July 2006 - Freeradius-Devel - lists.freeradius.org

patch for Tropos dictionary
by Rick Dean 26 Jul '06

26 Jul '06

Please accept this patch for a dictionary of Tropos's VSA. -- Rick Dean Tropos Networks

2 1

RE: rlm_ippool and tcp TIME_WAIT state
by Sebastien Cantos 25 Jul '06

25 Jul '06

Hi, Ive coded a little patch for 1.1.2. If someone is interested in this and has some time to test (Ive done lots of tests using radclient) it may be interesting to include the patch in the CVS. Regards, Sebastien. _____ De : Sebastien Cantos [mailto:s.cantos@neopost.com] Envoyé : mercredi 19 juillet 2006 14:17 À : 'freeradius-devel(a)lists.freeradius.org.' Objet : rlm_ippool and tcp TIME_WAIT state Hi, Ive already posted this to the users mailing list, but I think that here is a best place for this. Ive noticed that rlm_ippool is nearly always reassigning an IP address that has just been releasing for a new connexion. This causes some TCP connexion problems because of the TIME_WAIT state. Scenario: 1/ one device connects using source port 1024 (ppp) and gets an IP address from freeradius 2/ this device disconnects, the ip is freed from the pool 3/ another devices connects using source port 1024 and gets the same ip address as before 4/ the connexion is impossible to the server because the connexion of last device is still in TIME_WAIT state How can I make sure an IP address is not assigned before some time period (240 seconds, time period of the TIME_WAIT state) after being released? I got one answer : >Interesting. >The IPs are allocated by a GDBM walk of the database, and use of the first free or expired IP. This will always tend to be the same one hence the repeat >allocations. >It would in theory be possible to save the key from the last walk, and next time we allocate an IP start from that key and wrap back around, which would >allocate IPs in a more round-robin fashion. I would appreciate if someone can help doing the hack or give me some hints to modify rlm_ippool.c to add some retention time parameter to make sure an ip is not reassigned instantly after being freed or to make things work more in a random or round robin way. Thanks in advance. Regards, Sebastien.

2 1

ntpasswd not UTF-8 safe?
by Josh Howlett 25 Jul '06

25 Jul '06

I don't think that the ntpasswd function in smbencrypt.c is safe with multi-byte character encodings, such as UTF-8. I think that the problem is in the conversion of the password to Unicode, for the construction of the NT hash. The function assumes a single-byte character-set encoding (which works fine for Latin1, etc) but not for multi-byte encodings such as UTF-8. I'm not quite sure what the best approach to fix this is; does anyone have any suggestions? best regards, josh. Josh Howlett, Networking Specialist, University of Bristol. email: josh.howlett(a)bristol.ac.uk | phone: +44 (0)7867 907076 | internal: 7850

3 6

Automatic report from sources (radiusd) between 24.07.2006 - 25.07.2006 GMT
by Automatic cvs log generator 25 Jul '06

25 Jul '06

CVS log entries from 24.07.2006 (Mon) 08:00:04 - 25.07.2006 (Tue) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/lib/radius.c; Revisions: 1.185, 1.184 ===================================================== Log entries ===================================================== Description: More checks for diameter length Modified files: File: radiusd/src/lib/radius.c; Revision: 1.185; Date: 2006/07/24 23:08:44; Author: aland; Lines: (+8 -6) ------------------------------- Description: Decode multiple Diameter attributes from inside one or more Extended-Attributes. It's inefficient (i.e. copying data to yet another buffer on the stack), but it works, and handles pretty much anything we can throw at it. Modified files: File: radiusd/src/lib/radius.c; Revision: 1.184; Date: 2006/07/24 21:53:08; Author: aland; Lines: (+204 -78) ===================================================== Summary of modified files ===================================================== File: radiusd/src/lib/radius.c Revisions: 1.185, 1.184 Authors: aland (+8 -6), aland (+204 -78) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Testing...
by Alan DeKok 24 Jul '06

24 Jul '06

Quiet list.. Alan DeKok.

