April 2006 - Freeradius-Devel - lists.freeradius.org

compile & install on FC4 x86_64
by FreeRadius Devel 15 May '06

15 May '06

hello, I am trying to install freeradius cvs version downloaded on 2006-01-14 on Fedora CORE 4 installed on a dual AMD Opteron system. fedora is updated as of 2006-01-14. I have have found two problems and I do not know if they are fedora, x86_64 or freeradius related. 1. after: # ./configure --with-large-files --with-udpfromto # make I get the error: gcc: /usr/lib/libsnmp.so: No such file or directory gmake[4]: *** [radiusd] Error 1 gmake[4]: Leaving directory `.../freeradius-060114/src/main' there is no file "/usr/lib/libsnmp.so" but there is a file "/usr/lib64/libsnmp.so" is the configure script suppose to find the 32bit version or the 64bit version ? after a link from /usr/lib64/libsnmp.so to /usr/lib/libsnmp.so freeradius compiles and installs 2. after running "# radiusd -X" I get the following error: Starting - reading configuration files ... read_config_files: reading dictionary Errors reading dictionary: dict_init: /usr/local/share/freeradius/dictionary.ascend[1228]: dict_addvalue: Duplicate value name Route-IPX-No for attribute X-Ascend-Route-IPX Segmentation fault identical configuration & installation works on FC4/i386 in file "src/lib/dict.c", function "DICT_VALUE *dict_valbyname(int attr, const char *name)" line "hash = lrad_hash_update(&attr, sizeof(&attr), hash);" I think that "sizeof(&attr)" should be "sizeof(attr)" because sizeof(int) != sizeof(&int) on 64bit. is there a compile option hat would instruct the compiler to consider "int" as being a 64bit integer ? thanks, Razvan Radu

4 3

Null pointer deref
by Daniel O'Connor 02 May '06

02 May '06

Hi, I am trying to get FreeRadius running on FreeBSD to handle WPA from an OpenWRT box, but I found that FreeRadius would crash when a request was processed. The strcmp's around lines 1630 and 1659 can be done on a NULL pointer (eg mainconfig.do_lower_user) which causes a crash. It is trivial to add a 'mainconfig.do_lower_user != NULL && ' (or similar) in front of these strcmps. -- Daniel O'Connor software and network engineer for Genesis Software - http://www.gsoft.com.au "The nice thing about standards is that there are so many of them to choose from." -- Andrew Tanenbaum GPG Fingerprint - 5596 B766 97C0 0E94 4347 295E E593 DC20 7B3F CE8C

2 6

Automatic report from sources (radiusd) between 28.04.2006 - 29.04.2006 GMT
by Automatic cvs log generator 29 Apr '06

