November 2005 - Freeradius-Devel - lists.freeradius.org

wiki?
by Michael Griego 12 Dec '05

12 Dec '05

Actually, this seems like a really good idea... Would it be possible to install a wiki on the FreeRADIUS site? I saw a post from another user saying he had set one up, but I think an "official" FR wiki linked from the site would be good. Thoughts? --Mike

4 3

rlm_krb5 hardware preauth
by Benjamin Bennett 06 Dec '05

06 Dec '05

Hi, I posted a patch to bugzilla (http://bugs.freeradius.org/show_bug.cgi?id=296) which adds kerberos hardware preauthentication support to rlm_krb5 when using MIT krb5 libs. Also pasted below. Any feedback from people involved with rlm_krb5 or other modules which use challenge-response would be appreciated. This patch takes advantage of the krb5 libs (and hence rlm_krb5) being thread-unsafe already, but could be changed if that bothers people. --ben --- src/modules/rlm_krb5/rlm_krb5.c.dist 2005-11-18 18:06:03.000000000 -0500 +++ src/modules/rlm_krb5/rlm_krb5.c 2005-11-18 21:44:49.000000000 -0500 @@ -20,6 +20,7 @@ * Copyright 2000 The FreeRADIUS server project * Copyright 2000 Nathan Neulinger <nneul(a)umr.edu> * Copyright 2000 Alan DeKok <aland(a)ox.org> + * Copyright 2005 Benjamin Bennett <ben(a)psc.edu> */ @@ -39,6 +40,8 @@ #include <krb5.h> #include <com_err.h> +REQUEST *global_request; + typedef struct rlm_krb5_t { const char *keytab; const char *service_princ; @@ -205,12 +208,83 @@ return 0; } +#ifndef HEIMDAL_KRB5 +static krb5_error_code KRB5_CALLCONV +krb5_radius_prompter(krb5_context context, void *data, const char *name, + const char *banner, int num_prompts, + krb5_prompt prompts[]) +{ + VALUE_PAIR *state; + VALUE_PAIR *reply; + char *challenge; + char *newstate; + int clen; + int r; + + /* Squelch unused param warnings */ + context = context; + data = data; + + if(num_prompts != 1) { + radlog(L_DBG, "rlm_krb5: [%s] krb5_radius_prompter failed: num_prompts (%d) != 1", global_request->username->strvalue, num_prompts); + global_request->reply->code = PW_AUTHENTICATION_REJECT; + return KRB5_LIBOS_CANTREADPWD; + } + + state = pairfind(global_request->packet->vps, PW_STATE); + + if(!state) { /* NEW Request */ + radlog(L_DBG, "rlm_krb5: [%s] krb5_radius_prompter: additional token required", global_request->username->strvalue); + + /* Setup challenge prompt */ + clen = strlen(name)+strlen(banner)+strlen(prompts[0].prompt)+5; + challenge = rad_malloc(clen); + snprintf(challenge, clen, "%s\n%s\n%s: ", name, banner, + prompts[0].prompt); + + /* Re-encode User-Password to send back */ + rad_pwencode((char *)global_request->password->strvalue, + &global_request->password->length, + global_request->secret, + (char *)global_request->packet->vector); + + /* Setup State with current Authenticator and User-Password */ + newstate = rad_malloc(AUTH_VECTOR_LEN+ + global_request->password->length+1); + memcpy(newstate, global_request->packet->vector, AUTH_VECTOR_LEN); + memcpy(newstate+AUTH_VECTOR_LEN, global_request->password->strvalue, + global_request->password->length+1); + + /* Put State into a challenge reply */ + reply = pairmake("Reply-Message", challenge, T_OP_EQ); + pairadd(&global_request->reply->vps, reply); + state = pairmake("State", newstate, T_OP_EQ); + pairadd(&global_request->reply->vps, state); + global_request->reply->code = PW_ACCESS_CHALLENGE; + free(challenge); + free(newstate); + r = KRB5_LIBOS_CANTREADPWD; + } else { /* Challenge Response */ + radlog(L_DBG, "rlm_krb5: [%s] krb5_radius_prompter: using additional token", global_request->username->strvalue); + + strncpy(prompts[0].reply->data, + (char *)global_request->password->strvalue, + prompts[0].reply->length); + prompts[0].reply->data[(prompts[0].reply->length)-1] = '\0'; + prompts[0].reply->length = strlen(prompts[0].reply->data); + r = 0; + } + return r; +} +#endif + /* validate userid/passwd */ /* MIT case */ #ifndef HEIMDAL_KRB5 static int krb5_auth(void *instance, REQUEST *request) { int r; + VALUE_PAIR *state; krb5_data tgtname = { 0, @@ -218,11 +292,13 @@ KRB5_TGS_NAME }; krb5_creds kcreds; + krb5_get_init_creds_opt opts; krb5_ccache ccache; char cache_name[L_tmpnam + 8]; krb5_context context = *((rlm_krb5_t *)instance)->context; /* copy data */ - const char *user, *pass; + const char *user; + char *pass; /* * We can only authenticate user requests which HAVE @@ -271,6 +347,8 @@ /* * Actually perform the authentication */ + krb5_get_init_creds_opt_init(&opts); + memset((char *)&kcreds, 0, sizeof(kcreds)); if ( (r = krb5_parse_name(context, user, &kcreds.client)) ) { @@ -302,22 +380,40 @@ return RLM_MODULE_REJECT; } - if ( (r = krb5_get_in_tkt_with_password(context, - 0, NULL, NULL, NULL, pass, ccache, &kcreds, 0)) ) { - radlog(L_AUTH, "rlm_krb5: [%s] krb5_g_i_t_w_p failed: %s", - user, error_message(r)); - krb5_free_cred_contents(context, &kcreds); - krb5_cc_destroy(context, ccache); - return RLM_MODULE_REJECT; - } else { + global_request = request; + state = pairfind(request->packet->vps, PW_STATE); + if(state) { + radlog(L_DBG, "rlm_krb5: [%s] challenge response", user); + if(state->length <= AUTH_VECTOR_LEN) { + radlog(L_AUTH, "rlm_krb5: [%s] BAD State data", user); + return RLM_MODULE_REJECT; + } + pass = (char *)state->strvalue+AUTH_VECTOR_LEN; + rad_pwdecode(pass, state->length-AUTH_VECTOR_LEN, + request->secret, (char *)state->strvalue); + } + + if(!(r = krb5_get_init_creds_password(context, &kcreds, + kcreds.client, pass, krb5_radius_prompter, NULL, + (krb5_deltat)0, NULL, &opts))) { + if( (r = krb5_cc_store_cred(context, ccache, &kcreds)) ) { + radlog(L_AUTH, "rlm_krb5: [%s] krb5_cc_store_cred failed: %s", + user, error_message(r)); + return RLM_MODULE_REJECT; + } /* Now verify the KDC's identity. */ r = verify_krb5_tgt(context, (rlm_krb5_t *)instance, user, ccache); - krb5_free_cred_contents(context, &kcreds); - krb5_cc_destroy(context, ccache); - return r; + } else if(r == KRB5_LIBOS_CANTREADPWD) { + r = RLM_MODULE_HANDLED; + } else { + radlog(L_AUTH, "rlm_krb5: [%s] krb5_g_i_c_p failed: %s", user, + error_message(r)); + r = RLM_MODULE_REJECT; } - return RLM_MODULE_REJECT; + krb5_free_cred_contents(context, &kcreds); + krb5_cc_destroy(context, ccache); + return r; } #else /* HEIMDAL_KRB5 */

