Index: .hgignore
===================================================================
--- .hgignore	(revision 6)
+++ .hgignore	(revision 0)
@@ -9,3 +9,2 @@
 core.*
 .svn
-*.pcap
Index: ca/rebuild_tree.sh
===================================================================
--- ca/rebuild_tree.sh	(revision 13)
+++ ca/rebuild_tree.sh	(revision 0)
@@ -7,5 +7,4 @@
 # General-use client and server
 make newcert ca=mgr.testbed.aaa name=client
-make newcert ca=mgr.testbed.aaa name=client2
 make newcert ca=mgr.testbed.aaa name=server
 
@@ -41,10 +40,3 @@
 make newcert ca=eap.testbed.aaa name=gw.eap.testbed.aaa
 make newcert ca=eap.testbed.aaa name=backend.eap.testbed.aaa
-make newcert ca=eap.testbed.aaa name=supauth2.eap.testbed.aaa
 
-# Interop testbed
-make newca ca=mgr.testbed.aaa name=iop.testbed.aaa
-make newcert ca=iop.testbed.aaa name=fdrelay.iop.testbed.aaa
-make newcert ca=iop.testbed.aaa name=crcumcli.iop.testbed.aaa
-make newcert ca=iop.testbed.aaa name=crcumsrv.iop.testbed.aaa
-
Index: conf/backend.eap.testbed.aaa/freeDiameter/CMakeFlags
===================================================================
--- conf/backend.eap.testbed.aaa/freeDiameter/CMakeFlags	(revision 9)
+++ conf/backend.eap.testbed.aaa/freeDiameter/CMakeFlags	(revision 0)
@@ -1,10 +1,5 @@
 -DBUILD_DBG_MONITOR:BOOL=ON 
 -DBUILD_APP_ACCT:BOOL=ON 
--DBUILD_TESTING:BOOL=OFF 
--DCMAKE_BUILD_TYPE:STRING=DebugValgrind
+-DSKIP_TESTS:BOOL=ON 
+-DCMAKE_BUILD_TYPE:STRING=Debug 
 -DDEFAULT_CONF_PATH:PATH=/root/conf/freeDiameter
--DBUILD_APP_DIAMEAP:BOOL=ON
--DBUILD_EAP_IDENTITY:BOOL=ON
--DBUILD_EAP_MD5:BOOL=ON
--DBUILD_EAP_TLS:BOOL=ON
-
Index: nf/backend.eap.testbed.aaa/freeDiameter/app_diameap.conf
===================================================================
--- conf/backend.eap.testbed.aaa/freeDiameter/app_diameap.conf	(revision 7)
+++ 	(revision )
@@ -1,44 +1,0 @@
-##### a sample Configuration file for DiamEAP
-
-# MySQL Database settings
-# Specify connection parameters for DiamEAP MySQL database:
-# - username and password to connect to the MySQL Server
-# - databaseserver : the MySQL server location. It can be the IP address or the host name where MySQL server is located. 'localhost' can be used as the location if the server is locatd in the same host than DiamEAP.
-# - database_name : the created database for DiamEAP.
-
-# Syntax :
-# DiamEAP_MySQL = "<username>" , "<password>" , "<databaseserver>" , "<database_name>";
-DiamEAP_MySQL = "diameap", "eapdiam", "localhost", "diameap";
-
-
-##### Extensible Authentication Protocol (EAP) Methods Plugins #####
-# An EAP method is identified by its EAP method name, EAP TYPE, VENDOR and path to its EAP Method Plugin.
-# Optionally, path to a configuration file of plugin can also be provided.
-# Location of plugins and their configuration files can be provided by the absolute pathor the relative path from the location configured in cmake.
-# An EAP Method Plugin can not be loaded twice. Only the first added method will be loaded.
-# Any EAP Method plugin with a same EAP_TYPE value than an already loaded one will be discarded.
-# EAP Methods are added in the same order they are added to the the configuration file.
-
-# Syntax :
-# Load_plugin = "<EAP method name>":EAP_TYPE:VENDOR:"<Path to EAP method >":"<Path to configuration file>";
-#
-# Example:
-# Load_plugin = "EAP MD5":4:0:"/extensions/eap_md5.emp":"";
-# Load_plugin = "EAP TLS":13:0;"/extensions/eap_tls.emp":"/doc/eap_tls_plugin.diameap.conf";
-
-Load_plugin = "EAP Identity":1:0:"/root/freeDiameter/extensions/eap_identity.emp":"";
-Load_plugin = "EAP md5":4:0:"/root/freeDiameter/extensions/eap_md5.emp":"";
-Load_plugin = "EAP TLS":13:0:"/root/freeDiameter/extensions/eap_tls.emp":"/root/conf/freeDiameter/eap_tls.conf";
-
-
-# In addition to authentication DiamEAP can be configured to check authorization of authenticated users. If set to 0 authorization is disabled, otherwise enabled.( by default disabled).
-Authorization = 1;
-
-# This parameter specify the maximum number of seconds provided to the access device for responding to an EAP request. (by default set to 30 seconds)
-#Multi_Round_Time_Out=30;
-
-# After receivin a number of invalid EAP packets, DiamEAP reject the authentication by responding with Failure Authentication.
-# The default value of maximum number of invalid EAP packets is set to 5 packets.
-# The value of maximum invalid EAP packets can be modified by adding a new value.
-#MAX_Invalid_EAP_Packets=5;
-
Index: nf/backend.eap.testbed.aaa/freeDiameter/app_diameap.sql
===================================================================
--- conf/backend.eap.testbed.aaa/freeDiameter/app_diameap.sql	(revision 9)
+++ 	(revision )
@@ -1,12 +1,0 @@
-# aptitude install mysql-server mysql-client libmysqlclient-dev
-# mysql -u root -p
-## create user diameap@localhost identified by 'eapdiam';
-## create database diameap;
-## GRANT ALL PRIVILEGES ON diameap.* TO diameap@localhost;
-## Bye
-# mysql -u diameap -p -D diameap < /home/aaa/src/freeDiameter/extensions/app_diameap/diameap.sql
-# mysql -u diameap -p -D diameap < /root/conf/freeDiameter/app_diameap.sql
-
-INSERT INTO users (username, eapmethod) values ( 'client@eap.testbed.aaa', 13 );
-INSERT INTO users (username, eapmethod) values ( 'client2@eap.testbed.aaa', 13 );
-
Index: nf/backend.eap.testbed.aaa/freeDiameter/eap_tls.conf
===================================================================
--- conf/backend.eap.testbed.aaa/freeDiameter/eap_tls.conf	(revision 7)
+++ 	(revision )
@@ -1,14 +1,0 @@
-#### a sample configuration file for EAP-TLS
-
-#Certificate and Private key files
-#Cred = "<Path to certificate>" : "<Path to private Key>";
-Cred = "/home/aaa/ca/ca_data/mgr.testbed.aaa/clients/server/cert.pem"
-                : "/home/aaa/ca/ca_data/mgr.testbed.aaa/clients/server/privkey.pem";
-
-#CA file
-#CA = "<Path to CA file>";
-CA = "/home/aaa/ca/ca_data/mgr.testbed.aaa/public/cacert.pem";
-
-#CRL file
-#CRL = "<Path to CRL file>";
-
Index: conf/backend.eap.testbed.aaa/freeDiameter/freeDiameter.conf
===================================================================
--- conf/backend.eap.testbed.aaa/freeDiameter/freeDiameter.conf	(revision 10)
+++ conf/backend.eap.testbed.aaa/freeDiameter/freeDiameter.conf	(revision 0)
@@ -55,9 +55,4 @@
 LoadExtension = "/root/freeDiameter/extensions/app_acct.fdx"
 		: "/root/conf/freeDiameter/app_acct.conf";
+ConnectPeer = "gw.eap.testbed.aaa" { No_TLS; };
 
-LoadExtension = "/root/freeDiameter/extensions/app_diameap.fdx"
-		: "/root/conf/freeDiameter/app_diameap.conf";
-
-ConnectPeer = "gw.eap.testbed.aaa" { No_TLS; };
-ConnectPeer = "supauth2.eap.testbed.aaa" { No_TLS; };
-
Index: conf/cli.simple.testbed.aaa/freeDiameter/CMakeFlags
===================================================================
--- conf/cli.simple.testbed.aaa/freeDiameter/CMakeFlags	(revision 5)
+++ conf/cli.simple.testbed.aaa/freeDiameter/CMakeFlags	(revision 0)
@@ -1,1 +1,1 @@
--DBUILD_TEST_APP:BOOL=ON -DBUILD_TEST_RT_ANY:BOOL=ON -DBUILD_DBG_MONITOR:BOOL=ON -DBUILD_DBG_RT:BOOL=ON -DBUILD_TESTING:BOOL=OFF -DCMAKE_BUILD_TYPE:STRING=Debug -DDEFAULT_CONF_PATH:PATH=/root/conf/freeDiameter
+-DBUILD_TEST_APP:BOOL=ON -DBUILD_TEST_RT_ANY:BOOL=ON -DBUILD_DBG_MONITOR:BOOL=ON -DBUILD_DBG_RT:BOOL=ON -DSKIP_TESTS:BOOL=ON -DCMAKE_BUILD_TYPE:STRING=Debug -DDEFAULT_CONF_PATH:PATH=/root/conf/freeDiameter
Index: conf/cli.simple.testbed.aaa/freeDiameter/freeDiameter.conf
===================================================================
--- conf/cli.simple.testbed.aaa/freeDiameter/freeDiameter.conf	(revision 1)
+++ conf/cli.simple.testbed.aaa/freeDiameter/freeDiameter.conf	(revision 0)
@@ -1,8 +1,52 @@
-# Limit the number of streams to avoid flooding the log.
+# This is a sample configuration file for freeDiameter daemon.
+
+##############################################################
+#Identity = "aaa.koganei.wide.ad.jp";
+#Realm = "wide.ad.jp";
+
+##############################################################
+#Port = 3868;
+#SecPort = 3869;
+#TLS_old_method;
+#No_TCP;
+#No_SCTP;
+#Prefer_TCP;
+#SCTP_streams = 30;
 SCTP_streams = 3;
+
+##############################################################
+#No_IP;
+#No_IPv6;
+#ListenOn = "202.249.37.5";
+#ListenOn = "2001:200:903:2::202:1";
+#ListenOn = "fe80::21c:5ff:fe98:7d62%eth0";
+
+##############################################################
 TLS_Cred = "/root/ca_data/cert.pem" , "/root/ca_data/privkey.pem";
 TLS_CA = "/root/ca_data/ca.pem";
+# TLS_CRL = "/root/ca_data/crl.pem";
 
+#TLS_Prio = "NORMAL";
+#TLS_DH_Bits = 1024;
+
+##############################################################
+#TcTimer = 30;
+#TwTimer = 30;
+
+##############################################################
 NoRelay;
+
+##############################################################
+#LoadExtension = "/path/to/extension" [ : "/optional/configuration/file" ] ;
+
+##############################################################
+#ConnectPeer = "diameterid" [ params... ] ;
+#   params: No_TCP; No_SCTP; No_IP; No_IPv6; Prefer_TCP; TLS_old_method; No_TLS;
+#           Port = 3868; TcTimer = 30; TwTimer = 30; ConnectTo = "202.249.37.5"; TLS_Prio = "NORMAL";
+
+
+##############################################################
+# -------- Test configuration ---------
+
 LoadExtension = "/root/freeDiameter/extensions/dbg_monitor.fdx";
 # LoadExtension = "/root/freeDiameter/extensions/dbg_rt.fdx";
Index: conf/cli.simple.testbed.aaa/freeDiameter/freeDiameter.conf.piotr
===================================================================
--- conf/cli.simple.testbed.aaa/freeDiameter/freeDiameter.conf.piotr	(revision 1)
+++ conf/cli.simple.testbed.aaa/freeDiameter/freeDiameter.conf.piotr	(revision 0)
@@ -1,3 +1,2 @@
-# Test configuration file for situation where there is no DNS support, we are using IP addresses for everything.
 
 Identity = "192.168.102.10";
Index: nf/crcumcli.iop.testbed.aaa/ca_name
===================================================================
--- conf/crcumcli.iop.testbed.aaa/ca_name	(revision 13)
+++ 	(revision )
@@ -1,1 +1,0 @@
-iop.testbed.aaa
Index: nf/crcumcli.iop.testbed.aaa/circum/circumd.conf.xml
===================================================================
--- conf/crcumcli.iop.testbed.aaa/circum/circumd.conf.xml	(revision 13)
+++ 	(revision )
@@ -1,17 +1,0 @@
-<?xml version="1.0" encoding="utf-8" ?>
-<!DOCTYPE circumd SYSTEM "circumd.conf.xml.dtd">
-<circumd>
-
-	<socket type="ipv6" proto="tcp" port="3868" mandatory="0" tls="false" />
-	<socket type="ipv4" proto="tcp" port="3868" mandatory="0" tls="false" />
-
-	<!-- TLS port yet to be assigned
-	     (also change net.c once assigned)
-	-->
-	<socket type="ipv6" proto="tcp" port="49152" mandatory="0" tls="true" />
-	<socket type="ipv4" proto="tcp" port="49152" mandatory="0" tls="true" />
-
-	<socket type="ipv6" proto="sctp" port="3868" mandatory="0" tls="false" />
-	<socket type="ipv4" proto="sctp" port="3868" mandatory="0" tls="false" />
-
-</circumd>
Index: nf/crcumsrv.iop.testbed.aaa/ca_name
===================================================================
--- conf/crcumsrv.iop.testbed.aaa/ca_name	(revision 13)
+++ 	(revision )
@@ -1,1 +1,0 @@
-iop.testbed.aaa
Index: nf/crcumsrv.iop.testbed.aaa/circum/circumd.conf.xml
===================================================================
--- conf/crcumsrv.iop.testbed.aaa/circum/circumd.conf.xml	(revision 13)
+++ 	(revision )
@@ -1,17 +1,0 @@
-<?xml version="1.0" encoding="utf-8" ?>
-<!DOCTYPE circumd SYSTEM "circumd.conf.xml.dtd">
-<circumd>
-
-	<socket type="ipv6" proto="tcp" port="3868" mandatory="0" tls="false" />
-	<socket type="ipv4" proto="tcp" port="3868" mandatory="0" tls="false" />
-
-	<!-- TLS port yet to be assigned
-	     (also change net.c once assigned)
-	-->
-	<socket type="ipv6" proto="tcp" port="49152" mandatory="0" tls="true" />
-	<socket type="ipv4" proto="tcp" port="49152" mandatory="0" tls="true" />
-
-	<socket type="ipv6" proto="sctp" port="3868" mandatory="0" tls="false" />
-	<socket type="ipv4" proto="sctp" port="3868" mandatory="0" tls="false" />
-
-</circumd>
Index: conf/eapmgr.testbed.aaa/dns/dnsmasq.conf
===================================================================
--- conf/eapmgr.testbed.aaa/dns/dnsmasq.conf	(revision 10)
+++ conf/eapmgr.testbed.aaa/dns/dnsmasq.conf	(revision 0)
@@ -11,5 +11,5 @@
 domain=eap.testbed.aaa
 
-dhcp-range=192.168.105.60,192.168.105.150,255.255.255.0,12h
+dhcp-range=192.168.105.50,192.168.105.150,255.255.255.0,12h
 
 dhcp-host=08:00:27:33:77:82,supauth
@@ -17,7 +17,4 @@
 dhcp-host=08:00:27:F0:A1:70,gw
 dhcp-host=08:00:27:D9:B0:9D,opendiam
-dhcp-host=08:00:27:63:F1:B7,supauth2
-dhcp-host=08:00:27:E5:C9:49,radpxy
-dhcp-host=08:00:27:9C:70:CE,supauth3
 
 #conf-dir=/etc/dnsmasq.d
Index: conf/eapmgr.testbed.aaa/dns/hosts
===================================================================
--- conf/eapmgr.testbed.aaa/dns/hosts	(revision 10)
+++ conf/eapmgr.testbed.aaa/dns/hosts	(revision 0)
@@ -14,9 +14,5 @@
 192.168.105.30	gw
 192.168.105.40	opendiam
-192.168.105.50	supauth2
-192.168.105.60	radpxy
-192.168.105.70	supauth3
 fde4:2c6e:55c4:105:a00:27ff:fe33:7782	supauth
-fde4:2c6e:55c4:105:a00:27ff:fef0:a170	gw
-fde4:2c6e:55c4:105:a00:27ff:fe0b:7859	backend
+fde4:2c6e:55c4:105:a00:27ff:fef0:a170	backend
 
Index: nf/fdrelay.iop.testbed.aaa/ca_name
===================================================================
--- conf/fdrelay.iop.testbed.aaa/ca_name	(revision 13)
+++ 	(revision )
@@ -1,1 +1,0 @@
-iop.testbed.aaa
Index: nf/fdrelay.iop.testbed.aaa/freeDiameter/CMakeFlags
===================================================================
--- conf/fdrelay.iop.testbed.aaa/freeDiameter/CMakeFlags	(revision 13)
+++ 	(revision )
@@ -1,7 +1,0 @@
--DBUILD_DBG_MONITOR:BOOL=ON \
--DBUILD_DBG_RT:BOOL=ON \
--DBUILD_DICT_EAP:BOOL=OFF \
--DBUILD_DICT_NASREQ:BOOL=OFF \
--DBUILD_TESTING:BOOL=OFF \
--DCMAKE_BUILD_TYPE:STRING=Debug \
--DDEFAULT_CONF_PATH:PATH=/root/conf/freeDiameter
Index: nf/fdrelay.iop.testbed.aaa/freeDiameter/freeDiameter.conf
===================================================================
--- conf/fdrelay.iop.testbed.aaa/freeDiameter/freeDiameter.conf	(revision 13)
+++ 	(revision )
@@ -1,14 +1,0 @@
-# This is a sample configuration file for freeDiameter daemon.
-
-SCTP_streams = 3;
-
-TLS_Cred = "/root/ca_data/cert.pem" , "/root/ca_data/privkey.pem";
-TLS_CA = "/root/ca_data/ca.pem";
-# TLS_CRL = "/root/ca_data/crl.pem";
-
-# LoadExtension = "/root/freeDiameter/extensions/dbg_monitor.fdx";
-#LoadExtension = "/root/freeDiameter/extensions/test_app.fdx"
-#		: "/root/conf/freeDiameter/test_app.conf";
-
-# ConnectPeer = "serv.simple.testbed.aaa" ;
-ConnectPeer = "crcumsrv.iop.testbed.aaa" { No_TLS; };
Index: conf/gw.eap.testbed.aaa/freeDiameter/CMakeFlags
===================================================================
--- conf/gw.eap.testbed.aaa/freeDiameter/CMakeFlags	(revision 9)
+++ conf/gw.eap.testbed.aaa/freeDiameter/CMakeFlags	(revision 0)
@@ -1,9 +1,3 @@
 -DBUILD_DBG_MONITOR:BOOL=ON 
--DBUILD_APP_RADGW:BOOL=ON 
--DBUILD_RGWX_DEBUG:BOOL=ON 
--DBUILD_RGWX_AUTH:BOOL=ON 
--DBUILD_RGWX_ACCT:BOOL=ON 
--DBUILD_RGWX_ECHODROP:BOOL=ON
--DBUILD_TESTING:BOOL=OFF 
--DCMAKE_BUILD_TYPE:STRING=DebugValgrind 
--DDEFAULT_CONF_PATH:PATH=/root/conf/freeDiameter
+-DBUILD_APP_RADGW:BOOL=ON -DBUILD_RGWX_DEBUG:BOOL=ON -DBUILD_RGWX_AUTH:BOOL=ON -DBUILD_RGWX_ACCT:BOOL=ON -DBUILD_RGWX_ECHODROP:BOOL=ON
+-DSKIP_TESTS:BOOL=ON -DCMAKE_BUILD_TYPE:STRING=Debug -DDEFAULT_CONF_PATH:PATH=/root/conf/freeDiameter
Index: conf/gw.eap.testbed.aaa/freeDiameter/freeDiameter.conf
===================================================================
--- conf/gw.eap.testbed.aaa/freeDiameter/freeDiameter.conf	(revision 11)
+++ conf/gw.eap.testbed.aaa/freeDiameter/freeDiameter.conf	(revision 0)
@@ -4,5 +4,5 @@
 NoRelay;
 
-# LoadExtension = "/root/freeDiameter/extensions/dbg_monitor.fdx";
+LoadExtension = "/root/freeDiameter/extensions/dbg_monitor.fdx";
 
 LoadExtension = "/root/freeDiameter/extensions/dict_nasreq.fdx";
@@ -12,6 +12,6 @@
 
 # "opendiam.eap.testbed.aaa" = { uri="aaa://opendiam.eap.testbed.aaa;transport=sctp"; };
-# ConnectPeer = "opendiam.eap.testbed.aaa" {   #TLS_old_Method; 
-#						No_TLS; };
+ConnectPeer = "opendiam.eap.testbed.aaa" {   #TLS_old_Method; 
+						No_TLS; };
 
 ConnectPeer = "backend.eap.testbed.aaa" { No_TLS; };
Index: conf/gw.eap.testbed.aaa/freeDiameter/rgw.conf
===================================================================
--- conf/gw.eap.testbed.aaa/freeDiameter/rgw.conf	(revision 11)
+++ conf/gw.eap.testbed.aaa/freeDiameter/rgw.conf	(revision 0)
@@ -10,12 +10,10 @@
 
 # Dump state when loop ends
-# RGWX = "/root/freeDiameter/extensions/debug.rgwx";
+RGWX = "/root/freeDiameter/extensions/debug.rgwx";
 
 
 ##################
 
-nas = 192.168.105.10 / "radiusecret" ;
-nas = 192.168.105.50 / "radiusecret2" ;
-pxy = 192.168.105.60 / "radiusecret3.2" ;
+cli = 192.168.105.10 / "radiusecret" ;
 
 
Index: nf/iopmgr.testbed.aaa/dns/dnsmasq.conf
===================================================================
--- conf/iopmgr.testbed.aaa/dns/dnsmasq.conf	(revision 13)
+++ 	(revision )
@@ -1,13 +1,0 @@
-domain-needed
-bogus-priv
-server=/testbed.aaa/192.168.101.1
-local=/iop.testbed.aaa/
-except-interface=eth0
-expand-hosts
-domain=iop.testbed.aaa
-dhcp-range=192.168.110.50,192.168.110.150,255.255.255.0,12h
-
-dhcp-host=08:00:27:3F:B9:DE,fdrelay
-dhcp-host=08:00:27:CC:9D:67,crcumcli
-dhcp-host=08:00:27:BA:15:92,crcumsrv
-
Index: nf/iopmgr.testbed.aaa/dns/hosts
===================================================================
--- conf/iopmgr.testbed.aaa/dns/hosts	(revision 13)
+++ 	(revision )
@@ -1,15 +1,0 @@
-127.0.0.1	localhost
-127.0.1.1	iopmgr.testbed.aaa	iopmgr
-
-# The following lines are desirable for IPv6 capable hosts
-::1     localhost ip6-localhost ip6-loopback
-fe00::0 ip6-localnet
-ff00::0 ip6-mcastprefix
-ff02::1 ip6-allnodes
-ff02::2 ip6-allrouters
-ff02::3 ip6-allhosts
-
-192.168.110.10	fdrelay
-192.168.110.20  crcumcli
-192.168.110.30  crcumsrv
-
Index: nf/iopmgr.testbed.aaa/network/interfaces
===================================================================
--- conf/iopmgr.testbed.aaa/network/interfaces	(revision 12)
+++ 	(revision )
@@ -1,18 +1,0 @@
-# This file describes the network interfaces available on your system
-# and how to activate them. For more information, see interfaces(5).
-
-# The loopback network interface
-auto lo
-iface lo inet loopback
-
-# The primary network interface
-auto eth0
-iface eth0 inet dhcp
-
-auto eth1
-iface eth1 inet static
-	address 192.168.110.1
-	netmask	255.255.255.0
-iface eth1 inet6 static
-	address fde4:2c6e:55c4:110::1
-	netmask 64
Index: nf/iopmgr.testbed.aaa/radvd.conf
===================================================================
--- conf/iopmgr.testbed.aaa/radvd.conf	(revision 12)
+++ 	(revision )
@@ -1,7 +1,0 @@
-interface eth1
-{
-   AdvSendAdvert on;
-   prefix fde4:2c6e:55c4:110::/64
-   {
-   };
-};   
Index: conf/mgr.testbeddomain/dns/dnsmasq.d/interopmgr.testbed.aaa
===================================================================
--- conf/mgr.testbeddomain/dns/dnsmasq.d/interopmgr.testbed.aaa	(revision 0)
+++ conf/mgr.testbeddomain/dns/dnsmasq.d/interopmgr.testbed.aaa	(revision 0)
@@ -0,0 +1,1 @@
+dhcp-host=08:00:27:87:01:49,interopmgr
Index: nf/mgr.testbeddomain/dns/dnsmasq.d/iopmgr.testbed.aaa
===================================================================
--- conf/mgr.testbeddomain/dns/dnsmasq.d/iopmgr.testbed.aaa	(revision 12)
+++ 	(revision )
@@ -1,1 +1,0 @@
-dhcp-host=08:00:27:86:9b:42,iopmgr
Index: conf/mgr.testbeddomain/dns/hosts
===================================================================
--- conf/mgr.testbeddomain/dns/hosts	(revision 12)
+++ conf/mgr.testbeddomain/dns/hosts	(revision 0)
@@ -19,5 +19,5 @@
 192.168.101.5	eapmgr
 192.168.101.6	dsmipmgr
-192.168.101.10	iopmgr
+192.168.101.10	interopmgr
 
 # winseven is also managed, but no fixed IP
Index: conf/mgr.testbeddomain/quagga/zebra.conf
===================================================================
--- conf/mgr.testbeddomain/quagga/zebra.conf	(revision 13)
+++ conf/mgr.testbeddomain/quagga/zebra.conf	(revision 0)
@@ -11,5 +11,4 @@
 ip route 192.168.115.0/24 192.168.101.3	
 ip route 192.168.105.0/24 192.168.101.5
-ip route 192.168.110.0/24 192.168.101.10
 
 ! dsmip: de 192 a 207
Index: conf/nas.a.rt.testbed.aaa/freeDiameter/CMakeFlags
===================================================================
--- conf/nas.a.rt.testbed.aaa/freeDiameter/CMakeFlags	(revision 15)
+++ conf/nas.a.rt.testbed.aaa/freeDiameter/CMakeFlags	(revision 0)
@@ -1,9 +1,1 @@
--DBUILD_TEST_APP:BOOL=ON 
--DBUILD_TEST_RT_ANY:BOOL=ON 
--DBUILD_RT_REDIRECT:BOOL=ON 
--DBUILD_DBG_MONITOR:BOOL=ON 
--DBUILD_DBG_INTERACTIVE:BOOL=ON 
--DBUILD_DBG_RT:BOOL=ON 
--DBUILD_TESTING:BOOL=OFF 
--DCMAKE_BUILD_TYPE:STRING=Debug 
--DDEFAULT_CONF_PATH:PATH=/root/conf/freeDiameter
+-DBUILD_TEST_APP:BOOL=ON -DBUILD_TEST_RT_ANY:BOOL=ON -DBUILD_DBG_MONITOR:BOOL=ON -DBUILD_DBG_RT:BOOL=ON -DSKIP_TESTS:BOOL=ON -DCMAKE_BUILD_TYPE:STRING=Debug -DDEFAULT_CONF_PATH:PATH=/root/conf/freeDiameter
Index: conf/nas.a.rt.testbed.aaa/freeDiameter/freeDiameter.conf
===================================================================
--- conf/nas.a.rt.testbed.aaa/freeDiameter/freeDiameter.conf	(revision 15)
+++ conf/nas.a.rt.testbed.aaa/freeDiameter/freeDiameter.conf	(revision 0)
@@ -1,29 +1,63 @@
+# This is a sample configuration file for freeDiameter daemon.
 
