November 2007 - Freeradius-Devel - lists.freeradius.org

Automatic report from sources (radiusd) between 05.11.2007 - 06.11.2007 GMT
by Automatic cvs log generator 06 Nov '07

06 Nov '07

CVS log entries from 05.11.2007 (Mon) 09:00:00 - 06.11.2007 (Tue) 09:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/main/event.c; Revisions: 1.69 File: radiusd/src/lib/event.c; Revisions: 1.14, 1.13 ===================================================== Log entries ===================================================== Description: Clarify code Modified files: File: radiusd/src/lib/event.c; Revision: 1.14; Date: 2007/11/05 23:24:48; Author: aland; Lines: (+6 -8) ------------------------------- Description: Set el->now Modified files: File: radiusd/src/lib/event.c; Revision: 1.13; Date: 2007/11/05 22:54:05; Author: aland; Lines: (+13 -9) ------------------------------- Description: Catch some corner cases in wait_a_bit Modified files: File: radiusd/src/main/event.c; Revision: 1.69; Date: 2007/11/05 23:26:26; Author: aland; Lines: (+26 -6) ===================================================== Summary of modified files ===================================================== File: radiusd/src/lib/event.c Revisions: 1.14, 1.13 Authors: aland (+6 -8), aland (+13 -9) ------------------------------- File: radiusd/src/main/event.c Revisions: 1.69 Authors: aland (+26 -6) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 04.11.2007 - 05.11.2007 GMT
by Automatic cvs log generator 05 Nov '07

05 Nov '07

CVS log entries from 04.11.2007 (Sun) 09:00:01 - 05.11.2007 (Mon) 09:00:00 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/raddb/sql/mysql/schema.sql; Revisions: 1.7 File: radiusd/raddb/sql/mysql/ippool.conf; Revisions: 1.4 File: radiusd/raddb/sql/mysql/ippool.sql; Revisions: 1.4 File: radiusd/raddb/sql/mysql/dialup.conf; Revisions: 1.5 ===================================================== Combined list of identical log entries ===================================================== Description: Updated Schema Modified files: File: radiusd/raddb/sql/mysql/dialup.conf; Revision: 1.5; Date: 2007/11/05 08:59:00; Author: aland; Lines: (+5 -5) File: radiusd/raddb/sql/mysql/ippool.conf; Revision: 1.4; Date: 2007/11/05 08:59:00; Author: aland; Lines: (+7 -7) File: radiusd/raddb/sql/mysql/ippool.sql; Revision: 1.4; Date: 2007/11/05 08:59:00; Author: aland; Lines: (+1 -1) File: radiusd/raddb/sql/mysql/schema.sql; Revision: 1.7; Date: 2007/11/05 08:59:00; Author: aland; Lines: (+3 -3) ===================================================== Log entries ===================================================== ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/sql/mysql/dialup.conf Revisions: 1.5 Authors: aland (+5 -5) ------------------------------- File: radiusd/raddb/sql/mysql/ippool.conf Revisions: 1.4 Authors: aland (+7 -7) ------------------------------- File: radiusd/raddb/sql/mysql/ippool.sql Revisions: 1.4 Authors: aland (+1 -1) ------------------------------- File: radiusd/raddb/sql/mysql/schema.sql Revisions: 1.7 Authors: aland (+3 -3) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Please look at my nas_ident passthough patch.
by Matthew Schumacher 05 Nov '07

