July 2006 - Freeradius-Devel - lists.freeradius.org

EAP method cleanup
by Piotr Marnik 31 Jul '06

31 Jul '06

Hello! I have a little problem with developing new EAP method. The problem is with the internal data which are used between subsequent EAP request (handler->opaque). My question is: how free session data when user breaks the session before finish? From my observation free_opaque is called only once when method finishes. But what about non finished sessions (intentionally or not) which should be, after some delay, also removed. Is there any solution for this problem? Regards Piotr Marnik -- Piotr Marnik e-mail: piotr.marnik(a)gmail.com icq: 319887763, gg: 8097221

2 2

bugzilla #380: rlm_dbm_parser refuses to create record if both check and reply items are empty
by Gabriel L. Somlo 30 Jul '06

30 Jul '06

rlm_dbm_parser refuses to create a users.dbm file where both the list of check items *and* the list of reply-items are empty (this is perfectly legal and allowed when one uses the files module). To reproduce: feed the following file to rlm_dbm_parser: #---begin users.dbm.src dummy_user ; ; #---end or #---begin users.dbm.src dummy_user ; #---end Then, attempt to create users.dbm: rlm_dbm_parser -c -i users.dbm.src -o users.dbm Notice how it says 'Records loaded: 0' Desired behavior is 'Record loaded: 1' A desired users.dbm file *can* be created by calling libdbm create/insert routines from a custom C program, by providing the username as key and the string "\n\n" as content (each '\n' denotes an empty list of check, and respectively, reply items). Once created, the users.dbm works fine with the actual freeradius server (radiusd). The problem is that, before inserting a record, rlm_dbm_parser checks the length of the content field, and skips insertion if length is less than 3 bytes. To be able to create a list of users w/o check and reply items, the minimum content length should be reduced to 2 bytes (for the two '\n' characters as described above). The following one-liner patch (against snapshot-20060730) fixes the bug (also submitted via bugzilla as #380): diff -NarU5 freeradius-snapshot-20060730.orig/src/modules/rlm_dbm/rlm_dbm_parser.c freeradius-snapshot-20060730.rlmfix/src/modules/rlm_dbm/rlm_dbm_parser.c --- freeradius-snapshot-20060730.orig/src/modules/rlm_dbm/rlm_dbm_parser.c 2006-03-16 11:47:43.000000000 -0500 +++ freeradius-snapshot-20060730.rlmfix/src/modules/rlm_dbm/rlm_dbm_parser.c 2006-07-30 17:14:00.000000000 -0400 @@ -153,11 +153,11 @@ static int storecontent (const char * username) { datum d,k; int res; - if ( pdb == NULL || concntr < 3 ) return 1; + if ( pdb == NULL || concntr < 2 ) return 1; DOUT2("store:\n%s\ncontent:\n%s",username,content); d.dptr = content; d.dsize = concntr + 1;

1 0

Automatic report from sources (radiusd) between 29.07.2006 - 30.07.2006 GMT
by Automatic cvs log generator 30 Jul '06

30 Jul '06

CVS log entries from 29.07.2006 (Sat) 08:00:01 - 30.07.2006 (Sun) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: nbk File: radiusd/doc/rlm_sqlcounter; Revisions: 1.4, 1.3.6.1 File: radiusd/raddb/radiusd.conf.in; Revisions: 1.233, 1.188.2.4.2.12 ===================================================== Combined list of identical log entries ===================================================== Description: Document the setup of sqlcounter against a PostgreSQL database. Patch from Stephen Gran <sgran(a)debian.org> Modified files: File: radiusd/doc/rlm_sqlcounter; Revision: 1.4; Date: 2006/07/29 19:39:23; Author: nbk; Lines: (+34 -1) File: radiusd/doc/rlm_sqlcounter; Revision: 1.3.6.1; Date: 2006/07/29 19:43:30; Author: nbk; Lines: (+34 -1) File: radiusd/raddb/radiusd.conf.in; Revision: 1.233; Date: 2006/07/29 19:39:23; Author: nbk; Lines: (+21 -1) File: radiusd/raddb/radiusd.conf.in; Revision: 1.188.2.4.2.12; Date: 2006/07/29 19:43:30; Author: nbk; Lines: (+21 -1) ===================================================== Log entries ===================================================== ===================================================== Summary of modified files ===================================================== File: radiusd/doc/rlm_sqlcounter Revisions: 1.4, 1.3.6.1 Authors: nbk (+34 -1), nbk (+34 -1) ------------------------------- File: radiusd/raddb/radiusd.conf.in Revisions: 1.233, 1.188.2.4.2.12 Authors: nbk (+21 -1), nbk (+21 -1) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Documentation updates (sql_counter with postgresql)
by Stephen Gran 29 Jul '06

