FreeRADIUS/freeradius-server — pull request #746 by hartmans (2014-07-28 18:19:41+00:00)
Title: Trust router integration

Alan, here's the pull request that will require significant review and modifications to add configure support.

A couple of things to point out/think about during your review.
First, you talked about wanting to have a separate module other than rlm_realm. I can see the desire, but I'll also note that we use 100% of the code from rlm_realm. You ant to be able to set the delimiter, etc for splitting user from realm, and we use all that. So, if you want a module boundary it's perhaps better to have it to be around what to do if you find the realm string in the user but cannot find the realm in your current configuration.

for configure, I recommend making sure you have trust_router/tid.h and that libtr_tid contains the symbol tid_srvr_get_dh. That will make sure you have new enough trust router code.

we'd appreciate it if you would dual license trust_router_integ.c with its existing bsd license and the FreeRADIUS GPL license. Your contract with JANET certainly doesn't require this but it would make it convenient if we ever end up wanting to pull logic from that file into the BSD-licensed trust router project. If that doesn't work for you we totally understand.

There's an xxx comment you'll want to think about. Currently we free the home_pool when we update it. We add a talloc_reference to keep home servers around for live requests and sockets. However there's still a race when freeing the auth_pool. If one request is in the load balance code looking to select a home server at the time we free the auth pool in another thread, badness will happen. We could add a mutex, but that seems way overkill. Instead, what I'd really like to do is to somehow convince the main loop to free the auth_pool about 30 seconds or a minute or so from now. Basically some facility for saying please throw away this talloc context after some reasonable time (perhaps max life time of a request) would be really convenient.

Also, as mentioned above there are two places where we do add calls to talloc_reference. I think that's OK because once successfully created home_servers are never directly talloc_freed, so you don't need to worry about the difference between talloc_free and talloc_unlink.