September 2005 - Freeradius-Devel - lists.freeradius.org

exit on select return -1 but errno == 0?
by Joe Maimon 14 Oct '05

14 Oct '05

running under gdb, server exits(1) after a bit Breakpoint 15, main (argc=2, argv=0xbfe26764) at radiusd.c:600 600 if (errno == EINTR) { (gdb) p errno $9 = 0 (gdb) p status $10 = -1 (gdb) Debian GNU/Linux dpkg -l libc6 Desired=Unknown/Install/Remove/Purge/Hold | Status=Not/Installed/Config-files/Unpacked/Failed-config/Half-installed |/ Err?=(none)/Hold/Reinst-required/X=both-problems (Status,Err: uppercase=bad) ||/ Name Version Description +++-=========================-=========================-================================================================== ii libc6 2.3.5-6 GNU C Library: Shared libraries and Timezone data

2 4

Adding strlcpy and strlcat replacements to libradius
by Nicolas Baradakis 06 Oct '05

06 Oct '05

I think we may perhaps add an autoconf test to detect whether the system provides the srtlcpy and strlcat functions from OpenBSD. If they're not present, we'd compile a replacement in libradius. These functions provide a consistent, unambiguous API described in this paper: http://www.usenix.org/events/usenix99/full_papers/millert/millert_html/inde… I know that our home-made strNcpy already ensures NUL-terminaison, but it has some weakness: - it seems it's wrong when N <= 0 - it's not easy to check if truncation has occurred I don't plan to change the code everywhere, but I'd like to have the functions available when writing new code. If I get approbation, I suggest to bring the following files in libradius. As to my understanding their licence allows us to do that: ftp://ftp.openbsd.org/pub/OpenBSD/src/lib/libc/string/strlcpy.c ftp://ftp.openbsd.org/pub/OpenBSD/src/lib/libc/string/strlcat.c -- Nicolas Baradakis

6 14

can't build for AIX
by Alexander Voropay 30 Sep '05

30 Sep '05

Hi! FreeRADIUS from the CVS. # uname -a AIX worck 3 5 00CC0FFE4D00 # gcc -v Reading specs from /opt/freeware/lib/gcc-lib/powerpc-ibm-aix5.1.0.0/3.3.2/specs Configured with: ../configure --with-as=/usr/bin/as --with-ld=/usr/bin/ld --disable-nls --enable-languages=c,c++ --prefix=/opt/freeware --enable-threads --disable-shared --enable-version-specific-runtime-libs --host=powerpc-ibm-aix5.1.0.0 Thread model: aix gcc version 3.3.2 #./configure stage is OK. Compilation finished with error: ... ... gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -D_LIBRADIUS -I../include -DHMAC_SHA1_DATA_PROBLEMS -c dict.c -DPIC -o .libs/dict.o In file included from ../include/libradius.h:38, from dict.c:42: /usr/include/sys/socket.h:513: error: redefinition of `struct sockaddr_storage' dict.c: In function `my_dict_init': dict.c:803: warning: implicit declaration of function `snprintf' Seens, configure script does not support AIX specifics. -- -=AV=-

2 1

Automatic report from sources (radiusd) between 29.09.2005 - 30.09.2005 GMT
by Automatic cvs log generator 30 Sep '05

