May 2007 - Freeradius-Devel - lists.freeradius.org

Automatic report from sources (radiusd) between 07.05.2007 - 08.05.2007 GMT
by Automatic cvs log generator 08 May '07

08 May '07

CVS log entries from 07.05.2007 (Mon) 08:00:01 - 08.05.2007 (Tue) 08:00:04 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/main/radius_snmp.c; Revisions: 1.36 Author: pnixon File: radiusd/raddb/sql/postgresql-ippool-dialup.conf; Revisions: 1.1 File: radiusd/raddb/sql/mysql-ippool-dialup.conf; Revisions: 1.1 File: radiusd/raddb/sqlippool.conf; Revisions: 1.10 ===================================================== Combined list of identical log entries ===================================================== Description: Split queries into dialect specific files and add mysql support Modified files: File: radiusd/raddb/sqlippool.conf; Revision: 1.10; Date: 2007/05/08 07:00:35; Author: pnixon; Lines: (+8 -76) File: radiusd/raddb/sql/mysql-ippool-dialup.conf; Revision: 1.1; Date: 2007/05/08 07:00:36; Author: pnixon; File: radiusd/raddb/sql/postgresql-ippool-dialup.conf; Revision: 1.1; Date: 2007/05/08 07:00:36; Author: pnixon; ===================================================== Log entries ===================================================== Description: use new signal stuff Modified files: File: radiusd/src/main/radius_snmp.c; Revision: 1.36; Date: 2007/05/07 17:31:25; Author: aland; Lines: (+5 -8) ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/sql/mysql-ippool-dialup.conf Revisions: 1.1 Authors: pnixon ------------------------------- File: radiusd/raddb/sql/postgresql-ippool-dialup.conf Revisions: 1.1 Authors: pnixon ------------------------------- File: radiusd/raddb/sqlippool.conf Revisions: 1.10 Authors: pnixon (+8 -76) ------------------------------- File: radiusd/src/main/radius_snmp.c Revisions: 1.36 Authors: aland (+5 -8) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Current cvs build failure
by Peter Nixon 07 May '07

07 May '07

/usr/src/packages/BUILD/freeradius-server-snapshot-20070507/libtool --mode=link gcc -export-dynamic -dlopen self \ -pie -o radiusd acct.lo auth.lo client.lo conffile.lo crypt.lo exec.lo files.lo listen.lo log.lo mainconfig.lo modules.lo modcall.lo radiusd.lo radius_snmp.lo session.lo smux.lo threads.lo util.lo valuepair.lo version.lo xlat.lo event.lo realms.lo \ ../lib/libradius.la -lnsl -lresolv -lpthread -lsnmp \ -lcrypt -lltdl -lcrypto -lssl -lcrypto rm -f .libs/radiusd.nm .libs/radiusd.nmS .libs/radiusd.nmT creating .libs/radiusdS.c (cd .libs && gcc -fmessage-length=0 -D_FORTIFY_SOURCE=2 -O2 -fno-strict-aliasing -DLDAP_DEPRECATED -fPIC -DPIC -c -fno-builtin "radiusdS.c") rm -f .libs/radiusdS.c .libs/radiusd.nm .libs/radiusd.nmS .libs/radiusd.nmT gcc .libs/radiusdS.o -pie -o .libs/radiusd .libs/acct.o .libs/auth.o .libs/client.o .libs/conffile.o .libs/crypt.o .libs/exec.o .libs/files.o .libs/listen.o .libs/log.o .libs/mainconfig.o .libs/modules.o .libs/modcall.o .libs/radiusd.o .libs/radius_snmp.o .libs/session.o .libs/smux.o .libs/threads.o .libs/util.o .libs/valuepair.o .libs/version.o .libs/xlat.o .libs/event.o .libs/realms.o -Wl,--export-dynamic ../lib/.libs/libradius.so -lnsl -lresolv -lpthread /usr/lib64/libsnmp.so -lcrypt /usr/lib64/libltdl.so -ldl -lssl -lcrypto -Wl,--rpath -Wl,/usr/lib64/freeradius .libs/radius_snmp.o: In function `radServReset': radius_snmp.c:(.text+0x943): undefined reference to `need_reload' collect2: ld returned 1 exit status gmake[4]: *** [radiusd] Error 1 gmake[4]: Leaving directory `/usr/src/packages/BUILD/freeradius-server-snapshot-20070507/src/main' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/usr/src/packages/BUILD/freeradius-server-snapshot-20070507/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/usr/src/packages/BUILD/freeradius-server-snapshot-20070507/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/usr/src/packages/BUILD/freeradius-server-snapshot-20070507' make: *** [all] Error 2 error: Bad exit status from /var/tmp/rpm-tmp.83516 (%build) -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

