On 11 Mar 2015, at 11:33, Alan DeKok <aland@deployingradius.com> wrote:
On Mar 11, 2015, at 11:30 AM, Graham Leggett <minfrin@sharp.fm> wrote:
I don’t follow - how does libldap work with software like httpd, but not work with freeradius? Many of the other users open connections and keep them open, or open connections in a child process. Not many use multiple threads and open/close connections.
It's because mod_ldap uses a global SSL configuration context. We use per connection configuration contexts, as that's the only way to ensure the module instance specific TLS parameters are honoured. If you attempted to use multiple TLS certificates with mod_ldap you would likely find that it did not work at intended. If you tried the same configuration with FreeRADIUS, it would work as intended. The mod_ldap code is available here: http://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ldap/util_ldap.c The github issue describes the root cause in greater detail: https://github.com/FreeRADIUS/freeradius-server/pull/866 This seems like an NSS defect TBH. It should do reference counting for its modules, to ensure they're not referenced by multiple contexts, so that they're not unintentionally unloaded when contexts are freed. TL;DR mod_ldap is broken in other ways which happens to mask this issue. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2