their content and create policies that look for those specific sets of attributes. Once the policy is created, the server then uses that information to make decisions. This process becomes more complicated when different NAS elements send the same information in different formats. For example, RADIUS has no MAC address data type, which means that the MAC address is sent as ASCII strings. Some NAS elements send a MAC address in the format of “00:01:02:03:04:05â€, while others use the format “00-01-02-03-04-05â€. The fact that these differences are not documented makes policy creation very difficult.In most cases, the administrator has to resort to trial and error methods to determine how to implement policies. freeradius-3.2.10+dfsg/doc/antora/modules/concepts/pages/components/radius.adoc000066400000000000000000000033421522352605200275730ustar00rootroot00000000000000= RADIUS RADIUS is a protocol for remote user Authorisation, Authentication and Accounting. Its primary use is for Internet Service Providers, though it may as well be used on any network that needs a centralized authentication and/or accounting service for its workstations. RADIUS is often used in larger Wi-Fi (wireless) networks for authentication purposes, replacing the simple shared key methods which are uncomfortable if a Wi-Fi network reaches a specific size. The protocol originally was designed by the well known terminal server manufacturer Livingston for use with their Portmaster series of terminal servers. Since then it has been implemented by hundreds other vendors and has a become an Internet Standard RFC. The DIAMETER protocol is the designated successor, but RADIUS is still commonly used today. == Protocol dependencies UDP: RADIUS uses UDP as its underlying protocol. The registered UDP port for RADIUS traffic is 1812; the early deployment of RADIUS used UDP port 1645, which conflicted with the "datametrics" service. When RADIUS is used for accounting rather than authentication and configuration, the registered UDP port is 1813; the early deployment used port 1646, which conflicted with the "sa-msg-port" service. == External links * RFC 2865 Remote Authentication Dial In User Service (RADIUS) * RFC 2866 RADIUS Accounting * RFC 2867 RADIUS Accounting Modifications for Tunnel Protocol Support * RFC 2868 RADIUS Attributes for Tunnel Protocol Support * RFC 2869 RADIUS Extensions * RADIUS attributes and packet type codes == See Also * FreeRADIUS * RADIUS-Clients * Other RADIUS Servers // Copyright (C) 2025 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/concepts/pages/components/radius_servers.adoc000066400000000000000000000115571522352605200313530ustar00rootroot00000000000000= RADIUS Server A RADIUS server is a central authority that handles authentication, authorisation, and accounting (AAA) for network access. The server receives requests from network access servers (NASs) like wireless access points or VPN concentrators and determines whether a user should be granted access based on predefined policies and data stored in a datastore. The RADIUS server is usually a software application running on a self-contained server. A physical device such as RADIUS appliances, with simplified maintenance and management interfaces, are also used. In either scenario, the server waits for a request from an NAS, processes or forwards the request, and then returns a response to the NAS. The response can contain authorisation policies or an acknowledgment of accounting data received. A single RADIUS server can receive and process many simultaneous access requests from numerous types of NASs (such as ADSL, dial-up, or VPN concentrators) in many different locations. A single server may also access flat files, SQL databases, LDAP directories, or other RADIUS servers. In order to make a decision regarding an access request, the RADIUS server must first use information from many sources. Once the server makes a decision, it returns a response to the NAS. The NAS may enforce the policy in that response, or it may ignore it altogether. The server is not aware if the NAS has received its response, or if the NAS is obeying the instructions in that response. Since it is customary for the NAS to log very little information about what has been received or how server responses are processed, it is very difficult to create and debug local site policies. The RADIUS server has no control over what the NAS does with a response. Consider the following analogy to help illustrate the point: a Human Resources (HR) department acts like a RADIUS server, by setting policies, and a security guard acts like the NAS in a network, by carrying out those HR department policies. In this example, the company policy is that when an employee is fired, HR notifies security and removes building access from that employee. The security guard is then responsible for ensuring the fired employee no longer accesses the company building. If one day an employee gets fired (similar to a user being denied access) and the HR department informs the security guard that the employee is no longer free to come and go (similar to the RADIUS server decision sent to the NAS), it is then up to the security guard at the company front desk to perform the task of refusing entry to the fired employee (similar to the NAS enforcing system access in a network). In the network, the NAS enforces system access. The RADIUS server does little more than offer advice to the NAS. [#policy] == RADIUS Server Policies The RADIUS server processes an NAS request based on the following criteria: * Contents of the NAS request. * Information available locally to the RADUS server (flat files, SQL, LDAP). This processing criteria limits the server ability to perform more complex authentication scenarios. The server can't negotiate with a NAS to request more information. The server uses the initial information that the NAS sends and returns either an acknowledgment or a non-acknowledgment. The RADIUS server has no control over the content of the request that the NAS sends. When the RADIUS server receives the request from the NAS, it uses local policies to decide how best to respond to the NAS request. The policies may be simple, such as “accept anyone with a correct user name and passwordâ€. More complex policies may be “allow basic users to request premium services in non-premium hours, except for Sundays and holidays, if their payment status is currentâ€. In all cases, the policies must be designed, implemented, and deployed by the network administrator because policies are based on the contents of the NAS requests. Often, the NAS documentation doesn't describe the content of the NAS requests. The only way for a network administrator to determine the NAS request content is to set up a test network. Test logins will result in the receipt of requests by the server. The administrator can examine these requests to determine their content and create policies that look for those specific sets of attributes. Once the policy is created, the server then uses that information to make decisions. This process becomes more complex when different NAS elements send the same information in different formats. For example, RADIUS has no MAC address data type, which means that the MAC address is sent as ASCII strings. Some NAS elements send a MAC address in the format of “00:01:02:03:04:05â€, while others use the format “00-01-02-03-04-05â€. The fact that these differences are not documented makes policy creation very difficult.In most cases, the administrator has to resort to trial and error methods to determine how to implement policies. freeradius-3.2.10+dfsg/doc/antora/modules/concepts/pages/freeradius.adoc000066400000000000000000000105601522352605200262500ustar00rootroot00000000000000= What is FreeRADIUS? FreeRADIUS is the most popular and the most widely deployed open source RADIUS server in the world. It serves as the basis for multiple commercial offerings, and it supplies the authentication, authorisation, and accounting (AAA) needs of many Fortune 500 companies and Tier 1 ISPs. It is also widely used by the academic community (i.e., eduroam, the world-wide roaming access service developed for the international research and education community, utilises FreeRADIUS software). FreeRADIUS was started in August 1999 by Alan DeKok and Miquel van Smoorenburg. Miquel had previously written the Cistron RADIUS server software, which had been widely adopted when the Livingston server was no longer in service. FreeRADIUS was developed using a modular design, to encourage more active community involvement. == Features More authentication types are supported by FreeRADIUS than by any other open source server. For example, FreeRADIUS is the only open source RADIUS server to support Extensible Authentication Protocol (EAP). FreeRADIUS is also the only open source RADIUS server to support virtual servers. The use of virtual servers means that complex implementations are simplified. Ongoing support and maintenance costs for network administrators are greatly reduced. FreeRADIUS's ability to support virtual servers gives it a huge advantage over the competition. == Modularity The modular design protocol makes FreeRADIUS easy to understand. The modular interface also simplifies adding or removing modules. If a feature is not needed for a configuration, the module is removed with a simple edit of the configuration file. Once the module is removed, it does not affect server performance, memory use, or security. This flexibility enables the server to run on platforms ranging from embedded systems to multi-core machines with gigabytes of RAM. The server core does the basic RADIUS and network handling. Almost everyother feature is managed with a module. This modular design increases the flexibility of the policy language. The policy language can execute multiple modules in any order, allowing for highly customizable workflows. Each module handles a specific, isolated task such as authentication, logging, or database access. For example, each of the authentication methods (PAP,CHAP, MS-CHAP, TOTP, and EAP) are individual modules. Similarly, each database connector (SQL,Redis, LDAP, etc.) are individual modules. In many cases, no code changes to the server core have to be made in order to support complex new functionality. This modular design streamlines development, testing, and enhances the system’s adaptability to new requirements or technologies. == Scalability A single FreeRADIUS server is easily reconfigured to handle a wide range of workloads, from just a few requests per second to thousands—by adjusting a few default settings. This adaptability makes FreeRADIUS suitable for both small deployments and very large organisations, including those with over 10 million customers who rely on it for authentication, authorization, and accounting (AAA) services. A single FreeRADIUS server can transition from handling one request every few seconds to processing thousands of requests per second. These varied workloads are handled by changing a few default settings. FreeRADIUS is suitable for both small deployments and very large organisations, including those with over 10 million customers. Often, only a single FreeRADIUS server is required to fulfill an organisation's requirements for their AAA services. While many commercial severs offer different versions of their software to handle different needs, only the latest version of FreeRADIUS provides better performance, more realms, more RADIUS clients, and more features, with no need to purchase additional product licenses. == Features * Complete support for https://datatracker.ietf.org/doc/html/rfc2865[RFC 2865] and https://datatracker.ietf.org/doc/html/rfc2866[RFC 2866] attributes. * Authentication Protocol supports for: ** EAP or protocol/EAP with EAP-MD5, EAP-SIM, EAP-TLS, EAP-TTLS. ** EAP-PEAP or protocol/EAP-PEAP. ** Cisco LEAP or protocol/LEAP and EAP sub-types. * Vendor Specific Attributes for over a hundred vendors including BinTec, Foundry, Cisco, Juniper, Lucent/Ascend, HP ProCurve, Microsoft, USR/3Com. * All known RADIUS clients. * Flexible configurations using attribute pairs. * Supports virtual servers. freeradius-3.2.10+dfsg/doc/antora/modules/concepts/pages/index.adoc000066400000000000000000000053441522352605200252320ustar00rootroot00000000000000= Concepts The Concepts guide introduces the main concepts for readers who are new to RADIUS (Remote Authentication Dial-In User Service) and its associated components. This information explains the foundational ideas and principles behind RADIUS to help you understand what RADIUS is, what it does, and how it operates within a network environment. By covering these basics, the section aims to provide a solid starting point for further exploration or practical use of RADIUS in network authentication, authorization, and accounting. == Sections in this Guide * xref:concepts:overview.adoc[Overview] explains the RADIUS server, FreeRADIUS, and the core services provided. ** xref:freeradius.adoc[What is FreeRADIUS] explains the benefits of the open-source software version. ** xref:aaa/aaa.adoc[Authentication Authorisation Accounting (AAA)] explains the core services provided by FreeRADIUS. *** xref:aaa/authz.adoc[Authorisation] is the process of allowing an authenticated user to access services on the network. *** xref:aaa/authn.adoc[Authentication] if the process of verifying an end-user's credentials. *** xref:aaa/acct.adoc[Accounting] operations record the time spent on the network and services accessed for auditing or billing purposes. ** xref:components/architecture.adoc[RADIUS System Components] explains the RADIUS design and components. *** xref:components/nas.adoc[Network Access Server (NAS)] outlines the NAS operations and access management. *** xref:components/radius_servers.adoc[RADIUS Server] describes the role of the server and how server policies work. *** xref:components/datastore.adoc[Datastores] details how datastores work and what's supported. ** xref:session/radius_session.adoc[RADIUS Sessions] explains session transmission and management or these session on the network. *** xref:session/radius_session_msg.adoc[Session Messages] details the format and content of session messages. *** xref:session/processing.adoc[Processing] outlines the flow of messages and how aaa services are implemented. * xref:protocol/authproto.adoc[Protocols] defines the protocols used in the RADIUS environment. * xref:modules/ldap/authentication.adoc[Authentication with LDAP] can be used by RADIUS servers to authenticate the network users. ** xref:modules/ldap/password_storage.adoc[Password Storage] explains the methods of how the user's information can be stored. ** xref:modules/ldap/novell.adoc[Integrate Novell] with RADIUS networks using LDAP. * xref:resources.adoc[Resources] find more help, mailing lists, and related documentation to help learn about deploying FreeRADIUS. freeradius-3.2.10+dfsg/doc/antora/modules/concepts/pages/modules/000077500000000000000000000000001522352605200247355ustar00rootroot00000000000000freeradius-3.2.10+dfsg/doc/antora/modules/concepts/pages/modules/ldap/000077500000000000000000000000001522352605200256555ustar00rootroot00000000000000freeradius-3.2.10+dfsg/doc/antora/modules/concepts/pages/modules/ldap/authentication.adoc000066400000000000000000000233271522352605200315330ustar00rootroot00000000000000== Authenticating Users with LDAP Please be aware the FreeRADIUS is an AAA server, and LDAP is a _database_. This separation of roles means that FreeRADIUS supports multiple kinds of authentication protocols such as `PAP`, `CHAP`, `MS-CHAP`, etc. An LDAP database supports only one authentication method: "bind as user". This authentication method is compatible only with PAP. Our recommendation is to use LDAP as a database. FreeRADIUS should read the "known good" password from LDAP, and then use that information to authenticate the user. It is almost always wrong to use the LDAP "bind as user" method for authenticating users. include::ROOT:partial$externaldoc.adoc[] The only caveat to the above recommendation is Active Directory. For "security" reasons, Active Directory will not return the "known good" password to FreeRADIUS over a standard LDAP query. Therefore when Active Directory is used, the choices are: PAP:: Use "bind as user" https://github.com/FreeRADIUS/freeradius-server/blob/v3.2.x/raddb/mods-available/mschap[MS-CHAP::] Use https://github.com/FreeRADIUS/freeradius-server/blob/v3.2.x/raddb/mods-available/ntlm_auth[`ntlm`] and https://github.com/FreeRADIUS/freeradius-server/blob/v3.2.x/raddb/mods-available/mschap[`winbind`] configuration. Due to the limitations of Active Directory, There are unfortunately no other possible choices. == LDAP Security Recommendations The credentials (username *and* password) for FreeRADIUS to use to connect to your LDAP server(s) should be secure. We make the following recommendations for LDAP "best practices" security. * Create a dedicated account for use by FreeRADIUS. * Ensure that this account does not have administrator access. * Ensure that this account is read-only, and has no write permissions. * Start by using 'simple authentication' instead of https://en.wikipedia.org/wiki/Simple_Authentication_and_Security_Layer[SASL]. The SASL protocol should be attempted only after 'simple authentication' has been verified to work. * Use TLS for connecting between FreeRADIUS and the LDAP server. See the `tls` sub-section of the default `ldap` module for instructions. * When storing RADIUS user profiles (quotas, `Simultaneous-Use` flags, access time restrictions, etc) in LDAP, the LDAP schema `doc/schemas/ldap/openldap/freeradius-radius.schema` must first be imported into the LDAP server. == Authentication method compatibility The LDAP module is compatible a few different kinds of authentication methods. Note that we say _compatible_, and not _supports_. LDAP servers are databases, and do not support authentication protocols such as CHAP, MS-CHAP, or EAP. https://github.com/FreeRADIUS/freeradius-server/blob/v3.2.x/raddb/mods-available/pap[PAP::] The user supplies a `User-Password` (plaintext or EAP-TTLS/PAP) + FreeRADIUS reads the "known good" password from LDAP, and compares that to what the user entered. Bind as user:: The user supplies a `User-Password` (plaintext or EAP-TTLS/PAP) + FreeRADIUS uses that password to "bind as the user" to LDAP, using the supplied `User-Name` and `User-Password. If the bind is successfull, the user is authenticated. Otherwise, authentication fails. https://github.com/FreeRADIUS/freeradius-server/blob/v3.2.x/raddb/mods-available/chap[CHAP::] The user supplies a `CHAP` password attribute. + FreeRADIUS reads the "known good" password from LDAP in cleartext, and compares that to what the user entered. https://github.com/FreeRADIUS/freeradius-server/blob/v3.2.x/raddb/mods-available/mschap[MS-CHAP::] The user supplies a `MS-CHAP` password attribute. Either as MS-CHAPv2, or as PEAP/MSCHAPv2, or as EAP-TTLS/MS-CHAPv2. + FreeRADIUS reads the "known good" password from LDAP in cleartext, or as an NT hash, and compares that to what the user entered. All of above authentication methods other than "bind as user" require that FreeRADIUS obtain the `userPassword` field from LDAP. If that field is not returned to FreeRADIUS, then normal authentication is impossible. Either FreeRADIUS has to be configured to use "bind as user" for authentication, or the LDAP database has to be updated to return the `userPassword` field to FreeRADIUS. This change usually involves giving the FreeRADIUS "read-only" user permission to read the `userPassword` field. Again, the best method is to test authentication is with the https://www.freeradius.org/documentation/freeradius-server/4.0.0/howto/modules/ldap/ldapsearch/index.html[ldapsearch] tool. These tests *must* be run prior to configuring FreeRADIUS. We strongly recommend having the LDAP database return the `userPassword` field to FreeRADIUS, so that FreeRADIUS can authenticate the user. We also strongly recommend that the passwords be stored in LDAP as cleartext. Otherwise, the only authentication methods that will work are PAP and EAP-TTLS/PAP. The next section explains these issues in more detail. == Password Storage Methods If the `userPassword` field is returned from LDAP to FreeRADIUS, that information can be stored in a number of different formats: * The value can be cleartext. * The value can be prepended with a string enclosed by braces, such as with `{crypt}` or `{ssha3}`. * The value can be have a suffix of `::`, in which case the password is generally a https://en.wikipedia.org/wiki/Base64[base64] encoded version of the real password. TIP: Base64 values can be decoded via the command: `printf "%s" "VALUE" | base64 -d` FreeRADIUS is capable of understanding and parsing all of the above formats. There is sufficient information in the password values to determine what format it is in (base64, binary, or text), and what password "encryption" mechanism has been used (crypt, MD5, SHA, SSHA2, SHA3, etc). All that is necessary is that the https://github.com/FreeRADIUS/freeradius-server/tree/v3.2.x/raddb/mods-available/ldap[ldap module] be configured to map the `userPassword` LDAP field to the `&control.Password.With-Header` attribute in FreeRADIUS. FreeRADIUS will then "do the right thing" to authenticate the user. This mapping is done in the default module configuration. There are no additional changes required for FreeRADIUS to correctly read and decode the `userPassword` field from LDAP. Please see the https://github.com/FreeRADIUS/freeradius-server/blob/v3.2.x/raddb/mods-available/pap[pap module] for a full list of supported password "encryption" formats. == Additional Considerations There are some major caveats with the above authentication methods. The first is that we *strongly recommend* against using "bind as user". This process is slow, and causes unnecessary churn in the connections used to contact the LDAP server. Further, the "bind as user" process works _only_ when a `User-Password attribute exists in the request. If any other authentication type is used in the request, then the "bind as user" _will not work_. There is no amount of "fixing" things or configuration changes which will make it work. The second caveat is that the `CHAP` authentication type works _only_ when a "clear text" password is stored in the LDAP database. The `CHAP` calclulations are designed around having access to the "clear text" password. It is impossible to use any "encrypted" or "hashed" passwords with `CHAP`. The third caveat is that the `MS-CHAP` authentication type works _only_ when a "clear text" password or "NT hashed" passwords which are stored in the LDAP database. The `MS-CHAP` calculations are designed around having access to "known good" passwords in those formats. It is impossible to use any other kind of "encrypted" or "hashed" passwords with `MS-CHAP`. The final caveat is that when the LDAP database contains "encrypted" or "hashed" passwords, the _only_ authentication type which is compatible with those passwords is PAP. i.e. when the `User-Password` is supplied to FreeRADIUS. For recommendations on password storage methods in LDAP, please see the LDAP https://openldap.org/doc/admin24/security.html#Password%20Storage[password storage] page. Please note that the recommendations there are made for LDAP security, and pay no attention to the caveats described above. When both RADIUS and LDAP are used together, then the requirements of _both_ systems must be met in order for them to work together. In many cases, a naive approach to LDAP security will prevent RADIUS from working. The issue of a database storing passwords in clear-text has to be balanced against the users sending clear-text passwords in authentication protocols. While those passwords are protected by TLS (EAP-TTLS) or by RADIUS (in it's own "encryption" mechanism), it is generally better to use a stronger authentication method than just PAP. In the end, there is no perfect solution to security requirements. The choice may be either to give up on using a particular authentication method, or to relax the security requirements on LDAP and on password storage. The final decision as to which choice is best can only be made by a local administrator. == Integrating Novell eDirectory with FreeRADIUS You can integrate Novell eDirectoryTM 8.7.1 or later with FreeRADIUS 1.0.2 onwards to allow wireless authentication for eDirectory users. By integrating eDirectory with FreeRADIUS, you can do the following: * Use universal password for RADIUS authentication. Universal password provides single login and authentication for eDirectory users. Therefore, the users need not have a separate password for RADIUS and eDirectory authentication. * Enforce eDirectory account policies for users. The existing eDirectory policies on the user accounts can still be applied even after integrating with RADIUS. Also, you can make use of the intruder lockout facility of eDirectory by logging the failed logins into eDirectory. For configuration information please refer to the https://www.netiq.com/documentation/edir_radius/[Novell documentation]. freeradius-3.2.10+dfsg/doc/antora/modules/concepts/pages/modules/ldap/ldap_authentication.adoc000066400000000000000000000153071522352605200325320ustar00rootroot00000000000000= Authentication with LDAP LDAP servers function primarily as databases that store user credentials and related information. They do not implement or handle authentication protocols themselves. The RADIUS server handles the authentication protocols such as `PAP`, `CHAP`, or `MS-CHAP`. The LDAP server is a backend accessed by the RADIUS server to verify user credentials. The LDAP module interacts with these protocols by retrieving and comparing data. The RADIUS server performs the authentication logic, not the LDAP server. The LDAP module is compatible a few different kinds of authentication methods. Note that we say _compatible_, and not _supports_. LDAP servers are databases, and do not support authentication protocols. PAP:: The user supplies a `User-Password` (plaintext or EAP-TTLS/PAP) + FreeRADIUS reads the "known good" password from LDAP, and compares that to what the user entered. Bind as user:: The user supplies a `User-Password` (plaintext or EAP-TTLS/PAP) + FreeRADIUS uses that password to "bind as the user" to LDAP, using the supplied `User-Name` and `User-Password. If the bind is successfull, the user is authenticated. Otherwise, authentication fails. CHAP:: The user supplies a `CHAP` password attribute. + FreeRADIUS reads the "known good" password from LDAP in cleartext, and compares that to what the user entered. MS-CHAP:: The user supplies a `MS-CHAP` password attribute. Either as MS-CHAPv2, or as PEAP/MSCHAPv2, or as EAP-TTLS/MS-CHAPv2. + FreeRADIUS reads the "known good" password from LDAP in cleartext, or as an NT hash, and compares that to what the user entered. All of above authentication methods other than "bind as user" require that FreeRADIUS obtain the `userPassword` field from LDAP. If that field is not returned to FreeRADIUS, then normal authentication is impossible. Either FreeRADIUS has to be configured to use "bind as user" for authentication, or the LDAP database has to be updated to return the `userPassword` field to FreeRADIUS. This change usually involves giving the FreeRADIUS "read-only" user permission to read the `userPassword` field. Again, the best method is to test authentication is with the ldap search tool. These tests *must* be run prior to configuring FreeRADIUS. We strongly recommend having the LDAP database return the `userPassword` field to FreeRADIUS, so that FreeRADIUS can authenticate the user. We recommend that the passwords be stored in LDAP as cleartext. Otherwise, the only authentication methods that will work are PAP and EAP-TTLS/PAP. The next section explains these issues in more detail. == Password Storage Methods If the `userPassword` field is returned from LDAP to FreeRADIUS, that information can be stored in a number of different formats: * the value can be cleartext * the value can be prepended with a string enclosed by braces, such as with `{crypt}` or `{ssha3}`. * the value can be have a suffix of `::`, in which case the password is generally a https://en.wikipedia.org/wiki/Base64[base64] encoded version of the real password TIP: Base64 values can be decoded via the command: `printf "%s" "VALUE" | base64 -d` FreeRADIUS is capable of understanding and parsing all of the above formats. There is sufficient information in the password values to determine what format it is in (base64, binary, or text), and what password "encryption" mechanism has been used (crypt, MD5, SHA, SSHA2, SHA3, etc). All that is necessary is that the https://github.com/FreeRADIUS/freeradius-server/blob/v3.2.x/raddb/mods-available/ldap[ldap module] be configured to map the `userPassword` LDAP field to the `control.Password-With-Header` attribute in FreeRADIUS. FreeRADIUS will then "do the right thing" to authenticate the user. This mapping is done in the default module configuration. There are no additional changes required for FreeRADIUS to correctly read and decode the `userPassword` field from LDAP. Please see the https://github.com/FreeRADIUS/freeradius-server/blob/v3.2.x/man/man5/rlm_pap.5[pap module] for a full list of supported password "encryption" formats. == Additional Considerations There are some major caveats with the above authentication methods. The first is that we *strongly recommend* against using "bind as user". This process is slow, and causes unnecessary churn in the connections used to contact the LDAP server. Further, the "bind as user" process works _only_ when a `User-Password attribute exists in the request. If any other authentication type is used in the request, then the "bind as user" _will not work_. There is no amount of "fixing" things or configuration changes which will make it work. The second caveat is that the `CHAP` authentication type works _only_ when a "clear text" password is stored in the LDAP database. The `CHAP` calclulations are designed around having access to the "clear text" password. It is impossible to use any "encrypted" or "hashed" passwords with `CHAP`. The third caveat is that the `MS-CHAP` authentication type works _only_ when a "clear text" password or "NT hashed" passwords which are stored in the LDAP database. The `MS-CHAP` calculations are designed around having access to "known good" passwords in those formats. It is impossible to use any other kind of "encrypted" or "hashed" passwords with `MS-CHAP`. The final caveat is that when the LDAP database contains "encrypted" or "hashed" passwords, the _only_ authentication type which is compatible with those passwords is PAP. i.e. when the `User-Password` is supplied to FreeRADIUS. For recommendations on password storage methods in LDAP, please see the LDAP https://openldap.org/doc/admin24/security.html#Password%20Storage[password storage] page. Please note that the recommendations there are made for LDAP security, and pay no attention to the caveats described above. When both RADIUS and LDAP are used together, then the requirements of _both_ systems must be met in order for them to work together. In many cases, a naive approach to LDAP security will prevent RADIUS from working. The issue of a database storing passwords in clear-text has to be balanced against the users sending clear-text passwords in authentication protocols. While those passwords are protected by TLS (EAP-TTLS) or by RADIUS (in it's own "encryption" mechanism), it is generally better to use a stronger authentication method than just PAP. In the end, there is no perfect solution to security requirements. The choice may be either to give up on using a particular authentication method, or to relax the security requirements on LDAP and on password storage. The final decision as to which choice is best can only be made by a local administrator. // Copyright (C) 2025 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/concepts/pages/modules/ldap/novell.adoc000066400000000000000000000015271522352605200300110ustar00rootroot00000000000000= Integrate Novell eDirectory You can integrate Novell eDirectoryTM 8.7.1 or later with FreeRADIUS to allow wireless authentication for eDirectory users. By integrating eDirectory with FreeRADIUS, you can do the following: * Use universal password for RADIUS authentication. Universal password provides single login and authentication for eDirectory users. Therefore, the users need not have a separate password for RADIUS and eDirectory authentication. * Enforce eDirectory account policies for users. The existing eDirectory policies on the user accounts can still be applied even after integrating with RADIUS. Also, you can make use of the intruder lockout facility of eDirectory by logging the failed logins into eDirectory. For configuration information please refer to the https://www.netiq.com/documentation/edir_radius/[Novell documentation]. freeradius-3.2.10+dfsg/doc/antora/modules/concepts/pages/modules/ldap/password_storage.adoc000066400000000000000000000100221522352605200320660ustar00rootroot00000000000000= Password Storage Methods If the `userPassword` field is returned from LDAP to FreeRADIUS, that information can be stored in a number of different formats: * The value can be cleartext. * The value can be prepended with a string enclosed by braces, such as with `{crypt}` or `{ssha3}`. * the value can be have a suffix of `::`, in which case the password is generally a https://en.wikipedia.org/wiki/Base64[base64] encoded version of the real password. [TIP] ==== Base64 values can be decoded via the command: `printf "%s" "VALUE" | base64 -d`. ==== FreeRADIUS understands and parses all of the above formats. There is sufficient information in the password values to determine what format it is in (base64, binary, or text), and what password "encryption" mechanism has been used (crypt, MD5, SHA, SSHA2, SHA3, etc). All that is necessary is that the xhttps://github.com/FreeRADIUS/freeradius-server/blob/v3.2.x/raddb/mods-available/ldap[ldap module] be configured to map the `userPassword` LDAP field to the `control.Password.With-Header` attribute in FreeRADIUS. FreeRADIUS will then "do the right thing" to authenticate the user. This mapping is done in the default module configuration. There are no additional changes required for FreeRADIUS to correctly read and decode the `userPassword` field from LDAP. Please see the https://github.com/FreeRADIUS/freeradius-server/blob/v3.2.x/raddb/mods-available/pap[pap module] for a full list of supported password "encryption" formats. == Additional Considerations There are some major caveats with the above authentication methods. The first is that we *strongly recommend* against using "bind as user". This process is slow, and causes unnecessary churn in the connections used to contact the LDAP server. Further, the "bind as user" process works _only_ when a `User-Password attribute exists in the request. If any other authentication type is used in the request, then the "bind as user" _will not work_. There is no amount of "fixing" things or configuration changes which will make it work. The second caveat is that the `CHAP` authentication type works _only_ when a "clear text" password is stored in the LDAP database. The `CHAP` calculations are designed around having access to the "clear text" password. It is impossible to use any "encrypted" or "hashed" passwords with `CHAP`. The third caveat is that the `MS-CHAP` authentication type works _only_ when a "clear text" password or "NT hashed" passwords which are stored in the LDAP database. The `MS-CHAP` calculations are designed around having access to "known good" passwords in those formats. It is impossible to use any other kind of "encrypted" or "hashed" passwords with `MS-CHAP`. The final caveat is that when the LDAP database contains "encrypted" or "hashed" passwords, the _only_ authentication type which is compatible with those passwords is PAP. i.e. when the `User-Password` is supplied to FreeRADIUS. For recommendations on password storage methods in LDAP, please see the LDAP https://openldap.org/doc/admin24/security.html#Password%20Storage[password storage] page. Please note that the recommendations there are made for LDAP security, and pay no attention to the caveats described above. When both RADIUS and LDAP are used together, then the requirements of _both_ systems must be met in order for them to work together. In many cases, a naive approach to LDAP security will prevent RADIUS from working. The issue of a database storing passwords in clear-text has to be balanced against the users sending clear-text passwords in authentication protocols. While those passwords are protected by TLS (EAP-TTLS) or by RADIUS (in it's own "encryption" mechanism), it is generally better to use a stronger authentication method than just PAP. In the end, there is no perfect solution to security requirements. The choice may be either to give up on using a particular authentication method, or to relax the security requirements on LDAP and on password storage. The final decision as to which choice is best can only be made by a local administrator. freeradius-3.2.10+dfsg/doc/antora/modules/concepts/pages/overview.adoc000066400000000000000000000132311522352605200257630ustar00rootroot00000000000000= Overview A RADIUS (Remote Authentication Dial In User Service) server offers authentication, authorisation, and accounting (AAA) services for network access. A Network Access Servers (NAS) sends authentication and accounting requests to a RADIUS server. The server then verifies user credentials and returns configuration details to the NAS. The NAS either grants or denies network access to the end-user or device. The key concepts of any RADIUS include: * *Centralized AAA*: RADIUS servers manage network access by verifying user credentials, granting access rights, and tracking user activity.  * *Client-Server Protocol*: RADIUS uses a client-server protocol. Network Access Servers are RADIUS clients that send requests to the RADIUS server.  * *Background Process*: RADIUS servers run as background processes or daemons on UNIX systems.  * *User Credentials:* The server stores or can access user account information and verifies authentication requests.  * *Configuration Details*: The RADIUS server sends details to the client, enabling it to grant or deny network access.  == What is RADIUS? RADIUS is a network protocol that defines rules and conventions for communication between network devices for remote user authentication and accounting. Commonly used by Internet Service Providers (ISPs), cellular network providers, and corporate and educational networks, the RADIUS protocol serves three primary functions: * Authenticates users or devices before allowing them access to a network. * Authorises those users or devices for specific network services. * Accounts for and tracks the usage of those services. === History In 1991, Merit Network, a non-profit internet provider, required a creative way to manage dial-in access to various Points-Of-Presence (POPs) across its network. In response to this need, RADIUS was created by Livingston Enterprises. When RADIUS was created, network access systems were distributed across a wide area and were run by multiple independent organisations. Central administrators wanted to prevent security and scalability issues, and therefore didn't want to distribute user names and passwords. Instead, they wanted the remote access servers to contact a central server to authorise access to the requested system or service. [NOTE] ==== A remote access server (RAS) is often called a Network Access Server (NAS), Network Access Client (NAC), or simply client. ==== In response to contact from the remote access server, the central server would return a “success†or “failure†message, and the remote machines would enforce this response for each end-user. This process ensures that authentication decisions are centralized, while enforcement happens at the network edge, maintaining both security and scalability in the system. The goal of RADIUS was to create a central location for user authentication, wherein users from many locations could request network access. The simplicity, efficiency, and usability of the RADIUS system led to its widespread adoption by network equipment vendors. RADIUS evolved into an industry and Internet Engineering Task Force (IETF) standard as outlined in https://datatracker.ietf.org/doc/html/rfc2865[RFC 2865]. === Customers Many types of businesses and organisations use the RADIUS protocol for their authentication and accounting needs. Some examples of RADIUS customers are: * Cellular network providers with millions of users. * Small to large ISPs to authenticate users connecting to the internet. * Enterprise networks implementing Network Access Control (NAC) using 802.1x or to manage access to their internal networks and VPNs. * Wireless networks in educational institutions and campuses. === Benefits The RADIUS client-server architecture is an open and scalable solution. RADIUS supports a wide range of environments and can grow to handle increased demand. Its adoption by many vendors ensures compatibility with a variety of products and systems. Organizations configure RADIUS to work with various security systems, including legacy solutions. Any RADIUS client-protocol-supporting communications device can interact with a RADIUS server, simplifying integration. The RADIUS authentication mechanisms enable organizations to integrate their existing security technologies. RADIUS architecture offers authentication and authorisation services to any supported security component. Additionally, the central server can integrate with a separate authentication mechanism. RADIUS extends beyond network access devices and terminal servers. ISPs integrating RADIUS leverage their infrastructure to provide Virtual Private Network (VPN) services. The distributive nature of RADIUS separates security processes from the communications processes. This design provides a single centralized information store for authorisation and authentication information. Centralization reduces the administrative burden of providing adequate access control for remote users. [NOTE] ==== The authentication server manages the security processes. The network access server (NAS) handles the communication processes. ==== If high availability is not a priority, redundancy is not necessary. All RADIUS-compatible hardware on the network can derive authentication services from a single server. In summary, the RADIUS client-server protocol provides these advantages: * An open and scalable solution. * Broad support by a large vendor base. * Easy modification. * Separation of security and communication processes. * Adaptable to most security systems. * Workable with any communication device that supports RADIUS client protocol. // Copyright (C) 2025 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/concepts/pages/protocol/000077500000000000000000000000001522352605200251265ustar00rootroot00000000000000freeradius-3.2.10+dfsg/doc/antora/modules/concepts/pages/protocol/authproto.adoc000066400000000000000000000113261522352605200300060ustar00rootroot00000000000000= Protocols == RADIUS Protocol RADIUS is a protocol for remote user Authorisation, Authentication, and Accounting. It's very important for Internet Service Providers, and any network that needs a centralized authentication and/or accounting services for its infrastructure. RADIUS is often used in larger Wi-Fi (wireless) networks for authentication purposes, replacing the simple shared key methods which are uncomfortable if a Wi-Fi network reaches a specific size. The protocol originally was designed by the well known terminal server manufacturer Livingston for use with their Portmaster series of terminal servers. Since then it has been implemented by hundreds other vendors and has a become an Internet Standard RFC. The DIAMETER protocol is the designated successor, but RADIUS is still commonly used today. === RADIUS Protocol Dependencies RADIUS uses UDP as its underlying protocol. The registered UDP port for RADIUS traffic is 1812 for authentication and configuration. The early deployment of RADIUS used UDP port 1645, which conflicted with the "datametrics" service. When RADIUS is used for accounting the registered UDP port is 1813. The earlier RADIUS version used port 1646, which conflicted with the "sa-msg-port" service. == Authentication Protocols In order for RADIUS authentication to work, user passwords need to be stored in a format that is understood by the authentication protocol used by the client. Many protocols integrated with RADIUS include: * PAP * CHAP * MS-CHAP * EAP Authentication protocols used in RADIUS are not always compatible with the way the passwords have been stored. The following table shows which protocol is compatible with what kind of password. === Authentication Protocol and Password Compatibility Passwords may be stored in a datastore in many forms. Clear-text, MD5 hashed, crypt'd, NT hash, or other methods are all commonly used. Authentication protocols used in RADIUS are not always compatible with the way the passwords have been stored. The following table shows which protocol is compatible with what kind of password. [#Proto-Password-Compat] .Protocol Password Compatibility [cols="2,1,1,1,1,1,1,1"] |=== |*Protocol*|*Clear-text*|*NT hash*|*MD5 hash*|*Salted MD5 hash*|*SHA1 hash*|*Salted SHA1 hash*|*Unix Crypt* |*PAP* | âœ”ï¸ | âœ”ï¸ | âœ”ï¸ | âœ”ï¸ | âœ”ï¸ | âœ”ï¸ | âœ”ï¸ |*CHAP* | âœ”ï¸ | ⌠| ⌠| ⌠| ⌠| ⌠| ⌠|*Digest* | âœ”ï¸ | ⌠| ⌠| ⌠| ⌠| ⌠| ⌠|*MSCHAP* | âœ”ï¸ | âœ”ï¸ | ⌠| ⌠| ⌠| ⌠| ⌠|*PEAP* | âœ”ï¸ | âœ”ï¸ | ⌠| ⌠| ⌠| ⌠| ⌠|*EA-MSCHAP2* | âœ”ï¸ | âœ”ï¸ | ⌠| ⌠| ⌠| ⌠| ⌠|*Cisco-LEAP* | âœ”ï¸ | âœ”ï¸ | ⌠| ⌠| ⌠| ⌠| ⌠|*EAP-GTC* | âœ”ï¸ | âœ”ï¸ | âœ”ï¸ | âœ”ï¸ | âœ”ï¸ | âœ”ï¸ | âœ”ï¸ |*EAP-MD5* | âœ”ï¸ | ⌠| ⌠| ⌠| ⌠| ⌠| ⌠|*EAP-PWD* | âœ”ï¸ | ⌠| ⌠| ⌠| ⌠| âœ”ï¸ | âœ”ï¸ |=== Many people store passwords in their databases in hashed or encrypted form. They later decide that they need to support an authentication protocol that the above table shows is incompatible with their password storage method. They then ask "How can I make authentication protocol X work with passwords stored as Y?" The short answer is "you can't". The password hashes, and authentication protocols were designed to be incompatible. If the cell in the above table is red, then it's impossible to make the authentication protocol use that form of the password. Your only choices are to stop trying to use that authentication protocol, or to store the passwords in a form compatible with that authentication protocol. The last choice often means asking all users to change their passwords, unfortunately. == More Information Refer to https://github.com/FreeRADIUS/freeradius-server/tree/v3.2.x/share[Attributes] for more protocol attribute details and https://www.iana.org/assignments/radius-types/radius-types.xhtml[RADIUS Packet Types]. The relevant RFCs are: * https://datatracker.ietf.org/doc/html/rfc2867[RFC 2867] RADIUS Accounting Modifications for Tunnel Protocol Support * https://datatracker.ietf.org/doc/html/rfc2868[RFC 2868] RADIUS Attributes for Tunnel Protocol Support * https://datatracker.ietf.org/doc/html/rfc2869[RFC 2869] RADIUS Extensions * https://datatracker.ietf.org/doc/html/rfc3758[RFC 3748] Extensible Authentication Protocol (EAP) * https://datatracker.ietf.org/doc/html/rfc3579[RFC 3579] RADIUS (Remote Authentication Dial In User Service) Support For Extensible Authentication Protocol (EAP) // Copyright (C) 2025 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/concepts/pages/protocol/peap.adoc000066400000000000000000000115131522352605200267040ustar00rootroot00000000000000*Protected Extensible Authentication Protocol*, *Protected EAP*, or simply *PEAP* (pronounced *peep*), is a method to securely transmit authentication information, including passwords, over wireless LANs. It was jointly developed by Microsoft, RSA Security and Cisco. It is an IETF open standard. PEAP is **not** an encryption protocol; as with other EAP types it only authenticates a client into a network. PEAP uses only server-side public key certificates to authenticate clients by creating an encrypted SSL/TLS tunnel between the client and the authentication server, which protects the ensuing exchange of authentication information from casual inspection. PEAP is similar in design to EAP-TTLS, requiring only a server-side PKI certificate to create a secure TLS tunnel to protect user authentication. As of May of 2005, there were two PEAP sub-types certified for the updated WPA and WPA2 standard. They are: * PEAPv0/EAP-MSCHAPv2 * PEAPv1/EAP-GTC == Types === PEAPv0/EAP-MSCHAPv2 PEAPv0/EAP-MSCHAPv2 is the most common form of PEAP in use, and what is usually referred to as PEAP. Behind EAP-TLS, PEAPv0/EAP-MSCHAPv2 is the second most widely supported EAP standard in the world. There are client and server implementations of it from various vendors, including support in all recent releases from Microsoft, Apple and Cisco. Other implementations exist such as AEGIS from Meetinghouse and xsupplicant from the Open1x.org project. === PEAPv1/EAP-GTC PEAPv1/EAP-GTC was created by Cisco as an alternative to PEAPv0/EAP-MSCHAPv2. It allows the use of an inner authentication protocol other than Microsoft’s MSCHAPv2. Even though Microsoft co-invented the PEAP standard, Microsoft never added support for PEAPv1 in general, which means PEAPv1/EAP-GTC has no native Windows OS support. Since Cisco has always favored the use of its own less secure proprietary LEAP and EAP-FAST protocols over PEAP and markets them as simpler certificate-less solutions, standardized PEAP is rarely promoted by Cisco. Cisco stands to gain a monopoly in the access point market if LEAP or EAP-FAST is universally adopted. As a result, most Cisco customers run Cisco's proprietary LEAP or EAP-FAST authentication protocols due to their promotion by Cisco. With no interest from Microsoft to support PEAPv1 and little interest from Cisco to promote PEAP in general, PEAPv1 authentication is rarely used. There is no native OS support for this EAP protocol. Note: The PEAP standard was created by Microsoft, Cisco, and RSA after EAP-TTLS had already come on the market. Even with its late start, Microsoft’s and Cisco’s size allowed them to quickly overtake EAP-TTLS in the market. Microsoft and Cisco parted ways when Microsoft only supported the PEAPv0 standard while Cisco supported both PEAPv0 and PEAPv1. PEAPv0 and PEAPv1 both refer to the outer authentication method and is the mechanism that creates the secure TLS tunnel to protect subsequent authentication transactions while EAP-MSCHAPv2, EAP-GTC, and EAP-SIM refer to the inner authentication method which facilitates user or device authentication. From Cisco’s perspective, PEAPv0 supports inner EAP methods EAP-MSCHAPv2 and EAP-SIM while PEAPv1 supports inner EAP methods EAP-GTC and EAP-SIM. Since Microsoft only supports PEAPv0 and doesn’t support PEAPv1, Microsoft simply calls PEAPv0 PEAP without the v0 or v1 designator. Another difference between Microsoft and Cisco is that Microsoft only supports PEAPv0/EAP-MSCHAPv2 mode but not PEAPv0/EAP-SIM mode. === PEAP-EAP-TLS Microsoft supports another form of PEAPv0 (which Microsoft calls PEAP-EAP-TLS) that Cisco and other third-party server and client software don’t support. PEAP-EAP-TLS does require a client-side digital certificate located on the client’s hard drive or a more secure smartcard. PEAP-EAP-TLS is very similar in operation to the original EAP-TLS but provides slightly more protection due to the fact that portions of the client certificate that are unencrypted in EAP-TLS are encrypted in PEAP-EAP-TLS. Since few third-party clients and servers support PEAP-EAP-TLS, users should probably avoid it unless they only intend to use Microsoft desktop clients and servers. Ultimately, PEAPv0/EAP-MSCHAPv2 is the only form of PEAP that most people will ever know. PEAP is so successful in the market place that even Funk Software, the inventor and backer of EAP-TTLS, had no choice but to support PEAP in their server and client software for wireless networks. == References * Understanding the updated WPA and WPA2 standards(http://blogs.zdnet.com/Ou/index.php?p=67) == External links * draft-josefsson-pppext-eap-tls-eap(http://www.potaroo.net/ietf/idref/draft-josefsson-pppext-eap-tls-eap/) - The PEAP protocol specifications == See Also * EAP // Copyright (C) 2025 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/concepts/pages/protocol/wep.adoc000066400000000000000000000227401522352605200265560ustar00rootroot00000000000000 == Overview *Wired Equivalent Privacy (WEP)* is a scheme that is part of the IEEE 802.11 wireless networking standard to secure IEEE 802.11 wireless computer network (also known as Wi-Fi networks). Because a wireless network broadcasts messages using radio, it is particularly susceptible to eavesdropping. WEP was intended to provide comparable confidentiality to a traditional wired local area network|network (in particular it doesn't protect users of the network from each other), hence the name. Several serious weaknesses were identified by cryptanalysts, and WEP was superseded by Wi-Fi Protected Access (WPA) in 2003, and then by the full IEEE 802.11i standard (also known as WPA2) in 2004. Despite the weaknesses, WEP provides a level of security that can deter casual snooping. == Details WEP is part of the IEEE 802.11 standard ratified in September 1999. WEP uses the stream cipher RC4 for confidentiality and the CRC-32 checksum for integrity. Standard 64-bit WEP uses a 40-bit encryption|40 bit key, which is concatenated to a 24-bit initialization vector (IV) to form the RC4 traffic key. At the time that the original WEP standard was being drafted, US Government export of cryptography limited the keysize. Once the restrictions were lifted, all of the major manufacturers eventually implemented an extended 128-bit WEP protocol using a 104-bit key size. A 128-bit WEP key is almost always entered by users as a string of 26 Hexadecimal (Hex) characters (0-9 and A-F). Each character represents 4 bits of the key. 4 * 26 = 104 bits. Adding the 24-bit IV brings us what we call a "128-bit WEP key". A 256-bit WEP system is available from some vendors, and as with the above-mentioned system, 24 bits of that is for the I.V., leaving 232 actual bits for protection. This is typically entered as 58 Hexadecimal characters. (58 * 4 = 232 bits) + 24 I.V. bits = 256 bits of WEP protection. Key size is not the only major security limitation in WEP. Cryptanalysis a longer key requires interception of more packets, but there are active attacks that stimulate the necessary traffic. There are other weaknesses in WEP, including the possibility of IV collisions and altered packets, that are not helped at all by a longer key. See stream cipher attack. == Flaws Because RC4 is a stream cipher, the same traffic key must never be used twice. The purpose of an IV, which is transmitted as plaintext, is to prevent any repetition, but a 24-bit IV is not long enough to ensure this on a busy network. The way the IV was used also opened WEP to a [[related key attack]]. For a 24-bit IV, there is a 50% probability the same IV will repeat after 5000 packets. Many WEP systems require a key in hexadecimal format. Some users choose keys that spell words in the limited 0-9, A-F hex character set, for example _C0DE C0DE C0DE C0DE_. Such keys are often easily guessed. In August 2001, Scott Fluhrer, Itzik Mantin, and Adi Shamir published a cryptanalysis of WEP that exploits the way the RC4 cipher and IV is used in WEP, resulting in a passive attack that can recover the RC4 key (cryptography) after eavesdropping on the network (depending on the network traffic (the number of packets you can inspect) the length could be from 10 minutes to indefinitely (if there is no data being sent at all)). There are also ways to force the traffic onto the network which is rejected, but packets are sent and thus can also be inspected to find the key. The attack was soon implemented, and automated tools have since been released. It is possible to perform the attack with a personal computer, off-the-shelf hardware and freely-available software. Cam-Winget et al. (2003) surveyed a variety of shortcomings in WEP. They write "_Experiments in the field indicate that, with proper equipment, it is practical to eavesdrop on WEP-protected networks from distances of a mile or more from the target._" They also reported two generic weaknesses: * the use of WEP was optional, resulting in many installations never even activating it, and * WEP did not include a key management protocol, relying instead on a single shared key amongst users. In 2005, a group from the U.S. Federal Bureau of Investigation gave a demonstration where they cracked a WEP-protected network in 3 minutes using publicly available tools.http://www.tomsnetworking.com/2005/03/31/the_feds_can_own_your_wlan_too/ In 2006, Bittau, Handley and Lackey showed that the 802.11 protocol itself can be used against WEP to enable earlier attacks that were previously thought impractical. After eavesdropping a single packet, an attacker can rapidly bootstrap to be able to transmit arbitrary data. Then the eavesdropped packet can be decrypted a byte at a time (by transmitting about 128 packets per byte to decrypt) to discover the local network IP addresses. Finally if the 802.11 network is connected to the Internet, the attacker can use 802.11 fragmentation to replay eavesdropped packets while crafting a new IP header on to them. The access point can then be used to decrypt these packets and relay them on to a buddy on the Internet, allowing real-time decryption of WEP traffic within a minute of eavesdropping the first packet. == Remedies === WEP2 A stopgap enhancement to WEP, implementable on _some_ (not all) hardware not able to handle WPA/WPA2, based on: * Enlarged IV value * Enforced 128-bit encryption However, WEP2 remains vulnerable to known WEP attacks -- at most it will just slow an attacker down a bit -- and thus shouldn't really be considered more secure than WEP. === WEPplus Also known as WEP+. A proprietary enhancement to WEP by Agere Systems (formerly a subsidiary of Lucent Technologies) that enhances WEP security by avoiding "weak IVs". It is only completely effective when WEPplus is used at _both ends_ of the wireless connection. As this cannot easily be enforced, it remains serious limitation. It is possible that successful attacks against WEPplus will eventually be found. It also does not necessarily prevent Replay attack|replay attacks. === WPA/WPA2 The most widely recommended solution to WEP security problems is to switch to WPA or WPA2. Either is