September 2006 - Freeradius-Devel - lists.freeradius.org

Multiple outgoing packets
by Alan DeKok 09 Sep '06

09 Sep '06

(moving to -devel) Peter Nixon <listuser(a)peternixon.net> wrote: > Being able to selectively replicate an accounting packet N times may > not be a standard configuration (although certainly usefull) but > proxying accounting-on/off packets to some/all downstream servers is > something that almost _everyone_ proxying accounting will want to > do. This probaby warrants a new config option in proxy.conf > (acctonoff-shotgun=yes/no) That's one more specialized config which could be replaced by a separate program. > In particular any downstream servers running ippools need this information.. > Not to mention people who charge by the minute for a particular service.. Yes. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

1 0

Automatic report from sources (radiusd) between 06.09.2006 - 07.09.2006 GMT
by Automatic cvs log generator 07 Sep '06

07 Sep '06

CVS log entries from 06.09.2006 (Wed) 08:00:01 - 07.09.2006 (Thu) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/main/listen.c; Revisions: 1.48 Author: pnixon File: radiusd/suse/rcradius-relayd; Revisions: 1.1 ===================================================== Log entries ===================================================== Description: Pick a proxy port for radrelay Modified files: File: radiusd/src/main/listen.c; Revision: 1.48; Date: 2006/09/06 16:25:26; Author: aland; Lines: (+3 -2) ------------------------------- Description: Initial Start script for radrelay Modified files: File: radiusd/suse/rcradius-relayd; Revision: 1.1; Date: 2006/09/06 22:43:08; Author: pnixon; ===================================================== Summary of modified files ===================================================== File: radiusd/src/main/listen.c Revisions: 1.48 Authors: aland (+3 -2) ------------------------------- File: radiusd/suse/rcradius-relayd Revisions: 1.1 Authors: pnixon -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 05.09.2006 - 06.09.2006 GMT
by Automatic cvs log generator 06 Sep '06

06 Sep '06

CVS log entries from 05.09.2006 (Tue) 08:00:01 - 06.09.2006 (Wed) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/modules/rlm_pap/rlm_pap.c; Revisions: 1.40 File: radiusd/src/include/conffile.h; Revisions: 1.30 File: radiusd/src/main/mainconfig.c; Revisions: 1.94 File: radiusd/src/main/radiusd.c; Revisions: 1.358 File: radiusd/src/main/radwho.c; Revisions: 1.63 File: radiusd/src/main/conffile.c; Revisions: 1.139, 1.138, 1.137 File: radiusd/src/modules/rlm_policy/parse.c; Revisions: 1.16 ===================================================== Combined list of identical log entries ===================================================== Description: Separate reading of a file from $INCLUDEing a file. This makes the code a little easier to understand... Modified files: File: radiusd/src/include/conffile.h; Revision: 1.30; Date: 2006/09/05 17:42:10; Author: aland; Lines: (+3 -5) File: radiusd/src/main/conffile.c; Revision: 1.137; Date: 2006/09/05 17:42:11; Author: aland; Lines: (+77 -149) File: radiusd/src/main/mainconfig.c; Revision: 1.94; Date: 2006/09/05 17:42:11; Author: aland; Lines: (+3 -3) File: radiusd/src/main/radwho.c; Revision: 1.63; Date: 2006/09/05 17:42:11; Author: aland; Lines: (+3 -3) File: radiusd/src/modules/rlm_policy/parse.c; Revision: 1.16; Date: 2006/09/05 17:42:12; Author: aland; Lines: (+2 -2) ===================================================== Log entries ===================================================== Description: Don't call cf_section_read() recursively. Instead, leverage the fact that each section has a parent pointer to do it iteratively, which means that we can catch more cases of mismatched braces Modified files: File: radiusd/src/main/conffile.c; Revision: 1.139; Date: 2006/09/05 21:39:24; Author: aland; Lines: (+44 -26) ------------------------------- Description: Catch more cases of start section without end, and end section without start in the same file. Modified files: File: radiusd/src/main/conffile.c; Revision: 1.138; Date: 2006/09/05 19:45:16; Author: aland; Lines: (+25 -17) ------------------------------- Description: 'X' means 'print output to stdout' Modified files: File: radiusd/src/main/radiusd.c; Revision: 1.358; Date: 2006/09/05 19:43:07; Author: aland; Lines: (+10 -8) ------------------------------- Description: Cleartext-Password is a "known good" password, too Modified files: File: radiusd/src/modules/rlm_pap/rlm_pap.c; Revision: 1.40; Date: 2006/09/05 17:41:01; Author: aland; Lines: (+12 -3) ===================================================== Summary of modified files ===================================================== File: radiusd/src/include/conffile.h Revisions: 1.30 Authors: aland (+3 -5) ------------------------------- File: radiusd/src/main/conffile.c Revisions: 1.139, 1.138, 1.137 Authors: aland (+44 -26), aland (+25 -17), aland (+77 -149) ------------------------------- File: radiusd/src/main/mainconfig.c Revisions: 1.94 Authors: aland (+3 -3) ------------------------------- File: radiusd/src/main/radiusd.c Revisions: 1.358 Authors: aland (+10 -8) ------------------------------- File: radiusd/src/main/radwho.c Revisions: 1.63 Authors: aland (+3 -3) ------------------------------- File: radiusd/src/modules/rlm_pap/rlm_pap.c Revisions: 1.40 Authors: aland (+12 -3) ------------------------------- File: radiusd/src/modules/rlm_policy/parse.c Revisions: 1.16 Authors: aland (+2 -2) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 04.09.2006 - 05.09.2006 GMT
by Automatic cvs log generator 05 Sep '06

