July 2006 - Freeradius-Devel - lists.freeradius.org

EAP method cleanup
by Piotr Marnik 31 Jul '06

31 Jul '06

Hello! I have a little problem with developing new EAP method. The problem is with the internal data which are used between subsequent EAP request (handler->opaque). My question is: how free session data when user breaks the session before finish? From my observation free_opaque is called only once when method finishes. But what about non finished sessions (intentionally or not) which should be, after some delay, also removed. Is there any solution for this problem? Regards Piotr Marnik -- Piotr Marnik e-mail: piotr.marnik(a)gmail.com icq: 319887763, gg: 8097221

2 2

bugzilla #380: rlm_dbm_parser refuses to create record if both check and reply items are empty
by Gabriel L. Somlo 30 Jul '06

30 Jul '06

rlm_dbm_parser refuses to create a users.dbm file where both the list of check items *and* the list of reply-items are empty (this is perfectly legal and allowed when one uses the files module). To reproduce: feed the following file to rlm_dbm_parser: #---begin users.dbm.src dummy_user ; ; #---end or #---begin users.dbm.src dummy_user ; #---end Then, attempt to create users.dbm: rlm_dbm_parser -c -i users.dbm.src -o users.dbm Notice how it says 'Records loaded: 0' Desired behavior is 'Record loaded: 1' A desired users.dbm file *can* be created by calling libdbm create/insert routines from a custom C program, by providing the username as key and the string "\n\n" as content (each '\n' denotes an empty list of check, and respectively, reply items). Once created, the users.dbm works fine with the actual freeradius server (radiusd). The problem is that, before inserting a record, rlm_dbm_parser checks the length of the content field, and skips insertion if length is less than 3 bytes. To be able to create a list of users w/o check and reply items, the minimum content length should be reduced to 2 bytes (for the two '\n' characters as described above). The following one-liner patch (against snapshot-20060730) fixes the bug (also submitted via bugzilla as #380): diff -NarU5 freeradius-snapshot-20060730.orig/src/modules/rlm_dbm/rlm_dbm_parser.c freeradius-snapshot-20060730.rlmfix/src/modules/rlm_dbm/rlm_dbm_parser.c --- freeradius-snapshot-20060730.orig/src/modules/rlm_dbm/rlm_dbm_parser.c 2006-03-16 11:47:43.000000000 -0500 +++ freeradius-snapshot-20060730.rlmfix/src/modules/rlm_dbm/rlm_dbm_parser.c 2006-07-30 17:14:00.000000000 -0400 @@ -153,11 +153,11 @@ static int storecontent (const char * username) { datum d,k; int res; - if ( pdb == NULL || concntr < 3 ) return 1; + if ( pdb == NULL || concntr < 2 ) return 1; DOUT2("store:\n%s\ncontent:\n%s",username,content); d.dptr = content; d.dsize = concntr + 1;

1 0

Automatic report from sources (radiusd) between 29.07.2006 - 30.07.2006 GMT
by Automatic cvs log generator 30 Jul '06

30 Jul '06

CVS log entries from 29.07.2006 (Sat) 08:00:01 - 30.07.2006 (Sun) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: nbk File: radiusd/doc/rlm_sqlcounter; Revisions: 1.4, 1.3.6.1 File: radiusd/raddb/radiusd.conf.in; Revisions: 1.233, 1.188.2.4.2.12 ===================================================== Combined list of identical log entries ===================================================== Description: Document the setup of sqlcounter against a PostgreSQL database. Patch from Stephen Gran <sgran(a)debian.org> Modified files: File: radiusd/doc/rlm_sqlcounter; Revision: 1.4; Date: 2006/07/29 19:39:23; Author: nbk; Lines: (+34 -1) File: radiusd/doc/rlm_sqlcounter; Revision: 1.3.6.1; Date: 2006/07/29 19:43:30; Author: nbk; Lines: (+34 -1) File: radiusd/raddb/radiusd.conf.in; Revision: 1.233; Date: 2006/07/29 19:39:23; Author: nbk; Lines: (+21 -1) File: radiusd/raddb/radiusd.conf.in; Revision: 1.188.2.4.2.12; Date: 2006/07/29 19:43:30; Author: nbk; Lines: (+21 -1) ===================================================== Log entries ===================================================== ===================================================== Summary of modified files ===================================================== File: radiusd/doc/rlm_sqlcounter Revisions: 1.4, 1.3.6.1 Authors: nbk (+34 -1), nbk (+34 -1) ------------------------------- File: radiusd/raddb/radiusd.conf.in Revisions: 1.233, 1.188.2.4.2.12 Authors: nbk (+21 -1), nbk (+21 -1) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Documentation updates (sql_counter with postgresql)
by Stephen Gran 29 Jul '06