much more secure than WEP. Some old WiFi access points might need to be replaced to do this or have their operating system, in flash memory, upgraded; however, replacements are relatively inexpensive. Another alternative is to use a tunneling protocol, such as IPsec, although that only protects traffic streams, not the network itself. == References * Nikita Borisov, Ian Goldberg, David Wagner, "Intercepting mobile communications: the insecurity of 802.11." MOBICOM 2001, pp180–189. * Nancy Cam-Winget, Russell Housley, David Wagner, Jesse Walker: Security flaws in 802.11 data link protocols. Communications of the ACM 46(5): 35-39 (2003) * Scott R. Fluhrer, Itsik Mantin, Adi Shamir, "Weaknesses in the Key Scheduling Algorithm of RC4". Selected Areas in Cryptography 2001: pp1–24. * Andrea Bittau, Mark Handley, Joshua Lackey, "The Final Nail in WEP's Coffin", IEEE Symposium on Security and Privacy (Oakland) 2006. * Update: Stepping Up Your WLAN Security (http://www.networkmagazineindia.com/200112/focus3.htm 802.11b) * Wireless LAN Deployment and Security Basics (http://www.extremetech.com/article2/0,1697,1157728,00.asp) * An Inductive Chosen Plaintext Attack against WEP/WEP2 (http://www.cs.umd.edu/~waa/attack/v3dcmnt.htm) * [http://www.starkrealities.com/wireless003.html It Came Out of the Sky -- WEP2, Credibility Zero] * [http://www.agere.com/NEWS/PRESS2001/111201b.html Agere Systems press release] ** [http://www.proxim.com/learn/library/whitepapers/wireless_security.pdf Wireless Network Security] ([[Proxim Wireless]] white paper) * Weak IVs ** [http://www.cs.virginia.edu/sammyg/CS551/node16.html Weak IV Attack] ** [http://www.informit.com/guides/content.asp?g=security&seqNum=85&rl=1 WPA Part 2: Weak IV's] ** [http://airsnort.shmoo.com/faq.html Frequently Asked Questions About AirSnort] * [http://www.cs.virginia.edu/sammyg/CS551/node18.html Replay Attack] ==External links== *[http://www.profit42.com/index.php/2006/08/02/92/ This simple but detailled guide describes how to crack wep step by step] *[http://www.isaac.cs.berkeley.edu/isaac/wep-faq.html (In)Security of the WEP algorithm] *[http://www.drizzle.com/~aboba/IEEE/rc4_ksaproc.pdf Weaknesses in the Key Scheduling Algorithm of RC4] *[http://www.cs.virginia.edu/sammyg/CS551/node12.html WEP Weaknesses] *[http://www.cs.umd.edu/~waa/wireless.html List of security problems with WEP] *[http://securityfocus.com/infocus/1814 WEP: Dead Again, Part 1 (Dec. 14, 2004)] *[http://securityfocus.com/infocus/1824 WEP: Dead Again, Part 2 (Mar. 8, 2005)] *[http://www.tomsnetworking.com/Sections-article111.php The Feds can own your WLAN too : TomsNetworking] * Humphrey Cheung, How to crack WEP, [http://www.tomsnetworking.com/Sections-article118.php part one], [http://www.tomsnetworking.com/Sections-article120.php part two], [http://www.tomsnetworking.com/Sections-article124.php part three] May/June 2005. *Several software tools are available to compute and recover WEP keys by passively monitoring transmissions. **[http://www.tuto-fr.com/tutoriaux/crack-wep/fichiers/wlan/en-index.php aircrack] **[[aircrack-ng|Aircrack-ng (aircrack-ng is the next generation of aircrack)]] **[http://airsnort.shmoo.com/ AirSnort] **[http://sourceforge.net/projects/wepcrack WEPCrack] **[http://sourceforge.net/projects/weplab Weplab] **[http://kismac.binaervarianz.de/ KisMAC] // Copyright (C) 2025 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/concepts/pages/protocol/wpa.adoc000066400000000000000000000220031522352605200265420ustar00rootroot00000000000000== Overview *Wi-Fi Protected Access* (*WPA* and *WPA2*) is a class of systems to secure wireless (Wi-Fi) computer networks. It was created in response to several serious weaknesses researchers had found in the previous system, Wired Equivalent Privacy (WEP). WPA implements the majority of the IEEE 802.11i standard, and was intended as an intermediate measure to take the place of WEP while 802.11i was prepared. WPA is designed to work with all wireless network interface cards, but not necessarily with first generation wireless access points. WPA2 implements the full standard, but will not work with some older network cards. Both provide good security, with two significant issues: * either WPA or WPA2 must be enabled and chosen in preference to WEP. WEP is usually presented as the first security choice in most installation instructions. * in the "Personal" mode, the most likely choice for homes and small offices, a passphrase is required that, for full security, must be longer than the typical 6 to 8 character passwords users are taught to employ. == History WPA was created by the The Wi-Fi Alliance, an industry trade group, which owns the trademark to the Wi-Fi name and certifies devices that carry that name. WPA is designed for use with an IEEE 802.1X authentication server, which distributes different keys to each user; however, it can also be used in a less secure *"pre-shared key" (PSK)* mode, where every user is given the same passphrase. The design of WPA is based on a Draft 3 of the IEEE 802.11i standard. The Wi-Fi Alliance created WPA to enable introduction of standard-based secure wireless network products prior to the IEEE 802.11i group finishing its work. The Wi-Fi Alliance at the time already anticipated the WPA2 certification based on the final draft of the IEEE 802.11i standard, therefore the tags on the frame fields (Information Elements or IEs) are intentionally made different from 802.11i to avoid the confusion in unified WPA/WPA2 implementations. Data is encrypted using the RC4 (cipher), with a 128-bit key and a 48-bit initialization vector (IV). One major improvement in WPA over WEP is the Temporal Key Integrity Protocol (TKIP), which dynamically changes keys as the system is used. When combined with the much larger IV, this defeats the well-known related-key attack on WEP. In addition to authentication and encryption, WPA also provides vastly improved payload integrity. The cyclic redundancy check (CRC) used in WEP is inherently insecure; it is possible to alter the payload and update the message CRC without knowing the WEP key. A more secure message authentication code (usually known as a MAC, but here termed a *MIC* for "Message Integrity Code") is used in WPA, an algorithm named "Michael". The MIC used in WPA includes a frame counter, which prevents replay attack being executed; By increasing the size of the keys and IVs, reducing the number of packets sent with related keys, and adding a secure message verification system, WPA makes breaking into a Wireless LAN far more difficult. The Michael algorithm was the strongest that WPA designers could come up with that would still work with most older network cards. Due to inevitable weaknesses of Michael, WPA includes special countermeasure mechanism that detects the attempt to break TKIP and temporarily blocks communications with the attacker. == WPA2 WPA2 implements the mandatory elements of 802.11i. In particular, in addition to TKIP and the Michael algorithm, it introduces a new Advanced Encryption Standard based algorithm, CCMP, that is considered fully secure. Official support for WPA2 in Microsoft Windows XP was rolled out on 1 May 2005. Driver upgrades for network cards may be required. Apple Computer supports WPA2 on all AirPort Extreme-enabled Apple Macintosh, the AirPort Extreme Base Station, and the AirPort Express. Firmware upgrades needed are included in AirPort 4.2, released July 14, 2005. Note that from March 13, 2006, WPA2 certification is mandatory for all new devices wishing to be Wi-Fi certified. == Security in pre-shared key mode Pre-shared key mode (PSK, also known as *personal* mode) is designed for home and small office networks that cannot afford the cost and complexity of an 802.1X authentication server. Each user must enter a passphrase to access the network. The passphrase may be from 8 to 63 ASCII characters or 64 hexadecimal digits (256 bits). If you choose to use the ASCII characters, a Hash_function|hash function reduces it from 504 bits (63 characters * 8 bits/character) to 256 bits (using also the SSID). The passphrase may be stored on the user's computer at their discretion under most operating systems to avoid re-entry. The passphrase must remain stored in the Wi-Fi access point. Security is strengthened by employing a PBKDF2 key derivation function. However, the weak passphrases users typically employ are vulnerable to password cracking attack. Password cracking can be defeated by using a passphrase of at least 5 Diceware words or 14 completely random letters with WPA and WPA2. For maximum strength, 8 Diceware words or 22 random characters should be employed. Passphrases should be changed at regular intervals, or whenever an individual with access is no longer authorized to use the network or when a device configured to use the network is lost or compromised. Some consumer chip manufacturers have attempted to bypass weak passphrase choice by adding a method of automatically generating and distributing strong keys through a software or hardware interface that uses an external method of adding a new Wi-Fi adapter or appliance to a network. These methods include pushing a button (Broadcom and Buffalo AirStation One-Touch Secure System]) and entering a short challenge phrase through software (Atheros). The Wi-Fi Alliance is currently working on standardisation of this approach as part of its Simple Configuration effort. == EAP types under WPA- and WPA2- Enterprise The Wi-Fi alliance has announced the inclusion of additional EAP (Extensible Authentication Protocol) types to its certification programs for WPA- and WPA2- Enterprise. This was to ensure that WPA-Enterprise certified products can interoperate with one another. Previously, only EAP-TLS (Transport Layer Security) was certified by the Wi-Fi alliance. The EAP types now included in the certification program are: * EAP-TLS (previously tested) * EAP-TTLS/MSCHAPv2 * PEAPv0/EAP-MSCHAPv2 * PEAPv1/EAP-GTC * EAP-SIM Other EAP types may be supported by 802.1X clients and servers developed by specific firms. This certification is an attempt for popular EAP types to interoperate; their failure to do so is currently one of the major issues preventing rollout of 802.1X on heterogeneous networks. == See also * WAPI — Chinese National Standard for wireless LAN security. * tinyPEAP — a small-footprint RADIUS server designed to load into a wireless access point * FreeRADIUS - a free [[open source]] RADIUS server * Radiuz — a "cooperative WiFi network" that provides free RADIUS service for WPA-Enterprise compatible routers * SecureMyWiFi — Service that provides WPA/WPA2-Enterprise security with User/Network Management Interface. * SecureEasySetup — a technology developed by Broadcom to easily set up wireless LANs with WPA == References * Wi-Fi Alliance. (2003). Wi-Fi Protected Access: Strong, standards-based, interoperable security for today’s Wi-Fi networks. Retrieved March 1, 2004 from http://www.wifialliance.com/OpenSection/pdf/Whitepaper_Wi-Fi_Security4-29-03.pdf * Wi-Fi Alliance. (2004). Wi-Fi Protected Access™ security sees strong adoption: Wi-Fi Alliance takes strong position by requiring WPA security for product certification. Retrieved January 5, 2004 from http://www.wi-fi.org/opensection/ReleaseDisplay.asp?TID=4&ItemID=165&StrYear=2004&strmonth=2 * Weakness in Passphrase Choice in WPA Interface, by Robert Moskowitz. Retrieved March 2, 2004 from http://wifinetnews.com/archives/002452.html * Press Release about new EAP types supported under WPA-Enterprise from http://www.wi-fi.org/OpenSection/ReleaseDisplay.asp?TID=4&ItemID=205&StrYear=2005&strmonth=4 == External links * Wi-Fi Alliance's WPA page (http://www.wi-fi.org/opensection/protected_access.asp) * Wi-Fi Alliance's Interoperability Certificate page (http://www.wi-fi.org/opensection/certification-certificate.asp) * Network Configuration with WPA (http://www.wi-fiplanet.com/tutorials/article.php/3552826) * Apple Airport and Wi-Fi Network Security (http://theworld.com/~reinhold/airport.html) * EAP types supported under WPA-Enterprise (http://www.wi-fi.org/OpenSection/eap.asp) * Linux WPA/WPA2/IEEE 802.1X Supplicant (http://hostap.epitest.fi/wpa_supplicant/) * SmithMicro Quicklink Mobile Software (http://www.smithmicro.com/default.tpl?sku=QLMWA0EE&group=product_full) * Steve Gibson's Perfect Passwords(https://www.grc.com/passwords/) * GRC's Ultra High Security Password Generators(http://darkvoice.dyndns.org/wlankeygen/ Online WEP-/WPA-Key Generator) // Copyright (C) 2025 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/concepts/pages/resources.adoc000066400000000000000000000023531522352605200261320ustar00rootroot00000000000000= RESOURCES == Primary Sites * *https://www.freeradius.org/[FreeRADIUS]* * *https://www.inkbridgenetworks.com/[Inkbridge Networks]* == Mailing lists include::ROOT:partial$mailinglist.adoc[] == RFCs * http://www.freeradius.org/rfc/[Related RFCs and Drafts] * https://datatracker.ietf.org/doc/html/rfc2865[RFC 2865] Remote Authentication Dial In User Service (RADIUS) * https://datatracker.ietf.org/doc/html/rfc2866[RFC 2866] RADIUS Accounting * https://datatracker.ietf.org/doc/html/rfc2867[RFC 2867] RADIUS Accounting Modifications for Tunnel Protocol Support * https://datatracker.ietf.org/doc/html/rfc2868[RFC 2868] RADIUS Attributes for Tunnel Protocol Support * https://datatracker.ietf.org/doc/html/rfc2869[RFC 2869] RADIUS Extensions * https://datatracker.ietf.org/doc/html/rfc3758[RFC 3748] Extensible Authentication Protocol (EAP) * https://datatracker.ietf.org/doc/html/rfc3579[RFC 3579] - RADIUS (Remote Authentication Dial In User Service) Support For Extensible Authentication Protocol (EAP) == Related RADIUS Sites * *https://www.iana.org/assignments/radius-types/radius-types.xhtml[RADIUS Packet Types]* // Copyright (C) 2025 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/concepts/pages/session/000077500000000000000000000000001522352605200247505ustar00rootroot00000000000000freeradius-3.2.10+dfsg/doc/antora/modules/concepts/pages/session/processing.adoc000066400000000000000000000147531522352605200277660ustar00rootroot00000000000000= Processing The server processes requests through local site policy. That policy is used to examine the request, the request attributes, and the attribute values. The server then builds a reply message using responses (determined by local policy) such as time of day restrictions, group access limitations, and IP address allocation. The processing stage may include keeping track of <>. == How things work in RADIUS The client sends the server a RADIUS authentication request. You don't decide what's in the request, the client does. The server doesn't decide what's in the request, the client does. The client is 100% responsible for everything in the request. .FreeRADIUS v3 Request Flow image:request_flow.svg[Process Flow railroad diagram]. === Summary of the Request Flow Steps . An end-user tries to access a network through a RADIUS client such as a wireless access point.  . The RADIUS client sends a request to the RADIUS server along with the user's credentials. . The RADIUS server verifies the user's credentials against its datastore (flat file, SQL, LDAP, etc.).  . If authentication passes, the server returns configuration details (including authorisation) to the client. The client can now grant network access to the end-user  . If the authentication fails, the server denies access, and the RADIUS client informs the end-user. Users new to RADIUS, AAA, or EAP are encouraged to read the standards listed below. This documentation provides you with a solid foundation in RADIUS concepts and EAP at a protocol level. - https://datatracker.ietf.org/doc/html/rfc2865[RFC 2865] - Remote Authentication Dial In User Service (RADIUS) - https://datatracker.ietf.org/doc/html/rfc2866[RFC 2866] - RADIUS Accounting - https://datatracker.ietf.org/doc/html/rfc3748[RFC 3748] - Extensible Authentication Protocol (EAP) - https://datatracker.ietf.org/doc/html/rfc2865[RFC 3579] - RADIUS Support For Extensible Authentication Protocol (EAP) == Request Processing When the server processes requests, it manages four xref:unlang:list.adoc[attribute lists]. All of these lists are available to all modules. All of these lists are available in xref:unlang:index.adoc[Unlang] .Attribute Lists and Details [cols="1,2"] |=== |*Attribute List*|*Description* |`request` |Attributes taken from the received packet. |`reply` |Attributes which will be sent in the reply. |`control` |Attributes used to control how the server operates. These are never sent in a packet. |`session-state` |Attributes which are saved and restored across multiple request / reply exchanges. |=== == Select an Auth-Type - authorise {} The RADIUS server looks at the request and says: > Hmmm... can I deal with this request? The answer to that depends on what authentication types are enabled in the server, what the server can look up in a datastore, and what is in the request. The server starts querying the modules in the authorise section: > Unix module, can you handle this one? > Pap module, can you handle this one? > Mschap module, can you handle this one? At some point, one of the modules will say: > Yes, I see something in the request I recognize. I can do something! The module does this by looking for key attributes in the received request, such as MS-CHAP-Challenge (for mschap), or CHAP-Challenge (for chap), or EAP-Message (for eap). Or it may just assume it needs to add something to every request. If the module thinks has a possibility of authenticating the user, it'll say: > I can't authenticate this user now (I was just told to authorise them i.e. set the Auth-Type), > but my pal in the Authenticate section can! > Hey, set the Auth-Type to me! TThe module performs no action if it doesn't recognize anything in the request. If the module knows it doesn't need to do lookups, the module also does nothing. == Authenticate a user - authenticate {} At the end of the authorise process, the server checks if the Auth-Type has been set by a module. If no module sets the Auth-Type, the server immediately rejects the request. For example, the client sends a request with a User-Password attribute, and pap is enabled. The pap module then sets the ``Auth-Type = pap``. During this authenticate process, the server calls the pap module again: > I see a User-Password, which is what the user entered. > That's nice, but I need to compare it with something. > Ah! Another module added the "known good" password for this user in authorise! Next, the server compares the local "known good" password to the password as entered by the user. This is how authentication works. The "known good" password comes from another module. The pap module just does PAP authentication, and nothing more. The benefit of this approach is that the "known good" password can come from the 'users' file, SQL, LDAP, ``/etc/passwd``, or any external program. For this example, the ldap module is listed in the authorise section. It will have run and checked: > Hmm... Can I find a "known good" password for this user? If so, it will have added the "known good" password to the request, so that another module in authenticate can use it. == Insufficient information But WAIT! What if the client sends a MSCHAP request? What does the RADIUS server say then? > Well, this difficult and not the same as previous request > That client has made this difficult. I'm limited by some constraints! In this case, the mschap module looks at the request, and finds the MS-CHAP attributes. It sets the *Auth-Type* to itself (mschap). A database module (such as LDAP, above) gets the "known good" password, and adds it to the request. The mschap module is then run for authentication. It looks for either a clear text password or nt-hash. See an explanation for this limitation is explained in the xref:protocol/authproto.adoc#Proto-Password-Compat[Protocol Password Compatibilty] table. If one of those hasn't been added by a database, the mschap module says: > Sorry, I can't authenticate the user, > because I don't have the information I need to validate MSCHAP. But now the server has run out of options! Its only choice was mschap because that's what the client sent in the request. The mschap module can't do anything because you didn't give it a useful "known good" password . So the server has no choice but to reject the request. The MSCHAP data might be correct, but the server has no way to know that. So it replies with a reject. // Copyright (C) 2025 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/concepts/pages/session/radius_session.adoc000066400000000000000000000072061522352605200306370ustar00rootroot00000000000000= RADIUS Sessions A RADIUS session consists of the following steps: . A remote user connects to a RADIUS client device (using Point-to-Point Protocol (PPP, 802.1X) or another Data Layer link protocol) and initiates a login: * The NAS initiates all conversations (Authentication Sessions) in RADIUS. * All information sent to the server is done solely at the discretion of the client. * The RADIUS server does not control what the NAS sends. . The Network Access Server communicates with the RADIUS server using a shared secret mechanism: * RADIUS uses User Datagram Protocol (UDP) port 1812 for authentication and 1813 for accounting. . The NAS sends a RADIUS message (called an Access-Request) to the server. * This message contains information about the user, including user name, authentication credentials, and requested service. * In addition, the message may contain information about the NAS, such as its host name, MAC address, or wireless SSID. * The message is sent using the Password Authentication Protocol (PAP), Challenge-Handshake Authentication Protocol (CHAP), or Extensible Authentication Protocol (EAP). * The server must decide whether to authenticate or authorise a user based solely on the information contained within the NAS request, as it does not have access to any additional user information. * If the NAS sends a packet with an authentication protocol that the server does not support, the server will reject that request. . The RADIUS server processes the request and verifies the login request against either a local data- base or the authentication service running on the network. * Authentication services can include: LDAP servers for a domain validation; Active Directory servers on Windows networks; Kerberos servers; SQL Server or another type of database for getting information from a database . The RADIUS server sends validation results back to the NAS in one of the following forms: Access Reject, Access Challenge, or Access Accept. * Access Reject locks the user out of the network if the user is invalid or not authorized, denying them access to the requested resource. * Access Challenge occurs when the server requires additional information from the user. Since RADIUS packages are limited in size, Access Challenges allow the exchange of larger amounts of data. * Access Accept provides the user access to the resource and contains policy information which the NAS uses to provide services to, and enforce the behavior of the user. An Access Accept condition does not apply to all resources. Each additional resource is checked as required. The RADIUS client also verifies the original access offered on a periodic basis. * An Access Accept response results in the NAS providing the following services to the remote client: supplys a static or dynamic IP address; assigning a Time-to-Live for the session; downloading and applying the users’ Access Control List (ACL); setting up any L2TP , VLAN, and QoS session parameters required . Once the session is established on the RADIUS client, the accounting process is initiated: * The Accounting-Request (start) message, sent by the NAS to the server, indicates the commencement of the session. The the session account record is then created. * The Accounting-Request account record is then closed. (stop) message indicates the end of the session; the session * The data stored in the database during the accounting sessions is used to generate billable information and reports. * Accounting information retained in the database includes the following: time of session, number of packets and amount of data transferred, user and machine identification, network address, and point of attachment information. freeradius-3.2.10+dfsg/doc/antora/modules/concepts/pages/session/radius_session_msg.adoc000066400000000000000000000244171522352605200315100ustar00rootroot00000000000000= Messages A RADIUS session message consists of a single User Datagram Protocol (UDP) packet, containing a short header followed by the authentication, authorisation, or accounting data. == Message Attributes Each message contains a list of Attribute Value Pairs (AVPs), commonly referred to as attributes. These attributes carry information from the NAS to the server or virtual proxy server and from the server to the NAS. Common attributes include items such as user name, password, IP address, and NAS address; each attribute contains only one of these items. An attribute can also contain sub-attributes, for grouping purposes. For a complete list of standardized attributes, see the http://freeradius.org/rfc/attributes.html[FreeRADIUS RFC Attributes] for more details. Each client and server supports only a limited set of attributes. In some cases, attributes may not be supported because the server or NAS software may have been written before a standard was published, or the software may not support that particular functionality. Consult the software vendor documentation to determine what attributes are supported. If the documentation doesn't contain this information, the select attributes are probably not supported. Contact the vendor for additional information. In addition to standardized attributes, vendors can extend RADIUS with vendor-specific attributes (VSAs). Using VSAs means that the vendor can rapidly add functionality without having to do a time-consuming standardisation process. In order to be useful in the RADIUS client protocol, however, VSAs must be defined on the RADIUS server. Because VSAs are non-standardized attributes, it is difficult to discover any information about them. In addition, they are all vendor-specific (only work on that vendor’s products). Thus, defining VSAs for RADIUS server use may be difficult. == Attribute Types Basic RADIUS attribute types are defined in http://tools.ietf.org/html/rfc2865[RFC 2865]. Since the original implementation and standardisation, additional attribute types have been also defined. .RADIUS Attribute Types [options="headers, autowidth"] |=== | *Type* | *Format* | *Description* | integer | Value between 0 - 4294967295 | Unsigned 32-bit integer. | ipaddr | x.x.x.x | IPv4 address | date | 10 digit epoch time (xxxxxxxxxx)| Unix timestamp in seconds since January 1, 1970 GMT. | string | Variable-length string field | Used by FreeRADIUS for printable text strings. | octet | Variable-length string field | Used by FreeRADIUS for binary data. | ifid | x.x.x.x.x.x.x.x | IPv6 interface ID (host portion). | ipv6addr | x.x.x.x.x.x.x.x | IPv6 address. | ipv6prefix | Value between 0 - 128 | IPv6prefix. | byte | Single-byte integer | Supported in FreeRADIUS > v2. Value between 0 - 255. | short | Two-byte integer | Supported in FreeRADIUS > v3. Values between 0 - 65535, integer64, 8-byte integer. |=== See xref:unlang:type/index.adoc[data types of attributes] for a more details. == https://github.com/FreeRADIUS/freeradius-server/tree/v3.2.x/share[Attribute Definition Dictionaries] FreeRADIUS contains over 100 dictionaries, which hold nearly 5000 attribute definitions. Unlike text-based protocols such as SMTP or HTTP, RADIUS is a binary protocol; therefore, although attributes are commonly referred to by name (for example, “User-Nameâ€), these names have no meaning in the protocol. Data (i.e., “User-Nameâ€) are encoded in a message as a binary header with binary data, and not as text strings. Dictionary files are used to map between the names used by people and the binary data in the RADIUS packets. The packets sent by the NAS contain attributes that have a number, a length, and binary data. By contrast, a dictionary file consists of a list of entries with name, number, and data type. The server uses the dictionaries to interpret the binary data as follows: the server searches the dictionaries to match the number from the packet, and the corresponding data type in the dictionary entry is then used by the server to interpret the binary data in the packet. The name within the dictionary entry appears in all logs and debug messages, in order to present the attribute in a form that is understandable to people. This process also works in reverse: the server uses the dictionaries to encode a string (i.e., “User-Name = Bobâ€) as “number, length, binary data†in a packet. For example, a server may receive a packet that contains the number 1 and some binary data. The server would not be able to decode these attributes without knowing if the binary data were in the form of a string, an IP address, or an integer. The corresponding dictionary entry may state: the number ‘1’ is called ‘User-Name’ and it is in the form ‘string’. This information (i.e., form = ‘string’), contained in the dictionary entry, allows the server to successfully decode the packet. Adding new attributes to RADIUS software is made simpler through the use of dictionaries, as they allow the administrator to create new mappings without upgrading the software. Vendors can define new attributes in the dictionary without changing any of the server or client source code. These new attributes can then be incorporated in policy decisions or logged in an accounting record.Vendors can also define new functionality for their equipment by publishing a new dictionary file. Server support for an NAS can easily be added by writing the correct dictionary file for that NAS. There is no direct connection between the NAS and the dictionary files, as the dictionary files reside only on the server. For example, if names are edited in a local dictionary file, there is no effect on any other NAS or RADIUS server, because these names appear only in the local dictionary file. The RADIUS packets remain in binary format and contain only numbers, not names. [NOTE] ==== Editing attribute names in a local dictionary file does not effect any other NAS or RADIUS server. Only the attribute numbers are encoded and sent in RADIUS packets. The NAS and server may use different dictionaries, which may cause problems if they are not coordinated (a set of data may be interpreted differently by the NAS and the server, i.e., as a string by the NAS and an IP address by the server) ==== Since the attribute names are not sent in RADIUS packets, the dictionaries are limited to the local server and to the policy implemented by that server. In this respect, NAS implementations are much simpler than server implementations. Each NAS “looks†in the RADIUS packet for what it “understands†and ignores everything else. In contrast, each RADIUS server is presented with all of the information from every NAS in the RADIUS deployment. Each RADIUS server must be capable of “understanding†the functionality and configure-ability of every attribute that is necessary to authenticate or authorise the users. == Dictionary File Format It is very important to use the correct dictionaries. If the wrong dictionaries are used, the server may not properly interpret local configuration, or generate the correct response for the NAS. If the server does not have access to the correct vendor-specific attributes and dictionaries, it cannot correctly process any VSAs it receives for that vendor. [NOTE] ==== Servers must have access to a vendor dictionary to understand vendor attributes. ==== Some servers may not contain all the necessary dictionary files because each vendor defines their own dictionaries and release schedule. If a server does not include dictionaries for a particular vendor, contact that vendor, and not the organisation that supplied the RADIUS server. [#server-attr] === Server-side Attributes Server-side attributes are attributes that control the server’s behavior. It is frequently necessary to define these server-side attributes, while ensuring that information pertaining to server-side attributes never gets sent through the network in a RADIUS message. Server-side attributes should not be included in RADIUS messages, since these attributes are internal to server implementation. Definitions for server-side attributes may vary by server vendor, or may vary even from one version of the same server to another. Only FreeRADIUS definitions for internal attributes are referenced in this document. Those definitions are generally the same across all versions of the server, but other vendors may have different implementations. Information such as “use LDAP server Xâ€, or “remember that the user is in group Y†should be used to create local policy. This information should be stored in server-side attributes (also known as “non-protocol attributesâ€). Server-side attributes are presented using the same format as standard or vendor RADIUS attributes. This format gives the administrator the same control over internal aspects of the server behavior as over the server external responses. The server-side attribute information can be retrieved as part of one policy and checked later as part of another policy. For example, the policy can say “use LDAP server X for this request†and “respond with attribute X, value Yâ€. === xref:session/processing.adoc[Processing Requests] The server processes requests through local site policy. That policy is used to examine the request, the request attributes, and the attribute values. The server then builds a reply message using responses (determined by local policy) such as time of day restrictions, group access limitations, and IP address allocation. The processing stage may include keeping track of <>. FreeRADIUS maintains these attribute lists for every request. .Attribute Lists and Details [cols="1,2"] |=== |*Attribute List*|*Description* |`request` |Attributes taken from the received packet. |`reply` |Attributes which will be sent in the reply. |`control` |Attributes used to control how the server operates. These are never sent in a packet. |`session-state` |Attributes which are saved and restored across multiple request / reply exchanges. |=== See the xref:unlang:list.adoc[Attribute Lists] reference documentation for more details. freeradius-3.2.10+dfsg/doc/antora/modules/developers/000077500000000000000000000000001522352605200225205ustar00rootroot00000000000000freeradius-3.2.10+dfsg/doc/antora/modules/developers/nav.adoc000066400000000000000000000004471522352605200241410ustar00rootroot00000000000000* xref:index.adoc[Developers] ** xref:bugs.adoc[Bugs] ** xref:coding-methods.adoc[Coding Methods] ** xref:coverage.adoc[Code Coverage] ** xref:profile.adoc[Profiling] ** xref:contributing.adoc[Contributing] ** xref:release-method.adoc[Release Method] ** xref:protocol-error.adoc[Protocol-Error] freeradius-3.2.10+dfsg/doc/antora/modules/developers/pages/000077500000000000000000000000001522352605200236175ustar00rootroot00000000000000freeradius-3.2.10+dfsg/doc/antora/modules/developers/pages/bugs.adoc000066400000000000000000000127141522352605200254140ustar00rootroot00000000000000= Bugs == Introduction The https://freeradius.org/[FreeRADIUS website] contains most of the information referenced in this document. This document is primarily for non-developers of the FreeRADIUS server. If you are able to patch the code to work correctly, then we invite you to join the development list to discuss it. If you’re the type who know little about how to code, then this is the place for you! == You found a bug Where the server terminates ungracefully due to a bus error, segmentation violation, or other memory error, you should create a new issue in the https://freeradius.org/[issue tracker], including information from the debugging sections below. For any other issues, first post and discuss them on the https://freeradius.org/support/[FreeRADIUS users list], to see if anyone can reproduce them. Often there’s a simple explanation of why the server behaves as it does, and it’s not necessarily a bug in the code, so browse the lists’ archives of the last two months, and if you don’t see messages about it, ask! If the behavior is correct but confusing, we think that’s a bug too, and you should file a bug against our documentation. For more information about the users list, the lists’ archives and the faq, please visit https://www.freeradius.org/list/users.html[FreeRADIUS org]. Please make sure to *read* and *respect* the house-rules. You will get much better response and much faster if you do! == Core dumps If the server (or one of the accompanying programs) core dumps, then you should rebuild the server as follows: ``` $ ./configure --enable-developer $ make $ make install ``` and then run the program again. You may have to to enable core dumps, via: ``` $ ulimit -c unlimited ``` When it core dumps, do: ``` $ gdb /path/to/executable /path/to/core/file ``` Enable logging in `gdb` via the following commands: ``` (gdb) set logging file gdb-radiusd.log (gdb) set logging on ``` and follow the instructions in the proceeding section. You can also enable the `panic_action` given in `raddb/radiusd.conf`. See the comments in that file for more details about automatically collecting gdb debugging information when the server crashes. == Debugging a live server If you can’t get a core dump, or the problem doesn’t result in a core dump, you may have to run the server under gdb. To do this, ensure that you have symbols in the binaries (i.e. a 'non-stripped' binary) by re-building the server as described in the previous section. Then, run the server under gdb as follows: ``` $ gdb radiusd ``` Enable logging in `gdb` via the following commands: ``` (gdb) set logging file gdb-radiusd.log (gdb) set logging on ``` Tell `gdb` to pass any necessary command-line arguments to the server: ``` (gdb) set args ... ``` Where the ``…'' are the command-line arguments you normally pass to radiusd. For debugging, you probably want to do: ``` (gdb) set args -fxx ``` Then, do: ``` (gdb) run ``` When something interesting happens, you can hit CTRL-C in the window, and you should be back at the gdb prompt: ``` (gdb) ``` And follow the instructions in the next section. == Obtaining useful information Once you have a core dump loaded into gdb, or FreeRADIUS running under gdb, you may use the commands below to get useful information about the state of the server. If the server was built with threads, you can do: ``` (gdb) info threads ``` Which will give you information about the threads. If the server isn’t threaded, that command-line will print a message saying so. Then, do: ``` (gdb) thread apply all bt full ``` If the server isn’t threaded, the `thread apply` section isn’t necessary The output should be printed to the screen, and also sent to the `gdb-radiusd.log` file. You should then submit the information from the log file, along with any server output, the output of `radiusd -xv`, and information about your operating system to: https://bugs.freeradius.org/ Submitting it to the bug database ensures that the bug report won’t get forgotten, and that it will be dealt with in due course. You should provide the issue number in any mail sent to the user’s list. == Valgrind On Linux systems, `valgrind` is a useful tool that can catch certain classes of bugs. To use it, run the server via: ``` $ valgrind --tool=memcheck --leak-check=full radiusd -Xm ``` It will print out certain kinds of errors to the screen. There may be a number of errors related to OpenSSL, dlopen(), or libtldl. We cannot do anything about those problems. However, any errors that are inside of the FreeRADIUS source should be brought to our attention. == Running with `screen` If the bug is a crash of the server, and it takes a long time for the crash to happen, perform the following steps: * Log in as root. * Open a https://www.gnu.org/software/screen/[screen] session: `$ screen bash`. * Make sure FreeRADIUS is not running. * Make sure you have all the debug symbols about, or a debugable version of the server installed (one built with `--enable-developer` as above). * Configure screen to log to a file by pressing `Ctrl+a`, then `h`. * Type `gdb /path/to/radiusd` (or /path/to/freeradius on Debian). * At the `(gdb)` prompt, type `run -X`. * Detach from screen with `Ctrl+a`, `d`. * When you notice FreeRADIUS has died, reconnect to your screen session `$ screen -D -r`. * At the `(gdb)` prompt type `where` or for _lots_ of info try `thread apply all bt full`. * Tell screen to stop logging, `Ctrl+a`, `h`. * Logout from screen. FreeRADIUS Project, copyright 2019 freeradius-3.2.10+dfsg/doc/antora/modules/developers/pages/coding-methods.adoc000066400000000000000000000176441522352605200273670ustar00rootroot00000000000000= Coding Methods The following is a short set of guidelines to follow while programming. It does not address coding styles, function naming methods, or debugging methods. Rather, it describes the processes which should go on in the programmer’s mind while they are programming. Coding standards apply to function names, the look of the code, and coding consistency. Coding methods apply to the daily practices used by the programmer to write code. == Comment your code If you don’t, you’ll be forced to debug it six months later, when you have no clue as to what it’s doing. If someone _really_ hates you, you’ll be forced to debug un-commented code that someone else wrote. You don’t want to do that. For FreeRADIUS, use doxygen `@`-style comments so you get the benefits of the developer documentation https://doc.freeradius.org/[site]. == Give things reasonable names Variables and functions should have names. Calling them `x`, `xx`, and `xxx` makes your life hell. Even `foo` and `i` are problematic. Avoid smurfs. Don’t re-use struct names in field names, i. e. [source,c] ---- struct smurf { char *smurf_pappa_smurf; } ---- If your code reads as full English sentences, you’re doing it right. == Check input parameters in the functions you write Your function _cannot_ do anything right if the user passed in garbage and you were too lazy to check for garbage input. `assert()` (`fr_assert()`) is ugly. Use it. [NOTE] ==== GIGO, "Garbage In, Garbage Out," is wrong. If your function gets garbage input, it should complain loudly and with great descriptiveness. ==== == Write useful error messages "Function failed" is useless as an error message. It makes debugging the code impossible without source-level instrumentation. If you’re going to instrument the code at source level for error messages, leave the error messages there, so the next sucker won’t have to do the same work all over again. == Check error conditions from the functions you call Your function _cannot_ do anything right if you called another function, and they gave you garbage output. One of the most common mistakes is: [source,c] ---- fp = fopen(...); fgetc(fp); /* core dumps! */ ---- If the programmer had bothered to check for a `NULL` fp (error condition), then they could have produced a descriptive error message instead of having the program core dump. == Core dumps are *ineffectual* If your program core dumps accidentally, it's an indication of bad or weak programming. You don’t know what your program is doing, or what it’s supposed to be doing when anything goes wrong. If it hits an `assert()` and calls `abort()`, you’re a genius. You’ve thought ahead to what _might_ go wrong, and put in an assertion to ensure that it fails in a _known manner_ when something _does_ go wrong. (As it usually does…) == Initialize your variables `memset()` (`talloc_zero()`) is your friend. `ptr = NULL` is nice, too. Having variables containing garbage values makes it easy for the code to do garbage things. The contents of local variables are inputs to your function. See xref:#_check_input_parameters_in_the_functions_you_write[#3]. It’s also nearly impossible for you to debug any problems, as you can’t tell the variables with garbage values from the real ones. == Don’t allow buffer over-runs They’re usually accidental, but they cause core dumps. `strcpy()` and `strcat()` are ugly. Use them under duress. `sizeof()` is your friend. == `const` is your friend If you don’t mean to modify an input structure to your function, declare it `const`. Declare string constants `const`. It can’t hurt, and it allows more errors to be found at compile time. Use `const` everywhere. Once you throw a few into your code, and have it save you from stupid bugs, you’ll blindly throw in `const` everywhere. It’s a life-saver. == Use C compiler warnings Turn on all of the C compiler warnings possible. You might have to turn some off due to broken system header files, though. But the more warnings the merrier. Getting error messages at compile time is much preferable to getting core dumps at run time. See xref:#_initialize_your_variables[#7]. Notice that the C compiler error messages are helpful? You should write error messages like this, too. See xref:#_write_useful_error_messages[#4]. == Avoid UNIXisms and ASCIIisms and visualisms You don’t know under what system someone will try to run your code. Don’t demand that others use the same OS or character set as you use. Never assign numbers to pointers. If foo is a `char*`, and you want it to be be `NULL`, assign `NULL`, not `0`. The zeroth location is perfectly as addressable as any other on plenty of OSes. Not all the world runs on Unix (though it should :) ). Another common mistake is to assume that the zeroth character in the character set is the string terminator. Instead of terminating a string with `0`, use `'\0'`, which is always right. Similarly, `memset()` with the appropriate value: `NULL`, `'\0'`, or `0` for pointers, chars, and numbers. Don’t put tabs in string constants, either. Always use `'\t'` to represent a tab, instead of ASCII 9. Literal tabs are presented to readers of your code as arbitrary whitespace, and it’s easy to mess up. == Make conditionals explicit Though it’s legal to test `if (foo) {}` if you test against the appropriate value (like `NULL` or `'\0'`), your code is prettier and easier for others to read without having to eyeball your prototypes continuously to figure out what you’re doing (especially if your variables aren’t well-named). See xref:#_give_things_reasonable_names[#2]. == Test your code Even Donald Knuth writes buggy code. You’ll never find all of the bugs in your code. But writing a test program definitely helps. This means that you’ll have to write your code so that it will be easily testable. As a result, it will look better and be easier to debug. == Hints, Tips, and Tricks This section lists many of the common `rules` associated with code submitted to the project. There are always exceptions… but you must have a really good reason for doing so. == Read the Documentation and follow the CodingStyle The FreeRADIUS server has a common coding style. Use real tabs to indent. There is whitespace in variable assignments (`i = 1`, not `i=1`). When in doubt, format your code to look the same as code already in the server. If your code deviates too much from the current style, it is likely to be rejected without further review, and without comment. == #ifdefs are ugly Code cluttered with `#ifdef` s is difficult to read and maintain. Don’t do it. Instead, put your `#ifdef` s in a header, and conditionally define `static inline` functions, or macros, which are used in the code. Let the compiler optimize away the 'no-op' case. Simple example, of poor code: [source,c] ---- #ifdef CONFIG_MY_FUNKINESS init_my_stuff(foo); #endif ---- Cleaned-up example: (in header): [source,c] ---- #ifndef CONFIG_MY_FUNKINESS static inline void init_my_stuff(char *foo) {} #endif ---- (in the code itself): [source,c] ---- init_my_stuff(dev); ---- == `static inline` is better than a macro Static inline functions are greatly preferred over macros. They provide type safety, have no length limitations, no formatting limitations, and under gcc they are as cheap as macros. Macros should only be used for cases where a static inline is clearly suboptimal (there a few, isolated cases of this in fast paths), or where it is impossible to use a static inline function (such as string-izing). `static inline` is preferred over `$$static __inline__$$`, `extern inline`, and `$$extern __inline__$$`. == Don’t over-design Don’t try to anticipate nebulous future cases which may or may not be useful: _Make it as simple as you can, and no simpler._ Split up functionality as much as possible. If your code needs to do two unrelated things, write two functions. Mashing two kinds of work into one function makes the server difficult to debug and maintain. freeradius-3.2.10+dfsg/doc/antora/modules/developers/pages/contributing.adoc000066400000000000000000000104341522352605200271600ustar00rootroot00000000000000= Contributing == Submitting patches or diff’s to the FreeRADIUS project For a person or company wishing to submit a change to the FreeRADIUS project the process can sometimes be daunting if you’re not familiar with "the system." This text is a collection of suggestions which can greatly increase the chances of your change being accepted. Note: Only trivial patches will be accepted via email. Large patches, or patches that modify a number of files MUST be submitted as a https://github.com/FreeRADIUS/freeradius-server/pulls[pull-request via GitHub]. == Hints and tips === 1. Describe your changes Describe the technical detail of the change(s) your patch or commit includes. Be as specific as possible. The WORST descriptions possible include things like "update file X", "bug fix for file X", or "this patch includes updates for subsystem X. Please apply." If your description starts to get long, that’s a sign that you probably need to split up your commit. See the next point. === 2. Separate your changes Separate each logical change into its own commit. For example, if your changes include both bug fixes and performance enhancements for a single module, separate those changes into two or more patches. On the other hand, if you make a single change to numerous files, group those changes into a single commit. Thus a single LOGICAL change is contained within a single commit. If one commit depends on another commit in order for a change to be complete, that is OK. Simply note "this commit depends on commit X" in the extended commit description. If your commit includes significant whitespace changes these should also be broken out into another, separate, commit. == Submitting patches via GitHub See the following links for more details about submitting via github: * https://help.github.com/articles/fork-a-repo * http://wiki.freeradius.org/contributing/GitHub == Submitting patches via email === 1. diff -u Use `diff -u` or `diff -urN` to create patches. All changes to the source occur in the form of patches, as generated by diff(1). When creating your patch, make sure to create it in unified diff format, as supplied by the `-u` argument to diff(1). Patches should be based in the root source directory, not in any lower subdirectory. To create a patch for a single file, it is often sufficient to do:: ``` SRCTREE=/home/user/src/freeradiusd/ MYFILE=src/modules/rlm_foo/foo.c cd $SRCTREE cp $MYFILE $MYFILE.orig vi $MYFILE # make your change diff -u $MYFILE.orig $MYFILE > /tmp/patch ``` To create a patch for multiple files, you should unpack a `vanilla`, or unmodified source tree, and generate a diff against your own source tree. For example: ``` MYSRC=/home/user/src/freeradiusd-feature/ gunzip freeradiusd-version.tar.gz tar xvf freeradiusd-version.tar diff -urN freeradiusd-version $MYSRC > ~/feature-version.patch ``` === 2. Select e-mail destination If you are on the developers mailing list, send the patch there. mailto:freeradius-devel@lists.freeradius.org[freeradius-devel@lists.freeradius.org] Otherwise, send the patch to mailto:patches@freeradius.org[patches@freeradius.org] === 3. No MIME, no links, no compression, no attachments. Just plain text The developers need to be able to read and comment on the changes you are submitting. It is important for a developer to be able to `quote` your changes, using standard e-mail tools, so that they may comment on specific portions of your code. For this reason, all patches should be submitting e-mail `inline`. Do not attach the patch as a MIME attachment, compressed or not. Many popular e-mail applications will not always transmit a MIME attachment as plain text, making it impossible to comment on your code. A MIME attachment also takes a bit more time to process, decreasing the likelihood of your MIME-attached change being accepted. Compressed patches are generally rejected outright. If the developer has to do additional work to read your patch, the odds are that it will be ignored completely. === 4. E-mail size Large changes are not appropriate for mailing lists, and some maintainers. If your patch, exceeds 5Kb in size, you must submit the patch via GitHub instead. === 5. Name the version of the server It is important to note, either in the subject line or in the patch description, the server version to which this patch applies. freeradius-3.2.10+dfsg/doc/antora/modules/developers/pages/coverage.adoc000066400000000000000000000004511522352605200262420ustar00rootroot00000000000000= Code Coverage We use the link:https://gcc.gnu.org/onlinedocs/gcc/Gcov-Intro.html#Gcov-Intro[gcov] tool to know our tests coverage. [source,shell] ---- $ make clean $ make coverage ---- If completed with success, a pretty report will be available in `${source_tree}/build/coverage/index.html` freeradius-3.2.10+dfsg/doc/antora/modules/developers/pages/index.adoc000066400000000000000000000007311522352605200255570ustar00rootroot00000000000000= FreeRADIUS Development List with some usual howtos for FreeRADIUS. Programming reference documentation can be found at the https://doc.freeradius.org/[Doxygen] site. == Topics * xref:bugs.adoc[Bugs] * xref:coding-methods.adoc[Coding Methods] * xref:coverage.adoc[Code Coverage] * xref:profile.adoc[Profiling] * xref:contributing.adoc[Contributing] * xref:release-method.adoc[Release Method] Also see the xref:installation:dependencies.adoc[build dependencies] page. freeradius-3.2.10+dfsg/doc/antora/modules/developers/pages/profile.adoc000066400000000000000000000013001522352605200261010ustar00rootroot00000000000000= Profiling Build with gperftools, and ensure that it's built: [source,shell] ---- $ grep profile Make.inc GPERFTOOLS_LIBS = -lprofiler ---- Run your test using the profiling tools. One signal will start the profiling, another will stop it. [source,shell] ---- env CPUPROFILE=/tmp/freeradius.prof CPUPROFILESIGNAL=12 freeradius ... killall -12 freeradius ... wait ... killall -12 freeradius ---- View the results [source,shell] ---- pprof --text /path/to/freeradius /tmp/freeradius.prof ---- or as a graph [source,shell] ---- pprof --gv /path/to/freeradius /tmp/freeradius.prof ---- or as cachgrind output [source,shell] ---- pprof --cachegrind /path/to/freeradius /tmp/freeradius.prof ---- freeradius-3.2.10+dfsg/doc/antora/modules/developers/pages/protocol-error.adoc000066400000000000000000000117701522352605200274450ustar00rootroot00000000000000= Protocol-Error Implementation The following is a set of notes for implementing Protocol-Error in FreeRADIUS 3.2. == Client Configuration Each client now has an additional configuration option: ``` protocol_error = yes # default is "no" ``` This configuration option is also exposed as in internal attribute for dynamic clients. The purpose of this option is to control whether or not we send a Protocol-Error response to the client. Previous versions of the server would synthesize an Access-Reject in some circumstances, and we don't want to change that behavior in a stable release. All new behavior for sending Protocol-Error to a client is enabled by setting this flag. == Encoder / Decoder The encoder and decoder have been updated to allow Protocol-Error. === Encoder The encoder has been updated to encode Protocol-Error as response packets. The encoding method used is the same as for Access-Accept, etc. This encoding means that Message-Authenticator is also added for all Protocol-Error packets, even for ones which are in response to Accounting-Request. We may be OK with relaxing this requirement in the future. The only magic in the encoder is that it automatically adds `Original-Packet-Code`. This attribute allows the client to associate the Protocol-Error responsewith (e.g.) Access-Request or Accounting-Request, even if both of those packets contain the same ID. i.e. there is no need for the RADIUS policies to add Original-Packet-Code. Since that attribute is required for protocol compliance, the encoder adds it automatically. FreeRADIUS tracks packets by ID, and not by packet Code. So this attribute isn't necessary. But maybe other RADIUS implementations need it. === Decoder The decoder has been updated to decode Protocol-Error as response packets for any request. Other than that, the decoder did not require any changes. == radclient radclient was updated to explicitly accept Protocol-Error as a response to Access-Request packets. Note that only the BlastRADIUS checks needed to be updated, because they checked the packet codes before calling the decoder. Since the decoder was updated to allow Protocol-Error, no additional changes to radclient were needed. == Server The server had a number of changes in order to support Protocol-Error. === Input Queue When the server is busy and cannot enqueue a new packet, it previously just discarded the request. It now checks if the client supports Protocol-Error. If so, it immediately encodes and sends a Protocol-Error response. The request is also marked up as done/completed/cleaned-up immediately. Since the server is busy, there isn't much utility in caching the packet for a "cleanup delay". NOTE: We may want to add "cleanup delay" handling in the future. === Modules The `realm` module has been updated to configurable return `notfound` when the destination realm isn't found. As this is a behavior change, it is hidden behind a new module configuration flag ``` return_notfound = yes # default is "no" ``` === Default Virtual Server The `default` virtual server has been updated with a commented-out configuration for Protocol-Error. The configuration is after the `suffix` module, which is used for routing packets based on realms: ``` authorize { ... suffix if (notfound && ("%{client:protocol_error}" == "yes")) { update { &control:Response-Packet-Type := Protocol-Error &reply:Error-Cause := Proxy-Request-Not-Routable } handled } ... } ``` === Proxied Requests No changes