2 1

NAS-Port attribute question
by Muhammad Tayseer Alquoatli 07 May '07

07 May '07

Hi list: I want your help to understand how freeradius uses NAS-Port attribute within rlm_ippool module I was looking for the interpretation of this attribute but i couldn't find more that "it's the physical port from which the request has come" reading the rlm_ippool code I've found that freeradius is using "NAS-IP, NAS-Port" pair as a key to search in the ippool file right ? so my questions are: 1- what does it mean with ("rlm_ippool: Searching for an entry for nas/port: %s/%u",key.nas,key.port)? does it mean that freeradius is searching for entries reserved by this nas/port ? and if this was true why it then set active entries to zero ? why it assume that this IP is not in use "i assume that active ip entry means it's in use"? 2- regarding mppp, i assume that NAS-Port should be unique for all sessions other that mppp sessions. those mppp sessions must share the same NAS-Port. is this the right use of the NAS-Port attribute? 3- according to sum of my assumptions, all auth requests that will be handled by the same rlm_ippool instance and that all have the same NAS-IP, NAS-Port, CLI will certainly have the same ip address reserved for them in the post_auth section, and any change in the triple (nas-ip, nas-port, cli) will certainly cause them to have different ip address assignment. is this true? please correct me? any pointer will be very helpful, as i couldn't find helpful resources Thanks in advance -- Muhammad Tayseer Alquoatli

2 2

Detail file handling
by Alan DeKok 06 May '07

06 May '07

OK... the code to handle the detail file is now in. radiusd.conf: listen { type = detail filename = foo max_outstanding = 10 # this will be deleted later } If one thread is waiting for something to do, then ONE packet is read from the detail file, and handed to a child thread. This means that if the server is busy handling authentication and/or accounting requests, it completely ignores the detail file. As it should. I've also updated the "detail" module so that in the post-proxy section, it writes the accounting packet IF there's no reply from the home server. This lets the detail module sit in Post-Proxy-Type Fail, and Just Do The Right Thing. Please test. I've done some basic work, and it should be OK. It doesn't hit assertions, it doesn't crash, and I've run 1000's of packets through it. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

2 7

Automatic report from sources (radiusd) between 04.05.2007 - 05.05.2007 GMT
by Automatic cvs log generator 05 May '07

