Merge branch 'master' into remaining_missing_locks

.clang-format

@@ -16,7 +16,7 @@ SortIncludes: false
 # after the opening brace, and before the closing brace.
 #
 # static conf_parser_t group_config[] = {
-#	{ FR_CONF_OFFSET("filter", FR_TYPE_STRING, rlm_ldap_t, groupobj_filter) }
+#	{ FR_CONF_OFFSET("filter", rlm_ldap_t, groupobj_filter) }
 # };
 #
 ContinuationIndentWidth: 8

.github/contributing.md

@@ -20,7 +20,7 @@ The GitHub issue tracker is for non-security related defect reports, feature req
 pull-requests ONLY.
 
 It is not for support requests or questions regarding configuration/operation of the server, they
-belong on the [users mailing list](http://freeradius.org/list/users.html).
+belong on the [users mailing list](https://freeradius.org/support/).
 
 Raising support requests or questions as issues will result in them being closed and locked.  If you
 continue to raise these questions as issues you will be banned from the FreeRADIUS project's GitHub
@@ -35,7 +35,7 @@ exploited.  This ensures that patches can be developed before the exploit is mad
 ### Before reporting a defect
 
 Verify it's still present in the Git HEAD.  Checkout the appropriate branch for the version of the
-server you're working with, as listed [here](http://doc.freeradius.org), build the server and attempt
+server you're working with, as listed [here](https://doc.freeradius.org), build the server and attempt
 to reproduce your issue.
 
 The [ChangeLog](https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/doc/ChangeLog) for the
@@ -63,28 +63,28 @@ If you're developing a new feature, module, or writing large amounts of code to
 a member of the FreeRADIUS development team first.  For simpler one or two line fixes go ahead and
 open a pull-request immediately.
 
-The dev team can be contacted via the [devel mailing list](http://freeradius.org/list/devel.html),
+The dev team can be contacted via the [devel mailing list](https://freeradius.org/support/),
 or via GitHub by using the GitHub issue tracker.
 
 Contacting the dev team gives us the opportunity to offer feedback.  We may have a solution to your
 problem that doesn't require additional code, or may have ideas as to how your problem can be solved
 in a way that will better fit with the long-term vision for the server.
 
 Once you've got the go ahead, please read through the
-[coding standards document](http://wiki.freeradius.org/contributing/coding-standards).
+[coding standards document](https://wiki.freeradius.org/contributing/coding-standards).
 
 If you're creating a new module you may wish to read the
-[module creation guide](http://wiki.freeradius.org/contributing/Modules3).
+[module creation guide](https://wiki.freeradius.org/contributing/Modules3).
 
-You may also wish to utilise the [doxygen site](http://doc.freeradius.org) to review code documentation.
+You may also wish to utilise the [doxygen site](https://doc.freeradius.org) to review code documentation.
 
 The doxygen site contains the complete reference of all API functions with doxygen headers as well
 as structs and callback declarations.  <https://doc.freeradius.org> is updated within one minute of each
 commit to the master branch of the freeradius-server repository.
 
 Finally, this file was written to be displayed automatically on the GitHub issue tracker, so
 Git/GitHub knowledge is assumed.  If you're wondering what a pull-request is, this document may be of
-some use <http://wiki.freeradius.org/contributing/GitHub>.
+some use <https://wiki.freeradius.org/contributing/GitHub>.
 