29 Jul '06

Hello all, After making this work for myself, I thought I would send the documentation on so that others could do it more easily. There are some duplicates that could be cut, but I leave that to you to decide. I have tried to be clear without being completely repetitive. Hopefully others will find it useful. There are 3 long lines in doc/rlm_sqlcounter that I see wrap badly - sorry about that. I was just trying to stay with the style of the file. Thanks, Index: doc/rlm_sqlcounter =================================================================== --- doc/rlm_sqlcounter (revision 939) +++ doc/rlm_sqlcounter (working copy) @@ -19,7 +19,7 @@ [1] Create a text file called sqlcounter.conf in the same directory where radiusd.conf resides (usually /usr/local/etc/raddb) -with the following content: +with the following content (for mysql): #-----# sqlcounter noresetcounter { @@ -59,6 +59,39 @@ #-----# +The respective lines for postgresql are: + +query = "SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{%k}'" +query = "SELECT SUM(AcctSessionTime - GREATER((%b - AcctStartTime::ABSTIME::INT4), 0)) FROM radacct WHERE UserName='%{%k}' AND AcctStartTime::ABSTIME::INT4 + AcctSessionTime > '%b'" +query = "SELECT SUM(AcctSessionTime - GREATER((%b - AcctStartTime::ABSTIME::INT4), 0)) FROM radacct WHERE UserName='%{%k}' AND AcctStartTime::ABSTIME::INT4 + AcctSessionTime > '%b'" + +If you are running postgres 7.x, you may not have a GREATER function. + +An example of one is: + +CREATE OR REPLACE FUNCTION "greater"(integer, integer) RETURNS integer AS ' +DECLARE + res INTEGER; + one INTEGER := 0; + two INTEGER := 0; +BEGIN + one = $1; + two = $2; + IF one IS NULL THEN + one = 0; + END IF; + IF two IS NULL THEN + two = 0; + END IF; + IF one > two THEN + res := one; + ELSE + res := two; + END IF; + RETURN res; +END; +' LANGUAGE 'plpgsql'; + [2] Include the above file to radiusd.conf by adding a line in modules{ } section Index: raddb/radiusd.conf.in =================================================================== --- raddb/radiusd.conf.in (revision 939) +++ raddb/radiusd.conf.in (working copy) @@ -1454,24 +1454,42 @@ # This query properly handles calls that span from the # previous reset period into the current period but # involves more work for the SQL server than those - # below + # below. For mysql: query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" + # For postgresql: + # Note - if you are running 7.x, you may not have a GREATER + # function. Please see doc/sql_counter for an example. + # query = "SELECT SUM(AcctSessionTime - \ + # GREATER((%b - AcctStartTime::ABSTIME::INT4), 0)) \ + # FROM radacct WHERE UserName='%{%k}' AND \ + # AcctStartTime::ABSTIME::INT4 + AcctSessionTime > '%b'" + # This query ignores calls that started in a previous # reset period and continue into into this one. But it - # is a little easier on the SQL server + # is a little easier on the SQL server. For mysql: # query = "SELECT SUM(AcctSessionTime) FROM radacct WHERE \ # UserName='%{%k}' AND AcctStartTime > FROM_UNIXTIME('%b')" + # For postgresql: + # query = "SELECT SUM(AcctSessionTime) FROM radacct WHERE \ + # UserName='%{%k}' AND AcctStartTime::ABSTIME::INT4 > '%b'" + # This query is the same as above, but demonstrates an # additional counter parameter '%e' which is the # timestamp for the end of the period + # For mysql: # query = "SELECT SUM(AcctSessionTime) FROM radacct \ # WHERE UserName='%{%k}' AND AcctStartTime BETWEEN \ # FROM_UNIXTIME('%b') AND FROM_UNIXTIME('%e')" +# + # For postgresql: + # query = "SELECT SUM(AcctSessionTime) FROM radacct \ + # WHERE UserName='%{%k}' AND AcctStartTime::ABSTIME::INT4 \ + # BETWEEN '%b' AND '%e'" } sqlcounter monthlycounter { @@ -1484,7 +1502,9 @@ # This query properly handles calls that span from the # previous reset period into the current period but # involves more work for the SQL server than those - # below + # below. + # The same notes above about the differences between mysql + # versus postgres queries apply here. query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ -- -------------------------------------------------------------------------- | Stephen Gran | What nonsense people talk about happy | | steve(a)lobefin.net | marriages! A man can be happy with any | | http://www.lobefin.net/~steve | woman so long as he doesn't love her. | | | -- Oscar Wilde | --------------------------------------------------------------------------

2 3

Automatic report from sources (radiusd) between 28.07.2006 - 29.07.2006 GMT
by Automatic cvs log generator 29 Jul '06

29 Jul '06

CVS log entries from 28.07.2006 (Fri) 08:00:02 - 29.07.2006 (Sat) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/lib/radius.c; Revisions: 1.186 File: radiusd/src/lib/valuepair.c; Revisions: 1.110 File: radiusd/src/include/libradius.h; Revisions: 1.123 File: radiusd/src/include/radius.h; Revisions: 1.82 File: radiusd/src/lib/dict.c; Revisions: 1.91, 1.90 File: radiusd/src/lib/print.c; Revisions: 1.43 ===================================================== Combined list of identical log entries ===================================================== Description: Added support for native "byte" and "short", which are used by some vendors. Added support for VALUE-ALIAS, to minimize the number of copies of VALUEs of the same name, for different ATTRIBUTEs Modified files: File: radiusd/src/include/libradius.h; Revision: 1.123; Date: 2006/07/28 17:34:13; Author: aland; Lines: (+4 -1) File: radiusd/src/include/radius.h; Revision: 1.82; Date: 2006/07/28 17:34:13; Author: aland; Lines: (+3 -1) File: radiusd/src/lib/dict.c; Revision: 1.90; Date: 2006/07/28 17:34:14; Author: aland; Lines: (+179 -10) File: radiusd/src/lib/print.c; Revision: 1.43; Date: 2006/07/28 17:34:14; Author: aland; Lines: (+4 -2) File: radiusd/src/lib/radius.c; Revision: 1.186; Date: 2006/07/28 17:34:14; Author: aland; Lines: (+31 -2) File: radiusd/src/lib/valuepair.c; Revision: 1.110; Date: 2006/07/28 17:34:14; Author: aland; Lines: (+69 -2) ===================================================== Log entries ===================================================== Description: Be smarter and faster about aliases. Don't allow aliases between attributes of differing types. Note that enforcing that the target of the alias has values means that the aliased attribute is of the correct type: integer, etc. Modified files: File: radiusd/src/lib/dict.c; Revision: 1.91; Date: 2006/07/28 21:46:11; Author: aland; Lines: (+44 -38) ===================================================== Summary of modified files ===================================================== File: radiusd/src/include/libradius.h Revisions: 1.123 Authors: aland (+4 -1) ------------------------------- File: radiusd/src/include/radius.h Revisions: 1.82 Authors: aland (+3 -1) ------------------------------- File: radiusd/src/lib/dict.c Revisions: 1.91, 1.90 Authors: aland (+44 -38), aland (+179 -10) ------------------------------- File: radiusd/src/lib/print.c Revisions: 1.43 Authors: aland (+4 -2) ------------------------------- File: radiusd/src/lib/radius.c Revisions: 1.186 Authors: aland (+31 -2) ------------------------------- File: radiusd/src/lib/valuepair.c Revisions: 1.110 Authors: aland (+69 -2) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Passing NAS-Identifier for radius generated stop packets.
by Matthew Schumacher 28 Jul '06

