- Freeradius-Devel - lists.freeradius.org

A Suggestion for rlm_ldap.
by Alister Winfield 24 Mar '11

24 Mar '11

A problem we have had and will continue to have without a small change to rlm_ldap's connection handling is that it defeats the ability of a load balancer to do its job. The issue being that if there is a temporary problem or maintenance on a bunch of LDAP servers all the active connections can end up on a tiny proportion of the servers. I understand that doing 1 query per connection would be terrible for performance so how about have 'max-requests-per-connection' in the code and drop the current connection after doing that many searches. Roughly (and untested) something like this. dogmatix:rlm_ldap alister$ git diff diff --git a/src/modules/rlm_ldap/rlm_ldap.c b/src/modules/rlm_ldap/rlm_ldap.c index 450279b..5eb1834 100644 --- a/src/modules/rlm_ldap/rlm_ldap.c +++ b/src/modules/rlm_ldap/rlm_ldap.c @@ -78,6 +78,10 @@ RCSID("$Id$") #define MAX_FAILED_CONNS_RESTART 4 #define MAX_FAILED_CONNS_START 5 +/* When connecting to a server farm its a good idea to reconnect regularly + * to allow a load balancer to do its job correctly.*/ +#define MAX_REQUESTS_PER_CONNECTION 2000 + #ifdef NOVELL_UNIVERSAL_PASSWORD /* Universal Password Length */ @@ -116,6 +120,7 @@ typedef struct ldap_conn { char bound; char locked; int failed_conns; + int query_count; #ifdef HAVE_PTHREAD_H pthread_mutex_t mutex; #endif @@ -856,12 +861,21 @@ retry: } conn->bound = 1; conn->failed_conns = 0; + conn->query_count = 0; + } + /* If we have performed greater than a fixed number of queries on this connection force a reconnect */ + if (conn->query_count > MAX_REQUESTS_PER_CONNECTION) { + conn->bound=0; + conn->query_count=0; + goto retry; } tv.tv_sec = inst->timeout; tv.tv_usec = 0; DEBUG2(" [%s] performing search in %s, with filter %s", inst->xlat_name, search_basedn ? search_basedn : "(null)" , filter); + + conn->query_count++; switch (ldap_search_st(conn->ld, search_basedn, scope, filter, attrs, 0, &tv, result)) { case LDAP_SUCCESS: @@ -1939,7 +1953,6 @@ static int ldap_authenticate(void *instance, REQUEST * request) if (conn1->failed_conns >= MAX_FAILED_CONNS_END){ conn1->failed_conns = MAX_FAILED_CONNS_RESTART; conn1->bound = 0; - } } retry: if (!conn1->bound || conn1->ld == NULL) { @@ -1955,6 +1968,7 @@ retry: } conn1->bound = 1; conn1->failed_conns = 0; + conn1->query_count = 0; } RDEBUG("Performing NMAS Authentication for user: %s, seq: %s \n", user_dn,seq);