 
 ## Continuous Integration Tests (CIT)

.github/workflows/ci-deb.yml

@@ -125,7 +125,7 @@ jobs:
 
     - name: Install build dependencies
       run: |
-        apt-get install -y --no-install-recommends build-essential devscripts quilt
+        apt-get install -y --no-install-recommends build-essential devscripts quilt fakeroot
         debian/rules debian/control
         mk-build-deps -irt"apt-get -y" debian/control
       working-directory: freeradius

.github/workflows/ci-freebsd.yml

@@ -74,6 +74,7 @@ jobs:
             libidn               \
             libmemcached         \
             libpcap              \
+            libyubikey           \
             lua52                \
             luajit-devel         \
             mysql80-client       \

.github/workflows/ci-macos.yml

@@ -93,6 +93,7 @@ jobs:
           json-c \
           libidn \
           libmemcached \
+          libyubikey \
           llvm@14 \
           luajit \
           mariadb \

.vscode/settings.json

@@ -1,4 +1,7 @@
 {
 	"files.trimTrailingWhitespace": true,
-	"files.insertFinalNewline": true
+	"files.insertFinalNewline": true,
+	"[diff]" : {
+		"files.trimTrailingWhitespace": false
+	}
 }

README.md

@@ -70,8 +70,8 @@ which includes WARNINGs about common issues, and suggestions for how
 they may be fixed.
 
 The debug output is explained in detail in the
-[radiusd-X](http://wiki.freeradius.org/radiusd-X) page on the
-[wiki](http://wiki.freeradius.org).
+[radiusd-X](https://wiki.freeradius.org/radiusd-X) page on the
+[wiki](https://wiki.freeradius.org).
 
 Many questions are answered on the Wiki:
 
@@ -87,7 +87,7 @@ the FreeRADIUS mailing lists.
 <https://freeradius.org/support/>
 
 Instructions for what to post on the mailing list are [on the
-wiki](http://wiki.freeradius.org/list-help).  Please note that we DO
+wiki](https://wiki.freeradius.org/list-help).  Please note that we DO
 recommend posting the output of `radiusd -X`.  That information shows
 what the server is doing when it receives packets, and how it
 processes those packets.

configure

@@ -614,7 +614,7 @@ PACKAGE_TARNAME='freeradius'
 PACKAGE_VERSION='$Id$'
 PACKAGE_STRING='freeradius $Id$'
 PACKAGE_BUGREPORT='http://bugs.freeradius.org'
-PACKAGE_URL='http://www.freeradius.org'
+PACKAGE_URL='https://freeradius.org'
 
 ac_unique_file="src/bin/radiusd.c"
 # Factoring default headers for most tests.
@@ -14418,7 +14418,7 @@ main (void)
 {
 
       void *sym[1];
-      backtrace_symbols(&sym, sizeof(sym))
+      backtrace_symbols(sym, sizeof(sym))
   ;
   return 0;
 }

configure.ac

@@ -431,7 +431,7 @@ dnl   sed -e 's%src/modules/.*/% (sub)- %; s%.*/%- %' |\
 dnl   awk '{print "                            "$0}']))
 
 AC_ARG_ENABLE(strict-dependencies,
-[  --enable-strict-dependencies  fail configure on lack of module dependancy.])
+[  --enable-strict-dependencies  fail configure on lack of module dependency.])
 
 AC_ARG_ENABLE(werror,
 [  --enable-werror         causes the build to fail if any warnings are generated.],
@@ -1970,7 +1970,7 @@ if test "x$developer" = "xyes"; then
   fi
 
   dnl #
-  dnl #  Can't use mutliple -fsanitize flags, so we need to combine
+  dnl #  Can't use multiple -fsanitize flags, so we need to combine
   dnl #  the values into one.
   dnl #
   fsanitizeflags=
@@ -2163,7 +2163,7 @@ if test "x$ac_cv_header_execinfo_h" = "xyes"; then
       #include <execinfo.h>
     ]], [[
       void *sym[1];
-      backtrace_symbols(&sym, sizeof(sym)) ]])],[
+      backtrace_symbols(sym, sizeof(sym)) ]])],[
       AC_MSG_RESULT(yes)
       ac_cv_lib_execinfo_backtrace_symbols="yes"
     ],[
@@ -2653,7 +2653,7 @@ case "$target" in
     dnl #  and LLDB throws an EXC_BAD_INSTRUCTION exception.
     dnl #
     dnl #  OpenSSL installs a SIGILL handler to catch the signal but this
-    dnl #  is also overriden by lldb.
+    dnl #  is also overridden by lldb.
     dnl #
     dnl #  To allow us to debug on macOS + LLDB + ARM we need to ignore
     dnl #  this exception and ignore SIGILL.