+##############################################################
+#Identity = "aaa.koganei.wide.ad.jp";
+#Realm = "wide.ad.jp";
+
+##############################################################
+#Port = 3868;
+#SecPort = 3869;
+#TLS_old_method;
+#No_TCP;
+#No_SCTP;
+#Prefer_TCP;
+#SCTP_streams = 30;
 SCTP_streams = 3;
+
+##############################################################
+#No_IP;
+#No_IPv6;
+#ListenOn = "202.249.37.5";
+#ListenOn = "2001:200:903:2::202:1";
+#ListenOn = "fe80::21c:5ff:fe98:7d62%eth0";
+
+##############################################################
 TLS_Cred = "/root/ca_data/cert.pem" , "/root/ca_data/privkey.pem";
 TLS_CA = "/root/ca_data/ca.pem";
+# TLS_CRL = "/root/ca_data/crl.pem";
+
+#TLS_Prio = "NORMAL";
+#TLS_DH_Bits = 1024;
+
+##############################################################
+#TcTimer = 30;
+#TwTimer = 30;
+
+##############################################################
 NoRelay;
 
+##############################################################
+#LoadExtension = "/path/to/extension" [ : "/optional/configuration/file" ] ;
+
+##############################################################
+#ConnectPeer = "diameterid" [ params... ] ;
+#   params: No_TCP; No_SCTP; No_IP; No_IPv6; Prefer_TCP; TLS_old_method; No_TLS;
+#           Port = 3868; TcTimer = 30; TwTimer = 30; ConnectTo = "202.249.37.5"; TLS_Prio = "NORMAL";
+
+
+##############################################################
 # -------- Test configuration ---------
 
-# LoadExtension = "/root/freeDiameter/extensions/dbg_monitor.fdx";
+LoadExtension = "/root/freeDiameter/extensions/dbg_monitor.fdx";
 # LoadExtension = "/root/freeDiameter/extensions/dbg_rt.fdx";
 # LoadExtension = "/root/freeDiameter/extensions/test_rt_any.fdx";
-
 LoadExtension = "/root/freeDiameter/extensions/test_app.fdx"
 		: "/root/conf/freeDiameter/test_app.conf";
-# LoadExtension = "/root/freeDiameter/extensions/dbg_interactive.fdx";
+LoadExtension = "/root/freeDiameter/extensions/rt_default.fdx"
+		: "/root/conf/freeDiameter/rtd.conf";
+
+# ConnectPeer = "serv.simple.testbed.aaa" ;
+ConnectPeer = "proxy.a.rt.testbed.aaa" ;
+ConnectPeer = "proxy.b.rt.testbed.aaa" ;
 
 
-LoadExtension = "/root/freeDiameter/extensions/rt_default.fdx"
-		: "/root/conf/freeDiameter/rtd.conf";
-ConnectPeer = "proxy.a.rt.testbed.aaa" ;
-		
-		
-# For failover testing:
-#ConnectPeer = "proxy.b.rt.testbed.aaa" ;
-
-# For redirect testing:
-ConnectPeer = "relay.a.rt.testbed.aaa" ;
-LoadExtension = "/root/freeDiameter/extensions/rt_redirect.fdx";
-
Index: nf/nas.a.rt.testbed.aaa/freeDiameter/python_.py
===================================================================
--- conf/nas.a.rt.testbed.aaa/freeDiameter/python_.py	(revision 14)
+++ 	(revision )
@@ -1,66 +1,0 @@
-gdict = cvar.fd_g_config.cnf_dict
-d_si = gdict.search ( DICT_AVP, AVP_BY_NAME, "Session-Id" )
-d_oh  = gdict.search ( DICT_AVP, AVP_BY_NAME, "Origin-Host" )
-d_or  = gdict.search ( DICT_AVP, AVP_BY_NAME, "Origin-Realm" )
-d_dh  = gdict.search ( DICT_AVP, AVP_BY_NAME, "Destination-Host" )
-d_dr  = gdict.search ( DICT_AVP, AVP_BY_NAME, "Destination-Realm" )
-d_rc  = gdict.search ( DICT_AVP, AVP_BY_NAME, "Result-Code" )
-d_vnd = gdict.new_obj(DICT_VENDOR, 	dict_vendor_data(999999, 	"app_test_py vendor") )
-d_app = gdict.new_obj(DICT_APPLICATION, dict_application_data(0xffffff, "app_test_py appli"), d_vnd)
-d_req = gdict.new_obj(DICT_COMMAND, 	dict_cmd_data(0xfffffe, "Test_py-Request", 1), d_app)
-d_ans = gdict.new_obj(DICT_COMMAND, 	dict_cmd_data(0xfffffe, "Test_py-Answer",  0), d_app)
-d_avp = gdict.new_obj(DICT_AVP, 	dict_avp_data(0xffffff, "app_test_py avp", AVP_TYPE_INTEGER32, 999999 ))
-gdict.new_obj(DICT_RULE, dict_rule_data(d_si, RULE_FIXED_HEAD, 1, 1), d_req)
-gdict.new_obj(DICT_RULE, dict_rule_data(d_si, RULE_FIXED_HEAD, 1, 1), d_ans)
-gdict.new_obj(DICT_RULE, dict_rule_data(d_avp, RULE_REQUIRED, 1, 1), d_req)
-gdict.new_obj(DICT_RULE, dict_rule_data(d_avp, RULE_REQUIRED, 1, 1), d_ans)
-gdict.new_obj(DICT_RULE, dict_rule_data(d_oh, RULE_REQUIRED, 1, 1), d_req)
-gdict.new_obj(DICT_RULE, dict_rule_data(d_oh, RULE_REQUIRED, 1, 1), d_ans)
-gdict.new_obj(DICT_RULE, dict_rule_data(d_or, RULE_REQUIRED, 1, 1), d_req)
-gdict.new_obj(DICT_RULE, dict_rule_data(d_or, RULE_REQUIRED, 1, 1), d_ans)
-gdict.new_obj(DICT_RULE, dict_rule_data(d_dr, RULE_REQUIRED, 1, 1), d_req)
-gdict.new_obj(DICT_RULE, dict_rule_data(d_dh, RULE_OPTIONAL, 0, 1), d_req)
-gdict.new_obj(DICT_RULE, dict_rule_data(d_rc, RULE_REQUIRED, 1, 1), d_ans)
-
-def receive_answer(ans, testval):
-   if (ans.is_request()):
-     print "Request was expired before receiving answer..."
-     return None
-   try:
-     tval = ans.search(d_avp).header().avp_value.u32
-   except:
-     print "Error in receive_answer: no Test-AVP included"
-     tval = 0
-   try:
-     print "Py RECV %x (expected: %x) Status: %d From: '%s'" % (tval, testval, ans.search(d_rc).header().avp_value.u32, ans.search(d_oh).header().avp_value.os.as_str())
-   except:
-     print "Error in receive_answer: Result-Code or Origin-Host are missing"
-   del ans
-   return None
-
-import random
-
-def send_query(destrealm="b.rt.testbed.aaa"):
-   qry = msg(d_req)
-   sess = session()
-   tv = random.randint(1, 1<<32)
-   # Session-Id
-   a = avp(d_si, AVPFL_SET_BLANK_VALUE)
-   a.header().avp_value.os = sess.getsid()
-   qry.add_child(a)
-   # Destination-Realm
-   a = avp(d_dr, AVPFL_SET_BLANK_VALUE)
-   a.header().avp_value.os = destrealm
-   qry.add_child(a)
-   # Origin-Host, Origin-Realm
-   qry.add_origin()
-   # Test-AVP
-   a = avp(d_avp, AVPFL_SET_BLANK_VALUE)
-   a.header().avp_value.u32 = tv
-   qry.add_child(a)
-   print "Py SEND %x to '%s'" % (tv, destrealm)
-   qry.send(receive_answer, tv, 1)
-
-send_query()
-
-
Index: conf/nas.a.rt.testbed.aaa/freeDiameter/rtd.conf
===================================================================
--- conf/nas.a.rt.testbed.aaa/freeDiameter/rtd.conf	(revision 15)
+++ conf/nas.a.rt.testbed.aaa/freeDiameter/rtd.conf	(revision 0)
@@ -1,4 +1,2 @@
-# Our local relay is default route for all messages
-* : "relay.a.rt.testbed.aaa" += 6; # This is "default + 1" so that it is prefered when possible
+# Our local proxy is default route for all messages
 * : "proxy.a.rt.testbed.aaa" += DEFAULT;
-* : "proxy.b.rt.testbed.aaa" += DEFAULT;
Index: conf/proxy.a.rt.testbed.aaa/freeDiameter/CMakeFlags
===================================================================
--- conf/proxy.a.rt.testbed.aaa/freeDiameter/CMakeFlags	(revision 15)
+++ conf/proxy.a.rt.testbed.aaa/freeDiameter/CMakeFlags	(revision 0)
@@ -1,6 +1,6 @@
+-DBUILD_TEST_RT_ANY:BOOL=ON \
 -DBUILD_DBG_MONITOR:BOOL=ON \
 -DBUILD_DBG_RT:BOOL=ON \
--DBUILD_TEST_NETEMUL:BOOL=ON \
--DBUILD_TESTING:BOOL=OFF \
+-DSKIP_TESTS:BOOL=ON \
 -DCMAKE_BUILD_TYPE:STRING=Debug \
 -DDEFAULT_CONF_PATH:PATH=/root/conf/freeDiameter
Index: conf/proxy.a.rt.testbed.aaa/freeDiameter/freeDiameter.conf
===================================================================
--- conf/proxy.a.rt.testbed.aaa/freeDiameter/freeDiameter.conf	(revision 15)
+++ conf/proxy.a.rt.testbed.aaa/freeDiameter/freeDiameter.conf	(revision 0)
@@ -1,22 +1,59 @@
+# This is a sample configuration file for freeDiameter daemon.
 
+##############################################################
+#Identity = "aaa.koganei.wide.ad.jp";
+#Realm = "wide.ad.jp";
+
+##############################################################
+#Port = 3868;
+#SecPort = 3869;
+#TLS_old_method;
+#No_TCP;
+#No_SCTP;
+#Prefer_TCP;
+#SCTP_streams = 30;
 SCTP_streams = 3;
+
+##############################################################
+#No_IP;
+#No_IPv6;
+#ListenOn = "202.249.37.5";
+#ListenOn = "2001:200:903:2::202:1";
+#ListenOn = "fe80::21c:5ff:fe98:7d62%eth0";
+
+##############################################################
 TLS_Cred = "/root/ca_data/cert.pem" , "/root/ca_data/privkey.pem";
 TLS_CA = "/root/ca_data/ca.pem";
+# TLS_CRL = "/root/ca_data/crl.pem";
+
+#TLS_Prio = "NORMAL";
+#TLS_DH_Bits = 1024;
+
+##############################################################
+#TcTimer = 30;
+#TwTimer = 30;
+
+##############################################################
 #NoRelay;
 
+##############################################################
+#LoadExtension = "/path/to/extension" [ : "/optional/configuration/file" ] ;
+
+
+##############################################################
+#ConnectPeer = "diameterid" [ params... ] ;
+#   params: No_TCP; No_SCTP; No_IP; No_IPv6; Prefer_TCP; TLS_old_method; No_TLS;
+#           Port = 3868; TcTimer = 30; TwTimer = 30; ConnectTo = "202.249.37.5"; TLS_Prio = "NORMAL";
+
+
+##############################################################
 # -------- Test configuration ---------
 
-#LoadExtension = "/root/freeDiameter/extensions/dbg_monitor.fdx";
-#LoadExtension = "/root/freeDiameter/extensions/dbg_rt.fdx";
-#LoadExtension = "/root/freeDiameter/extensions/test_rt_any.fdx";
-
+LoadExtension = "/root/freeDiameter/extensions/dbg_monitor.fdx";
+LoadExtension = "/root/freeDiameter/extensions/dbg_rt.fdx";
 LoadExtension = "/root/freeDiameter/extensions/acl_wl.fdx"
 		: "/root/conf/freeDiameter/acl_wl.conf";
-
-# For netemul tests:
-LoadExtension = "/root/freeDiameter/extensions/test_netemul.fdx"
-		: "/root/conf/freeDiameter/netemul.conf";
+# LoadExtension = "/root/freeDiameter/extensions/test_rt_any.fdx";
 
 ConnectPeer = "proxy.b.rt.testbed.aaa" ;
-ConnectPeer = "serv.b.rt.testbed.aaa" ;
 
Index: nf/proxy.a.rt.testbed.aaa/freeDiameter/netemul.conf
===================================================================
--- conf/proxy.a.rt.testbed.aaa/freeDiameter/netemul.conf	(revision 14)
+++ 	(revision )
@@ -1,7 +1,0 @@
-#  latency_average  = 500 ms;
-#  latency_deviation = 20 % ;
-#  dupl_proba = 1 / 100 ;
-
-latency_average  = 2 s;
-latency_deviation = 50 % ;
-dupl_proba = 1 / 5 ;
Index: conf/proxy.b.rt.testbed.aaa/freeDiameter/CMakeFlags
===================================================================
--- conf/proxy.b.rt.testbed.aaa/freeDiameter/CMakeFlags	(revision 14)
+++ conf/proxy.b.rt.testbed.aaa/freeDiameter/CMakeFlags	(revision 0)
@@ -3,6 +3,5 @@
 -DBUILD_DICT_EAP:BOOL=OFF \
 -DBUILD_DICT_NASREQ:BOOL=OFF \
--DBUILD_TEST_NETEMUL:BOOL=ON \
--DBUILD_TESTING:BOOL=OFF \
+-DSKIP_TESTS:BOOL=ON \
 -DCMAKE_BUILD_TYPE:STRING=Debug \
 -DDEFAULT_CONF_PATH:PATH=/root/conf/freeDiameter
Index: conf/proxy.b.rt.testbed.aaa/freeDiameter/freeDiameter.conf
===================================================================
--- conf/proxy.b.rt.testbed.aaa/freeDiameter/freeDiameter.conf	(revision 15)
+++ conf/proxy.b.rt.testbed.aaa/freeDiameter/freeDiameter.conf	(revision 0)
@@ -1,20 +1,59 @@
+# This is a sample configuration file for freeDiameter daemon.
+
+##############################################################
+#Identity = "aaa.koganei.wide.ad.jp";
+#Realm = "wide.ad.jp";
+
+##############################################################
+#Port = 3868;
+#SecPort = 3869;
+#TLS_old_method;
+#No_TCP;
+#No_SCTP;
+#Prefer_TCP;
+#SCTP_streams = 30;
 SCTP_streams = 3;
+
+##############################################################
+#No_IP;
+#No_IPv6;
+#ListenOn = "202.249.37.5";
+#ListenOn = "2001:200:903:2::202:1";
+#ListenOn = "fe80::21c:5ff:fe98:7d62%eth0";
+
+##############################################################
 TLS_Cred = "/root/ca_data/cert.pem" , "/root/ca_data/privkey.pem";
 TLS_CA = "/root/ca_data/ca.pem";
+# TLS_CRL = "/root/ca_data/crl.pem";
+
+#TLS_Prio = "NORMAL";
+#TLS_DH_Bits = 1024;
+
+##############################################################
+#TcTimer = 30;
+#TwTimer = 30;
+
+##############################################################
 #NoRelay;
 
+##############################################################
+#LoadExtension = "/path/to/extension" [ : "/optional/configuration/file" ] ;
+
+
+##############################################################
+#ConnectPeer = "diameterid" [ params... ] ;
+#   params: No_TCP; No_SCTP; No_IP; No_IPv6; Prefer_TCP; TLS_old_method; No_TLS;
+#           Port = 3868; TcTimer = 30; TwTimer = 30; ConnectTo = "202.249.37.5"; TLS_Prio = "NORMAL";
+
+
+##############################################################
 # -------- Test configuration ---------
 
-#LoadExtension = "/root/freeDiameter/extensions/dbg_monitor.fdx";
-#LoadExtension = "/root/freeDiameter/extensions/dbg_rt.fdx";
+LoadExtension = "/root/freeDiameter/extensions/dbg_monitor.fdx";
+LoadExtension = "/root/freeDiameter/extensions/dbg_rt.fdx";
+LoadExtension = "/root/freeDiameter/extensions/acl_wl.fdx"
+		: "/root/conf/freeDiameter/acl_wl.conf";
 # LoadExtension = "/root/freeDiameter/extensions/test_rt_any.fdx";
 
-LoadExtension = "/root/freeDiameter/extensions/acl_wl.fdx"
-		: "/root/conf/freeDiameter/acl_wl.conf";
+ConnectPeer = "proxy.a.rt.testbed.aaa" ;
 