30 Sep '05

CVS log entries from 29.09.2005 (Thu) 08:00:01 - 30.09.2005 (Fri) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: nbk File: radiusd/src/modules/rlm_ldap/rlm_ldap.c; Revisions: 1.160 File: radiusd/src/modules/rlm_linelog/rlm_linelog.c; Revisions: 1.4 File: radiusd/src/main/mainconfig.c; Revisions: 1.86 File: radiusd/src/main/smux.c; Revisions: 1.17 File: radiusd/src/modules/rlm_eap/types/rlm_eap_leap/eap_leap.c; Revisions: 1.10 File: radiusd/src/modules/rlm_unix/rlm_unix.c; Revisions: 1.72 File: radiusd/src/modules/rlm_eap/types/rlm_eap_md5/rlm_eap_md5.c; Revisions: 1.7 File: radiusd/src/modules/rlm_eap/types/rlm_eap_peap/peap.c; Revisions: 1.18 File: radiusd/src/modules/rlm_exec/rlm_exec.c; Revisions: 1.18 File: radiusd/src/main/radius_snmp.c; Revisions: 1.24 File: radiusd/src/modules/rlm_sqlcounter/rlm_sqlcounter.c; Revisions: 1.21 File: radiusd/src/modules/rlm_eap/types/rlm_eap_leap/rlm_eap_leap.c; Revisions: 1.10 ===================================================== Combined list of identical log entries ===================================================== Description: Add an attribute to the unused parameters. Patch from Primoz Bratanic <primoz(a)slo-tech.com> Modified files: File: radiusd/src/main/radius_snmp.c; Revision: 1.24; Date: 2005/09/29 17:57:35; Author: nbk; Lines: (+6 -7) File: radiusd/src/main/smux.c; Revision: 1.17; Date: 2005/09/29 17:57:35; Author: nbk; Lines: (+3 -3) File: radiusd/src/modules/rlm_eap/types/rlm_eap_leap/eap_leap.c; Revision: 1.10; Date: 2005/09/29 17:57:35; Author: nbk; Lines: (+2 -2) File: radiusd/src/modules/rlm_eap/types/rlm_eap_leap/rlm_eap_leap.c; Revision: 1.10; Date: 2005/09/29 17:57:35; Author: nbk; Lines: (+3 -3) File: radiusd/src/modules/rlm_eap/types/rlm_eap_md5/rlm_eap_md5.c; Revision: 1.7; Date: 2005/09/29 17:57:35; Author: nbk; Lines: (+2 -2) File: radiusd/src/modules/rlm_eap/types/rlm_eap_peap/peap.c; Revision: 1.18; Date: 2005/09/29 17:57:35; Author: nbk; Lines: (+2 -2) File: radiusd/src/modules/rlm_exec/rlm_exec.c; Revision: 1.18; Date: 2005/09/29 17:57:36; Author: nbk; Lines: (+3 -3) File: radiusd/src/modules/rlm_ldap/rlm_ldap.c; Revision: 1.160; Date: 2005/09/29 17:57:36; Author: nbk; Lines: (+5 -4) File: radiusd/src/modules/rlm_sqlcounter/rlm_sqlcounter.c; Revision: 1.21; Date: 2005/09/29 17:57:36; Author: nbk; Lines: (+5 -4) File: radiusd/src/modules/rlm_unix/rlm_unix.c; Revision: 1.72; Date: 2005/09/29 17:57:36; Author: nbk; Lines: (+5 -4) ===================================================== Log entries ===================================================== Description: Include "request_list.h", too. Modified files: File: radiusd/src/main/mainconfig.c; Revision: 1.86; Date: 2005/09/29 15:11:08; Author: nbk; Lines: (+2 -1) ------------------------------- Description: Fix function declaration. Patch from Primoz Bratanic <primoz(a)slo-tech.com> Modified files: File: radiusd/src/modules/rlm_linelog/rlm_linelog.c; Revision: 1.4; Date: 2005/09/29 16:50:12; Author: nbk; Lines: (+6 -3) ===================================================== Summary of modified files ===================================================== File: radiusd/src/main/mainconfig.c Revisions: 1.86 Authors: nbk (+2 -1) ------------------------------- File: radiusd/src/main/radius_snmp.c Revisions: 1.24 Authors: nbk (+6 -7) ------------------------------- File: radiusd/src/main/smux.c Revisions: 1.17 Authors: nbk (+3 -3) ------------------------------- File: radiusd/src/modules/rlm_eap/types/rlm_eap_leap/eap_leap.c Revisions: 1.10 Authors: nbk (+2 -2) ------------------------------- File: radiusd/src/modules/rlm_eap/types/rlm_eap_leap/rlm_eap_leap.c Revisions: 1.10 Authors: nbk (+3 -3) ------------------------------- File: radiusd/src/modules/rlm_eap/types/rlm_eap_md5/rlm_eap_md5.c Revisions: 1.7 Authors: nbk (+2 -2) ------------------------------- File: radiusd/src/modules/rlm_eap/types/rlm_eap_peap/peap.c Revisions: 1.18 Authors: nbk (+2 -2) ------------------------------- File: radiusd/src/modules/rlm_exec/rlm_exec.c Revisions: 1.18 Authors: nbk (+3 -3) ------------------------------- File: radiusd/src/modules/rlm_ldap/rlm_ldap.c Revisions: 1.160 Authors: nbk (+5 -4) ------------------------------- File: radiusd/src/modules/rlm_linelog/rlm_linelog.c Revisions: 1.4 Authors: nbk (+6 -3) ------------------------------- File: radiusd/src/modules/rlm_sqlcounter/rlm_sqlcounter.c Revisions: 1.21 Authors: nbk (+5 -4) ------------------------------- File: radiusd/src/modules/rlm_unix/rlm_unix.c Revisions: 1.72 Authors: nbk (+5 -4) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