debian/README.rfc

@@ -4,7 +4,7 @@ so we can't ship them in Debian main.  They are all available from the
 original freeradius tarball, available at
 ftp://ftp.freeradius.org/pub/radius/
 and from
-http://www.rfc-editor.org/
+https://www.rfc-editor.org/
 
 Sorry for the inconvenience.
 

debian/control.in

@@ -42,7 +42,7 @@ Priority: optional
 Maintainer: Network RADIUS SARL <[email protected]>
 Uploaders: Stephen Gran <[email protected]>, Mark Hymers <[email protected]>
 Standards-Version: 3.9.6
-Homepage: http://www.freeradius.org/
+Homepage: https://freeradius.org/
 
 Package: freeradius
 Architecture: any

debian/freeradius.default

@@ -1,4 +1,4 @@
-# Options passed to the FreeRADIUS deamon.
+# Options passed to the FreeRADIUS daemon.
 #
 FREERADIUS_OPTIONS=""
 

debian/freeradius.service

@@ -1,7 +1,7 @@
 [Unit]
 Description=FreeRADIUS multi-protocol policy server
 After=network-online.target
-Documentation=man:radiusd(8) man:radiusd.conf(5) http://wiki.freeradius.org/ http://networkradius.com/doc/
+Documentation=man:radiusd(8) man:radiusd.conf(5) https://wiki.freeradius.org/ https://freeradius.org/documentation/freeradius-server/
 
 [Service]
 Type=notify

debian/libfreeradius4.install

@@ -1,5 +1,6 @@
 usr/lib/freeradius/libfreeradius-arp.so
 usr/lib/freeradius/libfreeradius-bfd.so
+usr/lib/freeradius/libfreeradius-bio.so
 usr/lib/freeradius/libfreeradius-control.so
 usr/lib/freeradius/libfreeradius-dns.so
 usr/lib/freeradius/libfreeradius-eap-aka-sim.so

debian/patches/radiusd-to-freeradius.diff

@@ -56,21 +56,24 @@ Index: freeradius-server/raddb/sites-available/control-socket
 ===================================================================
 --- freeradius-server.orig/raddb/sites-available/control-socket
 +++ freeradius-server/raddb/sites-available/control-socket
-@@ -82,12 +82,12 @@ server control {
+@@ -68,7 +68,7 @@ server control {
  			#
- 			#  uid:: Name of user who is allowed to connect to the control socket.
+ 			#  Note that the control socket cannot have uid of 0.
  			#
 -#			uid = radius
 +#			uid = freerad
 
  			#
- 			#  gid:: Name of group that is allowed to connect to the control socket.
+ 			#  gid:: Name of group which owns the control socket.
+@@ -80,7 +80,7 @@ server control {
+ 			#
+ 			#  Note that the control socket cannot have gid of 0.
  			#
 -#			gid = radius
 +#			gid = freerad
 
  			#
- 			#  Access mode.
+ 			#  mode:: Access mode.
 Index: freeradius-server/src/bin/radiusd.c
 ===================================================================
 --- freeradius-server.orig/src/bin/radiusd.c

doc/all.mk

@@ -72,10 +72,6 @@ clean: clean.doc
 CONF_FILES := $(filter-out %~,$(wildcard raddb/*conf raddb/mods-available/* raddb/sites-available/* raddb/dictionary))
 BASE_ADOC_FILES := $(wildcard doc/*.adoc doc/*/*.adoc doc/*/*/*.adoc) doc/raddb/mods-available/all_modules.adoc
 