05 Nov '07

Developers, In my freeradius installation I make some decisions based on what the NAS identifies itself as in the nas-identifier attribute. One of these decisions is which accounting database to use. This has been causing problems for me since the session_zap function is called when we get two start messages in a row. The purpose of the function makes perfect sense: to end the old session so that multiple login detection works, but the problem is that the nas-identifier attribute isn't translated though to the stop message like the username or the nas-ip-Address so it gets logged to the wrong accounting database because there isn't a nas-identifier to match on. The solution is to pass the NAS-Identifier attribute though to the session_zap function and have it output to the accounting modules instead of simply leaving it null. I the attached patch to do this and it works, except my radius server has become less than stable. It crashes here and there, but I can't figure out why. I'm not much of a C programmer so I'm hoping that someone on the list can look at my patch and point out what I did wrong. I suspect it's a typing issue or something. Also, it would be great if the developers would consider this for a production version since passing though the NAS-Identifier won't break or affect anything currently running, but offers the flexibility of changing the Session-Type based on matching something in the NAS-Identifier. Thanks to any that can help, schu diff -ruN freeradius-1.1.7.orig/src/include/radiusd.h freeradius-1.1.7/src/include/radiusd.h --- freeradius-1.1.7.orig/src/include/radiusd.h 2007-06-12 01:31:45.000000000 -0800 +++ freeradius-1.1.7/src/include/radiusd.h 2007-09-20 16:06:57.000000000 -0800 @@ -295,7 +295,7 @@ int session_zap(REQUEST *request, uint32_t nasaddr, unsigned int port, const char *user, const char *sessionid, uint32_t cliaddr, - char proto); + char proto, const char *nas_ident); /* radiusd.c */ #ifndef _LIBRADIUS diff -ruN freeradius-1.1.7.orig/src/main/session.c freeradius-1.1.7/src/main/session.c --- freeradius-1.1.7.orig/src/main/session.c 2007-05-15 01:50:51.000000000 -0800 +++ freeradius-1.1.7/src/main/session.c 2007-09-20 16:08:45.000000000 -0800 @@ -46,7 +46,7 @@ /* End a session by faking a Stop packet to all accounting modules */ int session_zap(REQUEST *request, uint32_t nasaddr, unsigned int port, const char *user, - const char *sessionid, uint32_t cliaddr, char proto) + const char *sessionid, uint32_t cliaddr, char proto, const char *nas_ident) { REQUEST *stopreq; VALUE_PAIR *vp, *userpair; @@ -85,6 +85,7 @@ IPPAIR(PW_NAS_IP_ADDRESS, nasaddr); INTPAIR(PW_ACCT_DELAY_TIME, 0); STRINGPAIR(PW_USER_NAME, user); + STRINGPAIR(PW_NAS_IDENTIFIER, nas_ident); userpair = vp; INTPAIR(PW_NAS_PORT, port); STRINGPAIR(PW_ACCT_SESSION_ID, sessionid); diff -ruN freeradius-1.1.7.orig/src/modules/rlm_radutmp/rlm_radutmp.c freeradius-1.1.7/src/modules/rlm_radutmp/rlm_radutmp.c --- freeradius-1.1.7.orig/src/modules/rlm_radutmp/rlm_radutmp.c 2007-04-07 14:40:00.000000000 -0800 +++ freeradius-1.1.7/src/modules/rlm_radutmp/rlm_radutmp.c 2007-09-20 16:15:18.000000000 -0800 @@ -589,6 +589,7 @@ rlm_radutmp_t *inst = instance; char login[256]; char filename[1024]; + char *nas_ident = NULL; ssize_t read_size; /* @@ -664,6 +665,8 @@ ipno = vp->lvalue; if ((vp = pairfind(request->packet->vps, PW_CALLING_STATION_ID)) != NULL) call_num = vp->strvalue; + if ((vp = pairfind(request->packet->vps, PW_NAS_IDENTIFIER)) != NULL) + nas_ident = vp->strvalue; /* * lock the file while reading/writing. @@ -744,7 +747,7 @@ session_zap(request, u.nas_address, u.nas_port, login, session_id, u.framed_address, - u.proto); + u.proto, nas_ident); } } } diff -ruN freeradius-1.1.7.orig/src/modules/rlm_sql/rlm_sql.c freeradius-1.1.7/src/modules/rlm_sql/rlm_sql.c --- freeradius-1.1.7.orig/src/modules/rlm_sql/rlm_sql.c 2007-07-17 04:59:08.000000000 -0800 +++ freeradius-1.1.7/src/modules/rlm_sql/rlm_sql.c 2007-09-20 16:14:24.000000000 -0800 @@ -1131,6 +1131,7 @@ int ret; uint32_t nas_addr = 0; int nas_port = 0; + char *nas_ident = NULL; /* If simul_count_query is not defined, we don't do any checking */ if (inst->config->simul_count_query[0] == 0) { @@ -1206,6 +1207,8 @@ ipno = vp->lvalue; if ((vp = pairfind(request->packet->vps, PW_CALLING_STATION_ID)) != NULL) call_num = vp->strvalue; + if ((vp = pairfind(request->packet->vps, PW_NAS_IDENTIFIER)) != NULL) + nas_ident = vp->strvalue; while (rlm_sql_fetch_row(sqlsocket, inst) == 0) { @@ -1270,7 +1273,7 @@ session_zap(request, nas_addr,nas_port,row[2],row[1], - framed_addr, proto); + framed_addr, proto, nas_ident); } }