4 6

Maybe a 1.1.0?
by Alan DeKok 02 Dec '05

02 Dec '05

I've taken a quick look at porting a few features from the CVS head to 1.0.x. Specifically, the new dictionaries, dictionary parser, and the weird VSA handling. So far, it looks like it works. Should I commit it to 1.0.x, for maybe 1.0.6? Or make a 1.1.x branch off of 1.0.x, and call the new code 1.1.0? It's been over a year since 1.0 was released, and having a 1.1.0 with a few new features would be cool. We could also back-port a few other things, like some of the module cleanups. These should be relatively easy to back-port, and can have significant useful impact for people running the server. In the mean time, the CVS head can continue with it's re-writes, and IPv6 work. Also, having a 1.1.0 with a few minor changes means that the step to 2.x is less problematic. Thoughts? Opinions? Rocks & bricks? Alan DeKok.

7 16

EAp-AKA
by kalyani gopalabhatla 29 Nov '05

29 Nov '05

Hi, We are implementing EAP-AKA mechanism. As free RADIUS does not support AKA, we want to write the code for AKA. Can any one help us how to get started with it? Thanks Kal Raji --------------------------------- Yahoo! Personals Single? There's someone we'd like you to meet. Lots of someones, actually. Yahoo! Personals

2 1

Automatic report from sources (radiusd) between 28.11.2005 - 29.11.2005 GMT
by Automatic cvs log generator 29 Nov '05

29 Nov '05

CVS log entries from 28.11.2005 (Mon) 09:00:00 - 29.11.2005 (Tue) 09:00:00 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/modules/rlm_exec/rlm_exec.c; Revisions: 1.20 File: radiusd/src/main/request_list.c; Revisions: 1.71 File: radiusd/src/include/radius.h; Revisions: 1.78 File: radiusd/share/dictionary.freeradius.internal; Revisions: 1.6 ===================================================== Combined list of identical log entries ===================================================== Description: Re-implemented Exec-Program && Exec-Program-Wait in rlm_exec, in the post-auth section. We may want to add this in the "accounting" section, too Modified files: File: radiusd/share/dictionary.freeradius.internal; Revision: 1.6; Date: 2005/11/28 21:47:01; Author: aland; Lines: (+3 -1) File: radiusd/src/include/radius.h; Revision: 1.78; Date: 2005/11/28 21:47:01; Author: aland; Lines: (+3 -1) File: radiusd/src/modules/rlm_exec/rlm_exec.c; Revision: 1.20; Date: 2005/11/28 21:47:01; Author: aland; Lines: (+66 -4) ===================================================== Log entries ===================================================== Description: Clean up time passed calculation (again) Modified files: File: radiusd/src/main/request_list.c; Revision: 1.71; Date: 2005/11/28 21:39:44; Author: aland; Lines: (+5 -3) ===================================================== Summary of modified files ===================================================== File: radiusd/share/dictionary.freeradius.internal Revisions: 1.6 Authors: aland (+3 -1) ------------------------------- File: radiusd/src/include/radius.h Revisions: 1.78 Authors: aland (+3 -1) ------------------------------- File: radiusd/src/main/request_list.c Revisions: 1.71 Authors: aland (+5 -3) ------------------------------- File: radiusd/src/modules/rlm_exec/rlm_exec.c Revisions: 1.20 Authors: aland (+66 -4) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