are made to proxied requests. === Proxied Responses The server always accepts Protocol-Error as a response to any proxied request. This behavior is not configurable. There doesn't seem to be any good reason to ignore/discard Protocol-Error responses. If the server never receives a reply from the home server, it checks if the client can receive Protocol-Error. If so, it synthesizes a Protocol-Error reply, and runs it through the "proxcess proxy reply" functionality. It also adds an Error-Cause with a value that is appropriate for what happened. If the server never receives a reply from the home server, a policy in the Post-Proxy-Type section can still manually create a Protocol-Error packet. This is allowed because maybe there's a situation where checking the client `protocol_error` flag isn't enough. Again, it also adds (if necessary) an Error-Cause with a value that is appropriate for what happened. If the policy added Error-Cause, then that value isn't changed. NOTE: The server does not re-proxy the packet if it receives a Protocol-Error response from the home server. === Finished Processing, Sending Response Once a request is done processing, a response is sent. Since not all clients support Protocol-Error, the code checks if a policy (or home server) created a Protocol-Error response. If it is there, the packet code is mashed to "no reply". This change allows the rest of the code to determine what response (if any) is sent. For example, the historic behavior for Access-Request is to send a synthesized Access-Reject. freeradius-3.2.10+dfsg/doc/antora/modules/developers/pages/release-method.adoc000066400000000000000000000016321522352605200273470ustar00rootroot00000000000000= Release Method == Topics [arabic] . As of 2.0, the release process is much simpler. Edit the Changelog with the version number and any last updates. ``` # vi doc/ChangeLog # git commit doc/ChangeLog ``` [arabic, start=2] . Change version numbers in the VERSION file: ``` # vi VERSION # git commit VERSION ``` [arabic, start=3] . Make the files NOTE: It also does `make dist-check`, which checks the build rules for various packages. ``` # make dist ``` [arabic, start=4] . Validate that the packages are OK. If so, tag the release. NOTE: This does NOT actually do the tagging! You will have to run the command it prints out yourself. ``` # make dist-tag ``` [arabic, start=5] . Sign the packages. You will need the correct GPG key for this to work. ``` # make dist-sign ``` [arabic, start=6] . Push to the FTP site. You will need write access to the FTP site for this to work. ``` # make dist-publish ``` freeradius-3.2.10+dfsg/doc/antora/modules/howto/000077500000000000000000000000001522352605200215105ustar00rootroot00000000000000freeradius-3.2.10+dfsg/doc/antora/modules/howto/nav.adoc000066400000000000000000000025701522352605200231300ustar00rootroot00000000000000* xref:index.adoc[Howto Guides] ** Protocols **** xref:protocols/dhcp/index.adoc[DHCP] ***** xref:protocols/dhcp/prepare.adoc[Preparation] ***** xref:protocols/dhcp/enable.adoc[Enabling the DHCP service] ***** xref:protocols/dhcp/test.adoc[Testing the DHCP service] ***** xref:protocols/dhcp/policy.adoc[Defining the DHCP policy] ****** xref:protocols/dhcp/policy_ippool_creation.adoc[IP pool creation] ****** xref:protocols/dhcp/policy_common_options.adoc[Common options] ****** xref:protocols/dhcp/policy_network_options.adoc[Network options and IP pool selection] ****** xref:protocols/dhcp/policy_subnet_options.adoc[Subnet options] ****** xref:protocols/dhcp/policy_device_options.adoc[Device, class and group options] ****** xref:protocols/dhcp/policy_ippool_access.adoc[IP pool access restriction] **** xref:protocols/proxy/index.adoc[PROXY Protocol] ***** xref:protocols/proxy/enable_radsec.adoc[Enabling RadSec] ***** xref:protocols/proxy/radsec_client.adoc[Configuring a test RadSec client] ***** xref:protocols/proxy/radsec_with_haproxy.adoc[Proxying RadSec with HAproxy] ***** xref:protocols/proxy/radsec_with_traefik.adoc[Proxying RadSec with Traefik] ***** xref:protocols/proxy/enable_proxy_protocol.adoc[Enabling PROXY Protocol for RadSec] ** xref:monitoring/index.adoc[Monitoring] *** xref:monitoring/statistics.adoc[Server statistics] ** xref:simultaneous_use.adoc[Simultaneous-Use] freeradius-3.2.10+dfsg/doc/antora/modules/howto/pages/000077500000000000000000000000001522352605200226075ustar00rootroot00000000000000freeradius-3.2.10+dfsg/doc/antora/modules/howto/pages/index.adoc000066400000000000000000000014031522352605200245440ustar00rootroot00000000000000= Howto Guides The documents in this section describe how to perform various common tasks with FreeRADIUS. They also provide worked examples on using the various modules in common deployment scenarions. If you have a topic you'd like to see included in the list of howtos, contact the developers on the link:http://lists.freeradius.org/mailman/listinfo/freeradius-users[User's mailing list]. Some of the documents here started life as pages on link:http://wiki.freeradius.org[wiki.freeradius.org]. If you've just been through a particularly arduous service configuration and deployment, and would like to help your fellow users, then please create a new how to on the wiki. If it's popular enough, we'll include it in the official documentation for the next release. freeradius-3.2.10+dfsg/doc/antora/modules/howto/pages/monitoring/000077500000000000000000000000001522352605200247745ustar00rootroot00000000000000freeradius-3.2.10+dfsg/doc/antora/modules/howto/pages/monitoring/index.adoc000066400000000000000000000046701522352605200267420ustar00rootroot00000000000000= Monitoring Any good systems administrator will want to know how well their systems are operating, both to catch issues before they become a serious problem, or for long term analysis. The term "monitoring" can encompass all kinds of watching how the system is working, from generating and watching logs, gathering statistics or ensuring that the service daemon is still running and serving requests. We break the different types of monitoring down into the following sections. == Service checking Checking the running service can include the following: * Ensuring the daemon is still running, i.e. process monitoring * Sending regular RADIUS authentication or accounting requests and checking they are correctly responded to * Sending Status-Server RADIUS requests Within a proxy environment FreeRADIUS needs to know if upstream proxies are available. It can do this itself using the latter two options above. == Logging System logs are often the most critical part of a RADIUS system. They are necessary for the administrator to know who has logged in and when, for debugging purposes such as when an end user cannot connect, and often for regulatory or compliance purposes. RADIUS server logs are also often used as a basic form of recording accounting requests, which are in and of themselves a form of logging by the NAS. Getting correct logging systems operational is key to running an efficient and easy to maintain RADIUS server. FreeRADIUS has many options for being able to generate and store logs, including the following: * Main daemon logging, configured in `radiusd.conf` * Line-based text logging, using `rlm_linelog` * Detailed RADIUS packet logs, using `rlm_detail` As well as recording direct to disk, the above can be sent via a local syslog server, which opens up many opportunities for central logging. It is possible to integrate FreeRADIUS into other more complicated logging systems, some options may include: * To CSV files, for example via `rlm_linelog` * Writing entries to an SQL database using `rlm_sql` * Into a log management system such as Elasticsearch or Graylog == Statistics gathering It is often useful to collect statistics from a running RADIUS server. These are often plotted on graphs to show current load or for trend analysis, as well as an indication of system operation. Statistics are usually gathered in two ways: * FreeRADIUS xref:monitoring/statistics.adoc[internal statistics] * Analysing logs with some external tool freeradius-3.2.10+dfsg/doc/antora/modules/howto/pages/monitoring/statistics.adoc000066400000000000000000000265371522352605200300330ustar00rootroot00000000000000= Server statistics FreeRADIUS collects statistics internally about certain operations it is doing, such as the number of authentication and accounting requests, how many accepts and failures, and server queue lengths. These can be queried by sending a specially-crafted RADIUS `Status-Server` packet to a "status" virtual server. == Configuring the status virtual server The `status` virtual server is present in the default configuration, but needs to be enabled before it can be used. To do this, create a symlink from `sites-enabled/status` to `../sites-available/status`: [source,shell] ---- # cd raddb/sites-enabled # ln -s ../sites-available/status ---- [NOTE] ==== If you are not starting from the default configuration, check that `status_server` is still set to `yes` in `raddb/radiusd.conf` as well. ==== While the default configuration will work for most setups, you may edit the virtual server configuration in `sites-enabled/status`. No major changes are necessary here, though the default secret, `adminsecret`, should be changed. Other possible changes may be the listening IP address and port, and the clients that are allowed to connect. By default, connections are restricted to the local host only. Having enabled and configured the status server, restart FreeRADIUS to make it active. == Querying the server To get the current statistics from the server, send a RADIUS request of type `Status-Server` to the status port. Unless edited above, the request must come from the same server that FreeRADIUS is running on, and be sent to port 18121 with the secret 'adminsecret' . At a minimum, the `FreeRADIUS-Statistics-Type` attribute must be set. For example: $ cat < FreeRADIUS-Statistics-Type = 0x01 > Message-Authenticator = 0x00 > EOF Sent Status-Server Id 145 from 0.0.0.0:b852 to 127.0.0.1:18121 length 62 FreeRADIUS-Statistics-Type = Authentication Message-Authenticator = 0x00 Received Access-Accept Id 145 from 127.0.0.1:46c9 to 127.0.0.1:47186 length 152 FreeRADIUS-Total-Access-Requests = 27 FreeRADIUS-Total-Access-Accepts = 20 FreeRADIUS-Total-Access-Rejects = 1 FreeRADIUS-Total-Access-Challenges = 0 FreeRADIUS-Total-Auth-Responses = 5 FreeRADIUS-Total-Auth-Duplicate-Requests = 0 FreeRADIUS-Total-Auth-Malformed-Requests = 0 FreeRADIUS-Total-Auth-Invalid-Requests = 0 FreeRADIUS-Total-Auth-Dropped-Requests = 0 FreeRADIUS-Total-Auth-Unknown-Types = 0 FreeRADIUS-Total-Auth-Conflicts = 0 The `FreeRADIUS-Statistics-Type` attribute is a bitmask - add together the following numbers to select the statistics required. Some options are mutually exclusive, so it might be necessary to send multiple requests to collect all information. [%header,cols="2,1,1,5"] |=== |Name|Hex value|Decimal value|Description |Authentication |0x01 |1 |Stats about authentications |Accounting |0x02 |2 |Stats about accounting |Proxy Auth |0x04 |4 |Proxied authentication requests |Proxy Accounting |0x08 |8 |Proxied accounting requests |Internal |0x10 |16 |Queue lengths, thread information etc. |Client |0x20 |32 |Statistics about RADIUS clients e.g. defined in `clients.conf` |Server |0x40 |64 |Statistics about server 'listen' sockets e.g. in `sites-enabled/*` |Home Server |0x80 |128 |Statistics about a proxy home servers e.g. in `proxy.conf` |=== == Worked examples To show the statistics available, a few examples follow. === Global server authentications Using `FreeRADIUS-Statistics-Type = 0x01` requests stats about authentications. Because, for example, no "Client" qualifier has been added (`0x20`) the numbers are global to the server. [source,shell] ---- # cat <` below. The sample configuration files are well commented describing what each configuration option does. FreeRADIUS compiled from source will default to `/usr/local/etc/raddb`. Pre-built packages will default to either `/etc/raddb` or `/etc/freeradius`. === Enable the DHCP virtual server The FreeRADIUS configuration separates each network service that it provides into "virtual servers". A number of sample virtual server definitions are provided in `/sites-available`, one of which is the sample configuration for a DHCP service. Sites may be added to the working configuration by either creating a symlink to them or copying them to `/sites-enabled` depending on how you wish to manage future upgrades. [TIP] ==== As with other package-managed configuration files, package upgrades will not automatically replace files that you have edited but you will need to resolve any local differences. Creating copies avoids the need to resolve conflicts during a package upgrade. ==== Add the DHCP virtual server to the active configuration: [source,shell] ---- cd /sites-enabled ln -s ../sites-available/dhcp . ---- or: [source,shell] ---- cd /sites-enabled cp ../sites-available/dhcp . ---- The sample configuration has been set up in such a way that it is initially safe. It will not actually take over live DHCP serving on the network when it is simply enabled until it is configured to do so. Rather is set up for testing prior to going live. The virtual server begins with a `listen` section. In this section your need to modify the following configuration items: `ipaddr`:: The IP address to listen on. `src_ipaddr`:: The source IP for unicast packets. `port`:: The port to listen on. Setting this to `67` will make the DHCP service live on the network. `interface`:: The network interface to listen on. `broadcast`:: Allow broadcast packets. For most live systems this will need to be set to `yes`. Below the `listen` section, there are sections that define how to respond to each of the DHCP packet types. Most installations will require that you review the settings for `DHCP-Discover` and `DHCP-Request`. Their contents contain directives in the FreeRADIUS policy language, "unlang". Many examples are provided which have been carefully described. === Enable SQL and IP pool modules FreeRADIUS has many modules to support different aspects of the functionality required for the network protocols it can process. The two of most significance for DHCP are `dhcp_sql` and `dhcp_sqlippool`. As with virtual servers, a number of example module configurations are available in `/mods-available`. These should be symlinked or copied into `/mods-enabled` in order to enable them. ==== Configure the `dhcp_sql` module Add the `dhcp_sql` module to the active configuration: [source,shell] ---- cd /mods-enabled ln -s ../mods-available/dhcp_sql . ---- or: [source,shell] ---- cd /mods-enabled cp ../mods-available/dhcp_sql . ---- The `dhcp_sql` module should be configured with the connection parameters for whichever database is to be used. The key configuration items are: `dialect`:: Which SQL dialect is in use. `driver`:: Which driver to use to access the database. For most databases this is `rlm_sql_`, however Microsoft SQL Server has a choice of drivers. Then, there are configuration options that are unique to each database, including connection details. For most databases these are: `server`:: The host name or IP address of the database server. `port`:: The port to connect to the database server on. `login`:: The user name used to connect to the database. `password`:: The password for authenticating to the database. `radius_db`:: The name of the database. [NOTE] ==== SQLite does not use these connection options, rather the `filename` option within the `sqlite` section is used to determine where the database will be stored. ==== ==== Configure the `dhcp_sqlippool` module Add the `dhcp_sqlippool` module to the active configuration: [source,shell] ---- cd /mods-enabled ln -s ../mods-available/dhcp_sqlippool . ---- or [source,shell] ---- cd /mods-enabled cp ../mods-available/dhcp_sqlippool . ---- The `dhcp_sqlippool` module must be configured. The key configuration items are: `dialect`:: Set this to the same SQL dialect as in the `sql` module. `offer_duration`:: How long an IP is offered to the client in a DHCP OFFER. `lease_duration`:: How long an IP is leased to the client in a DHCP ACK. === Provision the database You should provision your database by creating a user for FreeRADIUS (matching the configuration that you have previously provided) and then loading the schema. The procedure for doing this will vary according to the database server. The schema, stored procedure definition and any additional setup scripts for your database are in `/mods-config/sql/ippool-dhcp/{dialect}/`. === Test FreeRADIUS startup Once you have provisioned your schema, created a user account and granted access to the user, you should be able to start FreeRADIUS. If FreeRADIUS has been configured correctly then the output of `ss` will contain a line showing that FreeRADIUS is listening for DHCP packets on the designated interface on port 67: .Example of FreeRADIUS listening on `` for DHCP packets ================================================================== # ss -lunp Netid Recv-Q Send-Q Local Address:Port ... udp 0 0 0.0.0.0%:67 ... users:(("radiusd",...)) ================================================================== Note that if the database is inaccessible then FreeRADIUS will normally refuse to start. The FreeRADIUS wiki contains extensive information about debugging FreeRADIUS startup issues that we do not repeat in any detail here. Essentially, stop your init system from repeatedly trying to launch FreeRADIUS: [source,shell] ---- service radiusd stop ---- Then start FreeRADIUS manually in debug mode: [source,shell] ---- radiusd -X ---- Carefully read the output since this will tell you why FreeRADIUS was unable to start. Once you have fixed the issue start FreeRADIUS as normal: [source,shell] ---- service radiusd start ---- Now xref:protocols/dhcp/test.adoc[test the DHCP service] to ensure that it is responding to requests. freeradius-3.2.10+dfsg/doc/antora/modules/howto/pages/protocols/dhcp/index.adoc000066400000000000000000000027321522352605200275140ustar00rootroot00000000000000= FreeRADIUS DHCP server This guide describes how FreeRADIUS can be used in place of ISC DHCP or ISC Kea to provide a significantly more performant and, above all, more flexible DHCP server. This guide provides a suggested configuration that should be somewhat familiar to anyone who has previously implemented DHCP using the most frequently used features of other DHCP server software. The modular design of FreeRADIUS means that there is no one "right" way to implement the DHCP service. FreeRADIUS allows you to put together a "mix and match" approach. For example you can manage the leases in an SQL database. You might then hard code certain DHCP reply parameters within configuration and then look up additional parameters using a datastore such as: * a local file such as a structured text file or an SQLite database * an organisational LDAP directory * an SQL or "no SQL" database * a remote endpoint such as a RESTful HTTP API The policy language and modular configuration of FreeRADIUS is sufficiently powerful and that almost any aspect of the server's behaviour can be customised to implement even the most sophisticated DHCP configurations. == Sections in this guide This guide is organised into four parts that should be read in order: 1. xref:protocols/dhcp/prepare.adoc[Preparation] 2. xref:protocols/dhcp/enable.adoc[Enabling the DHCP service] 3. xref:protocols/dhcp/test.adoc[Testing the DHCP service] 4. xref:protocols/dhcp/policy.adoc[Defining the DHCP policy] freeradius-3.2.10+dfsg/doc/antora/modules/howto/pages/protocols/dhcp/policy.adoc000066400000000000000000000017521522352605200277050ustar00rootroot00000000000000== Defining the DHCP policy Now that FreeRADIUS is successfully running as a DHCP server it is necessary to configure a DHCP policy so that it returns correctly formed responses to the DHCP requests that it receives. This involves a number of steps: * xref:protocols/dhcp/policy_ippool_creation.adoc[Defining the IP address pools.] * xref:protocols/dhcp/policy_common_options.adoc[Defining the options that are common to all replies.] * xref:protocols/dhcp/policy_network_options.adoc[Defining the options for the network from which the request originates and ensuring that IP addresses are allocated from the correct pool.] * xref:protocols/dhcp/policy_subnet_options.adoc[Defining the options for the subnet to which this issued IP address belongs.] * xref:protocols/dhcp/policy_device_options.adoc[Defining the device, class and group based options specific to the device.] * xref:protocols/dhcp/policy_ippool_access.adoc[Using device properties to restrict access to certain pools.] freeradius-3.2.10+dfsg/doc/antora/modules/howto/pages/protocols/dhcp/policy_common_options.adoc000066400000000000000000000060601522352605200330250ustar00rootroot00000000000000== Configure common reply options FreeRADIUS includes a powerful xref:index.adoc[policy language] called "unlang". Statements in unlang may be used to call further policies, update attribute lists and invoke modules. There are also control flow statements (if, switch, etc.) typical of most imperative languages. FreeRADIUS has a number attribute lists that it maintains as it processes packets within the virtual server sections. Most relevant to DHCP are `request`, `control` and `reply`. The DHCP options from the current request packet are provided in the `request` list. This includes fixed DHCP parameters such as `DHCP-Client-Hardware-Address`, optional parameters such as `DHCP-Requested-IP-Address`, and parameters synthesised by FreeRADIUS such as `DHCP-Message-Type` and `DHCP-Network-Subnet`. DHCP options can be set by updating their value in the `reply` list. This forms the basis of the packet returned to the client. In the default DHCP server configuration, a "policy" (akin to a subroutine) is used to set common options for reply packets. The policy is found in `/policy.d/dhcp`. Look at the contents of the `dhcp_common` section and set any global options applicable to all clients in this policy. [source,unlang] ---- dhcp_common { update reply { &DHCP-Domain-Name-Server := 8.8.8.8 &DHCP-Domain-Name-Server += 8.8.4.4 &DHCP-Subnet-Mask := 255.255.255.0 &DHCP-Router-Address := 192.0.2.1 ... } } ---- Note, FreeRADIUS has four main operators for assigning values to attributes: `=`:: Add the attribute to the list, if and only if an attribute of the same name is not already present in that list. `:=`:: Add the attribute to the list. If any attribute of the same name is already present in that list it is replaced with the new one. `+=`:: Add the attribute to the tail of the list, even if attributes of the same name are already present in the list. `^=`:: Add the attribute to the head of the list, even if attributes of the same name are already present in the list. These operators allow for attributes to be set to default values and then overwritten, e.g. setting a default lease time, but then overwriting it for a particular group of clients. Attributes in the `control` list are not returned in the DHCP reply packets but instead govern aspects of server's behaviour. To use an SQL backend for either static or dynamic IP allocation, un-comment the block: [source,unlang] ---- update control { &Pool-Name := "local" } dhcp_sqlippool ---- The `Pool-Name` control attribute is used in looking up addresses in the database. The line containing `dhcp_sqlippool` is a call to invoke an instance of a module with that name. This module is responsible for assigning a free IP address into the `DHCP-Your-IP-Address` reply attribute from the pool identified by `Pool-Name`. Here `Pool-Name` is being set to a constant value (`local`) indicating that a single pool is to be used. If you have multiple pools, then replace this `update` block with logic to map clients to the correct pool, as described below. freeradius-3.2.10+dfsg/doc/antora/modules/howto/pages/protocols/dhcp/policy_device_options.adoc000066400000000000000000000244021522352605200327740ustar00rootroot00000000000000== Configure "device", "class" and "group" options Beyond the global, network and subnet options already described, most sites will have a number of group or class based options, and have a requirement for setting reply parameters against individual devices. In general, FreeRADIUS does not differentiate between "classes" (memberships defined by some attribute of the DHCP request) and "groups" (memberships defined by some manually aggregation related devices, typically based on lists of MAC address). The sample DHCP configuration provided with FreeRADIUS makes use of an internal attribute `DHCP-Group-Name` to support the setting of different options for different groups of devices. In general the groups to which a device belongs is determined during the processing of a request and these are added as instances of the `DHCP-Group-Name` attribute. This may be by performing a test on one or more request parameters (akin to a "class"), hash-based lookup of up all of part of an attribute in a local list (akin to a "subclass"), or doing the same using a remote datastore (SQL, LDAP, REST API, etc). FreeRADIUS can then iterate over `DHCP-Group-Name` to set group-specific options. We describe some of these options in more detail. === Directly in Policy Simple class options can be written directly into policy. This is most suited to those options that rarely change and are based on attributes in the request such as the `User-Class`. Consider the ISC DHCP configuration snippet: [source,iscdhcp] ---- filename "undionly.kpxe"; class "pxeclient" { match option substring(user-class,0,4); } subclass "pxeclient" "iPXE" { filename "http://my.web.server/boot_script.php"; } ---- Or the equivalent Kea configuration: [source,isckea] ---- "Dhcp4": { "option-data": [ { "name": "boot-file-name", "data": "undionly.kpxe" } ], "client-classes": [ { "name": "pxeclient", "test": "substring(option[77],0,4) == 'iPXE'", "option-data": [ { "name": "boot-file-name", "data": "http://my.web.server/boot_script.php" } ] } ] ... } ---- These define the "filename" DHCP option differently based on whether or not the supplied "user-class" option begins with "iPXE". FreeRADIUS provides multiple ways for this to be configured. For example, the following "unlang" policy implements the class options defined above: [source,unlang] ---- if (&DHCP-User-Class && "%{substring:&DHCP-User-Class 0 4}" == "iPXE") { update reply { &DHCP-Boot-Filename := "http://my.web.server/boot_script.php" } } else { update reply { &DHCP-Boot-Filename := "undionly.kpxe" } } ---- Policy-based configuration of DHCP options is also useful for complex matching. For example, the following Unlang sets the DHCP-Boot-Filename parameter based on the request's DHCP-Client-Identifier using regular expression captures, provided that it matches the given format: [source,unlang] ---- if (&DHCP-Client-Identifier && \ "%{string:DHCP-Client-Identifier}" =~ /^RAS([0-9])-site([A-Z])$/) { update reply { &DHCP-Boot-Filename := "rasboot-%{1}-%{2}.kpxe" } } ---- === In Text Files The `files` module that has already been described for global, network and subnet options can also be used to apply options to groups of clients. Firstly we must defined a mapping from a set of clients clients to their respective groups. One option for this is to use the `passwd` module, for which a sample configuration is included. Firstly symlink or copy the module configuration `/mods-available/dhcp_passwd` into `/mods-enabled/`. The suggested configuration expects the group membership file to be in `/mods-config/files/dhcp_groups` and take the form of: [source,config] ---- |,, |, ---- i.e. one line for each group starting with the group name followed by a pipe character and then a comma-separated list of hardware addresses. The `allow_multiple_keys` option allows for a host to be a member of more than one group. Sample configuration for looking up group options is contained in `/policy.d/dhcp` in the `dhcp_group_options` policy and in `/mods-available/dhcp_files` as the `dhcp_set_group_options` instance. The same data file `/mods-config/files/dhcp` is used to lookup group options as was used for global and network options. In this instance, add entries with the group name as the key such as: [source,config] ---- group1 DHCP-Log-Server := 10.10.0.100, DHCP-LPR-Server := 10.10.0.200 group2 DHCP-LPR-Server := 192.168.20.200 ---- === In the SQL Database Policy and files are both read during startup and editing them while FreeRADIUS is running will not result in any changes in behaviour. If you require regular changes to DHCP options, then storing them in an SQL database provides greater flexibility since the queries will be run in response to each DHCP packet rather than requiring the server to be restarted. DHCP reply options for devices (including network-specific options) can be fetched from SQL using an arbitrary lookup key. This can be performed multiple times as necessary using different contexts, for example to first set subnet-specific options and then to set group-specific options. The default schema contains three tables to support this: "dhcpreply" contains reply options for a given identifier (e.g. MAC Address): .dhcpreply table |=== |Identifier |Attribute |Op |Value |Context |`02:01:aa:bb:cc:dd` |`DHCP-Log-Server` |`:=` |`192.0.2.10` |`by-mac` |`02:01:aa:bb:cc:dd` |`DHCP-LPR-Server` |`:=` |`192.0.2.11` |`by-mac` |`02:01:aa:bb:cc:dd` |`Fall-Through` |`:=` |`Yes` |`by-mac` |=== "dhcpgroup" maps identifiers to a group of options that can be shared: .dhcpgroup table |=== |Identifier |GroupName |Priority |Context |`02:01:aa:bb:cc:dd` |`salesdept` |`10` |`by-mac` |=== "dhcpgroupreply" contains reply options for each group: .dhcpgroupreply table |=== |GroupName |Attribute |Op |Value |Context |`salesdept` |`DHCP-NTP-Servers` |`:=` |`192.0.2.20` |`by-mac` |`salesdept` |`DHCP-Log-Server` |`+=` |`192.0.2.21` |`by-mac` |`salesdept` |`DHCP-LPR-Server` |`^=` |`192.0.2.22` |`by-mac` |=== Within the context of assigning options directly to devices, as well as to manually-curated groups of devices keyed by their MAC address: - Place device-specific options in the "dhcpreply" table. - Add `Fall-Through := Yes` to the options in the "dhcpreply" table in order to trigger group lookups, which are disabled by default. - Place entries in the "dhcpgroup" `identifier = , groupname = , priority = ` in the "dhcpgroup" table to map a device to its groups by priority. - Place the grouped options in the "dhcpgroupreply" table. - For each of the above, set `Context` to something by which the option lookup is referred to in the policy, for example `Context = 'by-mac'`. For the above example you would add the following to the DHCP virtual server to perform reply option lookup using the device's MAC address against the `by-mac` context: [source,unlang] ---- update control { &DHCP-SQL-Option-Context := "by-mac" &DHCP-SQL-Option-Identifier := &request:DHCP-Client-Hardware-Address } dhcp_sql.authorize ---- In the above, the DHCP reply options would be assigned to a device with MAC address 02:01:aa:bb:cc:dd as follows: - Firstly, the `DHCP-Log-Server` option would be set to `192.0.2.10` and the `DHCP-LPR-Server` option set to `192.0.2.11`. - `Fall-Through` is set, so the group mapping is then queried which determines that the device belongs to a single `salesdept` group. - Finally, the options for the `salesdept` group are now merged, setting a `DHCP-NTP-Servers` option to `192.0.2.20`, appending an additional `DHCP-Log-Server` option set to `192.0.2.21`, and prepending an additional `DHCP-LPR-Server` option set to `192.0.2.22`. If instead you wanted to perform a "subclass" lookup based on the first three octets of the device's MAC address then with tables containing the following sample data you could invoke an SQL lookup as shown: ."dhcpreply" table: |=== |Identifier |Attribute |Op |Value |Context |`000393` |`Fall-Through` |`:=` |`Yes` |`class-vendor` |`000a27` |`Fall-Through` |`:=` |`Yes` |`class-vendor` |`f40304` |`Fall-Through` |`:=` |`Yes` |`class-vendor` |=== ."dhcpgroup" table: |=== |Identifier |GroupName |Priority |Context |`000393` |`apple` |`10` |`class-vendor` |`000a27` |`apple` |`10` |`class-vendor` |`f40304` |`google` |`10` |`class-vendor` |=== ."dhcpgroupreply" table: |=== |GroupName |Attribute |Op |Value |Context |`apple` |`DHCP-Boot-Filename` |`:=` |`apple.efi` |`class-vendor` |`google` |`DHCP-Boot-Filename` |`:=` |`google.efi` |`class-vendor` |=== [source,unlang] ---- update control { &DHCP-SQL-Option-Context := "class-vendor" &DHCP-SQL-Option-Identifier := \ "%{substring:%{hex:&DHCP-Client-Hardware-Address} 0 6}" } dhcp_sql.authorize ---- The file `policy.d/dhcp` contains a policy named `dhcp_policy_sql` which provides further worked examples for different types of option lookups. === Testing "device", "class" and "group" options You should now test that any device-related options that you have configured using the various methods available are applied successfully by generating packets containing those parameters based upon which the reply options are set. For example, to test the iPXE user class example above you might want to generate a request as follows: [source,shell] ---- cat < dhcp-packet-ipxe-boot.txt DHCP-Message-Type := DHCP-Discover DHCP-Client-Hardware-Address := 02:01:aa:bb:cc:dd DHCP-User-Class := "iPXE-class-abc" EOF ---- To which you would expect to see a response such as: .Example output from dhcpclient =============================== dhcpclient: ... ---------------------------------------------------------------------- Waiting for DHCP replies for: 5.000000 ---------------------------------------------------------------------- ... DHCP-Message-Type = DHCP-Offer DHCP-Your-IP-Address = 1.2.3.4 DHCP-Boot-Filename := "http://my.web.server/boot_script.php" ... =============================== freeradius-3.2.10+dfsg/doc/antora/modules/howto/pages/protocols/dhcp/policy_ippool_access.adoc000066400000000000000000000026501522352605200326060ustar00rootroot00000000000000== Configure access restrictions for pools We can combine what we have learned in the preceeding sections to provide pools whose access is restricted in some way, for example to a particular class. Consider the ISC DHCP configuration snippet: [source,iscdhcp] ---- subnet 10.99.99.0 netmask 255.255.255.0 { pool { range 10.99.99.200 10.99.99.250; allow members of "printers"; } option routers 10.99.99.1; } ---- Or the equivalent Kea configuration: [source,isckea] ---- "Dhcp4": { "subnet4": [{ "subnet": "10.99.99.0/24", "pools": [ { "pool": "10.99.99.200 - 10.99.99.250", "client-class": "printers" } ], "option-data": [ { "name": "routers", "data": "10.10.0.1" } ] }], ... } ---- These define a subnet containing a single pool that is restricted to members of the "printers" class. (The definition for this class is omitted.) In FreeRADIUS, to filter access to this pool entries such as the following should included in the `/mods-config/files/dhcp` configuration file: [source,config] ---- network DHCP-Network-Subnet < 10.99.99.0/24, \ DHCP-Group-Name == "printers", Pool-Name := "printers-pool" DHCP-Router-Address := 10.99.99.1 ---- Note that any number of additional filters can be added to the initial "check" line to restrict matches to the network block. freeradius-3.2.10+dfsg/doc/antora/modules/howto/pages/protocols/dhcp/policy_ippool_creation.adoc000066400000000000000000000114431522352605200331510ustar00rootroot00000000000000=== Determine the IP pool plan Except for cases where all IP allocation is performed using a mapping from the device MAC address to a fixed IP address, the DHCP configuration will involve the use of one or more IP address pools. FreeRADIUS stores all the IP addresses in its pools in whichever database has been chosen. An instance of the `sqlippools` module is used to manage all pools within a single table (normally `dhcpippool`). Each row of this table corresponds to an IP address that is a member of some pool. The pools are distinguished by name, so the table has a column (`pool_name`) that denotes this. Each pool in this table should be composed of a set of equally valid IP addresses for the devices that are designated to be members of the pool. Firstly, consider the network locations to which distinct ranges of IP addresses must be allocated and provisionally assign a pool to each. Next, consider that many networks support multiple co-existing subnets without VLAN separation. We will call this a "shared-network" to use the original ISC DHCP parlance. In Microsoft DHCP contexts this is often referred to as a "multinet". Often in a shared-network the policy has no regard for which of the network's devices is allocated to which subnet. In this case we must create a single, combined pool containing all of the IP addresses from each subnet in that network. Since all addresses in a pool are treated equally this will mean that any IP address may be allocated to a device that is making a DHCP request from that network. The appropriate DHCP parameters for the subnet to which the IP address belongs is determined after allocation. There are sometimes shared-networks (or even single subnets) for which IP addresses belonging to any subnet may be technically suitable for any device, however some local policy wants to assigning them to a particular subnet, for example to provide loose segregation between classes of device. In this case we define multiple pools, one for each range of IP addresses whose devices needs to be differentiated. The choice of pool is ordinarily determined based on the network from which the request originates using a mapping from Layer 2 networks to the pool name provided by the user. The indicator for the originating network can be overridden when this alone is insufficient to implement the required pool selection policy such as when you need to differentiate the pool's users with more granularity that their Layer 2 network, such as by considering device attributes ("class" membership in ISC parlance) or Option 82 circuit data. === Populate the IP Pools By this stage you should have derived a list of pools, the IP address ranges contained therein, and the means of selecting the pool to use based on the originating network and/or some additional criteria from the request. A helper Perl script is provided with FreeRADIUS that can be used to populate the pools provide that you are using the default schema. [source,shell] ---- rlm_sqlippool_tool -p -s -e \ -t (-d | -f [ -i ]) \ [ -c ] [ -x ] ---- If, for example, you had a range configured in ISC DHCP as: [source,iscdhcp] ---- range 10.0.0.5 10.0.0.199 ---- and you are using PostgreSQL as your database, and you wish to refer to this pool using the name `local`, this could be prepared with: [source,shell] ---- rlm_sqlippool_tool -p local -s 10.0.0.5 -e 10.0.0.199 -t dhcpippool -d postgresql ---- If the SQL module of FreeRADIUS is already configured then this can be referenced so that the tool is able to use the configured connection parameters to connect to the database and populate the pool: [source,shell] ---- rlm_sqlippool_tool -p local -s 10.0.0.5 -e 10.0.0.199 -t dhcpippool -f /etc/raddb ---- For installations that require multiple pools, `rlm_sqlippool_tool` can be called referencing a YAML file defining the pools. Comments at the head of `rlm_sqlippool_tool` explain the options in more detail. If static leases are required then these should be set up in the database such that the MAC address of the client should be set as the `pool_key` against the corresponding address and the `status` column of the row representing the address set to `static`. A helper perl script, `rlm_iscfixed2ippool` can be used to read an ISC DHCP config file and produce SQL to perform these changes or directly update the database: [source,shell] ---- rlm_iscfixed2ippool -c -t -k \ (-d | -f [-i ]) ---- For example, to read /etc/dhcp/dhcpd.conf and populate the configured FreeRADIUS database, using the mac as the identifier: [source,shell] ---- rlm_iscfixed2ippool -c /etc/dhcp/dhcpd.conf -t dhcpippool -k mac -f /usr/local/etc/raddb ---- freeradius-3.2.10+dfsg/doc/antora/modules/howto/pages/protocols/dhcp/policy_network_options.adoc000066400000000000000000000223001522352605200332210ustar00rootroot00000000000000== Configure network-specific options and IP pool selection In an environment where multiple networks (often VLANs) are in use, it is necessary to identify which network a client belongs to in order to assign an address from the correct pool. Consider the ISC DHCP configuration snippet: [source,iscdhcp] ---- option domain-name "example.org"; subnet 10.10.0.0 netmask 255.255.0.0 { range 10.10.1.10 10.10.10.254; range 10.10.100.10 10.10.110.254; option routers 10.10.0.1; option domain-name-servers 10.10.0.2, 10.10.0.3; default-lease-time 7200; } ---- Or the equivalent Kea configuration: [source,isckea] ---- "Dhcp4": { "option-data": [ { "name": "domain-name", "data": "example.org" } ], "subnet4": [{ "subnet": "10.10.0.0/16", "pools": [ { "pool": "10.10.1.10 - 10.10.10.254" }, { "pool": "10.10.100.10 - 10.10.110.254" } ], "option-data": [ { "name": "routers", "data": "10.10.0.1" }, { "name": "domain-name-servers", "data": "10.10.0.2, 10.10.0.3" } ], "valid-lifetime": 7200 }], ... } ---- These define a network consisting of a single subnet 10.10.0.0/16 containing two IP address pools 10.10.1.10 - 10.10.10.254 and 10.10.100.10 - 10.10.110.254. Requests that are determined to have originated from this network (e.g. because their `giaddr` belongs within the subnet) will be assigned the specified DHCP parameters and allocated an address from one of its ranges. To provide equivalent functionality, FreeRADIUS must identify the correct DHCP reply parameters as well as the name of the pool to be used for IP address assignment, based on the originating network of the request. The definition for this pool (the addresses contained within it, corresponding to the `range` statement in ISC DHCP and Kea) is specified entirely in the database: It is precisely the rows in the `dhcpippool` table with a particular `pool_name`. [TIP] ==== As described previously, in FreeRADIUS a pool is a set of IP addresses that are equally valid with respect to the network policy; therefore, unlike ISC DHCP and ISC Kea, FreeRADIUS does not differentiate between the two `range`s. Instead we should have previously populated a single pool containing all of the IP addresses from both ranges. ==== FreeRADIUS derives a request attribute called `DHCP-Network-Subnet` which honours the standard DHCP process for designating the choice of network, in order of preference: 1. Link Selection Suboption of Option 82 2. IPv4 Subnet Selection Option 3. Gateway IP Address ("giaddr") 4. Client IP Address ("ciaddr", only set for unicast packets) If `DHCP-Network-Subnet` contains an IP address then this should be used as the basis of choosing a network. When there is no address in this attribute it can be assumed that the packet has been received from a client on the local LAN. The `files` module in FreeRADIUS provides a simple method to map `DHCP-Network-Subnet` to the corresponding pool based on its network membership, setting the appropriate options to return to clients. It can also set the global options. [TIP] ==== In the case where an instance of the `files` module is used to get global default parameters, the `dhcp_common` policy becomes redundant so the statement calling the policy (by name) can be commented out in `/sites-enabled/dhcp`. ==== To use the provided example `files` module instance for DHCP, symlink or copy `/mods-available/dhcp_files` into `/mods-enabled/` and then uncomment the calls to `dhcp_network` in `/sites-enabled/dhcp`. A template configuration file `/mods-config/files/dhcp` is also provided which should be adapted to suit your network topology. For the configuration above you may deduce the following configuration, which has been extended to include an initial default section for requests originating from directly-connected clients on the local LAN (192.168.20/24): [source,config] ---- network Pool-Name := "local" DHCP-Domain-Name := "example.org", DHCP-Subnet-Mask := 255.255.255.0, DHCP-Router-Address := 192.168.20.1, DHCP-Domain-Name-Server := 192.168.20.2, Fall-Through := yes network DHCP-Network-Subnet < 10.10.0.0/16, Pool-Name := "remote" DHCP-Subnet-Mask := 255.0.0.0, DHCP-Router-Address := 10.10.0.1, DHCP-Domain-Name-Server := 10.10.0.2, DHCP-Domain-Name-Server += 10.10.0.3, DHCP-IP-Address-Lease-Time := 7200 ---- Each block in the file starts with a line beginning with the key to be matched. In this case the keyword of `network` (defined earlier in `dhcp_networks` configuration) is used for each block, so each of the above blocks is a candidate during the search. There may be further filtering of the candidates in the form of ` `. In the case of the second block we match the `DHCP-Network-Subnet` to an enclosing subnet with `DHCP-Network-Subnet < `. Additional filters could be added as required, comma separated. Following the filters on the first line, attributes in the `control` list can be set using the syntax of ` := `. In this example this is used to specify the `Pool-Name` for choosing the appropriate IP pool to allocate an address from. Subsequent indented lines are attribute assignments for values in the `reply` list. Note that, apart from the last line, they are all terminated with a comma. The special option `Fall-Through` determines whether, following a match, other records are checked for a match. All lookups will match the entry with a key of `network` and no further filtering, so `Fall-Through` is set on that record in order that the other records will be tested to find subnet matches. === Example packet processing For our example, we consider a request arriving from a DHCP relay within 10.10.0.0/16. In the absence of any specific DHCP subnet selection options in the request, the `DHCP-Network-Subnet` attribute is calculated to be the relay's IP address, say 10.10.0.1. The request is matched against the first block, setting an initial pool name to "local", domain name to "example.org" and setting some additional global default parameters. By virtue of `Fall-Through` being set, the next block is considered. Since the network identifier is within the specified subnet (i.e. `10.10.0.1 < 10.10.0.0/16`) this second block is matched. This block overrides the pool name setting it to "remote", overrides some other global defaults and sets the lease time to 7200 seconds. `Fall-Through` is not set, so we are now done with deriving the pool name and network options. When the `dhcp_sqlippool` module is called during DHCP DISCOVER processing (in `/sites-enabled/dhcp`) the `remote` pool will be used for IP address allocation. The assigned IP address and network parameters will subsequently be returned in the DHCP reply. === Testing the pool operation and network-specific options Before proceeding further, you should test the operation of the IP pools and ensure that any network-specific reply attributes that you have configured are correctly set in replies. For example, if you have a single, flat pool you should test using sample packets for devices with different MAC addresses and/or Client Identifiers. [source,shell] ---- cat < dhcp-packet-1.txt DHCP-Message-Type := DHCP-Discover DHCP-Client-Hardware-Address := 02:01:11:11:11:11 DHCP-Client-Identifier := device1 EOF ---- [source,shell] ---- cat < dhcp-packet-2.txt DHCP-Message-Type := DHCP-Discover DHCP-Client-Hardware-Address := 02:01:22:22:22:22 DHCP-Client-Identifier := device2 EOF ---- Generate these packets as show previously using the dhcpclient tool and look for `DHCP-Your-IP-Address` in the DHCP responses to determine the IP address that has been offered. Ensure that the DHCP Offer responses contain unique IP addresses. Ensure that when these requests are resent within the lifetime of the initial offer that the reponses to the subsequent replies contain the original IP address that was in the initial offer to the device. Additionally, ensure that the DHCP Offers contain any network-specific parameters that you have specified. In the case that the policy contains multiple IP pools and network definitions for clients belonging to different Layer 2 networks (or indeed belonging to the same network but segregated according to some local policy) you should ensure that the devices are being mapped to the correct definition. For a typical policy that selects the IP pool and network options based on the originating network for the DHCP packet, explicitly specifying a network by including a `DHCP-Subnet-Selection-Option` parameter may avoid the need to test from a host within each individual network: [source,shell] ---- cat < dhcp-packet-network-10.10.10.0.txt DHCP-Message-Type := DHCP-Discover DHCP-Client-Hardware-Address := 02:01:aa:bb:cc:dd DHCP-Client-Identifier := abc123 DHCP-Subnet-Selection-Option := 10.10.10.0 EOF ---- For policies where the IP pool and network option selection is based on some custom criteria it is necessary to include different variations for the parameters on which the policy makes the decision. The testing example for the class-specific options later in this document provides such an example. freeradius-3.2.10+dfsg/doc/antora/modules/howto/pages/protocols/dhcp/policy_subnet_options.adoc000066400000000000000000000143151522352605200330370ustar00rootroot00000000000000== Configure subnet-specific options for shared networks In the case that shared-networks are in use, with the pool containing equally-valid IP addresses from multiple subnets, it is necessary to set the subnet-specific parameters such as `DHCP-Router-Address`, `DHCP-Subnet-Mask` and `DHCP-Broadcast-Address` based on the IP address that has been allocated. Consider the ISC DHCP configuration snippet: [source,iscdhcp] ---- option domain-name "example.org"; shared-network bigdept { option domain-name-servers 10.10.0.2, 10.10.0.3; default-lease-time 7200; subnet 10.30.10.0 netmask 255.255.255.0 { option routers 10.30.10.1; } subnet 10.30.20.0 netmask 255.255.255.0 { option routers 10.30.20.1; } range 10.30.10.10 10.30.10.254; range 10.30.20.10 10.30.20.254; } ---- Or the equivalent Kea configuration: [source,kea] ---- "Dhcp4": { "option-data": [ { "name": "domain-name", "data": "example.org" } ], "shared-networks": [{ "name": "bigdept", "option-data": [ { "name": "domain-name-servers", "data": "10.10.0.2, 10.10.0.3" } ], "valid-lifetime": 7200, "subnet4": [{ "subnet": "10.30.10.0/24", "pools": [ { "pool": "10.30.10.10 - 10.30.10.254" } ], "option-data": [ { "name": "routers", "data": "10.30.10.1" } ] }], "subnet4": [{ "subnet": "10.30.20.0/24", "pools": [ { "pool": "10.30.20.10 - 10.30.20.254" } ], "option-data": [ { "name": "routers", "data": "10.30.20.1" } ] }] }], ... } ---- As with the network to pool lookup, an instance of the `files` modules can be employed (this time after the allocation of an IP address) to set the correct reply parameters based on the subnet membership of the assigned address. To do this, we can use this section of `/mods-available/dhcp_files`: [source,config] ---- files dhcp_subnets { filename = ${modconfdir}/files/dhcp key = "subnet" } ---- Additionally, uncomment the `dhcp_subnets` policy in `/policy.d/dhcp`. This policy wraps the call to the `dhcp_subnets` files module with code that "tightens" the `DHCP-Network-Subnet` attribute by setting it to the just-allocated IP address. The relevant entries in the `/mods-config/files/dhcp` configuration file might then look something like this: [source,config] ---- network DHCP-Domain-Name := "example.org", Fall-Through := yes network DHCP-Network-Subnet < 10.30.0.0/16, Pool-Name := "bigdept" DHCP-Domain-Name-Server := 10.10.0.2, DHCP-Domain-Name-Server += 10.10.0.3, DHCP-IP-Address-Lease-Time := 7200 subnet DHCP-Network-Subnet < 10.30.10.0/24 DHCP-Router-Address := 10.30.10.1 subnet DHCP-Network-Subnet < 10.30.20.0/24 DHCP-Router-Address := 10.30.20.1 ---- === Example packet processing For our example, we consider a request arriving from a DHCP relay within 10.30.10.0/24. In the absence of any specific DHCP subnet selection options in the request, the `DHCP-Network-Subnet` attribute is calculated to be the relay's IP address, say 10.30.10.1. The request is matched against the first "network" block, setting the domain name to "example.org". By virtue of `Fall-Through` being set, the next "network" block is considered. Since the network identifier is within the specified subnet (i.e. `10.30.10.1 < 10.30.0.0/16`) this second "network" block is matched. This block sets the pool name to "bigdept", sets some network-specific DNS resolvers and sets the lease time to 7200 seconds. `Fall-Through` is not set, so we are now done with deriving the pool name and network options. When the `dhcp_sqlippool` module is called during DHCP DISCOVER processing (in `/sites-enabled/dhcp`) the `bigdept` pool will be used for IP address allocation. After IP allocation the `dhcp_subnet` policy and files instance are called. Before the subnet options are looked up the `DHCP-Network-Subnet` attribute is tightened to match the assigned IP address, say 10.30.20.123. The request does not match the first subnet block since 10.30.20.123 is not within 10.30.10.0/24. However, the request does match the second subnet block since `10.30.20.123 < 10.30.20.0/24`. This block sets the default gateway reply parameter. `Fall-Through` is not set, so we are now done with deriving the pool name and network options. The assigned IP address, network and subnet parameters will subsequently be returned in the DHCP reply. === Testing the subnet-specific options If you have set any subnet-specific reply parameters then you should test these before proceeding further. For example, in the case that you have a single, large pool spanning two IP subnets you might want to test by repeatedly allocating addresses using sample packets with different MAC addresses, each time checking to ensure that the DHCP parameters correspond to the IP address that has been offered. .Example output from dhcpclient showing a response ================================================== dhcpclient: ... ... ---------------------------------------------------------------------- Waiting for DHCP replies for: 5.000000 ---------------------------------------------------------------------- ... DHCP-Your-IP-Address = 10.0.10.50 DHCP-Router-Address = 10.0.10.1 DHCP-Broadcast-Address = 10.0.10.255 DHCP-Subnet-Mask = 255.255.255.255 ================================================== .Example output from dhcpclient showing a response ================================================== dhcpclient: ... ... ---------------------------------------------------------------------- Waiting for DHCP replies for: 5.000000 ---------------------------------------------------------------------- ... DHCP-Your-IP-Address = 10.99.99.50 DHCP-Router-Address = 10.99.99.1 DHCP-Broadcast-Address = 10.99.99.255 DHCP-Subnet-Mask = 255.255.255.255 ================================================== [TIP] ==== If the subnets are large then you might want to temporarily reduce their size by setting the `status` field of the majority of the rows for each subnet to "`disabled`" to cause offers to be made more readily with IP addresses in different subnets. ==== freeradius-3.2.10+dfsg/doc/antora/modules/howto/pages/protocols/dhcp/prepare.adoc000066400000000000000000000045141522352605200300430ustar00rootroot00000000000000== Preparation It is necessary to consider the requirements for the installation in order to devise an efficient and manageable set up. === Understand the network topology When multiple networks (VLANs) are in use consideration must be given to how the correct "pool" (IP address ranges) from which to allocate addresses is identified. The policy for setting specific DHCP options (e.g. lease time, default gateway, time server and vendor-specific parameters) for different groups of hosts, based on their network or some device attributes either supplied in the DHCP requests or determined by dynamic lookup, should be well defined and understood. Other DHCP servers may implement implicit assumptions about the requirement of your network topology and silently define particular behaviours, such as the selection of IP address pool for a request based on a relay address. Some of these behaviours must be specifed explicitly when using FreeRADIUS. === Choose a database backend FreeRADIUS stores its leases in an SQL database, so one of the key decisions to make is which database to use. FreeRADIUS supports: * SQLite * PostgreSQL * MySQL / MariaDB * Microsoft SQL Server * Oracle In most configurations the SQL database is likely to be the limiting component that restricts the IP allocation throughput of the overall system. Each database server has its own performance characteristics and unique approach to features such as high-availability. The choice of database should be made carefully based on the performance and high-availability requirements of the system, as well as any prior experience. [TIP] ==== SQLite is an in-process database that uses the local file system, is simple to configure and is suitable for smaller installations. However, users with larger address pools or high availability requirements should choose one of the other standalone databases based on criteria such as performance, features, familiarity and your need for commercial support. ==== FreeRADIUS ships with a default database schema and set of queries for each supported database. These are sufficient for most DHCP deployments but can be reviewed and modified as required to suit a particular situation, for example to customise the IP allocation policy such as by disabling address "stickiness". Now xref:protocols/dhcp/enable.adoc[enable the DHCP service]. freeradius-3.2.10+dfsg/doc/antora/modules/howto/pages/protocols/dhcp/test.adoc000066400000000000000000000116251522352605200273650ustar00rootroot00000000000000== Testing the DHCP service We can verify that FreeRADIUS is providing a DHCP service using the `dhcpclient` tool that is included with the FreeRADIUS distribution. Temporarily configure FreeRADIUS to issue a single static IP address to all clients by updating the `dhcp DHCP-Discover` section in the `dhcp` virtual server to include the following: [source,unlang] ---- update reply { &DHCP-Your-IP-Address := 1.2.3.4 } ---- Define a sample DHCP packet as follows: [source,shell] ---- cat < dhcp-packet.txt DHCP-Message-Type := DHCP-Discover DHCP-Client-Hardware-Address := 02:01:aa:bb:cc:dd DHCP-Client-Identifier := abc123 EOF ---- We can now generate this packet by invoking one of the following commands based on the current circumstances... From the host that is running the FreeRADIUS DHCP server: [source,shell] ---- dhcpclient -i lo 255.255.255.255 -f dhcp-packet.txt -x auto ---- From a different