-# don't automatically re-build raddb/ -> doc/*.adoc
-ifneq "$(findstring asciidoc,$(MAKECMDGOALS))" ""
-AUTO_ADOC_FILES := $(patsubst raddb/%,doc/raddb/%.adoc,$(CONF_FILES))
-endif
 ADOC_FILES	:= $(BASE_ADOC_FILES) $(AUTO_ADOC_FILES)
 PDF_FILES := $(patsubst doc/%.adoc,doc/%.pdf,$(ADOC_FILES))
 HTML_FILES := $(filter %html,$(patsubst doc/%.adoc,doc/%.html,$(ADOC_FILES)) \
@@ -207,6 +203,11 @@ doc/antora/modules/raddb/pages/%.adoc: raddb/%
 	${Q}perl -pi -e 's/^# ([^ \t])/#  $$1/;s/^([ \t]+)# ([^ \t])/$$1#  $$2/;s/[ \t]+$$//' $^
 	${Q}./scripts/asciidoc/conf2adoc -t -a ${top_srcdir}/asciidoc -o $@ < $^
 
+#
+#  Simple rule for lazy people.
+#
+.PHONY: doc.raddb
+doc.raddb: $(patsubst raddb/%,doc/antora/modules/raddb/pages/%.adoc,$(CONF_FILES))
 
 #
 #  antora rebuilds the entire documentation site on each run

doc/antora/modules/ROOT/pages/index.adoc

@@ -121,7 +121,7 @@ major version upgrade.
 == Getting Started with FreeRADIUS
 
 FreeRADIUS can be installed using the pre-built packages available
-from http://packages.networkradius.com[Network RADIUS,
+from https://packages.networkradius.com[Network RADIUS,
 window="_blank"]. That page contains packages for all common OS
 distributions.  New packages are available as soon as a new version
 has been released.  Packages for older releases are also available for
@@ -133,7 +133,7 @@ xref:installation:index.adoc[installation guide] for instructions.
 WARNING: Many Operating System distributions ship versions of FreeRADIUS
 which are years out of date. Those versions may contain bugs which have
 been fixed in newer releases. We recommend using the
-http://packages.networkradius.com[Network RADIUS, window="_blank"] packages where
+https://packages.networkradius.com[Network RADIUS, window="_blank"] packages where
 possible.
 
 Administrators who are new to FreeRADIUS should read the
@@ -178,21 +178,21 @@ debug output. In many cases, those messages describe exactly what is
 going wrong, and how to fix it.
 
 For further details, about the debug output see the
-http://wiki.freeradius.org/radiusd-X[radiusd-X, window="_blank"] page on the
-http://wiki.freeradius.org[wiki, window="_blank"].
+https://wiki.freeradius.org/radiusd-X[radiusd-X, window="_blank"] page on the
+https://wiki.freeradius.org[wiki, window="_blank"].
 
 == Getting Help
 
 We also recommend joining the
-http://lists.freeradius.org/mailman/listinfo/freeradius-users[mailing
+https://lists.freeradius.org/mailman/listinfo/freeradius-users[mailing
 list] in order to ask questions and receive answers. The developers are
 not on Stack Overflow, IRC, or other web sites. While the FreeRADIUS
 source is available on
 https://github.com/FreeRADIUS/freeradius-server/[GitHub, window="_blank"], questions
 posted there will not be answered.
 
 Before posting to the list, please read the
-http://wiki.freeradius.org/list-help[list help, window="_blank"] page. That page explains
+https://wiki.freeradius.org/list-help[list help, window="_blank"] page. That page explains
 how to run the server in debugging mode; how to understand the debug
 output; and what information to post to the list.
 

doc/antora/modules/developers/pages/contributing.adoc

@@ -49,7 +49,7 @@ be broken out into another, separate, commit.
 See the following links for more details about submitting via github:
 
 * https://help.github.com/articles/fork-a-repo
-* http://wiki.freeradius.org/contributing/GitHub
+* https://wiki.freeradius.org/contributing/GitHub
 
 == Submitting patches via email
 

doc/antora/modules/developers/pages/dbuff.adoc

@@ -45,7 +45,7 @@ the use of the buffer.  The functions normally return the number of
 bytes which have been used, so that the caller can adjust the pointer
 and length (adding to the former and subtracting from the latter).
 