assert on listen.c:565
by Joe Maimon 28 Nov '05

28 Nov '05

CVS 11/27 On older CVS versions I had this patch, which I am testing again as a solution. Server starts to log below after running fine for close to 12 hours...... Mon Nov 28 04:05:18 2005 : Proxy: No outstanding request was found for proxy reply from home server 90.90.90.15 port 1646 - ID 32 Mon Nov 28 04:05:18 2005 : Proxy: No outstanding request was found for proxy reply from home server 90.90.90.15 port 1646 - ID 35 Mon Nov 28 04:05:18 2005 : Proxy: No outstanding request was found for proxy reply from home server 90.90.90.15 port 1646 - ID 36 Mon Nov 28 04:05:19 2005 : Proxy: marking accounting server 90.90.90.15:1646 for realm jnet dead Mon Nov 28 04:05:21 2005 : Proxy: marking accounting server 90.90.90.15:1646 for realm jnet dead Mon Nov 28 04:05:22 2005 : Proxy: No outstanding request was found for proxy reply from home server 90.90.90.15 port 1646 - ID 37 Mon Nov 28 04:05:23 2005 : Proxy: No outstanding request was found for proxy reply from home server 90.90.90.15 port 1646 - ID 35 Mon Nov 28 04:05:23 2005 : Proxy: No outstanding request was found for proxy reply from home server 90.90.90.15 port 1646 - ID 33 Mon Nov 28 04:05:23 2005 : Proxy: No outstanding request was found for proxy reply from home server 90.90.90.15 port 1646 - ID 36 Mon Nov 28 04:05:23 2005 : Proxy: No outstanding request was found for proxy reply from home server 90.90.90.15 port 1646 - ID 34 Mon Nov 28 04:05:23 2005 : Proxy: No outstanding request was found for proxy reply from home server 90.90.90.15 port 1646 - ID 32 Mon Nov 28 04:05:24 2005 : Proxy: No outstanding request was found for proxy reply from home server 90.90.90.15 port 1646 - ID 37 Mon Nov 28 04:05:24 2005 : Proxy: No outstanding request was found for proxy reply from home server 90.90.90.15 port 1646 - ID 38 Mon Nov 28 04:05:24 2005 : Auth: Login incorrect: [CCCCCCC/cisco] (from client noc08rt08 port 805372387) Mon Nov 28 04:05:24 2005 : Proxy: No outstanding request was found for proxy reply from home server 90.90.90.15 port 1646 - ID 39 Mon Nov 28 04:05:25 2005 : Auth: Login OK: [ruth@CCCCCCC] (from client noc08rt08 port 805372387) Mon Nov 28 04:05:26 2005 : Proxy: No outstanding request was found for proxy reply from home server 90.90.90.15 port 1646 - ID 35 Mon Nov 28 04:05:26 2005 : Proxy: No outstanding request was found for proxy reply from home server 90.90.90.15 port 1646 - ID 36 Mon Nov 28 04:05:27 2005 : Proxy: No outstanding request was found for proxy reply from home server 90.90.90.15 port 1646 - ID 38 Mon Nov 28 04:05:27 2005 : Proxy: No outstanding request was found for proxy reply from home server 90.90.90.15 port 1646 - ID 37 Mon Nov 28 04:05:29 2005 : Proxy: No outstanding request was found for proxy reply from home server 90.90.90.15 port 1646 - ID 39 Mon Nov 28 04:05:32 2005 : Proxy: No outstanding request was found for proxy reply from home server 90.90.90.15 port 1646 - ID 38 Mon Nov 28 04:05:34 2005 : Proxy: No outstanding request was found for proxy reply from home server 90.90.90.15 port 1646 - ID 39 Mon Nov 28 04:05:59 2005 : Auth: Login incorrect: [XXXX/cisco] (from client noc08rt08 port 810287241) Mon Nov 28 04:06:05 2005 : Error: Assertion failed in listen.c, line 565 #! /bin/sh /usr/share/dpatch/dpatch-run ## 090-assert-listen-proxy.dpatch by <joe(a)nameserver3.ttec.com> ## ## All lines beginning with `## DP:' are a description of the patch. ## DP: No description. @DPATCH@ diff -urNad freeradius-1.1.0~/src/main/listen.c freeradius-1.1.0/src/main/listen.c --- freeradius-1.1.0~/src/main/listen.c 2005-11-27 15:47:21.000000000 -0500 +++ freeradius-1.1.0/src/main/listen.c 2005-11-28 08:08:57.000000000 -0500 @@ -562,8 +562,10 @@ */ static int auth_socket_send(rad_listen_t *listener, REQUEST *request) { - rad_assert(request->listener == listener); - rad_assert(listener->send == auth_socket_send); + if (request->proxy_listener != listener) { + rad_assert(request->listener == listener); + rad_assert(listener->send == auth_socket_send); + } /* * Ensure that the reply is sane

2 3

Automatic report from sources (radiusd) between 27.11.2005 - 28.11.2005 GMT
by Automatic cvs log generator 28 Nov '05

28 Nov '05

CVS log entries from 27.11.2005 (Sun) 09:00:00 - 28.11.2005 (Mon) 09:00:00 GMT ===================================================== Summary by authors ===================================================== Author: nbk File: radiusd/debian/rules; Revisions: 1.62 ===================================================== Log entries ===================================================== Description: Pull a few downstream fixes: - don't rerun configure during the build. - don't install CVS files. - add phony targets. Modified files: File: radiusd/debian/rules; Revision: 1.62; Date: 2005/11/27 15:14:51; Author: nbk; Lines: (+4 -3) ===================================================== Summary of modified files ===================================================== File: radiusd/debian/rules Revisions: 1.62 Authors: nbk (+4 -3) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