28 Jul '06

List, My radius system uses the NAS-Identifer attribute to make some decisions on how to log or record utmp records. Everything works fine until I have a situation where freeradius generates a stop packet in the session_zap function. Because the stop packet doesn't have the NAS-Identifier attribute it breaks the way I log things. I started hacking together a patch that would pass the NAS-Identifier of the access-request packet, but it doesn't work. Can someone take a look at my patch, or perhaps suggest a better work around? Thanks, schu diff -ruN freeradius-1.1.2.orig/src/include/radiusd.h freeradius-1.1.2/src/include/radiusd.h --- freeradius-1.1.2.orig/src/include/radiusd.h 2005-04-11 15:45:21.000000000 -0800 +++ freeradius-1.1.2/src/include/radiusd.h 2006-07-27 15:02:45.000000000 -0800 @@ -293,7 +293,7 @@ int session_zap(REQUEST *request, uint32_t nasaddr, unsigned int port, const char *user, const char *sessionid, uint32_t cliaddr, - char proto); + char proto, char nas_ident); /* radiusd.c */ #ifndef _LIBRADIUS diff -ruN freeradius-1.1.2.orig/src/main/session.c freeradius-1.1.2/src/main/session.c --- freeradius-1.1.2.orig/src/main/session.c 2006-03-24 08:54:57.000000000 -0900 +++ freeradius-1.1.2/src/main/session.c 2006-07-27 15:02:45.000000000 -0800 @@ -46,7 +46,7 @@ /* End a session by faking a Stop packet to all accounting modules */ int session_zap(REQUEST *request, uint32_t nasaddr, unsigned int port, const char *user, - const char *sessionid, uint32_t cliaddr, char proto) + const char *sessionid, uint32_t cliaddr, char proto, char nas_ident) { REQUEST *stopreq; VALUE_PAIR *vp, *userpair; @@ -103,6 +103,8 @@ INTPAIR(PW_ACCT_INPUT_PACKETS, 0); INTPAIR(PW_ACCT_OUTPUT_PACKETS, 0); + INTPAIR(PW_NAS_IDENTIFIER, nas_ident); + stopreq->username = userpair; stopreq->password = NULL; diff -ruN freeradius-1.1.2.orig/src/modules/rlm_radutmp/rlm_radutmp.c freeradius-1.1.2/src/modules/rlm_radutmp/rlm_radutmp.c --- freeradius-1.1.2.orig/src/modules/rlm_radutmp/rlm_radutmp.c 2004-02-26 10:04:34.000000000 -0900 +++ freeradius-1.1.2/src/modules/rlm_radutmp/rlm_radutmp.c 2006-07-27 15:03:17.000000000 -0800 @@ -589,6 +589,7 @@ rlm_radutmp_t *inst = instance; char login[256]; char filename[1024]; + char nas_ident; /* * Get the filename, via xlat. @@ -656,6 +657,8 @@ ipno = vp->lvalue; if ((vp = pairfind(request->packet->vps, PW_CALLING_STATION_ID)) != NULL) call_num = vp->strvalue; + if ((vp = pairfind(request->packet->vps, PW_NAS_IDENTIFIER)) != NULL) + nas_ident = vp->strvalue; /* * lock the file while reading/writing. @@ -736,7 +739,7 @@ session_zap(request, u.nas_address, u.nas_port, login, session_id, u.framed_address, - u.proto); + u.proto, nas_ident); } } } diff -ruN freeradius-1.1.2.orig/src/modules/rlm_sql/rlm_sql.c freeradius-1.1.2/src/modules/rlm_sql/rlm_sql.c --- freeradius-1.1.2.orig/src/modules/rlm_sql/rlm_sql.c 2006-05-20 04:44:37.000000000 -0800 +++ freeradius-1.1.2/src/modules/rlm_sql/rlm_sql.c 2006-07-27 15:03:46.000000000 -0800 @@ -1132,6 +1132,7 @@ int ret; uint32_t nas_addr = 0; int nas_port = 0; + char nas_ident; /* If simul_count_query is not defined, we don't do any checking */ if (inst->config->simul_count_query[0] == 0) { @@ -1207,7 +1208,8 @@ ipno = vp->lvalue; if ((vp = pairfind(request->packet->vps, PW_CALLING_STATION_ID)) != NULL) call_num = vp->strvalue; - + if ((vp = pairfind(request->packet->vps, PW_NAS_IDENTIFIER)) != NULL) + nas_ident = vp->strvalue; while (rlm_sql_fetch_row(sqlsocket, inst) == 0) { row = sqlsocket->row; @@ -1271,7 +1273,7 @@ session_zap(request, nas_addr,nas_port,row[2],row[1], - framed_addr, proto); + framed_addr, proto, nas_ident); } }

