September 2006 - Freeradius-Devel - lists.freeradius.org

How to make freeradius listen on IPv6 address?
by 高嵩 26 Sep '06

26 Sep '06

Hi,all. Now I'm using freeradius v1.0.4,it seems that the version i'm using cann't support IPv6 .Can you tell me how can i make my freeradius listen on IPv6 address? Thank you very much:)

2 1

problem linking auth module to freeradius functions
by kky 26 Sep '06

26 Sep '06

Hi, I'm developing an auth module based on eap outside of the FreeRADIUS environment and I'm having some problems linking freeRadius functions to my module ! this is the output of gcc : gcc -g -o rlm_eap_xxx-1.1.3.so -DNDEBUG -Wall -I/tmp/freeradius-1.1.3/src/include -I/tmp/freeradius-1.1.3/src/modules/rlm_eap -I/tmp/freeradius-1.1.3/src/modules/rlm_eap/libeap -I/tmp/freeradius-1.1.3/src/lib -I/home/ns/rlm_eap_xxx -I/usr/local/include -I/usr/local/lib -I/usr/include -L/tmp/freeradius-1.1.3/src/lib -L/usr/local/lib -lgcrypt -L/usr/local/lib -lgpg-error rlm_eap_xxx.o eap_xxx.o crypto_xxx.o /usr/lib/crt1.o(.text+0x18): In function `_start': ../sysdeps/i386/elf/start.S:115: undefined reference to `main' rlm_eap_xxx.o(.text+0x9): In function `xxx_initiate': /home/ns/rlm_eap_xxx/rlm_eap_xxx.c:55: undefined reference to `debug_flag' rlm_eap_xxx.o(.text+0x1a):/home/ns/rlm_eap_xxx/rlm_eap_xxx.c:55: undefined reference to `log_debug' (THIS LINE IS CALLING DEBUG2(....)) rlm_eap_xxx.o(.text+0x6f):/home/ns/rlm_eap_xxx/rlm_eap_xxx.c:72: undefined reference to `radlog' ( this line calls radlog(L_ERR, "rlm_eap_xxx: out of memory");) rlm_eap_xxx.o(.text+0xc2):/home/ns/rlm_eap_xxx/rlm_eap_xxx.c:88: undefined reference to `radlog' ( this line calls radlog(...)) rlm_eap_xxx.o(.text+0x14e):/home/ns/rlm_eap_xxx/rlm_eap_xxx.c:114: undefined reference to `debug_flag' (THIS LINE IS CALLING DEBUG2(....)) rlm_eap_xxx.o(.text+0x15f):/home/ns/rlm_eap_xxx/rlm_eap_xxx.c:114: undefined reference to `log_debug' rlm_eap_xxx.o(.text+0x180): In function `xxx_authenticate': /home/ns/rlm_eap_xxx/rlm_eap_xxx.c:124: undefined reference to `debug_flag' rlm_eap_xxx.o(.text+0x191):/home/ns/rlm_eap_xxx/rlm_eap_xxx.c:124: undefined reference to `log_debug' DEBUG2() rlm_eap_xxx.o(.text+0x1bd):/home/ns/rlm_eap_xxx/rlm_eap_xxx.c:146: undefined reference to `radlog' radlog() rlm_eap_xxx.o(.text+0x29c):/home/ns/rlm_eap_xxx/rlm_eap_xxx.c:168: undefined reference to `radlog' rlm_eap_xxx.o(.text+0x2df):/home/ns/rlm_eap_xxx/rlm_eap_xxx.c:173: undefined reference to `radlog' rlm_eap_xxx.o(.text+0x2fc):/home/ns/rlm_eap_xxx/rlm_eap_xxx.c:180: undefined reference to `debug_flag' rlm_eap_xxx.o(.text+0x30d):/home/ns/rlm_eap_xxx/rlm_eap_xxx.c:180: undefined reference to `log_debug' rlm_eap_xxx.o(.text+0x329):/home/ns/rlm_eap_xxx/rlm_eap_xxx.c:182: undefined reference to `pairmake' THIS LINE CALLS pairmake() rlm_eap_xxx.o(.text+0x346):/home/ns/rlm_eap_xxx/rlm_eap_xxx.c:184: undefined reference to `radlog' rlm_eap_xxx.o(.text+0x36d):/home/ns/rlm_eap_xxx/rlm_eap_xxx.c:188: undefined reference to `pairadd' rlm_eap_xxx.o(.text+0x386):/home/ns/rlm_eap_xxx/rlm_eap_xxx.c:194: undefined reference to `pairfind' rlm_eap_xxx.o(.text+0x3a3):/home/ns/rlm_eap_xxx/rlm_eap_xxx.c:206: undefined reference to `radlog' eap_xxx.o(.text+0x2b): In function `eapxxx_alloc': /home/ns/rlm_eap_xxx/eap_xxx.c:71: undefined reference to `radlog' eap_xxx.o(.text+0x17b): In function `eapxxx_extract': /home/ns/rlm_eap_xxx/eap_xxx.c:133: undefined reference to `radlog' eap_xxx.o(.text+0x24c):/home/ns/rlm_eap_xxx/eap_xxx.c:200: undefined reference to `radlog' eap_xxx.o(.text+0x36a): In function `eapxxx_compose': /home/ns/rlm_eap_xxx/eap_xxx.c:289: undefined reference to `radlog' eap_xxx.o(.text+0x4a9):/home/ns/rlm_eap_xxx/eap_xxx.c:340: more undefined references to `radlog' follow eap_xxx.o(.text+0x4d9): In function `xxx_msg1': /home/ns/rlm_eap_xxx/eap_xxx.c:349: undefined reference to `lrad_rand' eap_xxx.o(.text+0x4fe):/home/ns/rlm_eap_xxx/eap_xxx.c:351: undefined reference to `radlog' eap_xxx.o(.text+0x530):/home/ns/rlm_eap_xxx/eap_xxx.c:355: undefined reference to `radlog' eap_xxx.o(.text+0x626): In function `xxx_msg3': /home/ns/rlm_eap_xxx/eap_xxx.c:396: undefined reference to `radlog' eap_xxx.o(.text+0x656):/home/ns/rlm_eap_xxx/eap_xxx.c:402: undefined reference to `radlog' collect2: ld returned 1 exit status make: *** [rlm_eap_xxx-1.1.3.so] Error 1 in rlm_eap_xxx.c I'm including : #include <radiusd.h> , suggestions ? thank you ! kky

