Config file include order bug?

[Sven Hartge]

On 15.07.20 13:51, Sven Hartge wrote:
> Hello!
> 
> I just noticed something strange with 3.0.21 from buster-backports.
> 
> I have a custom policy in policy.d/thm_rada uses another policy from 
> policy.d/canonicalization and this works in my test system:
> 
> [...]
> including files in directory /etc/freeradius/3.0/policy.d/
> including configuration file /etc/freeradius/3.0/policy.d/control
> including configuration file /etc/freeradius/3.0/policy.d/rfc7542
> including configuration file /etc/freeradius/3.0/policy.d/canonicalization
> including configuration file /etc/freeradius/3.0/policy.d/abfab-tr
> including configuration file /etc/freeradius/3.0/policy.d/dhcp
> including configuration file /etc/freeradius/3.0/policy.d/thm_rada
> including configuration file /etc/freeradius/3.0/policy.d/debug
> including configuration file /etc/freeradius/3.0/policy.d/accounting
> including configuration file /etc/freeradius/3.0/policy.d/eap
> including configuration file /etc/freeradius/3.0/policy.d/cui
> including configuration file /etc/freeradius/3.0/policy.d/filter
> including configuration file 
> /etc/freeradius/3.0/policy.d/moonshot-targeted-ids
> including configuration file /etc/freeradius/3.0/policy.d/operator-name
> including files in directory /etc/freeradius/3.0/sites-enabled/
> including configuration file /etc/freeradius/3.0/sites-enabled/default
> main {
>   security {
>          user = "freerad"
>          group = "freerad"
> [...]
> 
> Now I tar'ed and copied the whole /etc/freeradius/ structure to my new 
> to-be-production system and this happens:
> 
> [...]
> including files in directory /etc/freeradius/3.0/policy.d/
> including configuration file /etc/freeradius/3.0/policy.d/eap
> including configuration file /etc/freeradius/3.0/policy.d/control
> including configuration file /etc/freeradius/3.0/policy.d/operator-name
> including configuration file /etc/freeradius/3.0/policy.d/debug
> including configuration file /etc/freeradius/3.0/policy.d/abfab-tr
> including configuration file /etc/freeradius/3.0/policy.d/thm_rada
> /etc/freeradius/3.0/policy.d/thm_rada[6]: Reference 
> "${policy.mac-addr-regexp}" not found
> /etc/freeradius/3.0/policy.d/thm_rada[6]: Parse error expanding ${...} 
> in condition
> Errors reading or parsing /etc/freeradius/3.0/radiusd.conf
> [...]
> 
> Notice how the load-order is different? It seems freeradius does not 
> load the files in alphanumeric order but in the order the filesystem 
> presents them, breaking the parsing of policy.d/thm_rada in this case 
> because policy.d/canonicalization hasn't been parsed yet.

Adding to that:

On the working system the output of "ls -fl" shows the file/dirctory 
order as follows:

-rw-r----- 1 freerad freerad  581 Jan 29 08:43 control
-rw-r----- 1 freerad freerad 1610 Jan 29 08:43 rfc7542
-rw-r----- 1 freerad freerad 2704 Jan 29 09:29 canonicalization
-rw-r----- 1 freerad freerad 2787 Jan 29 08:43 abfab-tr
-rw-r----- 1 freerad freerad  644 Jan 29 08:43 dhcp
-rw-r--r-- 1 freerad freerad  564 Jan 29 09:30 thm_rada
-rw-r----- 1 freerad freerad 1010 Jan 29 08:43 debug
-rw-r----- 1 freerad freerad 4202 Jan 29 08:43 accounting
-rw-r----- 1 freerad freerad 1320 Jan 29 08:43 eap
drwxr-xr-x 9 freerad freerad 4096 Apr 23 10:58 ..
-rw-r----- 1 freerad freerad 3847 Jan 29 08:43 cui
-rw-r----- 1 freerad freerad 4746 Jan 29 08:43 filter
drwxr-xr-x 2 freerad freerad 4096 Apr 23 10:58 .
-rw-r----- 1 freerad freerad 8201 Jan 29 08:43 moonshot-targeted-ids
-rw-r----- 1 freerad freerad 1323 Jan 29 08:43 operator-name

And this matches the load order in freeradius.

And on the non-working system it is:

-rw-r----- 1 freerad freerad 1320 Jul 15 14:03 eap
-rw-r----- 1 freerad freerad  581 Jul 15 14:03 control
-rw-r----- 1 freerad freerad 1323 Jul 15 14:03 operator-name
-rw-r----- 1 freerad freerad 1010 Jul 15 14:03 debug
drwxr-xr-x 2 freerad freerad 4096 Jul 15 14:03 .
-rw-r----- 1 freerad freerad 2787 Jul 15 14:03 abfab-tr
-rw-r--r-- 1 freerad freerad  564 Jul 15 14:03 thm_rada
-rw-r----- 1 freerad freerad 3847 Jul 15 14:03 cui
-rw-r----- 1 freerad freerad 4746 Jul 15 14:03 filter
-rw-r----- 1 freerad freerad 4202 Jul 15 14:03 accounting
drwxr-xr-x 9 freerad freerad 4096 Jul 15 13:53 ..
-rw-r----- 1 freerad freerad 8201 Jul 15 14:03 moonshot-targeted-ids
-rw-r----- 1 freerad freerad 2704 Jul 15 14:03 canonicalization
-rw-r----- 1 freerad freerad 1610 Jul 15 14:03 rfc7542
-rw-r----- 1 freerad freerad  644 Jul 15 14:03 dhcp

Also interesting: If I copy the files away and then copy them back, the 
same order persists, so there is at least some stability here.

It just doesn't change the fact that this breaks freeradius for me, 
unless I manually finagle the file order in the directory every time I 
make a change.

Grüße,
Sven.