1 1

rlm_dbm with empty check and reply items
by Gabriel L. Somlo 28 Jul '06

28 Jul '06

Alan & all, I want to use rlm_dbm for authorization with no check or reply items. A user is authorized if he is listed in the dbm database, and not authorized if not present: modules { ... dbm { usersfile = ${confdir}/users.dbm } ... } ... authorize { ... dbm { notfound = reject } } So, what I need is a dbm file which has "empty" content associated with each username key. "Empty" actually means a "\n\n" string (first '\n' for no check items, second one for no reply items). I can create such a database by calling dbm routines from my own C code, and it works fine with the radiusd.conf excerpt above. HOWEVER, I would like to use the rlm_dbm_parser binary included with the freeradius package. The trouble is, this code checks for the length of each content record before inserting into the dbm file, and refuses to do so unless the record is more than 3 characters long (rlm_dbm_parser.c, line 158, inside function 'static int storecontent' as per freeradius-snapshot-20060728): static int storecontent (const char * username) { datum d,k; int res; if ( pdb == NULL || concntr < 3 ) return 1; /* ^^^^^^^^^^^^^^ */ DOUT2("store:\n%s\ncontent:\n%s",username,content); d.dptr = content; ... Is there a known good reason why this code wants length >=3, or why it prevents check items and reply items from being empty at the same time ? If yes, inquiring minds want to know :) If not, please apply the attached patch, which modifies the check from < 3 to < 2, allowing "empty" keys to be stored in the dbm. Thanks much, Gabriel

1 0

Firebird sql driver for rlm_sql module
by Vitaly Bodzhgua 28 Jul '06

28 Jul '06

I wrote rlm_sql_firebird driver for rlm_sql module. This driver may work only with Firebird version 1.5.0 and higher, but with small modification (using linker option -lgds instead of -lfbclient) it may be used with lower version of Firebird and Interbase as well. Driver was tested with freeradius 1.0.5 and Firebird 1.5.2 for a month. Also it appeared to work with all stable freeradius versions starting with 1.0.5. So I can contribute the source code if one , who can make such decisions, decides that it is will be not unnecessary for freeradius project.

2 1

freeradius and openssl exception
by Stephen Gran 27 Jul '06

27 Jul '06

Hello all, I'm sorry in advance if this is something that has already been discussed to death. I have been googling around, and I do see some discussion about an openssl exception that took place in 2005, but I don't see any resolution, nor do I see any actual exception in COPYING. Is this something, first of all, that people are either interested in or amenable to? If so, has any progress been made? I ask all this because I recently took over comaintenance of the package for Debian, and there are several modules that we can't ship precompiled right now, as I understand it (eap being the most common, but for some reason postgres is also currently disabled - that needs seperate investigation). If no progress has been made, I would be willing to do some of the leg work sending around a sort of form email to contributors asking for an exception, or whatever you all thought was the best way of handling this. Of course, if you're not agreeable, I guess we just stop here - no hard feelings, but it means back to the drawing board for a gnutls solution or some shim layer. Take care, -- -------------------------------------------------------------------------- | Stephen Gran | Just because you're paranoid doesn't | | steve(a)lobefin.net | mean they AREN'T after you. | | http://www.lobefin.net/~steve | | --------------------------------------------------------------------------

3 7

Automatic report from sources (radiusd) between 26.07.2006 - 27.07.2006 GMT
by Automatic cvs log generator 27 Jul '06

27 Jul '06

CVS log entries from 26.07.2006 (Wed) 08:00:01 - 27.07.2006 (Thu) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/share/dictionary.tropos; Revisions: 1.1, 1.1.2.2, 1.1.2.1 File: radiusd/share/dictionary.walabi; Revisions: 1.1.2.2 File: radiusd/share/dictionary.riverstone; Revisions: 1.1.2.2 File: radiusd/share/dictionary; Revisions: 1.132, 1.93.2.5.2.5 File: radiusd/share/dictionary.alvarion; Revisions: 1.1.2.2 ===================================================== Combined list of identical log entries ===================================================== Description: Merged from CVS head Modified files: File: radiusd/share/dictionary; Revision: 1.93.2.5.2.5; Date: 2006/07/26 23:00:19; Author: aland; Lines: (+5 -1) File: radiusd/share/dictionary.alvarion; Revision: 1.1.2.2; Date: 2006/07/26 23:00:19; Author: aland; Lines: (+310 -0) File: radiusd/share/dictionary.riverstone; Revision: 1.1.2.2; Date: 2006/07/26 23:00:20; Author: aland; Lines: (+42 -0) File: radiusd/share/dictionary.tropos; Revision: 1.1.2.2; Date: 2006/07/26 23:00:20; Author: aland; Lines: (+52 -0) File: radiusd/share/dictionary.walabi; Revision: 1.1.2.2; Date: 2006/07/26 23:00:20; Author: aland; Lines: (+28 -0) ------------------------------- Description: As posted to the list Modified files: File: radiusd/share/dictionary; Revision: 1.132; Date: 2006/07/26 22:57:30; Author: aland; Lines: (+2 -1) File: radiusd/share/dictionary.tropos; Revision: 1.1; Date: 2006/07/26 22:57:30; Author: aland; ===================================================== Log entries ===================================================== Description: file dictionary.tropos was added on branch branch_1_1 on 2006-07-26 23:00:20 +0000 Modified files: File: radiusd/share/dictionary.tropos; Revision: 1.1.2.1; Date: 2006/07/26 22:57:30; Author: aland; Lines: (+0 -52) ===================================================== Summary of modified files ===================================================== File: radiusd/share/dictionary Revisions: 1.132, 1.93.2.5.2.5 Authors: aland (+2 -1), aland (+5 -1) ------------------------------- File: radiusd/share/dictionary.alvarion Revisions: 1.1.2.2 Authors: aland (+310 -0) ------------------------------- File: radiusd/share/dictionary.riverstone Revisions: 1.1.2.2 Authors: aland (+42 -0) ------------------------------- File: radiusd/share/dictionary.tropos Revisions: 1.1, 1.1.2.2, 1.1.2.1 Authors: aland, aland (+52 -0), aland (+0 -52) ------------------------------- File: radiusd/share/dictionary.walabi Revisions: 1.1.2.2 Authors: aland (+28 -0) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

patch for Tropos dictionary
by Rick Dean 26 Jul '06

26 Jul '06

Please accept this patch for a dictionary of Tropos's VSA. -- Rick Dean Tropos Networks