assert listen.c:573 in -s or -X mode
by Joe Maimon 29 Sep '05

29 Sep '05

happens frequently if I am stepping through requests, infrequently if it is running w/o breakpoints SO i changed the code to this static int auth_socket_send(rad_listen_t *listener, REQUEST *request) { if(request->proxy_listener == listener) rad_assert(request->proxy_listener == listener); else { rad_assert(request->listener == listener); rad_assert(listener->send == auth_socket_send); } cause it appears that proxy send trips this. Thanks, Joe

2 3

Automatic report from sources (radiusd) between 28.09.2005 - 29.09.2005 GMT
by Automatic cvs log generator 29 Sep '05

29 Sep '05

CVS log entries from 28.09.2005 (Wed) 08:00:00 - 29.09.2005 (Thu) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/main/conffile.c; Revisions: 1.131 File: radiusd/src/main/listen.c; Revisions: 1.37, 1.36 Author: fcusack File: radiusd/src/modules/rlm_otp/cardops/cryptocard.h; Revisions: 1.17, 1.16, 1.15, 1.14 File: radiusd/src/modules/rlm_otp/otp_state.c; Revisions: 1.16 File: radiusd/src/modules/rlm_otp/otp_cardops.h; Revisions: 1.18, 1.17, 1.16, 1.15 File: radiusd/src/modules/rlm_otp/cardops/cryptocard.c; Revisions: 1.17, 1.16, 1.15, 1.14 File: radiusd/src/modules/rlm_otp/otp_cardops.c; Revisions: 1.34, 1.33, 1.32 File: radiusd/src/modules/rlm_otp/otp_util.c; Revisions: 1.9 File: radiusd/src/modules/rlm_otp/otp.h; Revisions: 1.14, 1.13 ===================================================== Combined list of identical log entries ===================================================== Description: Add 'challenge' arg to cardops updatecsd() method. The challenge contains the time data which is probably needed for csd update. Modified files: File: radiusd/src/modules/rlm_otp/otp_cardops.c; Revision: 1.33; Date: 2005/09/29 05:34:58; Author: fcusack; Lines: (+3 -3) File: radiusd/src/modules/rlm_otp/otp_cardops.h; Revision: 1.17; Date: 2005/09/29 05:34:58; Author: fcusack; Lines: (+3 -2) File: radiusd/src/modules/rlm_otp/cardops/cryptocard.c; Revision: 1.16; Date: 2005/09/29 05:34:58; Author: fcusack; Lines: (+6 -2) File: radiusd/src/modules/rlm_otp/cardops/cryptocard.h; Revision: 1.16; Date: 2005/09/29 05:34:58; Author: fcusack; Lines: (+3 -1) ------------------------------- Description: pass 'when' arg to cardops nullstate() method, for the same reason we updated challenge() to accept a 'when' arg -- consistent time calculation relative to a t=0 position. Modified files: File: radiusd/src/modules/rlm_otp/otp_cardops.c; Revision: 1.34; Date: 2005/09/29 05:42:46; Author: fcusack; Lines: (+3 -3) File: radiusd/src/modules/rlm_otp/otp_cardops.h; Revision: 1.18; Date: 2005/09/29 05:42:46; Author: fcusack; Lines: (+2 -2) File: radiusd/src/modules/rlm_otp/cardops/cryptocard.c; Revision: 1.17; Date: 2005/09/29 05:42:46; Author: fcusack; Lines: (+5 -1) File: radiusd/src/modules/rlm_otp/cardops/cryptocard.h; Revision: 1.17; Date: 2005/09/29 05:42:47; Author: fcusack; Lines: (+2 -2) ------------------------------- Description: style: document buffer sizes for char[] args Modified files: File: radiusd/src/modules/rlm_otp/otp_cardops.h; Revision: 1.16; Date: 2005/09/29 05:23:56; Author: fcusack; Lines: (+9 -5) File: radiusd/src/modules/rlm_otp/cardops/cryptocard.c; Revision: 1.15; Date: 2005/09/29 05:23:56; Author: fcusack; Lines: (+3 -2) File: radiusd/src/modules/rlm_otp/cardops/cryptocard.h; Revision: 1.15; Date: 2005/09/29 05:23:56; Author: fcusack; Lines: (+3 -2) ------------------------------- Description: - Add nexttwin() cardops method, for help with evaluating consecutive passwords. Each cardops module has to implement its own method of "walking" the time (twin) counter, for now anyway. - Add twin2authtime() cardops method, for help ensuring that a passcode in the past (negative twin) is not earlier than the most recently seen passcode. Remove comment insisting that the challenge() or response() method needed