29 Jul '06

Hello all, After making this work for myself, I thought I would send the documentation on so that others could do it more easily. There are some duplicates that could be cut, but I leave that to you to decide. I have tried to be clear without being completely repetitive. Hopefully others will find it useful. There are 3 long lines in doc/rlm_sqlcounter that I see wrap badly - sorry about that. I was just trying to stay with the style of the file. Thanks, Index: doc/rlm_sqlcounter =================================================================== --- doc/rlm_sqlcounter (revision 939) +++ doc/rlm_sqlcounter (working copy) @@ -19,7 +19,7 @@ [1] Create a text file called sqlcounter.conf in the same directory where radiusd.conf resides (usually /usr/local/etc/raddb) -with the following content: +with the following content (for mysql): #-----# sqlcounter noresetcounter { @@ -59,6 +59,39 @@ #-----# +The respective lines for postgresql are: + +query = "SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{%k}'" +query = "SELECT SUM(AcctSessionTime - GREATER((%b - AcctStartTime::ABSTIME::INT4), 0)) FROM radacct WHERE UserName='%{%k}' AND AcctStartTime::ABSTIME::INT4 + AcctSessionTime > '%b'" +query = "SELECT SUM(AcctSessionTime - GREATER((%b - AcctStartTime::ABSTIME::INT4), 0)) FROM radacct WHERE UserName='%{%k}' AND AcctStartTime::ABSTIME::INT4 + AcctSessionTime > '%b'" + +If you are running postgres 7.x, you may not have a GREATER function. + +An example of one is: + +CREATE OR REPLACE FUNCTION "greater"(integer, integer) RETURNS integer AS ' +DECLARE + res INTEGER; + one INTEGER := 0; + two INTEGER := 0; +BEGIN + one = $1; + two = $2; + IF one IS NULL THEN + one = 0; + END IF; + IF two IS NULL THEN + two = 0; + END IF; + IF one > two THEN + res := one; + ELSE + res := two; + END IF; + RETURN res; +END; +' LANGUAGE 'plpgsql'; + [2] Include the above file to radiusd.conf by adding a line in modules{ } section Index: raddb/radiusd.conf.in =================================================================== --- raddb/radiusd.conf.in (revision 939) +++ raddb/radiusd.conf.in (working copy) @@ -1454,24 +1454,42 @@ # This query properly handles calls that span from the # previous reset period into the current period but # involves more work for the SQL server than those - # below + # below. For mysql: query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" + # For postgresql: + # Note - if you are running 7.x, you may not have a GREATER + # function. Please see doc/sql_counter for an example. + # query = "SELECT SUM(AcctSessionTime - \ + # GREATER((%b - AcctStartTime::ABSTIME::INT4), 0)) \ + # FROM radacct WHERE UserName='%{%k}' AND \ + # AcctStartTime::ABSTIME::INT4 + AcctSessionTime > '%b'" + # This query ignores calls that started in a previous # reset period and continue into into this one. But it - # is a little easier on the SQL server + # is a little easier on the SQL server. For mysql: # query = "SELECT SUM(AcctSessionTime) FROM radacct WHERE \ # UserName='%{%k}' AND AcctStartTime > FROM_UNIXTIME('%b')" + # For postgresql: + # query = "SELECT SUM(AcctSessionTime) FROM radacct WHERE \ + # UserName='%{%k}' AND AcctStartTime::ABSTIME::INT4 > '%b'" + # This query is the same as above, but demonstrates an # additional counter parameter '%e' which is the # timestamp for the end of the period + # For mysql: # query = "SELECT SUM(AcctSessionTime) FROM radacct \ # WHERE UserName='%{%k}' AND AcctStartTime BETWEEN \ # FROM_UNIXTIME('%b') AND FROM_UNIXTIME('%e')" +# + # For postgresql: + # query = "SELECT SUM(AcctSessionTime) FROM radacct \ + # WHERE UserName='%{%k}' AND AcctStartTime::ABSTIME::INT4 \ + # BETWEEN '%b' AND '%e'" } sqlcounter monthlycounter { @@ -1484,7 +1502,9 @@ # This query properly handles calls that span from the # previous reset period into the current period but # involves more work for the SQL server than those - # below + # below. + # The same notes above about the differences between mysql + # versus postgres queries apply here. query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ -- -------------------------------------------------------------------------- | Stephen Gran | What nonsense people talk about happy | | steve(a)lobefin.net | marriages! A man can be happy with any | | http://www.lobefin.net/~steve | woman so long as he doesn't love her. | | | -- Oscar Wilde | --------------------------------------------------------------------------