29 Apr '06

CVS log entries from 28.04.2006 (Fri) 08:00:01 - 29.04.2006 (Sat) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c; Revisions: 1.33, 1.21.4.8, 1.21.4.7 File: radiusd/raddb/eap.conf; Revisions: 1.8, 1.4.4.3 File: radiusd/src/modules/rlm_linelog/rlm_linelog.c; Revisions: 1.9, 1.8, 1.7 File: radiusd/src/modules/rlm_eap/libeap/eap_tls.h; Revisions: 1.1.2.2 File: radiusd/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.h; Revisions: 1.11, 1.5.4.3 File: radiusd/src/modules/rlm_digest/rlm_digest.c; Revisions: 1.5.4.5 ===================================================== Combined list of identical log entries ===================================================== Description: Add check_cert_issuer config option to rlm_eap_tls This closes bug #346 Modified files: File: radiusd/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c; Revision: 1.33; Date: 2006/04/28 18:21:49; Author: aland; Lines: (+52 -34) File: radiusd/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.h; Revision: 1.11; Date: 2006/04/28 18:21:49; Author: aland; Lines: (+2 -1) ------------------------------- Description: Add check_cert_issuer config option to rlm_eap_tls This closes bug #346 Modified files: File: radiusd/raddb/eap.conf; Revision: 1.8; Date: 2006/04/28 18:25:20; Author: aland; Lines: (+14 -1) File: radiusd/raddb/eap.conf; Revision: 1.4.4.3; Date: 2006/04/28 18:25:03; Author: aland; Lines: (+14 -1) ------------------------------- Description: Add check_cert_issuer config option to rlm_eap_tls. This closes bug #346 Modified files: File: radiusd/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c; Revision: 1.21.4.7; Date: 2006/04/28 18:18:59; Author: aland; Lines: (+52 -34) File: radiusd/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.h; Revision: 1.5.4.3; Date: 2006/04/28 18:18:58; Author: aland; Lines: (+2 -1) ===================================================== Log entries ===================================================== Description: Corrected typo. This fixes bug #363 Modified files: File: radiusd/src/modules/rlm_digest/rlm_digest.c; Revision: 1.5.4.5; Date: 2006/04/28 23:44:31; Author: aland; Lines: (+3 -3) ------------------------------- Description: Remove rlm_eap_tls conf from eap_tls.h Modified files: File: radiusd/src/modules/rlm_eap/libeap/eap_tls.h; Revision: 1.1.2.2; Date: 2006/04/28 18:16:55; Author: aland; Lines: (+1 -35) ------------------------------- Description: Add cipher_list to list of config options Modified files: File: radiusd/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c; Revision: 1.21.4.8; Date: 2006/04/28 18:20:42; Author: aland; Lines: (+3 -1) ------------------------------- Description: Whoops... more dumb things to fix Modified files: File: radiusd/src/modules/rlm_linelog/rlm_linelog.c; Revision: 1.9; Date: 2006/04/28 17:51:01; Author: aland; Lines: (+9 -12) ------------------------------- Description: Whoops, the name is "linelog", not "example" Modified files: File: radiusd/src/modules/rlm_linelog/rlm_linelog.c; Revision: 1.8; Date: 2006/04/28 17:48:50; Author: aland; Lines: (+3 -3) ------------------------------- Description: Added escape function, so embedded \n's and other non-printable characters don't get printed. This closes bug #257 Modified files: File: radiusd/src/modules/rlm_linelog/rlm_linelog.c; Revision: 1.7; Date: 2006/04/28 17:47:42; Author: aland; Lines: (+66 -3) ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/eap.conf Revisions: 1.8, 1.4.4.3 Authors: aland (+14 -1), aland (+14 -1) ------------------------------- File: radiusd/src/modules/rlm_digest/rlm_digest.c Revisions: 1.5.4.5 Authors: aland (+3 -3) ------------------------------- File: radiusd/src/modules/rlm_eap/libeap/eap_tls.h Revisions: 1.1.2.2 Authors: aland (+1 -35) ------------------------------- File: radiusd/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c Revisions: 1.33, 1.21.4.8, 1.21.4.7 Authors: aland (+52 -34), aland (+3 -1), aland (+52 -34) ------------------------------- File: radiusd/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.h Revisions: 1.11, 1.5.4.3 Authors: aland (+2 -1), aland (+2 -1) ------------------------------- File: radiusd/src/modules/rlm_linelog/rlm_linelog.c Revisions: 1.9, 1.8, 1.7 Authors: aland (+9 -12), aland (+3 -3), aland (+66 -3) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 27.04.2006 - 28.04.2006 GMT
by Automatic cvs log generator 28 Apr '06