host with an interface (eth0) in the same broadcast domain as the FreeRADIUS DHCP server: [source,shell] ---- dhcpclient -i eth0 255.255.255.255 -f dhcp-packet.txt -x auto ---- If all of the DHCP broadcast traffic in other Layer 2 networks is converted to unicast by DHCP relay agents then it is not necessary for FreeRADIUS to listen on a broadcast address. In this case you can test DHCP using a unicast request: [source,shell] ---- dhcpclient 192.0.2.10 -f dhcp-packet.txt -x auto ---- [NOTE] ==== In order for the returned, unicast DHCP OFFER to be received it is necessary to ensure that the `DHCP-Your-IP-Address` parameter set by FreeRADIUS matches an address on the interface used by the dhcpclient tool to send the Discover packet. ==== When one of the above commands is run, the tool with generate output such as the following which shows that the packet was sent and that it is now waiting for replies: .Example output from dhcpclient showing the request =================================================== dhcpclient: ... ---------------------------------------------------------------------- DHCP-Opcode = 0x01 DHCP-Hardware-Type = 0x01 DHCP-Hardware-Address-Length = 0x06 DHCP-Hop-Count = 0x00 DHCP-Transaction-Id = 0x5e0bbfab DHCP-Number-of-Seconds = 0x0000 DHCP-Flags = 0x0000 DHCP-Client-IP-Address = 0x00000000 DHCP-Your-IP-Address = 0x00000000 DHCP-Server-IP-Address = 0x00000000 DHCP-Gateway-IP-Address = 0x00000000 ... ---------------------------------------------------------------------- Waiting for DHCP replies for: 5.000000 ---------------------------------------------------------------------- =================================================== Each received DHCP response will generate output such as the following: .Example output from dhcpclient showing a response ================================================== ... ---------------------------------------------------------------------- DHCP-Opcode = Server-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 0 DHCP-Transaction-Id = 1577828267 DHCP-Number-of-Seconds = 0 DHCP-Flags = 0 DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 1.2.3.4 DHCP-Server-IP-Address = 192.0.2.10 DHCP-Gateway-IP-Address = 0.0.0.0 DHCP-Client-Hardware-Address = 02:42:0a:00:00:0b DHCP-Message-Type = DHCP-Offer DHCP-Client-Identifier = 0x616263313233 Waiting for additional DHCP replies for: 4.999429 ... ================================================== Examine the DHCP response to ensure that it has the correct message type (`DHCP-Offer`, in this case), contains the temporary IP address that you configured earlier, i.e. `DHCP-Your-IP-Address = 1.2.3.4`, and any other expected reply parameters (which we configure later). You should also carefully examine the output of a FreeRADIUS debug session (`radius -X`) to ensure that the policy is being executed in the way that you expect and that no warnings are being generated. You can now change the content of the sample DHCP request by editing the `dhcp-packet.txt` file and re-run the above command to see the server's reply. You should examine the DHCP dictionary distrubuted with FreeRADIUS (usually `/usr/share/freeradius/dictionary.dhcp`) which provides the list of all of the DHCP parameters ("attributes") understood by FreeRADIUS. [WARNING] ==== When you are done **remember** to remove the temporary edit that was made to the `dhcp` virtual server that provides the static IP assignment. ==== === Testing the DHCP policy The remainder of this guide describes how to configure the IP address plan, setup the IP pools and define a DHCP policy. You should develop your policy by making small, incremental changes to the provided configuration and then test those changes with the approach described above, using `dhcpclient` and `radius -X`, modifying the sample DHCP packet as required. If you break the policy then revert the last change, attempt to understand what went wrong, and try something else. Now xref:protocols/dhcp/policy.adoc[define the DHCP policy]. freeradius-3.2.10+dfsg/doc/antora/modules/howto/pages/protocols/proxy/000077500000000000000000000000001522352605200260145ustar00rootroot00000000000000freeradius-3.2.10+dfsg/doc/antora/modules/howto/pages/protocols/proxy/enable_proxy_protocol.adoc000066400000000000000000000062441522352605200332620ustar00rootroot00000000000000== Enabling PROXY Protocol Now that we have a working configuration which used RadSec and HAproxy or Traefik, we are finally ready to enable PROXY Protocol. Configure FreeRADIUS on the `radsecsvr` host to expect the PROXY Protocol for RadSec connections. This is done by editing the `listen {}` section of the `tls` virtual server to include a reference to the proxy protocol: .Enabling PROXY Protocol in a FreeRADIUS virtual server ======================================================= listen { ... proxy_protocol = true ... } ======================================================= Now restart the debugging session: [source,shell] ---- radiusd -fxxl /dev/stdout ---- For HAproxy, you should enable the PROXY Protocol on connections to the RadSec backend, by editing the `backend` definition to add a `send-proxy` argument: .Example HAproxy backend configuration with PROXY Protocol ========================================================== backend radsec_be mode tcp balance roundrobin server radsecsvr 172.23.0.3:2083 send-proxy ========================================================== Note the `send-proxy` argument in the `server` definition. Now reload the HAproxy service: [source,shell] ---- service haproxy reload ---- For Traefik, enable the PROXY Protocol on connections to the RadSec backend by editing the `radsec-service` definition to add a reference to the proxy protocol" .Example Traefik service configuration with PROXY Protocol ========================================================== radsec-service: loadBalancer: servers: - address: "172.23.0.3:2083" proxyProtocol: version: 1 ========================================================== Note the `proxyProtocol` and `version: 1` directives. Traefik should automatically detect the updates and reconfigure the service. === Testing RadSec connectivity via a proxy using PROXY Protocol Finally, with your test client configured to use the proxy, perform a test authentication: [source,shell] ---- echo "User-Name = bob" | radclient 127.0.0.1 auth testing123 ---- You should expect to see the familiar output: .Example output from radclient ============================== Sent Access-Request Id 252 from 0.0.0.0:50118 to 127.0.0.1:1812 length 27 Received Access-Accept Id 252 from 127.0.0.1:1812 to 127.0.0.1:50118 length 39 ============================== Now examine the FreeRADIUS debug output on the RadSec server: .Expected output from `radiusd -X` with PROXY Protocol ====================================================== ... (0) (TLS) Received PROXY protocol connection from client \ 172.23.0.2:55343 -> 172.23.0.4:2083, via proxy 172.23.0.4:40268 -> 0.0.0.0:2083 ... (0) Received Access-Request Id 227 from 172.23.0.2:55343 to 172.23.0.4:2083 length 49 (0) Sent Access-Accept Id 227 from 172.23.0.4:2083 to 172.23.0.2:55343 length 0 ... ====================================================== The output indicates that FreeRADIUS is receiving the originating connection information from the PROXY Protocol. FreeRADIUS then handles the RadSec requests as though they have been received directly from the originating client. freeradius-3.2.10+dfsg/doc/antora/modules/howto/pages/protocols/proxy/enable_radsec.adoc000066400000000000000000000136261522352605200314230ustar00rootroot00000000000000== Enabling RadSec with FreeRADIUS Our first task is to set up a RadSec server by configuring an instance of FreeRADIUS to accept RADIUS over TLS requests. The following steps should be performed on the host which will be the RadSec server, we will call it `radsecsvr`. You can install FreeRADIUS using the InkBridge Networks packages by following the instructions provided here: Before making any configuration changes, you should stop the radiusd service: [source,shell] ---- service radiusd stop ---- Then, enable the `tls` virtual server: [source,shell] ---- cd /etc/raddb/sites-enabled ln -s ../sites-available/tls ---- The FreeRADIUS distribution contains an example Certificate Authority that will have generated the necessary CA, server and client certificates and keys during package installation. You can use this CA, or you can use your own CA and certificates. [TIP] ==== If the example certificates are not present (for example if FreeRADIUS was installed from source) then FreeRADIUS will fail to start. The files can be regenerated by running `make` in the `/etc/raddb/certs` directory. ==== Edit the `tls` virtual server configuration, in order to add definitions for the clients by extending the `clients radsec {}` section: .Example radsec client definitions in `/etc/raddb/sites-available/tls` ==== clients radsec { ... # Direct connections from the test client client radseccli { ipaddr = 172.23.0.2 proto = tls virtual_server = default } # Connections via HAproxy client haproxy { ipaddr = 172.23.0.4 proto = tls virtual_server = default } # Connections via Traefik client traefik { ipaddr = 172.23.0.5 proto = tls virtual_server = default } } ==== The client `ipaddr` configuration item is used to match the source IP address of incoming connections. You must add client definitions for each of the clients which will connect. For RadSec, you can just list the IP address of the RadSec client. This client definition is used for processing RADIUS packets from the RadSec client. [NOTE] ==== A `secret` does not have to be specified for RadSec clients, as the default is `radsec`. If you specify a secret, then that will be used instead of `radsec`. ==== When the PROXY protocol is used, you must _also_ define a client which matches the IP address of the proxy (haproxy, etc). This client is only used to check that the source IP is permitted to connect to the server. Fields other than `ipaddr` can be specified (and in some cases may be required). However, all other fields will be ignored. For testing purposes, we want to amend the `default` virtual server so that it accepts all authentication reqeusts and immediately responds to accounting requests. Edit the `/etc/raddb/sites-enabled/default` file so that the beginning of the `authorize` and `preacct` sections looks as follows: .Example default virtual server modification to unconditionally accept Access-Requests ==== authorize { accept ... } ... preacct { handled ... } ==== This change makes the `authorize` section always "accept" the user, and makes the `preacct` section always say "we handled the accounting request". These changes are only for testing, and should never be used in production. Start the FreeRADIUS service in the foreground with debugging enabled: [source,shell] ---- radiusd -fxxl /dev/stdout ---- Examine the output from FreeRADIUS to ensure that it is now listening for RadSec connection on TCP/2083: .Example output from running `radiusd -fxxl /dev/stdout` ==== FreeRADIUS Version 3.0.24 Copyright (C) 1999-2021 The FreeRADIUS server project and contributors ... ... : Debug: Listening on auth+acct proto tcp address * port 2083 (TLS) bound to server default ... : Debug: Listening on auth address * port 1812 bound to server default ... : Debug: Listening on acct address * port 1813 bound to server default ... : Debug: Listening on auth address :: port 1812 bound to server default ... : Debug: Listening on acct address :: port 1813 bound to server default ... ... : Info: Ready to process requests ==== FreeRADIUS is now ready to process RadSec traffic. For testing, we first test normal RADIUS over UDP functionality, then the RadSec connection using a test client, then introduce a proxy server, and finally we enable PROXY Protocol. Doing the tests in this way ensures that we know that all previous steps work before trying the next step. This process allows us to quickly narrow down problems, and gets us to the final goal _faster_ than just "doing everything all at once". === Testing the RADIUS policy Before moving on, verify that the FreeRADIUS policy is able to authenticate a local test RADIUS Access-Request over UDP: [source,shell] ---- echo "User-Name = terry" | radclient 127.0.0.1 auth testing123 ---- Due to the `accept` we added in the `authorize` section, the expected output should be an Access-Accept: .Expected output from radclient =============================== Sent Access-Request Id 157 from 0.0.0.0:36850 to 127.0.0.1:1812 length 27 Received Access-Accept Id 157 from 127.0.0.1:1812 to 127.0.0.1:36850 length 20 =============================== Any other output indicates that there is a problem with the FreeRADIUS configuration which *must* be solved before testing RadSec. Carefully verify that you have carried out each of the above steps correctly and examine the debug output from FreeRADIUS, which will usually tell you what is wrong. See [how to read the debug output](http://wiki.freeradius.org/radiusd-X) for instructions on reading amd understanding the debug output. The next step is to xref:protocols/proxy/radsec_client.adoc[configure FreeRADIUS as a RadSec test client] so that we can verify that our RadSec server is working. freeradius-3.2.10+dfsg/doc/antora/modules/howto/pages/protocols/proxy/index.adoc000066400000000000000000000115401522352605200277540ustar00rootroot00000000000000= Proxying RadSec and enabling PROXY Protocol This guide shows how to set up FreeRADIUS to serve RadSec connections, fronted by either HAproxy or Traefik as Layer 4 proxies that pass on the original client connection information using PROXY Protocol. It is not a comprehensive guide to using RadSec with FreeRADIUS. It presents a basic configuration that uses an example CA and does not validate certificate attributes or perform revokation status. == Introduction FreeRADIUS supports receiving RADIUS requests over TLS-enabled TCP connections and supports proxying of requests over TCP connections to another TLS-enabled homeserver. The protocol for RADIUS over TLS is called "RadSec" and is defined in RFC 6614. FreeRADIUS is a capable and performant application-aware ("Layer 7") proxy / load-balancer for RadSec and other forms of RADIUS traffic. === Layer 4 proxying Rather than use an application-aware proxy it is sometimes better to reduce the performance impact incurred by re-encoding an application protocol by using a "Layer 4" proxy that operates at the level of individual connections without regard for the application protocol. Such a proxy is more of a "bump in the wire" than a request buffer and minimises the latency incurred due to proxying. It is common to see software such as HAproxy and Traefik used in Layer 4 mode in place of FreeRADIUS for purposes such as connection load balancing. In addition to improved performance, these tools have the benefit that they typically support dynamic service discovery and "hitless" reloads to automatically adapt their connection routing based on changes to backend services such as the introduction of new nodes with even a momentary loss of service. === Loss of connection information When TCP connections are relayed through Layer 4 proxies the information about the originating source of the connection is no longer known to the backend service, unless it is otherwise made available. Identifying the originator of connections is often necessary for security purposes and for request processing. Whilst many application protcols support headers that allow proxies to preserve connection information these are not helpful in the context of Layer 4 proxying: The process of populating headers requires knowledge of the application protocol to re-encode requests as they are transmitted between the frontend and backend connections. === PROXY Protocol PROXY Protocol overcomes this limitation by allowing the original connection information to be provided to the backend at the start of the TCP connection. After this initial data is encoded the remainder of the conversation then proceeds as normal. However now that the connection information is known to the backend server it is able to process requests made on the connection as though the connection were being made directly by the client and not via the proxy. PROXY Protocol is specified in this document: http://www.haproxy.org/download/1.8/doc/proxy-protocol.txt == Requirements PROXY Protocol Version 1 is supported by FreeRADIUS v3.0.24 and later versions. You will require the following set of VMs or containers, each with their own IP address: [cols="1,1,1"] |=== |Hostname|IP address|Purpose |radseccli |172.23.0.2 |FreeRADIUS configured to provide a RadSec test client |radsecsvr |172.23.0.3 |FreeRADIUS configured as a RadSec server |haproxy |172.23.0.4 |HAproxy in Layer 4 mode to the FreeRADIUS RadSec backend |=== Optionally you may want to configure a host to run Traefik within a Docker container using host mode networking, perhaps configured by Docker Compose, however the installation is beyond the scope of this guide: [cols="1,1,1"] |=== |traefik |172.23.0.5 |Traefik configured as a TCP router with TLS passthrough to the FreeRADIUS RadSec backend |=== The hostnames and IP addresses provided above are for examples purposes and are used throughout the remainder of this guide. This guide provides commands and output for CentOS. Other distributions will have minor differences, including the location of the FreeRADIUS configuration (the "raddb"). [NOTE] ==== You can choose to use your own hostname, IP addresses and OS distribution. You could also use official Docker images provided by the respecitive projects, however these prescribe methods for configuring and managing the services that are not typical for a normal package installation which would provide a distraction if used for by guide. ==== == Sections in this guide This guide is organised into four parts that should be read in order: 1. xref:protocols/proxy/enable_radsec.adoc[Enabling RadSec] 2. xref:protocols/proxy/radsec_client.adoc[Configuring a test RadSec client] 3. xref:protocols/proxy/radsec_with_haproxy.adoc[Proxying RadSec with HAproxy] 4. xref:protocols/proxy/radsec_with_traefik.adoc[Proxying RadSec with Traefik] 5. xref:protocols/proxy/enable_proxy_protocol.adoc[Enabling PROXY Protocol for RadSec] freeradius-3.2.10+dfsg/doc/antora/modules/howto/pages/protocols/proxy/radsec_client.adoc000066400000000000000000000125751522352605200314550ustar00rootroot00000000000000== Configuring FreeRADIUS as a RadSec test client Unfortunately, the `radclient` program does not support RadSec. We must therefore configure an instance of FreeRADIUS as a "transport converter" which proxies UDP-based RADIUS requests to a RadSec destination of our choice. The following steps should be performed on a client system, which we will call `radseccli`. This system should be a new system, with a different IP address. That is, you shoudl not edit the configuration on the `radsecsvr` host. Doing so will break the RadSec configuration. Install FreeRADIUS using the InkBridge Networks packages by following the instructions provided here: Before making any configuration changes, you should stop the radiusd service: [source,shell] ---- service radiusd stop ---- Add a new `tls` home server definition, which will point to the RadSec server. We do this by creating a file `/etc/raddb/sites-enabled/radsec-homeserver` with the following contents: .Example homeserver, pool and realm definitions for the RadSec service ==== home_server tls { ipaddr = 172.23.0.3 # IP address of our RadSec server port = 2083 type = auth+acct proto = tcp tls { private_key_password = whatever private_key_file = ${certdir}/client.pem certificate_file = ${certdir}/client.pem ca_file = ${cadir}/ca.pem } } home_server_pool tls { type = fail-over home_server = tls } realm tls { auth_pool = tls acct_pool = tls } ==== [TIP] ==== Complete descriptions of each of the above configuration items can be found in the `[raddb]/sites-available/tls` example configuration file. For simple tests, however, we can omit all of the comments from the file. ==== To use this `tls` home server, we change the `default` virtual server to proxy all authentication and accounting requests to it. Edit the `/etc/raddb/sites-enabled/default` file so that the beginning of the `authorize` and `preacct` sections looks as follows: .Example default virtual server modification to proxy requests to a RadSec proxy server ==== authorize { update control { &Proxy-To-Realm := tls } handled ... } ... preacct { update control { &Proxy-To-Realm := tls } handled ... } ==== These changes make the `tls` virtual server always proxy packets. These changes are only for testing, and should never be used in production. We must now copy the example CA certificate as well as the client certificate and key files which are on the `radsecsrv` host to this test client. Replace the following files on `radseccli` with the equivalent files from `radsecsrv`: [cols="1,1,1"] |=== |File|Corresponding configuration item|Purpose |/etc/raddb/certs/ca.pem |`ca_file` |CA certificate which is used to authenticate the server certificate presented by the RadSec server to the client. |/etc/raddb/certs/client.pem |`certificate_file` |Client certificate (signed by the CA certificate) that is presented by the test client to the RadSec server. |/etc/raddb/certs/client.pem |`private_key_file` and `private_key_password` |Private key corresponding to the client certificate |=== Note that the client certificate and key are typically bundled into a single file. [CAUTION] ==== If you do not correctly replace the CA, client certificate, and key material on the test client then the RadSec client and RadSec server will fail to mutually authenticate each other as they do not share a trusted CA. If you see messages like `unknown CA`, then you know that the certificates have not been set up correctly. ==== Start the FreeRADIUS service in debug mode: [source,shell] ---- radiusd -X ---- === Testing RadSec connectivity At this stage you should be able to cause the test client to send RadSec requests directly to the RadSec server. Run the following to send a RADUS (UDP) Access-Request to the local FreeRADIUS instance. It should then proxy the request over RadSec connection to the remote RadSec server: [source,shell] ---- echo "User-Name = bob" | radclient 127.0.0.1 auth testing123 ---- If the test client is able to successfully establish the RadSec connection, and the RadSec server replies with an Access-Accept response, then the output will be as follows: .Expected output from radclient =============================== Sent Access-Request Id 252 from 0.0.0.0:50118 to 127.0.0.1:1812 length 27 Received Access-Accept Id 252 from 127.0.0.1:1812 to 127.0.0.1:50118 length 39 =============================== Lack of response or an Access-Reject response indicates that the RadSec connection is not being established successfully. There may be serveral reasons for broken connectivity including: * The client not accepting the certificate presented by the server. * The server not accepting the certificate presented by the client. Look at the debug output generated by both the test client and the RadSec server. In many cases it will tell you exactly what the problem is. Do not proceed with any further steps until direct connections between the RadSec client and Radsec Server are working properly. Once things are working we are ready to xref:protocols/proxy/radsec_with_haproxy.adoc[configure HAproxy to proxy RadSec connections] or to xref:protocols/proxy/radsec_with_traefik.adoc[configure Traefik to proxy RadSec connections]. freeradius-3.2.10+dfsg/doc/antora/modules/howto/pages/protocols/proxy/radsec_with_haproxy.adoc000066400000000000000000000074311522352605200327170ustar00rootroot00000000000000== Proxying RadSec with HAproxy This section shows how to configure HAproxy to proxy RadSec connections. The following steps should be performed on the `haproxy` host, unless otherwise stated. Install the HAproxy package supplied with the OS distribution: [source,shell] ---- yum install haproxy ---- Stop the haproxy service: [source,shell] ---- service haproxy stop ---- Modify the haproxy configuration (typically `/etc/haproxy/haproxy.conf`) so that it includes new frontend and backend configuration for the radsec service: .Example minimal HAproxy configuration ====================================== global maxconn 100 defaults mode tcp timeout connect 10s timeout client 30s timeout server 30s frontend radsec_fe bind *:2083 default_backend radsec_be backend radsec_be balance roundrobin server radsecsvr 172.23.0.3:2083 ====================================== Note the `mode tcp` directive which tells HAproxy to act as a Layer 4 proxy, so that it doesn't attempt to perform SSL termination or decode the RADIUS protocol. [NOTE] ==== The above example is a minimal configuration. In practise you will want to retain many of the HAproxy configuration items already present in the configuration (e.g. `log`, `chroot`, `user`, `group`), but these vary across distributions. Other HTTP-related options that may already exist in the configuration will conflict with `mode tcp` (Layer 4 proxying) and should be removed if HAproxy complains about them. However, you should first get things working with the minimal configuration which is known to work, and then make customisations. If you start off with a complex configuration, then there may be a large number of things which are broken, and debugging them all will be difficult. Start simple, and then add complexity! ==== Restart the haproxy service in foreground mode for debugging purposes: [source,shell] ---- haproxy -f /etc/haproxy/haproxy.cfg -db ---- === Testing RadSec connectivity via HAproxy Now edit the test RadSec client, so that instead of making connections directly to the RadSec server it makes connections to the HAproxy server. On `radseccli` edit the `/etc/raddb/sites-enabled/tls` file, and set the IP address to the address of the `haproxy` host. .Example updated test client homeserver configuration ===================================================== home_server tls { ipaddr = 172.23.0.4 # Updated from radsecsvr to haproxy ... } ===================================================== Restart the debug mode session: [source,shell] ---- radiusd -X ---- Perform a test authentication: [source,shell] ---- echo "User-Name = bob" | radclient 127.0.0.1 auth testing123 ---- If the test client is able to successfully establish the RadSec connection via HAproxy, and the RadSec server replies with an Access-Accept response, then the output will be as follows: .Expected output from radclient =============================== Sent Access-Request Id 252 from 0.0.0.0:50118 to 127.0.0.1:1812 length 27 Received Access-Accept Id 252 from 127.0.0.1:1812 to 127.0.0.1:50118 length 39 =============================== HAproxy should also log a message that indicates that the connection was proxied, such as the following: .Expected output from HAproxy ============================= <150>...: Connect from 172.23.0.2:50087 to 172.23.0.4:2083 (radius_fr/TCP) ============================= Any other output from radclient or HAproxy indicates that there is a problem with the HAproxy configuration, or that FreeRADIUS is not accepting connection from the `haproxy` host, which must be solved before continuing. Once proxied connections are working we are ready to xref:protocols/proxy/enable_proxy_protocol.adoc[enable the PROXY Protocol] on both HAproxy and the RadSec server. freeradius-3.2.10+dfsg/doc/antora/modules/howto/pages/protocols/proxy/radsec_with_traefik.adoc000066400000000000000000000077571522352605200326650ustar00rootroot00000000000000== Proxying RadSec with Traefik This section shows how to configure Traefik to proxy RadSec connections. You should skip this section if you are not using Traefik as your proxy. Installing Traefik is beyond the scope of this guide. It is typically installed as a service mesh router within a Docker or Kubernetes environment using offical Docker images. Traefik configuration has two components of interest: * Static configuration: Defines "entrypoints" on which Traefik listens for connections. * Dynamic configuration: Defines backend service components and the routing policy. Traefik supports a number of providers of dynamic configuration data for the router and service definitions. For demonstration purposes the files provider is used here, however you can switch to another provide once you have things working using this method. The static configuration can be provided by starting Traefik with the following arguments: .Example Traefik static configuration ===================================== traefik \ --log.level=DEBUG \ --providers.file.filename=/etc/traefik/dynamic_config.yml --providers.file.watch=true --entryPoints.radsec.address=:2083 ===================================== Note that a `radsec` entrypoint is defined to listen on port 2083 and that a static `file` provider is used to defined the dynamic services. The backend for RadSec should be defined in this file as follows: .Example Traefik dynamic configuration ====================================== tcp: routers: radsec-router: entryPoints: - radsec rule: "HostSNI(`*`)" service: "radsec-service" tls: passthrough: true services: radsec-service: loadBalancer: servers: - address: "172.23.0.3:2083" ====================================== Note the `passthrough: true` directive under `tls:` which tells Treafik not to attempt TLS termination which it would otherwise perform for all incoming TLS connections. We require that the connection is passed through from the RadSec client to the RadSec server without being reterminated since the end client's certificate is authenticated by the RadSec server and many be used for policy decisions. === Testing RadSec connectivity via Traefik Now amend the test RadSec client so that instead of making connections directly to the RadSec server it makes them via Traefik. On `radseccli` amend `/etc/raddb/sites-enabled/tls` and set the IP address to that of the `traefik` host. .Example updated test client homeserver configuration ===================================================== home_server tls { ipaddr = 172.23.0.5 # Updated from radsecsvr to traefik ... } ===================================================== Restart the debug mode session: [source,shell] ---- radiusd -X ---- Perform a test authentication: [source,shell] ---- echo "User-Name = bob" | radclient 127.0.0.1 auth testing123 ---- If the test client is able to successfully establish the RadSec connection via Traefik and the RadSec server replies with an Access-Accept response then the output will be as follows: .Example output from radclient ============================== Sent Access-Request Id 252 from 0.0.0.0:50118 to 127.0.0.1:1812 length 27 Received Access-Accept Id 252 from 127.0.0.1:1812 to 127.0.0.1:50118 length 39 ============================== Traefik should also log a message that indicates that the connection was proxied, such as the following: .Example output from Traefik ============================ time="..." level=debug msg="Handling connection from 172.23.0.2:57367" ============================ Any other output from radclient or Traefik indicates that there is a problem with the Traefik configuration or that FreeRADIUS is not accepting connection from the `traefik` host, which must be solved before continuing. Once proxied connections are working we are ready to xref:protocols/proxy/enable_proxy_protocol.adoc[enable the PROXY Protocol] on both Traefik and the RadSec server. freeradius-3.2.10+dfsg/doc/antora/modules/howto/pages/simultaneous_use.adoc000066400000000000000000000066501522352605200270520ustar00rootroot00000000000000= Simultaneous-Use checking There are a whole lot of pieces which have to work together for `Simultaneous-Use` to work. In this guide, we assume that user sessions are stored in SQL. For `Simultaneous-Use` to work. the server needs to know who is online, which means that accounting must be configured and working. Start off by checking the basics, independent of `Simultaneous-Use`. If you are using EAP, you may also need to configure the `inner-tunnel` virtual server, and the `session` section there. Be also careful to correctly handle the difference between the "outer" User-Name, and the "inner-tunnel" User-Name. As always, start off with reading the debug output, and use that information to answer a few questions. == Did the user get Access-Accept? *No* - Fix that. Make sure that the user can be authenticated! *Yes* - FreeRADIUS told the NAS to allow the user online. This usually works, but perhaps the NAS disagreed, and still dropped the user. It happens. The only way you know that a user is actually online is to check the accounting data. So we will do that next. == Did the server then get an Accounting-Request for that user? *No* - The NAS isn't sending accounting packets, Simultaneous-Use will never work. Go fix the NAS so that it sends accounting packets. *Yes* - The NAS is telling FreeRADIUS that it allowed the user online, and the user has an active session. We now have to see where that data is stored. == Did the accounting data go into the radacct table? As always, Read the debug output. *No* - There is nothing in the debug output about radacct? Configure the server to write accounting data to SQL ou can use `radclient` to send fake accounting packets for testing. Use a real accounting packet as a template for input to `radclient`, but change the `User-Name` so that the tests don't affect real users. *Yes* - You see successful `INSERT` or `UPDATE` lines in `radacct`. That's good! == One last check Double-check the radacct database using an SQL client. Just to be sure that the data is really there. == It is now set up correctly to track user sessions If all that works, then the server is set up correctly to authenticate users, and to store their data in SQL. This is the foundation for `Simultaneous-Use`. == Set Simultaneous-Use Then, configure the server to set `Simultaneous-Use=1`. That tells the server to enforce `Simultaneous-Use`. That configuration can go into the `files` module, `sql`, or whereever else you want. You will also need to configure the `default` virtual server to check session data in SQL. Look for `Simultaneous-Use` in `sites-available/default`. Uncomment the line containing `sql` == Double check that a user can still log in! Go through all of the above steps _again_, checking that the user can log in, and that the server is receiving accounting packets. This time, also look for the debug output to contain: ``` # Executing section session from file ... session { ``` That shows it is checking the `session` database. If all goes well, the next few lines after that should show that it is checking `sql`. If the above text doesn't appear, then the server isn't getting told to set `Simultaneous-Use = 1`. You will have to fix that before going to the next step. If the user has not logged in yet, you will see an `Access-Accept`. Otherwise, if the user already has an active session, the server should say that the user is being rejected due to multiple logins. freeradius-3.2.10+dfsg/doc/antora/modules/installation/000077500000000000000000000000001522352605200230515ustar00rootroot00000000000000freeradius-3.2.10+dfsg/doc/antora/modules/installation/nav.adoc000066400000000000000000000003071522352605200244650ustar00rootroot00000000000000* xref:index.adoc[Install and Upgrade] ** xref:packages.adoc[Install from packages] ** xref:dependencies.adoc[Dependencies] ** xref:source.adoc[Build from Source] ** xref:upgrade.adoc[Upgrade to v3] freeradius-3.2.10+dfsg/doc/antora/modules/installation/pages/000077500000000000000000000000001522352605200241505ustar00rootroot00000000000000freeradius-3.2.10+dfsg/doc/antora/modules/installation/pages/dependencies.adoc000066400000000000000000000016101522352605200274240ustar00rootroot00000000000000= Dependencies Some external dependencies must be installed before building or running FreeRADIUS. For version 3, the core depends on one mandatory library: `libtalloc` for memory management. Many of the modules also have optional dependencies. For example, the LDAP module requires LDAP client libraries to be installed and database modules need their respective database client libraries. If building from source code, the configure stage will check for the optional dependencies. Any missing libraries will cause that particular module to be skipped. == Libraries === libtalloc Talloc is a memory allocation library available on the https://talloc.samba.org/talloc/doc/html/index.html[Samba] website. *OSX* `# brew install talloc` *Debian, Ubuntu and `dpkg`-based systems* `# apt-get install libtalloc-dev` *RedHat, CentOS, Rocky Linux or equivalent* ``` # yum install libtalloc-devel ``` freeradius-3.2.10+dfsg/doc/antora/modules/installation/pages/index.adoc000066400000000000000000000006531522352605200261130ustar00rootroot00000000000000== Installation FreeRADIUS is available from multiple sources: * Official xref:packages.adoc[InkBridge Networks] FreeRADIUS packages * xref:source.adoc[Source code] * Many Operating System distributions We highly recommend using the official packages from Network RADIUS, where available. The documents in this section cover details of the above installation methods, as well as instructions on building packages locally. freeradius-3.2.10+dfsg/doc/antora/modules/installation/pages/packages.adoc000066400000000000000000000015251522352605200265610ustar00rootroot00000000000000= Install from packages Network RADIUS provide pre-built binary packages of FreeRADIUS for common Linux distributions. This is the recommended installation method when packages are available for your system. The official https://packages.inkbridgenetworks.com/[InkBridge Networks packages] page contains recent FreeRADIUS packages and installation instructions. == Distribution-supplied packages While many Operating System distributions ship FreeRADIUS packages, the versions they include are often years out of date. As well as missing out on the latest bug fixes and features, this also means that it is very hard to know if an issue encountered is still a problem or if it is fixed in the latest release. Therefore, whilst the distribution-supplied packages can often be the most convenient to install, we do not usually recommend using them. freeradius-3.2.10+dfsg/doc/antora/modules/installation/pages/source.adoc000066400000000000000000000203051522352605200263000ustar00rootroot00000000000000= Building from Source We recommend xref:packages.adoc[installing from packages] if possible. Full instructions on building and installing from source code follow. The xref:installation:dependencies.adoc[dependencies] must be installed before FreeRADIUS can be built. These dependencies are `libtalloc` and `libkqueue`, which FreeRADIUS uses for memory management, and platform-independent event handling. Per-module dependencies that enable support for external services such as LDAP, SQL, etc, are optional. They must be installed for any modules that are to be used. The FreeRADIUS `./configure` step will automatically detect if each module has its dependencies met and automatically enable support for them. If the features you require are not enabled you should inspect the configure script output to figure out which additional development libraries need to be installed. include::xref:ROOT/partial$externaldoc.adoc The FreeRADIUS source may be obtained from a number of locations: * Download the latest version of the FreeRADIUS source from https://www.freeradius.org/releases/[the FreeRADIUS web site]; or * download from https://github.com/FreeRADIUS/freeradius-server/[GitHub]. The file wil be name something like: `freeradius-server-3.0.22.tar.gz`. Later versions will be `3.0.23`, or `4.0.0`, etc. PGP signatures are also provided for official releases from the FTP site; these are named e.g. `freeradius-server-3.0.22.tar.gz.sig`. Un-tar the file, and change to the FreeRADIUS directory (where `VERSION` below is the version of the server that you have downloaded). [source,shell] ---- tar -zxf freeradius-server-VERSION.tar.gz cd freeradius-server-VERSION ---- Take the following steps to build and install the server from source: [source,shell] ---- ./configure make sudo make install ---- == Custom build FreeRADIUS has GNU autoconf support. This means you have to run `./configure`, and then run `make`. To see which configuration options are supported, run `./configure --help`, and read its output. The `make install` stage will install the binaries, the "man" pages, and *may* install the configuration files. If you have not installed a RADIUS server before, then the configuration files for FreeRADIUS will be installed. If you already have a RADIUS server installed, then *FreeRADIUS WILL NOT over-write your current configuration.* The `make install` process will warn you about the files it could not install. If you see a warning message about files that could not be installed, then you *must* ensure that the new server is using the new configuration files and not the old configuration files, as this may cause undesired behavior and failure to operate correctly. The initial output from running in debugging mode (`radiusd -X`) will tell you which configuration files are being used. See xref:installation:upgrade.adoc[Upgrade to v3] for information about upgrading from older versions. There _may_ be changes in the dictionary files which are required for a new version of the software. These files will not be installed over your current configuration, so you *must* verify and install any problem files by hand, for example using `diff(1)` to check for changes. When installing from source, it is _extremely_ helpful to read the output of `./configure`, `make`, and `make install`. If a particular module you expected to be installed was not installed, then the output will tell you why that module was not installed. The most likely reason is that required libraries (including their development header files) are not available. Please do _not_ post questions to the FreeRADIUS users list without first carefully reading the output of this process as it often contains the information needed to resolve a problem. == Upgrade To A New Minor Release The installation process will not over-write your existing configuration files. It will, however, warn you about the files it did not install. These will require manual integration with the existing files. It is not possible to re-use configurations between different major versions of the server. For details on what has changed between the version, see the xref:installation:upgrade.adoc[Upgrade to v3] guide. We *strongly* recommend that new major versions be installed in a different location than any existing installations. Any local policies can then be migrated gradually to the configuration format of the new major version. The number of differences in the new configuration mean that is is both simpler and safer to migrate your configurations rather than to try and just get the old configuration to work. == Run the Server If the server builds and installs, but doesn’t run correctly, then you should first use debugging mode (`radiusd -X`) to figure out the problem. This is your best hope for understanding the problem. Read _all_ of the messages which are printed to the screen, the answer to your problem will often be in a warning or error message. We really cannot emphasize that last sentence enough. Configuring a RADIUS server for complex local authentication isn’t a trivial task. Your *best* and *only* method for debugging it is to read the debug messages, where the server will tell you exactly what it’s doing, and why. You should then compare its behaviour to what you intended, and edit the configuration files as appropriate. If you don’t use debugging mode, and ask questions on the mailing list, then the responses will all tell you to use debugging mode. The server prints out a lot of information in this mode, including suggestions for fixes to common problems. Look especially for `WARNING` and `ERROR` messages in the output, and read the related messages. Since the main developers of FreeRADIUS use debugging mode to track down their configuration problems with the server, it’s a good idea for you to use it, too. If you don’t, there is little hope for you to solve any configuration problem related to the server. To start the server in debugging mode, do: [source,shell] ---- radiusd -X ---- You should see a lot of text printed on the screen as it starts up. If you don’t, or if you see error messages, please read the https://www.freeradius.org/documentation/freeradius-server/4.0.0/faq.html[FAQ]: If the server says `Ready to process requests.`, then it is running properly. From another shell (or another window), type [source,shell] ---- radtest test test localhost 0 testing123 ---- You should see the server print out more messages as it receives the request, and responds to it. The `radtest` program should receive the response within a few seconds. It doesn’t matter if the authentication request is accepted or rejected, what matters is that the server received the request, and responded to it. You can now edit the configuration files for your local system. You will usually want to start with `sites-enabled/default` for main configurations. To set which NASes (clients) can communicate with this server, edit `raddb/clients.conf`. Please read the configuration files carefully, as many configuration options are only documented in comments in the file. Note that is is *highly* recommended that you use some sort of version control system to manage your configuration, such as git or Subversion. You should then make small changes to the configuration, checking in and testing as you go. When a config change causes the server to stop working, you will be able to easily step back and find out what update broke the configuration. It is also considered a best practice to maintain a staging or development environment. This allows you to test and integrate your changes without impacting your active production environment. You should make the appropirate investment in order to properly support a critical resource such as your authentication servers. Configuring and running the server MAY be complicated. Many modules have `man` pages. See `man rlm_pap`, or `man rlm_*` for information. Please read the documentation in the doc/ directory. The comments in the configuration files also contain a lot of documentation. If you have any additional issues, the https://www.freeradius.org/documentation/freeradius-server/4.0.0/faq.html[FAQ] or https://www.freeradius.org/documentation/freeradius-server/4.0.0/trouble-shooting/index.html[Troubleshooting] guides are good places to start. freeradius-3.2.10+dfsg/doc/antora/modules/installation/pages/upgrade.adoc000066400000000000000000000503651522352605200264400ustar00rootroot00000000000000= Upgrade to v3 The configuration for version 3 is *largely* compatible with the version 2 configuration. However, it is NOT possible to simply use the v2 configuration as-is. Instead, you should re-create it. == Security A number of configuration items have moved into the "security" subsection of radiusd.conf. If you use these, you should move them. Otherwise, they can be ignored. The list of moved options is: * chroot * user * group * allow_core_dumps * reject_delay * status_server These entries should be moved from "radiusd.conf" to the "security" subsection of that file. == Naming Many names used by configuration items were inconsistent in earlier versions of the server. These names have been unified in version 3.0. If a file is being referenced or created the config item `filename` is used. If a file is being created, the initial permissions are set by the `permissions` config item. If a directory hierarchy needs to be created, the permissions are set by `dir_permissions`. If an external host is referenced in the context of a module the `server` config item is used. Unless the config item is a well recognised portmanteau (as `filename` is for example), it must be written as multiple distinct words separated by underscores `_`. The configuration items `file`, `script_file`, `module`, `detail`, `detailfile`, `attrsfile`, `perm`, `dirperm`, `detailperm`, and `hostname` are deprecated. As well as any false portmanteaus, and configuration items that used hyphens as word delimiters. e.g. `foo-bar` has been changed to `foo_bar`. Please update your module configuration to use the new syntax. In most cases the server will tell you the replacement config item to use. As always, run the server in debugging mode to see these messages. == Modules Directory As of version 3.0, the `modules/` directory no longer exists. Instead, all "example" modules have been put into the `mods-available/` directory. Modules which can be loaded by the server are placed in the `mods-enabled/` directory. All of the modules in that directory will be loaded. This means that the `instantiate` section of radiusd.conf is less important. The only reason to list a module in the `instantiate` section is to force ordering when the modules are loaded. Modules can be enabled by creating a soft link. For module `foo`, do: [source,shell] ---- cd raddb/mods-enabled ln -s ../mods-available/foo ---- To create "local" versions of the modules, we suggest copying the file instead. This leaves the original file (with documentation) in the `mods-available/` directory. Local changes should go into the `mods-enabled/` directory. Module-specific configuration files are now in the `mods-config/` directory. This change allows for better organization, and means that there are fewer files in the main `raddb` directory. See `mods-config/README.rst` for more details. == Changed Modules The following modules have been changed in this version. === rlm_sql The SQL configuration has been moved from `sql.conf` to `mods-available/sql`. The `sqlippool.conf` file has also been moved to `mods-available/sqlippool`. The SQL module configuration has been changed. The old connection pool options are no longer accepted: ---- num_sql_socks connect_failure_retry_delay lifetime max_queries ---- Instead, a connection pool configuration is used. This configuration contains all of the functionality of the previous configuration, but in a more generic form. It also is used in multiple modules, meaning that there are fewer different configuration items. The mapping between the configuration items is: ---- num_sql_socks -> pool { max } connect_failure_retry_delay -> pool { retry_delay } lifetime -> pool { lifetime } max_queries -> pool { uses } ---- The pool configuration adds a number of new configuration options, which allow the administrator to better control how FreeRADIUS uses SQL connection pools. The following parameters have been changed: ---- trace -> removed tracefile -> logfile ---- The logfile is intended to log SQL queries performed. If you need to debug the server, use debugging mode. If `logfile` is set, then *all* SQL queries will go to `logfile`. You can now use a NULL SQL database: .Example ---- driver = rlm_sql_null ---- This is an empty driver which will always return "success". It is intended to be used to replace the `sql_log` module, and to work in conjunction with the `radsqlrelay` program. Simply take your normal configuration for raddb/mods-enabled/sql, and set: .Example ---- driver = rlm_sql_null ... logfile = ${radacctdir}/sql.log ---- All of the SQL queries will be logged to that file. The connection pool does not need to be configured for the `null` SQL driver. It can be left as-is, or deleted from the SQL configuration file. === rlm_sql_sybase The `rlm_sql_sybase` module has been renamed to `rlm_sql_freetds` and the old `rlm_sql_freetds` module has been removed. `rlm_sql_sybase` used the newer ct-lib API, and `rlm_sql_freetds` used an older API and was incomplete. The new `rlm_sql_freetds` module now also supports database selection on connection startup so `use` statements no longer have to be included in queries. === sql/dialup.conf Queries for post-auth and accounting calls have been re-arranged. The SQL module will now expand the 'reference' configuration item in the appropriate sub-section, and resolve this to a configuration item. This behaviour is similar to rlm_linelog. This dynamic expansion allows for a dynamic mapping between accounting types and SQL queries. Previously, the mapping was fixed. Any "new" accounting type was ignored by the module. Now, support for any accounting type can be added by just adding a new target, as below. Queries from v2.x.x may be manually copied to the new v3.0 `dialup.conf` file (`raddb/sql/main//queries.conf`). When doing this you may also need to update references to the accounting tables, as their definitions will now be outside of the subsection containing the query. The mapping from old "fixed" query to new "dynamic" query is as follows: ---- accounting_onoff_query -> accounting.type.accounting-on.query accounting_update_query -> accounting.type.interim-update.query accounting_update_query_alt +> accounting.type.interim-update.query accounting_start_query -> accounting.type.start.query accounting_start_query_alt +> accounting.type.start.query accounting_stop_query -> accounting.type.stop.query accounting_stop_query_alt +> accounting.type.stop.query postauth_query -> post-auth.query ---- Alternatively a 2.x.x config may be patched to work with the 3.0 module by adding the following: .Example [source,unlang] ---- accounting { reference = "%{tolower:type.