2 1

Crash in proxy code
by Tuyan Ozipek 26 Sep '06

26 Sep '06

Hi all, i am using the latest cvs that i checked out a few minutes ago, with a basic setup with tuyan Proxy-To-Realm := radius in users file, and a proxy realm in proxy.conf for server called "radius", i ended up having a crash. Note that there is no server running on the ip that i put in the proxy.conf.. Here is the gdb trace Tue Sep 26 12:38:52 2006 : Debug: modcall: group authorize returns noop for request 0 Tue Sep 26 12:38:52 2006 : Debug: proxy: allocating destination 192.168.4.52 port 1645 - Id 239 Sending Access-Request of id 239 to 192.168.4.52 port 1645 User-Name = "tuyan" User-Password = "tuyan" NAS-IP-Address = 192.168.4.100 NAS-Port = 654645 Proxy-State = 0x313733 Tue Sep 26 12:38:52 2006 : Error: Assertion failed in listen.c, line 620 Program received signal SIGABRT, Aborted. [Switching to Thread -1246864480 (LWP 20387)] 0xffffe410 in __kernel_vsyscall () (gdb) thread apply all bt full Thread 6 (Thread -1246864480 (LWP 20387)): #0 0xffffe410 in __kernel_vsyscall () No symbol table info available. #1 0xb7b477d0 in raise () from /lib/libc.so.6 No symbol table info available. #2 0xb7b48ea3 in abort () from /lib/libc.so.6 No symbol table info available. #3 0x08061c2b in rad_assert_fail (file=0x8065f5d "listen.c", line=620) at util.c:347 No locals. #4 0x08053a8e in proxy_socket_send (listener=0x814f130, request=0x815d3b0) at listen.c:620 sock = (listen_socket_t *) 0x814f160 #5 0x0806147e in request_handler_thread (arg=0x815d1f8) at threads.c:520 finished = 0 fun = (RAD_REQUEST_FUNP) 0x804d570 <rad_authenticate> set = {__val = {16391, 0 <repeats 31 times>}} #6 0xb7eb734b in start_thread () from /lib/libpthread.so.0 No symbol table info available. #7 0xb7bdc65e in clone () from /lib/libc.so.6 No symbol table info available. Thread 5 (Thread -1238471776 (LWP 20386)): #0 0xffffe410 in __kernel_vsyscall () No symbol table info available. #1 0xb7ebc75f in sem_wait(a)GLIBC_2.0 () from /lib/libpthread.so.0 No symbol table info available. #2 0x0806110e in request_handler_thread (arg=0x815d140) at threads.c:464 finished = -1238473764 fun = (RAD_REQUEST_FUNP) 0 set = {__val = {16391, 0 <repeats 31 times>}} #3 0xb7eb734b in start_thread () from /lib/libpthread.so.0 No symbol table info available. #4 0xb7bdc65e in clone () from /lib/libc.so.6 No symbol table info available. Thread 4 (Thread -1230079072 (LWP 20385)): #0 0xffffe410 in __kernel_vsyscall () No symbol table info available. #1 0xb7ebc75f in sem_wait(a)GLIBC_2.0 () from /lib/libpthread.so.0 No symbol table info available. #2 0x0806110e in request_handler_thread (arg=0x815d088) at threads.c:464 finished = -1230081060 fun = (RAD_REQUEST_FUNP) 0 set = {__val = {16391, 0 <repeats 31 times>}} #3 0xb7eb734b in start_thread () from /lib/libpthread.so.0 No symbol table info available. #4 0xb7bdc65e