1 0

GIT Log for 2011-03-24 00:33 GMT
by aland＠deployingradius.com 24 Mar '11

24 Mar '11

commit 2ecf8834ccf04ce0bda3041eae6dfa31384d47e6 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Mar 23 08:59:22 2011 +0100 Move illegal attributes around And enable the Motorola VSA dictionary Files changed: share/dictionary | 1 + share/dictionary.motorola | 14 -------------- share/dictionary.motorola.illegal | 26 ++++++++++++++++++++++++++ 3 files changed, 27 insertions(+), 14 deletions(-) ====================================================================== commit 228dff83d838803a2ab1771586b6a5298bfe4120 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Mar 23 17:19:18 2011 +0100 Note borken vendor-specific version of a dictionary Files changed: share/dictionary.wimax.alvarion | 514 +++++++++++++++++++++++++++++++++++++++ 1 files changed, 514 insertions(+), 0 deletions(-) ====================================================================== commit e352207c94e5eb45b2d22b5755c015251e7c021b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Mar 23 08:41:38 2011 +0100 Remove trailing whitespace Files changed: share/format.pl | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) ====================================================================== commit 555d3fd980f68ac2b6482395f76ea9206b92916d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Mar 23 08:41:21 2011 +0100 More Canopy attributes as posted to the list Files changed: share/dictionary.motorola | 66 ++++++++++++++++++++++++++++++++++++++++++--- 1 files changed, 62 insertions(+), 4 deletions(-) ====================================================================== commit ed47fb829f1ca16518b773bbd7b0c3cfa2fdebe6 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Mar 23 08:40:21 2011 +0100 Fix typos Files changed: share/dictionary.3gpp | 22 ++++++++++++++++++++-- 1 files changed, 20 insertions(+), 2 deletions(-) ====================================================================== commit d9c534dd80cb18ee43d18df5002663214d84f980 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Mar 20 08:11:05 2011 +0100 Clearer warnings about unsupported operators Files changed: src/main/evaluate.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) ====================================================================== commit 933d4cf6763591f1cc8bfd17dad966decc1fe69b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Mar 20 08:10:47 2011 +0100 Expose API to get token names Files changed: src/include/token.h | 1 + src/lib/token.c | 5 +++++ 2 files changed, 6 insertions(+), 0 deletions(-) ====================================================================== commit c86f16b8cdf2dd90825c9282d196e1fafee46309 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Mar 19 16:16:12 2011 +0100 How RADIUS should be done. Files changed: doc/rfc/rfc6158.txt | 2131 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 2131 insertions(+), 0 deletions(-) ====================================================================== commit ce1480146a0101064e0a2359b9ed399aa1234eba Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Mar 17 10:28:38 2011 +0100 Fix build error in test environment Files changed: src/main/modcall.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit a1eebb57c2fe6b86c3affa7cb27b311d65432611 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Mar 16 15:20:28 2011 +0100 Note extended-vendor-specific formats Files changed: man/man5/dictionary.5 | 10 +++++++--- 1 files changed, 7 insertions(+), 3 deletions(-) ======================================================================

1 0

Motorola Canopy Dictionary
by Ben Wiechman 23 Mar '11

23 Mar '11

Updated dictionary for Motorola Canopy. Used with the RADIUS auth/authz supported under Release 11.0+ Ben

2 1

Unlang and !*
by Brian Candler 20 Mar '11

20 Mar '11

Just a minor point: unlang accepts the syntax if (Foo !* "any") { ... } but it doesn't behave in the same way as !* in a 'users' file. =* and !* are not documented as being available as comparison operators in unlang (only as filtering operators), and there's no particular need for them since you can instead write if (!Foo) { ... } But I think it would be better if it rejected them outright as a syntax error if you tried to use them. It has caused some local confusion recently. Regards, Brian.