05 Sep '06

CVS log entries from 04.09.2006 (Mon) 08:00:01 - 05.09.2006 (Tue) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: pnixon File: radiusd/src/modules/rlm_sqlippool/ip_set.h; Revisions: 1.2 File: radiusd/src/modules/rlm_sqlippool/Makefile.in; Revisions: 1.5 File: radiusd/src/modules/rlm_sqlippool/ip_set.c; Revisions: 1.4 File: radiusd/src/modules/rlm_sqlippool/rlm_sqlippool.c; Revisions: 1.6 ===================================================== Combined list of identical log entries ===================================================== Description: Port module to new API (To stop it core dumping) and remove some other cruft Modified files: File: radiusd/src/modules/rlm_sqlippool/Makefile.in; Revision: 1.5; Date: 2006/09/04 15:29:40; Author: pnixon; Lines: (+3 -3) File: radiusd/src/modules/rlm_sqlippool/ip_set.c; Revision: 1.4; Date: 2006/09/04 15:29:41; Author: pnixon; Lines: (+1 -1) File: radiusd/src/modules/rlm_sqlippool/ip_set.h; Revision: 1.2; Date: 2006/09/04 15:29:41; Author: pnixon; Lines: (+0 -0) File: radiusd/src/modules/rlm_sqlippool/rlm_sqlippool.c; Revision: 1.6; Date: 2006/09/04 15:29:41; Author: pnixon; Lines: (+3 -3) ===================================================== Log entries ===================================================== ===================================================== Summary of modified files ===================================================== File: radiusd/src/modules/rlm_sqlippool/Makefile.in Revisions: 1.5 Authors: pnixon (+3 -3) ------------------------------- File: radiusd/src/modules/rlm_sqlippool/ip_set.c Revisions: 1.4 Authors: pnixon (+1 -1) ------------------------------- File: radiusd/src/modules/rlm_sqlippool/ip_set.h Revisions: 1.2 Authors: pnixon (+0 -0) ------------------------------- File: radiusd/src/modules/rlm_sqlippool/rlm_sqlippool.c Revisions: 1.6 Authors: pnixon (+3 -3) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

sql_log
by Peter Nixon 04 Sep '06

04 Sep '06

Forgive me if this has been asked before, but shouldn't the sql_log module use the same SQL queries from as the normal sql module? Why does it have it's own set of queries in radiusd.conf? As far as I can tell it should simply ignore connection info and non accounting queries otherwise do exactly the same thing! -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