in clone () from /lib/libc.so.6 No symbol table info available. Thread 3 (Thread -1221686368 (LWP 20384)): #0 0xffffe410 in __kernel_vsyscall () No symbol table info available. #1 0xb7ebc75f in sem_wait(a)GLIBC_2.0 () from /lib/libpthread.so.0 No symbol table info available. #2 0x0806110e in request_handler_thread (arg=0x815cfd0) at threads.c:464 finished = -1221688356 ---Type <return> to continue, or q <return> to quit--- fun = (RAD_REQUEST_FUNP) 0 set = {__val = {16391, 0 <repeats 31 times>}} #3 0xb7eb734b in start_thread () from /lib/libpthread.so.0 No symbol table info available. #4 0xb7bdc65e in clone () from /lib/libc.so.6 No symbol table info available. Thread 2 (Thread -1213293664 (LWP 20383)): #0 0xffffe410 in __kernel_vsyscall () No symbol table info available. #1 0xb7ebc75f in sem_wait(a)GLIBC_2.0 () from /lib/libpthread.so.0 No symbol table info available. #2 0x0806110e in request_handler_thread (arg=0x815cf18) at threads.c:464 finished = -1213295652 fun = (RAD_REQUEST_FUNP) 0x1000000 set = {__val = {16391, 0 <repeats 31 times>}} #3 0xb7eb734b in start_thread () from /lib/libpthread.so.0 No symbol table info available. #4 0xb7bdc65e in clone () from /lib/libc.so.6 No symbol table info available. Thread 1 (Thread -1213077840 (LWP 20380)): #0 0xffffe410 in __kernel_vsyscall () No symbol table info available. #1 0xb7bd5d11 in ___newselect_nocancel () from /lib/libc.so.6 No symbol table info available. #2 0x0805c16f in main (argc=3, argv=0xbfaa3604) at radiusd.c:596 tv = {tv_sec = 0, tv_usec = 992000} request = (REQUEST *) 0x815d358 buffer = "* port 1814", '\0' <repeats 633 times>, "I\uffff\uffff \uffff\uffff\003\uffff\uffff\uffff\uffff\uffff\uffff\uffff\177\uffff \uffff \203\uffff\uffff\000\000\000\000d)\uffff\uffff\uffffO\uffff \uffff", '\0' <repeats 24 times>, "\uffff\003\uffff\uffff\000\000\000 \000 \200\uffff\uffff", '\0' <repeats 13 times>, "\uffff÷", '\0' <repeats 48 times>, "I\uffff\uffff\uffff7\b\u0137\uffff\uffff\uffff \uffff\uffff\177\uffff\uffff \203\uffff\uffff\000\000\000\000 \uffff)\uffff\uffff\uffffO\uffff\uffff-\b\u0137E\b\u0137", '\0' <repeats 16 times>, "7\b\u0137\000\000\000\000 \200\uffff\uffff", '\0' <repeats 12 times>, "\uffffl\uffff\uffff", '\0' <repeats 20 times>, "E\b\u0137", '\0' <repeats 28 times>, "I\uffff"... readfds = {__fds_bits = {448, 0 <repeats 31 times>}} argval = <value optimized out> pid = <value optimized out> max_fd = <value optimized out> status = <value optimized out> sleep_time = 1 spawn_flag = 1 dont_fork = 1 last_cleaned_lists = <value optimized out> act = {__sigaction_handler = {sa_handler = 0x805c700 <sig_fatal>, sa_sigaction = 0x805c700 <sig_fatal>}, sa_mask = {__val = { 0 <repeats 32 times>}}, sa_flags = 0, sa_restorer = 0} listener = <value optimized out> #0 0xffffe410 in __kernel_vsyscall () (gdb) Cheers -- Tuyan Ozipek <tuyan(a)suntel.com.tr>

