March 2006 - Freeradius-Devel - lists.freeradius.org

compile & install on FC4 x86_64
by FreeRadius Devel 15 May '06

15 May '06

hello, I am trying to install freeradius cvs version downloaded on 2006-01-14 on Fedora CORE 4 installed on a dual AMD Opteron system. fedora is updated as of 2006-01-14. I have have found two problems and I do not know if they are fedora, x86_64 or freeradius related. 1. after: # ./configure --with-large-files --with-udpfromto # make I get the error: gcc: /usr/lib/libsnmp.so: No such file or directory gmake[4]: *** [radiusd] Error 1 gmake[4]: Leaving directory `.../freeradius-060114/src/main' there is no file "/usr/lib/libsnmp.so" but there is a file "/usr/lib64/libsnmp.so" is the configure script suppose to find the 32bit version or the 64bit version ? after a link from /usr/lib64/libsnmp.so to /usr/lib/libsnmp.so freeradius compiles and installs 2. after running "# radiusd -X" I get the following error: Starting - reading configuration files ... read_config_files: reading dictionary Errors reading dictionary: dict_init: /usr/local/share/freeradius/dictionary.ascend[1228]: dict_addvalue: Duplicate value name Route-IPX-No for attribute X-Ascend-Route-IPX Segmentation fault identical configuration & installation works on FC4/i386 in file "src/lib/dict.c", function "DICT_VALUE *dict_valbyname(int attr, const char *name)" line "hash = lrad_hash_update(&attr, sizeof(&attr), hash);" I think that "sizeof(&attr)" should be "sizeof(attr)" because sizeof(int) != sizeof(&int) on 64bit. is there a compile option hat would instruct the compiler to consider "int" as being a 64bit integer ? thanks, Razvan Radu

4 3

multiple lap modules
by Angelica Delgado 01 Apr '06

01 Apr '06

Hello all, I am trying to setup cisco webvpn with ldap and I want to configure a ldap module for each vpn. The problem is that I get the same NAS ip from all the vpns. I enabled Calling-Station Id and NAS-Port attribute at the webvpn module but freeradius does not display it on its logs. If there is something I need to enable on the system in order to receive NAS-PORT and Calling-Station on the radius packet. Thanks in advance, Angelica

2 3

Re: v1.1.1 build problems (SSL, EAP)
by Alan DeKok 31 Mar '06

31 Mar '06

Nicolas Baradakis <nbk(a)sitadelle.com> wrote... (moved to -devel) > It's a bug: in version 1.1.1 "configure" in rlm_eap_peap uses a > different autoconf test than "configure" in top level directory. ... > It's a different bug: we should add the user defined directory > to LDFLAGS instead of LIBS. Are these fixed? I noticed there are no daily cvs log emails any more, so I'm not sure what's going on... Alan DeKok.

3 2

Automatic report from sources (radiusd) between 31.03.2006 - 31.03.2006 GMT
by Automatic cvs log generator 31 Mar '06

31 Mar '06

CVS log entries from 31.03.2006 (Fri) 03:39:57 - 31.03.2006 (Fri) 09:00:01 GMT ===================================================== Summary by authors ===================================================== Author: mgriego File: radiusd/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c; Revisions: 1.28 File: radiusd/raddb/eap.conf; Revisions: 1.7 File: radiusd/src/modules/rlm_eap/libeap/eap_tls.h; Revisions: 1.3 ===================================================== Combined list of identical log entries ===================================================== Description: Add option to specify TLS cipher list Modified files: File: radiusd/src/modules/rlm_eap/libeap/eap_tls.h; Revision: 1.3; Date: 2006/03/31 03:54:31; Author: mgriego; Lines: (+2 -1) File: radiusd/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c; Revision: 1.28; Date: 2006/03/31 03:53:36; Author: mgriego; Lines: (+13 -1) ===================================================== Log entries ===================================================== Description: Add cipher_list option for setting the allowed TLS cipher suites. Modified files: File: radiusd/raddb/eap.conf; Revision: 1.7; Date: 2006/03/31 03:59:06; Author: mgriego; Lines: (+6 -1) ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/eap.conf Revisions: 1.7 Authors: mgriego (+6 -1) ------------------------------- File: radiusd/src/modules/rlm_eap/libeap/eap_tls.h Revisions: 1.3 Authors: mgriego (+2 -1) ------------------------------- File: radiusd/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c Revisions: 1.28 Authors: mgriego (+13 -1) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Choice of TLS ciphersuite
by Thomas Otto 30 Mar '06