28 Apr '06

CVS log entries from 27.04.2006 (Thu) 08:00:01 - 28.04.2006 (Fri) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c; Revisions: 1.32, 1.31, 1.30, 1.21.4.6, 1.21.4.5, 1.21.4.4, 1.21.4.3 File: radiusd/raddb/eap.conf; Revisions: 1.4.4.2 File: radiusd/libltdl/ltdl.c; Revisions: 1.7, 1.5.4.1 File: radiusd/src/modules/rlm_eap/libeap/eap_tls.h; Revisions: 1.5, 1.4, 1.1.2.1 File: radiusd/src/modules/rlm_perl/rlm_perl.c; Revisions: 1.13.4.7 File: radiusd/redhat/freeradius.spec; Revisions: 1.19.2.5.2.4 File: radiusd/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.h; Revisions: 1.10, 1.5.4.2 File: radiusd/doc/ChangeLog; Revisions: 1.57.2.31.2.16 File: radiusd/src/modules/rlm_eap/libeap/tls.c; Revisions: 1.4, 1.3, 1.1.2.3, 1.1.2.2 File: radiusd/doc/rlm_ldap; Revisions: 1.39, 1.34.2.1.2.2 File: radiusd/src/modules/rlm_eap/libeap/cb.c; Revisions: 1.3, 1.1.2.2 ===================================================== Combined list of identical log entries ===================================================== Description: Print SSL errors to radius.log, rather than stderr. This closes bug #347 Modified files: File: radiusd/src/modules/rlm_eap/libeap/tls.c; Revision: 1.3; Date: 2006/04/27 18:18:08; Author: aland; Lines: (+3 -3) File: radiusd/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c; Revision: 1.30; Date: 2006/04/27 18:18:08; Author: aland; Lines: (+7 -9) ------------------------------- Description: Pull load cipher list from CVS head. move rlm_eap_tls conf from libeap to rlm_eap_tls, where it belongs Modified files: File: radiusd/raddb/eap.conf; Revision: 1.4.4.2; Date: 2006/04/27 22:49:19; Author: aland; Lines: (+6 -1) File: radiusd/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c; Revision: 1.21.4.6; Date: 2006/04/27 22:47:34; Author: aland; Lines: (+13 -2) File: radiusd/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.h; Revision: 1.5.4.2; Date: 2006/04/27 22:47:35; Author: aland; Lines: (+38 -1) ------------------------------- Description: Get rid of annoying "return invalid handle if we failed to load the module" crap. Who writes this stuff? Modified files: File: radiusd/libltdl/ltdl.c; Revision: 1.7; Date: 2006/04/27 18:39:32; Author: aland; Lines: (+2 -0) File: radiusd/libltdl/ltdl.c; Revision: 1.5.4.1; Date: 2006/04/27 18:37:54; Author: aland; Lines: (+2 -0) ------------------------------- Description: Move cbtls_verify to rlm_eap_tls, where it won't pollute radeapclient, which doesn't use or need it. Modified files: File: radiusd/src/modules/rlm_eap/libeap/cb.c; Revision: 1.3; Date: 2006/04/27 18:52:44; Author: aland; Lines: (+1 -132) File: radiusd/src/modules/rlm_eap/libeap/cb.c; Revision: 1.1.2.2; Date: 2006/04/27 18:41:52; Author: aland; Lines: (+1 -132) File: radiusd/src/modules/rlm_eap/libeap/eap_tls.h; Revision: 1.4; Date: 2006/04/27 18:52:43; Author: aland; Lines: (+1 -2) File: radiusd/src/modules/rlm_eap/libeap/eap_tls.h; Revision: 1.1.2.1; Date: 2006/04/27 18:41:52; Author: aland; Lines: (+1 -2) File: radiusd/src/modules/rlm_eap/libeap/tls.c; Revision: 1.4; Date: 2006/04/27 18:52:44; Author: aland; Lines: (+3 -13) File: radiusd/src/modules/rlm_eap/libeap/tls.c; Revision: 1.1.2.3; Date: 2006/04/27 18:53:23; Author: aland; Lines: (+3 -13) File: radiusd/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c; Revision: 1.31; Date: 2006/04/27 18:52:44; Author: aland; Lines: (+145 -2) File: radiusd/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c; Revision: 1.21.4.5; Date: 2006/04/27 18:53:23; Author: aland; Lines: (+14 -2) File: radiusd/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c; Revision: 1.21.4.4; Date: 2006/04/27 18:41:52; Author: aland; Lines: (+132 -1) ------------------------------- Description: Print SSL errors to radius.log, rather than stderr. This fixes bug #347 Modified files: File: radiusd/src/modules/rlm_eap/libeap/tls.c; Revision: 1.1.2.2; Date: 2006/04/27 18:19:32; Author: aland; Lines: (+3 -3) File: radiusd/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c; Revision: 1.21.4.3; Date: 2006/04/27 18:19:32; Author: aland; Lines: (+7 -7) ------------------------------- Description: Move rlm_eap_tls configuration to it's private header file, and out of the global header file Modified files: File: radiusd/src/modules/rlm_eap/libeap/eap_tls.h; Revision: 1.5; Date: 2006/04/27 22:42:24; Author: aland; Lines: (+1 -36) File: radiusd/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c; Revision: 1.32; Date: 2006/04/27 22:42:25; Author: aland; Lines: (+3 -2) File: radiusd/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.h; Revision: 1.10; Date: 2006/04/27 22:42:25; Author: aland; Lines: (+38 -1) ===================================================== Log entries ===================================================== Description: List new stuff Modified files: File: radiusd/doc/ChangeLog; Revision: 1.57.2.31.2.16; Date: 2006/04/27 22:53:56; Author: aland; Lines: (+19 -2) ------------------------------- Description: Correct the documentation. Modified files: File: radiusd/doc/rlm_ldap; Revision: 1.39; Date: 2006/04/27 21:10:58; Author: aland; Lines: (+4 -2) ------------------------------- Description: Correct the documentation Modified files: File: radiusd/doc/rlm_ldap; Revision: 1.34.2.1.2.2; Date: 2006/04/27 21:10:16; Author: aland; Lines: (+4 -2) ------------------------------- Description: Don't use system libtool or force gnu LD. Bug #330 says this is bad Modified files: File: radiusd/redhat/freeradius.spec; Revision: 1.19.2.5.2.4; Date: 2006/04/27 20:33:53; Author: aland; Lines: (+0 -2) ------------------------------- Description: Pull diff from -r1.34 to -r1.35 from cvs head Modified files: File: radiusd/src/modules/rlm_perl/rlm_perl.c; Revision: 1.13.4.7; Date: 2006/04/27 17:35:44; Author: aland; Lines: (+24 -22) ===================================================== Summary of modified files ===================================================== File: radiusd/doc/ChangeLog Revisions: 1.57.2.31.2.16 Authors: aland (+19 -2) ------------------------------- File: radiusd/doc/rlm_ldap Revisions: 1.39, 1.34.2.1.2.2 Authors: aland (+4 -2), aland (+4 -2) ------------------------------- File: radiusd/libltdl/ltdl.c Revisions: 1.7, 1.5.4.1 Authors: aland (+2 -0), aland (+2 -0) ------------------------------- File: radiusd/raddb/eap.conf Revisions: 1.4.4.2 Authors: aland (+6 -1) ------------------------------- File: radiusd/redhat/freeradius.spec Revisions: 1.19.2.5.2.4 Authors: aland (+0 -2) ------------------------------- File: radiusd/src/modules/rlm_eap/libeap/cb.c Revisions: 1.3, 1.1.2.2 Authors: aland (+1 -132), aland (+1 -132) ------------------------------- File: radiusd/src/modules/rlm_eap/libeap/eap_tls.h Revisions: 1.5, 1.4, 1.1.2.1 Authors: aland (+1 -36), aland (+1 -2), aland (+1 -2) ------------------------------- File: radiusd/src/modules/rlm_eap/libeap/tls.c Revisions: 1.4, 1.3, 1.1.2.3, 1.1.2.2 Authors: aland (+3 -13), aland (+3 -3), aland (+3 -13), aland (+3 -3) ------------------------------- File: radiusd/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c Revisions: 1.32, 1.31, 1.30, 1.21.4.6, 1.21.4.5, 1.21.4.4, 1.21.4.3 Authors: aland (+3 -2), aland (+145 -2), aland (+7 -9), aland (+13 -2), aland (+14 -2), aland (+132 -1), aland (+7 -7) ------------------------------- File: radiusd/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.h Revisions: 1.10, 1.5.4.2 Authors: aland (+38 -1), aland (+38 -1) ------------------------------- File: radiusd/src/modules/rlm_perl/rlm_perl.c Revisions: 1.13.4.7 Authors: aland (+24 -22) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Google Summer of Code and RadSec?
by Stefan Winter 27 Apr '06