to implement this; that would have been awkward. - Add minauthtime state field, to support twin2authtime() change. - Change authtime state field to %x from %d. - Leave state at version 3. - Add 'when' arg to challenge() cardops method, to ensure that sucessive challenges (as twin changes) are relative to the same t=0 time. Modified files: File: radiusd/src/modules/rlm_otp/otp.h; Revision: 1.13; Date: 2005/09/29 04:55:10; Author: fcusack; Lines: (+2 -1) File: radiusd/src/modules/rlm_otp/otp_cardops.c; Revision: 1.32; Date: 2005/09/29 04:55:10; Author: fcusack; Lines: (+31 -22) File: radiusd/src/modules/rlm_otp/otp_cardops.h; Revision: 1.15; Date: 2005/09/29 04:55:10; Author: fcusack; Lines: (+5 -3) File: radiusd/src/modules/rlm_otp/otp_state.c; Revision: 1.16; Date: 2005/09/29 04:55:10; Author: fcusack; Lines: (+22 -5) File: radiusd/src/modules/rlm_otp/cardops/cryptocard.c; Revision: 1.14; Date: 2005/09/29 04:55:10; Author: fcusack; Lines: (+43 -2) File: radiusd/src/modules/rlm_otp/cardops/cryptocard.h; Revision: 1.14; Date: 2005/09/29 04:55:10; Author: fcusack; Lines: (+7 -3) ------------------------------- Description: otp_keystring2keyblock(): add range checking Modified files: File: radiusd/src/modules/rlm_otp/otp.h; Revision: 1.14; Date: 2005/09/29 05:17:57; Author: fcusack; Lines: (+1 -1) File: radiusd/src/modules/rlm_otp/otp_util.c; Revision: 1.9; Date: 2005/09/29 05:17:57; Author: fcusack; Lines: (+7 -3) ===================================================== Log entries ===================================================== Description: When including conf files, reference 'cs' rather than 'parent'. 'cs' already references parent, so we still get the same benefit. But if we reference 'parent' rather than 'cs', we don't get to see the definitions in 'cs', which we want. Bug & patch from Tariq Rashid Modified files: File: radiusd/src/main/conffile.c; Revision: 1.131; Date: 2005/09/28 22:28:58; Author: aland; Lines: (+4 -4) ------------------------------- Description: Set src ip/port for auth & acct, too. Based on last patch Modified files: File: radiusd/src/main/listen.c; Revision: 1.37; Date: 2005/09/28 22:29:30; Author: aland; Lines: (+10 -3) ------------------------------- Description: Set proxy packet src IP & port. Bug found by Joe Maimon Modified files: File: radiusd/src/main/listen.c; Revision: 1.36; Date: 2005/09/28 16:44:36; Author: aland; Lines: (+9 -4) ===================================================== Summary of modified files ===================================================== File: radiusd/src/main/conffile.c Revisions: 1.131 Authors: aland (+4 -4) ------------------------------- File: radiusd/src/main/listen.c Revisions: 1.37, 1.36 Authors: aland (+10 -3), aland (+9 -4) ------------------------------- File: radiusd/src/modules/rlm_otp/cardops/cryptocard.c Revisions: 1.17, 1.16, 1.15, 1.14 Authors: fcusack (+5 -1), fcusack (+6 -2), fcusack (+3 -2), fcusack (+43 -2) ------------------------------- File: radiusd/src/modules/rlm_otp/cardops/cryptocard.h Revisions: 1.17, 1.16, 1.15, 1.14 Authors: fcusack (+2 -2), fcusack (+3 -1), fcusack (+3 -2), fcusack (+7 -3) ------------------------------- File: radiusd/src/modules/rlm_otp/otp.h Revisions: 1.14, 1.13 Authors: fcusack (+1 -1), fcusack (+2 -1) ------------------------------- File: radiusd/src/modules/rlm_otp/otp_cardops.c Revisions: 1.34, 1.33, 1.32 Authors: fcusack (+3 -3), fcusack (+3 -3), fcusack (+31 -22) ------------------------------- File: radiusd/src/modules/rlm_otp/otp_cardops.h Revisions: 1.18, 1.17, 1.16, 1.15 Authors: fcusack (+2 -2), fcusack (+3 -2), fcusack (+9 -5), fcusack (+5 -3) ------------------------------- File: radiusd/src/modules/rlm_otp/otp_state.c Revisions: 1.16 Authors: fcusack (+22 -5) ------------------------------- File: radiusd/src/modules/rlm_otp/otp_util.c Revisions: 1.9 Authors: fcusack (+7 -3) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