30 Mar '06

Hi all! I'd like to do some EAP method performance measurements with wpa_supplicant and freeradius. In the ClientHello, the supplicant sends a list of ciphersuites, with the most preferred on top, it begins with Cipher Suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x0039) Cipher Suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA (0x0038) Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035) Cipher Suite: TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA (0x0016) Cipher Suite: TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA (0x0013) Cipher Suite: TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000a) The freeradius Server, however, always selects 0x0035. Where can I modify on freeradius side the choice? Thanks Thomas

3 4

radeapclient broken compilation
by Alin Nastac 30 Mar '06

30 Mar '06

Hi, Anyone could suggest a fix for the bug http://bugs.freeradius.org/show_bug.cgi?id=350 ? Regards, Alin

3 8

patch to rlm_sql
by onespell＠yandex.ru 30 Mar '06

30 Mar '06

Here is patch to rlm_sql.c and rlm_sql/conf.h which adds support of postproxy_query: *** ./conf.h Thu Apr 29 00:55:16 2004 --- ./conf.h Thu Mar 30 10:42:29 2006 *************** *** 50,55 **** --- 50,56 ---- int query_on_not_found; char *sql_postauth_table; char *postauth_query; + char *postproxy_query; char *allowed_chars; /* individual driver config */ *** ./rlm_sql.c Tue Dec 13 16:11:53 2005 --- ./rlm_sql.c Thu Mar 30 10:49:58 2006 *************** *** 131,136 **** --- 131,138 ---- offsetof(SQL_CONFIG,sql_postauth_table), NULL, "radpostauth"}, {"postauth_query", PW_TYPE_STRING_PTR, offsetof(SQL_CONFIG,postauth_query), NULL, ""}, + {"postproxy_query", PW_TYPE_STRING_PTR, + offsetof(SQL_CONFIG,postproxy_query), NULL, ""}, {"safe-characters", PW_TYPE_STRING_PTR, offsetof(SQL_CONFIG,allowed_chars), NULL, "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /"}, *************** *** 1347,1352 **** --- 1349,1400 ---- return RLM_MODULE_OK; } + /* + * Execute postproxy_query after authentication + */ + static int rlm_sql_postproxy(void *instance, REQUEST *request) { + SQLSOCK *sqlsocket = NULL; + SQL_INST *inst = instance; + char querystr[MAX_QUERY_LEN]; + char sqlusername[MAX_STRING_LEN]; + + DEBUG("rlm_sql (%s): Processing sql_postproxy", inst->config->xlat_name); + + if(sql_set_user(inst, request, sqlusername, 0) <0) + return RLM_MODULE_FAIL; + + /* If postproxy_query is not defined, we stop here */ + if (inst->config->postproxy_query[0] == '\0') + return RLM_MODULE_NOOP; + + /* Expand variables in the query */ + memset(querystr, 0, MAX_QUERY_LEN); + radius_xlat(querystr, sizeof(querystr), inst->config->postproxy_query, + request, sql_escape_func); + query_log(request, inst, querystr); + DEBUG2("rlm_sql (%s) in sql_postproxy: query is %s", + inst->config->xlat_name, querystr); + + /* Initialize the sql socket */ + sqlsocket = sql_get_socket(inst); + if (sqlsocket == NULL) + return RLM_MODULE_FAIL; + + /* Process the query */ + if (rlm_sql_query(sqlsocket, inst, querystr)) { + radlog(L_ERR, "rlm_sql (%s) in sql_postproxy: Database query error - %s", + inst->config->xlat_name, + (char *)(inst->module->sql_error)(sqlsocket, inst->config)); + sql_release_socket(inst, sqlsocket); + return RLM_MODULE_FAIL; + } + (inst->module->sql_finish_query)(sqlsocket, inst->config); + + sql_release_socket(inst, sqlsocket); + return RLM_MODULE_OK; + } + + /* globally exported name */ module_t rlm_sql = { "SQL", *************** *** 1360,1368 **** rlm_sql_accounting, /* accounting */ rlm_sql_checksimul, /* checksimul */ NULL, /* pre-proxy */ ! NULL, /* post-proxy */ rlm_sql_postauth /* post-auth */ }, rlm_sql_detach, /* detach */ rlm_sql_destroy, /* destroy */ }; --- 1408,1419 ---- rlm_sql_accounting, /* accounting */ rlm_sql_checksimul, /* checksimul */ NULL, /* pre-proxy */ ! rlm_sql_postproxy, /* post-proxy */ rlm_sql_postauth /* post-auth */ }, rlm_sql_detach, /* detach */ rlm_sql_destroy, /* destroy */ }; + + +