27 Apr '06

Hello, some of you may be aware that Google is soon launching another instance of it's "Summer of Code" program. As I understand it, there is some interest in the RadSec extensions to RADIUS here, especially Alan spoke in favor of it a few times. And actually there is going to be a real-world deployment of RadSec with Radiator soon (within a research group that operates the "eduroam" project, www.eduroam.org) Having a second implementation of RadSec would be really great, and I think the Summer of Code might be a good opportunity to introduce RadSec into FreeRADIUS. Since I'm not a real expert in the FR Code can't do much more than suggest that someone of the real developers here likes the idea of being a mentor for RadSec within FreeRADIUS and applies at Google for the project. As far as I've understood the SoC rules, you can only win: 500$ for FreeRADIUS and 4500$ for the guy who implements it. You'd have a very motivated developer (he gets the money only after getting the job done) and a clear timeframe for getting the resulting code. Any optinions on the topic? Greetings, Stefan Winter -- Stefan WINTER RESTENA Foundation - Réseau Téléinformatique de l'Education Nationale et de la Recherche R&D Engineer 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg email: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

3 8

Automatic report from sources (radiusd) between 26.04.2006 - 27.04.2006 GMT
by Automatic cvs log generator 27 Apr '06

27 Apr '06

CVS log entries from 26.04.2006 (Wed) 08:00:01 - 27.04.2006 (Thu) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: bjordanov File: radiusd/src/modules/rlm_perl/rlm_perl.c; Revisions: 1.35 ===================================================== Log entries ===================================================== Description: Fix rlm_perl handle leak in perl_xlat and memory leak from stack when ERRSV is true. Patch from Bj?rn Mork <bjorn(a)mork.no> Modified files: File: radiusd/src/modules/rlm_perl/rlm_perl.c; Revision: 1.35; Date: 2006/04/26 13:32:25; Author: bjordanov; Lines: (+24 -22) ===================================================== Summary of modified files ===================================================== File: radiusd/src/modules/rlm_perl/rlm_perl.c Revisions: 1.35 Authors: bjordanov (+24 -22) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

xlat in rlm_attr_filer
by Bjørn Mork 25 Apr '06

25 Apr '06

Hello, I've just received a wish for setting a reply attribute on proxied request based on one of the request attributes. We are already using rlm_attr_filer to do attribute filtering on these requests, so adding something like this to the "attrs" file seemed natural: realm.example.com Attribute := `%{Request-Attribute}` But I found that rlm_attr_filter doesn't do xlat. So I was wondering why? Is a patch welcome, or are there good reasons not to do this? (I was able to workaround this using the rlm_files module to modify this attribute instead, but I'm willing to work om rlm_attr_filter if I know that it has a chance of being accepted) Bjørn

2 2

Suggested feature for rlm_detail: logging only a few specific users
by Bjørn Mork 24 Apr '06

24 Apr '06

During debugging of production systems, I've often wished there was some way to enable debugging only for specific users. The attached patch (against 1.1.x CVS for now) extends rlm_detail with an optional rlm_files compatible "usersfile" option. It does not change the behaviour for existing configurations. Usage example: modules { .. detail debugusers { detailfile = "${logdir}/debuglog" usersfile = "${raddbdir}/users.debug" } .. } .. post-auth { Post-Auth-Type REJECT { debugusers } } Where users.debug contains a list of users to debug. The syntax is similar to users(5). It can even contain check-items and DEFAULT entries (which only makes sense if combined with check items), to filter the logging even more. I'm posting this here to get some feedback whether this is a good idea or if I'm reimplementing something that already exists, or if this should go into a separate module. Comments? Bjørn

3 5

Redundant ldap server with freeradius 1.0.5
by sumi thra 24 Apr '06

24 Apr '06

- Hey All, I want to configure two ldap server's for fail over conditions. My configuration in the radiusd.conf is... ldap { redundant { ldap_primary ldap_secondary } } .... ldap_primary { .. .. } ldap_secondary { .. .. } .. When the server gets any access-request packet, it tries to connect to the secondary server. Even though the primary server is reachable, the secondary server is contacted first. How can i make the radius server to contact primary ldap server first & then the next ldap server ?? Am i missing any configuration?? Could please help me in this regard. Thanks in advance. Sumithra.

1 0

Re: Google Summer of Code and RadSec?
by Pezhman Lali 23 Apr '06

23 Apr '06

Alan wrote: > I'd suggest coming up with 3-4 project suggestions, so that there > would be more of a chance of a student finding a project they liked. > > 1) GnuTLS support in rlm_eap > 2) radsec (as a separate daemon) > 3) adding tacacs+ support (see one of the bugs for template code) > > Others? I 'm agree with Alan Dekok. please add rlm_php to this list, the future of php is sunny. tanx Best Pezhman Lali --------------------------------- How low will we go? Check out Yahoo! Messengers low PC-to-Phone call rates.

2 1