-This method works, but there are some limitations
+This method works, but there are some limitations:
 
 * For encoders the buffer cannot be extended, which means the length
   of the buffer must be determined prior to calling the encoder.
@@ -68,7 +68,7 @@ the `fr_dbuff_t` structure in the source. The structure contains:
   operating on the same buffer are members of a singly linked list.
 
 The Encoding and decoding functions are passed pointers to dbuffs.
-Each function does its' work, updates the pointer to the next byte,
+Each function does its work, updates the pointer to the next byte,
 and then returns.  The caller can then just encode / decode multiple
 tokens in a row, with minimal additional overhead.
 
@@ -170,7 +170,7 @@ FR_DBUFF_FOO_RETURN(dbuff, ...);
 instead of
 [source,c]
 ----
-f ((val = fr_dbuff_foo(dbuff, ...) < 0) return val;
+if ((val = fr_dbuff_foo(dbuff, ...) < 0) return val;
 ----
 
 letting one return an error to the caller without cluttering the code.

doc/antora/modules/developers/pages/sbuff-ng.adoc

@@ -13,7 +13,7 @@
 ## Fixes
 ### Marker release
 
-Current sbuffs require markers to be tracked because the marker's pointer needs to be updated is the sbuff is shifted,
+Current sbuffs require markers to be tracked because the marker's pointer needs to be updated as the sbuff is shifted,
 
 Using offsets relative to the start of the current sbuff removes the tracking requirement and means that the markers no longer need to be updated.
 

doc/antora/modules/howto/pages/index.adoc

@@ -6,11 +6,11 @@ common deployment scenarios.
 
 If you have a topic you'd like to see included in the list of howtos, contact
 the developers on the
-link:http://lists.freeradius.org/mailman/listinfo/freeradius-users[User's
+link:https://lists.freeradius.org/mailman/listinfo/freeradius-users[User's
 mailing list].
 
 Some of the documents here started life as pages on
-link:http://wiki.freeradius.org[wiki.freeradius.org].  If you've just been
+link:https://wiki.freeradius.org[wiki.freeradius.org].  If you've just been
 through a particularly arduous service configuration and deployment, and would
 like to help your fellow users, then please create a new how to on the wiki.
 If it's popular enough, we'll include it in the official documentation for the

doc/antora/modules/howto/pages/modules/eap/index.adoc

@@ -337,7 +337,7 @@ respond with `EAP-Acknowledge` (`EAP-MD5`). Server now responds with
 EAP, EAP-MD5, and EAP-MSCHAPv2 do not require any additional packages.
 Freeradius contains all the required packages.
 
-For EAP-TLS, EAP-TTLS, and PEAP, OPENSSL, http://www.openssl.org/, is
+For EAP-TLS, EAP-TTLS, and PEAP, OPENSSL, https://www.openssl.org/, is
 required to be installed. Any version from 0.9.7, should fairly work
 with this module.
 

doc/antora/modules/howto/pages/modules/ldap/authorization/groups.adoc

@@ -143,7 +143,7 @@ appropriately.
 
 [source,unlang]
 ----
-if (%ldap.memberof(cn=foo,ou=groups,dc=example,dc=com) == true) {
+if (%ldap.memberof("cn=foo,ou=groups,dc=example,dc=com") == true) {
 	&reply.Reply-Message := "Welcome member of group 'foo'"
 }
 ----
@@ -152,7 +152,7 @@ if (%ldap.memberof(cn=foo,ou=groups,dc=example,dc=com) == true) {
 
 [source,unlang]
 ----
-if (%ldap.memberof(foo) == true) {
+if (%ldap.memberof("foo") == true) {
 	&reply.Reply-Message := "Welcome member of group 'foo'"
 }
 ----