2 3

Automatic report from sources (radiusd) between 28.07.2006 - 29.07.2006 GMT
by Automatic cvs log generator 29 Jul '06

29 Jul '06

CVS log entries from 28.07.2006 (Fri) 08:00:02 - 29.07.2006 (Sat) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/lib/radius.c; Revisions: 1.186 File: radiusd/src/lib/valuepair.c; Revisions: 1.110 File: radiusd/src/include/libradius.h; Revisions: 1.123 File: radiusd/src/include/radius.h; Revisions: 1.82 File: radiusd/src/lib/dict.c; Revisions: 1.91, 1.90 File: radiusd/src/lib/print.c; Revisions: 1.43 ===================================================== Combined list of identical log entries ===================================================== Description: Added support for native "byte" and "short", which are used by some vendors. Added support for VALUE-ALIAS, to minimize the number of copies of VALUEs of the same name, for different ATTRIBUTEs Modified files: File: radiusd/src/include/libradius.h; Revision: 1.123; Date: 2006/07/28 17:34:13; Author: aland; Lines: (+4 -1) File: radiusd/src/include/radius.h; Revision: 1.82; Date: 2006/07/28 17:34:13; Author: aland; Lines: (+3 -1) File: radiusd/src/lib/dict.c; Revision: 1.90; Date: 2006/07/28 17:34:14; Author: aland; Lines: (+179 -10) File: radiusd/src/lib/print.c; Revision: 1.43; Date: 2006/07/28 17:34:14; Author: aland; Lines: (+4 -2) File: radiusd/src/lib/radius.c; Revision: 1.186; Date: 2006/07/28 17:34:14; Author: aland; Lines: (+31 -2) File: radiusd/src/lib/valuepair.c; Revision: 1.110; Date: 2006/07/28 17:34:14; Author: aland; Lines: (+69 -2) ===================================================== Log entries ===================================================== Description: Be smarter and faster about aliases. Don't allow aliases between attributes of differing types. Note that enforcing that the target of the alias has values means that the aliased attribute is of the correct type: integer, etc. Modified files: File: radiusd/src/lib/dict.c; Revision: 1.91; Date: 2006/07/28 21:46:11; Author: aland; Lines: (+44 -38) ===================================================== Summary of modified files ===================================================== File: radiusd/src/include/libradius.h Revisions: 1.123 Authors: aland (+4 -1) ------------------------------- File: radiusd/src/include/radius.h Revisions: 1.82 Authors: aland (+3 -1) ------------------------------- File: radiusd/src/lib/dict.c Revisions: 1.91, 1.90 Authors: aland (+44 -38), aland (+179 -10) ------------------------------- File: radiusd/src/lib/print.c Revisions: 1.43 Authors: aland (+4 -2) ------------------------------- File: radiusd/src/lib/radius.c Revisions: 1.186 Authors: aland (+31 -2) ------------------------------- File: radiusd/src/lib/valuepair.c Revisions: 1.110 Authors: aland (+69 -2) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Passing NAS-Identifier for radius generated stop packets.
by Matthew Schumacher 28 Jul '06