2 1

GIT Log for 2011-03-17 00:33 GMT
by aland＠deployingradius.com 17 Mar '11

17 Mar '11

commit 03f1be4fb804522267b3c62b9dc0751efe350662 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Mar 16 15:17:24 2011 +0100 Allow VSAs of "evs" data type Files changed: src/lib/dict.c | 6 +++--- src/lib/radius.c | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) ====================================================================== commit ed958ed0981ed082bb2095c1f25e1f83f8ece043 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Mar 16 15:11:16 2011 +0100 Set "flags.is_tlv" correctly Files changed: src/lib/dict.c | 4 +--- src/lib/radius.c | 2 +- 2 files changed, 2 insertions(+), 4 deletions(-) ====================================================================== commit 25f7276880ee3321e97f94b88473fb9adaa2f71e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Mar 16 15:09:57 2011 +0100 More descriptive errors in the dictionary parser Files changed: src/lib/dict.c | 49 +++++++++++++++++++++++++++++++++++++++++++------ 1 files changed, 43 insertions(+), 6 deletions(-) ====================================================================== commit d4e2a5d11f022f7ab648e2f656115aa43beda01b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Mar 16 13:51:20 2011 +0100 Fix TLV encoding. This seems to be better, as it encodes VSA TLVs correctly. The previous code (vp2attr_tlvs) called do_next_tlv() with the NEXT attribute, which was wrong. Files changed: src/lib/radius.c | 65 +++++++++++++++++++++++++++++++++-------------------- 1 files changed, 40 insertions(+), 25 deletions(-) ====================================================================== commit ae06a5e359c39f3db79bc7df6cc72d70543620d8 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Mar 16 13:48:02 2011 +0100 Handle invalid formats for extended attributes Files changed: src/lib/print.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit ee170c57224a2ea55813bd765ff9b33dc909f66d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Mar 16 11:48:38 2011 +0100 VSA incomplete decode means decode the attribute as "raw" Files changed: src/lib/radius.c | 10 ++++++---- 1 files changed, 6 insertions(+), 4 deletions(-) ====================================================================== commit e8ae8a3b4782a3cef55105308012dfbb36105eea Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Mar 16 11:26:04 2011 +0100 Expose rad_print_hex, and use it in radsniff Files changed: src/include/libradius.h | 1 + src/lib/radius.c | 4 +--- src/main/radsniff.c | 1 + 3 files changed, 3 insertions(+), 3 deletions(-) ====================================================================== commit 48f452518fa30ddb377eb0efb58c279396df9ee8 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Mar 16 10:44:31 2011 +0100 Updated for latest features Files changed: man/man5/dictionary.5 | 123 +++++++++++++++++++++++++++++++++---------------- 1 files changed, 83 insertions(+), 40 deletions(-) ====================================================================== commit ca4e6291a37b260b3d0017a0c4e8dea52fd6bdb7 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Mar 16 08:20:54 2011 +0100 Allow VSAs to be specified as 26.9.1 This makes the OID parsing pretty generic, and it should now work for all attributes. Files changed: src/lib/dict.c | 28 ++++++++++++++++++++++++++++ 1 files changed, 28 insertions(+), 0 deletions(-) ====================================================================== commit e4762aa6d5a7f32dbbea3f23ecd26a2b99717b46 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Mar 16 08:06:45 2011 +0100 Added conflicting dictionary. Alvarion has what, 3-4 different dictionaries for the same vendor space? Files changed: share/dictionary.alvarion.wimax.v2_2 | 34 ++++++++++++++++++++++++++++++++++ 1 files changed, 34 insertions(+), 0 deletions(-) ======================================================================

1 0

GIT Log for 2011-03-16 00:33 GMT
by aland＠deployingradius.com 16 Mar '11

16 Mar '11

commit 7968925c95795767ee89a2b8663b0ebcfe4865fc Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Mar 15 17:23:22 2011 +0100 Fix compilation errors Files changed: src/main/modcall.c | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-) ====================================================================== commit 65c08416da75f9b1c607bd58f1827f3a639eead1 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Mar 15 15:22:47 2011 +0100 VP encoding routines now take "const" VP. This means that the API is just a little cleaner.. Files changed: src/include/libradius.h | 11 ++-- src/lib/radius.c | 138 +++++++++++++++++++++++++++-------------------- src/main/radattr.c | 7 +-- 3 files changed, 88 insertions(+), 68 deletions(-) ====================================================================== commit 0df697522d306234d902415c3876b8c4d4be4f23 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Mar 15 15:22:17 2011 +0100 Id is unsigned for printing Files changed: src/main/event.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 748472c8f43df54d4bc9851dc2bb4c2db538e263 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Mar 15 15:19:27 2011 +0100 Added more "const" to functions. This won't make a difference in practice, but it's cleaner. Files changed: src/include/libradius.h | 12 ++++++------ src/lib/filters.c | 2 +- src/lib/misc.c | 2 +- src/lib/print.c | 8 ++++---- 4 files changed, 12 insertions(+), 12 deletions(-) ====================================================================== commit 6ecd67c51cd73f69656bf5adef85021381df1f20 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Mar 15 14:52:20 2011 +0100 Quiet compiler warning Files changed: src/lib/valuepair.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 2f1e11482d5f148f76d150e08414f6ce5cb2b91b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Mar 15 11:40:55 2011 +0100 Update encoder/decode to use new wimax flags Files changed: src/lib/radius.c | 34 +++++++++++++++++++++------------- 1 files changed, 21 insertions(+), 13 deletions(-) ====================================================================== commit 37ee1cef27e85d3a5603dff03fad7fc989fa94b2 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Mar 15 11:31:42 2011 +0100 Add a "wimax" format flag to the attributes. This is in preparation for horrible Alvarion hacks Files changed: src/include/libradius.h | 1 + src/lib/dict.c | 9 +++++++++ 2 files changed, 10 insertions(+), 0 deletions(-) ====================================================================== commit 390f6efd70ad2a4172bc63d7373a4e0064280d6c Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Mar 15 11:27:47 2011 +0100 Fix build error Files changed: src/modules/rlm_sqlcounter/rlm_sqlcounter.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) ====================================================================== commit 0b2727f7e85e3f904c6a2a8c3a291656e604462f Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Mar 15 09:45:11 2011 +0100 If select() returns an error, show it to the user. Helps to address bug #149 However, the underlying issue still isn't fixed. It isn't clear why select() returns an error. An alternate solution might be to simply re-do all of the FD_SET stuff, in the hope that the cached version was wrong. Files changed: src/lib/event.c | 4 +++- src/main/radiusd.c | 12 +++++++++--- 2 files changed, 12 insertions(+), 4 deletions(-) ====================================================================== commit 3161e60705e553789d421c70b7f3e4f3b6c27b95 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Mar 15 09:34:54 2011 +0100 Note bad configuration The sqlcounter module does it's own expansion. This doesn't seem to work. Files changed: raddb/modules/sqlcounter_expire_on_login | 15 ++++++++++++++- src/modules/rlm_sqlcounter/rlm_sqlcounter.c | 2 ++ 2 files changed, 16 insertions(+), 1 deletions(-) ====================================================================== commit 497465d96daa19805d7926cd0732144f321d6723 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Mar 14 14:15:21 2011 +0100 Updated command list radmin -e "help -r" | perl -ne 's/^(.*) - /\n/;$foo = $1; $foo =~ s/\ /\\ /g;print ".IP ", $foo;print;' > foo Files changed: man/man8/radmin.8 | 26 ++++++++++++++++++++++---- 1 files changed, 22 insertions(+), 4 deletions(-) ======================================================================