1 0

RE: rfc4590
by Alexander Schrab 25 Sep '06

25 Sep '06

Well, not really. That is the most simple way of doing it. But there are several other ways that are better. One possible idea is to use part of the nonce as a signature of the rest of the nonce. And part of the nonce can be a time stamp. This way the impact of replay attacks and DoS attacks can be minimized. Anyhow, you can do it a lot more complicated than random :) /Alex > -----Original Message----- > From: > freeradius-devel-bounces+alexander.schrab=axis.com(a)lists.freer > adius.org > [mailto:freeradius-devel-bounces+alexander.schrab=axis.com@lis > ts.freeradius.org] On Behalf Of Alan DeKok > Sent: den 22 september 2006 18:08 > To: FreeRadius developers mailing list > Subject: Re: rfc4590 > > > Alexander Schrab <Alexander.Schrab(a)axis.com> wrote: > > Oh yeah, I have not implemented challange. This is because it was a > > bigger task than I expected. We need a nonce creation algorithm, > > methods for calculating body digest and a few more things. > Can do that > > later, the code is prepared for implementing that feature... > > The nonce creation is simply calls to lrad_rand(). > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/devel.html >

2 1

Configurable Logging
by Peter Nixon 23 Sep '06

23 Sep '06

Hi Guys We are about to start work on a patch to allow FreeRADIUS to do configurable logging for certain events. The plan is to allow Auth OK, Auth Fail, and similar events via a proxy to be configured. This will be configurable in the following manner (Similar to SQL queries): log-auth-login-ok= "Auth: Login OK: [%{User-Name}] (from client %{Client-Ip-Address} port %{NAS-Port} cli %{Calling-Station-Id} did %{Called-Station-Id})" Does anyone have anything to contribute before we start? Cheers -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

4 5

Automatic report from sources (radiusd) between 22.09.2006 - 23.09.2006 GMT
by Automatic cvs log generator 23 Sep '06