28 Jul '06

List, My radius system uses the NAS-Identifer attribute to make some decisions on how to log or record utmp records. Everything works fine until I have a situation where freeradius generates a stop packet in the session_zap function. Because the stop packet doesn't have the NAS-Identifier attribute it breaks the way I log things. I started hacking together a patch that would pass the NAS-Identifier of the access-request packet, but it doesn't work. Can someone take a look at my patch, or perhaps suggest a better work around? Thanks, schu diff -ruN freeradius-1.1.2.orig/src/include/radiusd.h freeradius-1.1.2/src/include/radiusd.h --- freeradius-1.1.2.orig/src/include/radiusd.h 2005-04-11 15:45:21.000000000 -0800 +++ freeradius-1.1.2/src/include/radiusd.h 2006-07-27 15:02:45.000000000 -0800 @@ -293,7 +293,7 @@ int session_zap(REQUEST *request, uint32_t nasaddr, unsigned int port, const char *user, const char *sessionid, uint32_t cliaddr, - char proto); + char proto, char nas_ident); /* radiusd.c */ #ifndef _LIBRADIUS diff -ruN freeradius-1.1.2.orig/src/main/session.c freeradius-1.1.2/src/main/session.c --- freeradius-1.1.2.orig/src/main/session.c 2006-03-24 08:54:57.000000000 -0900 +++ freeradius-1.1.2/src/main/session.c 2006-07-27 15:02:45.000000000 -0800 @@ -46,7 +46,7 @@ /* End a session by faking a Stop packet to all accounting modules */ int session_zap(REQUEST *request, uint32_t nasaddr, unsigned int port, const char *user, - const char *sessionid, uint32_t cliaddr, char proto) + const char *sessionid, uint32_t cliaddr, char proto, char nas_ident) { REQUEST *stopreq; VALUE_PAIR *vp, *userpair; @@ -103,6 +103,8 @@ INTPAIR(PW_ACCT_INPUT_PACKETS, 0); INTPAIR(PW_ACCT_OUTPUT_PACKETS, 0); + INTPAIR(PW_NAS_IDENTIFIER, nas_ident); + stopreq->username = userpair; stopreq->password = NULL; diff -ruN freeradius-1.1.2.orig/src/modules/rlm_radutmp/rlm_radutmp.c freeradius-1.1.2/src/modules/rlm_radutmp/rlm_radutmp.c --- freeradius-1.1.2.orig/src/modules/rlm_radutmp/rlm_radutmp.c 2004-02-26 10:04:34.000000000 -0900 +++ freeradius-1.1.2/src/modules/rlm_radutmp/rlm_radutmp.c 2006-07-27 15:03:17.000000000 -0800 @@ -589,6 +589,7 @@ rlm_radutmp_t *inst = instance; char login[256]; char filename[1024]; + char nas_ident; /* * Get the filename, via xlat. @@ -656,6 +657,8 @@ ipno = vp->lvalue; if ((vp = pairfind(request->packet->vps, PW_CALLING_STATION_ID)) != NULL) call_num = vp->strvalue; + if ((vp = pairfind(request->packet->vps, PW_NAS_IDENTIFIER)) != NULL) + nas_ident = vp->strvalue; /* * lock the file while reading/writing. @@ -736,7 +739,7 @@ session_zap(request, u.nas_address, u.nas_port, login, session_id, u.framed_address, - u.proto); + u.proto, nas_ident); } } } diff -ruN freeradius-1.1.2.orig/src/modules/rlm_sql/rlm_sql.c freeradius-1.1.2/src/modules/rlm_sql/rlm_sql.c --- freeradius-1.1.2.orig/src/modules/rlm_sql/rlm_sql.c 2006-05-20 04:44:37.000000000 -0800 +++ freeradius-1.1.2/src/modules/rlm_sql/rlm_sql.c 2006-07-27 15:03:46.000000000 -0800 @@ -1132,6 +1132,7 @@ int ret; uint32_t nas_addr = 0; int nas_port = 0; + char nas_ident; /* If simul_count_query is not defined, we don't do any checking */ if (inst->config->simul_count_query[0] == 0) { @@ -1207,7 +1208,8 @@ ipno = vp->lvalue; if ((vp = pairfind(request->packet->vps, PW_CALLING_STATION_ID)) != NULL) call_num = vp->strvalue; - + if ((vp = pairfind(request->packet->vps, PW_NAS_IDENTIFIER)) != NULL) + nas_ident = vp->strvalue; while (rlm_sql_fetch_row(sqlsocket, inst) == 0) { row = sqlsocket->row; @@ -1271,7 +1273,7 @@ session_zap(request, nas_addr,nas_port,row[2],row[1], - framed_addr, proto); + framed_addr, proto, nas_ident); } }