-LoadExtension = "/root/freeDiameter/extensions/test_netemul.fdx"
-		: "/root/conf/freeDiameter/netemul.conf";
-		
-ConnectPeer = "proxy.a.rt.testbed.aaa" ;
-ConnectPeer = "serv.b.rt.testbed.aaa" ;
-# Realm = "a.rt.testbed.aaa" ;
Index: nf/proxy.b.rt.testbed.aaa/freeDiameter/netemul.conf
===================================================================
--- conf/proxy.b.rt.testbed.aaa/freeDiameter/netemul.conf	(revision 14)
+++ 	(revision )
@@ -1,7 +1,0 @@
-#  latency_average  = 500 ms;
-#  latency_deviation = 20 % ;
-#  dupl_proba = 1 / 100 ;
-
-latency_average  = 2 s;
-latency_deviation = 50 % ;
-dupl_proba = 1 / 5 ;
Index: nf/radpxy.eap.testbed.aaa/ca_name
===================================================================
--- conf/radpxy.eap.testbed.aaa/ca_name	(revision 10)
+++ 	(revision )
@@ -1,1 +1,0 @@
-eap.testbed.aaa
Index: nf/radpxy.eap.testbed.aaa/freeradius/acct_users
===================================================================
--- conf/radpxy.eap.testbed.aaa/freeradius/acct_users	(revision 11)
+++ 	(revision )
@@ -1,1 +1,0 @@
-DEFAULT	Proxy-To-Realm := "eap.testbed.aaa"
Index: nf/radpxy.eap.testbed.aaa/freeradius/attrs
===================================================================
--- conf/radpxy.eap.testbed.aaa/freeradius/attrs	(revision 11)
+++ 	(revision )
@@ -1,127 +1,0 @@
-#
-#	Configuration file for the rlm_attr_filter module.
-#	Please see rlm_attr_filter(5) manpage for more information.
-#
-#	$Id: attrs,v 1.8 2008/04/09 07:18:25 aland Exp $
-#
-#	This file contains security and configuration information
-#	for each realm. The first field is the realm name and
-#	can be up to 253 characters in length. This is followed (on
-#	the next line) with the list of filter rules to be used to
-#	decide what attributes and/or values we allow proxy servers
-#	to pass to the NAS for this realm.
-#
-#	When a proxy-reply packet is received from a home server,
-#	these attributes and values are tested. Only the first match
-#	is used unless the "Fall-Through" variable is set to "Yes".
-#	In that case the rules defined in the DEFAULT case are
-#	processed as well.
-#
-#	A special realm named "DEFAULT" matches on all realm names.
-#	You can have only one DEFAULT entry. All entries are processed
-#	in the order they appear in this file. The first entry that
-#	matches the login-request will stop processing unless you use
-#	the Fall-Through variable.
-#
-#	Indented (with the tab character) lines following the first
-#	line indicate the filter rules.
-#
-#	You can include another `attrs' file with `$INCLUDE attrs.other'
-#
-
-#
-# This is a complete entry for realm "fisp". Note that there is no
-# Fall-Through entry so that no DEFAULT entry will be used, and the
-# server will NOT allow any other a/v pairs other than the ones
-# listed here.
-#
-# These rules allow:
-#     o  Only Framed-User Service-Types ( no telnet, rlogin, tcp-clear )
-#     o  PPP sessions ( no SLIP, CSLIP, etc. )
-#     o  dynamic ip assignment ( can't assign a static ip )
-#     o  an idle timeout value set to 600 seconds (10 min) or less
-#     o  a max session time set to 28800 seconds (8 hours) or less
-#
-#fisp
-#	Service-Type == Framed-User,
-#	Framed-Protocol == PPP,
-#	Framed-IP-Address == 255.255.255.254,
-#	Idle-Timeout <= 600,
-#	Session-Timeout <= 28800
-
-#
-# This is a complete entry for realm "tisp". Note that there is no
-# Fall-Through entry so that no DEFAULT entry will be used, and the
-# server will NOT allow any other a/v pairs other than the ones
-# listed here.
-#
-# These rules allow:
-#       o Only Login-User Service-Type ( no framed/ppp sessions )
-#       o Telnet sessions only ( no rlogin, tcp-clear )
-#       o Login hosts of either 192.168.1.1 or 192.168.1.2
-#
-#tisp
-#	Service-Type == Login-User,
-#	Login-Service == Telnet,
-#	Login-TCP-Port == 23,
-#	Login-IP-Host == 192.168.1.1,
-#	Login-IP-Host == 192.168.1.2
-
-#
-# The following example can be used for a home server which is only
-# allowed to supply a Reply-Message, a Session-Timeout attribute of
-# maximum 86400, a Idle-Timeout attribute of maximum 600 and a
-# Acct-Interim-Interval attribute between 300 and 3600.
-# All other attributes sent back will be filtered out.
-#
-#strictrealm
-#	Reply-Message =* ANY,
-#	Session-Timeout <= 86400,
-#	Idle-Timeout <= 600,
-#	Acct-Interim-Interval >= 300,
-#	Acct-Interim-Interval <= 3600
-
-#
-# This is a complete entry for realm "spamrealm". Fall-Through is used,
-# so that the DEFAULT filter rules are used in addition to these.
-#
-# These rules allow:
-#       o Force the application of Filter-ID attribute to be returned
-#         in the proxy reply, whether the proxy sent it or not.
-#       o The standard DEFAULT rules as defined below
-#
-#spamrealm
-#	Framed-Filter-Id := "nosmtp.in",
-#	Fall-Through = Yes
-
-#
-# The rest of this file contains the DEFAULT entry.
-# DEFAULT matches with all realm names. (except if the realm previously
-# matched an entry with no Fall-Through)
-#
-
-DEFAULT
-	Service-Type == Framed-User,
-	Service-Type == Login-User,
-	Login-Service == Telnet,
-	Login-Service == Rlogin,
-	Login-Service == TCP-Clear,
-	Login-TCP-Port <= 65536,
-	Framed-IP-Address == 255.255.255.254,
-	Framed-IP-Netmask == 255.255.255.255,
-	Framed-Protocol == PPP,
-	Framed-Protocol == SLIP,
-	Framed-Compression == Van-Jacobson-TCP-IP,
-	Framed-MTU >= 576,
-	Framed-Filter-ID =* ANY,
-	Reply-Message =* ANY,
-	Proxy-State =* ANY,
-	EAP-Message =* ANY,
-	Message-Authenticator =* ANY,
-	MS-MPPE-Recv-Key =* ANY,
-	MS-MPPE-Send-Key =* ANY,
-	MS-CHAP-MPPE-Keys =* ANY,
-	State =* ANY,
-	Session-Timeout <= 28800,
-	Idle-Timeout <= 600,
-	Port-Limit <= 2
Index: nf/radpxy.eap.testbed.aaa/freeradius/attrs.access_reject
===================================================================
--- conf/radpxy.eap.testbed.aaa/freeradius/attrs.access_reject	(revision 11)
+++ 	(revision )
@@ -1,16 +1,0 @@
-#
-#	Configuration file for the rlm_attr_filter module.
-#	Please see rlm_attr_filter(5) manpage for more information.
-#
-#	$Id: attrs.access_reject,v 1.1 2006/11/22 21:48:35 aland Exp $
-#
-#	This configuration file is used to remove almost all of the attributes
-#	From an Access-Reject message.  The RFC's say that an Access-Reject
-#	packet can contain only a few attributes.  We enforce that here.
-#
-DEFAULT
-	EAP-Message =* ANY,
-	State =* ANY,
-	Message-Authenticator =* ANY,
-	Reply-Message =* ANY,
-	Proxy-State =* ANY
Index: nf/radpxy.eap.testbed.aaa/freeradius/attrs.accounting_response
===================================================================
--- conf/radpxy.eap.testbed.aaa/freeradius/attrs.accounting_response	(revision 11)
+++ 	(revision )
@@ -1,15 +1,0 @@
-#
-#	Configuration file for the rlm_attr_filter module.
-#	Please see rlm_attr_filter(5) manpage for more information.
-#
-#	$Id: attrs.accounting_response,v 1.1 2006/11/22 21:48:35 aland Exp $
-#
-#	This configuration file is used to remove almost all of the attributes
-#	From an Accounting-Response message.  The RFC's say that an
-#	Accounting-Response packet can contain only a few attributes.
-#	We enforce that here.
-#
-DEFAULT
-	Vendor-Specific =* ANY,
-	Message-Authenticator =* ANY,
-	Proxy-State =* ANY
Index: nf/radpxy.eap.testbed.aaa/freeradius/attrs.pre-proxy
===================================================================
--- conf/radpxy.eap.testbed.aaa/freeradius/attrs.pre-proxy	(revision 11)
+++ 	(revision )
@@ -1,62 +1,0 @@
-#
-#	Configuration file for the rlm_attr_filter module.
-#	Please see rlm_attr_filter(5) manpage for more information.
-#
-#	$Id: attrs.pre-proxy,v 1.3 2008/04/09 07:18:25 aland Exp $
-#
-#	This file contains security and configuration information
-#	for each realm. It can be used be an rlm_attr_filter module
-#	instance to filter attributes before sending packets to the
-#	home server of a realm.
-#
-#	When a packet is sent to a home server, these attributes
-#	and values are tested. Only the first match is used unless
-#	the "Fall-Through" variable is set to "Yes". In that case
-#	the rules defined in the DEFAULT case are processed as well.
-#
-#	A special realm named "DEFAULT" matches on all realm names.
-#	You can have only one DEFAULT entry. All entries are processed
-#	in the order they appear in this file. The first entry that
-#	matches the login-request will stop processing unless you use
-#	the Fall-Through variable.
-#
-#	The first line indicates the realm to which the rules apply.
-#	Indented (with the tab character) lines following the first
-#	line indicate the filter rules.
-#
-
-# This is a complete entry for 'nochap' realm. It allows to send very
-# basic attributes to the home server. Note that there is no Fall-Through
-# entry so that no DEFAULT entry will be used. Only the listed attributes
-# will be sent in the packet, all other attributes will be filtered out.
-#
-#nochap
-#	User-Name =* ANY,
-#	User-Password =* ANY,
-#	NAS-Ip-Address =* ANY,
-#	NAS-Identifier =* ANY
-
-# The entry for the 'brokenas' realm removes the attribute NAS-Port-Type
-# if its value is different from 'Ethernet'. Then the default rules are
-# applied.
-#
-#brokenas
-#	NAS-Port-Type == Ethernet
-#	Fall-Through = Yes
-
-# The rest of this file contains the DEFAULT entry.
-# DEFAULT matches with all realm names.
-
-DEFAULT
-	User-Name =* ANY,
-	User-Password =* ANY,
-	CHAP-Password =* ANY,
-	CHAP-Challenge =* ANY,
-	MS-CHAP-Challenge =* ANY,
-	MS-CHAP-Response =* ANY,
-	EAP-Message =* ANY,
-	Message-Authenticator =* ANY,
-	State =* ANY,
-	NAS-IP-Address =* ANY,
-	NAS-Identifier =* ANY,
-	Proxy-State =* ANY
Index: nf/radpxy.eap.testbed.aaa/freeradius/clients.conf
===================================================================
--- conf/radpxy.eap.testbed.aaa/freeradius/clients.conf	(revision 11)
+++ 	(revision )
@@ -1,10 +1,0 @@
-# -*- text -*-
-
-client supauth3.eap.testbed.aaa {
-	ipaddr = 192.168.105.70
-	secret		= radiusecret3.1
-	require_message_authenticator = no
-
-	nastype     = other	# localhost isn't usually a NAS...
-}
-
Index: nf/radpxy.eap.testbed.aaa/freeradius/dictionary
===================================================================
--- conf/radpxy.eap.testbed.aaa/freeradius/dictionary	(revision 11)
+++ 	(revision )
@@ -1,32 +1,0 @@
-#
-#	This is the master dictionary file, which references the
-#	pre-defined dictionary files included with the server.
-#
-#	Any new/changed attributes MUST be placed in this file, as
-#	the pre-defined dictionaries SHOULD NOT be edited.
-#
-#	$Id: dictionary.in,v 1.4 2004/04/14 15:26:20 aland Exp $
-#
-
-#
-#	The filename given here should be an absolute path. 
-#
-$INCLUDE	/usr/share/freeradius/dictionary
-
-#
-#	Place additional attributes or $INCLUDEs here.  They will
-#	over-ride the definitions in the pre-defined dictionaries.
-#
-#	See the 'man' page for 'dictionary' for information on
-#	the format of the dictionary files.
-
-#
-#	If you want to add entries to the dictionary file,
-#	which are NOT going to be placed in a RADIUS packet,
-#	add them here.  The numbers you pick should be between
-#	3000 and 4000.
-#
-
-#ATTRIBUTE	My-Local-String		3000	string
-#ATTRIBUTE	My-Local-IPAddr		3001	ipaddr
-#ATTRIBUTE	My-Local-Integer	3002	integer
Index: nf/radpxy.eap.testbed.aaa/freeradius/experimental.conf
===================================================================
--- conf/radpxy.eap.testbed.aaa/freeradius/experimental.conf	(revision 11)
+++ 	(revision )
@@ -1,501 +1,0 @@
-#
-#  This file contains the configuration for experimental modules.
-#
-#  By default, it is NOT included in the build.
-#
-#  $Id: experimental.conf,v 1.42 2008/01/19 22:26:30 aland Exp $
-#
-
-	# Configuration for the Python module.
-	#
-	# Where radiusd is a Python module, radiusd.py, and the
-	# function 'authorize' is called.  Here is a dummy piece
-	# of code:
-	# 
-	#	def authorize(params):
-	#	    print params
-	#	    return (5, ('Reply-Message', 'banned'))
-	#
-	# The RADIUS value-pairs are passed as a tuple of tuple
-	# pairs as the first argument, e.g. (('attribute1',
-	# 'value1'), ('attribute2', 'value2'))
-	#
-	# The function return is a tuple with the first element
-	# being the return value of the function.
-	# The 5 corresponds to RLM_MODULE_USERLOCK. I plan to
-	# write the return values as Python symbols to avoid
-	# confusion.
-	#
-	# The remaining tuple members are the string form of
-	# value-pairs which are passed on to pairmake().
-	#
-	python {
-		mod_instantiate = radiusd_test
-		func_instantiate = instantiate
-
-		mod_authorize = radiusd_test
-		func_authorize = authorize
-
-		mod_accounting = radiusd_test
-		func_accounting = accounting
-
-		mod_preproxy = radiusd_test
-		func_preproxy = preproxy
-
-		mod_postproxy = radiusd_test
-		func_postproxy = postproxy
-
-		mod_postauth = radiusd_test
-		func_postauth = postauth
-
-		mod_detach = radiusd_test
-		func_detach = detach
-	}
-
-	
-	# Configuration for the example module.  Uncommenting it will cause it
-	# to get loaded and initialized, but should have no real effect as long
-	# it is not referencened in one of the autz/auth/preacct/acct sections
-	example {
-		#  Boolean variable.
-		# allowed values: {no, yes}
-		boolean = yes
-
-		#  An integer, of any value.
-		integer = 16
-
-		#  A string.
-		string = "This is an example configuration string"
-
-		# An IP address, either in dotted quad (1.2.3.4) or hostname
-		# (example.com)
-		ipaddr = 127.0.0.1
-
-		# A subsection
-		mysubsection {
-			anotherinteger = 1000
-			# They nest
-			deeply nested {
-				string = "This is a different string"
-			}
-		}
-	}
-
-	#
-	#  To create a dbm users file, do:
-	#
-	#   cat test.users | rlm_dbm_parser -f /etc/raddb/users_db
-	#
-	#  Then add 'dbm' in 'authorize' section.
-	#
-	#  Note that even if the file has a ".db" or ".dbm" extension,
-	#  you may have to specify it here without that extension.  This
-	#  is because the DBM libraries "helpfully" add a ".db" to the
-	#  filename, but don't check if it's already there.
-	#
-	dbm {
-		usersfile = ${confdir}/users_db
-	}
-
-	#
-	#  Persistent, embedded Perl interpreter.
-	#
-	perl {
-		#
-		#  The Perl script to execute on authorize, authenticate,
-		#  accounting, xlat, etc.  This is very similar to using
-		#  'rlm_exec' module, but it is persistent, and therefore
-		#  faster.
-		#
-		module = /path/to/your/perl_module.pm
-
-		#
-		#  The following hashes are given to the module and
-                #  filled with value-pairs (Attribute names and values)
-		#
-		#  %RAD_CHECK		Read-only	Check items
-		#  %RAD_REQUEST		Read-only	Attributes from the request
-		#  %RAD_REPLY		Read-write	Attributes for the reply
-		# 
-		#  The return codes from functions in the perl_script
-		#  are passed directly back to the server.  These
-		#  codes are defined in doc/configurable_failover,
-		#  src/include/modules.h (RLM_MODULE_REJECT, etc),
-		#  and are pre-defined in the 'example.pl' program
-		#  which is included.
-		#		
-
-		#
-		#  List of functions in the module to call.
-		#  Uncomment and change if you want to use function
-		#  names other than the defaults.
-		#
-		#func_authenticate = authenticate
-		#func_authorize = authorize
-		#func_preacct = preacct
-		#func_accounting = accounting
-		#func_checksimul = checksimul
-		#func_pre_proxy = pre_proxy
-		#func_post_proxy = post_proxy
-		#func_post_auth = post_auth
-		#func_xlat = xlat
-		#func_detach = detach
-
-		#
-		#  Uncomment the following lines if you wish
-		#  to use separate functions for Start and Stop
-		#  accounting packets. In that case, the 
-		#  func_accounting function is not called.
-		#
-		#func_start_accounting = accounting_start
-		#func_stop_accounting = accounting_stop
-		
-		#  Uncomment the following lines if your perl is 
-		#  compiled with threads support.
-		#  The settings below are the defaults.
-		#
-		#max_clones = 32
-		#start_clones = 32
-		#min_spare_clones = 0
-		#max_spare_clones = 32
-		#cleanup_delay = 5
-		#max_request_per_clone = 0
-
-	}
-
-	#
-	#  Perform NT-Domain authentication.  This only works
-	#  with PAP authentication.  That is, Authentication-Request
-	#  packets containing a User-Password attribute.
-	#
-	#  To use it, add 'smb' into the 'authenticate' section,
-	#  and then in another module (usually the 'users' file),
-	#  set 'Auth-Type := SMB'
-	#
-	#  WARNING: this module is not only experimental, it's also
-	#  a security threat. It's not recommended to use it until
-	#  it gets fixed.
-	#
-	smb {
-		server = ntdomain.server.example.com
-		backup = backup.server.example.com
-		domain = NTDOMAIN
-	}
-
-	# See doc/rlm_fastusers before using this
-	# module or changing these values.
-	#
-	fastusers {
-		usersfile = ${confdir}/users_fast
-		hashsize = 1000
-		compat = no
-		# Reload the hash every 600 seconds (10mins)
-		hash_reload = 600
-	}
-
-	# Caching module
-	#
-	# Should be added in the post-auth section (after all other modules)
-	# and in the authorize section (before any other modules)
-	#
-	# authorize {
-	#	caching {
-	#		ok = return
-	#	}
-	#	[... other modules ...]
-	# }
-	# post-auth {
-	#	[... other modules ...]
-	#	caching
-	# }
-	#
-	# The caching module will cache the Auth-Type and reply items
-	# and send them back on any subsequent requests for the same key
-	#
-	# Configuration:
-	#
-	# filename: The gdbm file to use for the cache database
-	#		(can be memory mapped for more speed)
-	#
-	# key: A string to xlat and use as a key. For instance,
-	#	"%{Acct-Unique-Session-Id}"
-	#
-	# post-auth: If we find a cached entry, set the post-auth to that value
-	#
-	# cache-ttl: The time to cache the entry. The same time format
-	#		as the counter module apply here.
-	#	  num[hdwm] where:
-	#  	h: hours, d: days, w: weeks, m: months
-	#  	If the letter is ommited days will be assumed.
-	#	e.g. 1d == one day
-	#
-	# cache-size: The gdbm cache size to request (default 1000)
-	#
-	# hit-ratio: If set to non-zero we print out statistical
-	#	information after so many cache requests
-	#
-	# cache-rejects: Do we also cache rejects, or not? (default 'yes')
-	#
-	caching {
-		filename = ${db_dir}/db.cache
-		cache-ttl = 1d
-		hit-ratio = 1000
-		key = "%{Acct-Unique-Session-Id}"
-		#post-auth = ""
-		# cache-size = 2000
-		# cache-rejects = yes
-	}
-
-
-	# Simple module for logging of Account packets to radiusd.log
-	# You need to declare it in the accounting section for it to work
-	acctlog {
-		acctlog_update = ""
-		acctlog_start = "Connect: [%{User-Name}] (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} ip %{Framed-IP-Address})"
-		acctlog_stop = "Disconnect: [%{User-Name}] (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} ip %{Framed-IP-Address}) %{Acct-Session-Time} seconds"
-		acctlog_on = "NAS %C (%{NAS-IP-Address}) just came online"
-		acctlog_off = "NAS %C (%{NAS-IP-Address}) just went offline"
-	}
-
-	# Another implementation of the EAP module.
-	#
-	#  This module requires the libeap.so file from the hostap
-	#  software (http://hostap.epitest.fi/hostapd/).  It has been
-	#  tested on the development version of hostapd (0.6.1) ONLY.
-	#
-	#  In order to use it, you MUST build a "libeap.so" in hostapd,
-	#  which is not done by default.
-	#
-	#  You MUST also edit the file: src/modules/rlm_eap2/Makefile
-	#  to point to the location of the hostap include files.
-	#
-	#  This module CANNOT be used in the same way as the current
-	#  FreeRADIUS "eap" module.  There is NO way to look inside of
-	#  a tunneled request.  There is NO way to proxy a tunneled
-	#  request.  There is NO way to even look at the user name inside
-	#  of the tunneled request.  There is NO way to control the
-	#  choice of EAP types inside of the tunnel.  You MUST force
-	#  the server to choose "eap2" for authentication, because this
-	#  module has no "authorize" section.
-	#
-	#  If you want to use this module for experimentation, please
-	#  post your comments to the freeradius-devel list:
-	#
-	#    http://lists.freeradius.org/mailman/listinfo/freeradius-devel
-	#
-	#  If you want to use this module in a production (i.e. real-world)
-	#  environment:
-	#
-	#	!!! DO NOT USE IT IN A PRODUCTION ENVIRONMENT !!!
-	#
-	#  The module needs additional work to make it ready for
-	#  production use..  Please supply patches, or sponsor the
-	#  work by hiring a developer.  Do NOT ask when the work will
-	#  be done, because there is no plan to finish this module
-	#  unless there is demand for it.
-	#
-	eap2 {
-		#  EAP types are chosen in the order that they are
-		#  listed in this section.  There is no "default_eap_type"
-		#  as with rlm_eap.  Instead, the *first* EAP type is
-		#  used as the default type.
-		#
-		peap {
-		}
-
-		ttls {
-		}
-
-		#  This is the ONLY EAP type that has any configuration.
-		#  All other EAP types have no configuration.
-		#
-		tls {
-			ca_cert = ${confdir}/certs/ca.pem
-			server_cert = ${confdir}/certs/server.pem
-			private_key_file = ${confdir}/certs/server.pem
-			private_key_password = whatever
-		}
-
-		#
-		#  These next two methods do not supply keying material.
-		#
-		md5 {
-		}
-
-		mschapv2 {
-		}
-
-		#  LEAP is NOT supported by this module.
-		#  Use the "eap" module instead.
-
-		#  For other methods that MIGHT work, see the
-		#  configuration of hostap.  The methods are statically
-		#  linked in at compile time, and cannot be controlled
-		#  here.
-	}
-
-	#  Configuration for experimental EAP types.  The sub-sections
-	#  can be copied into eap.conf.
-	eap {
-		ikev2 {
-
-		# Server auth type 
-		# Allowed values are:
-		#  cert   - for certificate based server authentication,
-		#           other required settings for this type are
-		#	    'private_key_file' and 'certificate_file'
-		#  secret - for shared secret based server authentication, 
-		#           other required settings for this type is 'id'
-		# Default value of this option is 'secret'
-	#     server_authtype=cert
-
-		# Allowed default client auth types
-		# Allowed values are:
-		#   secret - for shared secret based client	authentication
-		#   cert   - for certificate based client authentication
-		#   both   - shared secret and certificate is allowed
-		#   none   - authentication will always fail
-		# Default value for this option is 'both'. This option could
-		#  be overwritten within 'usersfile' file by EAP-IKEv2-Auth
-		#  option. 
-	#   default_authtype = both
-
-		# path to trusted CA certificate file
-		CA_file="/path/to/CA/cacert.pem"
-
-		# path to CRL file, if not set, then there will be no
-		#  checks against CRL
-	#   crl_file="/path/to/crl.pem"
-
-		# path to file with user settings 
-		#
-		#  Note that this file is read ONLY on module initialization!
-		#
-		# default ${confdir}/eap_ikev2_users
-	#   usersfile=${confdir}/eap_ikev2_users
-
-#
-#  Sample "eap_ikev2_users" file entry:
-#
-#username  EAP-IKEv2-IDType := KEY_ID,  EAP-IKEv2-Secret := "tajne"
-
-## where:
-## username           - client user name from IKE-AUTH (IDr)  or CommonName
-##                      from x509 certificate
-## EAP-IKEv2-IDType   - ID Type - same as in expected IDType payload
-##	                allowable attributes for EAP-IKEv2-IDType:
-##	                IPV4_ADDR FQDN RFC822_ADDR IPV6_ADDR DER_ASN1_DN
-##			DER_ASN1_GN KEY_ID
-## EAP-IKEv2-Secret   - shared secret
-## EAP-IKEv2-AuthType - optional parameter which defines expected client auth
-##                      type. Allowed values are: secret,cert,both,none.
-##			For the meaning of this values, please see the
-##                      description of 'default_authtype'.
-##                      This attribute can overwrite 'default_authtype' value.
-
-
-
-		# path to  file with server private key
-		private_key_file="/path/to/srv-private-key.pem"
-
-		# password to private key file
-		private_key_password="passwd"
-
-		# path to file with server certificate
-		certificate_file="/path/to/srv-cert.pem"
-
-		# server identity string
-		id="deMaio"
-
-		# Server identity type. Allowed values are:
-		# IPV4_ADDR, FQDN, RFC822_ADDR, IPV6_ADDR, ASN1_DN, ASN1_GN,
-		#  KEY_ID
-		# Default value is:	KEY_ID
-	#   id_type = KEY_ID
-
-
-		# MTU (default: 1398)
-	#   fragment_size = 1398
-    
-		# maximal allowed number of resends SA_INIT after receiving
-		# 'invalid KEY' notification (default 3)
-	#   DH_counter_max = 3
-
-		# option which is used to control whenever send CERT REQ
-		#  payload or not.
-		# Allowed values for this option are "yes" or "no".
-		#Default value is "no".
-	#   certreq = "yes"
-
-		# option which cotrols fast reconnect capability.
-		# Allowed valuse for this option are "yes" or "no".
-		# Default value is "yes".
-	#   enable_fast_reauth = "no"
-    
-		# option which is used to control performing of DH exchange
-		#  during fast rekeying protocol run.
-		# Allowed values for this option are "yes" or "no".
-		# Default value is "no"
-	#   fast_DH_exchange = "yes"
-
-		# Option which is used to set up expiration time of inactive
-		#  IKEv2 session.
-		# After selected period of time (in seconds), inactive
-		# session data will be deleted.
-		# Default value of this option is set to 900 seconds
-	#   fast_timer_expire = 900
-
-		# list of server proposals of available cryptographic
-		# suites
-		proposals {
-			# proposal number #1 
-			proposal {
-
-				# Supported transforms types: encryption,
-				# prf, integrity, dhgroup. For multiple
-				# transforms just simple repeat key (i.e.
-				# integity).
-
-				# encryption algorithm
-				# supported algorithms:
-				# null,3des,aes_128_cbc,aes_192_cbc,
-				# aes_256_cbc,idea
-	            		# blowfish:n, where n range from 8 to 448 bits,
-				#  step 8 bits
-				# cast:n, where n range from 40 to 128 bits,
-				#  step 8 bits 
-				encryption = 3des
-
-				# pseudo random function. Supported prf's:
-				# hmac_md5, hmac_sha1, hmac_tiger
-				prf = hmac_sha1
-
-				# integrity algorithm. Supported algorithms:
-				# hmac_md5_96, hmac_sha1_96,des_mac
-				integrity = hmac_sha1_96
-				integrity = hmac_md5_96
-
-				# Diffie-Hellman groups:
-				# modp768, modp1024, modp1536, modp2048, 
-				# modp3072, modp4096, modp6144, modp8192
-				dhgroup = modp2048 
-			}
-		
-			# proposal number #2 
-			proposal {
-				encryption = 3des
-				prf = hmac_md5
-				integrity = hmac_md5_96
-				dhgroup = modp1024
-			}	
-
-			# proposal number #3 
-			proposal {
-				encryption=3des
-				prf=hmac_md5
-				integrity=hmac_md5_96
-				dhgroup=modp2048
-			} 
-		}
-		}
-	}
Index: nf/radpxy.eap.testbed.aaa/freeradius/hints
===================================================================
--- conf/radpxy.eap.testbed.aaa/freeradius/hints	(revision 11)
+++ 	(revision )
@@ -1,77 +1,0 @@
-# hints
-#
-#	The hints file.   This file is used to match
-#	a request, and then add attributes to it.  This
-#	process allows a user to login as "bob.ppp" (for example),
-#	and receive a PPP connection, even if the NAS doesn't
-#	ask for PPP.  The "hints" file is used to match the
-#	".ppp" portion of the username, and to add a set of
-#	"user requested PPP" attributes to the request.
-#
-#	Matching can take place with the the Prefix and Suffix
-#	attributes, just like in the "users" file.
-#	These attributes operate ONLY on the username, though.
-#
-#	Note that the attributes that are set for each
-#	entry are _NOT_ passed back to the terminal server.
-#	Instead they are added to the information that has
-#	been _SENT_ by the terminal server.
-#
-#	This extra information can be used in the users file to
-#	match on. Usually this is done in the DEFAULT entries,
-#	of which there can be more than one.
-#
-#	In addition a matching entry can transform a username
-#	for authentication purposes if the "Strip-User-Name"
-#	variable is set to Yes in an entry (default is Yes).
-#
-#	A special non-protocol name-value pair called "Hint"
-#	can be set to match on in the "users" file.
-#
-#	The following is how most ISPs want to set this up.
-#
-# Version:	$Id: hints,v 1.4 2004/01/29 16:42:43 aland Exp $
-#
-
-
-DEFAULT	Suffix == ".ppp", Strip-User-Name = Yes
-	Hint = "PPP",
-	Service-Type = Framed-User,
-	Framed-Protocol = PPP
-
-DEFAULT	Suffix == ".slip", Strip-User-Name = Yes
-	Hint = "SLIP",
-	Service-Type = Framed-User,
-	Framed-Protocol = SLIP
-
-DEFAULT	Suffix == ".cslip", Strip-User-Name = Yes
-	Hint = "CSLIP",
-	Service-Type = Framed-User,
-	Framed-Protocol = SLIP,
-	Framed-Compression = Van-Jacobson-TCP-IP
-
-######################################################################
-#
-#	These entries are old, and commented out by default.
-#	They confuse too many people when "Peter" logs in, and the
-#	server thinks that the user "eter" is asking for PPP.
-#
-#DEFAULT	Prefix == "U", Strip-User-Name = No
-#	Hint = "UUCP"
-
-#DEFAULT	Prefix == "P", Strip-User-Name = Yes
-#	Hint = "PPP",
-#	Service-Type = Framed-User,
-#	Framed-Protocol = PPP
-
-#DEFAULT	Prefix == "S", Strip-User-Name = Yes
-#	Hint = "SLIP",
-#	Service-Type = Framed-User,
-#	Framed-Protocol = SLIP
-
-#DEFAULT	Prefix == "C", Strip-User-Name = Yes
-#	Hint = "CSLIP",
-#	Service-Type = Framed-User,
-#	Framed-Protocol = SLIP,
-#	Framed-Compression = Van-Jacobson-TCP-IP
-
Index: nf/radpxy.eap.testbed.aaa/freeradius/huntgroups
===================================================================
--- conf/radpxy.eap.testbed.aaa/freeradius/huntgroups	(revision 11)
+++ 	(revision )
@@ -1,47 +1,0 @@
-#
-# huntgroups	This file defines the `huntgroups' that you have. A
-#		huntgroup is defined by specifying the IP address of
-#		the NAS and possibly a port range. Port can be identified
-#		as just one port, or a range (from-to), and multiple ports
-#		or ranges of ports must be seperated by a comma. For
-#		example: 1,2,3-8
-#
-#		Matching is done while RADIUS scans the user file; if it
-#		includes the selection criterium "Huntgroup-Name == XXX"
-#		the huntgroup is looked up in this file to see if it
-#		matches. There can be multiple definitions of the same
-#		huntgroup; the first one that matches will be used.
-#
-#		This file can also be used to define restricted access
-#		to certain huntgroups. The second and following lines
-#		define the access restrictions (based on username and
-#		UNIX usergroup) for the huntgroup.
-#
-
-#
-# Our POP in Alphen a/d Rijn has 3 terminal servers. Create a Huntgroup-Name
-# called Alphen that matches on all three terminal servers.
-#
-#alphen		NAS-IP-Address == 192.168.2.5
-#alphen		NAS-IP-Address == 192.168.2.6
-#alphen		NAS-IP-Address == 192.168.2.7
-
-#
-# The POP in Delft consists of only one terminal server.
-#
-#delft		NAS-IP-Address == 192.168.3.5
-
-#
-# Ports 0-7 on the first terminal server in Alphen are connected to
-# a huntgroup that is for business users only. Note that only one
-# of the username or groupname has to match to get access (OR/OR).
-#
-# Note that this huntgroup is a subset of the "alphen" huntgroup.
-#
-#business	NAS-IP-Address == 192.168.2.5, NAS-Port-Id == 0-7
-#		User-Name = rogerl,
-#		User-Name = henks,
-#		Group = business,
-#		Group = staff
-
-supauths	NAS-IP-Address == 192.168.105.70
Index: nf/radpxy.eap.testbed.aaa/freeradius/ldap.attrmap
===================================================================
--- conf/radpxy.eap.testbed.aaa/freeradius/ldap.attrmap	(revision 11)
+++ 	(revision )
@@ -1,71 +1,0 @@
-#
-# Mapping of RADIUS dictionary attributes to LDAP directory attributes
-# to be used by LDAP authentication and authorization module (rlm_ldap)
-#
-# Format:
-#   ItemType	RADIUS-Attribute-Name		ldapAttributeName  [operator]
-#
-# Where:
-#   ItemType              = checkItem or replyItem 
-#   RADIUS-Attribute-Name = attribute name in RADIUS dictionary
-#   ldapAttributeName     = attribute name in LDAP schema
-#   operator              = optional, and may not be present.
-#			    If not present, defaults to "==" for checkItems,
-#			    and "=" for replyItems.
-#			    If present, the operator here should be one
-#			    of the same operators as defined in the "users"3
-#			    file ("man users", or "man 5 users").
-#			    If an operator is present in the value of the
-#			    LDAP entry (i.e. ":=foo"), then it over-rides
-#			    both the default, and any operator given here.
-#
-# If $GENERIC$ is specified as RADIUS-Attribute-Name, the line specifies
-# a LDAP attribute which can be used to store any RADIUS 
-# attribute/value-pair in LDAP directory.
-#
-# You should edit this file to suit it to your needs.
-#
-
-checkItem	$GENERIC$			radiusCheckItem
-replyItem	$GENERIC$			radiusReplyItem
-
-checkItem	Auth-Type			radiusAuthType
-checkItem	Simultaneous-Use		radiusSimultaneousUse
-checkItem	Called-Station-Id		radiusCalledStationId
-checkItem	Calling-Station-Id		radiusCallingStationId
-checkItem	LM-Password			lmPassword
-checkItem	NT-Password			ntPassword
-checkItem	LM-Password			sambaLmPassword
-checkItem	NT-Password			sambaNtPassword
-checkItem	SMB-Account-CTRL-TEXT		acctFlags
-checkItem	Expiration			radiusExpiration
-checkItem	NAS-IP-Address			radiusNASIpAddress
-
-replyItem	Service-Type			radiusServiceType
-replyItem	Framed-Protocol			radiusFramedProtocol
-replyItem	Framed-IP-Address		radiusFramedIPAddress
-replyItem	Framed-IP-Netmask		radiusFramedIPNetmask
-replyItem	Framed-Route			radiusFramedRoute
-replyItem	Framed-Routing			radiusFramedRouting
-replyItem	Filter-Id			radiusFilterId
-replyItem	Framed-MTU			radiusFramedMTU
-replyItem	Framed-Compression		radiusFramedCompression
-replyItem	Login-IP-Host			radiusLoginIPHost
-replyItem	Login-Service			radiusLoginService
-replyItem	Login-TCP-Port			radiusLoginTCPPort
-replyItem	Callback-Number			radiusCallbackNumber
-replyItem	Callback-Id			radiusCallbackId
-replyItem	Framed-IPX-Network		radiusFramedIPXNetwork
-replyItem	Class				radiusClass
-replyItem	Session-Timeout			radiusSessionTimeout
-replyItem	Idle-Timeout			radiusIdleTimeout
-replyItem	Termination-Action		radiusTerminationAction
-replyItem	Login-LAT-Service		radiusLoginLATService
-replyItem	Login-LAT-Node			radiusLoginLATNode
-replyItem	Login-LAT-Group			radiusLoginLATGroup
-replyItem	Framed-AppleTalk-Link		radiusFramedAppleTalkLink
-replyItem	Framed-AppleTalk-Network	radiusFramedAppleTalkNetwork
-replyItem	Framed-AppleTalk-Zone		radiusFramedAppleTalkZone
-replyItem	Port-Limit			radiusPortLimit
-replyItem	Login-LAT-Port			radiusLoginLATPort
-replyItem	Reply-Message			radiusReplyMessage
Index: nf/radpxy.eap.testbed.aaa/freeradius/otp.conf
===================================================================
--- conf/radpxy.eap.testbed.aaa/freeradius/otp.conf	(revision 11)
+++ 	(revision )
@@ -1,78 +1,0 @@
-#
-#  Configuration for the OTP module.
-#
-
-#  This module allows you to use various handheld OTP tokens
-#  for authentication (Auth-Type := otp).  These tokens are
-#  available from various vendors.
-#
-#  It works in conjunction with otpd, which implements token
-#  management and OTP verification functions; and lsmd or gsmd,
-#  which implements synchronous state management functions.
-#  otpd, lsmd and gsmd are available from TRI-D Systems:
-#              <http://www.tri-dsystems.com/>
-
-#  You must list this module in BOTH the authorize and authenticate
-#  sections in order to use it.
-otp {
-	# otpd rendezvous point.
-	# (default: /var/run/otpd/socket)
-	#otpd_rp = /var/run/otpd/socket
-
-	# Text to use for the challenge.  The '%' character is
-	# disallowed, except that you MUST have a single "%s"
-	# sequence in the string; the challenge itself is
-	# inserted there.  (default "Challenge: %s\n Response: ")
-	#challenge_prompt = "Challenge: %s\n Response: "
-
-	# Length of the challenge.  Most tokens probably support a
-	# max of 8 digits.  (range: 5-32 digits, default 6)
-	#challenge_length = 6
-
-	# Maximum time, in seconds, that a challenge is valid.
-	# (The user must respond to a challenge within this time.)
-	# It is also the minimal time between consecutive async mode
-	# authentications, a necessary restriction due to an inherent
-	# weakness of the RADIUS protocol which allows replay attacks.
-	# (default: 30)
-	#challenge_delay = 30
-
-	# Whether or not to allow asynchronous ("pure" challenge/
-	# response) mode authentication.  Since sync mode is much more
-	# usable, and all reasonable tokens support it, the typical
-	# use of async mode is to allow resync of event based tokens.
-	# But because of the vulnerability of async mode with some tokens,
-	# you probably want to disable this and require that out-of-sync
-	# users resync from specifically secured terminals.
-	# See the otpd docs for more info.
-	# (default: no)
-	#allow_async = no
-
-	# Whether or not to allow synchronous mode authentication.
-	# When using otpd with lsmd, it is *CRITICALLY IMPORTANT*
-	# that if your OTP users can authenticate to multiple RADIUS
-	# servers, this must be "yes" for the primary/default server,
-	# and "no" for the others.  This is because lsmd does not
-	# share state information across multiple servers.  Using "yes"
-	# on all your RADIUS servers would allow replay attacks!
-	# Also, for event based tokens, the user will be out of sync
-	# on the "other" servers.  In order to use "yes" on all your
-	# servers, you must either use gsmd, which synchronizes state
-	# globally, or implement your own state synchronization method.
-	# (default: yes)
-	#allow_sync = yes
-
-	# If both allow_async and allow_sync are "yes", a challenge is
-	# always presented to the user.  This is incompatible with NAS's
-	# that can't present or don't handle Access-Challenge's, e.g.
-	# PPTP servers.  Even though a challenge is presented, the user
-	# can still enter their synchronous passcode.
-
-	# The following are MPPE settings.  Note that MS-CHAP (v1) is
-	# strongly discouraged.  All possible values are listed as
-	# {value = meaning}.  Default values are first.
-	#mschapv2_mppe = {2 = required, 1 = optional, 0 = forbidden}
-	#mschapv2_mppe_bits = {2 = 128, 1 = 128 or 40, 0 = 40}
-	#mschap_mppe = {2 = required, 1 = optional, 0 = forbidden}
-	#mschap_mppe_bits = {2 = 128}
-}
Index: nf/radpxy.eap.testbed.aaa/freeradius/policy.conf
===================================================================
--- conf/radpxy.eap.testbed.aaa/freeradius/policy.conf	(revision 11)
+++ 	(revision )
@@ -1,54 +1,0 @@
-# -*- text -*-
-##
-## policy.conf	-- FreeRADIUS server configuration file.
-##
-##	http://www.freeradius.org/
-##	$Id: policy.conf,v 1.2 2008/01/15 16:29:55 aland Exp $
-##
-
-#
-#  Policies are virtual modules, similar to those defined in the
-#  "instantate" section of radiusd.conf.
-#
-#  Defining a policy here means that it can be referenced in multiple
-#  places as a *name*, rather than as a series of conditions to match,
-#  and actions to take.
-#
-#  Policies are something like subroutines in a normal language, but
-#  they cannot be called recursively.  They MUST be defined in order.
-#  If policy A calls policy B, then B MUST be defined before A.
-#
-policy {
-	#
-	#	Forbid all EAP types.
-	#
-##	forbid_eap {
-##		if (EAP-Message) {
-##			reject
-##		}
-##	}
-
-	#
-	#	Forbid all non-EAP types outside of an EAP tunnel.
-	#
-##	permit_only_eap {
-##		if (!EAP-Message) {
-			#  We MAY be inside of a TTLS tunnel.
-			#  PEAP and EAP-FAST require EAP inside of
-			#  the tunnel, so this check is OK.
-			#  If so, then there MUST be an outer EAP message.
-##			if (!"%{outer.request:EAP-Message}") {
-##				reject
-##			}
-##		}
-##	}
-
-	#
-	#	Forbid all attempts to login via realms.
-	#
-##	deny_realms {
-##		if (User-Name =~ /@|\\/) {
-##			reject
-##		}
-##	}
-}
Index: nf/radpxy.eap.testbed.aaa/freeradius/policy.txt
===================================================================
--- conf/radpxy.eap.testbed.aaa/freeradius/policy.txt	(revision 11)
+++ 	(revision )
@@ -1,185 +1,0 @@
-#
-#	Sample of a policy language for rlm_policy.
-#
-#	This is NOT the "unlang" policy, and has NO RELATION to "unlang"!
-#	The syntax is different, and the functionality is different.
-#
-
-#	As of 2.0.0, the new configuration "un-language" is better
-#	tested, has more features, and is better integrated into the
-#	server than the rlm_policy module.  rlm_policy is deprecated,
-#	and will likely be removed in a future release.
-#
-#	There is no documentation other than this file.
-#
-#	The syntax is odd, but it sort of works.
-#
-#	A number of sites are using it in production servers,
-#	so it appears to be stable.  However, we cannot answer
-#	questions about it, because we use "unlang", instead of
-#	this file.	
-#
-#	$Id: policy.txt,v 1.5 2007/12/29 05:01:45 aland Exp $
-#
-#  Debugging statements
-#
-#debug print_tokens	# as we're parsing this file
-debug print_policy	# once the file has been parsed
-
-# Using this requires code edits to rlm_policy/evaluate.c
-#debug evaluate		# print limited information during evaluation
-
-#
-#  A named policy.
-#
-policy 3pm {
-if (Time-Of-Day < "15:00") {
-   #
-   #  The general form of edits to the attribute lists:
-   #
-   #   name s-operator {
-   #	    Attribute-Name = Value
-   #   }
-   #
-   #  name is: request, reply, control, proxy-request, proxy-reply
-   #
-   #  s-operator is operator for section, not attributes:
-   #
-   #		=	append, using operators from attributes
-   #		.=	append attributes, ignoring operators from attributes
-   #		^=	add to head of list
-   #		^==	add BEFORE matching attribute
-   #		^.	append
-   #		^.=	append BEFORE matching attribute
-   #		$=	add AFTER  (same as =)
-   #		$==	add AFTER matching attribute
-   #		$.	add after  (same as .=)
-   #		$.=	add after matching
-   #
-   #  If the above explanation confuses you, don't ask.  Try various
-   #  configurations to see what happens.  The results are difficult
-   #  to explain, but easy to understand once you see them in action.
-   #
-   #  The "matching attribute" text above refers to the syntax:
-   #
-   #   name s-operator (match) {
-   #	    Attribute-Name = Value
-   #   }
-   #
-   #  Where "match" is something like:	User-Name == "bob"
-   #
-   #  This lets you insert/edit/update attributes by selected
-   #  position, which can be useful.
-   #
-   reply .= {
-      # Use ARAP-Password for testing because it's an attribute
-      # no one cares about.
-      ARAP-Password = "< 15:00"
-   }
-}
-
-}
-
-#
-#  A named policy, executed during the "authorize" phase,
-#  because it's named "authorize". 
-#
-policy authorize {
-  if (CHAP-Password) {
-     if (!CHAP-Challenge) {
-        print "Adding CHAP-Challenge = %{request:Packet-Authentication-Vector}\n"
-
-        #
-        #  Append all attributes to the specified list.
-        #  The per-attribute operators MUST be '='
-        #
-        request .= {
-           CHAP-Challenge = "%{request:Packet-Authentication-Vector}"
-        }
-     }
-
-     #
-     #  Use per-attribute operators to do override, replace, etc.
-     #  It's "control", not "check items", because "check items"
-     #  is a hold-over from the "users" file, and we no longer like that.
-     #
-     control = {
-     	  Auth-Type := CHAP
-     }
-  }
-
-#
-#  This could just as well be "%{ldap: query...}" =~ ...
-#
-#  if ("%{User-Name}" =~ "^(b)") {
-#     reply .= {
-#	   Arap-Password = "Hello, %{1}"
-#     }
-#  }
-
-  #
-  #  Execute "3pm", as if it was in-line here.
-  #
-#  call 3pm
-}
-
-######################################################################
-#
-#  The following entries are for example purposes only.
-#
-
-#  Insert the attribute at the top of the list.
-#
-#reply ^= {
-#  Attribute1 += "Value1"
-#}
-
-
-#  Insert attribute1 before Attribute2 if found, otherwise it behaves 
-#  like ^=
-#reply ^== ( Attribute2 == "Value2" ) {
-#	Attribute1 += "Value1"
-#}
-
-# ^. and ^.= have the same difference as .= and =
-# namely they append the attribute list instead of looking at the
-# attribute operators.
-#
-# Otherwise they are the same.
-
-#  Motivation:
-#
-#  Cisco NAS's will kick users who assign a VRF after assigning an IP 
-#  address. The VRF must come first.
-#
-#  A sample policy to fix this is:
-#
-policy add_inter_vrf {
-	#
-	#	If there's a matching lcp:...,
-	#	then add the vrf entry before it.
-	#
-	reply ^== ( reply:Cisco-Avpair =~ "lcp:interface-config") {
-		Cisco-Avpair    += "lcp:interface-config=ip vrf forwarding CHL-PRIVATE"
-	}
-
-	#
-	#	If there's no ip address thingy,
-	#	add ip unnumbered after the vrf stuff.
-	#
-	if (!reply:Cisco-Avpair =~ "lcp:interface-config=ip address.*") {
-	        reply $== (reply:Cisco-AVpair == "lcp:interface-config=ip vrf forwarding CHL-PRIVATE") {
-        		Cisco-Avpair    += "lcp:interface-config=ip unnumbered l10"
-	        }
-	}
-
-	#
-	#	No IP address assigned through RADIUS, tell the Cisco
-	#	NAS to assign it from it's own private IP pool.
-	#
-	if (!reply:Framed-IP-Address =* "") {
-		reply = {
-                	Cisco-Avpair    += "ip:addr-pool=privatepool"
-		}
-	}
-}
Index: nf/radpxy.eap.testbed.aaa/freeradius/preproxy_users
===================================================================
--- conf/radpxy.eap.testbed.aaa/freeradius/preproxy_users	(revision 11)
+++ 	(revision )
@@ -1,2 +1,0 @@
-
-DEFAULT
Index: nf/radpxy.eap.testbed.aaa/freeradius/proxy.conf
===================================================================
--- conf/radpxy.eap.testbed.aaa/freeradius/proxy.conf	(revision 11)
+++ 	(revision )
@@ -1,45 +1,0 @@
-# -*- text -*-
-proxy server {
-	default_fallback = no
-
-}
-
-home_server gw.eap.testbed.aaa {
-	type = auth+acct
-	ipaddr = 192.168.105.30
-	port = 1812
-	secret = radiusecret3.2
-	response_window = 20
-	zombie_period = 40
-
-	revive_interval = 120
-}
-
-home_server_pool my_pool {
-	type = fail-over
-	home_server = gw.eap.testbed.aaa
-}
-
-######################################################################
-#
-#
-#  This section defines a new-style "realm".  Note the in version 2.0,
-#  there are many fewer configuration items than in 1.x for a realm.
-#
-#  Automatic proxying is done via the "realms" module (see "man
-#  rlm_realm").  To manually proxy the request put this entry in the
-#  "users" file:
-
-#
-#
-#DEFAULT	Proxy-To-Realm := "realm_name"
-#
-#
-
-
-realm DEFAULT {
-	pool = my_pool
-	nostrip
-}
-
-
Index: nf/radpxy.eap.testbed.aaa/freeradius/radiusd.conf
===================================================================
--- conf/radpxy.eap.testbed.aaa/freeradius/radiusd.conf	(revision 11)
+++ 	(revision )
@@ -1,260 +1,0 @@
-# -*- text -*-
-
-prefix = /usr
-exec_prefix = /usr
-sysconfdir = /etc
-localstatedir = /var
-sbindir = ${exec_prefix}/sbin
-logdir = /var/log/freeradius
-
-raddbdir = /root/conf/freeradius
-
-radacctdir = ${logdir}/radacct
-confdir = ${raddbdir}
-run_dir = ${localstatedir}/run/freeradius
-db_dir = $(raddbdir)
-libdir = /usr/lib/freeradius
-pidfile = ${run_dir}/freeradius.pid
-user = freerad
-group = freerad
-max_request_time = 30
-cleanup_delay = 5
-max_requests = 1024
-listen {
-	type = auth
-	ipaddr = *
-	port = 0
-}
-listen {
-	ipaddr = *
-	port = 0
-	type = acct
-}
-hostname_lookups = no
-allow_core_dumps = yes
-regular_expressions	= yes
-extended_expressions	= yes
-log {
-	destination = files
-	file = ${logdir}/radius.log
-	syslog_facility = daemon
-	stripped_names = no
-	auth = no
-	auth_badpass = no
-	auth_goodpass = no
-}
-checkrad = ${sbindir}/checkrad
-security {
-	max_attributes = 200
-	reject_delay = 1
-	status_server = yes
-}
-
-# PROXY CONFIGURATION
-#
-#  proxy_requests: Turns proxying of RADIUS requests on or off.
-#
-#  The server has proxying turned on by default.  If your system is NOT
-#  set up to proxy requests to another server, then you can turn proxying
-#  off here.  This will save a small amount of resources on the server.
-#
-#  If you have proxying turned off, and your configuration files say
-#  to proxy a request, then an error message will be logged.
-#
-#  To disable proxying, change the "yes" to "no", and comment the
-#  $INCLUDE line.
-#
-#  allowed values: {no, yes}
-#
-proxy_requests  = yes
-$INCLUDE proxy.conf
-
-
-# CLIENTS CONFIGURATION
-#
-#  Client configuration is defined in "clients.conf".  
-#
-
-#  The 'clients.conf' file contains all of the information from the old
-#  'clients' and 'naslist' configuration files.  We recommend that you
-#  do NOT use 'client's or 'naslist', although they are still
-#  supported.
-#
-#  Anything listed in 'clients.conf' will take precedence over the
-#  information from the old-style configuration files.
-#
-$INCLUDE clients.conf
-
-
-snmp	= no
-thread pool {
-	start_servers = 5
-	max_servers = 32
-	min_spare_servers = 3
-	max_spare_servers = 10
-	max_requests_per_server = 0
-}
-
-modules {
-	#  'username@realm'
-	#
-	realm suffix {
-		format = suffix
-		delimiter = "@"
-	}
-
-	preprocess {
-		huntgroups = ${confdir}/huntgroups
-		hints = ${confdir}/hints
-		with_ascend_hack = no
-		ascend_channels_per_line = 23
-		with_ntdomain_hack = no
-		with_specialix_jetstream_hack = no
-		with_cisco_vsa_hack = no
-	}
-	
-	files {
-		# The default key attribute to use for matches.  The content
-		# of this attribute is used to match the "name" of the
-		# entry.
-		#key = "%{Stripped-User-Name:-%{User-Name}}"
-
-		usersfile = ${confdir}/users
-		acctusersfile = ${confdir}/acct_users
-		preproxy_usersfile = ${confdir}/preproxy_users
-
-		compat = no
-	}
-
-	# Write a detailed log of all accounting records received.
-	#
-	detail {
-		detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d
-		detailperm = 0600
-		header = "%t"
-	}
-
-
-	detail auth_log {
-		detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d
-
-		#
-		#  This MUST be 0600, otherwise anyone can read
-		#  the users passwords!
-		# detailperm = 0600
-
-		# You may also strip out passwords completely
-		#suppress {
-			# User-Password
-		#}
-	}
-	
-	#  This module logs packets proxied to a home server.
-	#
-	#  You will also need to un-comment the 'pre_proxy_log' line
-	#  in the 'pre-proxy' section, below.
-	#
-	detail pre_proxy_log {
-		detailfile = ${radacctdir}/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d
-
-		#
-		#  This MUST be 0600, otherwise anyone can read
-		#  the users passwords!
-		# detailperm = 0600
-
-		# You may also strip out passwords completely
-		#suppress {
-			# User-Password
-		#}
-	}
-
-	#
-	#  This module logs response packets from a home server.
-	#
-	#  You will also need to un-comment the 'post_proxy_log' line
-	#  in the 'post-proxy' section, below.
-	#
-	detail post_proxy_log {
-		detailfile = ${radacctdir}/%{Client-IP-Address}/post-proxy-detail-%Y%m%d
-
-		# detailperm = 0600
-	}
-
-	radutmp {
-		filename = ${logdir}/radutmp
-		username = %{User-Name}
-		case_sensitive = yes
-		check_with_nas = yes		
-		perm = 0600
-		callerid = "yes"
-	}
-	radutmp sradutmp {
-		filename = ${logdir}/sradutmp
-		perm = 0644
-		callerid = "no"
-	}
-
-	attr_filter attr_filter.post-proxy {
-		attrsfile = ${confdir}/attrs
-	}
-	attr_filter attr_filter.pre-proxy {
-		attrsfile = ${confdir}/attrs.pre-proxy
-	}
-	attr_filter attr_filter.access_reject {
-		key = %{User-Name}
-		attrsfile = ${confdir}/attrs.access_reject
-	}
-	attr_filter attr_filter.accounting_response {
-		key = %{User-Name}
-		attrsfile = ${confdir}/attrs.accounting_response
-	}
-	always fail {
-		rcode = fail
-	}
-	always reject {
-		rcode = reject
-	}
-	always noop {
-		rcode = noop
-	}
-	always handled {
-		rcode = handled
-	}
-	always updated {
-		rcode = updated
-	}
-	always notfound {
-		rcode = notfound
-	}
-	always ok {
-		rcode = ok
-		simulcount = 0
-		mpp = no
-	}
-}
-
-instantiate {
-}
-
-
-
-
-
-authorize {
-	preprocess
-	auth_log
-	suffix
-	files
-}
-preacct {
-	preprocess
-	suffix
-	files
-}
-pre-proxy {
-	files
-	pre_proxy_log
-}
-post-proxy {
-	post_proxy_log
-}
Index: nf/radpxy.eap.testbed.aaa/freeradius/sites-available/README
===================================================================
--- conf/radpxy.eap.testbed.aaa/freeradius/sites-available/README	(revision 11)
+++ 	(revision )
@@ -1,335 +1,0 @@
-1.  Virtual Servers.
-
-  FreeRADIUS 2.0 supports virtual servers.  This is probably the
-single largest change that is NOT backwards compatible with 1.x.
-
-  The virtual servers do NOT have to be set up with the
-"sites-available" and "sites-enabled" directories.  You can still have
-one "radiusd.conf" file, and put the server configuration there:
-
-	...
-	server {
-		authorize {
-			...
-		}
-		authenticate {
-			...
-		}
-		...
-	}
-	...
-
-  The power of virtual servers lies in their ability to separate
-policies.  A policy can be placed into a virtual server, where it is
-guaranteed to affect only the requests that are passed through that
-virtual server.  In 1.x, the policies were global, and it sometimes
-took much effort to write a policy so that it only applied in certain
-limited situations.
-
-
-2.  What do we mean by "virtual server"?
-
-
-  A virtual server is a (nearly complete) RADIUS server, just like a
-configuration for FreeRADIUS 1.x.  However, FreeRADIUS can now run
-multiple virtual servers at the same time.  The virtual servers can
-even proxy requests to each other!
-
-  The simplest way to create a virtual server is to take the all of
-the request processing sections from radius.conf, ("authorize" ,
-"authenticate", etc.) and wrap them in a "server {}" block, as above.
-
-  You can create another virtual server by:
-
-    1) defining a new "server foo {...}" section in radiusd.conf
-    2) Putting the normal "authorize", etc. sections inside of it
-    3) Adding a "listen" section *inside* of the "server" section.
-
-  e.g.
-
-	...
-	server foo {
-		listen {
-			ipaddr = 127.0.0.1
-			port = 2000
-			type = auth
-		}
-
-		authorize {
-			update control {
-				Cleartext-Password := "bob"
-			}
-			pap
-		}
-
-		authenticate {
-			pap
-		}
-	}
-	...
-
-  With that text added to "radiusd.conf", run the server in debugging
-mode (radiusd -X), and in another terminal window, type:
-
-$ radtest bob bob localhost:2000 0 testing123
-
-  You should see the server return an Access-Accept.
-
-
-3. Capabilities and limitations
-
-
-  The only sub-sections that can appear in a virtual server section
-are:
-
-	listen
-	client
-	authorize
-	authenticate
-	post-auth
-	pre-proxy
-	post-proxy
-	preacct
-	accounting
-	session
-
-  All other configuration parameters (modules, etc.) are global.
-
-  Inside of a virtual server, the authorize, etc. sections have their
-normal meaning, and can contain anything that an authorize section
-could contain in 1.x.
-
-  When a "listen" section is inside of a virtual server definition, it
-means that all requests sent to that IP/port will be processed through
-the virtual server.  There cannot be two "listen" sections with the
-same IP address and port number.
-
-  When a "client" section is inside of a virtual server definition, it
-means that that client is known only to the "listen" sections that are
-also inside of that virtual server.  Not only is this client
-definition available only to this virtual server, but the details of
-the client configuration is also available only to this virtual
-server.
-
-  i.e. Two virtual servers can listen on different IP address and
-ports, but both can have a client with IP address 127.0.0.1.  The
-shared secret for that client can be different for each virtual
-server.
-
-
-4. More complex "listen" capabilities
-
-  The "listen" sections have a few additional configuration items that
-were not in 1.x, and were not mentioned above.  These configuration
-items enable almost any mapping of IP / port to clients to virtual
-servers.
-
-  The configuration items are:
-
-	virtual_server = <name>
-
-		If set, all requests sent to this IP / port are processed
-		through the named virtual server.
-
-		This directive can be used only for "listen" sections
-		that are global.  i.e. It CANNOT be used if the
-		"listen" section is inside of a virtual server.
-
-	clients = <name>
-
-		If set, the "listen" section looks for a "clients" section:
-
-			clients <name> {
-				...
-			}
-
-		It looks inside of that named "clients" section for
-		"client" subsections, at least one of which must
-		exist.  Each client in that section is added to the
-		list of known clients for this IP / port.  No other
-		clients are known.
-
-		If it is set, it over-rides the list of clients (if
-		any) in the same virtual server.  Note that the
-		clients are NOT additive!
-
-		If it is not set, then the clients from the current
-		virtual server (if any) are used.  If there are no
-		clients in this virtual server, then the global
-		clients are used.
-
-		i.e. The most specific directive is used:
-			* configuration in this "listen" section
-			* clients in the same virtual server
-			* global clients
-
-		The directives are also *exclusive*, not *additive*.
-		If you have one client in a virtual server, and
-		another client referenced from a "listen" section,
-		then that "listen" section will ONLY use the second
-		client.  It will NOT use both clients.
-
-
-5. More complex "client" capabilities
-
-  The "client" sections have a few additional configuration items that
-were not in 1.x, and were not mentioned above.  These configuration
-items enable almost any mapping of IP / port to clients to virtual
-servers.
-
-  The configuration items are:
-
-	virtual_server = <name>
-
-		If set, all requests from this client are processed
-		through the named virtual server.
-
-		This directive can be used only for "client" sections
-		that are global.  i.e. It CANNOT be used if the
-		"client" section is inside of a virtual server.
-
-  If the "listen" section has a "server" entry, and a matching
-client is found ALSO with a "server" entry, then the clients server is
-used for that request.
-
-
-6. Worked examples
-
-
-  Listening on one socket, and mapping requests from two clients to
-two different servers.
-
-	listen {
-		...
-	}
-	client one {
-		...
-		virtual_server = server_one
-	}
-	client two {
-		...
-		virtual_server = server_two
-	}
-	server server_one {
-		authorize {
-			...
-		}
-		...
-	}
-	server server_two {
-		authorize {
-			...
-		}
-		...
-	}
-
-  This could also be done as:
-
-
-	listen {
-		...
-		virtual_server = server_one
-	}
-	client one {
-		...
-	}
-	client two {
-		...
-		virtual_server = server_two
-	}
-	server server_one {
-		authorize {
-			...
-		}
-		...
-	}
-	server server_two {
-		authorize {
-			...
-		}
-		...
-	}
-
-  In this case, the default server for the socket is "server_one", so
-there is no need to set that in the client "one" configuration.  The
-"server_two" configuration for client "two" over-rides the default
-setting for the socket.
-
-  Note that the following configuration will NOT work:
-
-	listen {
-		...
-		virtual_server = server_one
-	}
-	client one {
-		...
-	}
-	server server_one {
-		authorize {
-			...
-		}
-		...
-	}
-	server server_two {
-		client two {
-			...
-		}
-		authorize {
-			...
-		}
-		...
-	}
-
-  In this example, client "two" is hidden inside of the virtual
-server, where the "listen" section cannot find it.
-
-
-7. Outlined examples
-
-  This section outlines a number of examples, with alternatives.
-
-  One server, multiple sockets
-	- multiple "listen" sections in a "server" section
-
-  one server per client
-	- define multiple servers
-	- have a global "listen" section
-	- have multiple global "clients", each with "virtual_server = X"
-
-  two servers, each with their own sockets
-	- define multiple servers
-	- put "client" sections into each "server"
-	- put a "listen" section into each "server"
-
-	Each server can list the same client IP, and the secret
-	can be different
-
-  two sockets, sharing a list of clients, but pointing to different servers
-	- define global "listen" sections
-	- in each, set "virtual_server = X"
-	- in each, set "clients = Y"
-	- define "clients Y" section, containing multiple clients.
-
-	This also means that you can have a third socket, which
-	doesn't share any of these clients.
-
-
-8.  How to decide what to do
-
-
-  If you want *completely* separate policies for a socket or a client,
-then create a separate virtual server.  Then, map the request to that
-server by setting configuration entries in a "listen" section or in a
-"client" section.
-
-  Start off with the common cases first.  If most of the clients
-and/or sockets get a particular policy, make that policy the default.
-Configure it without paying attention to the sockets or clients you
-want to add later, and without adding a second virtual server.  Once
-it works, then add the second virtual server.
-
-  If you want to re-use the previously defined sockets with the second
-virtual server, then you will need one or more global "client"
-sections.  Those clients will contain a "virtual_server = ..." entry
-that will direct requests from those clients to the appropriate
-virtual server.
Index: nf/radpxy.eap.testbed.aaa/freeradius/sites-available/buffered-sql
===================================================================
--- conf/radpxy.eap.testbed.aaa/freeradius/sites-available/buffered-sql	(revision 11)
+++ 	(revision )
@@ -1,111 +1,0 @@
-# -*- text -*-
-######################################################################
-#
-#	In 2.0.0, radrelay functionality is integrated into the
-#	server core.  This virtual server gives an example of
-#	using radrelay functionality inside of the server.
-#
-#	In this example, the detail file is read, and the data
-#	is put into SQL.  This configuration is used when a RADIUS
-#	server on this machine is receiving accounting packets,
-#	and writing them to the detail file.
-#
-#	The purpose of this virtual server is to de-couple the storage
-#	of long-term accounting data in SQL from "live" information
-#	needed by the RADIUS server as it is running. 
-#
-#	The benefit of this approach is that for a busy server, the
-#	overhead of performing SQL qeuries may be significant.  Also,
-#	if the SQL databases are large (as is typical for ones storing
-#	months of data), the INSERTs and UPDATEs may take a relatively
-#	long time.  Rather than slowing down the RADIUS server by
-#	having it interact with a database, you can just log the
-#	packets to a detail file, and then read that file later at a
-#	time when the RADIUS server is typically lightly loaded.
-#
-#	If you use on virtual server to log to the detail file,
-#	and another virtual server (i.e. this one) to read from
-#	the detail file, then this process will happen automatically.
-#	A sudden spike of RADIUS traffic means that the detail file
-#	will grow in size, and the server will be able to handle
-#	large volumes of traffic quickly.  When the traffic dies down,
-#	the server will have time to read the detail file, and insert
-#	the data into a long-term SQL database.
-#
-#	$Id: buffered-sql,v 1.1 2007/10/23 03:53:19 aland Exp $
-#
-######################################################################
-
-server buffered-sql {
-	listen {
-		type = detail
-
-		#  The location where the detail file is located.
-		#  This should be on local disk, and NOT on an NFS
-		#  mounted location!
-		filename = ${radacctdir}/detail
-
-		#
-		#  The server can read accounting packets from the
-		#  detail file much more quickly than those packets
-		#  can be written to a database.  If the database is
-		#  overloaded, then bad things can happen.
-		#
-		#  The server will keep track of how long it takes to
-		#  process an entry from the detail file.  It will
-		#  then pause between handling entries.  This pause
-		#  allows databases to "catch up", and gives the
-		#  server time to notice that other packets may have
-		#  arrived.
-		#		
-		#  The pause is calculated dynamically, to ensure that
-		#  the load due to reading the detail files is limited
-		#  to a small percentage of CPU time.  The
-		#  "load_factor" configuration item is a number
-		#  between 1 and 100.  The server will try to keep the
-		#  percentage of time taken by "detail" file entries
-		#  to "load_factor" percentage of the CPU time.
-		#
-		#  If the "load_factor" is set to 100, then the server
-		#  will read packets as fast as it can, usually
-		#  causing databases to go into overload.
-		#  
-		load_factor = 10
-	}
-
-	#
-	#  Pre-accounting.  Decide which accounting type to use.
-	#
-	preacct {
-		preprocess
-	
-		#
-		#  Ensure that we have a semi-unique identifier for every
-		#  request, and many NAS boxes are broken.
-		acct_unique
-	
-		#
-		#  Read the 'acct_users' file.  This isn't always
-		#  necessary, and can be deleted if you do not use it.
-		files
-	}
-	
-	#
-	#  Accounting.  Log the accounting data.
-	#
-	accounting {
-		#
-		#  Log traffic to an SQL database.
-		#
-		#  See "Accounting queries" in sql.conf
-	#	sql
-
-
-		#  Cisco VoIP specific bulk accounting
-	#	pgsql-voip
-	
-	}
-
-	# The requests are not being proxied, so no pre/post-proxy
-	# sections are necessary.
-}
Index: nf/radpxy.eap.testbed.aaa/freeradius/sites-available/copy-acct-to-home-server
===================================================================
--- conf/radpxy.eap.testbed.aaa/freeradius/sites-available/copy-acct-to-home-server	(revision 11)
+++ 	(revision )
@@ -1,149 +1,0 @@
-# -*- text -*-
-######################################################################
-#
-#	In 2.0.0, radrelay functionality is integrated into the
-#	server core.  This virtual server gives an example of
-#	using radrelay functionality inside of the server.
-#
-#	In this example, the detail file is read, and the packets
-#	are proxied to a home server.  You will have to configure
-#	realms, home_server_pool, and home_server in proxy.conf
-#	for this to work.
-#
-#	The purpose of this virtual server is to enable duplication
-#	of information across a load-balanced, or fail-over set of
-#	servers.  For example, if a group of clients lists two
-#	home servers (primary, secondary), then RADIUS accounting
-#	messages will go only to one server at a time.  This file
-#	configures a server (primary, secondary) to send copies of
-#	the accounting information to each other.
-#
-#	That way, each server has the same set of information, and
-#	can make the same decision about the user.
-#
-#	$Id: copy-acct-to-home-server,v 1.3 2008/04/26 15:23:43 aland Exp $
-#
-######################################################################
-
-server copy-acct-to-home-server {
-	listen {
-		type = detail
-
-		#  The location where the detail file is located.
-		#  This should be on local disk, and NOT on an NFS
-		#  mounted location!
-		#
-		#  On most systems, this should support file globbing
-		#  e.g. "${radacctdir}/detail-*:*"
-		#  This lets you write many smaller detail files as in
-		#  the example in radiusd.conf: ".../detail-%Y%m%d:%H"
-		#  Writing many small files is often better than writing
-		#  one large file.  File globbing also means that with
-		#  a common naming scheme for detail files, then you can
-		#  have many detail file writers, and only one reader.
-		filename = ${radacctdir}/detail
-
-		#
-		#  The server can read accounting packets from the
-		#  detail file much more quickly than those packets
-		#  can be written to a database.  If the database is
-		#  overloaded, then bad things can happen.
-		#
-		#  The server will keep track of how long it takes to
-		#  process an entry from the detail file.  It will
-		#  then pause between handling entries.  This pause
-		#  allows databases to "catch up", and gives the
-		#  server time to notice that other packets may have
-		#  arrived.
-		#		
-		#  The pause is calculated dynamically, to ensure that
-		#  the load due to reading the detail files is limited
-		#  to a small percentage of CPU time.  The
-		#  "load_factor" configuration item is a number
-		#  between 1 and 100.  The server will try to keep the
-		#  percentage of time taken by "detail" file entries
-		#  to "load_factor" percentage of the CPU time.
-		#
-		#  If the "load_factor" is set to 100, then the server
-		#  will read packets as fast as it can, usually
-		#  causing databases to go into overload.
-		#  
-		load_factor = 10
-	}
-
-	#
-	#  Pre-accounting.  Decide which accounting type to use.
-	#
-	preacct {
-		preprocess
-	
-		# Since we're just proxying, we don't need acct_unique.
-
-		#
-		#  Look for IPASS-style 'realm/', and if not found, look for
-		#  '@realm', and decide whether or not to proxy, based on
-		#  that.
-		#
-		#  Accounting requests are generally proxied to the same
-		#  home server as authentication requests.
-	#	IPASS
-		suffix
-	#	ntdomain
-	
-		#
-		#  Read the 'acct_users' file.  This isn't always
-		#  necessary, and can be deleted if you do not use it.
-		files
-	}
-	
-	#
-	#  Accounting.  Log the accounting data.
-	#
-	accounting {
-		   #
-		   # Since we're proxying, we don't log anything
-		   # locally.  Ensure that the accounting section
-		   # "succeeds" by forcing an "ok" return.
-		   ok	
-	}
-	
-	
-	#
-	#  When the server decides to proxy a request to a home server,
-	#  the proxied request is first passed through the pre-proxy
-	#  stage.  This stage can re-write the request, or decide to
-	#  cancel the proxy.
-	#
-	#  Only a few modules currently have this method.
-	#
-	pre-proxy {
-	#	attr_rewrite
-	
-		#  If you want to have a log of packets proxied to a home
-		#  server, un-comment the following line, and the
-		#  'detail pre_proxy_log' section in radiusd.conf.
-	#	pre_proxy_log
-	}
-	
-	#
-	#  When the server receives a reply to a request it proxied
-	#  to a home server, the request may be massaged here, in the
-	#  post-proxy stage.
-	#
-	post-proxy {
-		#
-	
-		#  If you want to have a log of replies from a home
-		#  server, un-comment the following line, and the
-		#  'detail post_proxy_log' section in radiusd.conf.
-	#	post_proxy_log
-	
-	#	attr_rewrite
-	
-		#  Uncomment the following line if you want to filter
-		#  replies from remote proxies based on the rules
-		#  defined in the 'attrs' file.
-	
-	#	attr_filter
-	}
-}
Index: nf/radpxy.eap.testbed.aaa/freeradius/sites-available/default
===================================================================
--- conf/radpxy.eap.testbed.aaa/freeradius/sites-available/default	(revision 11)
+++ 	(revision )
@@ -1,502 +1,0 @@
-######################################################################
-#
-#	As of 2.0.0, FreeRADIUS supports virtual hosts using the
-#	"server" section, and configuration directives.
-#
-#	Virtual hosts should be put into the "sites-available"
-#	directory.  Soft links should be created in the "sites-enabled"
-#	directory to these files.  This is done in a normal installation.
-#
-#	$Id: default,v 1.8 2008/04/01 08:34:31 aland Exp $
-#
-######################################################################
-#
-#	Read "man radiusd" before editing this file.  See the section
-#	titled DEBUGGING.  It outlines a method where you can quickly
-#	obtain the configuration you want, without running into
-#	trouble.  See also "man unlang", which documents the format
-#	of this file.
-#
-#	This configuration is designed to work in the widest possible
-#	set of circumstances, with the widest possible number of
-#	authentication methods.  This means that in general, you should
-#	need to make very few changes to this file.
-#
-#	The best way to configure the server for your local system
-#	is to CAREFULLY edit this file.  Most attempts to make large
-#	edits to this file will BREAK THE SERVER.  Any edits should
-#	be small, and tested by running the server with "radiusd -X".
-#	Once the edits have been verified to work, save a copy of these
-#	configuration files somewhere.  (e.g. as a "tar" file).  Then,
-#	make more edits, and test, as above.
-#
-#	There are many "commented out" references to modules such
-#	as ldap, sql, etc.  These references serve as place-holders.
-#	If you need the functionality of that module, then configure
-#	it in radiusd.conf, and un-comment the references to it in
-#	this file.  In most cases, those small changes will result
-#	in the server being able to connect to the DB, and to
-#	authenticate users.
-#
-######################################################################
-
-#
-#	In 1.x, the "authorize", etc. sections were global in
-#	radiusd.conf.  As of 2.0, they SHOULD be in a server section.
-#
-#	The server section with no virtual server name is the "default"
-#	section.  It is used when no server name is specified.
-#
-#	We don't indent the rest of this file, because doing so
-#	would make it harder to read.
-#
-
-#  Authorization. First preprocess (hints and huntgroups files),
-#  then realms, and finally look in the "users" file.
-#
-#  The order of the realm modules will determine the order that
-#  we try to find a matching realm.
-#
-#  Make *sure* that 'preprocess' comes before any realm if you 
-#  need to setup hints for the remote radius server
-authorize {
-	#
-	#  The preprocess module takes care of sanitizing some bizarre
-	#  attributes in the request, and turning them into attributes
-	#  which are more standard.
-	#
-	#  It takes care of processing the 'raddb/hints' and the
-	#  'raddb/huntgroups' files.
-	#
-	#  It also adds the %{Client-IP-Address} attribute to the request.
-	preprocess
-
-	#
-	#  If you want to have a log of authentication requests,
-	#  un-comment the following line, and the 'detail auth_log'
-	#  section, above.
-#	auth_log
-
-	#
-	#  The chap module will set 'Auth-Type := CHAP' if we are
-	#  handling a CHAP request and Auth-Type has not already been set
-	chap
-
-	#
-	#  If the users are logging in with an MS-CHAP-Challenge
-	#  attribute for authentication, the mschap module will find
-	#  the MS-CHAP-Challenge attribute, and add 'Auth-Type := MS-CHAP'
-	#  to the request, which will cause the server to then use
-	#  the mschap module for authentication.
-	mschap
-
-	#
-	#  If you have a Cisco SIP server authenticating against
-	#  FreeRADIUS, uncomment the following line, and the 'digest'
-	#  line in the 'authenticate' section.
-#	digest
-
-	#
-	#  Look for IPASS style 'realm/', and if not found, look for
-	#  '@realm', and decide whether or not to proxy, based on
-	#  that.
-#	IPASS
-
-	#
-	#  If you are using multiple kinds of realms, you probably
-	#  want to set "ignore_null = yes" for all of them.
-	#  Otherwise, when the first style of realm doesn't match,
-	#  the other styles won't be checked.
-	#
-	suffix
-#	ntdomain
-
-	#
-	#  This module takes care of EAP-MD5, EAP-TLS, and EAP-LEAP
-	#  authentication.
-	#
-	#  It also sets the EAP-Type attribute in the request
-	#  attribute list to the EAP type from the packet.
-	#
-	#  As of 2.0, the EAP module returns "ok" in the authorize stage
-	#  for TTLS and PEAP.  In 1.x, it never returned "ok" here, so
-	#  this change is compatible with older configurations.
-	#
-	#  The example below uses module failover to avoid querying all
-	#  of the following modules if the EAP module returns "ok".
-	#  Therefore, your LDAP and/or SQL servers will not be queried
-	#  for the many packets that go back and forth to set up TTLS
-	#  or PEAP.  The load on those servers will therefore be reduced.
-	#
-	eap {
-		ok = return
-	}
-
-	#
-	#  Pull crypt'd passwords from /etc/passwd or /etc/shadow,
-	#  using the system API's to get the password.  If you want
-	#  to read /etc/passwd or /etc/shadow directly, see the
-	#  passwd module in radiusd.conf.
-	#
-	unix
-
-	#
-	#  Read the 'users' file
-	files
-
-	#
-	#  Look in an SQL database.  The schema of the database
-	#  is meant to mirror the "users" file.
-	#
-	#  See "Authorization Queries" in sql.conf
-#	sql
-
-	#
-	#  If you are using /etc/smbpasswd, and are also doing
-	#  mschap authentication, the un-comment this line, and
-	#  configure the 'etc_smbpasswd' module, above.
-#	etc_smbpasswd
-
-	#
-	#  The ldap module will set Auth-Type to LDAP if it has not
-	#  already been set
-#	ldap
-
-	#
-	#  Enforce daily limits on time spent logged in.
-#	daily
-
-	#
-	# Use the checkval module
-#	checkval
-
-	expiration
-	logintime
-
-	#
-	#  If no other module has claimed responsibility for
-	#  authentication, then try to use PAP.  This allows the
-	#  other modules listed above to add a "known good" password
-	#  to the request, and to do nothing else.  The PAP module
-	#  will then see that password, and use it to do PAP
-	#  authentication.
-	#
-	#  This module should be listed last, so that the other modules
-	#  get a chance to set Auth-Type for themselves.
-	#
-	pap
-
-	#
-	#  If "status_server = yes", then Status-Server messages are passed
-	#  through the following section, and ONLY the following section.
-	#  This permits you to do DB queries, for example.  If the modules
-	#  listed here return "fail", then NO response is sent.
-	#
-#	Autz-Type Status-Server {
-#
-#	}
-}
-
-
-#  Authentication.
-#
-#
-#  This section lists which modules are available for authentication.
-#  Note that it does NOT mean 'try each module in order'.  It means
-#  that a module from the 'authorize' section adds a configuration
-#  attribute 'Auth-Type := FOO'.  That authentication type is then
-#  used to pick the apropriate module from the list below.
-#
-
-#  In general, you SHOULD NOT set the Auth-Type attribute.  The server
-#  will figure it out on its own, and will do the right thing.  The
-#  most common side effect of erroneously setting the Auth-Type
-#  attribute is that one authentication method will work, but the
-#  others will not.
-#
-#  The common reasons to set the Auth-Type attribute by hand
-#  is to either forcibly reject the user (Auth-Type := Reject),
-#  or to or forcibly accept the user (Auth-Type := Accept).
-#
-#  Note that Auth-Type := Accept will NOT work with EAP.
-#
-#  Please do not put "unlang" configurations into the "authenticate"
-#  section.  Put them in the "post-auth" section instead.  That's what
-#  the post-auth section is for.
-#
-authenticate {
-	#
-	#  PAP authentication, when a back-end database listed
-	#  in the 'authorize' section supplies a password.  The
-	#  password can be clear-text, or encrypted.
-	Auth-Type PAP {
-		pap
-	}
-
-	#
-	#  Most people want CHAP authentication
-	#  A back-end database listed in the 'authorize' section
-	#  MUST supply a CLEAR TEXT password.  Encrypted passwords
-	#  won't work.
-	Auth-Type CHAP {
-		chap
-	}
-
-	#
-	#  MSCHAP authentication.
-	Auth-Type MS-CHAP {
-		mschap
-	}
-
-	#
-	#  If you have a Cisco SIP server authenticating against
-	#  FreeRADIUS, uncomment the following line, and the 'digest'
-	#  line in the 'authorize' section.
-#	digest
-
-	#
-	#  Pluggable Authentication Modules.
-#	pam
-
-	#
-	#  See 'man getpwent' for information on how the 'unix'
-	#  module checks the users password.  Note that packets
-	#  containing CHAP-Password attributes CANNOT be authenticated
-	#  against /etc/passwd!  See the FAQ for details.
-	#  
-	unix
-
-	# Uncomment it if you want to use ldap for authentication
-	#
-	# Note that this means "check plain-text password against
-	# the ldap database", which means that EAP won't work,
-	# as it does not supply a plain-text password.
-#	Auth-Type LDAP {
-#		ldap
-#	}
-
-	#
-	#  Allow EAP authentication.
-	eap
-}
-
-
-#
-#  Pre-accounting.  Decide which accounting type to use.
-#
-preacct {
-	preprocess
-
-	#
-	#  Ensure that we have a semi-unique identifier for every
-	#  request, and many NAS boxes are broken.
-	acct_unique
-
-	#
-	#  Look for IPASS-style 'realm/', and if not found, look for
-	#  '@realm', and decide whether or not to proxy, based on
-	#  that.
-	#
-	#  Accounting requests are generally proxied to the same
-	#  home server as authentication requests.
-#	IPASS
-	suffix
-#	ntdomain
-
-	#
-	#  Read the 'acct_users' file
-	files
-}
-
-#
-#  Accounting.  Log the accounting data.
-#
-accounting {
-	#
-	#  Create a 'detail'ed log of the packets.
-	#  Note that accounting requests which are proxied
-	#  are also logged in the detail file.
-	detail
-#	daily
-
-	#  Update the wtmp file
-	#
-	#  If you don't use "radlast", you can delete this line.
-	unix
-
-	#
-	#  For Simultaneous-Use tracking.
-	#
-	#  Due to packet losses in the network, the data here
-	#  may be incorrect.  There is little we can do about it.
-	radutmp
-#	sradutmp
-
-	#  Return an address to the IP Pool when we see a stop record.
-#	main_pool
-
-	#
-	#  Log traffic to an SQL database.
-	#
-	#  See "Accounting queries" in sql.conf
-#	sql
-
-	#
-	#  Instead of sending the query to the SQL server,
-	#  write it into a log file.
-	#
-#	sql_log
-
-	#  Cisco VoIP specific bulk accounting
-#	pgsql-voip
-
-	#  Filter attributes from the accounting response.
-	attr_filter.accounting_response
-
-	#
-	#  See "Autz-Type Status-Server" for how this works.
-	#
-#	Acct-Type Status-Server {
-#
-#	}
-}
-
-
-#  Session database, used for checking Simultaneous-Use. Either the radutmp 
-#  or rlm_sql module can handle this.
-#  The rlm_sql module is *much* faster
-session {
-	radutmp
-
-	#
-	#  See "Simultaneous Use Checking Queries" in sql.conf
-#	sql
-}
-
-
-#  Post-Authentication
-#  Once we KNOW that the user has been authenticated, there are
-#  additional steps we can take.
-post-auth {
-	#  Get an address from the IP Pool.
-#	main_pool
-
-	#
-	#  If you want to have a log of authentication replies,
-	#  un-comment the following line, and the 'detail reply_log'
-	#  section, above.
-#	reply_log
-
-	#
-	#  After authenticating the user, do another SQL query.
-	#
-	#  See "Authentication Logging Queries" in sql.conf
-#	sql
-
-	#
-	#  Instead of sending the query to the SQL server,
-	#  write it into a log file.
-	#
-#	sql_log
-
-	#
-	#  Un-comment the following if you have set
-	#  'edir_account_policy_check = yes' in the ldap module sub-section of
-	#  the 'modules' section.
-	#
-#	ldap
-
-	exec
-
-	#
-	#  Access-Reject packets are sent through the REJECT sub-section of the
-	#  post-auth section.
-	#
-	#  Add the ldap module name (or instance) if you have set 
-	#  'edir_account_policy_check = yes' in the ldap module configuration
-	#
-	Post-Auth-Type REJECT {
-		attr_filter.access_reject
-	}
-}
-
-#
-#  When the server decides to proxy a request to a home server,
-#  the proxied request is first passed through the pre-proxy
-#  stage.  This stage can re-write the request, or decide to
-#  cancel the proxy.
-#
-#  Only a few modules currently have this method.
-#
-pre-proxy {
-#	attr_rewrite
-
-	#  Uncomment the following line if you want to change attributes
-	#  as defined in the preproxy_users file.
-#	files
-
-	#  Uncomment the following line if you want to filter requests
-	#  sent to remote servers based on the rules defined in the
-	#  'attrs.pre-proxy' file.
-#	attr_filter.pre-proxy
-
-	#  If you want to have a log of packets proxied to a home
-	#  server, un-comment the following line, and the
-	#  'detail pre_proxy_log' section, above.
-#	pre_proxy_log
-}
-
-#
-#  When the server receives a reply to a request it proxied
-#  to a home server, the request may be massaged here, in the
-#  post-proxy stage.
-#
-post-proxy {
-
-	#  If you want to have a log of replies from a home server,
-	#  un-comment the following line, and the 'detail post_proxy_log'
-	#  section, above.
-#	post_proxy_log
-
-#	attr_rewrite
-
-	#  Uncomment the following line if you want to filter replies from
-	#  remote proxies based on the rules defined in the 'attrs' file.
-#	attr_filter.post-proxy
-
-	#
-	#  If you are proxying LEAP, you MUST configure the EAP
-	#  module, and you MUST list it here, in the post-proxy
-	#  stage.
-	#
-	#  You MUST also use the 'nostrip' option in the 'realm'
-	#  configuration.  Otherwise, the User-Name attribute
-	#  in the proxied request will not match the user name
-	#  hidden inside of the EAP packet, and the end server will
-	#  reject the EAP request.
-	#
-	eap
-
-	#
-	#  If the server tries to proxy a request and fails, then the
-	#  request is processed through the modules in this section.
-	#
-	#  The main use of this section is to permit robust proxying
-	#  of accounting packets.  The server can be configured to
-	#  proxy accounting packets as part of normal processing.
-	#  Then, if the home server goes down, accounting packets can
-	#  be logged to a local "detail" file, for processing with
-	#  radrelay.  When the home server comes back up, radrelay
-	#  will read the detail file, and send the packets to the
-	#  home server.
-	#
-	#  With this configuration, the server always responds to
-	#  Accounting-Requests from the NAS, but only writes
-	#  accounting packets to disk if the home server is down.
-	#
-#	Post-Proxy-Type Fail {
-#			detail
-#	}
-
-}
-
Index: nf/radpxy.eap.testbed.aaa/freeradius/sites-available/dhcp
===================================================================
--- conf/radpxy.eap.testbed.aaa/freeradius/sites-available/dhcp	(revision 11)
+++ 	(revision )
@@ -1,193 +1,0 @@
-# -*- text -*-
-######################################################################
-#
-#	This is a virtual server that handles DHCP.
-#
-#		!!!! WARNING !!!!
-#
-#	This code is experimental, and SHOULD NOT be used in a
-#	production system.  It is intended for validation and
-#	experimentation ONLY.
-#
-#	In order for this to work, you will need to run configure:
-#
-#		$ ./configure --with-dhcp
-#		$ make
-#		$ make install
-#
-#	DHCP is NOT enabled by default.
-#
-#	The goal of this effort is to get the code in front of
-#	people who are interested in another DHCP server.
-#	We NEED FEEDBACK, patches, bug reports, etc.  Especially patches!
-#
-#	Please contribute, or this work will be nothing more than
-#	a curiosity.
-#
-#
-#	Q: What does it do?
-#	A: It allows the server to receive DHCP packets, and to
-#	   respond with static, pre-configured DHCP responses.
-#
-#	Q: Does it do static/dynamic IP assignment?
-#	A: No.  Or, maybe.  Try it and see.
-#
-#	Q: Does it read ISC configuration or lease files?
-#	A: No.  Please submit patches.
-#
-#	Q: Does it have DHCP feature X?
-#	A: No.  Please submit patches.
-#
-#	Q: Does it support option 82?
-#	A: Yes.
-#
-#	Q: Does it support other options?
-#	A: Maybe.  See dictionary.dhcp.  Please submit patches.
-#
-#	Q: It doesn't seem to do much of anything!
-#	A: Exactly.
-#
-#	$Id: dhcp,v 1.1 2008/04/20 14:52:18 aland Exp $
-#
-######################################################################
-
-#
-#  The DHCP functionality goes into a virtual server.
-#
-server dhcp {
-
-#  This is part RADIUS legacy (sorry).  Clients have to be defined for
-#  DHCP.  This is not normal practice for a DHCP server, but it does
-#  enable a simple filter list of "known clients".
-#
-
-#  DHCP packets are normally sent with source IP address 0.0.0.0.
-#  If you want to accept packets from any IP, uncomment the "netmask"
-#  entry below, and delete the other "client" sections in this file.
-client any {
-	ipaddr = 0.0.0.0
-	#netmask = 0
-	dhcp = yes
-}
-
-#  For local testing.
-client localnet {
-	ipaddr = 127.0.0.0
-	netmask = 8
-	dhcp = yes
-}
-
-#  Define a DHCP socket.
-#
-#  The default port below is 6700, so you don't break your network.
-#  If you want it to do real DHCP, change this to 67, and good luck!
-#
-#  You can also bind the DHCP socket to an interface.
-#  See raddb/radiusd.conf for examples.
-#
-#  This lets you run *one* DHCP server instance and have it listen on
-#  multiple interfaces, each with a separate policy.
-listen {
-	ipaddr = *
-	port = 6700
-	type = dhcp
-}
-
-#  Packets received on the socket will be processed through one
-#  of the following sections, named after the DHCP packet type.
-#  See dictionary.dhcp for the packet types.
-dhcp DHCP-Discover {
-	update reply {
-	       DHCP-Message-Type = DHCP-Offer
-	}
-
-	#  The contents here are invented.  Change them!
-	update reply {
-	        DHCP-Domain-Name-Server = 127.0.0.1
-	        DHCP-Domain-Name-Server = 127.0.0.2
-		DHCP-Subnet-Mask = 255.255.255.0
-		DHCP-Router-Address = 192.168.1.1
-		DHCP-IP-Address-Lease-Time = 86400
-		DHCP-DHCP-Server-Identifier = 192.168.1.1
-	}
-
-	#  Do a simple mapping of MAC to assigned IP.
-	#
-	#  See below for the definition of the "mac2ip"
-	#  module.
-	#
-	#mac2ip
-
-	#  If the MAC wasn't found in that list, do something else.
-	#  You could call a Perl, Python, or Java script here.
-
-	#if (notfound) {
-	# ...
-	#}
-
-	ok
-}
-
-dhcp DHCP-Request {
-	update reply {
-	       DHCP-Message-Type = DHCP-Ack
-	}
-
-	#  The contents here are invented.  Change them!
-	update reply {
-	        DHCP-Domain-Name-Server = 127.0.0.1
-	        DHCP-Domain-Name-Server = 127.0.0.2
-		DHCP-Subnet-Mask = 255.255.255.0
-		DHCP-Router-Address = 192.168.1.1
-		DHCP-IP-Address-Lease-Time = 86400
-		DHCP-DHCP-Server-Identifier = 192.168.1.1
-	}
-
-	#  Do a simple mapping of MAC to assigned IP.
-	#
-	#  See below for the definition of the "mac2ip"
-	#  module.
-	#
-	#mac2ip
-
-	#  If the MAC wasn't found in that list, do something else.
-	#  You could call a Perl, Python, or Java script here.
-
-	#if (notfound) {
-	# ...
-	#}
-
-	ok
-}
-
-#  If there's no named section for the packet type, then the packet
-#  is processed through this section.
-dhcp {
-	# send a DHCP NAK.
-	reject
-}
-
-
-}
-
-######################################################################
-#
-#  This next section is a sample configuration for the "passwd"
-#  module, that reads flat-text files.  It should go into
-#  radiusd.conf, in the "modules" section.
-#
-#  The file is in the format <mac>,<ip>
-#
-#	00:01:02:03:04:05,192.168.1.100
-#	01:01:02:03:04:05,192.168.1.101
-#	02:01:02:03:04:05,192.168.1.102
-#
-#  This lets you perform simple static IP assignment.
-#
-######################################################################
-
-#passwd mac2vlan {
-#	filename = ${confdir}/mac2ip
-#	format = "*DHCP-Client-Hardware-Address:=DHCP-Your-IP-Address"
-#	delimiter = ","
-#}
Index: nf/radpxy.eap.testbed.aaa/freeradius/sites-available/example
===================================================================
--- conf/radpxy.eap.testbed.aaa/freeradius/sites-available/example	(revision 11)
+++ 	(revision )
@@ -1,122 +1,0 @@
-######################################################################
-#
-#	An example virtual server configuration.
-#
-#	$Id: example,v 1.2 2007/10/09 14:25:36 aland Exp $
-#
-######################################################################
-
-
-#
-#	This client will be available to any "listen" section that
-#	are defined outside of a virtual server section.  However,
-#	when the server receives a packet from this client, the
-#	request will be processed through the "example" virtual
-#	server, as the "client" section contains a configuration item
-#	to that effect.
-#
-#	Note that this client will be able to send requests to any
-#	port defined in a global "listen" section.  It will NOT,
-#	however, be able to send requests to a port defined in a
-#	"listen" section that is contained in a "server" section.
-#
-#	With careful matching of configurations, you should be able
-#	to:
-#
-#	- Define one authentication port, but process each client
-#	  through a separate virtual server.
-#
-#	- define multiple authentication ports, each with a private
-#	  list of clients.
-#
-#	- define multiple authentication ports, each of which may
-#	  have the same client listed, but with different shared
-#	  secrets
-#
-#	FYI: We use an address in the 192.0.2.* space for this example,
-#	as RFC 3330 says that that /24 range is used for documenation
-#	and examples, and should not appear on the net.  You shouldn't
-#	use it for anything, either.
-#
-client 192.0.2.10 {
-	shortname	= example-client
-	secret		= testing123
-	virtual_server  = example
-}
-
-######################################################################
-#
-#	An example virtual server.  It starts off with "server name {"
-#	The "name" is used to reference this server from a "listen"
-#	or "client" section.
-#
-######################################################################
-server example {
-	#
-	#	Listen on 192.0.2.1:1812 for Access-Requests
-	#
-	#	When the server receives a packet, it is processed
-	#	through the "authorize", etc. sections listed here,
-	#	NOT the global ones the "default" site.
-	#
-	listen {
-		ipaddr = 192.0.2.1
-		port = 1821
-		type = auth
-	}
-
-	#
-	#	This client is listed within the "server" section,
-	#	and is therefore known ONLY to the socket defined
-	#	in the "listen" section above.  If the client IP
-	#	sends a request to a different socket, the server
-	#	will treat it as an unknown client, and will not
-	#	respond.
-	#
-	#	In contrast, the client listed at the top of this file
-	#	is outside of any "server" section, and is therefore
-	#	global in scope.  It can send packets to any port
-	#	defined in a global "listen" section.  It CANNOT send
-	#	packets to the listen section defined above, though.
-	#
-	#	Note that you don't have to have a "virtual_server = example"
-	#	line here, as the client is encapsulated within
-	#	the "server" section.
-	#
-	client 192.0.2.9 {
-		shortname	= example-client
-		secret		= testing123
-	}
-
-	authorize {
-		#
-		#  Some example policies.  See "man unlang" for more.
-		#
-		if ("%{User-Name}" == "bob") {
-			update control {
-				Cleartext-Password := "bob"
-			}
-		}
-
-		#
-		#  And then reject the user.  The next line requires
-		#  that the "always reject {}" section is defined in
-		#  the "modules" section of radiusd.conf.
-		#
-		reject
-	}
-
-	authenticate {
-
-	}
-
-	post-auth {
-
-		Post-Auth-Type Reject {
-			update reply {
-				Reply-Message = "This is only an example."
-			}
-		}
-	}
-
-}
Index: nf/radpxy.eap.testbed.aaa/freeradius/sites-available/inner-tunnel
===================================================================
--- conf/radpxy.eap.testbed.aaa/freeradius/sites-available/inner-tunnel	(revision 11)
+++ 	(revision )
@@ -1,405 +1,0 @@
-# -*- text -*-
-######################################################################
-#
-#	This is a virtual server that handles *only* inner tunnel
-#	requests for EAP-TTLS and PEAP types.
-#
-#	$Id: inner-tunnel,v 1.6 2008/03/29 21:33:12 aland Exp $
-#
-######################################################################
-
-server inner-tunnel {
-
-#
-#  Un-comment the next section to perform test on the inner tunnel
-#  without needing an outer tunnel session.  The tests will not be
-#  exactly the same as when TTLS or PEAP are used, but they will
-#  be close enough for many tests.
-#
-#listen {
-#       ipaddr = 127.0.0.1
-#       port = 18120
-#       type = auth
-#}
-
-
-#  Authorization. First preprocess (hints and huntgroups files),
-#  then realms, and finally look in the "users" file.
-#
-#  The order of the realm modules will determine the order that
-#  we try to find a matching realm.
-#
-#  Make *sure* that 'preprocess' comes before any realm if you 
-#  need to setup hints for the remote radius server
-authorize {
-	#
-	#  The chap module will set 'Auth-Type := CHAP' if we are
-	#  handling a CHAP request and Auth-Type has not already been set
-	chap
-
-	#
-	#  If the users are logging in with an MS-CHAP-Challenge
-	#  attribute for authentication, the mschap module will find
-	#  the MS-CHAP-Challenge attribute, and add 'Auth-Type := MS-CHAP'
-	#  to the request, which will cause the server to then use
-	#  the mschap module for authentication.
-	mschap
-
-	#
-	#  Pull crypt'd passwords from /etc/passwd or /etc/shadow,
-	#  using the system API's to get the password.  If you want
-	#  to read /etc/passwd or /etc/shadow directly, see the
-	#  passwd module, above.
-	#
-	unix
-
-	#
-	#  Look for IPASS style 'realm/', and if not found, look for
-	#  '@realm', and decide whether or not to proxy, based on
-	#  that.
-#	IPASS
-
-	#
-	#  If you are using multiple kinds of realms, you probably
-	#  want to set "ignore_null = yes" for all of them.
-	#  Otherwise, when the first style of realm doesn't match,
-	#  the other styles won't be checked.
-	#
-	#  Note that proxying the inner tunnel authentication means
-	#  that the user MAY use one identity in the outer session
-	#  (e.g. "anonymous", and a different one here
-	#  (e.g. "user@example.com").  The inner session will then be
-	#  proxied elsewhere for authentication.  If you are not
-	#  careful, this means that the user can cause you to forward
-	#  the authentication to another RADIUS server, and have the
-	#  accounting logs *not* sent to the other server.  This makes
-	#  it difficult to bill people for their network activity.
-	#
-	suffix
-#	ntdomain
-
-	#
-	#  The "suffix" module takes care of stripping the domain
-	#  (e.g. "@example.com") from the User-Name attribute, and the
-	#  next few lines ensure that the request is not proxied.
-	#
-	#  If you want the inner tunnel request to be proxied, delete
-	#  the next few lines.
-	#
-	update control {
-	       Proxy-To-Realm := LOCAL
-	}
-
-	#
-	#  This module takes care of EAP-MSCHAPv2 authentication.
-	#
-	#  It also sets the EAP-Type attribute in the request
-	#  attribute list to the EAP type from the packet.
-	#
-	#  The example below uses module failover to avoid querying all
-	#  of the following modules if the EAP module returns "ok".
-	#  Therefore, your LDAP and/or SQL servers will not be queried
-	#  for the many packets that go back and forth to set up TTLS
-	#  or PEAP.  The load on those servers will therefore be reduced.
-	#
-	eap {
-		ok = return
-	}
-
-	#
-	#  Read the 'users' file
-	files
-
-	#
-	#  Look in an SQL database.  The schema of the database
-	#  is meant to mirror the "users" file.
-	#
-	#  See "Authorization Queries" in sql.conf
-#	sql
-
-	#
-	#  If you are using /etc/smbpasswd, and are also doing
-	#  mschap authentication, the un-comment this line, and
-	#  configure the 'etc_smbpasswd' module, above.
-#	etc_smbpasswd
-
-	#
-	#  The ldap module will set Auth-Type to LDAP if it has not
-	#  already been set
-#	ldap
-
-	#
-	#  Enforce daily limits on time spent logged in.
-#	daily
-
-	#
-	# Use the checkval module
-#	checkval
-
-	expiration
-	logintime
-
-	#
-	#  If no other module has claimed responsibility for
-	#  authentication, then try to use PAP.  This allows the
-	#  other modules listed above to add a "known good" password
-	#  to the request, and to do nothing else.  The PAP module
-	#  will then see that password, and use it to do PAP
-	#  authentication.
-	#
-	#  This module should be listed last, so that the other modules
-	#  get a chance to set Auth-Type for themselves.
-	#
-	pap
-}
-
-
-#  Authentication.
-#
-#
-#  This section lists which modules are available for authentication.
-#  Note that it does NOT mean 'try each module in order'.  It means
-#  that a module from the 'authorize' section adds a configuration
-#  attribute 'Auth-Type := FOO'.  That authentication type is then
-#  used to pick the apropriate module from the list below.
-#
-
-#  In general, you SHOULD NOT set the Auth-Type attribute.  The server
-#  will figure it out on its own, and will do the right thing.  The
-#  most common side effect of erroneously setting the Auth-Type
-#  attribute is that one authentication method will work, but the
-#  others will not.
-#
-#  The common reasons to set the Auth-Type attribute by hand
-#  is to either forcibly reject the user, or forcibly accept him.
-#
-authenticate {
-	#
-	#  PAP authentication, when a back-end database listed
-	#  in the 'authorize' section supplies a password.  The
-	#  password can be clear-text, or encrypted.
-	Auth-Type PAP {
-		pap
-	}
-
-	#
-	#  Most people want CHAP authentication
-	#  A back-end database listed in the 'authorize' section
-	#  MUST supply a CLEAR TEXT password.  Encrypted passwords
-	#  won't work.
-	Auth-Type CHAP {
-		chap
-	}
-
-	#
-	#  MSCHAP authentication.
-	Auth-Type MS-CHAP {
-		mschap
-	}
-
-	#
-	#  Pluggable Authentication Modules.
-#	pam
-
-	#
-	#  See 'man getpwent' for information on how the 'unix'
-	#  module checks the users password.  Note that packets
-	#  containing CHAP-Password attributes CANNOT be authenticated
-	#  against /etc/passwd!  See the FAQ for details.
-	#  
-	unix
-
-	# Uncomment it if you want to use ldap for authentication
-	#
-	# Note that this means "check plain-text password against
-	# the ldap database", which means that EAP won't work,
-	# as it does not supply a plain-text password.
-#	Auth-Type LDAP {
-#		ldap
-#	}
-
-	#
-	#  Allow EAP authentication.
-	eap
-}
-
-######################################################################
-#
-#	There are no accounting requests inside of EAP-TTLS or PEAP
-#	tunnels.
-#
-######################################################################
-
-
-#  Session database, used for checking Simultaneous-Use. Either the radutmp 
-#  or rlm_sql module can handle this.
-#  The rlm_sql module is *much* faster
-session {
-	radutmp
-
-	#
-	#  See "Simultaneous Use Checking Queries" in sql.conf
-#	sql
-}
-
-
-#  Post-Authentication
-#  Once we KNOW that the user has been authenticated, there are
-#  additional steps we can take.
-post-auth {
-	# Note that we do NOT assign IP addresses here.
-	# If you try to assign IP addresses for EAP authentication types,
-	# it WILL NOT WORK.  You MUST use DHCP.
-
-	#
-	#  If you want to have a log of authentication replies,
-	#  un-comment the following line, and the 'detail reply_log'
-	#  section, above.
-#	reply_log
-
-	#
-	#  After authenticating the user, do another SQL query.
-	#
-	#  See "Authentication Logging Queries" in sql.conf
-#	sql
-
-	#
-	#  Instead of sending the query to the SQL server,
-	#  write it into a log file.
-	#
-#	sql_log
-
-	#
-	#  Un-comment the following if you have set
-	#  'edir_account_policy_check = yes' in the ldap module sub-section of
-	#  the 'modules' section.
-	#
-#	ldap
-
-	#
-	#  Access-Reject packets are sent through the REJECT sub-section of the
-	#  post-auth section.
-	#
-	#  Add the ldap module name (or instance) if you have set 
-	#  'edir_account_policy_check = yes' in the ldap module configuration
-	#
-	Post-Auth-Type REJECT {
-		attr_filter.access_reject
-	}
-
-	#
-	#  The example policy below updates the outer tunnel reply
-	#  (usually Access-Accept) with the User-Name from the inner
-	#  tunnel User-Name.  Since this section is processed in the
-	#  context of the inner tunnel, "request" here means "inner
-	#  tunnel request", and "outer.reply" means "outer tunnel
-	#  reply attributes".
-	#
-	#  This example is most useful when the outer session contains
-	#  a User-Name of "anonymous@....", or a MAC address.  If it
-	#  is enabled, the NAS SHOULD use the inner tunnel User-Name
-	#  in subsequent accounting packets.  This makes it easier to
-	#  track user sessions, as they will all be based on the real
-	#  name, and not on "anonymous".
-	#
-	#  The problem with doing this is that it ALSO exposes the
-	#  real user name to any intermediate proxies.  People use
-	#  "anonymous" identifiers outside of the tunnel for a very
-	#  good reason: it gives them more privacy.  Setting the reply
-	#  to contain the real user name removes ALL privacy from
-	#  their session.
-	#
-	#  If you want privacy to remain, see the
-	#  Chargeable-User-Identity attribute from RFC 4372.  In order
-	#  to use that attribute, you will have to allocate a
-	#  per-session identifier for the user, and store it in a
-	#  long-term database (e.g. SQL).  You should also use that
-	#  attribute INSTEAD of the configuration below.
-	#
-	#update outer.reply {
-	#	User-Name = "%{request:User-Name}"
-	#}
-
-}
-
-#
-#  When the server decides to proxy a request to a home server,
-#  the proxied request is first passed through the pre-proxy
-#  stage.  This stage can re-write the request, or decide to
-#  cancel the proxy.
-#
-#  Only a few modules currently have this method.
-#
-pre-proxy {
-#	attr_rewrite
-
-	#  Uncomment the following line if you want to change attributes
-	#  as defined in the preproxy_users file.
-#	files
-
-	#  Uncomment the following line if you want to filter requests
-	#  sent to remote servers based on the rules defined in the
-	#  'attrs.pre-proxy' file.
-#	attr_filter.pre-proxy
-
-	#  If you want to have a log of packets proxied to a home
-	#  server, un-comment the following line, and the
-	#  'detail pre_proxy_log' section, above.
-#	pre_proxy_log
-}
-
-#
-#  When the server receives a reply to a request it proxied
-#  to a home server, the request may be massaged here, in the
-#  post-proxy stage.
-#
-post-proxy {
-
-	#  If you want to have a log of replies from a home server,
-	#  un-comment the following line, and the 'detail post_proxy_log'
-	#  section, above.
-#	post_proxy_log
-
-#	attr_rewrite
-
-	#  Uncomment the following line if you want to filter replies from
-	#  remote proxies based on the rules defined in the 'attrs' file.
-#	attr_filter.post-proxy
-
-	#
-	#  If you are proxying LEAP, you MUST configure the EAP
-	#  module, and you MUST list it here, in the post-proxy
-	#  stage.
-	#
-	#  You MUST also use the 'nostrip' option in the 'realm'
-	#  configuration.  Otherwise, the User-Name attribute
-	#  in the proxied request will not match the user name
-	#  hidden inside of the EAP packet, and the end server will
-	#  reject the EAP request.
-	#
-	eap
-
-	#
-	#  If the server tries to proxy a request and fails, then the
-	#  request is processed through the modules in this section.
-	#
-	#  The main use of this section is to permit robust proxying
-	#  of accounting packets.  The server can be configured to
-	#  proxy accounting packets as part of normal processing.
-	#  Then, if the home server goes down, accounting packets can
-	#  be logged to a local "detail" file, for processing with
-	#  radrelay.  When the home server comes back up, radrelay
-	#  will read the detail file, and send the packets to the
-	#  home server.
-	#
-	#  With this configuration, the server always responds to
-	#  Accounting-Requests from the NAS, but only writes
-	#  accounting packets to disk if the home server is down.
-	#
-#	Post-Proxy-Type Fail {
-#			detail
-#	}
-
-}
-
-} # inner-tunnel server block
Index: nf/radpxy.eap.testbed.aaa/freeradius/sites-available/proxy-inner-tunnel
===================================================================
--- conf/radpxy.eap.testbed.aaa/freeradius/sites-available/proxy-inner-tunnel	(revision 11)
+++ 	(revision )
@@ -1,47 +1,0 @@
-# -*- text -*-
-######################################################################
-#
-#	This is a virtual server that handles *only* inner tunnel
-#	requests for EAP-TTLS and PEAP types.
-#
-#	$Id: proxy-inner-tunnel,v 1.3 2008/02/13 09:27:18 aland Exp $
-#
-######################################################################
-
-server proxy-inner-tunnel {
-
-#
-#  This example is very simple.  All inner tunnel requests get
-#  proxied to another RADIUS server.
-#
-authorize {
-	#
-	#  Do other things here, as necessary.
-	#
-	#  e.g. run the "realms" module, to decide how to proxy
-	#  the inner tunnel request.
-	#
-
-	update control {
-		#  You should update this to be one of your realms.
-		Proxy-To-Realm := "example.com"
-	}
-}
-
-authenticate {
-	#
-	#  This is necessary so that the inner tunnel EAP-MSCHAPv2
-	#  method can be called.  That method takes care of turning
-	#  EAP-MSCHAPv2 into plain MS-CHAPv2, if necessary.
-	eap
-}
-
-post-proxy {
-	#
-	#  This is necessary for LEAP, or if you set:
-	#
-	#  proxy_tunneled_request_as_eap = no
-	#
-	eap
-}
-}
Index: nf/radpxy.eap.testbed.aaa/freeradius/sites-available/robust-proxy-accounting
===================================================================
--- conf/radpxy.eap.testbed.aaa/freeradius/sites-available/robust-proxy-accounting	(revision 11)
+++ 	(revision )
@@ -1,174 +1,0 @@
-# -*- text -*-
-######################################################################
-#
-#	This is a sample configuration for robust proxy accounting.
-#	accounting packets are proxied, OR logged locally if all
-#	home servers are down.  When the home servers come back up,
-#	the accounting packets are forwarded.
-#
-#	This method enables the server to proxy all packets to the
-#	home servers when they're up, AND to avoid writing to the
-#	detail file in most situations.
-#
-#	In most situations, proxying of accounting messages is done
-#	in a "pass-through" fashion.  If the home server does not
-#	respond, then the proxy server does not respond to the NAS.
-#	That means that the NAS must retransmit packets, sometimes
-#	forever.  This example shows how the proxy server can still
-#	respond to the NAS, even if all home servers are down.
-#
-#	This configuration could be done MUCH more simply if ALL
-#	packets were written to the detail file.  But that would
-#	involve a lot more disk writes, which may not be a good idea.
-#
-#	This file is NOT meant to be used as-is.  It needs to be
-#	edited to match your local configuration.
-#
-#	$Id: robust-proxy-accounting,v 1.2 2008/04/28 14:53:17 aland Exp $
-#
-######################################################################
-
-#  (1) Define two home servers.
-home_server home1.example.com {
-	type = acct
-	ipaddr = 192.0.2.10
-	port = 1813
-	secret = testing123
-
-	#  Mark this home server alive ONLY when it starts being responsive
-	status_check = request
-	username = "test_user_status_check"
-
-	#  Set the response timeout aggressively low.
-	#  You MAY have to increase this, depending on tests with
-	#  your local installation.
-	response_window = 6
-}
-
-home_server home2.example.com {
-	type = acct
-	ipaddr = 192.0.2.20
-	port = 1813
-	secret = testing123
-
-	#  Mark this home server alive ONLY when it starts being responsive
-	status_check = request
-	username = "test_user_status_check"
-
-	#  Set the response timeout aggressively low.
-	#  You MAY have to increase this, depending on tests with
-	#  your local installation.
-	response_window = 6
-}
-
-#  (2) Define a virtual server to be used when both of the
-#  home servers are down.
-home_server acct_detail.example.com {
-	virtual_server = acct_detail.example.com
-}
-
-#  Put all of the servers into a pool.
-home_server_pool acct_pool.example.com {
-	type = load-balance	# other types are OK, too.
-
-	home_server = home1.example.com
-	home_server = home2.example.com
-	# add more home_server's here.
-
-	# If all home servers are down, try a home server that
-	# is a local virtual server.
-	fallback = acct_detail.example.com
-
-	# for pre/post-proxy policies
-	virtual_server = home.example.com
-}
-
-#  (3) Define a realm for these home servers.
-#  It should NOT be used as part of normal proxying decisions!
-realm acct_realm.example.com {
-	acct_pool = acct_pool.example.com
-}
-
-#  (4) Define a detail file writer.  This next section MUST be
-#  copied to the "modules" section of radiusd.conf, and un-commented
-#
-#  We write *multiple* detail files here.  They will be processed
-#  in the order that they were created.  The directory containing
-#  these files should NOT be used for any other purposes.  That is,
-#  it should have NO other files in it.
-#
-#  Writing multiple detail enables the server to process the pieces
-#  in smaller chunks.  This helps in certain catastrophic corner cases.
-#  (e.g. home servers down for days...)
-#
-#detail detail.example.com {
-#	detailfile = ${radacctdir}/detail.example.com/detail-%Y%m%d:%H
-#}
-
-
-#  (5) Define the virtual server to write the packets to the detail file
-#  This will be called when ALL home servers are down, because of the
-#  "fallback" configuration in the home server pool.
-virtual_server acct_detail.example.com {
-	accounting {
-		detail.example.com
-	}
-}
-
-#  (6) Define a virtual server to handle pre/post-proxy re-writing
-virtual_server home.example.com {
-	pre-proxy {
-		#  Insert pre-proxy rules here
-	}
-
-	post-proxy {
-		#  Insert post-proxy rules here
-
-		#  This will be called when the CURRENT packet failed
-		#  to be proxied.  This may happen when one home server
-		#  suddenly goes down, even though another home server
-		#  may be alive.
-		#
-		#  i.e. the current request has run out of time, so it
-		#  cannot fail over to another (possibly) alive server.
-		#
-		#  We want to respond to the NAS, so that it can stop
-		#  re-sending the packet.  We write the packet to the
-		#  "detail" file, where it will be read, and sent to
-		#  another home server.
-		#
-		Post-Proxy-Type Fail {
-			detail.example.com
-		}
-	}
-
-
-	#  Read accounting packets from the detail file(s) for
-	#  the home server.
-	listen {
-		type = detail
-		filename = "${radacctdir}/detail.example.com/detail-*:*"
-		load_factor = 10
-	}
-
-	#  All packets read from the detail file are proxied back to
-	#  the home servers.
-	#
-	#  The normal pre/post-proxy rules are applied to them, too.
-	#
-	#  If the home servers are STILL down, then the server stops
-	#  reading the detail file, and queues the packets for a later
-	#  retransmission.  The Post-Proxy-Type "Fail" handler is NOT
-	#  called.
-	#
-	#  When the home servers come back up, the packets are forwarded,
-	#  and the detail file processed as normal.
-	accounting {
-		# You may want accounting policies here...
-
-		update control {
-			Proxy-To-Realm := "acct_realm.example.com"
-		}
-	}
-
-}
Index: nf/radpxy.eap.testbed.aaa/freeradius/sites-available/virtual.example.com
===================================================================
--- conf/radpxy.eap.testbed.aaa/freeradius/sites-available/virtual.example.com	(revision 11)
+++ 	(revision )
@@ -1,26 +1,0 @@
-# -*- text -*-
-######################################################################
-#
-#	Sample virtual server for internally proxied requests.
-#
-#	See the "realm virtual.example.com" example in "proxy.conf".
-#
-#	$Id: virtual.example.com,v 1.1 2008/04/01 10:20:59 aland Exp $
-#
-######################################################################
-
-#
-#  Sample contents: just do everything that the default configuration does.
-#
-#  You WILL want to edit this to your local needs.  We suggest copying
-#  the "default" file here, and then editing it.  That way, any
-#  changes to the 'default" file will not affect this virtual server,
-#  and vice-versa.
-#
-#  When this virtual server receives the request, the original
-#  attributes can be accessed as "outer.request", "outer.control", etc.
-#  See "man unlang" for more details.
-#
-server virtual.example.com {
-$INCLUDE	${confdir}/sites-available/default
-}
Index: nf/radpxy.eap.testbed.aaa/freeradius/sites-available/vmps
===================================================================
--- conf/radpxy.eap.testbed.aaa/freeradius/sites-available/vmps	(revision 11)
+++ 	(revision )
@@ -1,90 +1,0 @@
-# -*- text -*-
-######################################################################
-#
-#	As of version 2.0.0, the server also supports the VMPS
-#	protocol.
-#
-#	$Id: vmps,v 1.7 2008/04/01 08:20:13 aland Exp $
-#
-######################################################################
-
-server vmps {
-	listen {
-		# VMPS sockets only support IPv4 addresses.
-		ipaddr = *
-
-		#  Port on which to listen.
-		#  Allowed values are:
-		#	integer port number
-		#	1589 is the default VMPS port.
-		port = 1589
-
-		#  Type of packets to listen for.  Here, it is VMPS.
-		type = vmps
-
-		#  Some systems support binding to an interface, in addition
-		#  to the IP address.  This feature isn't strictly necessary,
-		#  but for sites with many IP addresses on one interface,
-		#  it's useful to say "listen on all addresses for
-		#  eth0".
-		#
-		#  If your system does not support this feature, you will
-		#  get an error if you try to use it.
-		#
-		#	interface = eth0
-	}
-
-	#  If you have switches that are allowed to send VMPS, but NOT
-	#  RADIUS packets, then list them here as "client" sections.
-	#
-	#  Note that for compatibility with RADIUS, you still have to
-	#  list a "secret" for each client, though that secret will not
-	#  be used for anything.
-
-
-	#  And the REAL contents.  This section is just like the
-	#  "post-auth" section of radiusd.conf.  In fact, it calls the
-	#  "post-auth" component of the modules that are listed here.
-	#  But it's called "vmps" to highlight that it's for VMPS.
-	#
-	vmps {
-		#
-		#  Some requests may not have a MAC address.  Try to
-		#  create one using other attributes.
-		if (!VMPS-Mac) {
-			if (VMPS-Ethernet-Frame =~ /0x.{12}(..)(..)(..)(..)(..)(..).*/) {
-        			update request {
-					VMPS-Mac = "%{1}:%{2}:%{3}:%{4}:%{5}:%{6}"
-				}
-			}
-			else {
-				update request {
-					VMPS-Mac = "%{VMPS-Cookie}"
-				}
-			}
-		}
-
-		#  Do a simple mapping of MAC to VLAN.
-		#
-		#  See radiusd.conf for the definition of the "mac2vlan"
-		#  module.
-		#
-		#mac2vlan
-
-		# required VMPS reply attributes
-		update reply {
-			VMPS-Packet-Type = VMPS-Join-Response
-			VMPS-Cookie = "%{VMPS-Mac}"
-
-			VMPS-VLAN-Name = "please_use_real_vlan_here"
-
-			#
-			#  If you have VLAN's in a database, you can select
-			#  the VLAN name based on the MAC address.
-			#
-			#VMPS-VLAN-Name = "%{sql:select ... where mac='%{VMPS-Mac}'}"
-		}
-	}
-
-	# Proxying of VMPS requests is NOT supported.
-}
Index: nf/radpxy.eap.testbed.aaa/freeradius/snmp.conf
===================================================================
--- conf/radpxy.eap.testbed.aaa/freeradius/snmp.conf	(revision 11)
+++ 	(revision )
@@ -1,46 +1,0 @@
-# -*- text -*-
-##
-## snmp.conf -- snmp configuration directives
-##
-##	$Id: snmp.conf,v 1.4 2007/12/31 03:31:16 aland Exp $
-
-#######################################################################
-#
-#  SNMP configuration
-#
-#  NOTE: This part is only working if your radiusd is compiled with SNMP
-#  support.
-#
-#  smux_password: Password used for SMUX registration.
-#
-#  Specifies password used when connecting to the SNMP master agent.
-#  This must match the password as configured on the agent. The OID
-#  used to register the radius subagent is 1.3.6.1.4.1.11344.1.1.1.
-#  A sample entry for the ucd-snmp deamon looks like this:
-#
-#  smuxpeer .1.3.6.1.4.1.11344.1.1.1 verysecret
-#
-#  A sample entry for AIX 4.3 is:
-#
-#  smux 1.3.6.1.4.1.11344.1.1.1 verysecret
-#
-#  The default password is an empty password.
-#
-#smux_password = verysecret
-
-#
-#  snmp_write_access:
-#
-#  Controls if write access to the radiusd via SNMP is enabled or not.
-#  Set this value to yes, if you want to be able to reload radiusd from
-#  your network management station.
-#
-#  For this to work, you also have to make sure that your master agent
-#  is configured to allow SNMP set requests. For security reasons, this
-#  setting defaults to no.
-#
-# allowed values: {no, yes}
-#
-#snmp_write_access = yes
-
-
Index: nf/radpxy.eap.testbed.aaa/freeradius/sql.conf
===================================================================
--- conf/radpxy.eap.testbed.aaa/freeradius/sql.conf	(revision 11)
+++ 	(revision )
@@ -1,94 +1,0 @@
-# -*- text -*-
-##
-## sql.conf -- SQL modules
-##
-##	$Id: sql.conf,v 1.61 2007/12/31 03:31:16 aland Exp $
-
-######################################################################
-#
-#  Configuration for the SQL module
-#
-#  The database schemas and queries are located in subdirectories:
-#
-#	sql/DB/schema.sql	Schema
-#	sql/DB/dialup.conf	Basic dialup (including policy) queries
-#	sql/DB/counter.conf	counter
-#	sql/DB/ippool.conf	IP Pools in SQL
-#	sql/DB/ippool.sql	schema for IP pools.
-#
-#  Where "DB" is mysql, mssql, oracle, or postgresql.
-#
-
-sql {
-	#
-	#  Set the database to one of:
-	#
-	#	mysql, mssql, oracle, postgresql
-	#
-	database = "mysql"
-
-	#
-	#  Which FreeRADIUS driver to use.
-	#
-	driver = "rlm_sql_${database}"
-
-	# Connection info:
-	server = "localhost"
-	login = "radius"
-	password = "radpass"
-
-	# Database table configuration for everything except Oracle
-	radius_db = "radius"
-	# If you are using Oracle then use this instead
-        # radius_db = "(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=localhost)(PORT=1521))(CONNECT_DATA=(SID=your_sid)))"
-
-	# If you want both stop and start records logged to the
-	# same SQL table, leave this as is.  If you want them in
-	# different tables, put the start table in acct_table1
-	# and stop table in acct_table2
-	acct_table1 = "radacct"
-	acct_table2 = "radacct"
-
-	# Allow for storing data after authentication
-	postauth_table = "radpostauth"
-
-	authcheck_table = "radcheck"
-	authreply_table = "radreply"
-
-	groupcheck_table = "radgroupcheck"
-	groupreply_table = "radgroupreply"
-
-	# Table to keep group info
-	usergroup_table = "radusergroup"
-
-	# If set to 'yes' (default) we read the group tables
-	# If set to 'no' the user MUST have Fall-Through = Yes in the radreply table
-	# read_groups = yes
-
-	# Remove stale session if checkrad does not see a double login
-	deletestalesessions = yes
-
-	# Print all SQL statements when in debug mode (-x)
-	sqltrace = no
-	sqltracefile = ${logdir}/sqltrace.sql
-
-	# number of sql connections to make to server
-	num_sql_socks = 5
-
-	# number of seconds to dely retrying on a failed database
-	# connection (per_socket)
-	connect_failure_retry_delay = 60
-
-	# Set to 'yes' to read radius clients from the database ('nas' table)
-	# Clients will ONLY be read on server startup.  For performance
-	# and security reasons, finding clients via SQL queries CANNOT
-	# be done "live" while the server is running.
-	# 
-	#readclients = yes
-
-	# Table to keep radius client info
-	nas_table = "nas"
-
-	# Read driver-specific configuration
-	$INCLUDE sql/${database}/dialup.conf
-}
Index: nf/radpxy.eap.testbed.aaa/freeradius/sqlippool.conf
===================================================================
--- conf/radpxy.eap.testbed.aaa/freeradius/sqlippool.conf	(revision 11)
+++ 	(revision )
@@ -1,53 +1,0 @@
-##  Configuration for the SQL based IP Pool module (rlm_sqlippool)
-##
-##  The database schemas are available at:
-##
-##       doc/examples/*.sql
-##
-##  $Id: sqlippool.conf,v 1.15 2007/12/23 13:54:55 pnixon Exp $
-
-sqlippool {
-
- #########################################
- ## SQL instance to use (from sql.conf) ##
- #########################################
- sql-instance-name = "sql"
-
- ## SQL table to use for ippool range and lease info
- ippool_table = "radippool"
-
- ## IP lease duration. (Leases expire even if Acct Stop packet is lost)
- lease-duration = 3600
-
- ## Attribute which should be considered unique per NAS
- ## Using NAS-Port gives behaviour similar to rlm_ippool. (And ACS)
- ## Using Calling-Station-Id works for NAS that send fixed NAS-Port
- ## ONLY change this if you know what you are doing!
- pool-key = "%{NAS-Port}"
- # pool-key = "%{Calling-Station-Id}"
-
- ################################################################
- ## Uncomment the appropriate config file for your SQL dialect ##
- ################################################################
-
- # $INCLUDE sql/mysql/ippool.conf
- $INCLUDE sql/postgresql/ippool.conf
-
-
- ## Logging configuration. (Comment out to disable logging)
- sqlippool_log_exists = "Existing IP: %{reply:Framed-IP-Address} \
-  (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})"
-
- sqlippool_log_success = "Allocated IP: %{reply:Framed-IP-Address} from %{control:Pool-Name} \
-  (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})"
-
- sqlippool_log_clear = "Released IP %{Framed-IP-Address}\
- (did %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name})"
-
- sqlippool_log_failed = "IP Allocation FAILED from %{control:Pool-Name} \
-  (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})"
-
- sqlippool_log_nopool = "No Pool-Name defined \
-  (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})"
-
-}
Index: nf/radpxy.eap.testbed.aaa/freeradius/templates.conf
===================================================================
--- conf/radpxy.eap.testbed.aaa/freeradius/templates.conf	(revision 11)
+++ 	(revision )
@@ -1,104 +1,0 @@
-# -*- text -*-
-##
-## templates.conf -- configurations to be used in multiple places
-##
-##	$Id: templates.conf,v 1.3 2007/12/31 03:26:59 aland Exp $
-
-######################################################################
-#
-#  Version 2.0 has a useful new feature called "templates".
-#
-#  Use templates by adding a line in radiusd.conf:
-#
-#	$INCLUDE templates.conf
-#
-#  The goal of the templates is to have common configuration located
-#  in this file, and to list only the *differences* in the individual
-#  sections.  This feature is most useful for sections like "clients"
-#  or "home_servers", where many may be defined, and each one has
-#  similar repeated configuration.
-#
-#  Something similar to templates can be done by putting common
-#  configuration into separate files, and using "$INCLUDE file...",
-#  but this is more flexible, and simpler to understand.  It's also
-#  cheaper for the server, because "$INCLUDE" makes a copy of the
-#  configuration for inclusion, and templates are simply referenced.
-#
-#  The templates are defined in the "templates" section, so that they
-#  do not affect the rest of the server configuration.
-#
-#  A section can reference a template by using "$template name"
-#
-templates {
-	  #
-	  #  The contents of the templates section are other
-	  #  configuration sections that would normally go into
-	  #  the configuration files.
-	  #
-
-	  #
-	  #  This is a default template for the "home_server" section.
-	  #  Note that there is no name for the section.
-	  #
-	  #  Any configuration item that is valid for a "home_server"
-	  #  section is also valid here.  When a "home_server" section
-	  #  is defined in proxy.conf, this section is referenced as
-	  #  the template.
-	  #
-	  #  Configuration items that are explicitly listed in a
-	  #  "home_server" section of proxy.conf are used in
-	  #  preference to the configuration items listed here.
-	  #
-	  #  However, if a configuration item is NOT listed in a
-	  #  "home_server" section of proxy.conf, then the value here
-	  #  is used.
-	  #
-	  #  This functionality lets you put common configuration into
-	  #  a template, and to put only the unique configuration
-	  #  items in "proxy.conf".  Each section in proxy.conf can
-	  #  then contain a line "$template home_server", which will
-	  #  cause it to reference this template.
-	  #
-	  home_server {
-		      	response_window = 20
-			zombie_period = 40
-			revive_interval = 120
-			#
-			#  Etc.
-	  }
-
-	  #
-	  #  You can also have named templates.  For example, if you
-	  #  are proxying to 3 different home servers all at the same
-	  #  site, with identical configurations (other than IP
-	  #  addresses), you can use this named template.
-	  #
-
-	  #  Then, each "home_server" section in "proxy.conf" would
-	  #  only list the IP address of that home server, and a
-	  #  line saying
-	  #
-	  #		template = example.com
-	  #
-	  #  That would tell FreeRADIUS to look in the section below
-	  #  for the rest of the configuration items.
-	  #
-	  home_server example.com {
-		      type = auth
-		      port = 1812
-		      secret = testing123
-		      response_window = 20
-		      #
-		      # Etc...
-	  }
-
-	  #
-	  #  You can have templates for other sections, too, but they
-	  #  seem to be most useful for home_servers.
-	  #
-	  #  For now, you can use templates only for sections in
-	  #  radiusd.conf, not sub-sections.  So you still have to use
-	  #  the "$INCLUDE file.." method for things like defining
-	  #  multiple "sql" modules, each with similar configuration.
-	  #	  
-}
Index: nf/radpxy.eap.testbed.aaa/freeradius/users
===================================================================
--- conf/radpxy.eap.testbed.aaa/freeradius/users	(revision 11)
+++ 	(revision )
@@ -1,1 +1,0 @@
-DEFAULT	Proxy-To-Realm := "eap.testbed.aaa"
Index: nf/radpxy.eap.testbed.aaa/ntp.conf
===================================================================
--- conf/radpxy.eap.testbed.aaa/ntp.conf	(revision 10)
+++ 	(revision )
@@ -1,19 +1,0 @@
-# /etc/ntp.conf, configuration for ntpd; see ntp.conf(5) for help
-
-driftfile /var/lib/ntp/ntp.drift
-
-statistics loopstats peerstats clockstats
-filegen loopstats file loopstats type day enable
-filegen peerstats file peerstats type day enable
-filegen clockstats file clockstats type day enable
-
-server proxy.testbed.aaa
-
-# By default, exchange time with everybody, but don't allow configuration.
-restrict -4 default kod notrap nomodify nopeer noquery
-restrict -6 default kod notrap nomodify nopeer noquery
-
-# Local users may interrogate the ntp server more closely.
-restrict 127.0.0.1
-restrict ::1
-
Index: nf/relay.a.rt.testbed.aaa/freeDiameter/CMakeFlags
===================================================================
--- conf/relay.a.rt.testbed.aaa/freeDiameter/CMakeFlags	(revision 15)
+++ 	(revision )
@@ -1,4 +1,0 @@
--DBUILD_APP_REDIRECT:BOOL=ON 
--DBUILD_TESTING:BOOL=OFF 
--DCMAKE_BUILD_TYPE:STRING=Debug 
--DDEFAULT_CONF_PATH:PATH=/root/conf/freeDiameter
Index: nf/relay.a.rt.testbed.aaa/freeDiameter/ard.conf
===================================================================
--- conf/relay.a.rt.testbed.aaa/freeDiameter/ard.conf	(revision 15)
+++ 	(revision )
@@ -1,1 +1,0 @@
-# Redirects tests
Index: conf/relay.a.rt.testbed.aaa/freeDiameter/freeDiameter.conf
===================================================================
--- conf/relay.a.rt.testbed.aaa/freeDiameter/freeDiameter.conf	(revision 15)
+++ conf/relay.a.rt.testbed.aaa/freeDiameter/freeDiameter.conf	(revision 0)
@@ -1,15 +1,58 @@
+# This is a sample configuration file for freeDiameter daemon.
+
+##############################################################
+#Identity = "aaa.koganei.wide.ad.jp";
+#Realm = "wide.ad.jp";
+
+##############################################################
+#Port = 3868;
+#SecPort = 3869;
+#TLS_old_method;
+#No_TCP;
+#No_SCTP;
+#Prefer_TCP;
+#SCTP_streams = 30;
 SCTP_streams = 3;
+
+##############################################################
+#No_IP;
+#No_IPv6;
+#ListenOn = "202.249.37.5";
+#ListenOn = "2001:200:903:2::202:1";
+#ListenOn = "fe80::21c:5ff:fe98:7d62%eth0";
+
+##############################################################
 TLS_Cred = "/root/ca_data/cert.pem" , "/root/ca_data/privkey.pem";
 TLS_CA = "/root/ca_data/ca.pem";
+# TLS_CRL = "/root/ca_data/crl.pem";
+
+#TLS_Prio = "NORMAL";
+#TLS_DH_Bits = 1024;
+
+##############################################################
+#TcTimer = 30;
+#TwTimer = 30;
+
+##############################################################
 #NoRelay;
 
 ##############################################################
+#LoadExtension = "/path/to/extension" [ : "/optional/configuration/file" ] ;
 
-# LoadExtension = "/root/freeDiameter/extensions/dbg_monitor.fdx";
-# LoadExtension = "/root/freeDiameter/extensions/dbg_rt.fdx";
+##############################################################
+#ConnectPeer = "diameterid" [ params... ] ;
+#   params: No_TCP; No_SCTP; No_IP; No_IPv6; Prefer_TCP; TLS_old_method; No_TLS;
+#           Port = 3868; TcTimer = 30; TwTimer = 30; ConnectTo = "202.249.37.5"; TLS_Prio = "NORMAL";
 
-ConnectPeer = "nas.a.rt.testbed.aaa" ;
-ConnectPeer = "proxy.a.rt.testbed.aaa" ;
 
-LoadExtension = "/root/freeDiameter/extensions/app_redirect.fdx"
-		: "/root/conf/freeDiameter/ard.conf";
+##############################################################
+# -------- Test configuration ---------
+
+LoadExtension = "/root/freeDiameter/extensions/dbg_monitor.fdx";
+LoadExtension = "/root/freeDiameter/extensions/dbg_rt.fdx";
+# LoadExtension = "/root/freeDiameter/extensions/test_rt_any.fdx";
+#LoadExtension = "/root/freeDiameter/extensions/test_app.fdx"
+#		: "/root/conf/freeDiameter/test_app.conf";
+
+# ConnectPeer = "serv.simple.testbed.aaa" ;
+
Index: conf/serv.b.rt.testbed.aaa/freeDiameter/CMakeFlags
===================================================================
--- conf/serv.b.rt.testbed.aaa/freeDiameter/CMakeFlags	(revision 5)
+++ conf/serv.b.rt.testbed.aaa/freeDiameter/CMakeFlags	(revision 0)
@@ -1,1 +1,1 @@
--DBUILD_TEST_APP:BOOL=ON -DBUILD_RT_DEFAULT:BOOL=OFF -DBUILD_DBG_MONITOR:BOOL=ON -DBUILD_DBG_RT:BOOL=ON -DBUILD_TESTING:BOOL=OFF -DCMAKE_BUILD_TYPE:STRING=Debug -DDEFAULT_CONF_PATH:PATH=/root/conf/freeDiameter
+-DBUILD_TEST_APP:BOOL=ON -DBUILD_RT_DEFAULT:BOOL=OFF -DBUILD_DBG_MONITOR:BOOL=ON -DBUILD_DBG_RT:BOOL=ON -DSKIP_TESTS:BOOL=ON -DCMAKE_BUILD_TYPE:STRING=Debug -DDEFAULT_CONF_PATH:PATH=/root/conf/freeDiameter
Index: conf/serv.b.rt.testbed.aaa/freeDiameter/freeDiameter.conf
===================================================================
--- conf/serv.b.rt.testbed.aaa/freeDiameter/freeDiameter.conf	(revision 15)
+++ conf/serv.b.rt.testbed.aaa/freeDiameter/freeDiameter.conf	(revision 0)
@@ -1,13 +1,55 @@
+# This is a sample configuration file for freeDiameter daemon.
+
+##############################################################
+#Identity = "aaa.koganei.wide.ad.jp";
+#Realm = "wide.ad.jp";
+
+##############################################################
+#Port = 3868;
+#SecPort = 3869;
+#TLS_old_method;
+#No_TCP;
+#No_SCTP;
+#Prefer_TCP;
+#SCTP_streams = 30;
 SCTP_streams = 3;
+
+##############################################################
+#No_IP;
+#No_IPv6;
+#ListenOn = "202.249.37.5";
+#ListenOn = "2001:200:903:2::202:1";
+#ListenOn = "fe80::21c:5ff:fe98:7d62%eth0";
+
+##############################################################
 TLS_Cred = "/root/ca_data/cert.pem" , "/root/ca_data/privkey.pem";
 TLS_CA = "/root/ca_data/ca.pem";
+# TLS_CRL = "/root/ca_data/crl.pem";
+
+#TLS_Prio = "NORMAL";
+#TLS_DH_Bits = 1024;
+
+##############################################################
+#TcTimer = 30;
+#TwTimer = 30;
+
+##############################################################
 NoRelay;
 
+##############################################################
+#LoadExtension = "/path/to/extension" [ : "/optional/configuration/file" ] ;
+
+##############################################################
+#ConnectPeer = "diameterid" [ params... ] ;
+#   params: No_TCP; No_SCTP; No_IP; No_IPv6; Prefer_TCP; TLS_old_method; No_TLS;
+#           Port = 3868; TcTimer = 30; TwTimer = 30; ConnectTo = "202.249.37.5"; TLS_Prio = "NORMAL";
+
+
+##############################################################
 # -------- Test configuration ---------
 
-#LoadExtension = "/root/freeDiameter/extensions/dbg_monitor.fdx";
+LoadExtension = "/root/freeDiameter/extensions/dbg_monitor.fdx";
 # LoadExtension = "/root/freeDiameter/extensions/dbg_rt.fdx";
 # LoadExtension = "/root/freeDiameter/extensions/test_rt_any.fdx";
-
 LoadExtension = "/root/freeDiameter/extensions/test_app.fdx"
 		: "/root/conf/freeDiameter/test_app.conf";
@@ -15,2 +57,3 @@
 ConnectPeer = "proxy.b.rt.testbed.aaa" ;
 ConnectPeer = "proxy.a.rt.testbed.aaa" ;
+
Index: conf/serv.simple.testbed.aaa/freeDiameter/CMakeFlags
===================================================================
--- conf/serv.simple.testbed.aaa/freeDiameter/CMakeFlags	(revision 5)
+++ conf/serv.simple.testbed.aaa/freeDiameter/CMakeFlags	(revision 0)
@@ -1,1 +1,1 @@
--DBUILD_TEST_APP:BOOL=ON -DBUILD_TEST_RT_ANY:BOOL=ON -DBUILD_DBG_MONITOR:BOOL=ON -DBUILD_DBG_RT:BOOL=ON -DBUILD_TESTING:BOOL=OFF -DCMAKE_BUILD_TYPE:STRING=Debug -DDEFAULT_CONF_PATH:PATH=/root/conf/freeDiameter
+-DBUILD_TEST_APP:BOOL=ON -DBUILD_TEST_RT_ANY:BOOL=ON -DBUILD_DBG_MONITOR:BOOL=ON -DBUILD_DBG_RT:BOOL=ON -DSKIP_TESTS:BOOL=ON -DCMAKE_BUILD_TYPE:STRING=Debug -DDEFAULT_CONF_PATH:PATH=/root/conf/freeDiameter
Index: conf/serv.simple.testbed.aaa/freeDiameter/freeDiameter.conf
===================================================================
--- conf/serv.simple.testbed.aaa/freeDiameter/freeDiameter.conf	(revision 2)
+++ conf/serv.simple.testbed.aaa/freeDiameter/freeDiameter.conf	(revision 0)
@@ -1,16 +1,56 @@
-# Limit number of streams to avoid flooding the logs.
+# This is a sample configuration file for freeDiameter daemon.
+
+##############################################################
+#Identity = "aaa.koganei.wide.ad.jp";
+#Realm = "wide.ad.jp";
+
+##############################################################
+#Port = 3868;
+#SecPort = 3869;
+#TLS_old_method;
+#No_TCP;
+#No_SCTP;
+#Prefer_TCP;
+#SCTP_streams = 30;
 SCTP_streams = 3;
 
+##############################################################
+#No_IP;
+#No_IPv6;
+#ListenOn = "202.249.37.5";
+#ListenOn = "2001:200:903:2::202:1";
+#ListenOn = "fe80::21c:5ff:fe98:7d62%eth0";
+
+##############################################################
 TLS_Cred = "/root/ca_data/cert.pem" , "/root/ca_data/privkey.pem";
 TLS_CA = "/root/ca_data/ca.pem";
-# In the simplest testbed we don't need relay capability
+# TLS_CRL = "/root/ca_data/crl.pem";
+
+#TLS_Prio = "NORMAL";
+#TLS_DH_Bits = 1024;
+
+##############################################################
+#TcTimer = 30;
+#TwTimer = 30;
+
+##############################################################
 NoRelay;
 
-# Monitor the state of the application easily
+##############################################################
+#LoadExtension = "/path/to/extension" [ : "/optional/configuration/file" ] ;
+
+##############################################################
+#ConnectPeer = "diameterid" [ params... ] ;
+#   params: No_TCP; No_SCTP; No_IP; No_IPv6; Prefer_TCP; TLS_old_method; No_TLS;
+#           Port = 3868; TcTimer = 30; TwTimer = 30; ConnectTo = "202.249.37.5"; TLS_Prio = "NORMAL";
+
+
+##############################################################
+# -------- Test configuration ---------
+
 LoadExtension = "/root/freeDiameter/extensions/dbg_monitor.fdx";
-# The application we are running.
 LoadExtension = "/root/freeDiameter/extensions/test_app.fdx" 
 		: "/root/conf/freeDiameter/test_app.conf";
-# Connect only to the client.
+
 ConnectPeer = "cli.simple.testbed.aaa" ;
 
Index: conf/serv.simple.testbed.aaa/freeDiameter/test_app.conf
===================================================================
--- conf/serv.simple.testbed.aaa/freeDiameter/test_app.conf	(revision 2)
+++ conf/serv.simple.testbed.aaa/freeDiameter/test_app.conf	(revision 0)
@@ -1,2 +1,1 @@
-# This side is server, there is not much to configure...
 mode = server;
Index: conf/supauth.eap.testbed.aaa/wpasupplicant/wpa_supplicant.conf
===================================================================
--- conf/supauth.eap.testbed.aaa/wpasupplicant/wpa_supplicant.conf	(revision 15)
+++ conf/supauth.eap.testbed.aaa/wpasupplicant/wpa_supplicant.conf	(revision 0)
@@ -11,6 +11,5 @@
 