23 Sep '06

CVS log entries from 22.09.2006 (Fri) 08:00:01 - 23.09.2006 (Sat) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: pnixon File: radiusd/doc/examples/postgresql.sql; Revisions: 1.7 File: radiusd/doc/examples/postgresql_update_radacct_group_trigger.sql; Revisions: 1.2 File: radiusd/doc/examples/oracle.sql; Revisions: 1.4 File: radiusd/doc/examples/mysql.sql; Revisions: 1.4 File: radiusd/raddb/sql.conf; Revisions: 1.56 File: radiusd/doc/examples/mssql.sql; Revisions: 1.4 File: radiusd/src/modules/rlm_sql/rlm_sql.c; Revisions: 1.160 ===================================================== Combined list of identical log entries ===================================================== Description: Rename table for consistency Modified files: File: radiusd/doc/examples/mssql.sql; Revision: 1.4; Date: 2006/09/22 12:26:21; Author: pnixon; Lines: (+8 -8) File: radiusd/doc/examples/mysql.sql; Revision: 1.4; Date: 2006/09/22 12:26:21; Author: pnixon; Lines: (+3 -3) File: radiusd/doc/examples/oracle.sql; Revision: 1.4; Date: 2006/09/22 12:26:21; Author: pnixon; Lines: (+7 -7) File: radiusd/doc/examples/postgresql.sql; Revision: 1.7; Date: 2006/09/22 12:26:21; Author: pnixon; Lines: (+5 -5) File: radiusd/doc/examples/postgresql_update_radacct_group_trigger.sql; Revision: 1.2; Date: 2006/09/22 12:26:21; Author: pnixon; Lines: (+3 -3) File: radiusd/raddb/sql.conf; Revision: 1.56; Date: 2006/09/22 12:26:20; Author: pnixon; Lines: (+2 -2) ===================================================== Log entries ===================================================== Description: Kill this stupid check for NULL username. Modified files: File: radiusd/src/modules/rlm_sql/rlm_sql.c; Revision: 1.160; Date: 2006/09/22 11:59:16; Author: pnixon; Lines: (+12 -24) ===================================================== Summary of modified files ===================================================== File: radiusd/doc/examples/mssql.sql Revisions: 1.4 Authors: pnixon (+8 -8) ------------------------------- File: radiusd/doc/examples/mysql.sql Revisions: 1.4 Authors: pnixon (+3 -3) ------------------------------- File: radiusd/doc/examples/oracle.sql Revisions: 1.4 Authors: pnixon (+7 -7) ------------------------------- File: radiusd/doc/examples/postgresql.sql Revisions: 1.7 Authors: pnixon (+5 -5) ------------------------------- File: radiusd/doc/examples/postgresql_update_radacct_group_trigger.sql Revisions: 1.2 Authors: pnixon (+3 -3) ------------------------------- File: radiusd/raddb/sql.conf Revisions: 1.56 Authors: pnixon (+2 -2) ------------------------------- File: radiusd/src/modules/rlm_sql/rlm_sql.c Revisions: 1.160 Authors: pnixon (+12 -24) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Null SQL user
by Peter Nixon 22 Sep '06

22 Sep '06

Hi Guys We have had to locally patch rlm_sql to make it accept NULL usernames. Is there any particular reason why it does this check? rlm_sql_postgresql works fine with NULL usernames as does the rest of FreeRADIUS. Cheers -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

4 16

Proxy feature enhancement
by Geoffroy Arnoud 22 Sep '06

22 Sep '06

Hello, We are developping a RADIUS platform for our customer based on FreeRADIUS 1.1.3. We plan to patch the kernel code to implement a timeout/reries configuration per realm, for the RADIUS proxy feature. I saw in the archive that some time ago, someone planned to perform this modification (http://lists.freeradius.org/mailman/htdig/freeradius-devel/2004-October/007…) I am wondering if such a patch is available? If not, we will develop it and provide it to the community. For this purpose, we may need some tips on how proxy is implemented, in terms of configuration and behaviour (for example, How is managed timeout detection for a given request?). Furthermore, are there tests suite available on the server kernel so we can perform/enhance them to check non-regression? Any information will be welcome. Best regards, Geoff.