2 1

EAP Failure Reason
by awaneesh kumar 05 Nov '07

05 Nov '07

Hi All, Currently, when the authentication using specific EAP method fails, EAP server sends the Access-Reject with EAP payload indicating result as FAILURE. Is there a way by which EAP-Server can provide the exact reason of failure in Access-Reject? I mean is there any standard or Vendor specific attribute defined to indicate the failure reason. Thanks in advance. Awaneesh __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 3

Automatic report from sources (radiusd) between 02.11.2007 - 03.11.2007 GMT
by Automatic cvs log generator 03 Nov '07

03 Nov '07

CVS log entries from 02.11.2007 (Fri) 08:00:00 - 03.11.2007 (Sat) 08:00:00 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/raddb/sites-available/proxy-inner-tunnel; Revisions: 1.1 File: radiusd/raddb/sites-available/inner-tunnel; Revisions: 1.3 File: radiusd/raddb/certs/xpextensions; Revisions: 1.2 ===================================================== Log entries ===================================================== Description: Point to MS's page Modified files: File: radiusd/raddb/certs/xpextensions; Revision: 1.2; Date: 2007/11/03 00:14:54; Author: aland; Lines: (+3 -1) ------------------------------- Description: Deleted blank line Modified files: File: radiusd/raddb/sites-available/inner-tunnel; Revision: 1.3; Date: 2007/11/02 23:57:12; Author: aland; Lines: (+1 -2) ------------------------------- Description: One more sample virtual server. At this rate, we'll have something resembling "documentation" real soon now. Modified files: File: radiusd/raddb/sites-available/proxy-inner-tunnel; Revision: 1.1; Date: 2007/11/02 23:57:40; Author: aland; ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/certs/xpextensions Revisions: 1.2 Authors: aland (+3 -1) ------------------------------- File: radiusd/raddb/sites-available/inner-tunnel Revisions: 1.3 Authors: aland (+1 -2) ------------------------------- File: radiusd/raddb/sites-available/proxy-inner-tunnel Revisions: 1.1 Authors: aland -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

CVS server broken?
by Chris Mikkelson 01 Nov '07

01 Nov '07

My cvs updates are dying with: cvs update: Updating . cvs update: failed to create lock directory for `/source/radiusd' (/source/radiusd/#cvs.lock): No space left on device cvs update: failed to obtain dir lock in repository `/source/radiusd' cvs [update aborted]: read lock failed - giving up which appears to be a server-side error. Anyone else's doing the same? Thanks, -- Chris Mikkelson | For example, I could be a sentient PERL script. That cmikk(a)qwest.net | pretty much assumes that someone brilliant enough to | write me was also stupid enough to program in PERL. | Not a likely explanation. -- Terry Lambert

2 1

Testing EAP-TLS session resumption
by sujithsankar 01 Nov '07

01 Nov '07

Hi all, I am working on EAP-TLS client. The normal functionality testing was done by interoperating with FreeRADIUS. Now, I would like to test fast re-authentication feature of my EAP-TLS client. It is learnt that FreeRADIUS does not support this feature. Has anyone of you tried to test such a feature? Does anyone know about any patch for FreeRADIUS to support session resumption? Please throw some light on this. Thanks, -Sujith The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments contained in it. Contact your Administrator for further information.

2 2