[PATCH] policy module controlling where attributes are inserted into the reply
by Joe Maimon 27 Nov '05

27 Nov '05

The attached patch (tested to varying degrees in different points of its lifetime, compiles and performs as expected on my system) adds the ability to perform these operations Also attached is a patch that uses pairxlatmove instead of pairmove, which is the way I actually use it. The patch adds these operations reply ^= { } reply ^== () { } reply ^. { } reply ^.= () { } reply $= { } reply $== () { } reply $. { } reply $.= () { } ======================================== reply ^= { Attribute1 += "Value1" } Will insert the attribute at the top of the list. reply ^== ( Attribute2 == "Value2" ) { Attribute1 += "Value1" } Will insert attribute1 before Attribute2 if found, otherwise it behaves like ^= ^. and ^.= have the same difference as .= and = namely they call pairadd instead of pairmove Otherwise they are the same. Likewise provided are $= , $. , $== and $.= which insert AFTER the attribute. IOW $= and $. are synonymous with = and .= but are provided for completeness. $== and $.= are quite usefull in and of themselves. ========================================== Motivation: Cisco NAS's will kick users who assign a VRF after assigning an IP address. The VRF must come first. This allows this form in my policy.txt file. ====cut here========= policy add_inter_vrf { reply ^== ( reply:Cisco-Avpair =~ "lcp:interface-config") { Cisco-Avpair += "lcp:interface-config=ip vrf forwarding CHL-PRIVATE" } if (!(reply:Cisco-Avpair =~ "lcp:interface-config=ip address.*")) { reply $== (reply:Cisco-AVpair == "lcp:interface-config=ip vrf forwarding CHL-PRIVATE") { Cisco-Avpair += "lcp:interface-config=ip unnumbered l10" } } if (!(reply:Framed-IP-Address =* "")) { reply = { Cisco-Avpair += "ip:addr-pool=privatepool" } } } ====cut here========= Enjoy! #! /bin/sh /usr/share/dpatch/dpatch-run ## 240-before-after-where-head-tail.dpatch by <joe(a)nameserver3.ttec.com> ## ## All lines beginning with `## DP:' are a description of the patch. ## DP: No description. @DPATCH@ diff -urNad freeradius-1.1.0~/src/modules/rlm_policy/evaluate.c freeradius-1.1.0/src/modules/rlm_policy/evaluate.c --- freeradius-1.1.0~/src/modules/rlm_policy/evaluate.c 2005-11-27 12:22:35.000000000 -0500 +++ freeradius-1.1.0/src/modules/rlm_policy/evaluate.c 2005-11-27 12:22:35.000000000 -0500 @@ -882,6 +882,7 @@ VALUE_PAIR **vps = NULL; VALUE_PAIR *vp, *head, **tail; const policy_item_t *attr; + policy_lex_t this_how; this = (const policy_attributes_t *) item; @@ -932,20 +933,119 @@ tail = &(vp->next); } - switch (this->how) { + this_how = this->how; +retry_how: + switch (this_how) { case POLICY_LEX_SET_EQUALS: /* dangerous: removes all previous things! */ pairfree(vps); *vps = head; break; + case POLICY_LEX_AFTER_TAIL_ASSIGN: case POLICY_LEX_ASSIGN: /* 'union' */ - pairmove(vps, head); + pairmove(vps, &head); pairfree(&head); break; + case POLICY_LEX_BEFORE_HEAD_ASSIGN: + pairmove(&head, &vps); + pairfree(vps); + *vps = head; + break; + + case POLICY_LEX_AFTER_TAIL_EQUALS: case POLICY_LEX_CONCAT_EQUALS: pairadd(vps, head); break; + + case POLICY_LEX_BEFORE_HEAD_EQUALS: + pairadd(&head, *vps); + *vps = head; + break; + + case POLICY_LEX_BEFORE_WHERE_EQUALS: + case POLICY_LEX_AFTER_WHERE_EQUALS: + case POLICY_LEX_BEFORE_WHERE_ASSIGN: + case POLICY_LEX_AFTER_WHERE_ASSIGN: + /* find location*/ + { + VALUE_PAIR *vpprev = NULL, *vpnext = NULL, *lvp; + + for(lvp = *vps; lvp; vpprev = lvp, lvp = lvp->next) { + vpnext = lvp->next; + lvp->next = NULL; + if (evaluate_condition(state, this->where_loc)) + break; + lvp->next = vpnext; + } + + if (lvp) { + switch(this_how) { + case POLICY_LEX_BEFORE_WHERE_EQUALS: + case POLICY_LEX_BEFORE_WHERE_ASSIGN: + if (vpprev) { + lvp->next = vpnext; + vpnext = lvp; + vpprev->next = NULL; + lvp = vpprev; + } + default: /* always reached */ + break; + } + + switch(this_how) { + case POLICY_LEX_BEFORE_WHERE_EQUALS: + if (vpprev) + pairadd(&lvp, head); + else + *vps = lvp = head; + break; + case POLICY_LEX_AFTER_WHERE_EQUALS: + pairadd(&lvp, head); + break; + case POLICY_LEX_BEFORE_WHERE_ASSIGN: + if (vpprev) { + pairmove(&lvp, &head); + pairfree(&head); + } + else + *vps = lvp = head; + break; + case POLICY_LEX_AFTER_WHERE_ASSIGN: + pairmove(&lvp, &head); + pairfree(&head); + break; + default:/*never reached*/ + break; + } + for( ; lvp && lvp->next; lvp = lvp->next); + if (lvp) + lvp->next = vpnext; + break; + } + + switch(this_how) { + case POLICY_LEX_BEFORE_WHERE_EQUALS: + this_how = POLICY_LEX_BEFORE_HEAD_EQUALS; + break; + case POLICY_LEX_AFTER_WHERE_EQUALS: + this_how = POLICY_LEX_AFTER_TAIL_EQUALS; + break; + case POLICY_LEX_BEFORE_WHERE_ASSIGN: + this_how = POLICY_LEX_BEFORE_HEAD_ASSIGN; + break; + case POLICY_LEX_AFTER_WHERE_ASSIGN: + this_how = POLICY_LEX_AFTER_TAIL_ASSIGN; + break; + default: /*never reached*/ + break; + } + goto retry_how; + } + fprintf(stderr, "HUH?\n"); + pairfree(&head); + return 0; + break; /* never reach here */ default: fprintf(stderr, "HUH?\n"); diff -urNad freeradius-1.1.0~/src/modules/rlm_policy/parse.c freeradius-1.1.0/src/modules/rlm_policy/parse.c --- freeradius-1.1.0~/src/modules/rlm_policy/parse.c 2005-11-27 12:22:35.000000000 -0500 +++ freeradius-1.1.0/src/modules/rlm_policy/parse.c 2005-11-27 12:22:35.000000000 -0500 @@ -106,6 +106,14 @@ { ">=", POLICY_LEX_GT }, { "=~", POLICY_LEX_RX_EQUALS }, { "!~", POLICY_LEX_RX_NOT_EQUALS }, + { "^=", POLICY_LEX_BEFORE_HEAD_ASSIGN }, + { "^==", POLICY_LEX_BEFORE_WHERE_ASSIGN }, + { "^.", POLICY_LEX_BEFORE_HEAD_EQUALS }, + { "^.=", POLICY_LEX_BEFORE_WHERE_EQUALS }, + { "$=", POLICY_LEX_AFTER_TAIL_ASSIGN }, + { "$==", POLICY_LEX_AFTER_WHERE_ASSIGN }, + { "$.", POLICY_LEX_AFTER_TAIL_EQUALS }, + { "$.=", POLICY_LEX_AFTER_WHERE_EQUALS }, { ".=", POLICY_LEX_CONCAT_EQUALS }, { ":=", POLICY_LEX_SET_EQUALS }, { "-=", POLICY_LEX_MINUS_EQUALS }, @@ -219,6 +227,56 @@ } *token = POLICY_LEX_BAD; return input + 1; + + case '^': + if (input[1] == '.' ) { + if (input[2] == '=') { + *token = POLICY_LEX_BEFORE_WHERE_EQUALS; + return input + 3; + } + else { + *token = POLICY_LEX_BEFORE_HEAD_EQUALS; + return input + 2; + } + } + else if (input[1] == '=') { + if (input[2] == '=') { + *token = POLICY_LEX_BEFORE_WHERE_ASSIGN; + return input + 3; + } + else { + *token = POLICY_LEX_BEFORE_HEAD_ASSIGN; + return input + 2; + } + } + + *token = POLICY_LEX_BAD; + return input + 1; + + case '$': + if (input[1] == '.' ) { + if (input[2] == '=') { + *token = POLICY_LEX_AFTER_WHERE_EQUALS; + return input + 3; + } + else { + *token = POLICY_LEX_AFTER_TAIL_EQUALS; + return input + 2; + } + } + else if (input[1] == '=') { + if (input[2] == '=') { + *token = POLICY_LEX_AFTER_WHERE_ASSIGN; + return input + 3; + } + else { + *token = POLICY_LEX_AFTER_TAIL_ASSIGN; + return input + 2; + } + } + + *token = POLICY_LEX_BAD; + return input + 1; case ':': if (input[1] == '=') { @@ -935,9 +993,31 @@ policy_lex_t token; policy_attributes_t *this; char buffer[32]; + + this = rad_malloc(sizeof(*this)); + if (!this) { + fprintf(stderr, "%s[%d]: rad_malloc failed\n", + lexer->filename, lexer->lineno); + return 0; + } + memset(this, 0, sizeof(*this)); + this->item.type = POLICY_TYPE_ATTRIBUTE_LIST; token = policy_lex_file(lexer, 0, buffer, sizeof(buffer)); switch (token) { + case POLICY_LEX_BEFORE_WHERE_EQUALS: + case POLICY_LEX_AFTER_WHERE_EQUALS: + case POLICY_LEX_BEFORE_WHERE_ASSIGN: + case POLICY_LEX_AFTER_WHERE_ASSIGN: + if (!parse_condition(lexer, &(this->where_loc))) { + rlm_policy_free_item((policy_item_t *)this); + return 0; + } + break; + case POLICY_LEX_BEFORE_HEAD_EQUALS: + case POLICY_LEX_AFTER_TAIL_EQUALS: + case POLICY_LEX_BEFORE_HEAD_ASSIGN: + case POLICY_LEX_AFTER_TAIL_ASSIGN: case POLICY_LEX_ASSIGN: case POLICY_LEX_SET_EQUALS: case POLICY_LEX_CONCAT_EQUALS: @@ -947,13 +1027,10 @@ fprintf(stderr, "%s[%d]: Unexpected token %s\n", lexer->filename, lexer->lineno, lrad_int2str(rlm_policy_tokens, token, "?")); + rlm_policy_free_item((policy_item_t *)this); return 0; /* unknown */ } - - this = rad_malloc(sizeof(*this)); - memset(this, 0, sizeof(*this)); - this->item.type = POLICY_TYPE_ATTRIBUTE_LIST; this->item.lineno = lexer->lineno; this->where = where; this->how = token; diff -urNad freeradius-1.1.0~/src/modules/rlm_policy/rlm_policy.h freeradius-1.1.0/src/modules/rlm_policy/rlm_policy.h --- freeradius-1.1.0~/src/modules/rlm_policy/rlm_policy.h 2005-11-27 12:22:35.000000000 -0500 +++ freeradius-1.1.0/src/modules/rlm_policy/rlm_policy.h 2005-11-27 12:23:09.000000000 -0500 @@ -80,6 +80,14 @@ POLICY_LEX_CONCAT_EQUALS, /* .= */ POLICY_LEX_VARIABLE, /* %{foo} */ POLICY_LEX_FUNCTION, /* Hmmm... */ + POLICY_LEX_BEFORE_HEAD_ASSIGN, /* ^= */ + POLICY_LEX_BEFORE_WHERE_ASSIGN, /* ^== */ + POLICY_LEX_BEFORE_HEAD_EQUALS, /* ^. */ + POLICY_LEX_BEFORE_WHERE_EQUALS, /* ^.= */ + POLICY_LEX_AFTER_TAIL_ASSIGN, /* $= */ + POLICY_LEX_AFTER_WHERE_ASSIGN, /* $== */ + POLICY_LEX_AFTER_TAIL_EQUALS, /* $. */ + POLICY_LEX_AFTER_WHERE_EQUALS, /* $.= */ POLICY_LEX_DOUBLE_QUOTED_STRING, POLICY_LEX_SINGLE_QUOTED_STRING, POLICY_LEX_BACK_QUOTED_STRING, @@ -157,6 +165,7 @@ policy_reserved_word_t where; /* where to do it */ policy_lex_t how; /* how to do */ policy_item_t *attributes; /* things to do */ + policy_item_t *where_loc; /* search for location in list*/ /* FIXME: VALUE_PAIR *vps; */ } policy_attributes_t; #! /bin/sh /usr/share/dpatch/dpatch-run ## 245-policy-xlat.dpatch by <joe(a)nameserver3.ttec.com> ## ## All lines beginning with `## DP:' are a description of the patch. ## DP: No description. @DPATCH@ diff -urNad freeradius-1.1.0~/src/modules/rlm_policy/evaluate.c freeradius-1.1.0/src/modules/rlm_policy/evaluate.c --- freeradius-1.1.0~/src/modules/rlm_policy/evaluate.c 2005-11-27 11:39:20.000000000 -0500 +++ freeradius-1.1.0/src/modules/rlm_policy/evaluate.c 2005-11-27 11:40:02.000000000 -0500 @@ -943,12 +943,12 @@ case POLICY_LEX_AFTER_TAIL_ASSIGN: case POLICY_LEX_ASSIGN: /* 'union' */ - pairmove(vps, &head); + pairxlatmove(NULL, vps, &head); pairfree(&head); break; case POLICY_LEX_BEFORE_HEAD_ASSIGN: - pairmove(&head, &vps); + pairxlatmove(NULL, &head, &vps); pairfree(vps); *vps = head; break; @@ -1005,14 +1005,14 @@ break; case POLICY_LEX_BEFORE_WHERE_ASSIGN: if (vpprev) { - pairmove(&lvp, &head); + pairxlatmove(NULL, &lvp, &head); pairfree(&head); } else *vps = lvp = head; break; case POLICY_LEX_AFTER_WHERE_ASSIGN: - pairmove(&lvp, &head); + pairxlatmove(NULL, &lvp, &head); pairfree(&head); break; default:/*never reached*/