%{Acct-Status-Type}.query}" type { accounting-on { query = "${....accounting_onoff_query}" } accounting-off { query = "${....accounting_onoff_query}" } start { query = "${....accounting_start_query}" query = "${....accounting_start_query_alt}" } interim-update { query = "${....accounting_update_query}" query = "${....accounting_update_query_alt}" } stop { query = "${....accounting_stop_query}" query = "${....accounting_stop_query_alt}" } } } post-auth { query = "${..postauth_query}" } ---- In general, it is safer to migrate the configuration rather than trying to "patch" it, to make it look like a v2 configuration. Note that the sub-sections holding the queries are labelled `accounting-on`, and not `accounting_on`. The reason is that the names of these sections are taken directly from the `Accounting-Request` packet, and the `Acct-Status-Type` field. The `sql` module looks at the value of that field, and then looks for a section of that name, in order to find the query to use. That process means that the server can be extended to support any new value of `Acct-Status-Type`, simply by adding a named sub-section, and a query. This behavior is preferable to that of v2, which had hard-coded queries for certain `Acct-Status-Type` values, and was ignored all other values. === rlm_ldap The LDAP module configuration has been substantially changed. Please read `raddb/mods-available/ldap`. It now uses a connection pool, just like the SQL module. Many of the configuration items remain the same, but they have been moved into subsections. This change is largely cosmetic, but it makes the configuration clearer. Instead of having a large set of random configuration items, they are now organized into logical groups. You will need to read your old LDAP configuration, and migrate it manually to the new configuration. Simply copying the old configuration WILL NOT WORK. Users upgrading from 2.x.x who used to call the ldap module in `post-auth` should now set `edir_autz = yes`, and remove the `ldap` module from the `post-auth` section. === rlm_ldap and LDAP-Group In 2.x.x the registration of the `LDAP-Group` pair comparison was done by the last instance of rlm_ldap to be instantiated. In 3.0 this has changed so that only the default `ldap {}` instance registers `LDAP-Group`. If `-LDAP-Group` is already used throughout your configuration no changes will be needed. === rlm_ldap authentication In 2.x.x the LDAP module had a `set_auth_type` configuration item, which forced `Auth-Type := ldap`. This was removed in 3.x.x as it often did not work, and was not consistent with the rest of the server. We generally recommend that LDAP should be used as a database, and that FreeRADIUS should do authentication. The only reason to use `Auth-Type := ldap` is when the LDAP server will not supply the "known good" password to FreeRADIUS, *and* where the Access-Request contains User-Password. This situation happens only for Active Directory. If you think you need to force `Auth-Type := ldap` in other situations, you are very likely to be wrong. The following is an example of what should be inserted into the `authorize {}` and `authenticate {}` sections of the relevant virtual-servers, to get functionality equivalent to v2.x: .Example [source,unlang] ---- authorize { ... ldap if ((ok || updated) && User-Password) { update control { Auth-Type := ldap } ... } authenticate { ... Auth-Type ldap { ldap } ... } ---- === rlm_eap The EAP configuration has been moved from `eap.conf` to `mods-available/eap`. A new `pwd` subsection has been added for EAP-PWD. === rlm_expiration & rlm_logintime The rlm_expiration and rlm_logintime modules no longer add a `Reply-Message`, the same behaviour can be achieved checking the return code of the module and adding the `Reply-Message` with unlang: .Example [source,unlang] ---- expiration if (userlock) { update reply { Reply-Message := "Your account has expired" } } ---- === rlm_unix The `unix` module does not have an `authenticate` section. So you cannot set `Auth-Type := System`. The `unix` module has also been deleted from the examples in `sites-available/`. Listing it there has been deprecated for many years. The PAP module can do crypt authentication. It should be used instead of Unix authentication. The Unix module still can pull the passwords from `/etc/passwd`, or `/etc/shadow`. This is done by listing it in the `authorize` section, as is done in the examples in `sites-available/`. However, some systems using NIS or NSS will not supply passwords to the `unix` module. For those systems, we recommend putting users and passwords into a database, instead of relying on `/etc/passwd`. === rlm_preprocess In 2.x.x `huntroups` and `users` files were loaded from default locations without being configured explicitly. Since 3.x.x you need to set `huntgroups` and `users` configuration item(s) in module section in order to get them being processed. == New Modules === rlm_date Instances of rlm_date register an xlat method which can translate integer and date values to an arbitrarily formatted date time string, or an arbitrarily formated time string to an integer, depending on the attribute type passed. === rlm_rest The `rest` module is used to translate RADIUS requests into RESTfull HTTP requests. Currently supported body types are JSON and POST. === rlm_unpack The `unpack` module is used to turn data buried inside of binary attributes. e.g. if we have `Class = 0x00000001020304` then: .Example [source,unlang] ---- Tmp-Integer-0 := "%{unpack:&Class 4 short}" ---- will unpack octets 4 and 5 as a "short", which has value 0x0304. All integers are assumed to be in network byte order. === rlm_yubikey The `yubikey` module can be used to forward yubikey OTP token values to a Yubico validation server, or decrypt the token using a PSK. == Deleted Modules The following modules have been deleted, and are no longer supported in Version 3. If you are using one of these modules, your configuration can probably be changed to not need it. Otherwise email the freeradius-devel list, and ask about the module. === rlm_acct_unique This module has been replaced by the "acct_unique" policy. See raddb/policy.d/accounting. The method for calculating the value of acct_unique has changed. However, as this method was configurable, this change should not matter. The only issue is in having a v2 and v3 server writing to the same database at the same time. They will calculate different values for Acct-Unique-Id. === rlm_acctlog You should use rlm_linelog instead. That module has a superset of the acctlog functionality. === rlm_attr_rewrite The attr_rewrite module looked for an attribute, and then re-wrote it, or created a new attribute. All of that can be done in "unlang". A sample configuration in "unlang" is: .Example [source,unlang] ---- if (request:Calling-Station-Id) { update request { Calling-Station-Id := "...." } } ---- We suggest updating all uses of attr_rewrite to use unlang instead. === rlm_checkval The checkval module compared two attributes. All of that can be done in "unlang": .Example [source,unlang] ---- if (&request:Calling-Station-Id == &control:Calling-Station-Id) { ok } ---- We suggest updating all uses of checkval to use unlang instead. === rlm_dbm No one seems to use it. There is no sample configuration for it. There is no speed advantage to using it over the "files" module. Modern systems are fast enough that 10K entries can be read from the "users" file in about 10ms. If you need more users than that, use a real database such as SQL. === rlm_fastusers No one seems to use it. It has been deprecated since Version 2.0.0. The "files" module was rewritten so that the "fastusers" module was no longer necessary. === rlm_policy No one seems to use it. Almost all of its functionality is available via `unlang`. === rlm_sim_files The rlm_sim_files module has been deleted. It was never marked "stable", and was never used in a production environment. There are better ways to test EAP. If you want similar functionality, see rlm_passwd. It can read CSV files, and create attributes from them. === rlm_sql_log This has been replaced with the "null" sql driver. See `raddb/mods-available/sql` for an example configuration. The main SQL module has more functionality than rlm_sql_log, and results in less code in the server. == Other Functionality The following is a list of new / changed functionality. === RadSec RadSec (or RADIUS over TLS) is now supported. RADIUS over bare TCP is also supported, but is recommended only for secure networks. See `sites-available/tls` for complete details on using TLS. The server can both receive incoming TLS connections, and also originate outgoing TLS connections. The TLS configuration is taken from the old EAP-TLS configuration. It is largely identical to the old EAP-TLS configuration, so it should be simple to use and configure. It re-uses much of the EAP-TLS code, so it is well-tested and reliable. Once RadSec is enabled, normal debugging mode will not work. This is because the TLS code requires threading to work properly. Instead of doing: .Example [source,shell] ---- radiusd -X ---- you will need to do: .Example [source,shell] ---- radiusd -fxx -l stdout ---- That's the price to pay for using RadSec. This limitation may be lifted in a future version of the server. === PAP and User-Password From version 3.0 onwards the server no longer supports authenticating against a cleartext password in the 'User-Password' attribute. Any occurences of this (for instance, in the users file) should now be changed to 'Cleartext-Password' instead. e.g. change entries like this: ---- bob User-Password == "hello" ---- to ones like this: ---- bob Cleartext-Password := "hello" ---- If this is not done, authentication will likely fail. The server will also print a helpful message in debugging mode. If it really is impossible to do this, the following unlang inserted above the call to the pap module may be used to copy User-Password to the correct attribute: .Example [source,unlang] ---- if (!control:Cleartext-Password && control:User-Password) { update control { Cleartext-Password := "%{control:User-Password}" } } ---- However, this should only be seen as a temporary, not permanent, fix. It is better to fix your databases to use the correct configuration. == Unlang The unlang policy language is compatible with v2, but has a number of new features. See `man unlang` for complete documentation. === Errors Many more errors are caught when the server is starting up. Syntax errors in `unlang` are caught, and a helpful error message is printed. The error message points to the exact place where the error occurred: ---- ./raddb/sites-enabled/default[230]: Parse error in condition ERROR: if (User-Name ! "bob") { ERROR: ^ Invalid operator ---- `update` sections are more generic. Instead of doing `update reply`, you can do the following: .Example [source,unlang] ---- update { reply:Class := 0x0000 control:Cleartext-Password := "hello" } ---- This change means that you need fewer `update` sections. === Comparisons Attribute comparisons can be done via the `&` operator. When you needed to compare two attributes, the old comparison style was: .Example [source,unlang] ---- if (User-Name == "%{control:Tmp-String-0}") { ---- This syntax is inefficient, as the `Tmp-String-0` attribute would be printed to an intermediate string, causing unnecessary work. You can now instead compare the two attributes directly: .Example [source,unlang] ---- if (&User-Name == &control:Tmp-String-0) { ---- See `man unlang` for more details. === Casts Casts are now permitted. This allows you to force type-specific comparisons: .Example [source,unlang] ---- if ("%{sql: SELECT...}" == 127.0.0.1) { ---- This forces the string returned by the SELECT to be treated as an IP address, and compare to `127.0.0.1`. Previously, the comparison would have been done as a simple string comparison. === Networks IP networks are now supported: if (127.0.0.1/32 == 127.0.0.1) { Will be `true`. The various comparison operators can be used to check IP network membership:: .Example [source,unlang] ---- if (127/8 > 127.0.0.1) { ---- Returns `true`, because `127.0.0.1` is within the `127/8` network. However, the following comparison will return `false`:: .Example [source,unlang] ---- if (127/8 > 192.168.0.1) { ---- because `192.168.0.1` is outside of the `127/8` network. === Optimization As `unlang` is now pre-compiled, many compile-time optimizations are done. This means that the debug output may not be exactly the same as what is in the configuration files: if (0 && (User-Name == "bob')) { The result will always be `false`, as the `if 0` prevents the following `&& ...` from being evaluated. Not only that, but the entire contents of that section will be ignored entirely: .Example [source,unlang] ---- if (0) { this_module_does_not_exist and_this_one_does_not_exist_either } ---- In v2, that configuration would result in a parse error, as there is no module called `this_module_does_not_exist`. In v3, that text is ignored. This ability allows you to have dynamic configurations where certain parts are used (or not) depending on compile-time configuration. Similarly, conditions which always evaluate to `true` will be optimized away: .Example [source,unlang] ---- if (1) { files } ---- That configuration will never show the `if (1)` output in debugging mode. === Dialup_admin The dialup_admin directory has been removed. No one stepped forward to maintain it, and the code had not been changed in many years. freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/000077500000000000000000000000001522352605200223765ustar00rootroot00000000000000freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/assets/000077500000000000000000000000001522352605200237005ustar00rootroot00000000000000freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/assets/images/000077500000000000000000000000001522352605200251455ustar00rootroot00000000000000freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/assets/images/SAVE.svg000066400000000000000000000363631522352605200264370ustar00rootroot00000000000000 NAS NAS NAS NAS Proxy Proxy thread thread thread thread thread preprocess chap suffix files eap sql authorize Home server waiting authenticate unix authorize preprocess chap suffix files eap sql proxy to realm preprocess accounting suffix files FreeRADIUS Server core freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/assets/images/access-challenge.svg000066400000000000000000000107301522352605200310500ustar00rootroot00000000000000 Access-Request Access-Request Access-Challenge State = 0x01 State = 0x01 Access-Accept authorize authenticate authorize authenticate post-auth Server NAS freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/assets/images/access-request-proxy.svg000066400000000000000000000122431522352605200317760ustar00rootroot00000000000000 Access-Accept Proxy-State = 0x01 Access-Request Proxy-State = 0x01 Access-Request Access-Accept authorize authenticate post-auth authorize authenticate pre-proxy post-proxy NAS Proxy Home server freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/assets/images/access-request.svg000066400000000000000000000053111522352605200306150ustar00rootroot00000000000000 Access-Request Access-Accept authorize authenticate post-auth Server NAS freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/assets/images/accounting-request-proxy.svg000066400000000000000000000117621522352605200326740ustar00rootroot00000000000000 NAS Accounting-Request Proxy-State = 0x01 pre-proxy Proxy preacct accounting Accounting-Request post-proxy Accounting-Response Home server preacct accounting Proxy-State = 0x01 Accounting-Response freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/assets/images/accounting-request.svg000066400000000000000000000050221522352605200315050ustar00rootroot00000000000000 Server NAS Accounting-Request preacct accounting Accounting-Response freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/assets/images/asciifull.gif000066400000000000000000000665421522352605200276240ustar00rootroot00000000000000GIF89aËè‡ìÿìììûûûüüüýýýþþþÿÿÿ!ùÿ,ËèÿH° Áƒ*\È°¡Ã‡#JœH±¢Å‹3jÜȱ£Ç CŠI²¤É“(Sª\ɲ¥Ë—0cÊœI³¦Í›8sêÜɳ§ÏŸ@ƒ J´¨Ñ£H“*]Ê´©Ó™ž.*µ&ÕªX³jÝzð*× ^¿® +¶¬Ù³=ɢũv­È¶nm˜;WcX¸é*Ä›·nÞ¸b½Òõ[ñîC½ ù 4Œ@qcˆˆg¼:ØñÞ‚–îz™ UÇ 7+V[ù"㆑9«þû˜!ÞÔ™) žŒy!åÄ®Y·¼u¶î‰§mÿ®Û³äâ¨uÇÆ}¼9pâÈá¾&:úðÕƯC†.Ü9÷쬫#ÿ¼íÝãiØ£k“÷NùófƒŒ£Š&,Ÿ·QßÊç3ÿ»|s¿©§^]ò¹§v­Èßvìõ%˜têiwž{§—‚š8ÜgJÖ߆zVá‚åíö…X€‚ø}&Z_x%ú—`Œ3ÞØ|îf }Eáwy=ÂG]Œ.ö(X£‘])¹Ü‡E*)`võ¥8ä“8ùc‘Wòè¥ ú¸¥–/†y&˜6J¹˜•ö5¦]GžéZe§£†5¶È&`µù—š•–&šzŽ‡§D:ÔV£Q9(’˜-z(”Lò‰'œfRJ椉vÙ)_›z¨æž}ZZe¦ß)Gh¤Ô ÿöj™Hæȧ§ëÉê) i Z¨“;NŠh«ÃvŠj°àýi–º’ ݈vr™c®„>Ê*¥ñ5Û«§²i-–Â*‹ëµ¦Õùé°zz»-£ òJ”ÇîZf–˜F+o’áÎ**¤ î[/ºÝÒZ,µ÷Úªî¿: î·×2¼&·ï)®lÉ2©0d<1·£¾©¯»Vù§qŸGŽé’·ë(LJ‰ßÉ_Š)Ìû¥Üñ¶#ú²Å1Ó;3ÏC¼_Îv颜ë^šñ{ô&Z~ñ‚ÌÓƒ¢W³Ò‰1ÝrcÚÓö&÷fÕúÜâÑHwˆ(½üîö±¤=¶ˆW³õ][#ì±×<îÿ|¯Ô€3µ\à NøÕ‡«´éâŒ7îøãG.ùä”Wnùå˜g®ùæœwîùç ‡.ú褗núé¨_žøê?Î:F®¿þ±ì´×>Tì¶Ãš{¿»÷î;P¸ÿž´ðqoüñ.<±Ë+¿üóÐó=ÅÓÏ^ýõØ#ž½ØÕ;¿ý÷È{ÿ¼ø„“þù½›¼úf àþðÇ €þüðWÅö|±½/Gìßä3ÙÙX¼¬ÜoÎ#`áÞó5RáODpqŸü$(Áêï}Ü; Þ˜÷»×<ÐmT³ ›f¸,ñË2ûà G<¸A¢MQ• !¬Îæ3†PœEØFé…ÛY•õÿ’w«g Me»Â` rÃÃ<ç;ýãÉ„õ3cUÑTVü!‰Zõ „(ð‚© ÅhABk‹bÍNè6 èxI!Ï•/®eñ_‡:[¥ÜˆÄ=†lvz¼™Ä¢D4Ñ+ÛÛ—àU«ñepVj¼b5òµ)‚*,䙈ÈN2bhäL$±ÃÆn5 6Îa`79GJ†-N, o…@`%€ü[Å\†Ä²²“›満՟ŒáQx>Ì!ËŽh³éD¨^®["0)(LCRW¨”§.&È3b]™`0OeÄ_`u'âàhË(n$–’,g)"NiŽ³•ÐÌ#Ùÿ¼ ¢,¥håFňØó ÕçõÉLxúM+[;%ªJ/ZY}å.ºQJš ƒÜ <˹!²žÓä¤BIÉÐëð3|ÜCÙ!VšÈnêT[A4yÈžª‡ £P€t!Zv”d75ÖKuj|*³¥%-(4kêÊÙ¼´˜î¤ž.9VÅy6õ¢÷üé0-¶Ïcv°¡ò*I¡úÃ<Ũy£§ǨÂ2*±®× ªYÍÅMµÒÍ­;|+S¿šP:îrW~ežF÷X¾°¢0ê(CÇ6ŒÖ¼á5‡F eÈP†âêX×»‘‡}³lrJhÐwÞ-µ Tm%{Ø•ÿ±Ö†u- j%[ÛB²ÍÍmé·×r9Òxd4n÷ˆ»»þeÕ-Ïm.ö¢ËÜêÚ‡º¶Ãn\´kÝîž…»²/ZÄëÝòj…¼£®y×K<ôŽÅG 'HÜ‹vÕ NíQXÚ©•Ði•ìeïy× æ¶¸,á-dÅÈGÖ7¶@„­ÇPëG¯¶—œ/„Íé ·±· ÆŸ*’ß‚‘0Ä‘ ±€›V˜Žt!ÉÕðÑšJƒÕ§…U¦ëvlÇ·8Á4Fìo.fUæMf.¥!e KÛ¹ÆPþ0±¥Å%ç×™!%§.Ùà*³‘G¶¡JCÂãE’/8ÄñJ†˜Ð¦ÿC¡R!‹!ËZ EŠüë‹ çà⌯ªe•æ2™X–ùŸ?‡œ4Т§…V®ŸT½ I#uŠÚ˜… cóh•—VT {ºY5¡3\¡"©ÓÀy2!ÓÃ[õ´”aN3³*=Ïäb†ù,ç«æÒ"c4Fq fù^ÙÖ†%¨LÁ$S™)û"‡$ó§£jù†õÚu{Û}e¹¬¿Éh™NªÐ¢œ’fs³ZluÖG‡ºÔ–蕃Å\4¹-}Ë6'9œ¥Fð³™Yi®¦gÝ#|ªsìZS;ÞA(¶µœÅSš« ¾**lÅõ£ ›»Sd º$念¥¶|XmÖ˜hƒÿ¶(Á·šê‰ûsã´‹ð|óoÚ]­¸¥©æc/sÊ#FêLå™sr{•¼Szµ‘l6ÖΖT¹¬‹Nò"Šûê0|ºoÇ âsÙ¶ºÃBs#_㈾ŠâmÚüèþʯ.c°”}bÅWÎnk›ß¼÷ ÉÊïB}ò¡%¼õµ •´zée†kñ´÷öµqž-Ú"¿xƒËhÃEä;én÷)ÅZðßC;ð¬>øòŠ¾7ìMÜéEªír§þóÒ}½ìi·zÕ+·Ÿ½îu’{@õþ)¿ß½ð¡òúà7ÅøF9ððËþVÆžºozwèwZàLJ¯Ù[ rï\Gsÿ=)¸Y僾¾Þ§M ^û|«]¶§•È,Ožð•ÿØñSpi^øþ;™Ûmºu–üçaïWyÝdÑ'm€”V-uRÅs Çp¤‡`Úƒä„|ºoIgSIµX4WCô÷qÁTb–woÂ%UÜ‘XGFloGc6€.H+ç6IÖq h‚;gt’‚GG­ôEkÆf,Âwrr„lWw¦E[Mrxç'~fnü†d&AQÇlâJ™A‚}¥‚F¨„Ûƃv%i;HƒÃã…nNH†„U„7„AH(1–fòÖpPód3:Ò`¨c¾kÉ6nF•kà¢_q˜Qcx%-WqÿÈe„˜?3X\¹²„×hšÖdT#‚õçƒÊ¥;Al†6‰pˆiû”b¸‡)n¡ò‡‚ljŠFQ¿ÂO#çnófj:GoPx† !€úfoO‚pcµ‹¾HQP²gR‡‚÷Š²8;D„%ru¤‡LJüGëÇq”†ZÅ¡ƒAGk&ñn%ŽwÈQ!‰¸J+—h,xäŽ1JJõŽ;w}÷y hR¢IÂ$Œù”/{QÙU¶xX®¨‹ÅFuIwˆÚ4KÀ%Xé'}GUuì8‡Œ5e¨™e~b—iV°øYI6)GßØ„˜§y¾wr4Fs§’¥gïÿ“fNžõXÝ~×_- •€†èD@†û—xjçfLøÐø‰ß—€:ixLy‘‰”ÞÕ¥75ŧ^Ë$\Ék£—zc$a™–bù•×s–jù–‰¸^ny;pY—ßÅ–Ëe—zÙ|¡}X˜aÎ(=öC}¿ˆo" {Iá|KiX¹˜ý×vûXAäW~>'ƒc”?èˆ'Q/‰b#Ô†ADƆ‘©xF•阢4s’;é@‰šU†™« ŒasýÿX’c&N'Xh†Á©_í6ü&ˆœèóø‚TV"å›q EFu’'-äX“ áŒX‹ç‘†Y–5€vt­ÿYŠ+„sîÈAÐ9‰éiJ¢›9”N¹HÊxev‰$rŒVœ—d5@TQäGšÒ"úÙtiŠbˆiÙyŸçÁ ‰:&yÀˆ• ;ÿ…lX•f‡\ómk‘`g3Í™}³†™Fm¨‚bô†G™±ž™YIú–J‚jX¶E’²k=–‘ÒKÈ¢…=ÆNsÆ€®'‡~“oHŠ¤Ä†Ë©ŠaWÎ |‡qB–SÅ8Pì¦v5¡ ZrWX É¥¦ò‹5jm7ú—œ j³¨¥&pʼn;I–Q‰£{5„†VdRƒJ*ú'!NÚ£P¥õV5Ìq9õœäùŒZÊB€:wàxkùÿèR2èšOj¢…HQX‚uÚ~¸…¥ ¨› O"€Óh¤zž&º$jxuÌXŸ’*¥‰diŽœ¤©YêoH¹‘¶ùWY™¨n(w}z©¬ÊpÔI‘ ¦5lј°)X™™tW4™mE¹uðù”ìÇ“?bg{ª”Éêv¨¹4xæDŒ÷U´ê`ýÉ`ßÚk I›YY«†ª¬ÛZ¬ˆZ‘êŠäJ\sY¯Hq¯¨×–{y—R¡¯¿Ê\Û:ýZ°ƒi–`i° kœ˯Ós˜ 8š»%¡]餕5¯¸‰}‚_î:¯ðøZ­°éŸÿ™Y!Éô ’$eö¦ò‡yïZ²›fÈÿ:JÇiãj†Hx'˜ºŸ9C¬¹k•ÉT±Ú²Kèe›¦€Qv’;Å¢7w™~zfI$VˆD›µ7±Z+iwj«él&&sä"«…*•¾’q:È‹–êe08qJžÁQƒTvƒŠ¶j¡TÔ·dsõˆI‚¤j…³²¡jG{§S²aÓz¸ñ×YYT{b‘›gQ8œQ£¨a{·;*7’«;[¯Ç´‚K kk ×ŸqëTsËVŠ•q˜10²;º¹pʃmZpž7µu„I…«P(øPpBg$ÉEÂËjb¸Ç‹urˆ€$*‘Wä©؜̨²—×kAÉWèösÞDlNK¸;ÿz»Ø[¶þ»²»ç»½d«·+*ªêçÊ›W ¾î+2Hªt_»¨÷[x´ÈÕǾ•«Ô‰¦ç)PjºŒ¤gOå¹ Sêª-Ⱥ ¦œ êˆI:Áàa¾ç»Á¦êj,Wž(C™QP-©¡À{‡«j‘Z’nÕeKÀ++ÀËyv¦ùm×’ÌÖ¨JOÛ®ò[‹7£:,Y=Œr,«Àh2ÄGÌv»•!Ŧy¢¢2‡ v²~+¤ìKž4ƒÁ ¬ßéÂËÒ;Ø¿¨êrÊ‹¶-Œ¦a‹mµ«wbŸ ¥t»¨ ǯZCG›ÅÖ+0vŠÇÙ!»„¬Á…ìCOŸÅÿ 7»yf'Y“IWaĵä[}çÈy~ñYSEyx|ºV‹Gx5œCGkÂîšÊy‘€;¦!ðÚ@Ù+ÊD)áz½´¼Ê”õ}pUÈT|ÈXÙÊ1K?\K°lÜ]Å,R/áËáËÎÌÌëÊÌ'ÄÈœ°+ñ̌ؼÍѬ°É¬™Öü³{ÛÜÁåüÌÝl°ß,¢y …LÎçÏÐœÎz¹Îë°îüÎ!Ïü<Îôl—ö,b“WÅE ËÿJ˜Ȭª+ÎÜÌýÌÏk´QÇ’ KÐ}Ì[‘,™q'ÍÇ,œR¤¸?5ë¼7ëb |¶æ9ÐdW¦0¯ž¦ã¹Ð6;ÑiÿGȲ²ÍsñÌ9}¾t¡ÏfÁ5üÇ°“Òâ+j?…µg{{½À Ì»g©‰VºpL¨{ÅêFz~³e‚ZrYœÔy̼œá˱Å8í̱‹¾†ìÓÏÇÇ\§oXÇm¤jÔÓˆÔE+­uöY‡»Êz­"¥Ü—|ÚmUø¶ìIÓ% ÄZlW­/Y£´ nCÖutJºgªÍ‡<ÎåŒÖ6mÈš­Öþ›Mj ’Z¼@— Åêô~É…RÀùÕ_2'Æk¯m{öŠ³Ü» ÍmÜx~BÒ ~yŒ¿=½èDÐâj¸m}NÀL™-ÖüËóœd«‹Œ|/»ªè¹Â¾™»‘MŒ&=o ÿù×_ñ¡v¬SzÀxj£L­jM)È@}.´h*u˜h«ffÖç¬Ùh=Ö–ÖÙÁóÙ´• ×0‹¯CÊ·«”Ýõ ÖÕ‹ Þ|iÜ}ú‘W![}Š *à­«ÇXÈ4À= I q‡=ŠrËÚ•Ýö½Ü6m(›ýÜNÙŽŠ¡A|œÚÀÝ]µ_Ü·Ú½‹ Ž¸ˆÖˆm¦®;Æn|É «β#<àazAž«I(Ç ¹´‘\k¡í2ÍÝÙ'nÖ’ÑÜ„¼Ç„¹Œ¬¤m™»~:«Ñ è«›­—œ„÷ß^ê{2KY`®­:Tш™ç-ª¬´Ùw¿eæàÚ¼›ÊŠsÆBÉÙƒÿ!ÖGˆÍ¢‹ËñCÉÔ•KÝrÎ Î ñÐçlÜüÏz².êàÎ^“Î’Ñé ¡éå Ï íéiYêûe驾éñÐûéûÌ设|°~²Îê´웎꜎뻾{½Ž–ø¬¶.ì«~ëžíÐÆþ»}ìãÕ—é*ænŠ{|Û@¼±º¤éήëÐÞåµNîµ)ÑÛ7Ý#ê9ù¿~ü´^§æríÖÊ`ž¯Yæ·Ín뮀w|ŽV©šˆ›´‡çÒ»Ú½’…rèäŽ<åã¼ÓŠ¾CÄnˆ4Œàþ¾ù>טR«Í±ˆXï•Ð¿OÝŽŒ-Õßï‰}DŽͶ9ÿËœ¹ýѾÁÁùÍÍaÁß­nâÌÝþ4Ñý]ÝîD}»(œL¼Š›è!ŽûA¤üÙºJ¹¼zÏL.¦ÊGò¸á#h¬òmÐÚ ðZ)Hk~ä2j}ó½å>/ñéûºÁŽåg]Œ.h.^»ì>_“˜€Ði‡a\À'‚¼FGV®Ý‹J‘Lÿ£Çé%(z”öé]ªÊk¤q¦M¶:š8¿+þù:­y¨— »,Ó)ÚÞˆ‰áLSÑKY¿mÞªôÉ;Ÿ( ÚX_ù“Š¿æ-‘Kµ-šâ+ó"øÞû6ó­;ú:ÍŸýæþŸ¯F:M¥Ú–¿’ÿ?u3îÔ5x²:Ù}”’¿¯h*(½"oÌYßùþwºXáp«r¬_âéÿêëäV\ô ßüM ô1À‚ DX "P˜p¡Ã†\Äø¢CˆjÜØ#H"E’¼8R¥–,U¾„æÉ“2GÒ”‰³äFž0pü‰ ¨P‡C‡Æ¬©SiÏ¥<>½UeS5¥ÚÄšUëV®=_RµzÕ$Ç°dÍNej3åX«ɦ|kÓåÑ®jíž%™3íݽ:gB}¶-\ŠeG¶ÌÚö¦Åˆ%2Pµ£Á„R=FöûX `À…Ý2$Œ1´áº¥¿æú)jÕªWÎu)46ÿbÙ|=Ãu»V÷SܬKŠ~;:÷gàxMGÞ•4褨Owþ\:óº•'Ǿ|ðòàžÕ§Þ=uÞ­Ü_J £EÑš ²¾¨ù6å÷&Ëj¾)ï۬ܲx´.©³üÒ 6á½Õ«]±Å—4£Šªßýìu0/Ey54°ÀÌawÇxª…gÚëÙ˜–-ñÚl¡MضƒszøÄdA³©[J 22 k¬ ²<´Ê1ƒNÕÜî݉fcƒ²•Ëã ~÷c}ýý‰.Š=éUš˜àHë¥×bïíøé£ÿ•^k‡Î®Þ†O +w‘Fx¾©O 9OúZ,e ‘¢²¢s¿Òó ò@Ý”j”Œ÷g~¤³@§’]ŽV r& ãi¾û蹕X¿ÌëZឥVÜ:¼b]XÅ=VÌk±6÷™¼Î»êSoIŽ*ekÛ“[#üÚR{Ü”gv±é÷å{g¾Ý'  ÷WëšíŽœrÆ5œ9͉†øo{ ä sÑa\þc¨A¯p½¢w­÷­Dù±³ÝU{q† [è$ù¾Ž[å*‚_ÝìÁÞ wMó;cëƒÇÙwàéw<é§xÍcÑŠå0E^ºQõ¶V-jL{‹Ú§ÿði uf)ŸÁз6PêUár߆^&7Ë}M “‰àî7¢ÝEÌ|{+œýúgAç%pz, äŒgÃêrœ˜pÄ°MyüÜþâ–'ªgF¦ó Bȧ'˜±MuÒL³´¸§'Åçe(±¢Ñ6ø¨Üá/1¿Âžlj%CZaí7ŠV]ÄƹJ<k͉մ[u)iÉÉŸòŽHÈa)qˆ×2dVò7ª¡p3Ž_ ä7,È4 u‡tbQÇǤD*ÃdJUj²Sg[S¨H%˶NT£Š%.[É8VÆq—úå–f™`jÅL ´¥+ÉxËeö)M´#¡Š9Mj²ÿ¨—Õ,˜'—‰ÍZê2”Ïôæ,ÃéÌn3—Éäf:Õ¹ k®“?Ë&7õÍršSœè$g9ï‰NwöÓŸnüç‹dÏjÎó†Ñ$(BéÏsn“#ùüÏ(:ÑCµ3I-„•¶4Є‰ŒÜsdý.5,Ú“ž ­Ð§ÈiЇzä7#Wìx$k­“¨‚i e(Êÿ†Õ±¨çŠyÄ?Ú”Z~¬VQÇÓ1FÆp£65×%¡•Q¯AP©- {¨¢ò³90õÈGI.MÊì65²¤6U¶G«ô0µa§ȳ‹]Ω{ÃÙL窻>Õs¼bSw½ïä-€]ãKô P¸ED¬ÿšCl—’Q&0§ÌVีÐÞÑdŒbmúÂB2 Ánvù¬Íð†Fâ0›'µ!aëj>Ü-€¼9êY#ÜÂ1©Þy$![ Jq°Q`%·ŠÓ»¾ö}•nÍ$ëšV‹˜;àO}‚©ð%ºŸ5)^Dë)=n„¡Ýäl©¢Ý•o£5ýKþØ*ÅÊ‘±0DlSŽ‹d-W®Â½KdÃ&­ˆG®]ÛïÛûÔ2 m¾ª© Nµ¡-»ÚÚ¬WUK“m“uõ /ÝZGœóz,µó{!] LØJW(Ö[Oe,¼Çåf:¬1aZÁ]Ò5ÅO4nè\|تgUŒêÿŠm«³£ñ…Ø®C–ðçÄç²ôÎ6É^fgAH2)°1 ÅjÜvÅeZBåe±š°"d?ç²*ÈVn*›Wœ¼öÐ,Íê/¾öÔ,¬UMØ›(Ø‹•EÀW›—×Æèäù 9`ßrûZˆ\ö®ËáÕòF../S2¼‹6éXÊ'• NÖˆ†A mÚ| ¶õÉþËáYçü˜Öyöåñ å'Ú¿€^ ír‰M,Ñ9õ®ýC¦x+~.«b¥tš©’z7Š î4™Ûô­ž§T¤àU‡C=øÞبb®Ov4%_ÍFîMxÒxBJ52¸ºdºãÒsë›À¼osÿ‡dqÁw8¾:¸p& m¦ôS )¹²ÕKnsÓ'û•4 [1ŠÎ°Ìš&Ÿ[Ùî©•Ÿ"ZøÉÿ%$±´ž 5¹C;þ&‘G˜¯Á¬ùÌ%KÞ…‚(å*÷ËKsÌ0ªè@‡¨Î•¾ôœ/=×(%ÑÏeÞ¡×ÅFG'h>5ît®Ï¼éØìùÎy>õIÑTwS—̞ЭS¸ëowúשit±+“ì Zû‚ª>ôµOî Éá>ø©£‰U–$;út¨‡HêðC7±ëÇ’‘Ê’N}÷ûâÓ´X [·?úw¿EŸ7¹Ô1¯ƒSu€&÷JÈÐW"j±G_S¹@©ÎbŒžÈÁd;;íà±[" ”ÀYó±=¢'¡žúº-†©1 “.ûˆ-Ws¥@·²&«¾-"És+{5ÿ1ŒÁ†šÁPº?ŠÃ´åÊ"ÚA5QÃÍÑ(ˆæs¾!l¢î¡3aS/tB. ½çˆÂü‹—öÒ! ¬3^3¢É24ÝòB!iÄêSÂ3¬@€[ F+ÔÁBdž{5æ‹4-ºCèº,EÒÃÒø –@?D¦Ëø²õ˜¼Á" ¤5l±;¶†{1!S1Qš÷:¥ô[Àç±Ä ÅäŠÆ$?sAIÄÛA¿BkÆ÷36‡ºnĪMéAÓ*BD‹õñFêC<Å¢°‰O+­x¤?WìÅí+®;Û°º+d0c”T•ró<@ 7YÔ©¼b7ÓÓšŒ8¸žt¬·` 7»‰/ bÊò[²ªâ ;Jƒó-Ÿä<ókÃSÔÆ©‘Ã#ʯ¬¬p©JK‚&Ë‘?Å # ’¸úp%z¾}A¬ÌJŽ#<q'¨ŒJ¸Ó+—+Åx|CÀÌ7¼;¼[˱˺Á¼KlÒKØsÌÅTËÅk¹Ž¬'Å´;Í;T¨•">ÈôÌÏ¿Ï„¨Éü»Ë´LÓÄL #©‹¹ÔÍ×ìºÆ ¦|"ÍÒÌ…c&¢kÕü¹È ;ÿØN“Í_¢MÓ€(Ìs¨Þ„VÄÍ­G ¼à”ÎL0«ZÄ­äJrÎÝSL—›¤g{ÊÜS5朤:1•DÃ: Ê·Äú·Ôʨ Ë©d@Æ›*C’Í舤o>s³Ê²9äG^S·ÔËND Ov3á¿÷1Ô0.Z­.¡ ]tÐëªÚúü­ô¬ËCF9ŠÎûK8 E@ƒ”ïJËG»¼¹k9eQJ£Hh„Ãöc6œ³¶Ò?sj@©Á‚—°¯ýk@5Å¢;À/SÇ®C¤AíµÕH<ì{ÀcE<ƒ?¢¼¯"Ðh›"5‚ª¹”¼`Ëÿí*Ê#ÓTª0üŧà ù4ÌR®@S>x\,—ƒœü°EÏúQËPEÊ¡‹I=+7HyIÕ1TlÈA M%œ/§èd±,Ýž"¿dD½û2³2<5ÿ¢Æ_ƒÁÂʘe Ut"8Ý5CH‘ aÛÄG´-g’ QÓÞÉ*!sœ›B¥²‘\¶[PcTÇbÓ@êÓÜ¢ÁósÇa…G, S€ÛRD\R~ùRÂÖC6ݱQœÖc<ÊGÅ,S‹<=“­(%2PôE"×# Q¾û»}ˆÃ,‰] µ^ER ÖU!-R¬Ÿõ“&¥Gí›SêlWw=×4ÛÖk}'J$c™Uÿýµ}˜õ*W†•¿ì WÂRÃX5×ÅÓsLÂoe׎ C´ôÇ^ê“"òWñù3V 5 %!/ú˜´¬Ú ŒEÕ6ƒ=×rÅTRKÒµK•Ö† ÓMDQ²XRÃØ(«ÒBäØ£ÕÔíJme´ZAWõ–ÍÇ!e\u°© YÁÏ]ÍYà‚¯ë{(‚ýÙ®Z£ý/4môÀGd¿½OM·²üÇ9º¹° Ú›ùü=’‚ã²øP¹Í\¹Ä1éÐÿ‡-½¥¨áTÏE)Q^±Í²%”-Lg‚’«CŽ%á›ÓœNÞ¾¢¹â5ÝÔ»?QÞ»c^4éLìÐ^sÞé5ßóµV¥‘^Á‘ ;^–â‘ðÊD¤Í,LôÅ_ЬÞI9þ¥÷}_iâù_ú=^ìÍ߆ÍýÝMÖ,;)V­àÿ-ß 3àŽÈ¥£[æ`k “ËŸÚý:ùˆ`Î$ü àéS¤‚S+L±/í¢óä@Þ G±ª\ ½FAÏÀ ÓÛ`ŽQöÌŽgŒ“Ø#\ñèÜÜÜŒÝ~}RÀ•×tÄPçs ˜]a5¹Pö°§ë\×{³sêbÌ,ÏKbj)cÿ÷TJц Ji Q ­ÀÃÀÈõÝÝÔ;‰.8†c<]-fŒ&s00­a«3@Þ¤¤s‚¼{­ cEÀ¡õêrRp¬¥ÒÑF­õÈtµSM¦IËQ½+àÍ؆ëÄ­‘c‡-¹Ï­=Ò7åyS© )Üò`Nì]OÄT†ô!G~Y.º®-ÞÙã8ä`~°˜y0ϪÃ'"IM“oùÁJ&©Ì´­œ½ÝÆKÆDa¼aYq®â¥a"¢dß¡BO­FÙSÈqæOMY=&ÃRU oeŠf&Ï`¥G|LÉ:ŠâxöYGY´bIz~ÇÐAÛ]½!‰0K†X„‹\kÎæQŽf$BQåÿ½,e‘}hì¿n ”BÍ¥N#›ÆëuŽíljFšÓOÖ9²C½R`–bšEæBcni.=¿Øå è„°ä/<è«¥æˆÅ…íi™âY;Îà[þh'šãƒÜXJÔhGLا±Hu.S‡¾ óáÆeÎÁ›Õ¿J!%ÞcÆçu¹8Fæ—6eˆàjŸ}btÁ2¬ièŠ4g iK$×4CTk㥙å>Ù.NÅ ¤âñÂCÊIÜèU2>ÆÛá)a]¡®6^dçà9Ζ6V.»%›^±þëÓàåAË<}&,¢Û¸þi°]ã½5IÆmå…æxãbºlÊÈ[D¡ùaíüDÿºL83ÙÁ§¤j¤JÖùÔP2­¸…kâòM ¾Ìî á. ”#K]@œlt2Òê^ËËMhîI4\¤Åuí3ÕÉ¢ÅËfàR*”ô6&ä\ßíLázZ[¬ë9+)O‡CÌ÷ÎM(í`¥cïùo£N÷Žïö~o)Îïfj^èÇ/pžCØþ–ðà ðÖ$pñí_ÄôUÓÜoûíH•Ê;®øÍYžðçº ·ðÇð ·» çp»sð7üßf·ñÏDqt` VNeŠ[ÂÌoÔ”ñßñÿÌܾqéÌqÂŒÐl.o³c¦wÃ÷ðå%ò@V M²Ü^òD³½›Ô¨!YOå(nÿÒ®l¡ŒOVsÜn¾]D*o3é4„m0G8{Øíž2ÜcCÇ:éîIßSp*& ˜õåóøJòzÛ/;½"d ïÇýf스IUmXã뎅XuÖ®XR®5Ò­ßP7Oj.µùklòçæ;1Oî[&Oa]|UiJt°×dIu[¢¸åv,+MDžþÚD W‡VÙ&tULntKbûTW_vl}«l=»6ÙÂí-4½\Gÿ¶ÔeÜ¥O²¹J‰–1«åf'ÚØ[_Ô×%Õî»Íþ=3]^þ4—:tWÀ–ºiJªTN…Ô_Ÿ.ŸÚÔX%äÚ÷^OömU)ÜÜNeø½¼¬ÿ¨•jwÓV_?ÕÊîäOÇj,œK¿xNV¿Ö`÷¯[óÍßL?‡³œYy7©)»ÇâÁ(Ñõ.:jFéÛÍFªe 4O2#G’„wGc;Š¥žµ‡oóÑ‘FrWfŸTZŒ¦¢RöhJ ÆNDU Ìê T3Ër5{qDy…Ry)ƒIËðêy7VMsRôøÔ+D¥¥ã~7yðK.¶Xx 'êKW¢Ç›3NÑóžhezíqúiùÀªiÆ_wÎ$ã–X9²”Ö%\ VÅ/Un [úÞN i´JÛÕå'—–´|_›’ɤ5¬)YÛd¾W€³3NgÔ¶Ú‰HÿQÇtaÔt¡=ȧ}×-ÁÎd¨¦Q:žf_Hig~ Ž} ÕζÒÈN&z$Ÿ+7î4H ‚„  ðàC„ !2\hÑ C‰r¼±àG7vtèq¡Ä‰&/6üxÒ%L” _*À怜hZ\y1g€:uþJÔãЛ9=úÄhtiÏ9 î,ÚpêA£T‡¾ÌÈódÓ¯4W¶T)3lTŸ)™ŽœS¬W±_ÑÊ­k÷.Þ¼zïÒÝë÷¯\·€yÿö;öáàÄŠ‘>­úhã¢OO&å*·±ãš‘%cî¼y1è G“.mú4jÅ¢S³FÙ#\Á,¿®m±3`ÜŒ'ïV U,æÝF…{.n;ïêãÊ—3oîü9ôçÉ£?þ¼W7gË’}gæ<ûQðÅ­SïYþ<úôê׳=½=pòy±ßþnux|Þõå#oþ{ð 8 xZ€î‡ßuö‰×fÜAH™ƒšé·  ²— ‚zø!ˆrè!NÜR~b^}ÖUaB0Z˜!‹‡™TVYb °#; ÐUˆxÅuâYE:'ØZs%É–ZM‘t‘?Fù#r¦¨Þ•¥­6Óÿ“i©´¥[mÉæÝMÜ  }+ÖX“„UᘕuÁ¹æ‰IIg]q‘UŸrñÈ#yùXr.É’“)u WG}6z#m_ùØch®9:×¥æ9ꤤ QI%¥BiXbY’&Ú™˜ò i ÎJ8%å*¢ÄѹŒýµÙ'«Ù§çTÚiZ±¿ÕŠZa5IÓŸ 2¥)¯Ñ¶ºªª‘ZK˜ZnJÛž‚ž$e¨¥’ص–jË)OÎ&ªºŒžE—Ý(¯YFNDä¡‚Æ /B"Í{¢¡ÐJG­äüêÁ™>û®o7=Š$Z¹Î(,®mv§ì¯%éäÛ¸ýɺ±±‰®¹÷¾nÿ»%ŸËm¹åv;­¶ /R¶‘öºì·”¦¼—² ¾ŒpÍ„ZÔ.»¢Ú,-‘Þ–Üí¿ GeîχÙkÌÍvó˜@·ŒôZùºìk°S‰üÒA™²­h3'Kº±Ú0řޙµÜU+{ʇ-Ͳ̽Œê õêíÉR{ ¥Î‹Ñ`ÔP«¼u¸žNj´Â#})EL/zmŽ$Gý³©•Ž{÷àN-pß^Í»UC…“-qŒü­!ÆÁ1 2¤_^‘žOê¥¯Ì«×LC.óï³õÞµã¨3›¸jWÛèÒ/DôºU~tËAßÜ7êÉBû¹µ¡+ÞUŽà{ÞjòUóÍ{cß++ÿìóg±cµcÖúì&^¾8©²å:»¦h0óÞî¤Õ8çÕ-Pùdò­)íL{ÜSÕÕÊ×<ЀvA ÔvB㹫{È2Y̪äÈofoœü¨/ÞÙocþÂYÚ&¤¦ áOnÿ¡ÖÇÖô;Œ†ÎK³šUÁÂEptÔ"Øéˆx/H5IQûzZm:G7&‰_WL⧹ ÎoòÒHæÄtC/¢ÏŠSƒÀ Ò/.Q§‹eDÔ·XÆ®éQy5Ô'v+ú©hm¶k›gh&• ½Ét_µãE~ _–#+I0óoTíá¤$?YPš¦z©ßëL¹C9$Wãÿ¡‰ì<HYÒ²–~!%rú8°:>G‡‰¬Ž*¿‚Ê? ‘˜4Š¥1m 3e2³™Î QÜ ÈŠ½˜€|2cGžVó—°¼f3qùÌq’³œ¥Œæ2ks!ÿXÂ̦6i’n¦‰Bj §9ó©Ï}.žÇKÍfhä—z¦È„”g<éiPBæSœü|(D!êÏN¢&8ÇäKGlH”íòlK¨Bu¸Â’ˆÉ.“šÜÌÊy&$Ú‹9cÒåÈ®65Kž \ë#F e=ŽFDĤ5Y/þ r+XYäQïi˜y–hcóñ§ƒV¢•9•‘g<Ähš§’¼/@€ªà¹X*T—U§ïjéÿVƒ¦AŠÞ´G`µà ·šºµþ3T_ åR*< æ•­íù)न@kiwA Û Ã¤­¦â„-ß æA$Õb)nŸÑÓ?“Ǿ tü”ð†x¼õ…6Žëö¸G·»ö”pܶê:Æp½U¯™KшU™,}=Î0ëW–…¥°ˆ½ÓýÒÂ¥°ù®0}aãw\¶Q‘Œ±•æÈ ˜Õ“AOz¢«yX>¹Òìq D!â²×Ú'F*¼$ñ:ÛHjîº „!×ôª àêmuâ½ã-k¤Î mw# î”Â×Ô2>‘® {øDžÚí¬ËÒé<´îÚVdD,i$aÿß½b¸Âî”zÅubLÁvxÌmûª(ºÞ—}ù5-øëDÓí­¸”}Je {1Žø·ÈeZJ‚žÙá<ȆµØ`ÿ»7ä9»ô*‡Çö] OÊš’¢ê¬\cÁ^O¾ƒ©"…Ùú^o8Æ9í,MŒßâ8Çð¤^KÀ!_>ÙÉsÑûªL¿ ï‡Pú*Ù?ÿY?ü{Ï–¸2&–¯€m= ‡!GBëvµ¿®5ï“64%®÷qsvá”ÊZ’—Vk–³¤¹ŠÛw•ÿýðC³7º×5’“ÓrÔ NИJ©V0d&!ë°…; õÓª¾™ÖTJ`àyµÆæÿë:Û±Ò¶² Íšô‰XI›\¸Ÿ‡S”>E°Éã«8–™~q¸ìQ2Eu;oª”5¡Uý7R Zbdgf:ø6¶S#;·]á±ßÊ-òXýØ×[–׌×mñ@ `«8¢VSÐoû™ÍüA!=åO;šÊý™üà—íËc~’#È“õ£9Œ.Jðc?œ•Ýx|œ!™sšèF?úËa‡sþ }ɃôÎDMžÃ‚‡˜HÇîÕ³®õr*½¢òiºÓy¾ò…Ú“<rXv¶n0µ³½íµDæˆÄ^òU¢3å;DyHý¼·cï~ÿ»ƒ¹h‘&ôç׬¦Ô—•£.Ò¤;W¨‚¹¼z×ÿ…Ýú}æJ±8?—& ¦1m#±-^S»F ®š?¢çëJóèH¬Éá‰wî@2à¬X%àiDHë'­+Ü9þñÝŒ<Ã"Þ[r‡^ÔÄßä`íÍj‹½ 7#ž•+æׂz–Õ̵­}÷%ŒeÖK9MÊÕ³^v®ß¨Æ«µé2¥ÏŽÃb9ÅMÞ‹šƒt?&ð£˜Y:?›Ö¡¸¬…Õó¤X‡Qˆm›ëYü êq†’©1Jø¹Ø,íLmy—FàÖÅÛóÅ‘õJ®œŸSMVI°øO¬°ß°\ð=‘Õ_z RHåœuRªlIQÏÃO¥ à|qÎÿô •–õLó0ÿ`ñ}ß‚_àäɽZ'YÞ¦T}Q œa—HD ,…à’õ bÝ“TU"ý™l`²…×é¼ ŠÝ_"Ѫ©ñà M jUZê-ßx!a¡¼Qˆ-‰~Zje_ŠMáÚ} ÄíX噵[L¼Zût Ú’Œˆ ‚=Õ c³¥ – Ia\AlbºLÝé$ÏÑü¡ )Ä™–=`VŸ[:q¢|¢bé¡Ž,â_ÄZ!"¢ûL‡³b 9¶b$¾]rMLYÖõÄ6mbá8™î!Œ3®ÖØÝÚì—áÈ/£b"&¡^›..Øß|#æ@g¢Ü|1’ÿ™"ŠkÁ"2vòà´$£2’2Y ÒŽÍl“ÇšM¨Lü`V²ÈÞÜø )ÊÂÜ<^¡ 2$ó5ß½Õ1~`:ÊcœéÔ·‰^#Å‹m¤Ûõ‘å"w‰Ñ”äÕí½ÛíñáÊ â‡ÀH@Ú ‚]Öím“í! tÕa6¢ýA6¡ð™G•¤ZI éQ¸Í¤LQÒ¾Qž†= (‘ßÖqe/rDÊàš$ÓÁ“Ý…];”WzÜZ^Wˆ9UÈNÆ YšÒÁ¹ÜÔ¥¥*µ%Dñ¥[þ%`>•ŠÌ%ÔAÕ¥ÏÞÓaS,ù%?9f`F¦d–Å¦Ú f4ÝeÔÝÿ]b$¦½&dN¦hŠfT‰åefΡæf¢åIŽ&7º&lƦb”æÎe£ØÉf²H‰íK®X^ÇIÞÃÈ›Iù¦!ÖRæ_š!HÏÈT2IKyMéI»¼dߥžâ˜uºÇidÌÎ]ÑwäÖ¯„b„!Ù˜”&gõ$8á!:çÅeú4arÆÕ¦%hõ£Fî–{š•½Ä§8FšŸXöùU¶ñã|:à0¶Ù®bª£BÇÒ9šXbVE°`öО|aBfÊTå'ÞŒ z~åê´e{1'jè楗9Ê"›©(¦•è±Ð¢Eö`±%(L¶®5yºØÖºiœ}Âÿᧅù L ¡wv†„rm¢§@Nh›4N±šåg 5‚ÆcѹÚhñc-v›Ê äÁèQ}zWº‹`=嶥I<¢F–ãù¸[éì¨-²™ŽÚÖL^Л2ß„Í™ŠV¡1nçf05ZåwþÍ!Y©Q-¦Ê‰¦IˆJ%{" ÙàrÙ!Âèrä9fåGé©>[Gj!Œáè›Å逆Z¬Ê×òižÚÌŒI‰5OSj\C*.Âéb|'²U¢´pç…Æ·$XËœ`c9eªTH¦òÌŽÍ£™ê¡ …IêcåYWûLGªR!·je°ºhV~é¾iÚŠõ(­ªÿ!ŽP»îߺRK‹-ŒîÄЂvæ¢kžÑ²"…ÞH‚¹ cž¨ý º(¯ÊÖµž)™~ Šªšz«–‘× êŸR¶ã˜Ù(§¦ÂªŒ&_…è÷­)©rlmlª½Ð…éã¡î«x4’=ÞÉÚ}ÏÀ’¬ìloÙIJ ˆ¬ˆj›žF,]1­î&M:ß¡ÕÖª’¬ÿ½¬ºJÐH:¥˜m˜šVîàÆí'‘úé0–)U6âæp-¼Ýdù×sÊQn k^"e•z†¾ubÔîÏñd^à\ÃÎ-ªD-µb¹AåÄQëT‚¢ÚV%åñçÐŽìÔÊægbÿƒ¶ϱ 7Ù&áÍʵ\n„î©`nq¢.h®‡g*Ž.%GRî£Bk‚^¦Gh6”êö®zÐnzè\ÍßDåæiÚåçÈîšÓòú®óÖî€t“m/ðÖfÏÕÝgÄ®ˆ8oó>ïóž¥sÐÓô"œéŠ¥boÞ•¯îr¯÷¶ï4ïûJoÚàÏbB/efúBÔ.¥äh 9­”¸jƒâ!gvŽÆ¢èŠjÕâz­¢N‘‡ˆS’|àÉÙ ý’g%ñdþ]„ VˆïÐFé+"pÂ`Ã-ðé5ðˆ˜0«¶j‹:ÄHnÏ›V0-úgåèoº,½ælÿ¢™M¡ø„ïse‰—ñUújpqÀð~4Œ©QÀf)”rÌn ± óâoÊꚪcKņ¤×rñ>b-0.ñ_0Q>¢ÂX'­GÖYãØí»þàŸFÛ’Úäâ*é؆Äx˜¢Ñ §“/âuág(–R£ÂPñb1„EX§£¥î§jØ¿¦cNÙöŒÎpÅ°}õ#ÍrÎœþOÞqçŸñÃk«Þ*¾Œ«¼‚ØX°‚ò‰-1På/qlpe©ë‡rho$DXñ$ì©žÛQ¢ðÒ£P~ñ`ªrÈ´V­Ô &‰/gq1v+>:.=¾r)/XͲ)¯ÊmÙÿ×rÒM“é2­‘–ÌPsvÐ/ÜŒ˜"ì1‹Í£(sa -´¦î8¯çÄB)×hM^¢â¯c8)Hž³)n×´6®*zªºÚ#^Y`E 8Z!W ³¾=»ÞANþÞ®$S²TD qÕ3û%«3Wä`^24oŸBCìzZŠ’±O‹rFk²!‡1QÓ(o³t~mÌ`‹=4ÊqD£±øP{áW¯5³D›ô2÷ÍK ÇY Ø/7š«Äô†: Oó19ÞÒ’sBKS'7m ?­œN _OÇ¢^ï*}…¤·íðÚî‘0–J*_%FçpbOíºdtÐL.ÿ ‘:sѲŽ\‹šæÍÉZÿÒÍÈYÏÞì‘ u‰»‰CØ/ ùußãr ¹¼°³OdóšÕv½á6leof÷^/áâ]Ð)7 &†joØñtËo‡$·æºïdb÷ý.7^ЈQ’nâÒi›eY&¯ï­&zp7>i·{üžoiÓÝÝ’wÛ.R7;{3S¿wlV°](Tw+U=E·@ÙnUïtW/\úî¸k¢wé’ðè2X‹àF"s.ƒ›fý*/ûJ¸ˆ{zã­…›¦s£MNCņ7ø‰›/ÇX|Öµ]ð[ÌxeŸ²-çë°jtž£ÿçVµM6eçq ‡)¿–ø±è­íÑ¥jýúM « ÀuU¥¶JT¯¥^m Jõkºðá†m 9Fé«òeµ¸½”p[å{åîp¾G³¤«Õf­˜*,ßñFƒãy`‡wgŸA9í朄¯€=ãϺµ¯qJtŸ†­ty™ŽkÆz´É*ðÖñ\c5›Zó,ñž‚IIëߨ‹:»Ž²ª…4DÚ3eg˸{¹ÑÏ4IÒËÍ.”féP¦øâ£&z³1£!ìO\b_7Ȫs+«t˜ß«¹žiÙÊi(!¨}3†¹'¡Äžú3Ûy_ÞjsÃVÕZÊ.«ÿÖÃâ2«ül½cqÕˆñ²Ò£r±_Ì•êm‚ùáG•´ž+âO3ðE²‚Ž)²;Þи6SMÿå©Rõž6Á§z1œ‚´,‡û:—kšš×¹å« jÖZ-r½‡Ì½{eîÞ£;–l¡¹±:t ž««Öx/ë¨øa§ y#žàÊ¢.õÎ#FqÇ Æcº+Cû(v<‚n{W·ñ´ëWOî³Eª¿Ç“²»œ\Ê¥ÏB4"x½#l·k5æ9¸ÛiáÞØÚk©ªûü{:7ÛaS.4÷ õÚ³ú¦t_Ž#4/m¦_µ›mô-/ü`K™‡öÛ3|¯óÉËÃÿ8°d•¦ßŠ·õ¾º±ô¢b¤áv:uŠ;Ëê Ý‹kêk­Sï‹I^ßA›»Ó¾¥×ÊÖFöPñ%š&îôA6ä†lCðàkÙeë½›ûq4»jSEî»çUøíf[ÇÊc>“ý-ü¹¾0‹§–›òörÔvÅ%¿èñ~®'§lsû›q­cvÆ9¿3“ë™Ix„¸úÊ·•;È0E¾Íwz3ÈÓÅ7@ 8`Aƒ&TˆÀB‡!F”8‘"ņ1fÔ¸‘cGAv¼’$Á'Q¢ì˜’%B,S„©ráÌÚ¬ióäAž0)ê,9táH¢G‘†4š”iS§O¡F•êSÿèFž «"ÈŠ0kέrýÙ3èÌ©%—žUÛ4íZ·oáÆ•Ë1¬Õ¯&«ÞkV W¾ ëŠý[vð܉m '¶¨˜qcÇ›^µ[x/P’±þ½ˆY0å‚-'ƒ†\tt鄈M§V½º1çŒze†Û2Ã˳o{&ª·áH¿}£F(€8ZÖ‹ƒN±¸…“^ð7õåj«ãÌ~zéuîÊ·3 _xq‚å ,ÿ0íxöNKܮӻíÜ¢qkÕ|?%ðéxYª¯¾ƒôÎ;×ú²OAœ$J?BM@÷¬Ûn@ƒÆ›:íó-Á!JÏ<—´³®B ýèB+T‘Â÷”ÃÿºŠÐ)FITQÇ;ÜÑÃáÔÈA…t¨­ ךé%ŒF²éGó­ª&aZrÆÏú»©G¯T°»õ«2Æ»tÑ!=BìÇ'9dKÁ¼ˆM ÇŒξ„Có´2¹ÜpM0yìP—êtÓÐ7ÅKhH …NÍ=ßlOÑ"THO>«KÏÞ2ÍÐÀ]´0»ß õ$ÿää4Ô.»r3+)…¢2@-å,Iy”ó9Úú;QÓZUôRŽt×@Û¼sÐZQ]µÄg…vP\—=Ø2…sÔW`»óÔÒÓl”4sÅ4OJ‡7ÐTAÔG2Ý]°ËxS=¥—h ¶]C¯Êÿטl¥©3ÐdíÏßÊzòÒ \ªÊ|m;òÚ‡¤ÍÅn‹RØZf³•ñIj'ªøKs‘ÄxÜMMÞ8Á‘'FÒ ŠÓTDå·Úš)­Tg 7^3E/mïçdí´ÍÞ£™Ô¨)ù•M·€o°Ê‰®YB—]:ËÞPÙå—I*Öê÷øT–æG¹ïº9q¦Xe'¾Vۢ㎘a;ù E#D6oš5¾+†^DÓVúï¼ÿ<ºTY&3LÑÈ|6É´V²î²¯þíÌ.4ðHã›Ñdáö{n½‹ýÏwó$rac‰ö»mÅiÏQôÜG×÷åõN/[Y¶‹~ývÙwFÿÞp›%f9ð’±öü2|?UÐw¥¾w¨³¯K¾@¯¾ÔÍï|Ëó6x|»eUÔoaf²ÜÞçÝ·çèoÏtåÅs!çÔe6¯é {€+ ú2Ö#ð¬mh‚J³Ô–±O9JTŒš€§ž ðgC[#è¾ç„‡œ¢^ +è¾Í(é`Üû—h^°ôÝ‹T]á%ؾþÅV‰“ÏY.¦Ãï‘@làÌÔÈ£Ã,Ê%>ùÊ a8–îì{µiÍÓF³Å,qmtcTÔø²Aù"¼7=F­ŒÞ;£UÇ7:Eƒ4ä!ÿ¡C’ÔQ"Œ#Äö(Æšå.”Ô""SHLn’“AchIER‘¬K[BùG?¦F“ ž+aK:¦Ò“–Ì''·JSÆj`©¡ee¹–V“˜ÅÌ¥ÀiË­²È„š) ±Ñ(2qGÜâ72LÈTÓ=H<z°y»Mr“\Tü_ØHˆD ÍLCtN5¨®pfm‹c¦GºÈRlYÚ¥e²5Å!–SŠü3Ó-“x=q‚-~1+¢Ðn˜²"ô I›¬h© ílx}"¡6‚B뇒ShDÀ.épl棃·Ñ䇣¶+¤#é">gªÌV/a[ÿ)ÿ÷±Nq.­VFËéCóùŽ¡a›ßþf§£Õõ©eU?¸¡ø9ï¤O½*²šg¤Ýíf3k¨üèǸüe ¦“ÚhºjÊA/ŠTË©O©€CC ¦0QÙÁk^ñª¯ ̧µjPùh;–bϨm«jŸ¬)Wžõ‡¨kkT¡ŠYÆF„xËê™ ÈVí±œÑTÕFÂŽjloCùØÉVjÙ Žp­+¶ü÷<í)í^ÖþØežêp7ËÒãÅHÄðB~ºQc=¯Ú}u{n“iß@ꦀ>¶¸[jfËÇœÐò΃³“.i=‹Zêp±4u*ÝÖETÓO¦ÈËÙòŠ×ÁÞÿò6@ååp§75›Îqøâ’#ƒ:ZÓŽ‹¾Ï0‰.êß¿³F¯dž‚ÈÓâ&1UkóC4^²ÚÏZþàƒ!|7Õⶽ÷U)|Ñë_wKÆ3+8EváÏøtŽÊpwü¡á"¾¨!®öÈ9îs6ñ•P%¶—¦öEÒ­&Š™j[ ç·ÆÚ±}%±¿[Z1{:×.ŸØs_ÖîeEKâ,“gž•Í°f×ÛÔ¡ËÅä­ñdÂãÄ2¤·D.±ý>Vh+ÉÙȳÚí1GÙLÎ@W¾#¾Ó”릿õVð}ÿ«³Cë'<9³t컨¼šK×3Õ™«l^¨ØâË»‰êjÿtèœÒYv–wE¥2E…ÏPØ$³õ ©÷× l×8Œàuþzd¾þzŸ€r~šœiNow¤ba¤D6fØßî5¿Üë„»ÔÖµŸ¼ýÐi›sWÚÔ¦1_|OJZš ɧ(›ítñÞøFJÁ N¶„/<:ö¼e*•éň3¹ÐwÈ]Îp¥hœ)çøÇ#iH/™‡³Ä%ÂxM;’|s —ŠÇ]Þâ˜Ïü,zñçÉ_ƒS&?3’凉[`ó ÿœèr„¤nnþK|*³6ˆÝ)±Š.̨¿xêU7ù’ïÒʼn¯ç#O¹}KnÎ{ÕŸ5'Ç.³¯­§Øÿ6$9Iêæ¦S¬'º!kÌvóŒHïhúqÖ“þè¡ÐPäü&n$MõtQãeôÆ»ºÁíë5§X¡k'JEø䔢“O(™C–3ô&µËïæ¼A=Ï!“ºÚe{§ìÉV_;xëYÁ{wo}ñ¸¾‘KS’Fë:F*ÎòÜ·Ä/cI¶Â«8ÔߎZ¶–©Tã·§ùÐ[<‹Ó:QèÏXû<»í´†Wé'w5ÍVµâž?ëý×'ßÉ×gþ“m¤ÚâÑÀuMö„ðzd-¡JÿO,aÝÇ^òªSdFÿ¬m…¢ðNHU"¯ü˜‹ñlaΫ½hŒìX‹ÎÖý.­ýܯ¬¬Å×rKýÿ”¯eÎeb·%Î8fú2°»¬ÏñFÍÙ€€ŠdQ†ÅÑð$tö/AòO|¬¤øì¥xį]x¸VªzN¨WìMeIF¥ºD ؼ):¦Í¬È ý4jãÈMã §+«®Î>§ADÌ„'0Æh³Îïo–ÈtDbqD­±ÎfRlPþ‚-ŽÐB§ƒôckÈ÷²„ËšMºôïÑt…Í·º¦À ±ÃVL5 ù–ïΈ*šË§¯ÝB­åœO­ÆÐn(ÓÜ÷8K1‘Ô"Ѐ¸æÿËÁfØ@‘íôìÐE=N"nÂÇ÷ðÅÀtä«G¸ŽkûÊÐÿ ;DÑçþpâaB:P¹peë uÇ ±ìEèê^±i±ÕÛ0ŠÐ2-‰§´üì5ësBÃ’CeÒ>½é´ÿ¸O¼®«£*/£k×è>U=ù³i¯%pDI%”)q@’å‚Ïð¾Žzöíêôˆ+“=·Ln@òaÌU+Ó¯54Ù°Å6¬d\g#M2CÝÕÂ/ÇÏK©óI9'Aee”|´Q´ëô4öGßÔ™TÙÔFÙ8…Ù²†òÏTBˆEÕï_¬íð¸’B§¢ áìXbpUPíBð|p­Â¼"5[/‰2µª©hô€¬ïkVOTWPÖBŠ·löÕ«Ô,ÙhG”µiU—.2±/ò §çVƒ+$±ì˜Œ4ñt« ³-%µûÖÌgÿ8M qÛ±<*Sãqó.‘ÌÂôi’dN>k­CUGLgK,÷ðͱI‹ŒAô…”R¦Þ´Výh¸„uuÈ–"äÁÂK ­Q!!‘Ú”¿‘™o5QDòÃRMë2ÔÆZkò!cщú¥º”\·GUYRÇ“+qcÑPZ'ö~ÀüêÔVÞ•£jU)éÔU{PWo‚^ù5Xåå_m6ÉÒŽÈ&Ê È%svù²”¼J' Ób9°c“&ÕQ%Ùñœºµ\ÓLIKgߌÉKi ƒd™ÖÕUj{$e/#@WBrÔe‘I§‚P; fµ§gqvFÿ_' ßÄÑ$Q S±R!2ú´–l%¶Dh­Ü~¨ÏRWò&=Eè-¥´ªVdMV–‚·‰ÖžÝJoS¿ðÝø"^Ùx ?4î¯@ô*óêN³òmíOéN+QIÚ¾rs= h‘Õ-EP.+”Eu6µ>W>¥èØ"•/ÅíÅ<÷ÖÀ .wHx‡2cÉ6£$”¶³ W f{bt{.ä0Ó³: Ö|IÓ|Ÿâ8 t+¶W_aÉÌ|ß·9ŸSÉŽ4ÙB}—–Ó—»“2“209‚~ëw2âò·1þ728á"€wCä”39Uó:UNåì·ð£áÿ(øŠBØAG81Ns€1X;-˜ƒÃ·ƒ=‘&Ø/cؘf¸„—n…³ó‚1ÃæZ¸…!‚3Ï3˜ÄS\/liñÐS`Ë.F íæêDCôà×Tè; *½—?ÿ3)‘=þ3²˜Éˆ5úëøIç,êH°h6y‰XˆäŽŠP¨žÒ ‹6›Ú2ŽU™ ‹Ù XÍUiƒÆ£PtŽŸO‡øxOFµÕÓìBkpËU|àD"}Ë7ø"=âµGm°Gcåiô…¯ÍøìúqÚ¸Laï`GtlÍÏÕŽÊÌü¶qKpª.¶û®Ê?”KsÌE‰vFW‘‘“JcA5BoψQY³têJÿðCt€`"mõƒm¢øׯú´_ÿ¼ÇsÅ£uË —ˆ{2\#&d›w\‰wq!§÷¥4IëØ<Ŷd9zaR£ÎUö¾4]Õôßæ.±/r[+Ÿû· Áf%0}Ð,Öƒ%\vØR×@Ãä„rKNÏIT$øüèáW Ýe[ƒErúõ¼4‰ÛÌ2ËÊ,ÝORà±”yñ:±,[®¥aqÝæÄŽ+e—Yðɶvºi ãÐØ0– ñ¸û ¡ãä1(6?UÂ98£õ oqõÚ&Q£ d¤mO:Ytzš8ùSÃV˜Ö‰\ÔºbÆ.u±öìj@Zqš¨ÿŸ¶žU•IÙZ:Tl‘º©^ú»äp?îu¸–º% Ä©2šo¢…Ês°šb´º"Yð‘­ÖQGñ3/ñÌ~è}×J]g|ïÚ± åh]9—iŠ®Áïz¼nšÁ†÷­;µµÛ ’³†iîuf¡„©…±OªçT¢’&Ö$²uÏ ·ÐQ QÌ3ç«hÑ‘.Ë-W+sÛY ½o­-•qÑXõ©p•˜=õ—•ÔYe›og-³ìòÿÐ;×@7y}lJ²Y~2† ¥~mËCš•äf¥íÙ”×@ýJ›wʻƮlw¾ÑZ/Õ„8r§˜ Åê I˜ºÈ·sÿ{×¹ª[s©òϹ.ŸwvcÛ*åXÜúr°³0¾B2æw_gÃâxŽ5T1Z©†§ŽÇ…؆ÀS“™„bÆNévo§Æ·“vÈ5ÛÜ0oÈŸî*X%>)“¼1}¼èº<–¾<Êù 7ÉâŒ`8øáxø7.ÌiÎÍ™\ÌçÂ5ÞWÈcâÊÑXËÑØåà\èF¸ÏÅ|ÊsØÌÏœ&Ò|™pø…ý<<[5=÷Æ‘Ÿ|œÔÌÑ=Ø 0ˆÿ£»®›NÏYÙˆõ@f‚ROVi5¢µäÈ‘üÆMä¹<¢(½BÃPÂI\Ö$7cKr%hy©XÓk½–o]§ûøÂ5×Ce’Öÿk}˜_ô›4Èy«7 GÎCz–¢UVôØmØ{Ûd¿^-Û#G:'µºÅQ‹Zqk˜)W$U‘ȵ_[pktÙqÒ­ë±`£´_z¶hyG|¡¥ŸYšœÃe±?è°hW_”M¯X%`«NQIX·½Q$K•Z!|=ÓýºgY->ã‘×›¶ ¶—=´KQ·!kwÌ»'q“•ƒìi 1›­àÁá39ŒŒºÛ̱íuµ7œáLÚZÙØg[•EÌÂôŽEø ý, š\z´V­Õ»åe{ê©ÔY[­ÔV-윖ĬQ‘ÑJpÞÏGw?z^%èÿõ”¯e8h›¶#é®÷NšÝŸ^ÝÓuì¡ÌãšÞGvr•½³³[ëyïç]éùÝ„ּÀ¤ìÛô i>—€K=“<_Þž«lV¦ Ð#Tïþd¿MÞÑ’v´OÙði{žj[ŸªÎöŸ\9–qÿö³¹ö«qÿš=M{ºÔô֢Ϟ,ZK”§GQ}Éz^#í¶ -­{¼Þ«>ä§uR×·ô›úýg¹ÿê¡]Ü¿ÿñ\žÎ,¬d¹rÕ ìÝɼ-t£8Bx­Êê[LšäŠô˜"@8hP€@x±`A¸Xñ¢F8vÄqãD‘ÿH<‰2¥Ê•,[º| 3æK“,=Ž¤YóâI›+yvDésæO™%‰ÚSgI¥9q~tšr#NžA[š„ëÑ¢7•J]ª(P¦*¿r{ôêÖ²kÛº5Z±¢Ä¸tåÖÐòn\ z•‹ô­àÁ„e†-Œ8±âÅC;~ìø0äÉ”+[>©·`ß½êæÝŒwçæ£aJ¾ŒZðéÔ¬[gu ›õêØ´k³¾;´_ÏŸGcîk;¸íÙ‹O&n<¹KäÊ›;‡™¹3]é{q³Ôøóí‹™sÿn¼x¶ãË›§ÎÙ³îÒ×}ÿŽ~>þrùôM×ÿîý¾þÉ™y«ŸÞ|ïñ¶ß}ùÿɧVW]!wAŠh^‚OíDÖK &ä y 5TTA˜Ø‡Ž5Öa„—FQ¤×Btá…ši7Qn’hTU[‘u ˆ®IF’YI9¥#Z .µ–„žåR†v˜ˆËÙTäH%R¸ãPSÕÈeLNZ…%…Dž&d•‰ÉԈṓÌňjgÇf—( À"žI—'žèÑD"çŒ4â$ XDùØ“œã©hcQqµe£\VjgNmÖ©á™*}¢¥Z29i›™–Ú%§š…)M˜zÊŒó™š*­¢ºJ*ª©j›KvŠ•šŠØ«`ι’žE´lHÆh ¡ÿú䳜yF-Æ*¢v±!9³WWŠçk†?ìA ~_¬g›R®)…ðŸâÄùô‰e–Ñ{à–”¥¬ôÅï!Òr¨ZGº†ŽÿŽqÙËè$êNð)Ÿ$(«ç¦~St d(—G?}vÎhà›Mõ€ÓÿmP- ô®·µqŒŸøB(JÕõÔuŒ†««ÈE%rÓÝp°ú[ ‘‰Ãýp‰¿é-3†ÔÊõΆƒ&’¶Ò,ÞÎ¥4jò:ª¹ºõûôjæø†·¨µ¤:üYØÀè5<Žñ¯2åʉ舀ì!=£¿à¦²¹š¥ é"ËiÖUåÕoZ àIKåNT.´ë ]‘úYeÌ(ß,œX/çDÒ½ö®ô k»s7¯†õlꃥ#¥õT¢þ5g’Ðö(=!u”X -²vKÙûqñfÿlÝ@«›?Ó6ÌqÓ¥—síUÌÙÒ駭-wÃhÞ¯&ªEž®”›?C¥=¥(cÙب’'§k%lnÓ T:âõ»›^; ÙÍ®¶¦dL Ü]ÅÅ7iÞû¯P‡*Üèž*a`¬_¿ŠÏ™m·¸UM¨ÐšOφn(‹J¨üÂO¿ú‚Y‘vàÍWÄÝN±Ë_Äp¬ Ìì‡Z‚Áñqvv$V‚£8*qù³Äö:ñè4ˆÝzVËà@¯*D9nµœA4nÑÄÄÂ"  !ÒVœ*á¾qÌTn˜­Ø׮“ é<—¹Úá&.®–L§=wXA• ˆîÿQ{ÁüC£EÑytŽ­WMúq@ƒa&d<M_Ô§$µ¨ã³i3WϧN«qûêXóR²V¥©k`\/J×±~$¯1yk^[“Ãþµs\ilr&ûËVk³½THd?Û˜À¦9aSlËóÂDq,¡õxÌ)¯s½Åb4=Ñ{æ‹á #hµrBòëío§Ùd>t=á‹hu¶Q9Æôc¢Èmy^ñÜñ÷O-{Û¨-™Uœ3™˜hoû4Å GqI1¶bÉJÃ^Ô ð[^mÓÛ®Ø rK̼™F7à&†uÁ‰.?™à<^í†ÞÜfœâŸ¹I\:±6­â žÝÿêÇ4BL¸D§ j×ŪJsÙ¨µ9»˜Ôo“5‰)E2Ñw}r˜O˜£³å™\‡Nðêõ­FžCÁ¶e;Gláâ3å-Ý6À³êýSIV`Óuîó—) á¿Æl–a5Øä¦ÝƒÆœ!ÃîV fšîÍÄŽ²R×.þv*œ»vžõ«¹F{É“nô¥“ûï–&èÏ G©J¯Žß/Ö5Ïï‹·6ßi÷R÷ÜGxÄ'¹ÎLëÜÆ#˜èm`2I_z, yë>ëËâ´í¯¦=ˆ|5B‡¸iÖÛ{•]Û'&?ø¶OmøéJn 8úî}©Ö‡SŸO¬ú/½éŒÿrÚÓXïƒQÄÇ2ASÜ×j8Vú÷rÿGO^fVÒ$IÖ^4R‡'}!Ud|¶h%$|õ·WØ·h,7z&{òäpS"e‡!2#OoiF&rÖ9ÉfxfOø6eÒ³oYãluew:8MÃç‚W„î—IHÆ;VV#•xÍ7„‡bu7mÕi¯Au]8obxƒê%†gÈQÈS„Ù&Hh¨jn(p(‡sjtxvh†x¨‡{ˆ<|ølxY~(ˆƒø…„Xt~ˆzôu†ÈˆyX–W…´‘ˆŸfm™e8ňóÄgûm僚õt鶉TUpF(Gxyæçÿc´ƒ2èKØzªHFå—L‹ˆ‰Nøp’Š@ȉZ€þXçt²¨o`„UÔTP<5dÏ÷hø_ý%RÈ^çlãU3,ÕU·swrÑøs5W9*rÐw€ øŒN†4G~¡×‹+xeÏ[åøvÄyätö8to¸~ßG}P¸^…`6\¹X…Y•DSåzc†$=¨ÿC‚¿BWX_F%]Çwãyا€Çg8˜2å׎ñg|ú3`QH’!Ø‚G'ŽãxÇT'ˆAe8’ý~7xNcaF]Ùx]&ø’ù7‘äerRøoÓ—‹f> –=è{ü÷Žï%vàtÿ\LI[uŽ Ø’#H•Êcuà54¶ˆ{ßs…f–BN³cö~U3‰âç€6…<)]"T”^‡‘Eó”VrÜh„LøZ‰Ä‡|&¹3Â9¼BVo}ûØ•¨çCP)’`X•Ê†áX˜r¹“òV‡ÝÈ´sB˜Oàè€`d‹’¹dêG˜*3XãÇŽ ˜þeveù•åµE¿Sa\Ö08׌³)˜§é•çf‚´”6É1÷\õ×–FW—€‡tÔvázRBŒÔSšqˆ™œ9.eøŠav‰QÉqÆ•@G…÷¶×Ù„£8P¼˜o£¨#gTƒÕ$÷9L½‡&¡ø)ˆÿgææˆÌfhð)nhYx?‡h]¢8pº„×F ìt„FÉYø¹pÚhŒ)éž J4H•"'‰¬è¡¦¹‡Ë9¢mÈ{Ox”Ft¢™†‡&Ú¢1ªH0ŠK4ºŠ2Š£ƒh£³´£ûÑ£9 ¤²¤‰†?ì9¤ph¤eô‰*:†3Z‰®ØnØyHᦄÌhBŸ˜jÙŠ¸(“…rŠ k“˜”!©žû–Ÿ<”Œ“Å{{¡j)›%&"Þa;MÖ‰°5ŒWØŸJôžq*¡GÇ›áYˆ<—~Cyœ øqï&¦UŠmê…”“¾ù—³Ž¾cjlG¨s7•—9ED‰zf™°isƒšux”:ÿl•°Æ˜:›ßE2HJMYEE9t&Z«™ˆ f©«À¸¢Åa®ú›Þ‡‚S·yp¦dc§‘Y<ßµuVGy\˜ˆ­ê¬ž—Šd‰ŒÙÛI¬¹¡F“…PÚG.ÏÉsÙ*Òg^šø¡…&pþ·c (F[&šÐ¹™c‡«“º”ãšuxG¤¡Š\﵆þúEŸWs69°,Ù¡µ§ŒöÊ°«×w j?¿È—ñy–©R‘Rµ–“¢B6¬Ûh:|„:å:¡\J¯ÎHœ>£{M¹46±w‡°e˜1û~šI°}˜†¸™‘ì8z±j±Š§q Fû•¯Oú€#{{% ÿZžª¯¤è´ì7+Øú© z£ î(ª§—à ²S …"(FÔJ4HAÐÕœ GÁhšK?)¶¥Š±[+L ¬wù´c›}üš­æ2½ê¤Ëv¸Ri§ ‰žúµ`[°è*snŸ% ›ž¯øšjØE9gÕ¤„fô%^ŸkN´ú û¹8{š¦¹EþW?šÿ§È*¥0»¨ Ÿk\²™‚–Ø2+ œ d¡‘X¡¸Ê¾û§‹„t¨|Ä+½¢UGI*»²V®Kj½ûjpÚÝû†®¶½};rãk¾Ï¦½›”¾ñ±¾çë¾ûš¤í‹¢ïK¿²&¿¬Æ‡÷[¿û{ÿµŒÚ¤‡ë·Ô†¼ ê­<»ŠðJÅFšõ˜nšÀí6“ª—šÿ¦¿z‡Û¯#D»<¸¦ï4Hê¢òYo ¼¥–¾uºŒ˜§pÃø¦®;Mïù¦Ž¨ö¤{¹Š;©2Öq¥IjdÚ¨ª©êjÃòèªT©[À[C鲜úëx›ùH³¸©C±Jy›Ít·fÅv©fË…‰Ú¨ „ i.$To¶û«w‰Á{Æ×KŽæ˜µ˜ë˜$ iÃe—IHÚ¸\lg¬û‹V;c5¹}ÍÕÇ–2¬±È5j¹Wn7ë»® ±ƒìfh7‰×MÁ)ÕöüQ–mhf’¦²M—~j„Öì%-~XUE e³}Â%í·‹nI×ÐMغƒÒ2ñTÕr}y Í-ÍÑõìÈŠŠÛß›²£|ìÒÕ…€)Wa¨uÐÂé³/÷ʤ•Ñ6Cµ¼IØ¢ú¶NÌÿÞoÙ-‰©â:´ŸíÝxýdž*³Gχh«d<§iü»k\.\ýŸR§ÛÑ—ÐU‚Úšƒè´oÄ TéÌx!\vq{s½yáýßÙµp5â±¹¼[+È×ݳ»øDZœ¶m×Ú¦«pš Ï–‹“ÅåÉùÜ“ ù“Õ¹w(tÏ9Z¿y§‚]˜̼ÿ*Çî7F‰4–/)׋¬™ï‚•LÉaéÞ­[ñœäÞM´¸]”l[Õv{ÊÅãÌ|k£{È+®´ ˆÍ¯Úmá»C-~7 ’}ùÜ|.ÞŽåw­åÜÇ| šªþ&Æ­æ—KÈ&D%–ó­a×ÊÝ)-ÜÑ[r.Ðc ã\[Ð|yÿß8yqy‹‹š±e?¥~é)nª.*èmÎ7Á¥heÊzš*n³$¦›;üèèÈæ+7Z™.äK^¶ŽÓ Hª5 .QV ­ã¢œ™½ãUK"EýÀFŽ×TÌëº{ªíÇ8=¼ÚRÅE¢kOë ÕÓÎWWäg ¼çXÝà êÆ3ýâÊîÀP®D]¾kŽÆÒ&ÌïÊ;ÀtÚ·s»Šî}¼­¡ŽG¥½;Õ²>9¾?Þ ]J‰HÎ…Lß…Þ:ñ#¯Ê›ý×$ò¹½½"¯ï)ïò/ó1/ó3Oó5oó7ó9¯ó;Ïó=ïó??H®ÞMDô$lÄ,ôIß}þCÿô‹BD%LÀJOõ#/ôNõ;òpH]õ]/Ùn¬ºŸ;Êz«~&6dl~Gí);ºŽºZ%yÐô°{Æïõw¾loöZ=]¼M/÷ý­Õe€öœèÂS¥º qðÎÔŠ§z¿ÐxOùr¸ø—á‚LÔü£øe¿Èã‚ù ®øf«ž¿øº-¦ÿ«•ÏúEŠÆ£ïùGn·4Dïšú¡ùRçL¢Oø7N©Pq§ßúÇ/† œø¼ï4-A¯¿BED’?úigµy$|ÿ‚uÏ÷ªüßß…¬ Îݺ&x<÷·¯ÆÜŸ8`ø@ÌuVud3ýÆW?þù_ùø¯ÿýïÿˆ $XÐàA„ .dØÐáCˆ%N¤XÑâEŒ5näØÑãG!EŽ$YÒäBO~ ;freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/assets/images/dispatcher.svg000066400000000000000000000145411522352605200300210ustar00rootroot00000000000000 Thread 1 Thread 2 Thread 3 Thread 4 Request 1 Request 2 Request 3 Request 4 Request 5 Server core Thread Pool and request dispatcher Access-Request freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/assets/images/dual_nas_backup_server.svg000066400000000000000000001700371522352605200323770ustar00rootroot00000000000000 NAS NAS Internet One Two User Two User One dual_nas_backup_server_failover.svg000066400000000000000000001671211522352605200342070ustar00rootroot00000000000000freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/assets/images NAS NAS Internet One Two User One User Two dual_nas_backup_server_redundancy.svg000066400000000000000000000736551522352605200345440ustar00rootroot00000000000000freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/assets/images NAS NAS Internet One Two Copy freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/assets/images/dual_nas_load_balance.svg000066400000000000000000001730511522352605200321270ustar00rootroot00000000000000 NAS NAS NAS NAS One Two Proxies Server Pool freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/assets/images/eap-md5.svg000066400000000000000000000126411522352605200271220ustar00rootroot00000000000000 EAP-Success EAP-MD5 challenge EAP-Identity request EAP-Identity "bob" EAP-Start EAP-MD5 response EAP RADIUS + EAP-Message EAP client RADIUS server AP freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/assets/images/eap-ttls.svg000066400000000000000000000064341522352605200274260ustar00rootroot00000000000000 PAP, CHAP, MS-CHAP, etc. Carrier Protocol (PPP, EAPOL, RADIUS, Diameter, etc EAP TLS EAP-TTLS Diameter-style attributes EAP EAP-MD5, etc. freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/assets/images/login.svg000066400000000000000000000776001522352605200270100ustar00rootroot00000000000000 Internet NAS Server RADIUS PPP Username "bob" Password "bob" freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/assets/images/login_net_access.svg000066400000000000000000000765241522352605200312030ustar00rootroot00000000000000 Accessing the network Internet NAS Server freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/assets/images/login_ok.svg000066400000000000000000000776011522352605200275020ustar00rootroot00000000000000 Internet PPP NAS Server RADIUS Authentication OK IP 192.168.10.12 freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/assets/images/nas_backup_server.svg000066400000000000000000001101321522352605200313600ustar00rootroot00000000000000 NAS Internet Primary Backup freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/assets/images/nas_backup_server_failover.svg000066400000000000000000001100121522352605200332440ustar00rootroot00000000000000 NAS Internet Backup Primary freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/assets/images/peap_packet.svg000066400000000000000000000062421522352605200301460ustar00rootroot00000000000000 EAP-MSCHAPv2 (Microsoft) EAP-GTC (Cisco) Carrier Protocol (PPP, EAPOL, RADIUS, Diameter, etc EAP EAP-PEAP TLS (with modifications) EAP (with modifications) freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/assets/images/proxy.svg000066400000000000000000000652051522352605200270570ustar00rootroot00000000000000 NAS NAS Home Proxy Internet freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/assets/images/proxy_backup_server.svg000066400000000000000000000624561522352605200317770ustar00rootroot00000000000000 NAS Proxy Primary Backup Internet freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/assets/images/proxy_load_balance.svg000066400000000000000000000744551522352605200315320ustar00rootroot00000000000000 NAS Proxy Two One Three Internet freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/assets/images/radius_packet.svg000066400000000000000000000226501522352605200305110ustar00rootroot00000000000000 attr Code Id Length authentication vector data... len more data... attr len data... RADIUS packet header List of attributes freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/assets/images/request_files.svg000066400000000000000000000125571522352605200305520ustar00rootroot00000000000000 clients (clients.conf) hints huntgroups realms (proxy.conf) users Access-Accept Access-Request accept or reject the user, and respond with policy attributes check if the user is associated with an organization group users by NAS and NAS-Port check if the user has requested a specific protocol match request to a known client contains user, password, and requested policy match requests to server policy, and configure the reply freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/assets/images/request_handoff.svg000066400000000000000000000213211522352605200310420ustar00rootroot00000000000000 Request Request Request lock request queue pop a request unlock request queue process request Wait for semaphore Thread signal semaphore Receive a request push request onto queue lock request queue unlock request queue Server core freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/assets/images/request_processing.svg000066400000000000000000000072221522352605200316150ustar00rootroot00000000000000 Processing a request Accounting-Request Access-Request authorize authenticate pre-proxy post-proxy session preacct accounting pre-proxy post-proxy post-auth freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/assets/images/request_receive.svg000066400000000000000000000203221522352605200310570ustar00rootroot00000000000000 Is the request a valid RADIUS packet? Is the request from a known client? Is the request a duplicate? Do we already have a reply for that request? Should we re-send a proxied request? Are we currently processing the original? Add the request to the internal cache Give the request to a child to process Accounting-Request Access-Request Server freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/assets/images/server_schematic.svg000066400000000000000000000450231522352605200312200ustar00rootroot00000000000000 NAS NAS NAS Proxy Proxy thread thread thread thread preprocess chap suffix files eap sql authorize AP FreeRADIUS Server core waiting authenticate unix preprocess chap suffix files eap sql proxy to realm thread preprocess suffix files preacct accounting act_unique detail unix Home server authorize freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/assets/images/ttls_packet.svg000066400000000000000000000064131522352605200302070ustar00rootroot00000000000000 PAP, CHAP, MS-CHAP, etc. Carrier Protocol (PPP, EAPOL, RADIUS, Diameter, etc EAP TLS EAP-TTLS Diameter EAP EAP-MD5, etc. freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/nav.adoc000066400000000000000000000023301522352605200240100ustar00rootroot00000000000000* Tutorials ** xref:new_user.adoc[New User] ** xref:matching_users.adoc[Matching Users] ** xref:new_client.adoc[New Client] ** xref:accounting.adoc[Accounting] *** xref:simultaneous_use.adoc[Simultaneous Use] ** Unlang *** xref:unlang_update_blocks_and_conditions.adoc[Update blocks and conditions] *** xref:unlang_splitting_strings.adoc[Splitting strings] *** xref:unlang_policies.adoc[Policies] ** xref:proxy.adoc[Proxying] *** xref:proxy_receive.adoc[Proxy Receive] *** xref:proxy_failover.adoc[Proxy Fail-Over] *** xref:proxy_load_balance.adoc[Proxy Load-Balance] ** EAP *** xref:eap-md5.adoc[EAP-MD5] *** xref:eap-ttls.adoc[EAP-TTLS] *** xref:eap-peap.adoc[EAP-PEAP] *** xref:eap-tls.adoc[EAP-TLS] ** xref:sql.adoc[SQL] *** xref:sql_user.adoc[SQL Users] ** xref:variables.adoc[Variables] ** xref:dynamic-translation.adoc[Dynamic-Translation] ** xref:multiple_modules.adoc[Module instances] ** xref:autz-type.adoc[Autz-Type] ** xref:module_fail_over.adoc[Module-Fail-Over] ** xref:prepaid.adoc[Prepaid] ** xref:dictionary.adoc[Dictionary] ** xref:virtual.adoc[Virtual] ** xref:radmin.adoc[Radmin] // Copyright (C) 2025 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/pages/000077500000000000000000000000001522352605200234755ustar00rootroot00000000000000freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/pages/accounting.adoc000066400000000000000000000104601522352605200264600ustar00rootroot00000000000000= Accounting Requests *Goal*: To send the server accounting requests and to have the server log the accounting requests. *Time:* 20-30 minutes *Files:* - `/var/radacct/127.0.0.1/detail*` *Modules:* detail In addition to authorization and authentication, one of the primary roles of a RADIUS server is to record accounting information supplied by an NAS. In this exercise, you should create accounting requests to send to the server and see what the server does with those requests. This process simulates the actions taken by an NAS when a user logs in. Use the entry in the file from the exercise in xref:new_user.adoc[New User] for user "bob". You may create accounting packets by hand for this exercise, but we suggest that the follow test packets from the `exercises/packets` directory be used in this exercise: [source, bash] ----------------- bob-login-one.sh bob-acct-start.sh bob-acct-stop.sh ----------------- If you do create accounting packets by hand, then the attributes listed in the above scripts should be used as a guide. First, run the `bob-login-one.sh` script. Observe that the server has replied with an authentication accept to an authentication request for user "bob", who has logged in on a particular NAS port. If the server does not reply with an authentication accept, then check the attributes in the test packet and the file entry. You should now read the `man` pages for the `radwho` and `radlast` programs. Run each program in turn: [source, bash] --------- $ radwho $ radlast --------- Observe that both programs do not report user "bob" as being logged in. Now run the `bob-acct-start.sh` script, and observe the response of the server. You should see output containing lines similar to the following: ----------------------------------------------------------------------------------- (0) Received Accounting-Request packet from host 127.0.0.1 port 57470, id=35, length=53 (0) User-Name = 'bob' (0) Acct-Status-Type = Start (0) Acct-Session-Id = '01020304' (0) NAS-IP-Address = 127.0.0.1 (0) NAS-Port = 501 (0) # Executing section preacct from file /etc/raddb/sites-enabled/default (0) preacct { (0) [preprocess] = ok ----------------------------------------------------------------------------------- Other modules that should be referenced for "accounting" are the "preprocess", "suffix", "detail", and "sql" modules. We will work through the operation of these modules in a moment. Now, run the `radwho` and `radlast` programs again: [source, bash] --------- $ radwho $ radlast --------- Observe that both programs now see "bob" as being logged in. To tell the server that user "bob" has logged out, run the `bob-acct-stop.sh` script. Observe the server output, and then run `radwho` and `radlast` again. The `radwho` program should not display any logged-in users. The `radlast` program should now display both the last login time and the last logout time for user "bob". Now run the `bob-acct-stop.sh` program again. Observe how the server's output differs from the previous accounting stop packet. You should now read the `man` pages for the rlm_unix, rlm_radutmp, and rlm_unix modules, along with their configuration entries in `raddb/mods-available/radutmp` and `raddb/mods-available/unix`. In short, the "unix" module manages the database used by the `radlast` command. The "radutmp" module manages a separate database, which is used by the `radwho` command. The "detail" module simply logs every accounting request to a file in a simple textual format. == Questions 1. Why do accounting messages require less configuration of the server than authentication methods? 2. Why is the "detail" module useful? 3. Where is the "detail" file located? Why is the "detail" file in this location? Where is it configured? 4. What parts of the servers manage user session information? 5. What module other than "radutmp" can manage user session information? 6. Why is it useful to record which users are currently logged in? 7. What attributes that are found in the accounting request are not found in the authentication request? Why? 8. Which attributes are required to be in an accounting request? 9. What error message is produced on the second accounting stop, and why is it produced? // Copyright (C) 2021 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/pages/autz-type.adoc000066400000000000000000000034351522352605200262740ustar00rootroot00000000000000= Using the Autz-Type attribute *Goal:* To control which authorization modules are executed for an `Access-Request` *Time:* 10-20 minutes *Files:* - `etc/raddb/sites-available/default` - `etc/raddb/users` This exercise is a follow-up to the previous one in xref:multiple_modules.adoc[Multiple Modules], and it uses the `byname` and `bydate` modules configured there. Start off by deleting the old log files: [source, bash] ------------------------------------------------- $ rm -f /var/log/radius/radacct/byname/* $ rm -f !/var/log/radius/radacct/bydate/* ------------------------------------------------- Edit the file, and add the following text at the top: ---------------------------- DEFAULT Autz-Type := byname Fall-Through = 1 ---------------------------- In the `raddb/sites-available/default` file, edit the `authorize` section entries for the `byname` and `bydate` modules to be as follows: ---------------------- Autz-Type byname { byname } Autz-Type bydate { bydate } ---------------------- Start the server, and send it a test packet (e.g., `bob.sh`). Use the debug messages from the server to verify that only one of the modules is called. Look in the log directory, and verify the existence of the files and their contents, as follows: [source, bash] -------------------------------------------------- $ ls /var/log/radius/radacct/byname/ $ more /var/log/radius/radacct/byname/bob $ ls /var/log/radius/radacct/bydate/ -------------------------------------------------- [[autz-type-questions]] == Questions // Copyright (C) 2021 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. 1. Why is it useful to _not_ call certain modules for a request? 2. Why is it useful to control which modules get called for a request? freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/pages/dictionary.adoc000066400000000000000000000051151522352605200264740ustar00rootroot00000000000000= Custom Dictionaries and Attributes *Goal:* To understand how the dictionaries affect the server and to create a new vendor-specific dictionary with a number of custom attributes; also, to test those attributes in the server. *Time:* 20-30 minutes *File:* - usr/share/freeradius/dictionary.* *`man` page:* dictionary The dictionary files used by FreeRADIUS form the basis for mapping protocol numbers to humanly readable text. These dictionary files are ASCII and may be edited to add, delete, or update entries. For this exercise, you will create a custom dictionary and will send the attributes to the server using a RADIUS test client. You should first familiarize yourself with the `man` page for the "dictionary" file. You should create a file called `dictionary.test` in the appropriate directory and populate it with a "test" vendor, using a vendor ID of 123456. This dictionary file should be referenced from the main dictionary file. You should verify that the server starts successfully with the new dictionary file, even when the new dictionary is empty. You should now stop the server and add a number of vendor specific attributes to the "test" dictionary, as follows: .Vendor Specific Attributes to add |============================================ | Name | Number | Type | Lunch time | 1 | date | People to eat with | 2 | text string | Where to eat | 3 | IP address | What to eat | 4 | integer |============================================ .Enumerated values for "What to eat" to add |====================== | Name | Number | Salad | 1 | Bread | 2 | Dessert | 3 | Beans | 4 |====================== Once the attributes and values are added to the `dictionary.test` file, re-start the server. Using a RADIUS client, send the server an authentication request for user "bob", containing one of each attribute. Verify that the attributes are printed as names, not numbers. Edit the file, and update the entry for user "bob" to reply with the attributes and with four names for "people to eat with". Re-send the authentication request for user "bob", and verify that the access accept contains the expected attributes. [[dictionary-questions]] == Questions 1. What happens when the same attribute has multiple names, i.e., multiple names for one number? 2. Why are many of the attributes in other vendor specific dictionaries prefixed with the vendor name? 3. Why are vendor specific attributes useful? // Copyright (C) 2021 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/pages/dynamic-translation.adoc000066400000000000000000000121171522352605200303070ustar00rootroot00000000000000= Further dynamic translation *Goal:* To use dynamic translation of strings to perform inter-module references. *Time:* 20-35 minutes. *Files:* - `etc/raddb/radiusd.conf` - `etc/raddb/users` Run-time variables in the server may include more than simple references to attributes in packets. The server supports the ability to perform complex inter-module queries, which significantly extends its usefulness. In this exercise, we will work through a number of different examples of configuring inter-module calls. To start, open `raddb/mods-available/exec` and read the sample configuration for the `exec` module. Then, edit the users file to add the following entry at the top: ------------------------------------------------------------------------------- bob Password.Cleartext := "hello" Callback-Id = "%exec('/bin/echo', "Hello, there") ------------------------------------------------------------------------------- The `echo` program may be in `/usr/bin/echo`, depending on your local system. On many systems you can use the following command: [source, bash] ------------ $ which echo ------------ This will tell you the full pathname of the `echo` command. Use that pathname in the file entry. Start the server and send it a test packet for user `bob`. The debug output of the server should print messages similar to the following. ------------------------------------------------------------------------------- (0) files : users: Matched entry bob at line 1 Executing: /bin/echo Hello, there: Program returned code (0) and output 'Hello, there' (0) files : EXPAND %exec('/bin/echo', "Hello, there") (0) files : --> Hello, there (0) [files] = ok ------------------------------------------------------------------------------- These message indicate that the first entry in the file (at line 1) was used to match the incoming request. The `exec` xlat function was then used to perform the dynamic translation of the string, which resulted in a call to the `rlm_exec` module. That module called the `Exec-Program` function of the server to execute a program, and finally, the `exec` xlat function returned the string "Hello there". That text was then sent back to the RADIUS client in the `Callback-Id` attribute, which was not quoted above. // Copyright (C) 2021 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. Another dynamic translation string function is the `expr` module. It performs some simple mathematical operations. The following sample file entry demonstrates how to use the `expr` module. ------------------------------------------------------------------------------- bob Password.Cleartext := "hello" Session-Timeout = "%{60 * 60}" ------------------------------------------------------------------------------- Dynamically translated strings may also be used as "check items" to match requests coming in to the server. The following examples show how those strings (or run-time variables) may be used to both match a request and to configure dynamic responses. You should use the `bob-login-one.sh` script to send a request to match the first entry and should send another request with a different NAS-Port. ------------------------------------------------------------------------------- bob Password.Cleartext := "hello", NAS-Port == "%exec('/usr/bin/id', '-u')" Reply-Message = "Your port is very nice.", Session-Timeout = "%{60 * 60}" bob Password.Cleartext := "hello", NAS-Port != "%exec('/usr/bin/id', '-u')" Reply-Message = "Your port is less nice.", Session-Timeout = "%{60 * 2}" ------------------------------------------------------------------------------- The run-time variables may be nested, too. The following file entry demonstrates this nesting. ------------------------------------------------------------------------------- bob Password.Cleartext := "hello" Session-Timeout = "%{60 * %exec(/usr/bin/id -u})" ------------------------------------------------------------------------------- In this case, the user "bob" is given one minute of access time, multiplied by the value of the "UID" of the RADIUS server. == Further considerations Run-time variables allow inter-module calling. The administrator may perform LDAP queries and SQL queries to use database information in other modules. Unfortunately, the format of the string is module-dependent. This limitation comes from the fact that each module has its own syntax for database queries. The syntax for querying LDAP databases is different than the syntax for querying SQL database. The administrator should consult the `man` pages for the relevant module for more information on the syntax for run-time dynamic translation of strings. Another limitation is that the query string can be only approximately 250 characters long in the current version of the server. This limitation may be removed in a later version. == Questions 1. How would you perform an SQL query in a run-time variable, instead of executing a program? 2. Why is it useful for modules to be able to query information from other modules? 3. What is an example of conditional syntax for a run-time variable? freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/pages/eap-md5.adoc000066400000000000000000000050001522352605200255500ustar00rootroot00000000000000= Other protocols within RADIUS: EAP-MD5 *Goal:* To configure the server to use the EAP-MD5 authentication protocol and to send and receive test packets. *Time:* 10-15 minutes. *File:* - `etc/raddb/mods-available/eap` *Diagram:* image::eap-md5.svg[Fig. EAP-MD5] *Programs*: radtest For this exercise, your are assumed to have previously worked through and be familiar with the exercise in xref:new_user.adoc[New User] for user "bob". While RADIUS is an authentication protocol in its own right, other authentication protocols are also used in the network. One such protocol is the Extensible Authentication Protocol (EAP). It originally was designed to be used in PPP, but has been more widely used in recent deployments. EAP is a protocol that is intended to carry other authentication protocols. It does not carry authorization information like RADIUS, so it therefore has a more limited application. One of the most common uses for EAP is for wireless authentication. In this exercise, we will configure and test the EAP-MD5 sub-type of EAP. `raddb/mods-available/eap` has a configuration section for the `eap` module. The EAP sub-types are configured inside of that section. By default, the server ships with the EAP-MD5 module enabled, and with the EAP module initiating EAP-MD5 for all RADIUS requests containing EAP. You should now read the appropriate section of the `raddb/mods-available/eap` file, to verify that the `eap` module is configured and that the `md5` sub-module of the `eap` module is configured. The sample packet `eap-md5.sh` may now be used to test EAP-MD5 authentication. The server output should be examined to follow the EAP-MD5 authentication process, and that output should be compared to the schematic diagram image::eap-md5.svg[Fig. EAP-MD5] == Questions 1. In which of the following sections is the `eap` module used? authorize, authenticate, and accounting. 2. Which of those sections do not reference the `eap` module? Why? 3. What is the difference (if any) between the server output for this test and the diagram below? Why is there a difference? image::eap_md5.svg[Fig. EAP-MD5] 4. Why do we test EAP-MD5 before testing other EAP types? 5. How is the EAP protocol carried within a RADIUS packet? 6. Why is the Message-Authenticator attribute required when using EAP? 7. What security issues exist with EAP-MD5? 