2 3

RE: rfc4590
by Alexander Schrab 22 Sep '06

22 Sep '06

BTW, would it be possible to add the behavior described in rfc4590 so freeradius can create a nonce. I am not sure if the structure of freeradius supports this since the rlm_digest only returns OK if the user is authenticated. Is it possible to define the returned package in more detail? "B sends an Access-Request packet with the newly defined Digest-Method and Digest-URI attributes but without a Digest-Nonce attribute to the RADIUS server, C (step 2). C chooses a nonce and responds with an Access-Challenge (step 3)." (B=http server, C=radius server) (RFC4590 1.3) /Alex > -----Original Message----- > From: > freeradius-devel-bounces+alexander.schrab=axis.com(a)lists.freer > adius.org > [mailto:freeradius-devel-bounces+alexander.schrab=axis.com@lis > ts.freeradius.org] On Behalf Of Alan DeKok > Sent: den 18 september 2006 18:35 > To: FreeRadius developers mailing list > Subject: Re: rfc4590 > > > "Alexander Schrab" <Alexander.Schrab(a)axis.com> wrote: > > I think I have a working version. But I can't test it with the old > > version of digest (I had a test program, but it expired). > How do you > > usually test freeradius? > > src/tests. It includes a number of digest tests. > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/devel.html >

3 10

Automatic report from sources (radiusd) between 21.09.2006 - 22.09.2006 GMT
by Automatic cvs log generator 22 Sep '06

22 Sep '06

CVS log entries from 21.09.2006 (Thu) 08:00:01 - 22.09.2006 (Fri) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/doc/rfc/Makefile; Revisions: 1.11 File: radiusd/doc/rfc/attributes.html; Revisions: 1.3 File: radiusd/doc/rfc/rfc4590.txt; Revisions: 1.1 File: radiusd/doc/rfc/rewrite.pl; Revisions: 1.4, 1.3 Author: pnixon File: radiusd/src/modules/rlm_sqlippool/rlm_sqlippool.c; Revisions: 1.7 File: radiusd/raddb/sqlippool.conf; Revisions: 1.4 ===================================================== Combined list of identical log entries ===================================================== Description: Added rfc4590 to the the list Modified files: File: radiusd/doc/rfc/Makefile; Revision: 1.11; Date: 2006/09/21 23:17:42; Author: aland; Lines: (+3 -2) File: radiusd/doc/rfc/attributes.html; Revision: 1.3; Date: 2006/09/21 23:17:41; Author: aland; Lines: (+26 -1) ===================================================== Log entries ===================================================== Description: Fix it more Modified files: File: radiusd/doc/rfc/rewrite.pl; Revision: 1.4; Date: 2006/09/21 23:29:41; Author: aland; Lines: (+6 -4) ------------------------------- Description: Be a little politer about what we print Modified files: File: radiusd/doc/rfc/rewrite.pl; Revision: 1.3; Date: 2006/09/21 23:16:48; Author: aland; Lines: (+3 -5) ------------------------------- Description: Added for Digest authentication Modified files: File: radiusd/doc/rfc/rfc4590.txt; Revision: 1.1; Date: 2006/09/21 23:17:02; Author: aland; ------------------------------- Description: Change %{P} to %{check:Pool-Name} to improve query readability Modified files: File: radiusd/raddb/sqlippool.conf; Revision: 1.4; Date: 2006/09/21 10:55:31; Author: pnixon; Lines: (+2 -2) ------------------------------- Description: Remove mutexes and log Called/Calling-Station-Id when handing out IPs Modified files: File: radiusd/src/modules/rlm_sqlippool/rlm_sqlippool.c; Revision: 1.7; Date: 2006/09/21 09:21:55; Author: pnixon; Lines: (+26 -28) ===================================================== Summary of modified files ===================================================== File: radiusd/doc/rfc/Makefile Revisions: 1.11 Authors: aland (+3 -2) ------------------------------- File: radiusd/doc/rfc/attributes.html Revisions: 1.3 Authors: aland (+26 -1) ------------------------------- File: radiusd/doc/rfc/rewrite.pl Revisions: 1.4, 1.3 Authors: aland (+6 -4), aland (+3 -5) ------------------------------- File: radiusd/doc/rfc/rfc4590.txt Revisions: 1.1 Authors: aland ------------------------------- File: radiusd/raddb/sqlippool.conf Revisions: 1.4 Authors: pnixon (+2 -2) ------------------------------- File: radiusd/src/modules/rlm_sqlippool/rlm_sqlippool.c Revisions: 1.7 Authors: pnixon (+26 -28) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0