3 12

logging permissions bug
by Peter Nixon 04 Sep '06

04 Sep '06

Hi Guys I think the following behaviour is a bug. When radiusd is configured to run as user "radiusd" the first time it starts up, if there is no radius.log file it creates it as user root, then promptly fails because it cannot write to it as user "radiusd". # ls -l /var/log/radius total 0 drwx------ 2 radiusd radiusd 48 2006-09-02 14:34 radacct -rw-r--r-- 1 radiusd radiusd 0 2006-09-02 14:34 radutmp # rcradiusd start Starting RADIUS daemon radiusd: Couldn't open /var/log/radius/radius.log for logging: Permission denied (rlm_exec: wait=yes but no output defined. Did you mean output=none?) done # ls -l /var/log/radius total 4 drwx------ 2 radiusd radiusd 48 2006-09-02 14:34 radacct -rw-r--r-- 1 root root 208 2006-09-04 14:06 radius.log -rw-r--r-- 1 radiusd radiusd 0 2006-09-02 14:34 radutmp -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

2 1

diameter
by Pezhman Lali 04 Sep '06

04 Sep '06

hi dear is it true question that, freeradius can/will support DIAMETER ? Best Pezhman __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

Automatic report from sources (radiusd) between 02.09.2006 - 03.09.2006 GMT
by Automatic cvs log generator 03 Sep '06

03 Sep '06

CVS log entries from 02.09.2006 (Sat) 08:00:00 - 03.09.2006 (Sun) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: nbk File: radiusd/debian/freeradius.init; Revisions: 1.7 Author: pnixon File: radiusd/doc/rlm_ldap; Revisions: 1.40 File: radiusd/doc/ascend; Revisions: 1.3 File: radiusd/doc/ldap_howto.txt; Revisions: 1.6 ===================================================== Combined list of identical log entries ===================================================== Description: Minor doc cleanups Modified files: File: radiusd/doc/ascend; Revision: 1.3; Date: 2006/09/02 10:53:17; Author: pnixon; Lines: (+2 -2) File: radiusd/doc/ldap_howto.txt; Revision: 1.6; Date: 2006/09/02 10:53:17; Author: pnixon; Lines: (+2 -2) File: radiusd/doc/rlm_ldap; Revision: 1.40; Date: 2006/09/02 10:53:17; Author: pnixon; Lines: (+1 -1) ===================================================== Log entries ===================================================== Description: Rework the /var/run on tmpfs patch and print an error if for some reason /var/run is not writable. Modified files: File: radiusd/debian/freeradius.init; Revision: 1.7; Date: 2006/09/02 11:17:16; Author: nbk; Lines: (+6 -2) ===================================================== Summary of modified files ===================================================== File: radiusd/debian/freeradius.init Revisions: 1.7 Authors: nbk (+6 -2) ------------------------------- File: radiusd/doc/ascend Revisions: 1.3 Authors: pnixon (+2 -2) ------------------------------- File: radiusd/doc/ldap_howto.txt Revisions: 1.6 Authors: pnixon (+2 -2) ------------------------------- File: radiusd/doc/rlm_ldap Revisions: 1.40 Authors: pnixon (+1 -1) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