debugging rlm_
by Joe Maimon 29 Sep '05

29 Sep '05

Any tips on how to get gdb to load the symbols for the rlm_ and breakpoint its functions? Thanks, Joe

2 1

proxied request accepted but none of the preproccessed attributes are sent to NAS
by Joe Maimon 29 Sep '05

29 Sep '05

Only the proxy server A/V are sent to the nas. None of the preprocess, in specific, the files match which includes things like vrf, ip pool and similar important stuff. Here is the -X output. Where should I start looking? Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 hints: Matched DEFAULT at 117 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: Looking up realm "jnet" for User-Name = "clinicallab@jnet" rlm_realm: Found realm "xyzabc" rlm_realm: Proxying request from user clinicallab to realm xyzabc rlm_realm: Adding Realm = "xyzabc" rlm_realm: Preparing to proxy authentication request to realm "xyzabc" modcall[authorize]: module "suffix" returns updated for request 4 radius_xlat: 'clinicallab@xyzabc' rlm_sql (sql): sql_set_user escaped user --> 'clinicallab@xyzabc' rlm_sql (sql): Reserving sql socket id: 25 radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'clinicallab@xyzabc' ORDER BY id' radius_xlat: 'SELECT GroupName FROM usergroup WHERE UserName='clinicallab@xyzabc'' rlm_sql (sql): Released sql socket id: 25 rlm_sql (sql): User clinicallab@xyzabc not found modcall[authorize]: module "sql" returns notfound for request 4 users: Matched entry DEFAULT at line 552 modcall[authorize]: module "files" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "expiration" returns noop for request 4 modcall[authorize]: module "logintime" returns noop for request 4 modcall[authorize]: module "pap" returns noop for request 4 modcall: leaving group authorize (returns updated) for request 4 --- Walking the entire request list --- Waking up in 1 seconds... authorize: Skipping authorize in post-proxy stage rad_check_password: Found Auth-Type rad_check_password: Auth-Type = Accept, accepting the user Login OK: [clinicallab@xyzabc/1113128] (from client localhost port 1) Finished request 4 Going to the next request Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 4 seconds... --- Walking the entire request list ---

2 4

proxy accounting in cvs
by Joe Maimon 28 Sep '05

28 Sep '05

appears to not set the src_ipaddr, even though server is bound to single ip on multiple IP'd host machine. Therefore all accounting servers marked dead. Proxy auth appears to work. Joe

2 4

tiny patch to fix expansion of variables in $INCLUDED files
by Tariq Rashid 28 Sep '05

28 Sep '05

this follows on from the discussion on the -users mailing list: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg20024.… and solution announced: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg20320.… problem: variables declated in the radiusd.conf or included files were not being expanded in subsequent included files. for example declaring a = b in radiusd.conf would not expand ${a} in an included proxy.conf solution: the inclusion of a file creates (alloc) a new conf section - called "main" - different to the real top-level "main". when trying to expand the variable, the current scope (eg "realm") is searched, and if it fails the parent "main" is searched. except its the temporary one, not the main one. this is proved by various tests - including debugging output showing the searches in progress iterating over planted items in the temporary "main" conf section. this solution properly links the new temporary conf to the real "main" section. testing: it works fine here - and has been for a a few days. see below for the tiny patch ... applied to 1.0.2 but the problem and solution are also applicable to 1.0.5 tariq rashid --- freeradius-1.0.2/src/main/conffile.c 2004-04-06 19:00:57.000000000 +0100 +++ freeradius-1.0.2-patched/src/main/conffile.c 2005-09-26 15:18:47.000000000 +0100 @@ -669,7 +669,7 @@ DEBUG2( "Config: including file: %s", value ); - if ((is = conf_read(cf, *lineno, value, parent)) == NULL) { + if ((is = conf_read(cf, *lineno, value, cs)) == NULL) { cf_section_free(&cs); return NULL; }

2 1