1 0

Re: Possible bug in configurable failover
by Brian Candler 15 Mar '11

15 Mar '11

Alan DeKok wrote: > The "update" section should behave identically to the "if". It doesn't at the moment. Version 1 policy.conf: testing_module { if (1) { update reply { Reply-Message += "Foo" } } if (1) { update reply { Reply-Message += "Bar" } } ok } Results: $ bin/radtest steve badpass localhost 1 testing123 Sending Access-Request of id 69 to 127.0.0.1 port 1812 User-Name = "steve" User-Password = "badpass" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=69, length=25 Reply-Message = "Foo" $ Version 2 policy.conf: testing_module { #if (1) { update reply { Reply-Message += "Foo" } #} #if (1) { update reply { Reply-Message += "Bar" } #} ok } Results: $ bin/radtest steve badpass localhost 1 testing123 Sending Access-Request of id 33 to 127.0.0.1 port 1812 User-Name = "steve" User-Password = "badpass" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=33, length=81 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 172.16.3.33 Framed-IP-Netmask = 255.255.255.0 Framed-Routing = Broadcast-Listen Filter-Id = "std.ppp" Framed-MTU = 1500 Framed-Compression = Van-Jacobson-TCP-IP Reply-Message = "Foo" Reply-Message = "Bar" $ So: without the 'ifs', the three sections are run sequentially (update, update, ok). With the 'ifs', only the first section is run. Authenticate section has: Auth-Type PAP { pap { ok = return reject = 1 } testing_module } Regards, Brian.

2 8

Possible bug in logging duplicate requests
by Alexandr Kovalenko 15 Mar '11

15 Mar '11

Hello! I've found that when duplicate request found it is logged with (probably) wrong printf pattern: src/main/event.c line 2574: ------------------ radlog(L_ERR, "Discarding duplicate request from " "client %s port %d - ID: %d due to unfinished request %u", client->shortname, request->packet->src_port,request->packet->id, request->number); break; ----------------- Due to 'ID: %d' I'm getting negative IDs in log: Tue Mar 15 11:46:57 2011 : Error: Discarding duplicate request from client dhcp port 67 - ID: -2021971096 due to unfinished request 977 I think it should be changed to '%u'. -- Alexandr Kovalenko http://uafug.org.ua/