8. Why is EAP-MD5 disabled in newer operating systems? // Copyright (C) 2021 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/pages/eap-peap.adoc000066400000000000000000000064071522352605200260240ustar00rootroot00000000000000= EAP-PEAP: Tunneled authentication *Goal:* To configure the server to use the EAP-PEAP authentication protocol and to send and receive test packets. *Time:* 20-35 minutes. *File:* - `etc/raddb/mods-available/eap` *Diagram:* image::peap_packet.svg[Fig. PEAP Packet] When started with the `radiusd -X` command, the server automatically creates certificates for use with PEAP. In a normal installation, there should be little or no action required to enable PEAP. Start the server, and verify that the `peap` module was loaded and that the server is `Ready to process requests`. This exercise does not cover how to configure EAP-PEAP on the wireless client nor how to set up a wireless access point to perform EAP-PEAP. We suggest that you consults the documentation for your wireless client software for details on this process. For the initial testing of EAP-PEAP, we recommend using `EAP-MSCHAPv2` on the wireless client as the tunneled authentication protocol. You should check that the `mschap` module is configured in the `raddb/modules` directory. The `mschapv2` module performs EAP-MSCHAPv2 authentication and is contained in the `eap` section of the `raddb/eap.conf`. While these authentication methods are similar, they are not identical. Both modules need to be configured for EAP-PEAP to work. Test PEAP ``inner tunnel'' authentication via the following command: [source, bash] -------------------------------------------------------------- $ radtest -t mschap 127.0.0.1:18120 USER PASSWORD 0 testing123 -------------------------------------------------------------- Once the wireless client has been configured to enable EAP-PEAP, you should perform a test authentication to the server. If all goes well, the server, AP, and wireless client should exchange multiple RADIUS `Access-Request` and `Access-Challenge` packets. This process should take a few seconds, and you should wait until it is done. If all goes well, the final packet from the server should be an `Access-Accept` and should contain the `MS-MPPE-Recv-Key` and `MS-MPPE-Send-Key` attributes. Verify that the authentication succeeded by using the `ping` command to see if the wireless client now has network access. == Further Considerations Different wireless clients may implement different tunneled authentication protocols inside of EAP-PEAP. These clients may not be compatible with all RADIUS servers. FreeRADIUS has only been tested using EAP-MSCHAPv2 as the tunneled authentication protocol. Other protocols may require source code changes to work. If there are issues getting EAP-PEAP to work on Windows, the following registry setting may be useful ------------------------------------------------------------------ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASTLS\EnableTracing ------------------------------------------------------------------ Set the above key to value ``1''. A file `RASTLS.LOG` will be created and will contain the requested tracing information. == Questions 1. How does EAP-PEAP compare with EAP-TTLS? 2. What authentication protocols may be carried inside of the TLS tunnel for EAP-PEAP? 3. Would you use EAP-PEAP in a large deployment? If so, why? If not, why not? // Copyright (C) 2021 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/pages/eap-tls.adoc000066400000000000000000000110731522352605200256740ustar00rootroot00000000000000= EAP-TLS: Certificate-based authentication *Goal:* To configure the server to use the EAP-TLS authentication protocol and to send and receive test packets. *Time:* 20-35 minutes. *Files:* - `etc/raddb/mods-available/eap` - `scripts/certs.sh` - `etc/raddb/certs/` EAP-TLS is an authentication protocol that uses a TLS session, along with client and server certificates, to authenticate a user. You should now verify that the `rlm_eap_tls` module was built and installed by executing: [source, bash] -------------------------------------- $ ls -l usr/lib64/freeradius/rlm_eap* -------------------------------------- Use the directory where the FreeRADIUS libraries were installed. You should see not only files like `rlm_eap.so`, but also `rlm_eap_md5.so` and `rlm_eap_tls.so`. If you do not see those files, you will have to install them now. If necessary, you may have to re-build the server, as follows: [source, bash] --------------------------------------------------------------- $ ./configure --prefix=$HOME/freeradius/ \ --with-openssl-include-dir=/usr/local/ssl/include \ --with-openssl-lib-dir=/usr/local/ssl/lib $ make $ make install --------------------------------------------------------------- This exercise has insufficient room to describe how to debug any configuration, build, or installation problems with the `rlm_eap_tls` module. For the remainder of this exercise, we will assume that the driver is installed in the appropriate library directory. By default, the server creates a set of test certificates inside of the `raddb` directory, called `certs`. This directory contains sample server and client certificates, along with a demonstration certificate authority. These certificates may be used for this exercise, but should not be used in any live deployment of the server. You now edit the `etc/raddb/mods-available/eap` file to enable the `tls`. You should also set the configuration entry `default_eap_type` to `tls`. Start the server and verify that the `tls` module was loaded and that the server is `Ready to process requests`. This exercise does not cover how to configure EAP-TLS on the wireless client, nor how to set up a wireless access point to perform EAP-TLS. We suggest that the you consult the documentation for your wireless client software for details on this process. The wireless client will require the client certificate from the `raddb/certs` directory. Once the wireless client has been configured to enable EAP-TLS, you should perform a test authentication to the server. If all goes well, the server, AP, and wireless client should exchange multiple RADIUS `Access-Request` and `Access-Challenge` packets. This process should take a few seconds, and you should wait until it is done. If all goes well, the final packet from the server should be an `Access-Accept` and should contain the `MS-MPPE-Recv-Key` and `MS-MPPE-Send-Key` attributes. Verify that the authentication succeeded by using the `ping` command to see if the wireless client now has network access. == Further considerations EAP-TLS is an authentication protocol and nothing more. As such, the wireless client will still need to obtain an IP address. This address may be configured statically, or it may be obtained through DHCP. A benefit of EAP-TLS over EAP-MD5 is that it supports the creation of dynamic WEP keys. These keys are more secure than statically configured WEP keys and do not require administrator interaction to configure them. However, they are not perfectly secure, and we recommend that the server be configured to send a `Session-Timeout` attribute in the RADIUS `Access-Accept` packet in order to force the user to re-authenticate periodically, which will create new dynamic WEP keys. An issue with EAP-TLS is that it requires a client certificate. For secure authentication that does not require client certificates, see the EAP-TTLS and EAP-PEAP protocols. Configuring the wireless client (usually a laptop or notebook computer) to perform EAP-TLS may be difficult. Windows (since Windows XP) ships with an EAP-PEAP client, which may influence any decision about which wireless authentication protocol to use. == Questions 1. What other benefits does EAP-TLS have over EAP-MD5? 2. What happens to the user's password when they use EAP-TLS? 3. Would you use EAP-TLS in a large deployment? If so, why? If not, why not? 4. What is the purpose of the `MS-MPPE-Recv-Key` and `MS-MPPE-Send-Key` attributes in the final `Access-Accept` packet? // Copyright (C) 2021 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/pages/eap-ttls.adoc000066400000000000000000000034231522352605200260600ustar00rootroot00000000000000= EAP-TTLS: Tunneled authentication *Goal:* To configure the server to use the EAP-TTLS authentication protocol and to send and receive test packets. *Time:* 20-35 minutes. *File:* - `etc/raddb/sites-available/default` *Diagram:* image::eap-ttls.svg[Fig. TTLS Packet] During installation the build system automatically creates certificates for use with TTLS. In a normal installation, there should be little or no action required to enable TTLS. This exercise does not cover how to configure EAP-TTLS on the wireless client nor how to set up a wireless access point to perform EAP-TTLS. We suggest that you consult the documentation for your wireless client software for details on this process. For the initial testing of EAP-TTLS, we recommend using `PAP` on the wireless client as the tunneled authentication protocol. Once the wireless client has been configured to enable EAP-TTLS, you should perform a test authentication to the server. If all goes well, the server, AP, and wireless client should exchange multiple RADIUS `Access-Request` and `Access-Challenge` packets. This process should take a few seconds, and you should wait until it is done. If all goes well, the final packet from the server should be an `Access-Accept` and should contain the `MS-MPPE-Recv-Key` and `MS-MPPE-Send-Key` attributes. Verify that the authentication succeeded by using the `ping` command to see if the wireless client now has network access. == Questions 1. How is EAP-TTLS easier to use than EAP-TLS? 2. What authentication protocols may be carried inside of the TLS tunnel for EAP-TTLS? 3. Would you use EAP-TTLS in a large deployment? If so, why? If not, why not? // Copyright (C) 2021 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/pages/failover.adoc000066400000000000000000000352621522352605200261440ustar00rootroot00000000000000= Configurable Module Fail Over Before configurable module failover, we had this kind of entry in "radiusd.conf":: ---- authorize { preprocess files } ---- This entry instructed the "authorize" section to first process the request through the "preprocess" module, and if that returned success, to process it through "files" module. If that sequence returned success, then the "authorize" stage itself would then return success. Processing was strictly linear and if one module failed, the whole section would fail immediately. Configurable failover provides more flexibility. It takes advantage of the tree structure of radiusd.conf to support a configuration language that allows you to "group" modules that should work together in ways other than simple lists. You can control the flow of any stage (e.g. "authorize") to fit your needs, without touching C code, just by altering radiusd.conf. This configurable fail-over has a convenient short-hand, too. Administrators commonly want to say things like "try SQL1, if it's down, try SQL2, otherwise drop the request." For example:: ---- modules { sql sql1 { # configuration to connect to SQL database one } sql sql2 { # configuration to connect to SQL database two } always handled { rcode = handled } } # Handle accounting packets accounting { # always log to detail, stopping if it fails detail redundant { # try module sql1 sql1 # if that's down, try module sql2 sql2 # otherwise drop the request as # it's been "handled" by the "always" # module (see doc/rlm_always) handled } } ---- The "redundant" section is a configuration directive which tells the server to process the second module if the first one fails. Any number of modules can be listed in a "redundant" section. The server will process each in turn, until one of the modules succeeds. It will then stop processing the "redundant" list. == Rewriting results for single modules Normally, when a module fails, the entire section ("authorize", "accounting", etc.) stops being processed. In some cases, we may want to permit "soft failures". That is, we may want to tell the server that it is "ok" for a module to fail, and that the failure should not be treated as a fatal error. In this case, the module is treated as a "section", rather than just as a single line in "radiusd.conf". The configuration entries for that section are taken from the "configurable fail-over" code, and not from the configuration information for that module. For example, the "detail" module normally returns "fail" if it is unable to write its information to the "detail" file. As a test, we can configure the server so that it continues processing the request, even if the "detail" module fails. The following example shows how:: ---- # Handle accounting packets accounting { detail { fail = 1 } redundant { sql1 sql2 handled } } ---- The "fail = 1" entry tells the server to remember the "fail" code, with priority "1". The normal configuration is "fail = return", which means "if the detail module fails, stop processing the accounting section". == Fail-over configuration entries Modules normally return on of the following codes as their result: [options="header"] [cols="30%,70%"] |===== | Code | Meaning | notfound | the user was not found | noop | the module did nothing | ok | the module succeeded | updated | the module updated information in the request | fail | the module failed | reject | the module rejected the user | userlock | the user was locked out | invalid | the user's configuration entry was invalid | handled | the module has done everything to handle the request |===== In a configurable fail-over section, each of these codes may be listed, with a value. If the code is not listed, or a configurable fail-over section is not defined, then values that make sense for the requested "group" (group, redundant, load-balance, etc) are used. The special code "default" can be used to set all return codes to the specified value. This value will be used with a lower priority than ones that are explicitly set. The values for each code may be one of the following: [options="header"] [cols="30%,70%"] |===== | Value | Meaning | | Priority for this return code. | return | Stop processing this configurable fail-over list. | reject | Stop processing this configurable fail-over list and immediately return a reject. |===== The used for a value may be any decimal number between 1 and 99999. The number is used when processing a list of modules, to determine which code is returned from the list. For example, if "module1" returns "fail" with priority "1", and a later "module2" returns "ok" with priority "3", the return code from the list of modules will be "ok", because it has higher priority than "fail". This configurability allows the administrator to permit some modules to fail, so long as a later module succeeds. == More Complex Configurations The "authorize" section is normally a list of module names. We can create sub-lists by using the section name "group". The "redundant" section above is just a short-hand for "group", with a set of default return codes, which are different than the normal "stop processing the list on failure". For example, we can configure two detail modules, and allow either to fail, so long as one of them succeeds. ---- # Handle accounting packets accounting { group { detail1 { fail = 1 # remember "fail" with priority 1 ok = return # if we succeed, don't do "detail2" } detail2 { fail = 1 # remember "fail" with priority 1 ok = return # if we succeed, return "ok" # if "detail1" returned "fail" } } # returns "fail" only if BOTH modules returned "fail" redundant { sql1 sql2 handled } } ---- This configuration says: - Log to "detail1", and stop processing the "group" list if "detail1" returned OK. - If "detail1" returned "fail", then continue, but remember the "fail" code, with priority 1. - If "detail2" fails, then remember "fail" with priority 1. - If "detail2" returned "ok", return "ok" from the "group". The return code from the "group" is the return code which was either forced to return (e.g. "ok" for "detail1"), or the highest priority return code found by processing the list. This process can be extended to any number of modules listed in a "group" section. == More Complex Configuration using "if" and "else" As of version 2.0, the server allows "if"-style checking in the configuration sections. The section is still processed as a list, so there is no looping or "goto" support. But by using "if", the administrator can have branching paths of execution, where none was possible before. The "if" syntax added in 2.0.0-pre0 has been completely re-written in 2.0.0-pre2, to add major new functionality. Documentation will be updated later... == Virtual Modules Some configurations may require using the same list of modules, in the same order, in multiple sections. For those systems, the configuration can be simplified through the use of "virtual" modules. These modules are configured as named sub-sections of the "instantiate" section, as follows:: ---- instantiate { ... redundant sql1_or_2 { sql1 sql2 } } ---- The name "sql1_or_2" can then be used in any other section, such as "authorize" or "accounting". The result will be exactly as if that section was placed at the location of the "sql1_or_2" reference. These virtual modules are full-fledged objects in and of themselves. One virtual module can refer to another virtual module, and they can contain "if" conditions, or any other configuration permitted in a section. == Redundancy and Load-Balancing See load balancing for information on simple redundancy (fail-over) and load balancing. == The Gory Details The fundamental object is called a MODCALLABLE, because it is something that can be passed a specific radius request and returns one of the RLM_MODULE_* results. It is a function - if you can accept the fact that pieces of radiusd.conf are functions. There are two kinds of MODCALLABLEs: GROUPs and SINGLEs. A SINGLE is a reference to a module instance that was set up in the modules{} section of radiusd.conf, like "preprocess" or "sql1". When a SINGLE is called, the corresponding function in the rlm is invoked, and whichever RLM_MODULE_* it returns becomes the RESULT of the SINGLE. A GROUP is a section of radiusd.conf that includes some MODCALLABLEs. Examples of GROUPs above include "authorize{...}", which implements the C function module_authorize, and "redundant{...}", which contains two SINGLEs that refer to a couple of redundant databases. Note that a GROUP can contain other GROUPs - "Auth-Type SQL{...}" is also a GROUP, which implements the C function module_authenticate when Auth-Type is set to SQL. Now here's the fun part - what happens when a GROUP is called? It simply runs through all of its children in order, and calls each one, whether it is another GROUP or a SINGLE. It then looks at the RESULT of that child, and takes some ACTION, which is basically either "return that RESULT immediately" or "Keep going". In the first example, any "bad" RESULT from the preprocess module causes an immediate return, and any "good" RESULT causes the authorize{...} GROUP to proceed to the files module. We can see the exact rules by writing them out the long way:: ---- authorize { preprocess { notfound = 1 noop = 2 ok = 3 updated = 4 fail = return reject = return userlock = return invalid = return handled = return } files { notfound = 1 noop = 2 ok = 3 updated = 4 fail = return reject = return userlock = return invalid = return handled = return } } ---- This is the same as the first example, with the behavior explicitly spelled out. Each SINGLE becomes its own section, containing a list of RESULTs that it may return and what ACTION should follow from them. So preprocess is called, and if it returns for example RLM_MODULE_REJECT, then the reject=return rule is applied, and the authorize{...} GROUP itself immediately returns RLM_MODULE_REJECT. If preprocess returns RLM_MODULE_NOOP, the corresponding ACTION is "2". An integer ACTION serves two purposes - first, it tells the parent GROUP to go on to the next module. Second, it is a hint as to how desirable this RESULT is as a candidate for the GROUP's own RESULT. So files is called... suppose it returns RLM_MODULE_NOTFOUND. The ACTION for notfound inside the files{...} block is "1". We have now reached the end of the authorize{...} GROUP and we look at the RESULTs we accumulated along the way - there is a noop with preference level 2, and a notfound with preference level 1, so the authorize{...} GROUP as a whole returns RLM_MODULE_NOOP, which makes sense because to say the user was not found at all would be a lie, since preprocess apparently found him, or else it would have returned RLM_MODULE_NOTFOUND too. We could use the "default" code to simplify the above example a little. The following two configurations are identical:: ---- files { notfound = 1 noop = 2 ok = 3 updated = 4 default = return } ---- When putting the "default" first, later definitions over-ride it's return code:: ---- files { default = return notfound = 1 noop = 2 ok = 3 updated = 4 } ---- [Take a deep breath - the worst is over] That RESULT preference/desirability stuff is pretty complex, but my hope is that it will be complex enough to handle the needs of everyone's real-world imperfect systems, while staying out of sight most of the time since the defaults will be right for the most common configurations. So where does redundant{...} fit in with all that? Well, redundant{...} is simply a group that changes the default ACTIONs to something like:: ---- fail = 1 everythingelse = return ---- so that when one module fails, we keep trying until we find one that doesn't fail, then return whatever it returned. And at the end, if they all failed, the redundant GROUP as a whole returns RLM_MODULE_FAIL, just as you'd want it to (I hope). There are two other kinds of grouping: group{...} which does not have any specialized default ACTIONs, and append{...}, which should be used when you have separate but similarly structured databases that are guaranteed not to overlap. That's all that really needs to be said. But now a few random notes: * GROUPs may have RESULT=ACTION specifiers too! It would look like this: ---- authorize { preprocess redundant { sql1 sql2 notfound = return } files } ---- which would prevent rlm_files from being called if neither of the SQL instances could find the user. * redundant{...} and append{...} are just shortcuts. You could write: ---- group { sql1 { fail = 1 notfound = 2 noop = return ok = return updated = return reject = return userlock = return invalid = return handled = return } sql2 { fail = 1 notfound = 2 noop = return ok = return updated = return reject = return userlock = return invalid = return handled = return } } ---- instead of ---- redundant { sql1 sql2 } ---- but the latter is just a whole lot easier to read. * "authenticate{...}" itself is not a GROUP, even though it contains a list of Auth-Type GROUPs, because its semantics are totally different - it uses Auth-Type to decide which of its members to call, and their order is irrelevant. * The default rules are context-sensitive - for authorize, the defaults are what you saw above - notfound, noop, ok, and updated are considered success, and anything else has an ACTION of "return". For authenticate, the default is to return on success *or* reject, and only try the second and following items if the first one fails. You can read all the default ACTIONs in modcall.c (int defaultactions[][][]), or just trust me. They do the right thing. * There are some rules that can't be implemented in this language - things like "notfound = 1-reject", "noop = 2-ok", "ok = 3-ok", etc. But I don't feel justified adding that complexity in the first draft. There are already enough things here that may never see real-world usage. Like append{...} == See Also * load balancing // Copyright (C) 2025 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/pages/final_group_project.adoc000066400000000000000000000172221522352605200303640ustar00rootroot00000000000000= Group Project - Simulating a production service *Goal:* To create a simulated, federated, production service *Time:* 2-3 hours This task is split into multiple sections. If working with an instructor you should ask for your configuration file to be validated by the instructor after each section is complete. For this task you will need at least two participants. == Preparation Each participant should decide on the following: * A realm e.g. `example.com`, that their RADIUS server will respond to request for the realm must be unique within the group. This will be referred to as `your_realm` in the rest of the text. * A shared secret for the realm `your_secret`. * A backend module (`your_module`) to use to authenticate their users. Again, this should be unique within the group. Options are: + -- ** `files` ** `ldap` ** `redis` ** `rest` ** `sql` -- + For everything except `files` it's recommended to pick a module where you're familiar with the backend protocol. * A set of credentials (`your_user`, `your_password`). These should not be sensitive credentials as they will be seen by the rest of the group. Each user should send the following information to the instructor or place it in a shared document: - `your_realm` - `your_secret` - `your_ip` (the public IP address of your test machine) - `your_module` - `your_user` - `your_password` For local preparation, you should ensure that the following sections have no content: - The `recv Access-Request { ... }` or `authorize { ... }` section of `/etc/raddb/sites-available/default`. - The `send Access-Accept { ... }` or `post-auth { ... }` section of `/etc/raddb/sites-available/default`. _Clear the `post-auth-type reject { ...}` section if present but do not remove_. - The `send Access-Reject { ... }` section of `/etc/raddb/sites-available/default`. After completing each of the sections below, you should check that the configuration you've produced is valid (radiusd -XC), and if possible, test the functionality you've configured using `radtest` or `radclient`/ == Proxying *Goal:* To simulate federated access, by configuring proxy destinations for multiple upstream home servers. *Files:* - xref:reference:raddb/mods-available/radius.adoc[`etc/raddb/mods-available/radius`] - xref:reference:raddb/sites-available/default.adoc[`etc/raddb/sites-available/default`] (optionally) - xref:reference:raddb/mods-available/linelog.adoc[`etc/raddb/mods-available/linelog`] (optionally) *Time:* 20-30 minutes For each participant in the group, create a realm with a single home server. The information for the realm should come from the shared document, and should use the realm name, the secret, and the ip address supplied by the participant. For `your_realm`, you should create a realm which authenticates users locally on your server. Liveliness checks should be performed with 'status-server'. All remote realms should be configured with "nostrip", so the full username is proxied. The local realm should not have "nostrip" set. === Bonus tasks * When proxied requests fail, create a linelog message containing the date, the username and the destination realm. * Log all outbound packets to the proxy. * Log all inbound packets from the proxy. * For each home server. ** Set the check interval to three seconds. ** Set the check timeout to three seconds. ** Set the "number of answers until alive" to three answers. == Clients *Goal:* Allow incoming requests from other servers. *Files:* - xref:reference:raddb/clients.conf.adoc[`etc/raddb/clients.conf`] *Time*: 15-20 minutes Add client entries for each of the other participants server's, using the participant's name as the client name, the ip of their server as `ipaddr` and `your_secret` as the secret. [WARNING] ==== The secret used for the client _must_ be _your_ secret, not the other participants secret. The other participant will be configuring your secret in the home server definition to send requests to your home server. The client and home server definitions must match. ==== == Loading credentials *Goal:* Setup the backend, and populate it with credentials. *Time:* 10-60 minutes For your chosen backend: - Install any necessary packages - Load any FreeRADIUS specific schemas After the backend has bee setup insert your own credentials, and those for every other participant in the group, into your backend datastore. If the datastore provides no authentication method (`sql`, `redis`), you should use the value of `Stripped-User-Name` as the key, and when the user attempts to login, retrieve the user's password and store it in `control.Password.Cleartext`. == Authorization *Goal:* Retrieve user information from a backend datastore. *Files:* //- xref:reference:raddb/mods-available/suffix.adoc[`etc/raddb/mods-available/suffix`] - xref:reference:raddb/mods-available/files.adoc[`etc/raddb/mods-available/files`] - `etc/raddb/mods-config/files/authorize` - xref:reference:raddb/mods-available/ldap.adoc[`etc/raddb/mods-available/ldap`] - xref:reference:raddb/mods-available/redis.adoc[`etc/raddb/mods-available/redis`] - xref:reference:raddb/mods-available/rest.adoc[`etc/raddb/mods-available/rest`] - xref:reference:raddb/mods-available/sql.adoc[`etc/raddb/mods-available/sql`] *Time:* 20-60 minutes First, in the `recv Access-Request { ... }` or `authorize { ... }` section of of an appropriate virtual server, call the suffix module. If, after the suffix module has returned, the `control.Proxy-To-Realm` attribute is set, use the `return` keyword to exit from the section. This prevents local modules being called, when we know the request will be handled by a remote proxy. [source,unlang] ---- suffix if (control.Proxy-To-Realm) { return } ---- The following backend modules have an built in authorization method: - `files` - `ldap` - `rest` - `sql` The redis module has a string expansion %redis() which can be used to retrieve a single value from the datastore. Call the backend module's authorize method (or run an appropriate expansion) to determine if the authenticating user exists in the datastore. If the user does exist, and your module has an authenticate method (`ldap`, `rest`), set `control.Auth-Type` to an appropriate value. If the backend module does not have an authenticate method (`redis`, `files`, `sql`), you should ensure the "known good" copy of the user's password is set in `control.Password.Cleartext` and then call the pap module. === Bonus tasks - If the user was `notfound`, i.e. the user is local, log the fact the user was not found, along with the username, date and client IP address. == Authentication *Goal:* Authenticate a user. *Time:* 20-30 minutes For `ldap` and `rest` add or uncomment an appropriate `Auth-Type` section. For other backend modules, ensure the PAP module's `Auth-Type` section is uncommented. Run `radtest` or `radclient`, with credentials: `@` and `your_password`. You should receive an Access-Accept. === Bonus tasks - If the user was accepted, log the date, username, and client ip address. - If the user was rejected, log the date, username, and client ip address. == Remote-Authentication *Goal:* Verify all participants have configured their RADIUS services correctly. *Time:* 20+ minutes Check with the other participants to see how much of the exercise they have completed. If a participant has a working RADIUS server, send request with `@` and `your_password`, and verify that their server responds with an Access-Accept. If their server does not respond with an Access-Accept, work with the other participant to debug the issue. // Copyright (C) 2021 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/pages/matching_users.adoc000066400000000000000000000052441522352605200273450ustar00rootroot00000000000000= Matching entries in the users file *Goal:* To configure multiple entries for a user in the "users" file and to validate the server's configuration by sending test packets to exercise the new entries. *Time:* 30-45 minutes. Now that we have verified that we can add a simple entry to the file, we will try more complex configurations. In this exercise, we will add three configuration entries for a user named "bob" with clear-text password "hello". The three entries are related as follows: * The first will configure user "bob" with password "hello". It will configure a reply message in an appropriate attribute. This configuration entry will cause the server to continue processing the file. * The second entry will configure user "bob" and will match only when "bob" is asking to use PPP. The configuration entry should add the appropriate attributes to the reply, to allow "bob" to use PPP and to assign him the IP address 192.168.10.12. This entry should also cause the server to continue processing the file. * The last entry will configure any user asking for "framed" service, and will assign them a default route of 192.168.10.1 with netmask of 255.255.255.0. We suggest that you approach the problem by configuring each of the three entries in isolation. That is, add one entry, then create and send test packets until the server responds with the attributes you expect. Then, comment out the first entry and repeat the process for the second entry. Do the same for the third entry. Once all entries work in isolation, uncomment the first two and verify that the combination of entries behaves as expected. Test the server with username "bob" and password "hello". Use the debug output of the server to see which entries in the file were matched. You may use `radclient` or the `bob.sh` script to send the packets. In that case, save the packets into a file, and use the "-f" parameter to radclient to tell it which file to read. Perform other authentication tests, adding the appropriate attributes to the request sent by the RADIUS client. Continue until you have packets that will match: * entries 1 and 2, but not 3. * entries 1 and 3, but not 2. * entries 1, 2, and 3. Save copies of the packets. == Questions 1. What is the difference between the Framed-Route and Framed-Routing Attributes? 2. What is the Framed-IP-Netmask attribute used for? 3. What are potential pitfalls with the entry 2? That is, the entry meets the requirements, but do the requirements fit the needs of the network? 4. How does this kind of simple configuration scale to many users? // Copyright (C) 2021 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/pages/module_fail_over.adoc000066400000000000000000000076651522352605200276560ustar00rootroot00000000000000= Module Fail-Over *Goal:* To configure the server to use a "backup" module if a "primary" module fails. *Time:* 15-25 minutes *Files:* - `etc/raddb/mods-available/detail` - `usr/share/doc/freeradius*/configurable_failover` - `/var/log/radius/radacct/detail1` - `/var/log/radius/radacct/detail2` When the server uses an external database to find user authentication information or to log accounting requests, that database may sometimes fail temporarily. This situation is similar to the situation seen in the exercise in xref:proxy_failover.adoc[Proxy Failover], where proxied requests "fail-over" to a backup RADIUS server when the primary RADIUS server does not respond. In this exercise, we will configure the server to use two "databases" (here, detail files) for recording accounting data. We will simulate the failure of one database by changing the file permissions on the first detail file, and we will verify that accounting requests are logged to the second detail file. The first step is to configure the server to have two instances of the `detail` module. The following information should be added to the `etc/raddb/mods-available/detail` file: -------------------------------------------------- detail detail1 { filename = ${radacctdir}/detail1 permissions = 0600 } detail detail2 { filename = ${radacctdir}/detail2 permissions = 0600 } -------------------------------------------------- In the file `configurable_failover` in the documentation directory, there is a section titled "More Complex Configurations". This section contains a sample entry for the "accounting" section of `etc/raddb/sites-available/default`. The sample entry is a "group" with configurable fail-over between two modules named `detail1` and `detail2`. Copy the "group" section to the start of the `accounting` section in your `etc/raddb/sites-available/default` file. Now start the server and verify that it is `Ready to process requests.` Send the server a sample accounting packet (`bob-acct-start.sh`). Verify that the client receives an accounting response packet and that the server is using the `detail1` module to log the request. Verify that the `detail1` file contains the accounting request by examining it: [source, bash] ----------------------------------------------- $ more /var/log/radius/radacct/detail1 ----------------------------------------------- Also, verify that the `detail2` module is not referenced in the debugging messages of the server when the request is processed. Check that the `detail2` file does not exist: [source, bash] --------------------------------------------- $ ls /var/log/radius/radacct/detail2 --------------------------------------------- The command should fail with an error like "file not found." Now, simulate a database failure by changing the permissions on the file so that the server may not access it: [source, bash] ---------------------------------------------------- $ chmod a-w /var/log/radius/radacct/detail1 ---------------------------------------------------- Send the server another accounting packet ( `bob-acct-stop.sh`). Verify that the client receives an accounting response packet, that the `detail1` module fails, and that the server is using the `detail2` module to log the request. Verify that the `detail1` file does not contain the accounting request by examining it: [source, bash] ----------------------------------------------- $ more /var/log/radius/radacct/detail1 ----------------------------------------------- Verify that the `detail2` file exists, and that it contains the accounting request: [source, bash] ----------------------------------------------- $ more /var/log/radius/radacct/detail2 ----------------------------------------------- == Questions 1. Could the configuration for the "group" section containing the "detail1" and "detail2" modules be simplified? If so, how? // Copyright (C) 2021 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/pages/multiple_modules.adoc000066400000000000000000000050641522352605200277150ustar00rootroot00000000000000= Multiple instances of a module *Goal:* To configure the server to have multiple instances of a module. *Time:* 10-20 minutes *File:* - `/etc/raddb/mods-available/detail` In this exercise, we will configure the server to use two independent ``databases'' (here, detail files) for recording accounting data. These databases will use the same `detail` module, but with two different configurations. The `detail` module logs plain-text information about the request to a local file and is therefore an easy module to use for demonstration purposes. The first step is to configure the server to have two instances of the `detail` module. The first instance should log requests to a different file for each user name. The second should log requests to a different file for each date. The following information should be added to the `/etc/raddb/mods-available/detail` file. -------------------------------------------------------------------- detail byname { filename = ${radacctdir}/byname/%{User-Name || 'none'} permissions = 0600 } detail bydate { filename = ${radacctdir}/bydate/%Y-%m-%d permissions = 0600 } -------------------------------------------------------------------- In the module configurations contained within `/etc/raddb/mods-available/*`, each module may have two names. The first name is the name of the dynamically loadable module that implements that functionality. The second (optional) name is the name of an additional instance of the module. In this case, the `detail` module has two additional instances, `byname` and `bydate`. These instance names can be used in the `authorize`, `accounting`, etc. sections, just like a normal module name. You should now add the two modules to the list of modules in the `authorize` section. Start the server and verify that it is `Ready to process requests.` Send the server a test `Access-Request` packet (`bob.sh`). Verify that the client receives a response packet and that the server is using the two modules to log the request. Verify that the request was logged to two different files by examining them: [source, bash] ------------------------------------------------ $ more /var/log/radius/radacct/byname/* $ more /var/log/radius/radacct/bydate/* ------------------------------------------------ Once you have verified that the files exist and that the correct information is logged in them, you may stop the server. == Questions 1. Why is it useful to have multiple versions of a module? // Copyright (C) 2021 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/pages/new_client.adoc000066400000000000000000000040751522352605200264620ustar00rootroot00000000000000= Adding a new client to the server *Goal:* To permit an additional RADIUS client to communicate with the server. *Time:* 5-10 minutes. *File:* - `etc/raddb/clients.conf` The RADIUS server will only communicate with known clients. This restriction is for security, so that unknown machines on the Internet cannot probe the RADIUS server with test packets. In FreeRADIUS, the `clients.conf` file lists the clients that are permitted to send requests to the server. Take some time to read this file and the included comments. Configure the server with the the IP address of the new client and a shared secret. If the server is already running, stop it. Start the server [source, bash] ------------ $ radiusd -X ------------ Send a Status-Server packet from the new client to the server, using the correct IP address, port, and shared secret. Verify that the server saw the packet. Also verify that the client saw the response. Some common problems are: * not using the correct port in the client software * not using the the correct shared secret in the client software * the server responds to the client from an address that is different from the one to which the client sent the request. The first two problems can be solved by configuring the client with the correct information. The last problem is seen when the client does not see the response from the server, or when the server gives an error message about an invalid response. If the server responds to the packet and the client accepts the response, then the test was successful, and the server may be halted. == Questions 1. What happens when the server receives a packet from a machine not listed in "clients.conf"? 2. Why does the client not accept the response from the server when that response originates from another IP address? 3. Why does the server have to be re-started when the "clients.conf" file is edited? 4. What are the other fields in a client entry, and what are they used for? // Copyright (C) 2021 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/pages/new_user.adoc000066400000000000000000000060171522352605200261600ustar00rootroot00000000000000= Adding a new user to the server *Goal:* To configure the server with a new user, to send test packets as that new user, and to receive a reply. *Time:* 15-25 minutes. *File:* - `etc/raddb/users` *`man` page:* users The file is the usual place where new users may be added. The file is located in `etc/raddb/users`. It has a manual page; `man users`, or `man 5 users` will display this page. The manual page describes how the entries in the file are formatted and also contains some example entries. The comments at the top of the file should also be read. For testing purposes, add an entry at the top of the file, which will add a new user "bob" with password "hello", as suggested in the `man` page for the file. Start the server: [source, bash] ------------ $ radiusd -X ------------ Test the server with a radius test client (radclient, NTRadPing), and verify that the server responds with an Access-Accept packet. For this test, use a PAP password. If the server was successful, look for a message similar to: --------------------------------------------------------------------- (0) files : users: Matched entry bob at line 1 (0) [files] = ok --------------------------------------------------------------------- These messages indicate which entries in the file were used to match the incoming request. If the server does not see the packet, then double-check the IP address and port to which the client is sending the request. If the server does not send an Access-Accept, then stop the server and re-start it, while recording its output to a log file: [source, bash] ---------------- $ script log.txt $ radiusd -X ---------------- Send the test packet again, and after the Access-Reject is received by the client, "exit" the shell to close the "log.txt" file. Open the "log.txt" file in a text editor, and read the output. The cause of the error can generally be determined from those messages. The error will usually be one of the following problems: * the shared secret was incorrect * the user was not found, or no entry matched the request. Test the server again with a PAP password, but this time, deliberately use the wrong shared secret. Observe what happens and what error messages are produced. Test the server again with a test packet, this time using a CHAP password. Verify that authentication also succeeds. Test the server again with a CHAP password, but this time, deliberately use the wrong shared secret. Observe what happens and what error messages are produced. Also observe how the error messages are different from the previous test with a PAP password and incorrect shared secret. Stop the server. == Questions 1. What happens when using a PAP password with an incorrect shared secret, and why do we get this result? 2. What is different when using a CHAP password with an incorrect shared secret? 3. Why does the server need access to a clear-text password to perform CHAP authentication? // Copyright (C) 2021 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/pages/prepaid.adoc000066400000000000000000000035401522352605200257530ustar00rootroot00000000000000= A simple pre-paid example *Goal:* To implement a simple "prepaid" functionality in the server. *Time:* 15-25 minutes *Files:* - `etc/raddb/mods-available/counter` Many system administrators wish to implement "prepaid" billing for their systems. In this exercise, we will configure the server to use a simple "prepaid" scheme, wherein all users will be permitted to log in for only one hour a day. Read `etc/raddb/mods-available/counter` and look for the `counter daily` instance The documentation for the module consists solely of the comments in `etc/raddb/mods-available/counter`, so those comments should be read carefully. Search the rest of the configuration file for references to the `daily` module and un-comment any references you find. Add an entry that sets the `Max-Daily-Session` to have the value 3600 to the top of the file. Start the server, and test it with the `bob.sh` script. Note that unlike previous responses from the server, this one contains a `Session-Timeout` attribute with value 3600. Wait five to ten seconds, and then use the `bob-acct-stop.sh` script to tell the server that user "bob" has logged off. Observe that the `counter` module is called and that this module updates the user's login time. Now send the server another login request (`bob.sh`), and observe that the "Session-Timeout" attribute has a value less than 3600. The value should be near 3600. This value depends on the length of time passed between when the server is started and when the `bob-acct-stop.sh` script is run. == Questions 1. How would you configure the server to obtain the daily access limits from an SQL database? 2. Why is it useful to enforce time-based restrictions on users, in addition to enforcing `Simultaneous-Use`? // Copyright (C) 2021 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/pages/proxy.adoc000066400000000000000000000044071522352605200255130ustar00rootroot00000000000000= Configuring a server to proxy requests *Goal:* To configure the server to proxy packets to a remote (home) RADIUS server and to perform test authentications against both the proxy server and the home server. *Time:* 15-25 minutes *File:* - `etc/raddb/proxy.conf` *Diagram:* image::access-request-proxy.svg[Fig. Proxy] For this exercise, you will configure a RADIUS server to proxy requests to a home RADIUS server that is run by another user (the uber user)). You will configure a realm, called "realm1" in the `raddb/proxy.conf` file. This realm will be proxied to the RADIUS server administered by the uber user, who will supply the IP address, port, and shared secret used by their RADIUS server. The entry for the home server in `proxy.conf` will be configured to "strip" the realm name from the incoming request. The entry from the exercise in xref:new_user.adoc[New User] for user "bob", in the "users" file will be used in this exercise. The example packets `bob.sh` and `bob@realm1.sh` may be used in this exercise. You should verify that authentication requests for user "bob" to their RADIUS server result in authentication accept replies and that the request was not forwarded to the home RADIUS server. You should then use the `bob@realm1.sh` script to attempt an authentication request to their RADIUS server, which will then be proxied to the home server. Once you have verified that authentication requests are proxied to the home server and that you have received an authentication accept, the uber user will halt the home server. The users should then re-attempt the `bob@realm1.sh` authentication request to their server. They should then observe the resulting behavior of their server, as it attempts to proxy to a home server that does not respond. == Questions 1. How would you configure "proxy.conf" so that "realm1" was not proxied, but was instead handled by the local RADIUS server? 2. Will it make any difference for the home server if the request sent to the proxy contains CHAP-Password instead of User-Password? 3. Since the User-Password is encrypted with the RADIUS shared secret, what happens to it when a request is proxied? // Copyright (C) 2021 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/pages/proxy_failover.adoc000066400000000000000000000047051522352605200274030ustar00rootroot00000000000000= Proxy Fail-over *Goal:* To configure a "backup" home server that is used when the "primary" home server fails. *Time:* 15-25 minutes *Files:* - `etc/raddb/proxy.conf` - `etc/raddb/clients.conf` *Diagram:* image::proxy_backup_server.svg[Fig. Proxy Backup Server] For this exercise, you should find a group of other willing FreeRADIUS users! Divide yourselves into groups of three. One person (user 1) will operate the RADIUS server for "realm1" and the others will be operate the RADIUS server for "realm2". Each user will configure their realm in the `proxy.conf` file to be a "local" realm. user 1 will also configure two entries in the `proxy.conf` file for "realm2", one entry for each of the other partner's RADIUS servers. user 1 will configure the realms to "strip" the realm name from the incoming request. The two group for "realm2" should also configure their `clients.conf` file to permit user 1’s RADIUS server to act as a client, as given in the exercise in xref:new_client.adoc[New Clients]. Each user operating "realm2" should pick a different shared secret to use with user 1. Once the servers have been configured, the group should collectively observe user 1 sending the following requests to their server: - bob@realm1.sh - bob@realm2.sh The group should verify that the expected authentication requests sent to the server for "realm1" are handled locally, as in the exercise in xref:proxy.adoc[Proxy]. The group should then verify that the expected requests sent to the server for "realm1" are proxied to a server for "realm2". The group should send multiple requests to the server for "realm1" that are proxied to a server for "realm2", and they should verify that all of the requests are proxied to the same home server for "realm2". The group should then stop the "realm2" server that responded to that request, and they should repeat the request to "realm1". The group should observe the resulting behavior of the server for "realm1". If time permits, the group may switch roles, so that users have the opportunity to set up a proxy and a home server. == Questions 1. Which server for "realm2" is picked by "realm1"? Why? 2. Would the server for "realm1" ever again try to send packets to the "realm2" server that has been stopped? If so, when? If not, why not? 3. What would happen if both servers for "realm2" failed? // Copyright (C) 2021 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/pages/proxy_load_balance.adoc000066400000000000000000000023721522352605200301560ustar00rootroot00000000000000= Proxy Load Balancing *Goal:* To configure a server to load-balanceproxied requests across multiple home servers. *Time:* 10-15 minutes *File:* - `etc/raddb/proxy.conf` *Diagram:* image::proxy_load_balance.svg[Fig. Proxy Loadbalance] For this exercise, the users will be divided into the same groups as the previous exercise in xref:proxy_failover.adoc[Proxy Failover]. User 1 will edit his `proxy.conf` file, so that the entries for "realm2" are marked as load balancing. The users will send multiple requests to the server for "realm1", and observe how the proxied requests are distributed among the servers for "realm2". == Questions 1. Why is load balancing useful? 2. How is load balancing different than fail-over? 3. What happens to the load balancing when one of the "realm2" servers is stopped, and the server for "realm1" tries to proxy requests to it? 4. How would this exercise be different if there were more than two home server to load balance to? 5. If the load balancing home server which has "failed" is started again, will the proxying server ever send requests to it again? If so, when? If not, why not? // Copyright (C) 2021 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/pages/proxy_receive.adoc000066400000000000000000000052721522352605200272160ustar00rootroot00000000000000= Configuring a server to send and receive proxy requests *Goal:* To configure the server to proxy packets to a remote (home) RADIUS server and to receive packets from another proxy server. *Time:* 15-25 minutes *Files:* - `etc/raddb/proxy.conf` - `etc/raddb/clients.conf` For this exercise, the users will be divided into groups of two. One user will be named "realm1" and the other will be named "realm2". Each user will configure two realms in the `proxy.conf` file. One of the user's assigned realms will be authenticated by the local RADIUS server. The other realm will be proxied to the RADIUS server administered by the other user. Both realms will be configured to "strip" the realm name from the incoming request. User 1: realm1 is local realm2 gets proxied to the server running as "realm2". User 2: realm1 gets proxied to the server running as "realm1". realm2 is local The users should also configure each other's server as a RADIUS client, as given in the exercise in xref:new_client.adoc[New Clients]. The entry from the exercise in xref:new_user.adoc[New User] for user "bob" in the file, will be used in this exercise. The example packets `bob.sh`, `bob@realm1.sh`, and `bob@realm2.sh` may be used in this exercise. Each user should test that authentication requests from "bob" to their RADIUS server should result in authentication accept replies and that the request was not forwarded to the other RADIUS server. Each user should test that authentication requests for their own realm (User 1: "bob@realm1", User 2: "bob@realm2") to their RADIUS server should result in authentication accept replies and that the request was not forwarded to the other RADIUS server. Each user in turn should then attempt authentication using the other user's realm (User 1: "bob@realm2", User 2: "bob@realm1"), to their local RADIUS server. Each in turn should verify that authentication requests for their realm sent to the other user's RADIUS server results in an authentication reject. User 2 should then stop his server. User 1 should then attempt an authentication request to his server where the request would normally be proxied. Both users should examine the debug logs of User 1’s RADIUS client and server in order to observe what the server's resulting behavior will be. == Questions 1. Why is it necessary for each server to mark some realms as local? 2. What would happen if each user did not configure the other RADIUS server in the "raddb/clients.conf" file? 3. What would happen if each user did not configure the realms to "strip" the realm from the proxied requests? // Copyright (C) 2021 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/pages/radmin.adoc000066400000000000000000000021721522352605200256010ustar00rootroot00000000000000= The Administration CLI *Goal:* To understand how to use the `radmin` command. *Time:* 20-30 minutes *File:* - `etc/raddb/sites-enabled/control-socket` *`man` page:* radmin, raddebug The `radmin` command is an interactive command-line interface (CLI) to the internals of the server. It can be used to monitor statistics, to show the current configuration, and to change the configuration. Check that the control socket is enabled, and start the server in debugging mode. Connect to the control socket via `radmin`. Type `help`, and read the output. Use `radtest` to send the server packets, and see how the statistics change. == Questions 1. How can you modify the `control-socket` file so that you can change the server configuration? 2. What happens when you disable a module and try to authenticate a user? 3. How can you run a command from the shell without starting the `radmin` command? 4. Can you start the server in non-debugging mode (`radiusd -f`), and still see the debugging output? How? // Copyright (C) 2021 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/pages/simultaneous_use.adoc000066400000000000000000000045421522352605200277360ustar00rootroot00000000000000[[simultaneous-use]] = Configuring users for limited simultaneous access *Goal:* To prevent a user from having more than one login session at a time. *Time:* 20-35 minutes *Files:* - `etc/raddb/users` For this exercise, you are assumed to have previously worked through, and be familiar with, the accounting exercise from xref:accounting.adoc[Accounting], and to have an entry in the file, as given the exercise in xref:new_user.adoc[New User], for user "bob". In this exercise, youwill work through an example of a user logging into the server, and then attempting a simultaneous login for a second session, while still logged in for the first session. You should run the `bob-login-one.sh` and `bob-acct-start.sh` scripts, to simulate a successful user login. You should check the database to verify that the server knows that the user is logged in. You should then run the `bob-login-two.sh`, and observe that the second authentication request succeeds. The login record should be removed through running the `bob-acct-stop.sh` script, and check the database to verify that no one is currently logged in. you should now read the `Simultaneous-Use` file in the documentation directory, to determine how to limit a user to only one login at a time. The "bob" entry in the file should then be edited, to add the limitation that "bob" may only have one login session at a time. The scripts `bob-login-one.sh` and `bob-acct-start.sh` should be run again, to simulate a successful user login. The `bob-login-two.sh` script should then be run, to verify that the second simultaneous authentication attempt fails. After running the `bob-acct-stop.sh` script, you should run the `bob-login-two.sh` script again, to verify that the other login attempt is now permitted to succeed. == Questions 1. Why is it useful to prevent a user from having more than one simultaneous login session? 2. How would you configure `Simultaneous-Use` with an SQL database? 