1 1

rlm_dbm with empty check and reply items
by Gabriel L. Somlo 28 Jul '06

28 Jul '06

Alan & all, I want to use rlm_dbm for authorization with no check or reply items. A user is authorized if he is listed in the dbm database, and not authorized if not present: modules { ... dbm { usersfile = ${confdir}/users.dbm } ... } ... authorize { ... dbm { notfound = reject } } So, what I need is a dbm file which has "empty" content associated with each username key. "Empty" actually means a "\n\n" string (first '\n' for no check items, second one for no reply items). I can create such a database by calling dbm routines from my own C code, and it works fine with the radiusd.conf excerpt above. HOWEVER, I would like to use the rlm_dbm_parser binary included with the freeradius package. The trouble is, this code checks for the length of each content record before inserting into the dbm file, and refuses to do so unless the record is more than 3 characters long (rlm_dbm_parser.c, line 158, inside function 'static int storecontent' as per freeradius-snapshot-20060728): static int storecontent (const char * username) { datum d,k; int res; if ( pdb == NULL || concntr < 3 ) return 1; /* ^^^^^^^^^^^^^^ */ DOUT2("store:\n%s\ncontent:\n%s",username,content); d.dptr = content; ... Is there a known good reason why this code wants length >=3, or why it prevents check items and reply items from being empty at the same time ? If yes, inquiring minds want to know :) If not, please apply the attached patch, which modifies the check from < 3 to < 2, allowing "empty" keys to be stored in the dbm. Thanks much, Gabriel

1 0

Firebird sql driver for rlm_sql module
by Vitaly Bodzhgua 28 Jul '06

28 Jul '06

I wrote rlm_sql_firebird driver for rlm_sql module. This driver may work only with Firebird version 1.5.0 and higher, but with small modification (using linker option -lgds instead of -lfbclient) it may be used with lower version of Firebird and Interbase as well. Driver was tested with freeradius 1.0.5 and Firebird 1.5.2 for a month. Also it appeared to work with all stable freeradius versions starting with 1.0.5. So I can contribute the source code if one , who can make such decisions, decides that it is will be not unnecessary for freeradius project.