1 0

Re: Version 1.1.1 stops responding
by Stefan Winter 29 Mar '06

29 Mar '06

Hi Alan, (moved to -devel) thanks for the gdb refresher - I keep forgetting those args :-) I'm not sure I'm overly helpful here, but I think I _might_ have something. I set up an instance of 1.1.1 on my workstation, ran gdb radiusd set args -X run and then sent a HUP from another console. In gdb, continue Program received signal SIGHUP, Hangup. [Switching to Thread 16384 (LWP 29536)] 0xb7e0f5d2 in select () from /lib/libc.so.6 (gdb) cont Continuing. --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. Reloading configuration files. reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms Program received signal SIGINT, Interrupt. and then I experienced that during the re-reading of config files, the process just froze, but no segfault (sending garbage with nc, which should make radiusd complain, but doesn't... no trace of anything being processed). After Ctrl-C and bt, I got: (gdb) bt #0 0xb7e0f5d2 in select () from /lib/libc.so.6 #1 0xbff68d50 in ?? () #2 0x0806d310 in ?? () #3 0x0806d068 in ?? () #4 0x0805743e in main (argc=2, argv=0xbff69e34) at radiusd.c:1276 (gdb) info threads * 1 Thread 16384 (LWP 29536) 0xb7e0f5d2 in select () from /lib/libc.so.6 So for some reason it got stuck during select() - I watched this being stuck for several seconds before I killed the process. So there appears to be a deadlock in there. Not sure if it has anything to do with the TLS hang; it's just that the symptoms seem similar. The select() waiting forever would explain that the process is still there, bound to its ports, but does nothing. Greetings, Stefan Winter -- Stefan WINTER RESTENA Foundation - Réseau Téléinformatique de l'Education Nationale et de la Recherche R&D Engineer 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg email: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

2 3

Certificate based authentication in rlm_ldap
by Rahul Srinivas 28 Mar '06

28 Mar '06

Hi, The rlm_ldap module accepts the configuration parameters "tls_certfile" and "tls_keyfile" in radiusd.conf. But in the code, after setting the LDAP options LDAP_OPT_X_TLS_CERTFILE and LDAP_OPT_X_TLS_KEYFILE, 'ldap_bind' is done with a password (LDAP_AUTH_SIMPLE). Shouldn't a 'ldap_sasl_bind' be done whenever the certificate and key are specified ? Regards, -Rahul S.

1 0

Having multiple authentication query in sql.conf
by vignesh 28 Mar '06

28 Mar '06

Hello all Can I have multiple authentication queries in sql.conf file. There are different ways by which we want to autheticate the users. I will let you know what I exactly want. I want to authenticate users based on the CLID and the remote ip address. The problem is that the remote address has to be searched from a set of ips. I will give you a example Suppose that we have a user 9204 and if the call for this particular user comes from a set of ips like 222.223.33.24 or 33.44.334.44( which will be present in some database tables) etc only then user will be authenticated. Vignesh

1 0