2 1

Possible bug in configurable failover
by Brian Candler 15 Mar '11

15 Mar '11

I think I've found a bug in configurable failover - or at least, it doesn't correspond to any behaviour I can see documented, but I thought I'd raise it here before making a ticket. To replicate: start with stock freeradius 2.1.x, uncomment the "steve" entry from the users file, and apply the following config changes: --- etc/raddb/sites-available/default.orig 2011-03-13 19:48:20.584961000 +0000 +++ etc/raddb/sites-available/default 2011-03-13 19:47:09.244961001 +0000 @@ -237,7 +237,11 @@ # in the 'authorize' section supplies a password. The # password can be clear-text, or encrypted. Auth-Type PAP { - pap + pap { + ok = return + reject = 1 + } + testing_module } # --- etc/raddb/policy.conf.orig 2011-03-13 19:48:26.154961000 +0000 +++ etc/raddb/policy.conf 2011-03-13 19:49:45.434961000 +0000 @@ -194,4 +194,18 @@ noop } } + + testing_module { + if (1) { + update reply { + Reply-Message += "Foo" + } + } + if (1) { + update reply { + Reply-Message += "Bar" + } + ok + } + } } The idea is using a module to turn an access reject into an access reject under certain circumstances. It just happens to have two separate 'if' statements (and this is what triggers the bug) Everything is fine if you give the correct password for steve. If you give the wrong password, something strange happens: $ bin/radtest steve badpass localhost 1 testing123 Sending Access-Request of id 221 to 127.0.0.1 port 1812 User-Name = "steve" User-Password = "badpass" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=221, length=25 Reply-Message = "Foo" You can see that only the first 'if' statement has been executed, and then it has dropped out of the module entirely, keeping the reject status. As a workaround, you can insert a 'noop': --- etc/raddb/policy.conf.orig 2011-03-13 19:48:26.154961000 +0000 +++ etc/raddb/policy.conf 2011-03-13 19:57:42.294961000 +0000 @@ -194,4 +194,19 @@ noop } } + + testing_module { + if (1) { + update reply { + Reply-Message += "Foo" + } + noop + } + if (1) { + update reply { + Reply-Message += "Bar" + } + ok + } + } } And then it behaves how I would have expected in the first place, without the noop: $ bin/radtest steve badpass localhost 1 testing123 Sending Access-Request of id 159 to 127.0.0.1 port 1812 User-Name = "steve" User-Password = "badpass" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=159, length=81 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 172.16.3.33 Framed-IP-Netmask = 255.255.255.0 Framed-Routing = Broadcast-Listen Filter-Id = "std.ppp" Framed-MTU = 1500 Framed-Compression = Van-Jacobson-TCP-IP Reply-Message = "Foo" Reply-Message = "Bar" Any thoughts as to what is going on here? Thanks, Brian.

2 3

GIT Log for 2011-03-15 00:33 GMT
by aland＠deployingradius.com 15 Mar '11

15 Mar '11

commit c3b5aa29a3c7d1afaca8a4d054e563246fa7fe26 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Mar 14 14:01:28 2011 +0100 Check pre-condictions "inject file" requires "inject to" and "inject from" Files changed: src/main/command.c | 10 ++++++++++ 1 files changed, 10 insertions(+), 0 deletions(-) ====================================================================== commit 721c32b3b3e1ee2e01c8b1ac7b5e81566ce3480c Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Mar 14 12:04:56 2011 +0100 If the source address is INADDR_ANY, don't use udpfromto It breaks various systems. Closes bug #148 Files changed: src/lib/radius.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) ====================================================================== commit 767ac8bafc62350df0f47ce5e606636e1593b3c8 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Mar 14 11:59:53 2011 +0100 More sanity checks on decoding extended attrs Files changed: src/lib/radius.c | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-) ====================================================================== commit 90ef1ab273bba4fb29501b1b8582eade8072e313 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Mar 14 11:56:32 2011 +0100 Enforce numerical limits on "extended" attributes. They can only be in the range 241..255. This ensures that the internal code which packs the attribute number into the high octet of the vendor ID will work. If it allowed "extended" attrs to be 1..30 (or so), other things might potentially screw up internally Files changed: src/lib/dict.c | 11 ++++++++++- 1 files changed, 10 insertions(+), 1 deletions(-) ====================================================================== commit 38715dfceba904c0569d1800186e0c967c188c8a Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Mar 14 10:25:45 2011 +0100 Moved USR/ascend illegal dictionaries back to share/ raddb/dictionary is *not* changed on an upgrade, so removing those dictionaries from share/dictionary means that they might be surprisingly removed from the local configuration, and break things. That would be bad. Files changed: raddb/dictionary.in | 17 ----------------- share/dictionary | 9 +++++++-- 2 files changed, 7 insertions(+), 19 deletions(-) ======================================================================

1 0