4 5

build error
by Peter Nixon 21 Jul '06

21 Jul '06

Hi Guys When I build on the openSUSE Build Service I get the following errors scattered throughout the build (On all SUSE versions) but the build continues, but doesnt make anu .so files. /usr/src/packages/BUILD/freeradius-1.1.2/libtool --mode=link gcc -release 1.1.2 \ -module -export-dynamic -o rlm_eap_tls.la \ -rpath /usr/lib/freeradius rlm_eap_tls.lo rlm_eap_tls.c /usr/src/packages/BUILD/freeradius-1.1.2/src/lib/libradius.la \ ../../libeap/libeap.la -lcrypto -lssl -lcrypto -lnsl -lresolv -lpthread rm -fr .libs/rlm_eap_tls.la .libs/rlm_eap_tls.* .libs/rlm_eap_tls-1.1.2.* *** Warning: This library needs some functionality provided by -lcrypto. *** I have the capability to make that library automatically link in when *** you link to this library. But I can only do this if you have a *** shared version of the library, which you do not appear to have. *** Warning: This library needs some functionality provided by -lssl. *** I have the capability to make that library automatically link in when *** you link to this library. But I can only do this if you have a *** shared version of the library, which you do not appear to have. *** Warning: This library needs some functionality provided by -lcrypto. *** I have the capability to make that library automatically link in when *** you link to this library. But I can only do this if you have a *** shared version of the library, which you do not appear to have. *** Warning: This library needs some functionality provided by -lnsl. *** I have the capability to make that library automatically link in when *** you link to this library. But I can only do this if you have a *** shared version of the library, which you do not appear to have. *** Warning: This library needs some functionality provided by -lresolv. *** I have the capability to make that library automatically link in when *** you link to this library. But I can only do this if you have a *** shared version of the library, which you do not appear to have. *** Warning: This library needs some functionality provided by -lpthread. *** I have the capability to make that library automatically link in when *** you link to this library. But I can only do this if you have a *** shared version of the library, which you do not appear to have. *** Warning: libtool could not satisfy all declared inter-library *** dependencies of module rlm_eap_tls. Therefore, libtool will create *** a static module, that should work as long as the dlopening *** application is linked with the -dlopen flag. ar cru .libs/rlm_eap_tls.a rlm_eap_tls.o ranlib .libs/rlm_eap_tls.a When I build locally I dont get the same errors so, does anyone know what dependency I am missing on the build service? I currently specify (plus base system): BuildRequires: cyrus-sasl-devel BuildRequires: db-devel BuildRequires: e2fsprogs-devel BuildRequires: gcc-c++ BuildRequires: gdbm-devel BuildRequires: gettext-devel BuildRequires: glibc-devel BuildRequires: libtool BuildRequires: mysql-devel BuildRequires: ncurses-devel BuildRequires: openldap2-devel BuildRequires: openssl-devel BuildRequires: pam-devel BuildRequires: perl BuildRequires: postgresql-devel BuildRequires: python-devel BuildRequires: sed BuildRequires: unixODBC-devel BuildRequires: zlib-devel TIA -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

2 1

Session-Timeout & h323-credit-time Difference
by Akhnukh 20 Jul '06

20 Jul '06

Hi, Please anyone tell me exact difference between Session-Timeout attribute and VSA credit-time attribute. According to RFC both definitions looks same. Please specify difference. Thanks -- View this message in context: http://www.nabble.com/Session-Timeout---h323-credit-time-Difference-tf19718… Sent from the FreeRadius - Dev forum at Nabble.com.