1 0

Automatic report from sources (radiusd) between 25.11.2005 - 26.11.2005 GMT
by Automatic cvs log generator 26 Nov '05

26 Nov '05

CVS log entries from 25.11.2005 (Fri) 09:00:00 - 26.11.2005 (Sat) 09:00:00 GMT ===================================================== Summary by authors ===================================================== Author: nbk File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_mysql/configure.in; Revisions: 1.12 ===================================================== Log entries ===================================================== Description: Don't trust "mysql_config" output and test the libmysqlclient anyway. Broken MySQL packages from Redhat provide the script "mysql_config" without the libmysqlclient headers. (closes: #297) Modified files: File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_mysql/configure.in; Revision: 1.12; Date: 2005/11/25 20:31:54; Author: nbk; Lines: (+161 -101) ===================================================== Summary of modified files ===================================================== File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_mysql/configure.in Revisions: 1.12 Authors: nbk (+161 -101) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 24.11.2005 - 25.11.2005 GMT
by Automatic cvs log generator 25 Nov '05

25 Nov '05

CVS log entries from 24.11.2005 (Thu) 09:00:00 - 25.11.2005 (Fri) 09:00:00 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/include/missing.h; Revisions: 1.26 ===================================================== Log entries ===================================================== Description: More definitions for systems that don't have them Modified files: File: radiusd/src/include/missing.h; Revision: 1.26; Date: 2005/11/24 22:55:42; Author: aland; Lines: (+10 -2) ===================================================== Summary of modified files ===================================================== File: radiusd/src/include/missing.h Revisions: 1.26 Authors: aland (+10 -2) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0