3. What are the benefits of using an SQL database for `Simultaneous-Use`, over the `radumtp` file? 4. How does `Simultaneous-Use` affect users with multiple "bonded" lines, like MPP, or ISDN? 5. What would happen if the user tried to log in a second time, before the accounting start packet was received? // Copyright (C) 2021 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/pages/sql.adoc000066400000000000000000000156131522352605200251320ustar00rootroot00000000000000= Communicating with an SQL database *Goal:* To configure the server to communicate with an SQL database. *Time:* 25-40 minutes. *File:* - `etc/raddb/mods-available/sql` - `etc/raddb/mods-config/sql/main/*` In addition to the file, the server may obtain user configuration information from an SQL database. In this exercise, you will configure the server to communicate with an SQL database. you will configure the schema for the SQL server, and will populate that schema with a sample entry similar to that for the exercise in xref:new_user.adoc[New User]. There are a number of reasons why user information may be stored in an SQL database, rather than the file. While the file is adequate for a small number of users, it does not scale well to millions of users, and it may not be updated by general non-RADIUS tools. In contrast, SQL databases are designed to store millions of records, to have fast queries and retrievals, and there are many third-party tools for maintaining and updating the databases. The SQL schema used by FreeRADIUS is designed to mirror the users file. Each SQL dialect has its own set of schema and configuration files. They are located in the `raddb/mods-config/sql/main/` directory. The schema is defined by the "schema.sql" file, and the queries are defined by the `queries.conf` file. The main configuration for the SQL module is `raddb/mods-available/sql` it will `$INCLUDE` the appropriate "queries.conf" file for the dialect chosen. You should now read the configuration file for the SQL database which you use. [TIP] ======================================================================== Unless there is a pre-configured database available we recommend the sqlite driver be used. If the sqlite specific stanzas are uncommented in `raddb/mods-available/sql` it will automatically bootstrap a new database using the bundled schema. ======================================================================== The first step is to configure the server to use the SQL module, and to communicate with the SQL database. Edit the `radiusd.conf` file, and look for the `instantiate` section. Inside of that section, add one line containing the word `sql`, as follows: ------------------------------------------ instantiate { sql # start up the SQL module. } ------------------------------------------ This tells the server to look for, and use, the `sql` module when the server starts. Note that since the `sql` module is not listed in any of the "authorize", "authenticate", etc. sections, it will not be used in to process any authentication requests, or accounting requests. For now, we are interested solely in making the FreeRADIUS server communicate with the SQL server. Open `raddb/mods-available/sql` verify that the first few configuration entries are correct. That is, the "server", "login", and "password" entries should be set up correctly for your local SQL database. If using sqlite, these entries can be left commented out as they're not required, but you should uncomment the `sqlite {}` section and the configuration items within that section. FreeRADIUS uses the `rlm_sql` module to interface with the SQL databases. You should check that this module is installed by doing: [source, bash] -------------------------------------- $ ls -l usr/lib64/freeradius/rlm_sql* -------------------------------------- (Or, the directory wherever the FreeRADIUS libraries were installed.) You should see not only files like "rlm_sql.so", but also "rlm_sql_mysql.so", or "rlm_sql_sqlite.so". If you do not see "rlm_sql.so", or you do not see the sub-module which interfaces with your SQL server, you will have to install it now. You may do this by going to the rlm_sql subdirectory, and building the module: [source, bash] ------------------------ $ cd freeradius-server/src/modules/rlm_sql $ ./configure $ make $ make install ------------------------ This exercise has insufficient room to describe how to debug any configuration, build, or installation problems with the SQL drivers. For the remainder of this exercise, we will assume that the driver is installed in the appropriate library directory. Once you have verified that the SQL driver exists, have enabled the module by creating a symlink from `raddb/mods-available/sql` to `raddb/mods-enabled/sql` and you have configured the appropriate sql dialect, you should start the server as usual: ------------ $ radiusd -X ------------ If all has gone well, the server should print out the normal "Ready to process requests" message. Scroll up in your terminal window, and there should be messages from the `sql` module, such as: -------------- rlm_sql_sqlite: Database doesn't exist, creating it and loading schema rlm_sql_sqlite: Executing SQL statements from file "/etc/raddb/mods-config/sql/main/sqlite/schema.sql" rlm_sql (sql): Driver rlm_sql_sqlite (module rlm_sql_sqlite) loaded and linked rlm_sql (sql): Attempting to connect to database "radius" rlm_sql (sql): Initialising connection pool pool { start = 5 min = 4 max = 100 spare = 3 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 1 spread = no } rlm_sql (sql): Opening additional connection (0) rlm_sql_sqlite: Opening SQLite database "/tmp/freeradius.db" rlm_sql (sql): Opening additional connection (1) rlm_sql_sqlite: Opening SQLite database "/tmp/freeradius.db" rlm_sql (sql): Opening additional connection (2) rlm_sql_sqlite: Opening SQLite database "/tmp/freeradius.db" rlm_sql (sql): Opening additional connection (3) rlm_sql_sqlite: Opening SQLite database "/tmp/freeradius.db" rlm_sql (sql): Opening additional connection (4) rlm_sql_sqlite: Opening SQLite database "/tmp/freeradius.db" -------------- These messages indicate that the server was able to load the `sql` module, and that the `sql` module was able to communicate with the SQL server. If there is a problem with shared libraries, or with access permissions to the SQL database, then an error message will be printed, and the server will not start properly. The FreeRADIUS FAQ and the `radiusd.conf` file, entry "libdir", contain information as to how to fix shared library issues. If there are issues connecting to the database you should verify manually that you can connect to the SQL database using the given "server", "login", and "password". The SQL database should come with a test client which may be used to perform this test. Now stop the server. The next exercise will be to add the schema to the database, and to populate it with a test entry. == Questions 1. Why is it important to test SQL connectivity, independently of testing the ability to obtain user configuration from an SQL database? 2. Why are there different configuration files for each SQL server? 3. What additional benefits, not mentioned here, do SQL databases have over the files module? // Copyright (C) 2021 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/pages/sql_user.adoc000066400000000000000000000101211522352605200261550ustar00rootroot00000000000000= Configuring a user in an SQL database *Goal:* To configure the server to have a new user in an SQL database, to send test packets as that user, and to receive a reply. *Time:* 25-40 minutes. *File:* - `etc/raddb/mods-available/sql` - `etc/raddb/mods-config/sql/main/*` Now that we have verified in the previous exercise, xref:sql.adoc[SQL] that the server can communicate with an SQL server, we proceed to adding user configuration entries into the SQL database. Before adding any user configuration to an SQL database, we first need to create the schema used to store that information. In the source archive, the file `RADIUS-SQL.schema` in the documentatin directory, describes where the schemas are located, and how to install them. In general, you will need to be familiar with the tools for the SQL database your are using, as they are too complicated and variable to describe here. Once the schema has been created, use an SQL client utility to execute the following SQL commands: [source, sql] --------------------------------------------------------- INSERT INTO radcheck (UserName, Attribute, op, Value) values("bob", "Password.Cleartext", ":=", "hello"); INSERT INTO radreply (UserName, Attribute, op, Value) values("bob", "Reply-Message", ":=", "Hello from SQL"); --------------------------------------------------------- These commands may need to be modified slightly, depending on the syntax required by your SQL database. These commands mirror the "check" and "reply" entries listed in the file for the user "bob". Use the SQL client to verify that the entries are now in the database. As the previous exercise in xref:sql.adoc[SQL] did not tell the server to query the database, but only to connect to it, we must now configure FreeRADIUS to query the database. This may be done by editing `etc/raddb/sites-available/default`, and listing the `sql` module in the "authorize" section. There should already be a commented-out entry for `sql` in the "authorize" section or there will be `-sql` entry. If the entry is commented it should be un-commented, to make it live. If the entry has a '-' prefix, it may be left as is, the '-' prefix is used to mark modules as optional, so that the server can start even if they are not enabled. The file should now be edited to delete the existing entry or entries for user "bob". This may be done by commenting out the entries, rather than deleting them. Add a `#` character to the start of every line for the relevant entries, and save the updated file. The server should now be started. Send a test packet for user "bob", and verify that an authentication accept packet is received. Observe the debugging output of the server, and verify that the `sql` module is called, and that it successfully returns data for user "bob". If the server rejects the access request, then there are a number of steps to take, to correct the problem. Verify that FreeRADIUS is connecting to the SQL server, and that FreeRADIUS is "Ready to process requests." Verify that the file entry for "bob" has not matched the request. Verify that the SQL module returns "ok", rather than "notfound". If necessary, edit the `etc/raddb/mods-enabled/sql` file, and enable additional debugging of SQL statements via the `sqltrace` and `sqltracefile` configuration options. If the SQL queries are performed by the server and logged to the file, but the request for user "bob" is still rejected, then perform those queries by hand, using an SQL test client. Once you have verified that the SQL test client returns the correct information for the queries, then send the access request again. == Questions 1. Why do we not use an SQL database to "authenticate" users? 2. How do we have a DEFAULT entry in an SQL database? 3. Why is there no "Fall-Through" entry in an SQL database? 4. Does that DEFAULT entry differ from its use in the file? If so, why, and how? If not, why not? 5. What other configuration entries in `etc/raddb/sites-available/default` exist for the `sql` module, and why? // Copyright (C) 2021 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/pages/trouble_shooting.adoc000066400000000000000000000054301522352605200277150ustar00rootroot00000000000000If you encounter a problem with server configuration, observe the following set of procedures to troubleshoot or debug the server: * Make small, discrete changes to the configuration files. * Start the server in debugging mode: `radiusd -X` * Verify that the results are what you expect ** The debug output shows any configuration changes you have made. ** Databases (if used) are connected and operating. ** Test packets are accepted by the server. ** The debug output shows that the packets are being processed as you expect. ** The response packets are contain the attributes you expect to see. * If everything is OK, save a copy of the configuration, go back and make another change. * If anything goes wrong, ** double-check the configuration ** read the entire debug output, looking for words like error or warning. These messages usually contain descriptions of what went wrong, and suggestions for how it can be fixed. * If you can't make any progress, try to replace your configuration with a saved copy of a "known working" configuration, and start again. This process can clean up errors caused by temporary edits, or edits that you have forgotten. * If you get stuck, ask for help on the freeradius-users [[project/Mailing list|mailing list]]. Include a description of what you are trying to do, and the entire debugging output, especially output showing the server receiving and processing test packets. ** You may want to scrub "secret" information from the output before posting it - shared secrets, passwords, etc ** Please do *not* scrub all the exact addresses and similar data, because often the process of obfuscating can introduce more errors == Reminder - run the server in debugging mode! Run the server in debugging mode as suggested in the FAQ, README, INSTALL, man page, and daily on the mailing list. We cannot emphasize that strongly enough. There is no way for anyone to help you unless you post the debugging output along with your question. If you do not post the debugging output, your question will either be ignored, or you will receive a number of responses saying Post the debug output as suggested in the FAQ, README, INSTALL, man page, and daily on the mailing list. A large number of problems can be trivially solved by having an expert read the debug output. If you do not post it to the list, you are making it impossible for anyone to help you. == Parsing debug mode You can usually interpret the debug messages, but if you need help, there is a debug form available at: * http://networkradius.com/freeradius.html Paste the output into the debug form, and a colorized HTML version will be produced. Look for red or yellow text, and read the messages. // Copyright (C) 2025 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/pages/unlang_policies.adoc000066400000000000000000000034341522352605200275040ustar00rootroot00000000000000= Unlang Policies *Goal:* Create and use policies for abstracting business logic *Time:* 10-20 minutes *File:* - `etc/raddb/policy.d/*` *`man` page:* unlang include::partial$unlang_start.adoc[] Look through the existing files in `etc/raddb/policy.d/*` and the rest of the documentation to get a feel for the unlang syntax and the tasks that policies can be used for. The basic structure of a policy is the policy name then a set of curly braces containing the body of the policy ------------------------------------------------ a_policy { if (User-Name =~ /@([\w.+])/) { reply.Reply-Message := "Hello remote %{User-Name}" } } ------------------------------------------------ Policies defined within `etc/raddb/policy.d/*` can be called from anywhere in the server where modules can be called. ------------------------------------------------ authorize { ... a_policy ... } ------------------------------------------------ Create a policy `proxy_to_realm` that forwards the incoming request to to a remote realm if the `User-Name` attribute ends in `@`. The contents of this policy should be identical to the the 'unlang' code written for the xref:unlang_splitting_strings.adoc[Splitting Strings] tutorial. Call this policy at the start of the `authorize {}` section of the `etc/raddb/sites-available/default` virtual server. All the information you need to create this policy is contained within documentation pages and the examples in this exercise. == Questions 1. What are the advantages of using the policy language over interpreted language modules? 2. What are the main differences between a policy and a function in other languages? // Copyright (C) 2021 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/pages/unlang_return_codes.adoc000066400000000000000000000050401522352605200303640ustar00rootroot00000000000000= Module return codes *Goal:* Explore uses of return codes and return code overrides *Time:* 10-15 minutes *File:* - `etc/raddb/policy.d/*` *`man` page:* unlang - xref:unlang:index.adoc[Conditional Expressions] - xref:unlang:return_codes.adoc[Return Codes] - xref:unlang:return_codes.adoc[The Return Code Operator] - https://github.com/FreeRADIUS/freeradius-server/blob/v3.2.x/src/modules/rlm_always/README.md[The Always Module] - https://github.com/FreeRADIUS/freeradius-server/blob/695a87f98c02568d5aa2f07ae1b9212101c4dcf9/src/modules/rlm_sometimes/README.md[The Sometimes Module] include::partial$unlang_start.adoc[] The server includes a number of instances of the xref:reference:raddb/mods-available/always.adoc[always] module. These are used to set return codes during policy evaluation. For example, if the `ok` always module instance is called, the `ok` return code will be returned, and subject too priority comparisons, will be set as the return code for the request. One of the most common reasons for overriding return codes is to implement special behaviour on failure. To minimize external dependencies, for this exercise we will use the xref:reference:raddb/mods-available/sometimes.adoc[sometimes] module to simulate an unreliable external database. This module will return a specified xref:unlang:return_codes.adoc[return code] 50% of the time. Create an instance of the sometimes module called `bad_ldap`. Add unlang statements such that if the module returns `noop`, then a `control.Password.Cleartext = 'hello'` attribute pair is added to the request, and the return code is set to `updated`. Run three test requests using `bob.sh`, you should see that at least one request fails (though it may not as sometimes is truly random). Now add a policy to handle the `fail` return code of the sometimes module by executing the `files` module to provide an alternative source of credentials. [TIP] ==== You may need to modify the return code priorities of the xref:reference:raddb/mods-available/sometimes.adoc[sometimes] module. ==== If the policies are correct you will see that FreeRADIUS returns an `Access-Accept` 100% of the time. 1. Why might you need to override the return code priorities of the sometimes module? 2. Looking through the unlang keyword list, do you see any of keywords that might produce similar fail-over behaviour as the behaviour configured above xref:unlang:keywords.adoc[Keywords]. // Copyright (C) 2021 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/pages/unlang_splitting_strings.adoc000066400000000000000000000040331522352605200314570ustar00rootroot00000000000000= Splitting strings *Goal:* Explore uses of regular expressions and subcapture groups *Time:* 10-20 minutes *File:*   - `etc/raddb/policy.d/*` *`man` page:* unlang *documentation page(s):* - xref:unlang:condition/index.adoc[Conditions] - xref:unlang:condition/regex.adoc[Regular expressions] - xref:unlang:update.adoc[The Update Statement] include::partial$unlang_start.adoc[] include::partial$common_control_attrs_sidebar.adoc[] Regular expressions are an extremely powerful tool in the 'unlang' policy language. They provide both validation capabilities, allowing users to check the format of incoming attributes, and substring extraction (via capture groups). If you've completed the xref:proxy.adoc[Proxy] exercise you'll have used the `suffix` module to split an incoming `User-Name` value into its components and setup the request for proxying. Create an unlang version of "suffix" that splits an incoming `User-Name` into two components on the "@" separator. The first component should be written to the `request.Stripped-User-Name` attribute and the second component should be written to the `control.Stripped-User-Domain` attribute. Use `bob@realm1.sh` and `bob@realm2.sh` to test your new policy to ensure it works as expected. If you've completed the xref:proxy.adoc[Proxy] tutorial and have test realms setup, modify the policy code you have just written to proxy the request to the realm specified in the `User-Name` attribute. == Questions 1. Regular expressions can contain attribute expansions. Given that all supported regular expression libraries support pre-compilation of expressions, why would regular expressions containing expansions be avoided when the server being deployed will be under heavy load? 2. Why might you want to re-implement functionality offered by modules in unlang? 3. What is an advantage of using expression based string splitting over the suffix module? // Copyright (C) 2021 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/pages/unlang_update_blocks_and_conditions.adoc000066400000000000000000000060311522352605200335630ustar00rootroot00000000000000= Update blocks and simple conditions *Goal:* Explore uses of update blocks in the policy language *Time:* 10-25 minutes *File:* - `sites-available/default` *`man` page:* unlang *documentation page(s):* - xref:unlang:condition/index.adoc[Conditional Expressions] - xref:unlang:update.adoc[The Update Statement] include::partial$unlang_start.adoc[] include::partial$common_control_attrs_sidebar.adoc[] Unlang `update` blocks are used to update one or attributes in one of the server's xref:unlang:list.adoc[attribute lists]. In previous tutorials we've used the `files` modules, and the authorize methods of authentication modules such as `pap` and `chap` to alter how the server processes requests by setting a `Auth-Type` value. Here, we will emulate that behaviour using the policy language. * Create a condition (_condition 1_) to execute policy code if the `User-Name` in the request is 'bob'. * Within that condition block, set the control attribute `Password.Cleartext` to be 'hello', and instruct the server to run the the `authenticate { ... }` subsection for `pap`. * Use the `bob.sh` script to verify that you see an `Access-Accept` returned despite the `files` module not being called. Using additional conditions and update blocks, emulate the logic implemented using the files module in the xref:matching_users.adoc[Matching Users] exercise. To recap: * If an incoming request contains a `User-Name` attribute with the value 'bob', and contains an attribute `Framed-Protocol` with value `PPP` (_condition 2_), reply with a `Framed-IP-Address` attribute with the value `192.168.10.12`. * If an incoming request contains a `Service-Type` attribute with a value of `Framed-User` (_condition 3_), reply with a `Framed-Route` attribute assigning a default route of `192.168.10.1` (`0.0.0.0/0 192.168.10.1 1`) and a `Framed-IP-Netmask` attribute with a value of `255.255.255.0`. Again test the server with username "bob" and password "hello". Use the debug output of the server to see which unlang conditions evaluated to true. You may use `radclient` or the `bob.sh` script to send the packets. Perform other authentication tests, adding the appropriate attributes to the test requests to exercise the different conditions. If you already have test packets from the xref:matching_users.adoc[Matching Users] exercises, you may use those, otherwise continue until you have packets that will match: * conditions 1 and 2, but not 3. * conditions 1 and 3, but not 2. * conditions 1, 2, and 3. == Questions 1. What are the advantages of unlang over the files module when creating policies? 2. What are the advantages of the files modules over unlang? Are there any situations where you think the files module might be better suited to a task than unlang? 3. Can you think of any efficiencies the users module might have over multiple conditions, where policies are being assigned to many different users? // Copyright (C) 2025 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/pages/variables.adoc000066400000000000000000000104051522352605200262750ustar00rootroot00000000000000= Using configuration and run-time variables *Goal:* To use run-time variable expansion. *Time:* 15-30 minutes. *Files:* - `etc/raddb/radiusd.conf` - `etc/raddb/users` - `etc/raddb/mods-available/detail` *`man` page:* `radiusd.conf` *documentation page:* xref:unlang:xlat/index.adoc[Dynamic expansions] There are two kinds of variables within the server. The first is within `radiusd.conf` and related files. These variables are referenced via the `$` character, which is used to define common terms (e.g. `${logdir}` so that those terms do not have to be repeated multiple times in the configuration files. These variables are used only when the server reads the configuration files, and they cannot be updated or edited once the files have been read. The second kind of variable is a run-time variable, which is dynamically expanded for each request received by the server. These variables are referenced by the `%` character, and they may be used to pull the values of attributes from the request to be used by a module. These variables may also be used by one module to obtain information from another module. In this exercise, we cover configuration variables and some simple properties of the run-time variables. Later exercises cover additional properties of the run-time variables. The main configuration file `radiusd.conf` and the module configuration files contains a number of examples of the use of variables. For example, the `detail` module (configured in `etc/raddb/mods-enabled/detail`) has a configuration entry named "filename", which by default has the following value: ---------------------------------------------------------------- filename = ${radacctdir}/%{Net.Src.IP}/detail-%Y%m%d ---------------------------------------------------------------- The configuration entry is composed of two kinds of variable expansion. One references the `${radacctdir}` configuration variable, which was previously defined in `radiusd.conf`. The following variables are expanded at run time and depend on information in the request packet and other dynamically calculated data. Start the server in debugging mode (`radiusd -X`). In the server output, look for the `detail` module and the `filename` configuration entry for that module. Verify that the string printed for the `filename` does not print the reference to the `${radacctdir}` variable, but instead has substituted the value of that variable. Verify also that the values of the run-time variables have _not_ been substituted and that they are still printed as variables. If you don't see any configuration printed for the `detail` file module ensure it is uncommented in the `accounting {}` section of the `raddb/sites-available/default` virtual server. Now read the https://github.com/FreeRADIUS/freeradius-server/blob/v3.2.x/doc/configuration/variables.rst[variables] documentation file to determine the meaning of the variables used in the `filename` configuration entry. Once you are done, send the server an accounting packet (e.g., `bob-acct-stop.sh`), and go look for the detail file, which will be dynamically created. Verify that the contents of the file are the accounting packet you just sent. In addition to being used in the configuration files, run-time variables may also be used to create values for reply attributes. Stop the server, and edit the users file to add the following entry at the top: ----------------------------------------------------------------------------- bob Password.Cleartext := "hello" Reply-Message = "Hello %{User-Name}, your NAS port is %{NAS-Port}", Reply-Message += "at time %T" ----------------------------------------------------------------------------- Start the server, and run the `bob-login-one.sh` script. Verify that the `Reply-Message` attributes contain the user name, NAS port, time, and a copy of the `Class` attribute from the reply. == Questions 1. Why are run-time variables useful? 2. How would you configure that entry in the file to reply with the directory name where the `radiusd.conf` file is stored? Why is this a bad idea? 3. How would you create an entry in the users file that matched users when their `Class` was the same as their `NAS-Port`? // Copyright (C) 2021 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/pages/virtual.adoc000066400000000000000000000030471522352605200260170ustar00rootroot00000000000000= Virtual Servers *Goal:* To understand how to create and use a new virtual server. *Time:* 20-30 minutes *File:* - `etc/raddb/sites-enabled/virtual` *documentation page:* raddb/sites-available/README A "virtual server" is a configuration file that contains the following sections: - *listen* Defines a new socket. - *authorize* The authorization section - *authenticate* The authentication section - *post-auth* The post-authentication section - *pre-proxy* The pre-proxy section - *post-proxy* The post-proxy section - *preacct* The pre-accounting section - *accounting* The accounting section Create a new file `raddb/sites-enabled/virtual`. Put the following text into it: ----------------------------------------------- listen { ipaddr = 127.0.0.1 port = 18273 # some random 5 digit number type = auth } authorize { control.Clearext-Password := "hello" pap } authenticate { pap } ----------------------------------------------- Start the server in debugging mode, and use `radtest` to send a PAP authentication request to the server at the port defined above. == Questions 1. What happens when you try to use CHAP or MS-CHAP? Why does this result occur? 2. How can you make that virtual server use CHAP or MS-CHAP? 3. What happens when you try different User-Names? Why does this result occur? 4. How can you make the above configuration authenticate different users via different passwords? // Copyright (C) 2021 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/partials/000077500000000000000000000000001522352605200242155ustar00rootroot00000000000000freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/partials/common_control_attrs_sidebar.adoc000066400000000000000000000005461522352605200330100ustar00rootroot00000000000000.Common control attributes **** Attributes in the `control` list can control the behaviour of the server. Commonly used control attributes are: - `control.Auth-Type` specifies the `authenticate {}` section to run **** // Copyright (C) 2025 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/tutorials/partials/unlang_start.adoc000066400000000000000000000005301522352605200275440ustar00rootroot00000000000000[TIP] ==== For this tutorial you should start with an empty authorization section (`recv Access-Request { ... }` or in ≤ v3.2.x `authorize { ... }`) in the virtual server you're using to process requests. ==== // Copyright (C) 2025 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // This documentation was developed by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/000077500000000000000000000000001522352605200216345ustar00rootroot00000000000000freeradius-3.2.10+dfsg/doc/antora/modules/unlang/.gitignore000066400000000000000000000000101522352605200236130ustar00rootroot00000000000000!*.adoc freeradius-3.2.10+dfsg/doc/antora/modules/unlang/nav.adoc000066400000000000000000000035231522352605200232530ustar00rootroot00000000000000* xref:index.adoc[Unlang Policy Language] ** xref:list.adoc[Attribute Lists] ** xref:attr.adoc[Attribute References] ** xref:return_codes.adoc[Return Codes] ** xref:keywords.adoc[Keywords] *** xref:break.adoc[break] *** xref:case.adoc[case] *** xref:else.adoc[else] *** xref:elsif.adoc[elsif] *** xref:foreach.adoc[foreach] *** xref:group.adoc[group] *** xref:if.adoc[if] *** xref:load-balance.adoc[load-balance] *** xref:redundant-load-balance.adoc[redundant-load-balance] *** xref:redundant.adoc[redundant] *** xref:return.adoc[return] *** xref:switch.adoc[switch] *** xref:update.adoc[update] ** xref:module.adoc[Modules] *** xref:module_method.adoc[Module Methods] *** xref:module_builtin.adoc[Built-in Modules] ** xref:type/index.adoc[Data Types] *** xref:type/index.adoc[List of Data Types] *** xref:type/ip.adoc[IP Addresses] *** xref:type/numb.adoc[Numbers] *** xref:type/string/single.adoc[Single Quoted Strings] *** xref:type/string/double.adoc[Double Quoted Strings] *** xref:type/string/backticks.adoc[Backtick-quoted string] *** xref:type/string/unquoted.adoc[Unquoted Strings] ** xref:condition/index.adoc[Conditional Expressions] *** xref:condition/cmp.adoc[Comparisons] *** xref:condition/operands.adoc[Operands] *** xref:condition/return_codes.adoc[The Return Code Operator] *** xref:condition/eq.adoc[The '==' Operator] *** xref:condition/and.adoc[The '&&' Operator] *** xref:condition/or.adoc[The '||' Operator] *** xref:condition/not.adoc[The '!' Operator] *** xref:condition/para.adoc[The '( )' Operator] *** xref:condition/regex.adoc[Regular Expressions] ** xref:xlat/index.adoc[String Expansion] *** xref:xlat/alternation.adoc[Alternation Syntax] *** xref:xlat/builtin.adoc[Built-in Expansions] *** xref:xlat/character.adoc[Single Letter Expansions] *** xref:xlat/attribute.adoc[Attribute References] *** xref:xlat/module.adoc[Module References] freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/000077500000000000000000000000001522352605200227335ustar00rootroot00000000000000freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/attr.adoc000066400000000000000000000052241522352605200245400ustar00rootroot00000000000000= &Attribute References Attributes may be referenced via the following syntax: .Syntax [source,unlang] ---- &Attribute-Name &Attribute-Name:TAG &Attribute-Name[NUM] &:Attribute-Name &:Attribute-Name:TAG[NUM] ---- The `&Attribute-Name` operator returns a reference to the named attribute. When used as an existence check in a condition, the condition evaluates to `true` if the attribute exists. Otherwise, the condition evaluates to `false`. When used elsewhere, such as in xref:switch.adoc[switch], it returns the value of the named attribute. .Examples [source,unlang] ---- &User-Name &NAS-IP-Address ---- == Lists The attribute reference can also be qualified with a xref:list.adoc[list] reference. When no list is given, the server looks in the input packet list for the named attribute. .Examples [source,unlang] ---- &request:User-Name &reply:NAS-IP-Address ---- == Array References Finding a particular attribute from multiple instances can be done via an array reference. .Syntax [source,unlang] ---- &Attribute-Name[] ---- When an attribute appears multiple times in a list, this syntax allows you to address the attributes as if they were array entries. The `` value defines which attribute to address. The `[0]` value refers to the first attributes, `[1]` refers to the second attribute, etc. .Examples [source,unlang] ---- &EAP-Message[1] &reply:NAS-IP-Address[2] ---- == Other Array indexes The array syntax can be used for a few special cases, too. .Syntax [source,unlang] ---- &Attribute-Name[#] &Attribute-Name[*] &Attribute-Name[n] ---- These extra fields have the following definitions: `#`:: Returns an integer which is the number of instances of this attribute. `*`:: Returns all of the instances of the given attribute. This syntax can only be used in a xref:xlat/index.adoc[string expansion]. It will return all of the values of the attribute, separated by commas. `n`:: Returns the last instance of the given attribute. == Removing ambuguity from the configuration files In most cases, the server uses the `&` character to distinguish attribute names from other strings. Without the `&`, it is more difficult to parse the configuration file clearly. You could interpret a string as `hello-there` either as a literal string "hello-there", or as a reference to an attribute named `hello-there`. Adding the leading `&` character means that attribute references are now easily distinguishable from literal strings. The use of the leading `&` character is highly recommended. // Copyright (C) 2025 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/break.adoc000066400000000000000000000011021522352605200246410ustar00rootroot00000000000000= The break statement .Syntax [source,unlang] ---- break ---- The `break` statement is used to exit an enclosing xref:foreach.adoc[foreach] loop. The `break` statement only be used inside of a xref:foreach.adoc[foreach] loop. .Example [source,unlang] ---- foreach &Class { if (&Foreach-Variable-0 == 0xabcdef) { break } update reply { Reply-Message += "Contains %{Foreach-Variable-0}" } } ---- // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/case.adoc000066400000000000000000000020011522352605200244670ustar00rootroot00000000000000= The case Statement .Syntax [source,unlang] ---- case [ ] { [ statements ] } ---- The `case` statement is used to match data inside of a xref:switch.adoc[switch] statement. The `case` statement cannot be used outside of a xref:switch.adoc[switch] statement. The `` text can be an attribute reference such as `&User-Name`, or it can be a xref:type/index.adoc[string]. If the match text is a dynamically expanded string, then the match is performed on the output of the string expansion. If no `` text is given, it means that the `case` statement is the "default" and will match all which is not matched by another `case` statement inside of the same xref:switch.adoc[switch]. .Example [source,unlang] ---- switch &User-Name { case "bob" { reject } case &Filter-Id { reject } case { ok } } ---- // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/condition/000077500000000000000000000000001522352605200247215ustar00rootroot00000000000000freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/condition/and.adoc000066400000000000000000000010711522352605200263120ustar00rootroot00000000000000= The && Operator .Syntax [source,unlang] ---- (condition-1 && condition-2) ---- The `&&` operator performs a short-circuit "and" evaluation of the two conditions. This operator evaluates _condition-1_ and returns `false` if _condition-1_ returns `false`. Only if _condition-1_ returns `true` is _condition-2_ evaluated and its result returned. .Examples [source,unlang] ---- if (&User-Name && &EAP-Message) { ... ---- // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/condition/cmp.adoc000066400000000000000000000062701522352605200263350ustar00rootroot00000000000000= Comparisons .Syntax [source,unlang] ---- lhs OP rhs ---- The most common use-case for conditions is to perform comparisons. The `lhs` and `rhs` of a conditional comparison can be xref:attr.adoc[&Attribute-Name] or xref:type/index.adoc[data]. The the `OP` is an operator, commonly `==` or `\<=`. It is used to control how the two other portions of the condition are compared. == The Comparison Operators The comparison operators are given below. [options="header"] |===== | Operator | Description | < | less than | \<= | less than or equals | == | equals | != | not equals | >= | greater than or equals | > | greater than | xref:condition/regex.adoc[=~] | regular expression matches | xref:condition/regex.adoc[!~] | regular expression does not match |===== The comparison operators perform _type-specific_ comparisons. The only exceptions are the xref:condition/regex.adoc[regular expression] operators, which interpret the `lhs` as a printable string, and the `rhs` as a regular expression. == IP Address Comparisons The type-specific comparisons operate as expected for most data types. The only exception is data types that are IP addresses or IP address prefixes. For those data types, the comparisons are done via the following rules: * Any unqualified IP address is assumed to have a /32 prefix (IPv4) or a /128 prefix (IPv6). * If the prefixes of the left and right sides are equal, then the comparisons are performed on the IP address portion. * If the prefixes of the left and right sides are not equal, then the comparisons are performed as _set membership checks_. The syntax allows conditions such as `192.0.2.1 < 192.0.2/24`. This condition will return `true`, as the IP address `192.0.2.1' is within the network `192.0.2/24`. == Casting In some situations, it is useful to force the left side to be interpreted as a particular data type. [NOTE] The data types used by the cast *must* be a type taken from the RADIUS dictionaries, e.g., `ipaddr`, `integer`, etc. These types are not the same as the xref:type/index.adoc[data types] used in the configuration files. .Syntax [source,unlang] ---- lhs OP rhs ---- The `cast` text can be any one of the standard RADIUS dictionary data types, as with the following example: .Example [source,unlang] ---- &Class == 127.0.0.1 ---- In this example, the `Class` attribute is treated as if it was an IPv4 address and is compared to the address `127.0.0.1` Casting is most useful when the left side of a comparison is a dynamically expanded string. The cast ensures that the comparison is done in a type-safe manner, instead of performing a string comparison. .Example [source,unlang] ---- `/bin/echo 00` == 0 ---- In this example, the string output of the `echo` program is interpreted as an integer. It is then compared to the right side via integer comparisons. Since the integer `00` is equivalent to the integer `0`, the comparison will match. If the comparison had been performed via string equality checks, then the comparison would fail, because the strings `00` and `0` are different. // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/condition/eq.adoc000066400000000000000000000020111522352605200261500ustar00rootroot00000000000000= The == Operator .Syntax `(data-1 == data-2)` The `==` operator compares the result of evaluating `data-1` and `data-2`. As discussed in xref:type/index.adoc[Data Types], the `data-1` field may be interpreted as a reference to an attribute. The `data-2` field is interpreted in a type-specific manner. For example, if `data-1` refers to an attribute of type `ipaddr`, then `data-2` is evaluated as an IP address. If `data-1` refers to an attribute of type `integer`, then `data-2` is evaluated as an integer or as a named enumeration defined by a `VALUE` statement in a dictionary. Similarly, if `data-1` refers to an attribute of type `date`, then `data-2` will be interpreted as a date string. If the resulting data evaluates to be the same, then the operator returns `true`; otherwise, it returns `false`. .Example [source,unlang] ---- if (User-Name == "bob") { ... } ---- // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/condition/index.adoc000066400000000000000000000052651522352605200266700ustar00rootroot00000000000000= Conditional Expressions Conditions are evaluated when parsing xref:if.adoc[if] and xref:elsif.adoc[elsif] statements. These conditions allow the server to make complex decisions based on one of a number of possible criteria. .Syntax [source,unlang] ---- if ( condition ) { ... elsif ( condition ) { ... ---- Conditions are expressed using the following syntax: [options="header"] |===== | Syntax | Description | xref:attr.adoc[&Attribute-Name] | Check for attribute existence. | xref:condition/return_codes.adoc[rcode] | Check return code of a previous module. | xref:condition/operands.adoc[data] | Check value of data. | xref:condition/cmp.adoc[lhs OP rhs] | Compare two kinds of data. | xref:condition/para.adoc[( condition )] | Check sub-condition | xref:condition/not.adoc[! condition] | Negate a conditional check | xref:condition/and.adoc[( condition ) && ...] | Check a condition AND the next one | xref:condition/or.adoc[( condition ) \|\| ...] | Check a condition OR the next one |===== .Examples [source,unlang] ---- if ( &User-Name == "bob" ) { ... } if ( &Framed-IP-Address == 127.0.0.1 ) { ... } if ( &Calling-Station-Id == "%{sql:SELECT ...}" ) { ... } ---- == Load-time Syntax Checks The server performs a number of checks when it loads the configuration files. Unlike version 2, all of the conditions are syntax checked when the server loads. This checking greatly aids in creating configurations that are correct. Where the configuration is incorrect, a descriptive error is produced. This error contains the filename and line number of the syntax error. In addition, it will print out a portion of the line that caused the error and will point to the exact character where the error was seen. These descriptive messages mean that most errors are easy to find and fix. == Load-time Optimizations The server performs a number of optimizations when it loads the configuration files. Conditions that have static values are evaluated and replaced with the result of the conditional comparison. .Example [source,unlang] ---- if ( 0 == 1 ) { ... } ---- The condition `0 == 1` is static and will evaluate to `false`. Since it evaluates to `false`, the configuration inside of the `if` statement is ignored. Any modules referenced inside of the `if` statement will not be loaded. This optimization is most useful for creating configurations that selectively load (or not) certain policies. If the condition above was used in version 2, then the configuration inside of the `if` statement would be loaded, even though it would never be used. // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/condition/not.adoc000066400000000000000000000006561522352605200263600ustar00rootroot00000000000000= The ! Operator .Syntax [source,unlang] ---- ! condition ---- The `!` operator negates the result of the following condition. It returns `true` when _condition_ returns `false`. It returns `false` when _condition_ returns `true`. .Examples `(! (foo == bar))` + `! &User-Name` // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/condition/operands.adoc000066400000000000000000000020151522352605200273620ustar00rootroot00000000000000= Operands .Syntax [source,unlang] ---- string integer "double-quoted string" 'single-quoted string' `back-quoted string` ---- Any text not matching xref:attr.adoc[&Attribute-Name] or xref:condition/return_codes.adoc[Return Code] is interpreted as a value for a particular xref:type/index.adoc[data type]. Double-quoted strings and back-quoted strings are dynamically expanded before the condition is evaluated. Single-quoted strings are static literals and are not dynamically expanded. When used as an existence check, the condition evaluates to `true` if the data is non-zero. Otherwise, the condition evaluates to `false`. For integer existence checks, `0` is `false`; all other values are `true`. For string existence checks, an empty string is `false`. All other strings are `true`. All other data types are disallowed in existence checks. .Examples `"hello there"` + `5` // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/condition/or.adoc000066400000000000000000000010731522352605200261720ustar00rootroot00000000000000= The || Operator .Syntax [source,unlang] ---- (expression-1 || expression-2) ---- The `||` operator performs a short-circuit "or" evaluation of the two expressions. This operator evaluates _condition-1_ and returns `true` if _condition-1_ returns true. Only if _condition-1_ returns `false` is _condition-2_ evaluated and its result returned. .Examples [source,unlang] ---- if (&User-Name || &NAS-IP-Address) { ... ---- // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/condition/para.adoc000066400000000000000000000006401522352605200264740ustar00rootroot00000000000000= The ( ) Operator .Syntax [source,unlang] ---- ( condition ) ---- The `( )` operator returns the result of evaluating the given `condition`. It is used to clarify policies or to explicitly define conditional precedence. .Examples `(foo)` + `(bar || (baz && dub))` // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/condition/regex.adoc000066400000000000000000000134131522352605200266650ustar00rootroot00000000000000= Regular Expressions .Syntax ==== [source,unlang] ---- ( =~ //) ( =~ //[imsux]) ( !~ //) ( !~ //[imsux]) ---- ==== == Matching The regular expression operators perform regular expression matching on the data. The `` field can be an attribute reference or data, as with the other xref:condition/cmp.adoc[comparison] operators. The `//` field must be a valid regular expression. The `=~` operator evaluates to `true` when `data` matches the `//`. Otherwise, it evaluates to `false`. The `!~` operator evaluates to `true` when `data` does not match the `//`. Otherwise, it evaluates to `true`. The regular expression comparison is performed on the _string representation_ of the left side of the comparison. That is, if the left side is an xref:type/numb.adoc[integer], the regular expression will behave is if the value `0` was the literal string `"0"`. Similarly, if the left side is an xref:attr.adoc[&Attribute-Name], then the regular expression will behave is if the attribute was printed to a string, and the match was performed on the resulting string. .Checking if the `User-Name` attribute contains a realm of example.com ==== [source,unlang] ---- if (&User-Name =~ /@example\.com$/) { ... } ---- ==== == Dialects The syntax of the regular expression is defined by the regular expression library available on the local system. FreeRADIUS currently supports: * link:https://www.pcre.org/original/doc/html/[libpcre] and link:https://www.pcre.org/current/doc/html/[libpcre2] both of which provide link:https://en.wikipedia.org/wiki/Perl_Compatible_Regular_Expressions[Perl Compatible Regular expressions]. * Regex support provided by the local libc implementation, usually link:http://en.wikipedia.org/wiki/Regular_expression#POSIX_basic_and_extended[ Posix regular expressions]. [TIP] ==== Use the output of `radiusd -Xxv` to determine which regular expression library is in use. .... ... Debug : regex-pcre : no Debug : regex-pcre2 : yes Debug : regex-posix : no Debug : regex-posix-extended : no Debug : regex-binsafe : yes ... Debug : pcre2 : 10.33 (2019-04-16) - retrieved at build time .... ==== [WARNING] ==== Depending on the regular expression library or libc implementation the server was built against, the pattern matching function available may not be binary safe (see `regex-binsafe` in the output of `radiusd -Xxv`). If a binary safe regex match function is not available, and a match is attempted against a subject that contains one or more `NUL` ('\0') bytes, the match will be aborted, any condition that uses the result will evaluate to false, and a warning will be emitted. ==== == Flags The regular expression `//` may be followed by one or more flag characters. Again, which flags are available depends on the regular expression library the server was built with. Multiple flags may be specified per `/pattern/`. .Flags and their uses [options="header"] |===== | Flag Character | Available with | Effect | `i` | All | Enable case-insensitive matching. | `m` | All | '^' and '$' match newlines within the subject. | `s` | libpcre[2] | '.' matches anything, including newlines. | `u` | libpcre[2] | Treats subjects as UTF8. Invalid UTF8 sequences will result in the match failing. |`x` | libpcre[2] | Allows comments in expressions by ignoring whitespace, and text between '#' and the next newline character. |===== == Subcapture groups When the `=~` or `!~` operators are used, then parentheses in the regular expression will sub capture groups, which contain part of the subject string. The special expansion `%{0}` expands to the portion of the subject that matched. The expansions + `%{1}`..`%{32}` expand to the contents of any subcapture groups. When using libpcre[2], named capture groups may also be accessed using the built-in expansion + `%{regex:}`. Please see the xref:xlat/builtin.adoc#_0_32[xlat documentation] for more information on regular expression matching. .Extracting the 'user' portion of a realm qualified string ==== [source,unlang] ---- if (&User-Name =~ /^(.*)@example\.com$/) { update reply { Reply-Message := "Hello %{1}" } } ---- ==== == Pre-Compiled vs Runtime Compiled When the server starts any regular expressions comparisons it finds will be pre-compiled, and if support is available, JIT'd (converted to machine code) to ensure fast execution. If a pattern contains a xref:xlat/index.adoc[string expansion], the pattern cannot be compiled on startup, and will be compiled at runtime each time the expression is evaluated. The server will also turn off JITing for runtime compiled expressions, as the overhead is greater than the time that would be saved during evaluation. .A runtime compiled regular expression ==== [source,unlang] ---- if (&User-Name =~ /^@%{Tmp-String-0}$/) { ... } ---- ==== To ensure optimal performance you should limit the number of patterns containing xref:xlat/index.adoc[string expansions], and if using PCRE, combine multiple expressions operating on the same subject into a single expression using the PCRE alternation '|' operator. .Using multiple string expansions and the PCRE alternation operator ==== [source,unlang] ---- if (&User-Name =~ /^@(%{Tmp-String-0}|%{Tmp-String-1})$/) { ... } ---- ==== // Licenced under CC-by-NC 4.0. // Copyright (C) 2020 Network RADIUS SAS. // Copyright (C) 2019 Arran Cudbard-Bell // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/condition/return_codes.adoc000066400000000000000000000013721522352605200302500ustar00rootroot00000000000000= The return code Operator .Syntax [source,unlang] ---- rcode ---- The Unlang interpreter tracks the return code of any module, string expansion or keyword that has been called. This return code can be checked in any condition. If the saved return code matches the `code` given here, then the condition evaluates to `true`. Otherwise, it evaluates to `false`. rcodes cannot be set in a condition. rcodes cannot be compared with anything else. The list of valid return codes is as follows: .Return Codes include::partial$rcode_table.adoc[] .Examples [source,unlang] ---- sql if (notfound) { ... } ---- // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/default.adoc000066400000000000000000000021751522352605200252140ustar00rootroot00000000000000= The case Statement .Syntax [source,unlang] ---- case [ ] { [ statements ] } ---- The `case` statement is used to match data inside of a xref:switch.adoc[switch] statement. The `case` statement cannot be used outside of a xref:switch.adoc[switch] statement. The `` text can be an attribute reference such as `&User-Name`, or it can be a xref:type/index.adoc[string]. If the match text is a dynamically expanded string, then the match is performed on the output of the string expansion. The keyword `default` can be used to specify the default action to take inside of a xref:switch.adoc[switch] statement. If no `` text is given, it means that the `case` statement is the "default" and will match all which is not matched by another `case` statement inside of the same xref:switch.adoc[switch]. .Example [source,unlang] ---- switch &User-Name { case "bob" { reject } case &Filter-Id { reject } default { ok } } ---- // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/else.adoc000066400000000000000000000011041522352605200245070ustar00rootroot00000000000000= The else Statement .Syntax [source,unlang] ---- if (condition) { [ statements ] } else { [ statements ] } ---- An xref:if.adoc[if] statement can have an `else` clause. If _condition_ evaluates to `false`, the statements in the xref:if.adoc[if] subsection are skipped and the statements within the `else` subsection are executed. .Example [source,unlang] ---- if (&User-Name == "bob") { reject } else { ok } ---- // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/elsif.adoc000066400000000000000000000023041522352605200246640ustar00rootroot00000000000000= The elsif Statement .Syntax [source,unlang] ---- if (condition-1) { [ statements-1 ] } elsif (condition-2) { [ statements-2 ] } else { [ statements-3 ] } ---- An `elsif` statement is used to evaluate a subsequent xref:condition/index.adoc[condition] after a preceding xref:if.adoc[if] statement evaluates to `false`. In the example above, when _condition-1_ evaluates to false, then _statements-1_ are skipped and _condition-2_ is checked. When _condition-2_ evaluates true, then _statements-2_ are executed. When _condition-2_ evaluates false, then _statements-2_ are skipped and _statements-3_ are executed. As with xref:if.adoc[if], an `elsif` clause does not need to be followed by an xref:else.adoc[else] statement. However, any xref:else.adoc[else] statement must be the last statement in an `elsif` chain. An arbitrary number of `elsif` statements can be chained together to create a series of conditional checks and statements. .Example [source,unlang] ---- if (&User-Name == "bob") { reject } elsif (&User-Name == "doug") { ok } ---- // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/foreach.adoc000066400000000000000000000021011522352605200251640ustar00rootroot00000000000000= The foreach Statement .Syntax [source,unlang] ---- foreach { [ statements ] } ---- The `foreach` statement loops over a set of attributes as given by ``. The loop can be exited early by using the xref:break.adoc[break] keyword. :: The xref:attr.adoc[attribute reference] which will will be looped over. The reference can be to one attribute, to an array, a child, or be a subset. Inside of the `foreach` block, the attribute that is being looped over can be referenced as `Foreach-Variable-0`, through `Foreach-Variable-9`. The last digit is the depth of the loop, starting at "0". The loops can be nested up to eight (8) deep, though this is not recommended. The attributes being looped over cannot be modified or deleted. .Example [source,unlang] ---- foreach &Class { update reply { Reply-Message += "Contains %{Foreach-Variable-0}" } } ---- // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/group.adoc000066400000000000000000000017211522352605200247200ustar00rootroot00000000000000= The group Statement .Syntax [source,unlang] ---- group { [ statements ] } ---- The `group` statement collects a series of statements into a list. The default processing sections of the server (`authorize`, `accounting`, etc.) are also `group` statements. Those sections are given different name for management reasons, but they behave internally exactly like a `group`. [ statements ]:: The `unlang` commands which will be executed. All of the statements inside of the `group` are executed in sequence. The `group` statement is not normally used, as the statements within it can just be placed inside of the enclosing section. However, the `group` statement is included in the `unlang` syntax for completeness. .Examples [source,unlang] ---- group { sql ldap file if (updated) { ... } } ---- // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/if.adoc000066400000000000000000000012471522352605200241650ustar00rootroot00000000000000= The if Statement .Syntax [source,unlang] ---- if (condition) { [ statements ] } ---- .Description The `if` statement evaluates a xref:condition/index.adoc[condition]. When the _condition_ evaluates to `true`, the statements within the subsection are executed. When the _condition_ evaluates to `false`, those statements are skipped. An `if` statement can optionally be followed by an xref:else.adoc[else] or an xref:elsif.adoc[elsif] statement. .Example [source,unlang] ---- if (&User-Name == "bob") { reject } ---- // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/index.adoc000066400000000000000000000121351522352605200246740ustar00rootroot00000000000000= Unlang Policy Language The server supports a simple processing language called "Unlang", which is short for "un-language". The original intention of using an "un-language" was to avoid creating yet another programming language. Instead, the `unlang` syntax allows for simple _if / then / else_ checks, and attribute editing. It does not support recursion, subroutines, or more complex flow controls. Where more complicated functionality is required, we recommend using the `lua`, `perl` or `python` modules. Those modules allow the insertion of full-featured scripts at any point in the packet processing. [NOTE] ==== The documentation is this directory is *reference* documentation. That is, it describes the syntax of `unlang` keywords, using minimal examples. The reference documentation does not, however, describe *when* to use the keywords, or *how* to create policies. Please see the xref:howto:index.adoc[Howto] section for more in-depth "howto" guides. ==== The documentation is organized so that each item is on its own page. The page beings with a description of the item, followed by some text explaining what the item does. The page concludes with one or more examples of using the item in `unlang` policies. The `unlang` processing can be split into some high-level concepts. == Keywords xref:keywords.adoc[Keywords], which are the basic statements of the language, e.g., xref:load-balance.adoc[load-balance], xref:if.adoc[if], xref:else.adoc[else], etc. .Example [source,unlang] ---- load-balance { sql1 sql2 sql3 } ---- == Conditional Expressions xref:condition/index.adoc[Conditional expressions], which are used to check if conditions evaluate to _true_ or _false_. Conditional expressions can be used to control the flow of processing. .Example [source,unlang] ---- if ((&User-Name == "bob") && (&Calling-Station-Id == "00:01:03:04:05")) { ... } ---- == Update Statements xref:update.adoc[Update] statements are used to edit attributes and lists of attributes. Most request packets will result in reply packets that contain additional information for the requestor. The `update` section allows policies to add attributes to requests, replies, or to other places. .Example [source,unlang] ---- update reply { &Session-Timeout := 3600 &Framed-IP-Address := 192.0.2.4 } ---- == String Expansions xref:xlat/index.adoc[String expansion] Using `%{...