2 1

rlm_ippool and tcp TIME_WAIT state
by Sebastien Cantos 19 Jul '06

19 Jul '06

Hi, I've already posted this to the user's mailing list, but I think that here is a best place for this. I've noticed that rlm_ippool is nearly always reassigning an IP address that has just been releasing for a new connexion. This causes some TCP connexion problems because of the TIME_WAIT state. Scenario: 1/ one device connects using source port 1024 (ppp) and gets an IP address from freeradius 2/ this device disconnects, the ip is freed from the pool 3/ another devices connects using source port 1024 and gets the same ip address as before 4/ the connexion is impossible to the server because the connexion of last device is still in TIME_WAIT state How can I make sure an IP address is not assigned before some time period (240 seconds, time period of the TIME_WAIT state) after being released? I got one answer : >Interesting. >The IPs are allocated by a GDBM walk of the database, and use of the first free or expired IP. This will always tend to be the same one hence the repeat >allocations. >It would in theory be possible to save the key from the last walk, and next time we allocate an IP start from that key and wrap back around, which would >allocate IPs in a more round-robin fashion. I would appreciate if someone can help doing the hack or give me some hints to modify rlm_ippool.c to add some retention time parameter to make sure an ip is not reassigned instantly after being freed or to make things work more in a random or round robin way. Thanks in advance. Regards, Sebastien.

2 1

RE: Last set of changes for 1.1.3
by Sandworm 15 Jul '06

15 Jul '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > Are there any other issues we need to fix before 1.1.3? RPM spec > file fixes? The RPM Spec fixes that have been discussed on the list several times (unpackaged files, etc) could be added. Diff from previous messages attached for your reference. $ diff -u /usr/src/redhat/SPECS/freeradius.spec freeradius.spec.orig - - - --- /usr/src/redhat/SPECS/freeradius.spec 2006-04-09 18:26:53.000000000 +1000 +++ freeradius.spec.orig 2006-02-13 02:54:56.000000000 +1100 @@ -23,8 +23,6 @@ %prep %setup - - - -sed -i "s@doc/freeradius@doc/freeradius-%{version}@" doc/Makefile doc/examples/Makefile doc/rfc/Makefile - - - - %build CFLAGS="$RPM_OPT_FLAGS" \ %configure --prefix=%{_prefix} \ @@ -101,14 +99,7 @@ %files %defattr(-,root,root) - - - -%doc doc/Acct-Type doc/Autz-Type doc/CYGWIN doc/ChangeLog doc/DIFFS doc/MACOSX - - - -%doc doc/OS2 doc/Post-Auth-Type doc/RADIUS-LDAP-eDirectory doc/RADIUS-SQL.schema - - - -%doc doc/README doc/Session-Type doc/Simultaneous-Use doc/aaa.txt doc/ascend - - - -%doc doc/bay doc/bugs doc/cisco doc/coding-methods.txt doc/configurable_failover - - - -%doc doc/duplicate-users doc/ldap_howto.txt doc/load- balance.txt doc/misc-nas - - - -%doc doc/module_interface doc/mssql doc/performance-testing doc/processing_users_file - - - -%doc doc/proxy doc/radrelay doc/release-method.txt doc/rfc/ doc/rlm* doc/supervise-radiusd.txt - - - -%doc doc/tuning_guide doc/variables.txt todo/ COPYRIGHT INSTALL +%doc doc/ChangeLog doc/README* todo/ COPYRIGHT INSTALL %config /etc/pam.d/radius %config /etc/logrotate.d/radiusd %config /etc/rc.d/init.d/radiusd -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.5 wkYEARECAAYFAkStm1MACgkQmw4BJyaatJ2+7wCgrgRxv/4ieXR/0/rsTNNaBzNO67gA n2H07LeL1kKwvr8TKlU5d/H2moc2 =CArD -----END PGP SIGNATURE-----

4 3

Problem with change of shared secret
by Vishwanath Srikant Pattanshetti 14 Jul '06

14 Jul '06

All I am using FreeRADIUS 1.1.0 with Oracle 10. Am storing the clients data in database table 'nas' When I change the shared secret entry in this table the RADIUS server which is Already running does not seem to pick this change, and I get an error saying invalid Authenticator - however this problem does not occur if I restart the RADIUS server. Is there a way I can make the RADIUS server pick up changes to the 'nas' table dynamically? Any help would be a great help. -vishwa.

1 0