2 1

RE: rlm_ippool and tcp TIME_WAIT state
by Sebastien Cantos 25 Jul '06

25 Jul '06

Hi, Ive coded a little patch for 1.1.2. If someone is interested in this and has some time to test (Ive done lots of tests using radclient) it may be interesting to include the patch in the CVS. Regards, Sebastien. _____ De : Sebastien Cantos [mailto:s.cantos@neopost.com] Envoyé : mercredi 19 juillet 2006 14:17 À : 'freeradius-devel(a)lists.freeradius.org.' Objet : rlm_ippool and tcp TIME_WAIT state Hi, Ive already posted this to the users mailing list, but I think that here is a best place for this. Ive noticed that rlm_ippool is nearly always reassigning an IP address that has just been releasing for a new connexion. This causes some TCP connexion problems because of the TIME_WAIT state. Scenario: 1/ one device connects using source port 1024 (ppp) and gets an IP address from freeradius 2/ this device disconnects, the ip is freed from the pool 3/ another devices connects using source port 1024 and gets the same ip address as before 4/ the connexion is impossible to the server because the connexion of last device is still in TIME_WAIT state How can I make sure an IP address is not assigned before some time period (240 seconds, time period of the TIME_WAIT state) after being released? I got one answer : >Interesting. >The IPs are allocated by a GDBM walk of the database, and use of the first free or expired IP. This will always tend to be the same one hence the repeat >allocations. >It would in theory be possible to save the key from the last walk, and next time we allocate an IP start from that key and wrap back around, which would >allocate IPs in a more round-robin fashion. I would appreciate if someone can help doing the hack or give me some hints to modify rlm_ippool.c to add some retention time parameter to make sure an ip is not reassigned instantly after being freed or to make things work more in a random or round robin way. Thanks in advance. Regards, Sebastien.

2 1

ntpasswd not UTF-8 safe?
by Josh Howlett 25 Jul '06

25 Jul '06

I don't think that the ntpasswd function in smbencrypt.c is safe with multi-byte character encodings, such as UTF-8. I think that the problem is in the conversion of the password to Unicode, for the construction of the NT hash. The function assumes a single-byte character-set encoding (which works fine for Latin1, etc) but not for multi-byte encodings such as UTF-8. I'm not quite sure what the best approach to fix this is; does anyone have any suggestions? best regards, josh. Josh Howlett, Networking Specialist, University of Bristol. email: josh.howlett(a)bristol.ac.uk | phone: +44 (0)7867 907076 | internal: 7850

3 6

Automatic report from sources (radiusd) between 24.07.2006 - 25.07.2006 GMT
by Automatic cvs log generator 25 Jul '06

25 Jul '06

CVS log entries from 24.07.2006 (Mon) 08:00:04 - 25.07.2006 (Tue) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/lib/radius.c; Revisions: 1.185, 1.184 ===================================================== Log entries ===================================================== Description: More checks for diameter length Modified files: File: radiusd/src/lib/radius.c; Revision: 1.185; Date: 2006/07/24 23:08:44; Author: aland; Lines: (+8 -6) ------------------------------- Description: Decode multiple Diameter attributes from inside one or more Extended-Attributes. It's inefficient (i.e. copying data to yet another buffer on the stack), but it works, and handles pretty much anything we can throw at it. Modified files: File: radiusd/src/lib/radius.c; Revision: 1.184; Date: 2006/07/24 21:53:08; Author: aland; Lines: (+204 -78) ===================================================== Summary of modified files ===================================================== File: radiusd/src/lib/radius.c Revisions: 1.185, 1.184 Authors: aland (+8 -6), aland (+204 -78) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Testing...
by Alan DeKok 24 Jul '06

24 Jul '06

Quiet list.. Alan DeKok.

4 5

build error
by Peter Nixon 21 Jul '06

21 Jul '06

Hi Guys When I build on the openSUSE Build Service I get the following errors scattered throughout the build (On all SUSE versions) but the build continues, but doesnt make anu .so files. /usr/src/packages/BUILD/freeradius-1.1.2/libtool --mode=link gcc -release 1.1.2 \ -module -export-dynamic -o rlm_eap_tls.la \ -rpath /usr/lib/freeradius rlm_eap_tls.lo rlm_eap_tls.c /usr/src/packages/BUILD/freeradius-1.1.2/src/lib/libradius.la \ ../../libeap/libeap.la -lcrypto -lssl -lcrypto -lnsl -lresolv -lpthread rm -fr .libs/rlm_eap_tls.la .libs/rlm_eap_tls.* .libs/rlm_eap_tls-1.1.2.* *** Warning: This library needs some functionality provided by -lcrypto. *** I have the capability to make that library automatically link in when *** you link to this library. But I can only do this if you have a *** shared version of the library, which you do not appear to have. *** Warning: This library needs some functionality provided by -lssl. *** I have the capability to make that library automatically link in when *** you link to this library. But I can only do this if you have a *** shared version of the library, which you do not appear to have. *** Warning: This library needs some functionality provided by -lcrypto. *** I have the capability to make that library automatically link in when *** you link to this library. But I can only do this if you have a *** shared version of the library, which you do not appear to have. *** Warning: This library needs some functionality provided by -lnsl. *** I have the capability to make that library automatically link in when *** you link to this library. But I can only do this if you have a *** shared version of the library, which you do not appear to have. *** Warning: This library needs some functionality provided by -lresolv. *** I have the capability to make that library automatically link in when *** you link to this library. But I can only do this if you have a *** shared version of the library, which you do not appear to have. *** Warning: This library needs some functionality provided by -lpthread. *** I have the capability to make that library automatically link in when *** you link to this library. But I can only do this if you have a *** shared version of the library, which you do not appear to have. *** Warning: libtool could not satisfy all declared inter-library *** dependencies of module rlm_eap_tls. Therefore, libtool will create *** a static module, that should work as long as the dlopening *** application is linked with the -dlopen flag. ar cru .libs/rlm_eap_tls.a rlm_eap_tls.o ranlib .libs/rlm_eap_tls.a When I build locally I dont get the same errors so, does anyone know what dependency I am missing on the build service? I currently specify (plus base system): BuildRequires: cyrus-sasl-devel BuildRequires: db-devel BuildRequires: e2fsprogs-devel BuildRequires: gcc-c++ BuildRequires: gdbm-devel BuildRequires: gettext-devel BuildRequires: glibc-devel BuildRequires: libtool BuildRequires: mysql-devel BuildRequires: ncurses-devel BuildRequires: openldap2-devel BuildRequires: openssl-devel BuildRequires: pam-devel BuildRequires: perl BuildRequires: postgresql-devel BuildRequires: python-devel BuildRequires: sed BuildRequires: unixODBC-devel BuildRequires: zlib-devel TIA -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

2 1

Session-Timeout & h323-credit-time Difference
by Akhnukh 20 Jul '06

20 Jul '06

Hi, Please anyone tell me exact difference between Session-Timeout attribute and VSA credit-time attribute. According to RFC both definitions looks same. Please specify difference. Thanks -- View this message in context: http://www.nabble.com/Session-Timeout---h323-credit-time-Difference-tf19718… Sent from the FreeRadius - Dev forum at Nabble.com.

2 1

rlm_ippool and tcp TIME_WAIT state
by Sebastien Cantos 19 Jul '06

19 Jul '06

Hi, I've already posted this to the user's mailing list, but I think that here is a best place for this. I've noticed that rlm_ippool is nearly always reassigning an IP address that has just been releasing for a new connexion. This causes some TCP connexion problems because of the TIME_WAIT state. Scenario: 1/ one device connects using source port 1024 (ppp) and gets an IP address from freeradius 2/ this device disconnects, the ip is freed from the pool 3/ another devices connects using source port 1024 and gets the same ip address as before 4/ the connexion is impossible to the server because the connexion of last device is still in TIME_WAIT state How can I make sure an IP address is not assigned before some time period (240 seconds, time period of the TIME_WAIT state) after being released? I got one answer : >Interesting. >The IPs are allocated by a GDBM walk of the database, and use of the first free or expired IP. This will always tend to be the same one hence the repeat >allocations. >It would in theory be possible to save the key from the last walk, and next time we allocate an IP start from that key and wrap back around, which would >allocate IPs in a more round-robin fashion. I would appreciate if someone can help doing the hack or give me some hints to modify rlm_ippool.c to add some retention time parameter to make sure an ip is not reassigned instantly after being freed or to make things work more in a random or round robin way. Thanks in advance. Regards, Sebastien.

2 1

RE: Last set of changes for 1.1.3
by Sandworm 15 Jul '06

15 Jul '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > Are there any other issues we need to fix before 1.1.3? RPM spec > file fixes? The RPM Spec fixes that have been discussed on the list several times (unpackaged files, etc) could be added. Diff from previous messages attached for your reference. $ diff -u /usr/src/redhat/SPECS/freeradius.spec freeradius.spec.orig - - - --- /usr/src/redhat/SPECS/freeradius.spec 2006-04-09 18:26:53.000000000 +1000 +++ freeradius.spec.orig 2006-02-13 02:54:56.000000000 +1100 @@ -23,8 +23,6 @@ %prep %setup - - - -sed -i "s@doc/freeradius@doc/freeradius-%{version}@" doc/Makefile doc/examples/Makefile doc/rfc/Makefile - - - - %build CFLAGS="$RPM_OPT_FLAGS" \ %configure --prefix=%{_prefix} \ @@ -101,14 +99,7 @@ %files %defattr(-,root,root) - - - -%doc doc/Acct-Type doc/Autz-Type doc/CYGWIN doc/ChangeLog doc/DIFFS doc/MACOSX - - - -%doc doc/OS2 doc/Post-Auth-Type doc/RADIUS-LDAP-eDirectory doc/RADIUS-SQL.schema - - - -%doc doc/README doc/Session-Type doc/Simultaneous-Use doc/aaa.txt doc/ascend - - - -%doc doc/bay doc/bugs doc/cisco doc/coding-methods.txt doc/configurable_failover - - - -%doc doc/duplicate-users doc/ldap_howto.txt doc/load- balance.txt doc/misc-nas - - - -%doc doc/module_interface doc/mssql doc/performance-testing doc/processing_users_file - - - -%doc doc/proxy doc/radrelay doc/release-method.txt doc/rfc/ doc/rlm* doc/supervise-radiusd.txt - - - -%doc doc/tuning_guide doc/variables.txt todo/ COPYRIGHT INSTALL +%doc doc/ChangeLog doc/README* todo/ COPYRIGHT INSTALL %config /etc/pam.d/radius %config /etc/logrotate.d/radiusd %config /etc/rc.d/init.d/radiusd -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.5 wkYEARECAAYFAkStm1MACgkQmw4BJyaatJ2+7wCgrgRxv/4ieXR/0/rsTNNaBzNO67gA n2H07LeL1kKwvr8TKlU5d/H2moc2 =CArD -----END PGP SIGNATURE-----

4 3

Problem with change of shared secret
by Vishwanath Srikant Pattanshetti 14 Jul '06

14 Jul '06

All I am using FreeRADIUS 1.1.0 with Oracle 10. Am storing the clients data in database table 'nas' When I change the shared secret entry in this table the RADIUS server which is Already running does not seem to pick this change, and I get an error saying invalid Authenticator - however this problem does not occur if I restart the RADIUS server. Is there a way I can make the RADIUS server pick up changes to the 'nas' table dynamically? Any help would be a great help. -vishwa.

1 0

Re: Last set of changes for 1.1.3
by Sandworm 14 Jul '06

14 Jul '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > > "Sandworm" <sandworm(a)mepd.hush.com> wrote: > > The RPM Spec fixes that have been discussed on the list several > > times (unpackaged files, etc) could be added. Diff from previous > > messages attached for your reference. > > > > $ diff -u /usr/src/redhat/SPECS/freeradius.spec > > That looks like Redhat's spec file, not the one we ship with the > server. Please file a bug with Redhat, asking them to update their > spec file. > > If there are problems with redhat/freeradius.spec, please discuss > those here. > > Alan DeKok. > - Alan This is definitely not Redhat's spec file - it is the spec file from the FR tarball ie. redhat/freeradius.spec. This will be a bit long, but see the whole file listed below (including the changes I showed as a diff in my previous post): Summary: High-performance and highly configurable RADIUS server URL: http://www.freeradius.org/ Name: freeradius Version: 1.1.1 Release: 0 License: GPL Group: Networking/Daemons Packager: FreeRADIUS.org Source0: %{name}-%{version}.tar.gz Prereq: /sbin/chkconfig BuildPreReq: libtool # FIXME: snmpwalk, snmpget and rusers POSSIBLY needed by checkrad Provides: radiusd Conflicts: cistron-radius BuildRoot: %{_tmppath}/%{name}-root %description The FreeRADIUS Server Project is a high-performance and highly configurable GPL'd RADIUS server. It is somewhat similar to the Livingston 2.0 RADIUS server, but has many more features, and is much more configurable. %prep %setup sed -i "s@doc/freeradius@doc/freeradius-%{version}@" doc/Makefile doc/examples/Makefile doc/rfc/Makefile %build CFLAGS="$RPM_OPT_FLAGS" \ %configure --prefix=%{_prefix} \ --localstatedir=%{_localstatedir} \ --sysconfdir=%{_sysconfdir} \ --mandir=%{_mandir} \ --with-system-libtool \ --disable-ltdl-install \ --with-ltdl-lib=/usr/lib \ --with-ltdl-include=/usr/include \ --with-gnu-ld \ --with-large-files --with-udpfromto --with-edir \ --with-rlm-sql_postgresql-include-dir=/usr/include/pgsql \ --with-rlm-krb5-include-dir=/usr/kerberos/include \ --with-rlm-krb5-lib-dir=/usr/kerberos/lib make %install [ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT mkdir -p $RPM_BUILD_ROOT/etc/{logrotate.d,pam.d,rc.d/init.d} make install R=$RPM_BUILD_ROOT RADDB=$RPM_BUILD_ROOT/etc/raddb # set radiusd as default user/group perl -i -pe 's/^#user =.*$/user = radiusd/' $RADDB/radiusd.conf perl -i -pe 's/^#group =.*$/group = radiusd/' $RADDB/radiusd.conf # shadow password file MUST be defined on Linux perl -i -pe 's/# shadow =/shadow =/' $RADDB/radiusd.conf # remove unneeded stuff rm -f $RPM_BUILD_ROOT%{_mandir}/man8/builddbm.8 rm -f $RPM_BUILD_ROOT%{_prefix}/sbin/rc.radiusd cd redhat install -m 755 rc.radiusd-redhat $RPM_BUILD_ROOT/etc/rc.d/init.d/radiusd install -m 644 radiusd-logrotate $RPM_BUILD_ROOT/etc/logrotate.d/radiusd install -m 644 radiusd-pam $RPM_BUILD_ROOT/etc/pam.d/radius cd .. %pre /usr/sbin/useradd -c "radiusd user" -r -s /bin/false -u 95 -d / radiusd 2>/dev/null || : %preun if [ "$1" = "0" ]; then /sbin/service radiusd stop > /dev/null 2>&1 /sbin/chkconfig --del radiusd fi %post /sbin/ldconfig /sbin/chkconfig --add radiusd # Done here to avoid messing up existing installations for i in radius/radutmp radius/radwtmp radius/radius.log # radius/radwatch.log radius/checkrad.log do touch /var/log/$i chown radiusd:radiusd /var/log/$i chmod 600 /var/log/$i done %postun if [ "$1" -ge "1" ]; then /sbin/service radiusd condrestart >/dev/null 2>&1 fi if [ $1 = 0 ]; then /usr/sbin/userdel radiusd > /dev/null 2>&1 || : fi /sbin/ldconfig %clean [ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT %files %defattr(-,root,root) %doc doc/Acct-Type doc/Autz-Type doc/CYGWIN doc/ChangeLog doc/DIFFS doc/MACOSX %doc doc/OS2 doc/Post-Auth-Type doc/RADIUS-LDAP-eDirectory doc/RADIUS-SQL.schema %doc doc/README doc/Session-Type doc/Simultaneous-Use doc/aaa.txt doc/ascend %doc doc/bay doc/bugs doc/cisco doc/coding-methods.txt doc/configurable_failover %doc doc/duplicate-users doc/ldap_howto.txt doc/load-balance.txt doc/misc-nas %doc doc/module_interface doc/mssql doc/performance-testing doc/processing_users_file %doc doc/proxy doc/radrelay doc/release-method.txt doc/rfc/ doc/rlm* doc/supervise-radiusd.txt %doc doc/tuning_guide doc/variables.txt todo/ COPYRIGHT INSTALL %config /etc/pam.d/radius %config /etc/logrotate.d/radiusd %config /etc/rc.d/init.d/radiusd %config (noreplace) /etc/raddb/* %{_bindir}/* %{_datadir}/%{name} %{_libdir}/* %{_mandir}/*/* %{_sbindir}/* %attr(0700,radiusd,radiusd) %dir /var/log/radius %attr(0700,radiusd,radiusd) %dir /var/log/radius/radacct %attr(0700,radiusd,radiusd) %dir /var/run/radiusd %changelog * Thu Dec 15 2004 Alan DeKok - - - update for 1.1.0 * Mon May 31 2004 Paul Hampson - - - update for 1.0.0 release * Fri May 23 2003 Marko Myllynen - - - update for 0.9 * Wed Sep 4 2002 Marko Myllynen - - - fix libtool issues for good * Thu Aug 22 2002 Marko Myllynen - - - update for 0.7/0.8 * Tue Jun 18 2002 Marko Myllynen - - - run as radiusd user instead of root - - - added some options for configure * Thu Jun 6 2002 Marko Myllynen - - - set noreplace for non-dictionary files in /etc/raddb * Sun May 26 2002 Frank Cusack <frank(a)google.com> - - - move /var dirs from %%post to %%files * Thu Feb 14 2002 Marko Myllynen - - - use dir name macros in all configure options - - - libtool is required only when building the package - - - misc clean ups * Wed Feb 13 2002 Marko Myllynen - - - use %%{_mandir} instead of /usr/man - - - rename %%postin as %%post - - - clean up name/version * Fri Jan 18 2002 Frank Cusack <frank(a)google.com> - - - remove (noreplace) for /etc/raddb/* (due to rpm bugs) * Fri Sep 07 2001 Ivan F. Martinez <ivanfm(a)ecodigit.com.br> - - - changes to make compatible with default config file shipped - - - adjusts log files are on /var/log/radius instead of /var/log - - - /etc/raddb changed to config(noreplace) to don't override - - - user configs * Fri Sep 22 2000 Bruno Lopes F. Cabral <bruno(a)openline.com.br> - - - spec file clear accordling to the libltdl fix and minor updates * Wed Sep 12 2000 Bruno Lopes F. Cabral <bruno(a)openline.com.br> - - - Updated to snapshot-12-Sep-00 * Fri Jun 16 2000 Bruno Lopes F. Cabral <bruno(a)openline.com.br> - - - Initial release -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.5 wkYEARECAAYFAkS2+hsACgkQmw4BJyaatJ1Z3QCgrVAgFL1Pku5QGw+Xtzfb2DLsB20A n25ttFsUO06KtVysqIjF0gnQzZFD =Wr4i -----END PGP SIGNATURE-----