RFC compliance in sanitizing Access-Reject responses
by Mike 02 Sep '06

02 Sep '06

All, First, thank you for an excellent server. Within a few hours we went from google-ing for a radius server to having a proxy up which does (almost) everything we needed to make a third party device/server learn many cool new tricks. Unfortunately last night I had to spend 3 hours (maybe "only" 3 hours, attesting to high code quality) in trying to figure out why Access-Reject messages were loosing all but the Reply-Message attribute. Eventually I did find, first a hint on the mailing lists, then the RFC, and then finally after quite a bit of digging, the code in util.c : case PW_AUTHENTICATION_REJECT: pairmove2(&vps, &(packet->vps), PW_EAP_MESSAGE); pairmove2(&vps, &(packet->vps), PW_MESSAGE_AUTHENTICATOR); pairmove2(&vps, &(packet->vps), PW_REPLY_MESSAGE); break; I would like to suggest at least two small changes to make freeradius an even better tool than it already is. The first is really simple and would take practically no work at all: can we please have a log message here that notifies the user of this operation when running with -X? This would have saved me most of the time I've spent digging through mailing lists and the rlm_attr_filter code, and allowed me to quickly find the above culprit. This is actually quite necessary, since any "detail" logs that can be inserted on the proxy reply path happily show all attributes - the attributes magically disappear right before packet is sent. The second request is also trivial to implement: make the above code configurable/optional. Yes, there is a great deal of strength and respect in supporting the RFC to the dot - and without a doubt, that should be the default out-of-the-box configuration. But not all devices are created equal - and in my case, as I'm sure in some others, useful information is passed in the Access-Reject message in attributes other than Reply-Message. Obviously this is not compliant - but all the devices I have are quite happy accepting those "extra" arguments, and a third party server is certainly very happy to send them. Making this code "optional" with a config file switch saves me from hacking the sources. Code change can be achieved simply by moving up case PW_AUTHENTICATION_REJECT: above the default: case and wrapping the 4 line body (including break;) inside of an if statement, so this change is also quite triviail. The third "request" or "option" perhaps, is a bit more complex. I would propose that the above code is actually a hack to comply with RFC, and that the appropriate mechanism of accomplishing this effect is through an appropriate set of attribute filters (enabled by default). This would require extending the attr_filters module to consider the request/response type being filtered. The default configuration can point out the RFC in the comments and filter out everything with the three exceptions. This of course allows for maximal flexibility, while still respecting the standard in the default configuration. I think this one is quite a bit more work, so I do not put too many hopes into it, but I figured I would throw it out on the table. Again, thanks for a great server. The above "hickup" is hardly worth mentioning when compared to the overall experience we've had in setting up the proxy and getting it to do what we want.

3 7

RE: EAP-AKA authentication support
by Phaneuf, Brian 02 Sep '06

02 Sep '06

Re: Diffs in comments. I now see the create attachment link on the bug page which I did not notice before. Re: Configure script. This is the config script for rlm_eap_aka. When did a clean build, the make complained that it could not find it so I assumed that it was needed. It has been omitted in the patch that I just attached to the bug. Re: Radius.conf, I followed what I saw in the eap-sim tests. That is the only reason I included it at all. Since eap-aka and eap-sim do very similar things and I copied most of eap-sim to implement eap-aka, I though that is was the thing to do. Now I know that is it not. Are there additional changes you need? What if anything should I do with the radius.conf file in the patch? -----Original Message----- From: freeradius-devel-bounces+bphaneuf=reefpoint.com(a)lists.freeradius.org [mailto:freeradius-devel-bounces+bphaneuf=reefpoint.com@lists.freeradius .org] On Behalf Of Alan DeKok Sent: Friday, September 01, 2006 1:37 PM To: FreeRadius developers mailing list Subject: Re: EAP-AKA authentication support "Phaneuf, Brian" <bphaneuf(a)reefpoint.com> wrote: > Alan - I have updated the bugzilla entry with the new diffs that also > include the configure script in rlm_eap_aka that was missing from > before. Please don't put the diff's in the comments. Doing so makes it impossible to apply the patch. Add it as an attachment. And it's not necessary to include the 'configure' script. It can be generated from 'configure.in'. And I'm a little concerned about the whole-sale copy of radiusd.conf as an "example". Can you please add a separate attachment that is a diff of the stock radiusd.conf.in file, and the example you have. Adding an additional complete copy of radiusd.conf to the tree is a big problem. It means that now two copies have to be kept in sync, which is more work. It also means that the "example" you posted is configured for your local system, and is hard for others to use. I know there's already a copy of radiusd.conf in the src/eapsim-03 directory. That's a bad idea, and it should be fixed. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html

3 2