2 1

freeradius and openssl exception
by Stephen Gran 27 Jul '06

27 Jul '06

Hello all, I'm sorry in advance if this is something that has already been discussed to death. I have been googling around, and I do see some discussion about an openssl exception that took place in 2005, but I don't see any resolution, nor do I see any actual exception in COPYING. Is this something, first of all, that people are either interested in or amenable to? If so, has any progress been made? I ask all this because I recently took over comaintenance of the package for Debian, and there are several modules that we can't ship precompiled right now, as I understand it (eap being the most common, but for some reason postgres is also currently disabled - that needs seperate investigation). If no progress has been made, I would be willing to do some of the leg work sending around a sort of form email to contributors asking for an exception, or whatever you all thought was the best way of handling this. Of course, if you're not agreeable, I guess we just stop here - no hard feelings, but it means back to the drawing board for a gnutls solution or some shim layer. Take care, -- -------------------------------------------------------------------------- | Stephen Gran | Just because you're paranoid doesn't | | steve(a)lobefin.net | mean they AREN'T after you. | | http://www.lobefin.net/~steve | | --------------------------------------------------------------------------

3 7

Automatic report from sources (radiusd) between 26.07.2006 - 27.07.2006 GMT
by Automatic cvs log generator 27 Jul '06

27 Jul '06

CVS log entries from 26.07.2006 (Wed) 08:00:01 - 27.07.2006 (Thu) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/share/dictionary.tropos; Revisions: 1.1, 1.1.2.2, 1.1.2.1 File: radiusd/share/dictionary.walabi; Revisions: 1.1.2.2 File: radiusd/share/dictionary.riverstone; Revisions: 1.1.2.2 File: radiusd/share/dictionary; Revisions: 1.132, 1.93.2.5.2.5 File: radiusd/share/dictionary.alvarion; Revisions: 1.1.2.2 ===================================================== Combined list of identical log entries ===================================================== Description: Merged from CVS head Modified files: File: radiusd/share/dictionary; Revision: 1.93.2.5.2.5; Date: 2006/07/26 23:00:19; Author: aland; Lines: (+5 -1) File: radiusd/share/dictionary.alvarion; Revision: 1.1.2.2; Date: 2006/07/26 23:00:19; Author: aland; Lines: (+310 -0) File: radiusd/share/dictionary.riverstone; Revision: 1.1.2.2; Date: 2006/07/26 23:00:20; Author: aland; Lines: (+42 -0) File: radiusd/share/dictionary.tropos; Revision: 1.1.2.2; Date: 2006/07/26 23:00:20; Author: aland; Lines: (+52 -0) File: radiusd/share/dictionary.walabi; Revision: 1.1.2.2; Date: 2006/07/26 23:00:20; Author: aland; Lines: (+28 -0) ------------------------------- Description: As posted to the list Modified files: File: radiusd/share/dictionary; Revision: 1.132; Date: 2006/07/26 22:57:30; Author: aland; Lines: (+2 -1) File: radiusd/share/dictionary.tropos; Revision: 1.1; Date: 2006/07/26 22:57:30; Author: aland; ===================================================== Log entries ===================================================== Description: file dictionary.tropos was added on branch branch_1_1 on 2006-07-26 23:00:20 +0000 Modified files: File: radiusd/share/dictionary.tropos; Revision: 1.1.2.1; Date: 2006/07/26 22:57:30; Author: aland; Lines: (+0 -52) ===================================================== Summary of modified files ===================================================== File: radiusd/share/dictionary Revisions: 1.132, 1.93.2.5.2.5 Authors: aland (+2 -1), aland (+5 -1) ------------------------------- File: radiusd/share/dictionary.alvarion Revisions: 1.1.2.2 Authors: aland (+310 -0) ------------------------------- File: radiusd/share/dictionary.riverstone Revisions: 1.1.2.2 Authors: aland (+42 -0) ------------------------------- File: radiusd/share/dictionary.tropos Revisions: 1.1, 1.1.2.2, 1.1.2.1 Authors: aland, aland (+52 -0), aland (+0 -52) ------------------------------- File: radiusd/share/dictionary.walabi Revisions: 1.1.2.2 Authors: aland (+28 -0) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0