1 0

rlm_attr_filter
by Josip Almasi 13 Jul '06

13 Jul '06

Hi, I need to remove some attributes from the reply(*). Attr_filter does that only for proxy responses. So I wrote it: I added another parameter to attr_filter config, filterlocal, defaults to 'no'. Once you set it to 'yes' it filters locally originated attributes too. I did it in 1.0.1 source cuz it comes with redhat. So, how do I contribute? *) Yes nonsense you might say, just don't put these attribs to your config and you won't need to remove them, right?:) But I use Caller-Station-Id (and others) to perform db lookups and in the process I change its value. For both proxied and local realms. In two-stage auth (proxy.conf:post_proxy_authorize=yes). Regards...

2 2

pairmove() patch with multiple vendor-specific attributes
by Geoffrey D. Bennett 13 Jul '06

13 Jul '06

Hi there, I'm using rlm_perl to add custom reply attributes, but there's a problem when I want to return multiple instances of the same attribute, eg.: Cisco-AVPair=lcp:interface-config=service-policy output RATE-512 Cisco-AVPair=lcp:interface-config=service-policy input RATE-128 rlm_perl supports this (it looks out for arrayrefs) but rlmperl_call() calls pairmove() to put the attributes into the reply: if ((get_hv_content(rad_reply_hv, &vp)) > 0 ) { pairmove(&request->reply->vps, &vp); pairfree(&vp); } and pairmove() will "move attributes from one list to the other if not already present". Unfortunately, this means that only the first Cisco-AVPair ends up getting moved. I've attached a patch which makes pairmove() move all vendor-specific attributes. It works for me. The patch says 1.1.1, but it applies to 1.1.2 as well (untested, but I guess it should work -- lib/valuepair.c and rlm_perl.c look similar enough). Thanks, -- Geoffrey D. Bennett, RHCE, RHCX mailto:g@netcraft.com.au Senior Systems Engineer sip:g@netcraft.com.au NetCraft Australia Pty Ltd http://www.netcraft.com.au/geoffrey/

2 1

rlm_digest module - how to return rows in authenticate part
by biuro＠globeinphotos.com 12 Jul '06

12 Jul '06

Hi Because I've encountered some problems with OpenSer-Radius (described in http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg27755.… ) I've started analysis of FreeRadius sources and I've discovered very strange thing. I've compared rlm_digest.c from ver.1.0.1 with 1.1.2 and it was appeared that part descibed as "rlm_digest: Converting Digest-Attributes to something sane..." was moved from digest_authorize function to digest_authenticate . It is almost not important but how to handle such situation when I want return few attribute to client but to set values in attributes I need to know what are values in few attributes from Request eg. from Digest-Method. In current version I cannot return rows with attributes because only one SQL query can be invoked after authotize part - postauth_query (defined in postgres.conf) but this query cannot return list of row it can only return one value. Can you write how to return attributes to client in my situation? P.S As I understand the 'something sane' means that e.g we convert values from Digest-Attributes to Digest-Method. Regards Michal Szymanski

3 3

Freeradius-1.1.1 with CRL configuration
by sumi thra 12 Jul '06

12 Jul '06

Hi All, I want to configure the CRL in freeradius-1.1.1 version. Followed the procedures given in the config file, but the result is not as expected. The configuration in eap.conf are, 1) Copy CA certificates and CRLs to same directory. I appended the crl into CA file 2) Execute 'c_rehash <CA certs&CRLs Directory>'. Is it necessary? But i did this too 3) Add 'CA_path=<CA certs&CRLs directory>' 4) enable the crl check check_crl = yes 5) Restart radiusd CRL says that the client certificate is revoked. But, the user is still able to get authenticated by the radius server. Please let me know if i am missing any configuration. Thanks for your kind help in advance.

1 0