}` to perform dynamic string expansions. (also known as xref:xlat/index.adoc[xlat]) String expansions are usually performed in order to get additional information which is not immediately available to the policy. This information can be taken from almost any source, including other attributes, databases, and scripts. .Example [source,unlang] ---- update reply { &Framed-IP-Address := "%{sql:SELECT static_ip from table WHERE user = '%{User-Name}'}" } ---- == Data Types Each attribute used by the server has an associated xref:type/index.adoc[data type]. The `unlang` interpreter enforces restrictions on assignments, so that only valid data types can be assigned to an attribute. Invalid assignments result in a run-time error. .Example [source,unlang] ---- update reply { &Framed-IP-Address := 192.0.2.4 &Session-Timeout := 5 &Reply-Message := "hello" } ---- == Design Goals of Unlang The goal of `unlang` is to allow simple policies to be written with minimal effort. Conditional checks can be performed by the policies, which can then update the request or response attributes based on the results of those checks. `unlang` can only be used in a processing section, it cannot be used anywhere else, including in configuration sections for a client or a module. The reason for this limitation is that the language is intended to perform specific actions on requests and responses. The client and module sections contain definitions for a client or module; they do not define how a request is processed. `unlang` uses the same the basic syntax as the configuration files. The syntax of the configuration file for lines, comments, sections, sub-section, etc., all apply to `unlang`. Where `unlang` differs from the basic configuration file format is in complexity and operation. The normal configuration files are _declarative_ and they are _static_. That is, they declare variables and values for those variables. Those values do not change when the server is running. In contrast, `unlang` performs run-time processing of requests. Conditional statements such as xref:if.adoc[if] are evaluated for every packet that is received. Attribute editing statements such as xref:update.adoc[update] can be used to edit attribute contents or lists of attributes. .Example [source,unlang] ---- # First, the keyword 'if' # followed by condition which checks that the User-Name # attribute has value "bob" if (&User-Name == "bob") { # keyword "update" # followed by instructions to add the Reply-Message # attribute to the "reply" list, with contents # "Hello, bob" update reply { Reply-Message := "Hello, bob" } } ---- // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/keywords.adoc000066400000000000000000000053451522352605200254410ustar00rootroot00000000000000= Keywords The following tables list the keywords used in `Unlang`. These keywords implement the "flow control" of the policies. == Flow Control Keywords The _flow control_ keywords allow _if / then / else_ checks, simple looping, etc. .Flow Control [options="header"] [cols="30%,70%"] |===== | Keyword | Description | xref:break.adoc[break] | Exit early from a `foreach` loop. | xref:case.adoc[case] | Match inside of a `switch`. | xref:else.adoc[else] | Do something when an `if` does not match. | xref:elsif.adoc[elsif] | Check for condition when a previous `if` does not match. | xref:foreach.adoc[foreach] | Loop over a list of attributes. | xref:if.adoc[if] | Check for a condition, and execute a sub-policy if it matches. | xref:return.adoc[return] | Immediately stop processing a section. | xref:switch.adoc[switch] | Check for multiple values. |===== == Attribute Editing Keywords The _attribute editing_ keywords allow policies to add, delete, and modify attributes in any list or packet. .Attribute Editing [options="header"] [cols="30%,70%"] |===== | Keyword | Description | xref:update.adoc[update] | Add or filter attributes to a list |===== == Grouping Keywords The _grouping_ keywords allow policies to be organized into groups, including load-balancing. .Grouping [options="header"] [cols="30%,70%"] |===== | Keyword | Description | xref:group.adoc[group] | Group a series of statements. | xref:load-balance.adoc[load-balance] | Define a load balancing group without fail-over. | xref:redundant.adoc[redundant] | Define a redundant group with fail-over. | xref:redundant-load-balance.adoc[redundant-load-balance] | Define a redundant group with fail-over and load balancing. |===== == Module Keywords The _module_ keywords refer pre-packaged libraries that implement specific functionality, such as connecting to SQL, LDAP, etc. The name used here is not the literal string `module`. Instead, it is the name of an instance of a pre-packaged module such as `sql`, or `ldap`, or `eap`. The documentation below describes how to reference modules. That is, how to use `sql`, etc. in the policies. Please see `raddb/mods-available/` for configuration examples for each module. .Modules [options="header"] [cols="30%,70%"] |===== | Keyword | Description | xref:module.adoc[] | Execute a named module, e.g., `sql`. | xref:module_method.adoc[.] | Execute a particular method of a named module, e.g., `pap.authorize` | xref:module_builtin.adoc[reject] | Built-in modules, e.g., `reject`, or `ok`, etc. |===== // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/list.adoc000066400000000000000000000060261522352605200245420ustar00rootroot00000000000000= Attribute Lists An attribute list contains a set of attributes. The allowed lists are: `request`:: Attributes in the incoming request packet. `reply`:: Attributes in the outgoing reply packet. `control`:: Attributes in the internal "control" list that is associated with the request. + The `control` attributes are used to manage how the request is processed. These attributes are never sent in any packet. `session-state`:: Attributes which are maintained across multi-packet exchanges. `proxy-request`:: Attributes in the proxied request packet to a home server. `proxy-reply`:: Attributes in the reply packet from the home server. `coa`:: Attributes in a CoA-Request packet which is sent to a home server. `disconnect`:: Attributes in a Disconnect-Request packet which is sent to a home server. There must be a colon `:` after the list name and before the attribute name. This syntax helps the server to distinguish between list names and attribute names. With the exception of `session-state`, all of the above lists are ephemeral. That is, they exist for one packet exchange, and only one packet exchange. When a reply is sent for a request, the above lists and all attributes are deleted. There is no way to reference an attribute from a previous packet. We recommend using a database to track complex state. The `coa` and `disconnect` lists can only be used when the server receives an Access-Request or Accounting-Request. Use `request` and `reply` instead of `coa` when the server receives a CoA-Request or Disconnect-Request packet. Adding one or more attributes to either of the `coa` or `disconnect` list causes server to originate a CoA-Request or Disconnect-Request packet. That packet is sent when the current Access-Request or Accounting-Request has been finished, and a reply sent to the NAS. See `raddb/sites-available/originate-coa` for additional information. In some cases, requests are associated a multi-packet exchange. For those situations, the `session-state` list is automatically saved when a reply is sent, and it is automatically restored when the next packet in sequence comes in. Once the packet exchange has been finished, the `session-state` list is deleted. In some cases, there is a parent-child relationship between requests. In those situations, it is possible for the policy rules in the child to refer to attributes in the parent. This reference can be made by prefixing the __ name with the `parent` qualifier. The key word `outer` is also a synonym for `parent`. If there are multiple parent-child relationships, the `parent` qualifier can be repeated. There is, however, no way for the parent to refer to the child. When the child is running, the parent is suspended. Once the child finishes, it is deleted, and is no longer accessible to the parent. .Examples `&parent.request.User-Name` + `&parent.reply.Reply-Message` + `&parent.parent.session-state.Filter-Id` // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/load-balance.adoc000066400000000000000000000012271522352605200260670ustar00rootroot00000000000000= The load-balance Statement .Syntax [source,unlang] ---- load-balance { [ statements ] } ---- The `load-balance` section is similar to the `redundant` section except that only one module in the subsection is ever called. In general, the xref:redundant-load-balance.adoc[redundant-load-balance] statement is more useful than this one. [ statements ]:: One or more `unlang` commands. Only one of the statements is executed. .Examples [source,unlang] ---- load-balance &User-Name { sql1 sql2 } ---- // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/module.adoc000066400000000000000000000047311522352605200250550ustar00rootroot00000000000000= Modules .Syntax [source,unlang] ---- ---- The `` statement is a reference to the named module. Common module names include `pap`, `chap`, `files`, `eap`, and `sql`. The `modules { ... }` subsection of `radiusd.conf` contains all of the valid modules. When processing reaches a named module, the pre-compiled module is called. The module may succeed or fail and will return a status code to the `unlang` interpreter detailing success or failure. .Example [source,unlang] ---- chap sql ---- == Module Return Codes When a module is called, it returns one of the following codes to the interpreter; the meaning of each code is detailed to the right of the source, below: .Module Return Codes The below table describes the purpose of the rcodes that may be returned by a module call. In this case the 'operation' referenced in the table is the current module call. include::partial$rcode_table.adoc[] These return codes can be used in a subsequent xref:condition/index.adoc[conditional expression] thus allowing policies to perform different actions based on the behaviour of the modules. .Example [source,unlang] ---- sql if (notfound) { update reply { Reply-Message = "We don't know who you are" } reject } ---- == Module Return Code priority overrides In the case of modules, rcodes can be modified on a per-call basis. Module priority overrides are specified in a block inline with the module call. The format of an override is ` = (0+||return)` - That is, a number greater than or equal to 0, the priority of another rcode, or the special priority `return` which causes the current section to immediately exit. [source, unlang] ---- ldap { <1> fail = 1 <2> ok = handled <3> reject = return <4> } ---- <1> Call to the `ldap` module. <2> Sets the priority of the `fail` rcode to be `1`. If the priority of the rcode for the request is `0`, then the request request rcode will be set to `fail` if the module returns `fail`. <3> Sets the priority of the `ok` rcode to be whatever the default is for `handled` in this section. As the default for `handled` is usually `return`. If `ok` is returned, the current section will immediately exit. <4> Sets the priority of `reject` to be `return`. If the module returns `reject`, the current section will immediately exit. // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/module_builtin.adoc000066400000000000000000000023531522352605200266010ustar00rootroot00000000000000= Built-in Modules In some cases, it is useful to reject a request immediately or perform another action on it. The built-in modules can be used to perform these actions. These modules are named for the return codes given in the xref:module.adoc[module] section. In practice, these modules are implemented by the `always` module and exist so that a success or failure can be forced during the processing of a policy. The names and behaviours of these modules are given below: `fail`:: Causes the request to be treated as if a database failure had occurred. `noop`:: Do nothing. This also serves as an instruction to the configurable failover tracking that nothing was done in the current section. `ok`:: Instructs the server that the request was processed properly. This keyword can be used to over-ride earlier failures if the local administrator determines that the failures are not catastrophic. `reject`:: Causes the request to be immediately rejected. .Example [source,unlang] ---- if (!&User-Name) { update reply { Reply-Message := "We don't know who you are" } reject } ---- // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/module_method.adoc000066400000000000000000000014271522352605200264140ustar00rootroot00000000000000= Module methods .Syntax [source,unlang] ---- . ---- This variant of xref:module.adoc[] is used in one processing section. It calls a module using the method of another processing section. For example, it can be used to call a module's `authorize` method while processing the `post-auth` section. The `` portion must refer to an existing module; the `` portion must refer to processing method supported by that module. Typically, the names of the processing method will be the same as the processing sections. .Example [source,unlang] ---- sql.recv.Accounting-Request files.recv.Access-Request ---- // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/redundant-load-balance.adoc000066400000000000000000000022041522352605200300450ustar00rootroot00000000000000= The redundant-load-balance Statement .Syntax [source,unlang] ---- redundant-load-balance { [ statements ] } ---- The `redundant-load-balance` section operates as a combination of the xref:redundant.adoc[redundant] and xref:load-balance.adoc[load-balance] sections. [ statements ]:: One or more `unlang` commands. + If the selected statement succeeds, then the server stops processing the `redundant-load-balance` section. If, however, that statement fails, then the next statement in the list is chosen (wrapping around to the top). This process continues until either one statement succeeds or all of the statements have failed. + All of the statements in the list should be modules, and of the same type (e.g., `ldap` or `sql`). All of the statements in the list should behave identically, otherwise different requests will be processed through different modules and will give different results. .Example [source,unlang] ---- redundant-load-balance &User-Name { sql1 sql2 sql3 } ---- // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/redundant.adoc000066400000000000000000000023241522352605200255500ustar00rootroot00000000000000= The redundant Statement .Syntax [source,unlang] ---- redundant { [ statements ] } ---- The `redundant` section executes a series of statements in sequence. As soon as one statement succeeds, the rest of the section is skipped. [ statements ]:: One or more `unlang` commands. Processing starts from the first statement in the list. + If the selected statement succeeds, then the server stops processing the `redundant` section. If, however, that statement fails, then the next statement in the list is chosen. This process continues until either one statement succeeds or all of the statements have failed. + All of the statements in the list should be modules, and of the same type (e.g., `ldap` or `sql`). All of the statements in the list should behave identically, otherwise different requests will be processed through different modules and will give different results. In general, we recommend using the xref:redundant-load-balance.adoc[redundant-load-balance] statement instead of `redundant`. .Example [source,unlang] ---- redundant { sql1 sql2 sql3 } ---- // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/return.adoc000066400000000000000000000021571522352605200251070ustar00rootroot00000000000000= The return Statement .Syntax [source,unlang] ---- return ---- The `return` statement is used to exit a processing section such as `authorize`. It behaves similarly to the xref:break.adoc[break] statement, except that it is not limited to being used inside of a xref:foreach.adoc[foreach] loop. The `return` statement is not strictly necessary. It is mainly used to simplify the layout of `unlang` policies. If the `return` statement did not exist, then every xref:if.adoc[if] statement might need to have a matching xref:else.adoc[else] statement. The `return` statement will also exit a policy which is defined in the `policy { ... } ` subsection. This behavior allows policies to be treated as a function call. Any `return` inside of the policy section will only return from that policy. The `return` will _not_ return from the enclosing processing section which called the policy. .Example [source,unlang] ---- sql if (&reply.Filter-Id == "hello") { return } ... ---- // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/return_codes.adoc000066400000000000000000000012741522352605200262630ustar00rootroot00000000000000= Return codes Many operations in the server produce a return code (rcode). The different rcodes give a course indication of whether a particular operation (a module call, string expansion, or keyword) was successful. Unlike return values in other languages, FreeRADIUS' rcodes are are always taken from a fixed compiled-in set. include::partial$rcode_table.adoc[] Return codes propagate through nested unlang sections based on their priority. If a rcode returned by an operation has a higher priority than the current rcode associated with the request, then the request rcode is overwritten. Return code priorities are assigned by the section the module call, expansion or keyword was used in. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/switch.adoc000066400000000000000000000042721522352605200250710ustar00rootroot00000000000000= The switch Statement .Syntax [source,unlang] ---- switch { case { [ statements-1 ] } case { [ statements-2 ] } case { [ statements-3 ] } } ---- A `switch` statement causes the server to evaluate _expansion_, which can be an xref:attr.adoc[&Attribute-Name] or xref:condition/operands.adoc[data]. The result is compared against _match-1_ and _match-2_ to find a match. If no string matches, then the server looks for the default xref:case.adoc[case] statement, which has no associated match. The matching is done via equality. The `switch` statement is mostly syntactic sugar and is used to simplify the visual form of the configuration. It is mostly equivalent to the following use of xref:if.adoc[if] statements: .Nearly equivalent syntax [source,unlang] ---- if ( == ) { [ statements-1 ] } elsif ( == ) { [ statements-2 ] } else { [ statements-3 ] } ---- The only difference between the two forms is that for a `switch` statement, the _expansion_ is evaluated only once. For the equivalent xref:if.adoc[if] statement, the _expansion_ is evaluated again for every xref:if.adoc[if]. If a matching xref:case.adoc[case] is found, the statements within that xref:case.adoc[case] are evaluated. If no matching xref:case.adoc[case] is found, the `case` section with no "match" is evaluated. If there is no such `case { ...}` subsection, then the `switch` statement behaves as if the `case {...}` section was empty. //// For compatibility with version 3, and empty `case` statement can also be used instead of `default`. //// The _match_ text for the xref:case.adoc[case] statement can be an xref:attr.adoc[&Attribute-Name] or xref:type/index.adoc[data]. No statement other than xref:case.adoc[case] can appear in a `switch` statement, and the xref:case.adoc[case] statement cannot appear outside of a `switch` statement. .Example [source,unlang] ---- switch &User-Name { case "bob" { reject } case { ok } } ---- // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/type/000077500000000000000000000000001522352605200237145ustar00rootroot00000000000000freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/type/all_types.adoc000066400000000000000000000051201522352605200265360ustar00rootroot00000000000000= List of Data Types The server support a wide range of data types, both in `unlang` and in the dictionaries. This page outlines the names and functionality of those data types. == Basic Data Types There are a number of "basic" data types. These data types are fixed-size, and encapsulate simple concepts such as "integer" or "IP address". Basic data types can be used in `unlang`, as they contain simple values which can be compared, or assigned to one attribute. In most cases, it is not necessary to know the name of the data type. It is possible to write values in the format you expect, The server will do "the right thing" when interpreting the values. .Basic Data Types [options="header"] [cols="15%,85%"] |===== | Data Type | Description | bool | boolean | date | calendar date | ethernet | Ethernet address | float32 | 32-bit floating point number | float64 | 64-bit floating point number | ifid | interface ID | int8 | 8-bit signed integer | int16 | 16-bit signed integer | int32 | 32-bit signed integer | int64 | 64-bit signed integer | ipaddr | IPv4 address | ipv6addr | IPv6 address | ipv4prefix | IPv4 network with address and prefix length | ipv6prefix | IPv6 network with address and prefix length | octets | raw binary, printed as hex strings | string | printable strings | time_delta | difference between two calendar dates | uint8 | 8-bit unsigned integer | uint16 | 16-bit unsigned integer | uint32 | 32-bit unsigned integer | uint64 | 64-bit unsigned integer |===== === Structural Data Types The following data types are "structural", in that they form parent-child relationships between attributes. These data types can only be used in the dictionaries. They cannot be used in `unlang` statements. .Structural Data Types [options="header"] [cols="15%,85%"] |===== | Data Type | Description | struct | structure which contains fixed-width fields | tlv | type-length-value which contains other attributes | vsa | Encapsulation of vendor-specific attributes |===== === Protocol-Specific Data Types The following data types are used only in certain protocols. These data types can be used only in the dictionaries. They cannot be used in `unlang` statements. .Protocol Specific Data Types [options="header"] [cols="15%,15%,70%"] |===== | Data Type | Protocol | Description | abinary | RADIUS | Ascend binary filters | extended | RADIUS | attributes which "extend" the number space |===== // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/type/double.adoc000066400000000000000000000030731522352605200260210ustar00rootroot00000000000000= Double-Quoted Strings .Syntax `"string"` A double-quoted string is interpreted via the usual rules in programming languages for double quoted strings. The double-quote character can be placed in a string by escaping it with a backslash. Carriage returns and line-feeds can also be used via the usual `\r` and `\n` syntax. The main difference between the single and double quoted strings is that the double quoted strings can be dynamically expanded. The syntax `${...}` is used for parse-time expansion and `%{...}` is used for run-time expansion. The difference between the two methods is that the `${...}` form is expanded when the server loads the configuration files and is valid anywhere in the configuration files. The `%{...}` link:xlat.adoc[string expansion] form is valid only in conditional expressions and attribute assignments. The output of the dynamic expansion can be interpreted as a string, a number, or an IP address, depending on its context. Note that the interpretation of text _strongly_ depends on the context. The text `"0000"` can be interpreted as a data type "integer", having value zero, or a data type "string", having value `"0000"`. In general when a particular piece of text is used, it is used with the context of a known attribute. That attribute has a link:data.adoc[data type], and the text will be interpreted as that data type. .Examples `"word"` + `"a string"` + `"this has embedded\ncharacters"` // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/type/index.adoc000066400000000000000000000103061522352605200256530ustar00rootroot00000000000000= Data Types Unlang supports a number of data types. These data types are used in conditional expressions or when assigning a value to an attribute. == Using Data Types The server support a wide range of data types, as given in the xref:type/all_types.adoc[list of data types] page. The choice of which data type applies is determined by the context in which that data type is used. This context is usually taken from an attribute which is being assigned a value. The `unlang` interpreter uses pre-defined attributes which are defined in dictionaries. The dictionaries define both a name, and a data type for the attributes. In the interpreter, then, attributes can be assigned a value or compared to a value, without specifying the data type. The interpreter knows how to parse the value by using the data type assigned to the attribute. The result is that in most cases, it is not necessary to know the name of the data types. It is possible to write values in the format you expect, and he server will do "the right thing" when interpreting the values. .Attributes with Different Data Types [source,unlang] ---- Framed-IP-Address = 192.0.2.1 Framed-IPv6-Address = 2001:db8:: Reply-Message = "This is a reply" Port-Limit = 5 Boolean = true Octets-Thing = 0xabcdef0102030405 MAC-Address = 00:01:02:03:04:05 ---- == Parsing Data Types The interpreter is flexible when parsing data types. So long as the value can be parsed as the given data type without error, the value will be accepted. For example, a particular attribute may be of data type `ipaddr` in order to store IPv4 addresses. The interpreter will then accept the following strings as valid IPv4 addresses: `192.168.0.2`:: xref:type/string/unquoted.adoc[Unquoted text], interpreted as the data type `'192.168.0.2'`:: xref:type/string/single.adoc[Single-quoted string], the contents of the string are parsed as the data type. + The single-quoted string form is most useful when the data type contains special characters that may otherwise confuse the parser. `"192.168.0.2"`:: xref:type/string/double.adoc[Double-quoted string]. + The contents of the string are dynamically expanded as described in the xref:xlat/index.adoc[dynamic expansion] page. The resulting output is then interpreted as the given data type. `{backtick}/bin/echo 192.168.0.2{backtick}`:: xref:type/string/backticks.adoc[backtick-quoted string]. Run a script, and parse the resulting string as the data type. Similar processing rules are applied when parsing assignments and comparisons, for all attributes and data types. === Casting Data Types In some cases, it is necessary to parse values which do not refer to attributes. This situation usually occurs when two values need to be compared, as in the following example: [source,unlang] ---- if ("%{sql:SELECT ipaddress FROM table WHERE user=%{User-Name}}" == 192.0.2.1) } .... } ---- Since there is no attribute on either side of the `==` operator, the interpreter has no way of knowing that the string `192.0.2.1` is an IP address. There is unfortunately no way of automatically parsing strings in order to determine the data type to use. Any such automatic parsing would work most of the time, but it would have error cases where the parsing was incorrect. The solution is to resolve these ambiguities by allowing the values to be cast to a particular type. Casting a value to a type tells the interpreter how that value should be parsed. Casting is done by prefixing a value with the type name, surrounded by angle brackets; `<...>`. .Syntax ---- <...>value ---- We can add a cast to the above example, as follows: [source,unlang] ---- if ("%{sql:SELECT ipaddress FROM table WHERE user=%{User-Name}}" == 192.0.2.1) } .... } ---- In this example, we prefix the IP address with the string ``. The interpreter then knows that the value `192.0.2.` should be interpreted as the data type `ipaddr`, and not as the literal string `"192.0.2."`. For a full list of data types which can be used in a cast, please see the xref:type/all_types.adoc[list of data types] page, and the "Basic Type Types" section. // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/type/ip.adoc000066400000000000000000000007311522352605200251550ustar00rootroot00000000000000= IP Addresses .Examples `192.0.2.16` + `::1` + `example.com` Depending on the context, a "simple word", as above, may be interpreted as an IPv4 or an IPv6 address. This interpretation is usually done when the string is used in the context of an attribute, or to compare two addresses or assign an address to an attribute. // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/type/numb.adoc000066400000000000000000000003711522352605200255060ustar00rootroot00000000000000= Numbers .Examples `0` + `563` Numbers are unsigned integers that are composed of decimal digits. // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/type/string/000077500000000000000000000000001522352605200252225ustar00rootroot00000000000000freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/type/string/backticks.adoc000066400000000000000000000031771522352605200300200ustar00rootroot00000000000000= Backtick-quoted string .Syntax `{backtick}string{backtick}` The backtick operator is used to perform a run-time expansion similar to what is done with the Unix shell. The contents of the string are split into one or more sub-strings, based on intermediate whitespace. Each substring is then expanded as described above for double quoted strings. The resulting set of strings is used to execute a program with the associated arguments. The output of the program is recorded, and the resulting data is used in place of the input string value. Where the output is composed of multiple lines, any carriage returns and line feeds are replaced by spaces. For safety reasons, the full path to the executed program should be given. In addition, the string is split into arguments _before_ the substrings are dynamically expanded. This step is done both to allow the substrings to contain spaces, and to prevent spaces in the expanded substrings from affecting the number of command-line arguments. For performance reasons, we recommend that the use of back-quoted strings be kept to a minimum. Executing external programs is relatively expensive, and executing a large number of programs for every request can quickly use all of the CPU time in a server. If many programs need to be executed, it is suggested that alternative ways to achieve the same result be found. In some cases, using a real programming language such as `lua`, `perl` or `python` may be better. .Examples `{backtick}/bin/echo hello{backtick}` // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/type/string/double.adoc000066400000000000000000000051321522352605200273250ustar00rootroot00000000000000= Double Quoted Strings .Syntax `"string"` A double-quoted string allows escape sequences and xref:xlat/index.adoc[dynamic expansions]. As with xref:type/string/single.adoc[single-quoted strings], text within double quotes can include spaces. The main difference between the single and double quoted strings is that the double quoted strings can be dynamically expanded. The syntax `${...}` is used for parse-time expansion and `%{...}` is used for run-time expansion. The difference between the two methods is that the `${...}` form is expanded when the server loads the configuration files and is valid anywhere in the configuration files. The `%{...}` xref:xlat/index.adoc[string expansion] form is valid only in conditional expressions and attribute assignments. The output of the dynamic expansion can be interpreted as a string, a number, or an IP address, depending on its context. Note that the interpretation of text _strongly_ depends on the context. The text `"0000"` can be interpreted as a data type "integer", having value zero, or a data type "string", having value `"0000"`. In general when a particular piece of text is used, it is used with the context of a known attribute. That attribute has a xref:type/index.adoc[data type], and the text will be interpreted as that data type. NOTE: Most values retrieved from external datastores will be treated implicitly as double-quoted strings. == Escape sequences Escape sequences allow the inclusion of characters that may be difficult to represent in datastores, or the FreeRADIUS configuration files. .Escape sequences and their descriptions [options="header", cols="15%,85%"] |===== | Escape sequence | Character represented | `\\` | Literal backslash (0x5c) | `\r` | Carriage return (0x0d) | `\n` | Line feed (0x0a) | `\t` | Horizontal tab (0x09) | `\"` | Double quote (0x22) | `\x` | A byte whose numerical value is given by `` interpreted as a hexadecimal number. | `\x` | A byte whose numerical value is given by `` interpreted as an octal number. |===== .Examples `"word"` + `"a string"' + `"foo\"bar\""` + `"this is a long string"` + `"this has embedded\ncharacters"` + `"attribute\tvalue\nusername\t%{User-Name}\nreply-message\t%{reply.Reply-Message}"` `"The result of 'SELECT * FROM foo WHERE 1' is: %{sql:SELECT * FROM foo WHERE 1}"` // Licenced under CC-by-NC 4.0. // Copyright (C) 2019 Arran Cudbard-Bell // Copyright (C) 2019 The FreeRADIUS project. // Copyright (C) 2020 Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/type/string/escaping.adoc000066400000000000000000000007541522352605200276510ustar00rootroot00000000000000= Character Escaping The quotation characters in the above string data types can be escaped by using the backslash, or `\,` character. The backslash character itself can be created by using `\\`. Carriage returns and line feeds can be created by using `\n` and `\r`. .Examples `"I say \"hello\" to you"` + `"This is split\nacross two lines"` // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/type/string/single.adoc000066400000000000000000000010061522352605200273300ustar00rootroot00000000000000= Single Quoted Strings .Syntax `'string'` A single-quoted string is interpreted without any dynamic string expansion. The quotes allow the string to contain spaces, among other special characters. The single quote character can be placed in such a string by escaping it with a backslash. .Examples `'hello'` + `'foo bar`' + `'foo\\'bar'` + `'this is a long string'` // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/type/string/unquoted.adoc000066400000000000000000000013101522352605200277110ustar00rootroot00000000000000= Unquoted Strings Where a series of characters cannot be parsed as a decimal number, they are interpreted as a simple string composed of one word. This word is delimited by spaces, or by other tokens, such as `)` in conditional expressions. This unquoted text is interpreted as simple strings and are generally equivalent to placing the string in single quotes. The interpretation of the text depends on the context, which is usually defined by an attribute which has a xref:type/index.adoc[data type]. .Examples `Hello` + `192.168.0.1` + `00:01:02:03:04:05` // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/update.adoc000066400000000000000000000125151522352605200250510ustar00rootroot00000000000000= The update Statement .Syntax [source,unlang] ---- update [ ] { ... } ---- The `update` statement adds attributes to, or edits the attributes in, the named __. The `update` statement consists of the following syntax elements: :: The attribute list which will be updated. The list is usually `request`, `reply`, or `control`. + If the __ qualifier is omitted, then each entry inside of the `update` section *must* be prefixed with a list name. For example, `&request.User-Name ...` :: The server attribute which is assigned the __. :: The operator such as `=`, `:=`, etc. :: The value which is assigned to the attribute. If the field is a double-quoted string, it undergoes xref:xlat/index.adoc[string expansion], and the resulting value is assigned to the attribute. The update process is atomic, in that either all of the attributes are modified, or none of them are modified. If the `update` fails for any reason, then all of the results are discarded, and the `update` does not affect any server attributes. .Example [source,unlang] ---- update reply { &Reply-Message := "Hello!" &Framed-IP-Address := 192.0.2.4 } ---- == Lists The __ field sets the attribute list that will be updated. If the __ qualifier is omitted, then each entry inside of the `update` section *must* be prefixed with a list name. For example, `&request.User-Name ...` Please see the xref:list.adoc[list] page for valid list names. == Server Attributes The __ field is an attribute name, such as `&Reply-Message`. The attribute name may also be prefixed with a __ qualifier, which overrides the __ given at the start of the `update` section. NOTE: In version 3, the leading `&` is optional but recommended. == Editing Operators The `` field is used to define how the attribute is processed. Different operators allow attributes to be added, deleted, or replaced, as defined below. .Editing Operators [options="header"] [cols="10%,90%"] |===== | Operator | Description | = | Add the attribute to the list, if and only if an attribute of the same name is not already present in that list. | := | Add the attribute to the list. If any attribute of the same name is already present in that list, its value is replaced with the value of the current attribute. | += | Add the attribute to the tail of the list, even if attributes of the same name are already present in the list. | ^= | Add the attribute to the head of the list, even if attributes of the same name are already present in the list. | -= | Remove all attributes from the list that match __. | !* | Delete all occurances of the attribute, no matter what the value. |===== == Filtering Operators The following operators may also be used in addition to the ones listed above. These operators use the __ and __ fields to enforce limits on all attributes in the given __, and to edit attributes which have a matching __ name. All other attributes are ignored. .Filtering Operators [options="header] [cols="10%,90%"] |===== | Operator | Description | == | Keep only the attributes in the list that match __ | < | Keep only the attributes in the list that have values less than __. | \<= | Keep only the attributes in the list that have values less than or equal to __. | > | Keep only the attributes in the list that have values greater than __. | >= | Keep only the attributes in the list that have values greater than or equal to __. | =~ | Keep only the attributes in the list which match the regular expression given in __. | !~ | Keep only the attributes in the list which do not match the regular expression given in __. |===== The `==` operator is very different from the `=` operator listed above. The `=` operator is used to add new attributes to the list, while the `==` operator removes all attributes that do not match the given value. The comparison operators `<`, `<=`, `>`, and `>=` have some additional side effects. Any non-matching value is replaced by the __ given here. If no attribute exists, it is created with the given __. For IP addresses, the operators `>`, `>=`, `<`, and `\<=` check for membership in a network. The __ field should then be a IP network, given in `address/mask` format. .Example [source,unlang] ---- update reply { &Session-timeout := 86400 } ---- .Example [source,unlang] ---- update reply { &Reply-Message += "Rejected: Also, realm does not end with ac.uk" } ---- == Values The __ field is the value which is assigned to the __. The interpretation of the __ field depends on the data type of the contents. For example, if the string `"192.0.2.1"` is assigned to an attribute of the `string` data type, then the result is an ASCII string containing that value. However, if the same string is assigned to an attribute of the `ipaddr` data type, then the result is a 32-bit IPv4 address, with binary value `0xc0000201`. .Example [source,unlang] ---- update reply { &Session-Timeout <= 3600 } ---- // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/xlat/000077500000000000000000000000001522352605200237035ustar00rootroot00000000000000freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/xlat/alternation.adoc000066400000000000000000000012701522352605200270530ustar00rootroot00000000000000= Alternation Syntax Alternation syntax similar to that used in Unix shells may also be used: `%{%{Foo}:-bar}` This code returns the value of `%{Foo}`, if it has a value. Otherwise, it returns a literal string bar. `%{%{Foo}:-%{Bar}}` This code returns the value of `%{Foo}`, if it has a value. Otherwise, it returns the expansion of `%{Bar}`. These conditional expansions can be nested to almost any depth, such as with `%{%{One}:-%{%{Two}:-%{Three}}}`. .Examples `%{%{Stripped-User-Name}:-%{User-Name}}` + `%{%{Framed-IP-Address}:-}` // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/xlat/attribute.adoc000066400000000000000000000032521522352605200265400ustar00rootroot00000000000000= Attribute References Attributes in a list may be referenced via one of the following two syntaxes: `%{Attribute-Name}` + `%{:Attribute-Name}` The `:` prefix is optional. If given, it must be a valid reference to an xref:list.adoc[attribute list]. If the `:` prefix is omitted, then the `request` list is assumed. For EAP methods with tunneled authentication sessions (i.e. PEAP and EAP-TTLS), the inner tunnel session can refer to a list for the outer session by prefixing the list name with `outer.` ; for example, `outer.request`. When a reference is encountered, the given list is examined for an attribute of the given name. If found, the variable reference in the string is replaced with the value of that attribute. Otherwise, the reference is replacedd with an empty string. .Examples `%{User-Name}` + `%{request.User-Name} # same as above` + `%{reply.User-Name}` + `%{outer.request.User-Name} # from inside of a TTLS/PEAP tunnel` Examples of using references inside of a string: `"Hello %{User-Name}"` + `"You, %{User-Name} are not allowed to use %{NAS-IP-Address}"` == Additional Variations `%{Attribute-Name[#]}`:: Returns an integer containing the number of named attributes `%{Attribute-Name[0]}`:: When an attribute appears multiple times in a list, this syntax allows you to address the attributes as with array entries. `[0]` refers to the first attributes, `[1]` refers to the second attribute, etc. `%{Attribute-Name[*]}`:: Returns a comma-separated string containing all values for the named attributes. // Copyright (C) 2020 Network RADIUS SAS. Licenced under CC-by-NC 4.0. // Development of this documentation was sponsored by Network RADIUS SAS. freeradius-3.2.10+dfsg/doc/antora/modules/unlang/pages/xlat/builtin.adoc000066400000000000000000000407161522352605200262110ustar00rootroot00000000000000= Built-In Expansions In addition to storing attribute references, the server has a number of built-in expansions. These expansions act largely as functions which operate on inputs, and produce an output. == Attribute Manipulation === %{length: ... } The `length` expansion returns the size of the input as an integer. When the input is a string, then the output is identical to the `strlen` expansion. When the input is an attribute reference, the output is the size of the attributes data as encoded "on the wire". .Return: _size_ .Determining the length of fixed and variable length attributes ==== [source,unlang] ---- update control { &Tmp-String-0 := "Caipirinha" &Framed-IP-Address := 192.0.2.1 } update reply { &Reply-Message := "The length of %{control:Tmp-String-0} is %{length:&control:Tmp-String-0}" &Reply-Message += "The length of %{control:Framed-IP-Address} is %{length:&control:Framed-IP-Address}" } ---- .Output .... The length of Caipirinha is 10 The length of 192.168.0.2 is 4 .... ==== `length` is built in to the server core. === %{integer:<&ref>} Print the value of the attribute an integer. In normal operation, `integer` attributes are printed using the name given by a `VALUE` statement in a dictionary. Similarly, date attributes are printed as dates, i.e., "January 1 2010. The `integer` expansion applies only to attributes which can be converted to an integer. For all other inputs, it returns `0`. A common usage is to find the difference between two dates. For example, if a request contains `Service-Type = Login-User`, the expansion of `%{integer:&Service-Type}` will yield `1`, which is the value associated with the `Login-User` name. Using `%{integer:&Event-Timestamp}` will return the event timestamp as an unsigned 32-bit number. .Return: _string_ .Determining the integer value of an enumerated attribute ==== [source,unlang] ---- update { &control:Service-Type := Login-User } update reply { &Reply-Message := "The value of Service-Type is %{integer:&control:Service-Type}" } ---- .Output ``` The value of Service-Type is 1 ``` ==== `integer` is built in to the server core. === %{rand:} Generate random number from `0` to `-1`. .Return: _uint64_ .Generating a random number between 0 and 511 ==== [source,unlang] ---- update reply { &Reply-Message := "The random number is %{rand:512}" } ---- .Output ``` The random number is 347 ``` ==== `rand` is provided by the `rlm_expr` module. === %{tag:} CAUTION: This expansion is deprecated and will likely be removed. Returns a list of tags for any attributes found using ````. .Return: _int8_ .Determining the tag value of the second instance of the `radius.Tunnel-Server-Endpoint` attribute ==== [source,unlang] ---- update request { &Tunnel-Server-Endpoint := '192.0.1.1' &Tunnel-Server-Endpoint:1 := '192.0.5.2' &Tunnel-Server-Endpoint:1 += '192.0.3.8' &Tunnel-Server-Endpoint:2 := '192.0.2.1' &Tunnel-Server-Endpoint:2 += '192.0.3.4' } update reply { &Reply-Message := "The tag value of the second instance of Tunnel-Server-Enpoint is %{request:Tunnel-Server-Endpoint[1]}" } ---- .Output ``` The tag value of the second instance of Tunnel-Server-Enpoint is 192.0.5.2 ``` ==== `tag` is built in to the server core. === %{string:} Convert input to a string (if possible). For _octets_ type attributes, this means interpreting the data as a UTF8 string, and inserting octal escape sequences where appropriate. For other types, this means printing the value in its _presentation_ format, i.e. dotted quads for IPv4 addresses, link:https://en.wikipedia.org/wiki/ISO_8601[ISO 8601] time for date types, enumeration values for attributes such as `radius.Service-Type` etc. .Return: _string_ .String interpolation using the raw octets value of Tmp-Octets-0, and the stringified version ==== [source,unlang] ---- update control { &Tmp-Octets-0 := 0x7465737431 } update reply { &Reply-Message := "The string value of %{control:Tmp-Octets-0} is %{string:%{control:Tmp-Octets-0}}" } ---- ==== .Output ``` The string value of 0x7465737431 is test1 ``` `string` is built in to the server core. == Server Manipulation === %{config:} Refers to a variable in the configuration file. See the documentation on configuration file references. .Return: _string_ .Example [source,unlang] ---- "Server installed in %{config:prefix}" "Module rlm_exec.shell_escape = %{config:modules.exec.shell_escape}" ---- .Output ``` Server installed in /opt/freeradius Module rlm_exec.shell_escape = yes ``` `config` is built in to the server core. === %{client:} Refers to a variable that was defined in the client section for the current client. See the sections `client { ... }` in `clients.conf`. .Return: _string_ .Example [source,unlang] ---- "The client ipaddr is %{client:ipaddr}" ---- .Output ``` The client ipaddr is 192.168.5.9 ``` `client` is built in to the server core. === %{debug:} Dynamically change the debug level to something high, recording the old level. .Return: _string_ .Example [source,unlang] ---- authorize { if (&request:User-Name == "bob") { "%{debug:4}" } else { "%{debug:0}" } ... } ---- .Output (_extra informations only for that condition_) ``` ... (0) authorize { (0) if (&request:User-Name == "bob") { (0) EXPAND %{debug:4} (0) --> 2 (0) } # if (&request:User-Name == "bob") (...) (0) filter_username { (0) if (&State) { (0) ... (0) } ... ``` `debug` is built in to the server core. === %{debug_attr:} Print to debug output all instances of current attribute, or all attributes in a list. expands to a zero-length string. .Return: _string_ .Example [source,unlang] ---- authorize { if (&request:User-Name == "bob") { "%{debug_attr:request[*]}" } ... } ---- .Output ``` ... (0) authorize { (0) if (&request:User-Name == "bob") { (0) Attributes matching "request[*]" (0) &request:User-Name = bob (0) &request:User-Password = hello (0) &request:NAS-IP-Address = 127.0.1.1 (0) &request:NAS-Port = 1 (0) &request:Message-Authenticator = 0x9210ee447a9f4c522f5300eb8fc15e14 (0) EXPAND %{debug_attr:request[*]} (0) } # if (&request:User-Name == "bob") (...) ... ``` `debug_attr` is built in to the server core. == String manipulation === %{lpad:<&ref> } Left-pad a string. .Return: _string_ .Example [source,unlang] ---- update control { &Tmp-String-0 := "123" } update reply { &Reply-Message := "Maximum should be %{lpad:&control:Tmp-String-0 11 0}" } ---- .Output ``` Maximum should be 00000000123 ``` `lpad` is provided by the `rlm_expr` module. === %{rpad:<&ref> } Right-pad a string. .Return: _string_ .Example [source,unlang] ---- update control { &Tmp-String-0 := "123" } update reply { &Reply-Message := "Maximum should be %{rpad:&control:Tmp-String-0 11 0}" } ---- .Output ``` Maximum should be 12300000000 ``` `rpad` is provided by the `rlm_expr` module. === %{pairs:<&list:[*]>} Serialize attributes as comma-delimited string. .Return: _string_ .Example [source,unlang] ---- update { &control:Tmp-String-0 := "This is a string" &control:Tmp-String-0 += "This is another one" } update reply { &Reply-Message := "Serialize output: %{pairs:&control[*]}" } ---- .Output ``` Serialize output: Tmp-String-0 = \"This is a string\"Tmp-String-0 = \"This is another one\" ``` `pairs` is provided by the `rlm_expr` module. === %{randstr: ...} Get random string built from character classes. .Return: _string_ .Example [source,unlang] ---- update reply { &Reply-Message := "The random string output is %{randstr:aaaaaaaa}" } ---- .Output ``` The random string output is 4Uq0gPyG ``` `randstr` is provided by the `rlm_expr` module. === %{strlen: ... } Length of given string. .Return: _integer_ .Example [source,unlang] ---- update control { &Tmp-String-0 := "Caipirinha" } update reply { &Reply-Message := "The length of %{control:Tmp-String-0} is %{strlen:&control:Tmp-String-0}" } ---- .Output ``` The length of Caipirinha is 21 ``` `strlen` is built in to the server core. === %{tolower: ... } Dynamically expands the string and returns the lowercase version of it. This definition is only available in version 2.1.10 and later. .Return: _string_ .Example [source,unlang] ---- update control { &Tmp-String-0 := "CAIPIRINHA" } update reply { &Reply-Message := "tolower of %{control:Tmp-String-0} is %{tolower:%{control:Tmp-String-0}}" } ---- .Output ``` tolower of CAIPIRINHA is caipirinha ``` `tolower` is provided by the `rlm_expr` module. === %{toupper: ... } Dynamically expands the string and returns the uppercase version of it. This definition is only available in version 2.1.10 and later. .Return: _string_ .Example [source,unlang] ---- update control { &Tmp-String-0 := "caipirinha" } update reply { &Reply-Message := "toupper of %{control:Tmp-String-0} is %{toupper:%{control:Tmp-String-0}}" } ---- .Output ``` toupper of caipirinha is CAIPIRINHA ``` `toupper` is provided by the `rlm_expr` module. == String Conversion === %{base64: ... } Encode a string using Base64. .Return: _string_ .Example [source,unlang] ---- update control { &Tmp-String-0 := "Caipirinha" } update reply { &Reply-Message := "The base64 of %{control:Tmp-String-0} is %{base64:%{control:Tmp-String-0}}" } ---- .Output ``` The base64 of foo is Q2FpcGlyaW5oYQ== ``` `base64` is provided by the `rlm_expr` module. === %{base64tohex: ... } Decode a base64 string (e.g. previously encoded using `base64`) to hex. .Return: _string_ .Example [source,unlang] ---- update control { &Tmp-String-0 := "Q2FpcGlyaW5oYQ==" } update reply { &Reply-Message := "The base64tohex of %{control:Tmp-String-0} is %{base64tohex:%{control:Tmp-String-0}}" } ---- .Output ``` The base64decode of Q2FpcGlyaW5oYQ== is 436169706972696e6861 ``` `base64tohex` is provided by the `rlm_expr` module. === %{hex: ... } Convert to hex. .Return: _string_ .Example [source,unlang] ---- update control { &Tmp-String-0 := "12345" } update reply { &Reply-Message := "The value of %{control:Tmp-String-0} in hex is %{hex:%{control:Tmp-String-0}}" } ---- .Output ``` The value of 12345 in hex is 3132333435 ``` `hex` is built in to the server core. === %{urlquote: ... } Quote URL special characters. .Return: _string_. .Example [source,unlang] ---- update { &control:Tmp-String-0 := "http://example.org/" } update reply { &Reply-Message += "The urlquote of %{control:Tmp-String-0} is %{urlquote:%{control:Tmp-String-0}}" } ---- .Output ``` The urlquote of http://example.org/ is http%3A%2F%2Fexample.org%2F ``` `urlquote` is provided by the `rlm_expr` module. === %{urlunquote: ... } Unquote URL special characters. .Return: _string_. .Example [source,unlang] ---- update { &control:Tmp-String-0 := "http%%3A%%2F%%2Fexample.org%%2F" # Attention for the double %. } update reply { &Reply-Message += "The urlunquote of %{control:Tmp-String-0} is %{urlunquote:%{control:Tmp-String-0}}" } ---- .Output ``` The urlunquote of http%3A%2F%2Fexample.org%2F is http://example.org/ ``` `urlunquote` is provided by the `rlm_expr` module. == Hashing and Encryption === %{hmacmd5: } Generate `HMAC-MD5` of string. .Return: _octal_ .Example [source,unlang] ---- update { &control:Tmp-String-0 := "mykey" &control:Tmp-String-1 := "Caipirinha" } update { &control:Tmp-Octets-0 := "%{hmacmd5:%{control:Tmp-String-0} %{control:Tmp-String-1}}" } update reply { &Reply-Message := "The HMAC-MD5 of %{control:Tmp-String-1} in octets is %{control:Tmp-Octets-0}" &Reply-Message += "The HMAC-MD5 of %{control:Tmp-String-1} in hex is %{hex:control:Tmp-Octets-0}" } ---- .Output ``` The HMAC-MD5 of Caipirinha in octets is \317}\264@K\216\371\035\304\367\202,c\376\341\203 The HMAC-MD5 of Caipirinha in hex is 636f6e74726f6c3a546d702d4f63746574732d30 ``` `hmacmd5` is provided by the `rlm_expr` module. === %{hmacsha1: } Generate `HMAC-SHA1` of string. .Return: _octal_ .Example [source,unlang] ---- update { &control:Tmp-String-0 := "mykey" &control:Tmp-String-1 := "Caipirinha" } update { &control:Tmp-Octets-0 := "%{hmacsha1:%{control:Tmp-String-0} %{control:Tmp-String-1}}" } update reply { &Reply-Message := "The HMAC-SHA1 of %{control:Tmp-String-1} in octets is %{control:Tmp-Octets-0}" &Reply-Message += "The HMAC-SHA1 of %{control:Tmp-String-1} in hex is %{hex:control:Tmp-Octets-0}" } ---- .Output ``` The HMAC-SHA1 of Caipirinha in octets is \311\007\212\234j\355\207\035\225\256\372Ê™>R\"\341\351O) The HMAC-SHA1 of Caipirinha in hex is 636f6e74726f6c3a546d702d4f63746574732d30 ``` `hmacsha1` is provided by the `rlm_expr` module. === %{md5: ... } Dynamically expands the string and performs an MD5 hash on it. The result is binary data. .Return: _binary data_ .Example [source,unlang] ---- update control { &Tmp-String-0 := "Caipirinha" } update reply { &Reply-Message := "md5 of %{control:Tmp-String-0} is octal=%{md5:%{control:Tmp-String-0}}" &Reply-Message := "md5 of %{control:Tmp-String-0} is hex=%{hex:%{md5:%{control:Tmp-String-0}}}" } ---- .Output ``` md5 of Caipirinha is octal=\024\204\013md||\230\243\3472\3703\330n\251 md5 of Caipirinha is hex=14840b6d647c7c98a3e732f833d86ea9 ``` `md5` is provided by the `rlm_expr` module. == Miscellaneous Expansions === +%{0}+..+%{32}+ `%{0}` expands to the portion of the subject that matched the last regular expression evaluated. `%{1}`..`%{32}` expand to the contents of any capture groups in the pattern. Every time a regular expression is evaluated, whether it matches or not, the numbered capture group values will be cleared. === +%{regex:}+ Return named subcapture value from the last regular expression evaluated. Results of named capture groups are available using the `%{regex:}` expansion. They will also be accessible using the numbered expansions described xref:#_0_32[above]. Every time a regular expression is evaluated, whether it matches or not, the named capture group values will be cleared. [NOTE] ==== This expansion is only available if the server is built with libpcre or libpcre2. Use the output of `radiusd -Xxv` to determine which regular expression library in use. .... ... Debug : regex-pcre : no Debug : regex-pcre2 : yes Debug : regex-posix : no Debug : regex-posix-extended : no Debug : regex-binsafe : yes ... Debug : pcre2 : 10.33 (2019-04-16) - retrieved at build time .... ==== `regex` is built in to the server core. === +%{nexttime: