October 2005 - Freeradius-Devel - lists.freeradius.org

rlm_mschap patch into release branch?
by Michael Griego 18 Oct '05

18 Oct '05

I know we don't have anymore 1.0 series releases scheduled at the moment, but I was wondering if it would be a problem for anyone if the rlm_mschap patch to aid in PEAP machine auth got included in the next release? It's something that several people have been asking about (and there's a number of interested parties from the .edu side of things). The only other option really for those people who don't want to run CVS versions would be to put out a patched version of rlm_mschap.c for them to replace in their current/1.0 series source trees. --Mike

2 1

SQL clients code
by Michael Griego 18 Oct '05

18 Oct '05

Just as an FYI, with the masking fix, I've been able to verify that the SQL clients code in CVS seems to be working as it should. I don't think anyone had reported on that yet. --Mike

1 0

Automatic report from sources (radiusd) between 17.10.2005 - 18.10.2005 GMT
by Automatic cvs log generator 18 Oct '05

18 Oct '05

CVS log entries from 17.10.2005 (Mon) 08:00:01 - 18.10.2005 (Tue) 08:00:04 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/main/threads.c; Revisions: 1.99, 1.98, 1.77.2.7 File: radiusd/src/main/request_list.c; Revisions: 1.68, 1.67 File: radiusd/src/main/listen.c; Revisions: 1.39 Author: mgriego File: radiusd/src/modules/rlm_mschap/rlm_mschap.c; Revisions: 1.73 ===================================================== Log entries ===================================================== Description: When stealing the fd, steal the rl, too Modified files: File: radiusd/src/main/listen.c; Revision: 1.39; Date: 2005/10/17 17:25:15; Author: aland; Lines: (+5 -2) ------------------------------- Description: Catch even more corner cases. This code is *bad* Modified files: File: radiusd/src/main/request_list.c; Revision: 1.68; Date: 2005/10/17 19:04:07; Author: aland; Lines: (+6 -4) ------------------------------- Description: Catch the time when we're supposed to send delayed rejects. This appears to prevent the loop of "Waiting for 0 seconds" Modified files: File: radiusd/src/main/request_list.c; Revision: 1.67; Date: 2005/10/17 18:00:35; Author: aland; Lines: (+8 -2) ------------------------------- Description: Queue the request, THEN look for more threads Modified files: File: radiusd/src/main/threads.c; Revision: 1.99; Date: 2005/10/17 18:37:27; Author: aland; Lines: (+12 -12) ------------------------------- Description: Increment head *after* deleting it from the queue Modified files: File: radiusd/src/main/threads.c; Revision: 1.98; Date: 2005/10/17 17:19:29; Author: aland; Lines: (+4 -6) ------------------------------- Description: Pull fix from the head Modified files: File: radiusd/src/main/threads.c; Revision: 1.77.2.7; Date: 2005/10/17 18:38:07; Author: aland; Lines: (+11 -11) ------------------------------- Description: Be a little more forgiving about the number of domain components in a User-Name in the form of host/f.q.d.n. Modified files: File: radiusd/src/modules/rlm_mschap/rlm_mschap.c; Revision: 1.73; Date: 2005/10/17 19:09:42; Author: mgriego; Lines: (+21 -13) ===================================================== Summary of modified files ===================================================== File: radiusd/src/main/listen.c Revisions: 1.39 Authors: aland (+5 -2) ------------------------------- File: radiusd/src/main/request_list.c Revisions: 1.68, 1.67 Authors: aland (+6 -4), aland (+8 -2) ------------------------------- File: radiusd/src/main/threads.c Revisions: 1.99, 1.98, 1.77.2.7 Authors: aland (+12 -12), aland (+4 -6), aland (+11 -11) ------------------------------- File: radiusd/src/modules/rlm_mschap/rlm_mschap.c Revisions: 1.73 Authors: mgriego (+21 -13) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

TIMEOUT requests && then Duplicate Requests && then Threads block
by Joe Maimon 17 Oct '05

17 Oct '05

At least I think thats the sequence of events I am troubleshooting now. Here is a snippet in request_process.c case REQUEST_FAIL_SERVER_TIMEOUT: radlog(L_ERR, "TIMEOUT for request %d in module %s, component %s", request->number, request->module ? request->module : "<server core>", request->component ? request->component : "<server core>"); /* * Tell the server to stop processing the request */ request->options |= RAD_REQUEST_OPTION_STOP_NOW; /* This is the line I have added?? */ request->finished = TRUE; break;

2 5

thread_pool_addrequest()
by Joe Maimon 17 Oct '05

17 Oct '05

returns if it cannot spawn a thread per each request. It returns before adding the request to the queue. Does that mean the server will ignore requests if it cannot spawn a thread at the time of arrival? If so, wouldnt it be better to queue it and hope for the availability of threads in the near future? Something like this thread_pool_addrequest() while ((thread_pool.total_threads - thread_pool.active_threads) < lrad_hash_table_num_elements(thread_pool.queue)) { if (spawn_thread(request->timestamp) == NULL) { radlog(L_INFO, "The maximum number of threads (%d) are active, cannot spawn new thread to handle request", thread_pool.max_threads); break; } }

2 1

assert in util.c:189 on exit
by Joe Maimon 17 Oct '05

17 Oct '05

And so for the last week I have been happily using cvs20050929 with a couple one liners. This morning logs look like this: Fri Oct 7 08:29:29 2005 : Error: !!! ERROR !!! The server is blocked: discarding new request 181169 Fri Oct 7 08:29:29 2005 : Error: !!! ERROR !!! The server is blocked: discarding new request 181170 Fri Oct 7 08:29:30 2005 : Error: !!! ERROR !!! The server is blocked: discarding new request 181171 Fri Oct 7 08:29:30 2005 : Error: !!! ERROR !!! The server is blocked: on and on (any idea why? this never happened before [ before means cvs from 20050316 ]) so I executed /etc/init.d/freeradius stop and got the above assert. Apparently a gracefull exit is hard to do if the server has blocked threads? Where should I start looking? Thanks, Joe

2 3

Recieving diffrent NAS Identifiers in the Accounting requests
by Mohammed Riyaz 17 Oct '05

17 Oct '05

Hi, I was wondering what the radius server response would be to accounting-start and accounting-stop packets which arrive with different nas-identifiers (or nas-ip-address). This situation has not been dealt with in the RFC. So is the implementation specific? Could some one please give some information on this? Thank you, Riyaz -- http://www.fastmail.fm - Choose from over 50 domains or use your own

2 1

Automatic report from sources (radiusd) between 16.10.2005 - 17.10.2005 GMT
by Automatic cvs log generator 17 Oct '05

17 Oct '05

CVS log entries from 16.10.2005 (Sun) 08:00:01 - 17.10.2005 (Mon) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: mgriego File: radiusd/src/modules/rlm_mschap/rlm_mschap.c; Revisions: 1.72 ===================================================== Log entries ===================================================== Description: Allow mschap_xlat to return the correctly formatted username when given a User-Name in the format of host/fully.qualified.name. A Windows domain expects a machine name in the format of shortname$, ie the SAM version of the account name. mschap_xlat will also pull the first domain component following the hostname a host/ formatted username and return that as the NT-Domain xlat. With these changes, the ntlm_auth command can be assured to always have the correct formatting of the username for either user authentication and machine authentication by simply passing the xlats of %{mschap:User-Name} and %{mschap:NT-Domain} Modified files: File: radiusd/src/modules/rlm_mschap/rlm_mschap.c; Revision: 1.72; Date: 2005/10/17 02:20:42; Author: mgriego; Lines: (+63 -18) ===================================================== Summary of modified files ===================================================== File: radiusd/src/modules/rlm_mschap/rlm_mschap.c Revisions: 1.72 Authors: mgriego (+63 -18) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

PEAP Machine Authentications Working
by Michael Griego 17 Oct '05

17 Oct '05

I figured I'd go ahead and make the announcement here. I'll put something out to the user's list tomorrow. PEAP Machine authentications are now working. With the patch for Samba listed at http://www.open.com.au/archives/radiator/2005-10/msg00037.html (and I assume the forthcoming patches to allow these flags to be specified at runtime) and some work on the rlm_mschap module, I have been able to successfully get a Windows machine to perform machine authentication using PEAP via the ntlm_auth call. --Mike

2 1

patches
by Joe Maimon 16 Oct '05

16 Oct '05

Alan, all those with commit, I was wondering if the patches I postred had been considered. I am perfectly ok with them being turned down, as I know better than most that my code does not approach the quality of any of the existing submitters. And with dpatch (thanks!), maintaining the patches privately is the smallest part of the effort I expend each freeradius upgrade. I would however appreciate a note one way or the other, so I would know to shut up on the subjet of the indicated patch and that it had been seen. If I should assume no answer is an answer of no, I only need to be told once. Not trying to annoy anyone here, apologies in advance. Thanks in advance. Joe

2 2