 	eap=TLS
-	identity="client@eap.testbed.aaa"
-#	identity="clientinvalid@eap.testbed.aaa"
+	identity="client"
 	ca_cert="/home/aaa/ca/ca_data/mgr.testbed.aaa/public/cacert.pem"
 	client_cert="/home/aaa/ca/ca_data/mgr.testbed.aaa/clients/client/cert.pem"
Index: nf/supauth2.eap.testbed.aaa/ca_name
===================================================================
--- conf/supauth2.eap.testbed.aaa/ca_name	(revision 9)
+++ 	(revision )
@@ -1,1 +1,0 @@
-eap.testbed.aaa
Index: nf/supauth2.eap.testbed.aaa/freeDiameter/CMakeFlags
===================================================================
--- conf/supauth2.eap.testbed.aaa/freeDiameter/CMakeFlags	(revision 10)
+++ 	(revision )
@@ -1,9 +1,0 @@
--DBUILD_DBG_MONITOR:BOOL=ON 
--DBUILD_APP_RADGW:BOOL=ON 
--DBUILD_RGWX_DEBUG:BOOL=ON 
--DBUILD_RGWX_AUTH:BOOL=ON 
--DBUILD_RGWX_ACCT:BOOL=ON 
--DBUILD_RGWX_ECHODROP:BOOL=ON
--DBUILD_TESTING:BOOL=OFF 
--DCMAKE_BUILD_TYPE:STRING=DebugValgrind 
--DDEFAULT_CONF_PATH:PATH=/root/conf/freeDiameter
Index: nf/supauth2.eap.testbed.aaa/freeDiameter/dh.pem
===================================================================
--- conf/supauth2.eap.testbed.aaa/freeDiameter/dh.pem	(revision 12)
+++ 	(revision )
@@ -1,35 +1,0 @@
-
-Generator: 05
-
-Prime: 87:96:52:0b:5c:d5:ac:63:f2:46:09:ef
-	c8:f4:30:e7:58:d4:09:c9:f6:90:77:e7
-	7c:bb:04:cc:f8:16:93:90:02:c7:66:74
-	33:96:9d:bc:cb:fc:21:4f:92:b6:57:97
-	2a:be:7c:6f:32:71:18:47:b8:de:50:07
-	5a:a4:17:6d:82:72:31:95:1d:5a:6b:3a
-	b6:aa:9c:ec:78:53:c2:10:59:7f:20:00
-	de:1e:dd:b1:1a:e2:06:11:db:08:56:1e
-	cb:24:f9:6f:b5:86:60:b3:0b:8c:a0:5e
-	85:93:9d:48:e1:3a:40:f6:01:44:21:c9
-	11:aa:2f:0d:78:52:42:32:71:ce:cd:ca
-	b6:11:b9:44:b8:dd:4e:e2:27:89:38:30
-	0e:f8:c9:31:92:b3:32:99:a5:26:f2:59
-	4b:e0:ec:c4:75:c5:53:19:97:f1:c6:00
-	7c:34:39:cf:d4:09:21:ca:64:7e:9c:79
-	97:2d:e9:e5:03:86:3d:30:3e:df:db:4e
-	fd:5c:f0:4e:e8:11:f3:75:a6:34:ac:d0
-	12:b0:3f:df:1e:48:95:27:0b:ec:36:a9
-	b9:6c:eb:fc:cc:b1:36:8d:d9:f3:58:db
-	c8:fa:a9:58:0c:f2:24:6a:89:8e:14:5d
-	25:43:a9:4b:a0:25:8c:50:8f:25:91:46
-	7a:cb:73:cb
-
-
------BEGIN DH PARAMETERS-----
-MIIBCAKCAQEAh5ZSC1zVrGPyRgnvyPQw51jUCcn2kHfnfLsEzPgWk5ACx2Z0M5ad
-vMv8IU+StleXKr58bzJxGEe43lAHWqQXbYJyMZUdWms6tqqc7HhTwhBZfyAA3h7d
-sRriBhHbCFYeyyT5b7WGYLMLjKBehZOdSOE6QPYBRCHJEaovDXhSQjJxzs3KthG5
-RLjdTuIniTgwDvjJMZKzMpmlJvJZS+DsxHXFUxmX8cYAfDQ5z9QJIcpkfpx5ly3p
-5QOGPTA+39tO/VzwTugR83WmNKzQErA/3x5IlScL7DapuWzr/MyxNo3Z81jbyPqp
-WAzyJGqJjhRdJUOpS6AljFCPJZFGestzywIBBQ==
------END DH PARAMETERS-----
Index: nf/supauth2.eap.testbed.aaa/freeDiameter/echo_drop.rgwx.conf
===================================================================
--- conf/supauth2.eap.testbed.aaa/freeDiameter/echo_drop.rgwx.conf	(revision 10)
+++ 	(revision )
@@ -1,9 +1,0 @@
-
-# ECHO code 25 ; # Class attributes
-# DROP code 18 ; # Reply-Message attribute, should not be included in requests
-# DROP code 26 vendor 9 ; # Drop any Cisco-specific attribute
-# ECHO code 26 vendor 0 ext 256 ; # Echo any extended attribute with the type 256.
-
-drop code 4 ;
-echo code 33 ;
-
Index: nf/supauth2.eap.testbed.aaa/freeDiameter/freeDiameter.conf
===================================================================
--- conf/supauth2.eap.testbed.aaa/freeDiameter/freeDiameter.conf	(revision 12)
+++ 	(revision )
@@ -1,19 +1,0 @@
-SCTP_streams = 3;
-TLS_Cred = "/root/ca_data/cert.pem" , "/root/ca_data/privkey.pem";
-TLS_CA = "/root/ca_data/ca.pem";
-TLS_DH_File = "/root/conf/freeDiameter/dh.pem";
-NoRelay;
-
-# LoadExtension = "/root/freeDiameter/extensions/dbg_monitor.fdx";
-
-LoadExtension = "/root/freeDiameter/extensions/dict_nasreq.fdx";
-LoadExtension = "/root/freeDiameter/extensions/dict_eap.fdx";
-LoadExtension = "/root/freeDiameter/extensions/app_radgw.fdx"
-		: "/root/conf/freeDiameter/rgw.conf";
-
-# "opendiam.eap.testbed.aaa" = { uri="aaa://opendiam.eap.testbed.aaa;transport=sctp"; };
-#ConnectPeer = "opendiam.eap.testbed.aaa" {   #TLS_old_Method; 
-#						No_TLS; };
-
-ConnectPeer = "backend.eap.testbed.aaa" { No_TLS; };
-
Index: nf/supauth2.eap.testbed.aaa/freeDiameter/rgw.conf
===================================================================
--- conf/supauth2.eap.testbed.aaa/freeDiameter/rgw.conf	(revision 10)
+++ 	(revision )
@@ -1,19 +1,0 @@
-
-# Handle some attributes
-#RGWX = "/root/freeDiameter/extensions/echo_drop.rgwx" : "/root/conf/freeDiameter/echo_drop.rgwx.conf";
-
-# Handle Accounting-Request messages received on the correct port
-RGWX = "/root/freeDiameter/extensions/acct.rgwx" : acct : 4;
-
-# Handle Access-Request messages received on the correct port
-RGWX = "/root/freeDiameter/extensions/auth.rgwx" : auth : 1;
-
-# Dump state when loop ends
-# RGWX = "/root/freeDiameter/extensions/debug.rgwx";
-
-
-##################
-
-nas = 127.0.0.1 / "radiusecret2" ;
-
-
Index: nf/supauth2.eap.testbed.aaa/hostapd/build.config
===================================================================
--- conf/supauth2.eap.testbed.aaa/hostapd/build.config	(revision 9)
+++ 	(revision )
@@ -1,8 +1,0 @@
-# Build-time configuration for hostapd on supauth: authentication role.
-
-# Driver interface for drivers using the nl80211 kernel interface
-CONFIG_DRIVER_NL80211=y
-
-# Build IPv6 support for RADIUS operations
-CONFIG_IPV6=y
-
Index: nf/supauth2.eap.testbed.aaa/hostapd/hostapd.conf
===================================================================
--- conf/supauth2.eap.testbed.aaa/hostapd/hostapd.conf	(revision 10)
+++ 	(revision )
@@ -1,32 +1,0 @@
-interface=wlan0
-driver=nl80211
-
-logger_stdout=-1
-logger_stdout_level=2
-dump_file=/tmp/hostapd.dump
-
-ctrl_interface=/var/run/hostapd
-
-hw_mode=g
-channel=1
-ssid=mac80211 test2
-
-wpa=2
-wpa_key_mgmt=WPA-EAP
-wpa_pairwise=CCMP
-
-ieee8021x=1
-eapol_version=2
-eap_message=hello
-
-# Configuration for external RADIUS server
-own_ip_addr=192.168.105.50
-nas_identifier=supauth2.eap.testbed.aaa
-#auth_server_addr=192.168.105.30
-auth_server_addr=127.0.0.1
-auth_server_port=1812
-auth_server_shared_secret=radiusecret2
-#acct_server_addr=192.168.105.30
-acct_server_addr=127.0.0.1
-acct_server_port=1813
-acct_server_shared_secret=radiusecret2
Index: nf/supauth2.eap.testbed.aaa/ntp.conf
===================================================================
--- conf/supauth2.eap.testbed.aaa/ntp.conf	(revision 9)
+++ 	(revision )
@@ -1,19 +1,0 @@
-# /etc/ntp.conf, configuration for ntpd; see ntp.conf(5) for help
-
-driftfile /var/lib/ntp/ntp.drift
-
-statistics loopstats peerstats clockstats
-filegen loopstats file loopstats type day enable
-filegen peerstats file peerstats type day enable
-filegen clockstats file clockstats type day enable
-
-server proxy.testbed.aaa
-
-# By default, exchange time with everybody, but don't allow configuration.
-restrict -4 default kod notrap nomodify nopeer noquery
-restrict -6 default kod notrap nomodify nopeer noquery
-
-# Local users may interrogate the ntp server more closely.
-restrict 127.0.0.1
-restrict ::1
-
Index: nf/supauth2.eap.testbed.aaa/wpasupplicant/build.config
===================================================================
--- conf/supauth2.eap.testbed.aaa/wpasupplicant/build.config	(revision 9)
+++ 	(revision )
@@ -1,26 +1,0 @@
-# Config file for compilation wpa_supplicant sur supauth.eap.testbed.aaa
-
-# We use the WEXT generic driver with mac80211_hwsim hardware
-CONFIG_DRIVER_WEXT=y
-
-# EAP and EAPoL
-CONFIG_IEEE8021X_EAPOL=y
-CONFIG_EAP_MD5=y
-CONFIG_EAP_MSCHAPV2=y
-CONFIG_EAP_TLS=y
-CONFIG_EAP_PEAP=y
-CONFIG_EAP_TTLS=y
-# CONFIG_EAP_FAST=y
-CONFIG_EAP_GTC=y
-CONFIG_EAP_OTP=y
-CONFIG_EAP_SIM=y
-# ETC...
-CONFIG_EAP_IKEV2=y
-CONFIG_PKCS12=y
-
-CONFIG_EAPOL_TEST=y
-
-CONFIG_CTRL_IFACE=y
-CONFIG_BACKEND=file
-CONFIG_DEBUG_FILE=y
-
Index: nf/supauth2.eap.testbed.aaa/wpasupplicant/wpa_supplicant.conf
===================================================================
--- conf/supauth2.eap.testbed.aaa/wpasupplicant/wpa_supplicant.conf	(revision 9)
+++ 	(revision )
@@ -1,18 +1,0 @@
-ctrl_interface=/var/run/wpa_supplicant
-
-network={
-        ssid="mac80211 test2"
-        key_mgmt=WPA-EAP
-        proto=WPA2
-        pairwise=CCMP
-        group=CCMP
-#	eap=MD5
-#	password="himitsu"
-
-	eap=TLS
-	identity="client2@eap.testbed.aaa"
-	ca_cert="/home/aaa/ca/ca_data/mgr.testbed.aaa/public/cacert.pem"
-	client_cert="/home/aaa/ca/ca_data/mgr.testbed.aaa/clients/client2/cert.pem"
-	private_key="/home/aaa/ca/ca_data/mgr.testbed.aaa/clients/client2/privkey.pem"
-}
-
Index: nf/supauth3.eap.testbed.aaa/ca_name
===================================================================
--- conf/supauth3.eap.testbed.aaa/ca_name	(revision 10)
+++ 	(revision )
@@ -1,1 +1,0 @@
-eap.testbed.aaa
Index: nf/supauth3.eap.testbed.aaa/hostapd/build.config
===================================================================
--- conf/supauth3.eap.testbed.aaa/hostapd/build.config	(revision 10)
+++ 	(revision )
@@ -1,8 +1,0 @@
-# Build-time configuration for hostapd on supauth: authentication role.
-
-# Driver interface for drivers using the nl80211 kernel interface
-CONFIG_DRIVER_NL80211=y
-
-# Build IPv6 support for RADIUS operations
-CONFIG_IPV6=y
-
Index: nf/supauth3.eap.testbed.aaa/hostapd/hostapd.conf
===================================================================
--- conf/supauth3.eap.testbed.aaa/hostapd/hostapd.conf	(revision 11)
+++ 	(revision )
@@ -1,30 +1,0 @@
-interface=wlan0
-driver=nl80211
-
-logger_stdout=-1
-logger_stdout_level=2
-dump_file=/tmp/hostapd.dump
-
-ctrl_interface=/var/run/hostapd
-
-hw_mode=g
-channel=1
-ssid=mac80211 test3
-
-wpa=2
-wpa_key_mgmt=WPA-EAP
-wpa_pairwise=CCMP
-
-ieee8021x=1
-eapol_version=2
-eap_message=hello
-
-# Configuration for external RADIUS server, actually a proxy
-own_ip_addr=192.168.105.70
-nas_identifier=supauth3.eap.testbed.aaa
-auth_server_addr=192.168.105.60
-auth_server_port=1812
-auth_server_shared_secret=radiusecret3.1
-acct_server_addr=192.168.105.60
-acct_server_port=1813
-acct_server_shared_secret=radiusecret3.1
Index: nf/supauth3.eap.testbed.aaa/ntp.conf
===================================================================
--- conf/supauth3.eap.testbed.aaa/ntp.conf	(revision 10)
+++ 	(revision )
@@ -1,19 +1,0 @@
-# /etc/ntp.conf, configuration for ntpd; see ntp.conf(5) for help
-
-driftfile /var/lib/ntp/ntp.drift
-
-statistics loopstats peerstats clockstats
-filegen loopstats file loopstats type day enable
-filegen peerstats file peerstats type day enable
-filegen clockstats file clockstats type day enable
-
-server proxy.testbed.aaa
-
-# By default, exchange time with everybody, but don't allow configuration.
-restrict -4 default kod notrap nomodify nopeer noquery
-restrict -6 default kod notrap nomodify nopeer noquery
-
-# Local users may interrogate the ntp server more closely.
-restrict 127.0.0.1
-restrict ::1
-
Index: nf/supauth3.eap.testbed.aaa/wpasupplicant/build.config
===================================================================
--- conf/supauth3.eap.testbed.aaa/wpasupplicant/build.config	(revision 10)
+++ 	(revision )
@@ -1,26 +1,0 @@
-# Config file for compilation wpa_supplicant sur supauth.eap.testbed.aaa
-
-# We use the WEXT generic driver with mac80211_hwsim hardware
-CONFIG_DRIVER_WEXT=y
-
-# EAP and EAPoL
-CONFIG_IEEE8021X_EAPOL=y
-CONFIG_EAP_MD5=y
-CONFIG_EAP_MSCHAPV2=y
-CONFIG_EAP_TLS=y
-CONFIG_EAP_PEAP=y
-CONFIG_EAP_TTLS=y
-# CONFIG_EAP_FAST=y
-CONFIG_EAP_GTC=y
-CONFIG_EAP_OTP=y
-CONFIG_EAP_SIM=y
-# ETC...
-CONFIG_EAP_IKEV2=y
-CONFIG_PKCS12=y
-
-CONFIG_EAPOL_TEST=y
-
-CONFIG_CTRL_IFACE=y
-CONFIG_BACKEND=file
-CONFIG_DEBUG_FILE=y
-
Index: nf/supauth3.eap.testbed.aaa/wpasupplicant/wpa_supplicant.conf
===================================================================
--- conf/supauth3.eap.testbed.aaa/wpasupplicant/wpa_supplicant.conf	(revision 10)
+++ 	(revision )
@@ -1,18 +1,0 @@
-ctrl_interface=/var/run/wpa_supplicant
-
-network={
-        ssid="mac80211 test3"
-        key_mgmt=WPA-EAP
-        proto=WPA2
-        pairwise=CCMP
-        group=CCMP
-#	eap=MD5
-#	password="himitsu"
-
-	eap=TLS
-	identity="client2@eap.testbed.aaa"
-	ca_cert="/home/aaa/ca/ca_data/mgr.testbed.aaa/public/cacert.pem"
-	client_cert="/home/aaa/ca/ca_data/mgr.testbed.aaa/clients/client2/cert.pem"
-	private_key="/home/aaa/ca/ca_data/mgr.testbed.aaa/clients/client2/privkey.pem"
-}
-
Index: mrb/eap_testbed.sh
===================================================================
--- mrb/eap_testbed.sh	(revision 11)
+++ mrb/eap_testbed.sh	(revision 0)
@@ -20,15 +20,9 @@
 	./vm_start.sh "eap-supauth.eap.testbed.aaa" &
 	sleep 3
-	./vm_start.sh "eap-supauth2.eap.testbed.aaa" &
-	sleep 3
 	./vm_start.sh "eap-gw.eap.testbed.aaa" &
 	sleep 3
 	./vm_start.sh "eap-backend.eap.testbed.aaa" &
 	sleep 3
-	./vm_start.sh "eap-supauth3.eap.testbed.aaa" &
-	sleep 3
-	./vm_start.sh "eap-radpxy.eap.testbed.aaa" &
-	#sleep 3
-	#./vm_start.sh "eap-opendiam.eap.testbed.aaa" &
+	./vm_start.sh "eap-opendiam.eap.testbed.aaa" &
 	
 	# Done
@@ -40,10 +34,7 @@
 	./vm_pause.sh "eap-eapmgr.testbed.aaa" &
 	./vm_pause.sh "eap-supauth.eap.testbed.aaa" &
-	./vm_pause.sh "eap-supauth2.eap.testbed.aaa" &
 	./vm_pause.sh "eap-gw.eap.testbed.aaa" &
 	./vm_pause.sh "eap-backend.eap.testbed.aaa" &
-	./vm_pause.sh "eap-supauth3.eap.testbed.aaa" &
-	./vm_pause.sh "eap-radpxy.eap.testbed.aaa" &
-	#./vm_pause.sh "eap-opendiam.eap.testbed.aaa" &
+	./vm_pause.sh "eap-opendiam.eap.testbed.aaa" &
 	wait
 	;;
@@ -53,10 +44,7 @@
 	./vm_stop.sh "eap-eapmgr.testbed.aaa" &
 	./vm_stop.sh "eap-supauth.eap.testbed.aaa" &
-	./vm_stop.sh "eap-supauth2.eap.testbed.aaa" &
 	./vm_stop.sh "eap-gw.eap.testbed.aaa" &
 	./vm_stop.sh "eap-backend.eap.testbed.aaa" &
-	./vm_stop.sh "eap-supauth3.eap.testbed.aaa" &
-	./vm_stop.sh "eap-radpxy.eap.testbed.aaa" &
-	#./vm_stop.sh "eap-opendiam.eap.testbed.aaa" &
+	./vm_stop.sh "eap-opendiam.eap.testbed.aaa" &
 	wait
 	;;
Index: mrb/fd_rebuild.sh
===================================================================
--- mrb/fd_rebuild.sh	(revision 4)
+++ mrb/fd_rebuild.sh	(revision 0)
@@ -1,3 +1,3 @@
 #!/bin/bash -x
 
-cd ../src/freeDiameter && hg pull -u
+cd ../src/freeDiameter && hg pull && hg update 
Index: b/iop_testbed.sh
===================================================================
--- mrb/iop_testbed.sh	(revision 14)
+++ 	(revision )
@@ -1,54 +1,0 @@
-#!/bin/bash 
-
-echo ""
-
-case "$1" in
-  start)
-	# On a besoin de mgr
-	./vm_start.sh "__mgr.testbed.aaa" || {
-		echo "Echec au demarrage de mgr, abandon."
-		exit 1
-	}
-
-	# On a besoin ensuite de rtmgr
-	./vm_start.sh "iop-iopmgr.testbed.aaa" || {
-		echo "Echec au demarrage de iopmgr, abandon."
-		exit 1
-	}
-	
-	# Maintenant on peut demarrer les autres VM en paralelle
-	./vm_start.sh "iop-fdrelay.iop.testbed.aaa" &
-	sleep 3
-	./vm_start.sh "iop-crcumcli.iop.testbed.aaa" &
-	sleep 3
-	./vm_start.sh "iop-crcumsrv.iop.testbed.aaa" &
-	#./vm_start.sh "eap-supauth2.eap.testbed.aaa" &
-	#sleep 3
-	
-	# Done
-	#wait
-	;;
-  pause)
-	# On arrete toutes ces machines en sauvant leur etat
-	./vm_pause.sh "__mgr.testbed.aaa" &
-	./vm_pause.sh "iop-iopmgr.testbed.aaa" &
-	./vm_pause.sh "iop-fdrelay.iop.testbed.aaa" &
-	./vm_pause.sh "iop-crcumcli.iop.testbed.aaa" &
-	./vm_pause.sh "iop-crcumsrv.iop.testbed.aaa" &
-	wait
-	;;
-  stop)
-	# On arrete toutes ces machines en envoyant un shutdown
-	./vm_stop.sh "__mgr.testbed.aaa" &
-	./vm_stop.sh "iop-iopmgr.testbed.aaa" &
-	./vm_stop.sh "iop-fdrelay.iop.testbed.aaa" &
-	./vm_stop.sh "iop-crcumcli.iop.testbed.aaa" &
-	./vm_stop.sh "iop-crcumsrv.iop.testbed.aaa" &
-	wait
-	;;
-  *)
-	echo "Usage: $0 [start|pause|stop]"
-	exit 1
-esac
-
-exit 0
Index: mrb/routing_testbed.sh
===================================================================
--- mrb/routing_testbed.sh	(revision 15)
+++ mrb/routing_testbed.sh	(revision 0)
@@ -20,6 +20,4 @@
 	./vm_start.sh "rt-nas.a.rt.testbed.aaa" &
 	sleep 3
-	./vm_start.sh "rt-relay.a.rt.testbed.aaa" &
-	sleep 3
 	./vm_start.sh "rt-proxy.a.rt.testbed.aaa" &
 	sleep 3
@@ -36,5 +34,4 @@
 	./vm_pause.sh "rt-rtmgr.testbed.aaa" &
 	./vm_pause.sh "rt-nas.a.rt.testbed.aaa" &
-	./vm_pause.sh "rt-relay.a.rt.testbed.aaa" &
 	./vm_pause.sh "rt-proxy.a.rt.testbed.aaa" &
 	./vm_pause.sh "rt-proxy.b.rt.testbed.aaa" &
@@ -47,5 +44,4 @@
 	./vm_stop.sh "rt-rtmgr.testbed.aaa" &
 	./vm_stop.sh "rt-nas.a.rt.testbed.aaa" &
-	./vm_stop.sh "rt-relay.a.rt.testbed.aaa" &
 	./vm_stop.sh "rt-proxy.a.rt.testbed.aaa" &
 	./vm_stop.sh "rt-proxy.b.rt.testbed.aaa" &
Index: mrb/update_all_vm.sh
===================================================================
--- mrb/update_all_vm.sh	(revision 10)
+++ mrb/update_all_vm.sh	(revision 0)
@@ -36,6 +36,6 @@
 	# The EAP testbed
 	MGRS="$MGRS eap-eapmgr.testbed.aaa"
-	VMS="$VMS eap-supauth.eap.testbed.aaa eap-gw.eap.testbed.aaa"
-	VMS="$VMS eap-backend.eap.testbed.aaa"
+	VMS="$VMS supauth.eap.testbed.aaa gw.eap.testbed.aaa"
+	VMS="$VMS backend.eap.testbed.aaa opendiam.eap.testbed.aaa"
 	;;
 	
Index: ripts/circum-install.sh
===================================================================
--- scripts/circum-install.sh	(revision 14)
+++ 	(revision )
@@ -1,22 +1,0 @@
-#!/bin/bash -x
-
-# Install dependencies
-aptitude install -y autoconf automake libtool pkg-config build-essential \
-  git-core libhx-dev libpcre3-dev libxml2-dev libssl-dev \
-  apache2-dev libpam-dev gdb
-
-# Install the link to the configuration
-/home/aaa/installvm.sh conflink
-
-# Build circum
-rm -rf /root/circum
-rm -rf /root/circum-rt
-cd /root
-git clone file:///home/aaa/src/circum
-mkdir circum-rt
-cd circum
-./autogen.sh
-./configure --prefix=/root/circum-rt CFLAGS="-O0 -ggdb3" CXXFLAGS="-O0 -ggdb3"
-make && make install
-
-
Index: ripts/circum-run.sh
===================================================================
--- scripts/circum-run.sh	(revision 13)
+++ 	(revision )
@@ -1,10 +1,0 @@
-#!/bin/bash -x
-
-DATE=`date +%Y%m%d-%H%M%S`;
-HOST=`hostname --fqdn`;
-
-ulimit -c 1000000
-rm -f core*
-
-echo crcum-$HOST-$DATE.log > /home/aaa/logs/LATEST-$HOST-crcum.log
-/root/circum-rt/sbin/circumd -U root -D FF -c /root/conf/circum/circumd.conf.xml 2>&1 | tee -i /home/aaa/logs/crcum-$HOST-$DATE.log
Index: ripts/debian-install.sh
===================================================================
--- scripts/debian-install.sh	(revision 13)
+++ 	(revision )
@@ -1,6 +1,0 @@
-#!/bin/bash
-
-# Install this component on Debian VMs
-echo ipv6 >> /etc/modules
-echo vboxvfs >> /etc/modules
-
Index: scripts/freeDiameter-install.sh
===================================================================
--- scripts/freeDiameter-install.sh	(revision 15)
+++ scripts/freeDiameter-install.sh	(revision 0)
@@ -2,5 +2,5 @@
 
 # Install dependencies for freeDiameter
-aptitude install flex bison libsctp1 libsctp-dev libgcrypt-dev libgcrypt11-dbg libgnutls26 libgnutls26-dbg libgnutls-dev mercurial cmake gdb python-dev swig libidn11-dev
+aptitude install flex bison libsctp1 libsctp-dev libgcrypt-dev libgcrypt11-dbg libgnutls26 libgnutls26-dbg libgnutls-dev mercurial cmake gdb
 
 # Install the link to the configuration
Index: scripts/freeDiameter-run.sh
===================================================================
--- scripts/freeDiameter-run.sh	(revision 15)
+++ scripts/freeDiameter-run.sh	(revision 0)
@@ -12,3 +12,3 @@
 
 echo fd-$HOST-$DATE.log > /home/aaa/logs/LATEST-$HOST-fd.log
-/root/freeDiameter/freeDiameterd/freeDiameterd -dd $* 2>&1 | tee -i /home/aaa/logs/fd-$HOST-$DATE.log
+/root/freeDiameter/freeDiameter/freeDiameterd -dd $* 2>&1 | tee -i /home/aaa/logs/fd-$HOST-$DATE.log
Index: scripts/freeDiameter-trig.sh
===================================================================
--- scripts/freeDiameter-trig.sh	(revision 3)
+++ scripts/freeDiameter-trig.sh	(revision 0)
@@ -1,10 +1,3 @@
 #!/bin/bash -x
-
-# Usage: ./$0 [loop]
-# If "loop" is specified on the command line, the signal
-# will be sent every 10 seconds. Otherwise, it is only sent once.
-
-# Note: if the daemon is restarted (changes its PID), this script
-# must also be restarted.
 
 PID=`ps --no-heading -C freeDiameterd -o '%p'`;
Index: ripts/freeDiameter-valgrind.sh
===================================================================
--- scripts/freeDiameter-valgrind.sh	(revision 9)
+++ 	(revision )
@@ -1,32 +1,0 @@
-#!/bin/bash -x
-
-DATE=`date +%Y%m%d-%H%M%S`;
-HOST=`hostname --fqdn`;
-
-ulimit -c 1000000
-rm -f core*
-
-pushd freeDiameter
-make
-popd
-
-case "$1" in
-	helgrind)
-		TOOL="--tool=helgrind"
-		;;
-
-	DRD)
-		TOOL="--tool=drd"
-		;;
-
-	ptrcheck)
-		TOOL="--tool=exp-ptrcheck"
-		;;
-
-
-	*)
-		TOOL=""
-esac
-
-echo fd-$HOST-$DATE.log > /home/aaa/logs/LATEST-$HOST-fd.log
-valgrind $TOOL /root/freeDiameter/freeDiameter/freeDiameterd -dd $* 2>&1 | tee -i /home/aaa/logs/fd-$HOST-$DATE.log
Index: ripts/freeradius-install.sh
===================================================================
--- scripts/freeradius-install.sh	(revision 11)
+++ 	(revision )
@@ -1,9 +1,0 @@
-#!/bin/bash -x
-
-# Install software
-aptitude -y install freeradius || exit 1
-
-# Install the link to the configuration
-/home/aaa/installvm.sh conflink
-
-
Index: ripts/freeradius-run.sh
===================================================================
--- scripts/freeradius-run.sh	(revision 11)
+++ 	(revision )
@@ -1,11 +1,0 @@
-#!/bin/bash -x
-
-DATE=`date +%Y%m%d-%H%M%S`;
-HOST=`hostname --fqdn`;
-
-ulimit -c 1000000
-rm -f core*
-
-echo fr-$HOST-$DATE.log > /home/aaa/logs/LATEST-$HOST-fr.log
-freeradius -d /root/conf/freeradius -f -X 2>&1 | tee -i /home/aaa/logs/fr-$HOST-$DATE.log
-
Index: ripts/ipforward-install.sh
===================================================================
--- scripts/ipforward-install.sh	(revision 13)
+++ 	(revision )
@@ -1,6 +1,0 @@
-#!/bin/bash -x
-
-echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/ipforward.conf
-echo "net.ipv6.conf.all.forwarding=1" >> /etc/sysctl.d/ipforward.conf
-echo 1 > /proc/sys/net/ipv4/ip_forward
-echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
Index: scripts/vboxtools-install.sh
===================================================================
--- scripts/vboxtools-install.sh	(revision 9)
+++ scripts/vboxtools-install.sh	(revision 0)
@@ -2,5 +2,6 @@
 
 # Install the packages
-aptitude install dkms virtualbox-ose-guest-source virtualbox-ose-guest-dkms virtualbox-ose-guest-utils 
+# aptitude install dkms virtualbox-ose-guest-source virtualbox-ose-guest-utils virtualbox-ose-guest-dkms
+aptitude install dkms virtualbox-ose-guest-source virtualbox-ose-guest-dkms
 
 # Done :)