05 May '07

CVS log entries from 04.05.2007 (Fri) 08:00:00 - 05.05.2007 (Sat) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/main/threads.c; Revisions: 1.125 File: radiusd/src/lib/valuepair.c; Revisions: 1.120 File: radiusd/src/main/radiusd.c; Revisions: 1.366 File: radiusd/src/modules/rlm_detail/rlm_detail.c; Revisions: 1.60 File: radiusd/src/main/listen.c; Revisions: 1.72, 1.71, 1.70 File: radiusd/src/include/radiusd.h; Revisions: 1.230 Author: pnixon File: radiusd/doc/examples/postgresql.sql; Revisions: 1.1.2.9 ===================================================== Combined list of identical log entries ===================================================== Description: Added a self-pipe as per Emile's ideas at: http://www.xs4all.nl/~evbergen/unix-signals.html We don't need to handle more than 2-3 signals, so it all fits into one byte. Also added "detail" flag, so we can later add feedback from the child threads. If there are no queued requests, AND there's at least one thread waiting for something to do, THEN it's OK to read from the detail file. Modified files: File: radiusd/src/include/radiusd.h; Revision: 1.230; Date: 2007/05/04 09:18:08; Author: aland; Lines: (+11 -3) File: radiusd/src/main/radiusd.c; Revision: 1.366; Date: 2007/05/04 09:18:08; Author: aland; Lines: (+238 -145) ===================================================== Log entries ===================================================== Description: oops.. no need for the same column name twice.. Modified files: File: radiusd/doc/examples/postgresql.sql; Revision: 1.1.2.9; Date: 2007/05/04 14:59:51; Author: pnixon; Lines: (+1 -2) ------------------------------- Description: Do more initialization Modified files: File: radiusd/src/lib/valuepair.c; Revision: 1.120; Date: 2007/05/04 11:57:08; Author: aland; Lines: (+6 -2) ------------------------------- Description: Be more forgiving about corner cases Modified files: File: radiusd/src/main/listen.c; Revision: 1.72; Date: 2007/05/04 13:00:15; Author: aland; Lines: (+6 -10) ------------------------------- Description: Cleanup up detail file handling a little. Fixed a memory leak (how did that get in again?). It seems to work... Modified files: File: radiusd/src/main/listen.c; Revision: 1.71; Date: 2007/05/04 12:42:38; Author: aland; Lines: (+35 -33) ------------------------------- Description: more sanity checks, and clarify the code Modified files: File: radiusd/src/main/listen.c; Revision: 1.70; Date: 2007/05/04 09:06:15; Author: aland; Lines: (+17 -20) ------------------------------- Description: When adding a non-detail REQUEST to the queue, mark detail reading as not possible. When a thread finishes a request, AND the queues are empty, mark detail reading as possible. Modified files: File: radiusd/src/main/threads.c; Revision: 1.125; Date: 2007/05/04 12:43:51; Author: aland; Lines: (+36 -5) ------------------------------- Description: Suppress writes to the detail file if the request was read from a detail file. In post-proxy, if there's no proxy reply, we must be in a Post-Proxy-Type = Fail section, so run the accounting section Modified files: File: radiusd/src/modules/rlm_detail/rlm_detail.c; Revision: 1.60; Date: 2007/05/04 08:18:13; Author: aland; Lines: (+18 -3) ===================================================== Summary of modified files ===================================================== File: radiusd/doc/examples/postgresql.sql Revisions: 1.1.2.9 Authors: pnixon (+1 -2) ------------------------------- File: radiusd/src/include/radiusd.h Revisions: 1.230 Authors: aland (+11 -3) ------------------------------- File: radiusd/src/lib/valuepair.c Revisions: 1.120 Authors: aland (+6 -2) ------------------------------- File: radiusd/src/main/listen.c Revisions: 1.72, 1.71, 1.70 Authors: aland (+6 -10), aland (+35 -33), aland (+17 -20) ------------------------------- File: radiusd/src/main/radiusd.c Revisions: 1.366 Authors: aland (+238 -145) ------------------------------- File: radiusd/src/main/threads.c Revisions: 1.125 Authors: aland (+36 -5) ------------------------------- File: radiusd/src/modules/rlm_detail/rlm_detail.c Revisions: 1.60 Authors: aland (+18 -3) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 03.05.2007 - 04.05.2007 GMT
by Automatic cvs log generator 04 May '07

04 May '07

CVS log entries from 03.05.2007 (Thu) 08:00:01 - 04.05.2007 (Fri) 08:00:00 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/modules/rlm_eap/eap.c; Revisions: 1.65, 1.64 File: radiusd/src/main/modules.c; Revisions: 1.122, 1.121, 1.120 File: radiusd/src/main/realms.c; Revisions: 1.9, 1.8 File: radiusd/src/main/modcall.c; Revisions: 1.61 File: radiusd/src/main/util.c; Revisions: 1.56 File: radiusd/src/main/radclient.c; Revisions: 1.111 File: radiusd/src/main/conffile.c; Revisions: 1.157, 1.156, 1.155 File: radiusd/src/main/listen.c; Revisions: 1.69 ===================================================== Combined list of identical log entries ===================================================== Description: Standardized format for debugging output, after a few trials of different methods. The new output is cleaner, less noisy, and it's more obvious what's going on. Modified files: File: radiusd/src/main/conffile.c; Revision: 1.157; Date: 2007/05/03 09:03:16; Author: aland; Lines: (+22 -17) File: radiusd/src/main/modules.c; Revision: 1.122; Date: 2007/05/03 09:03:16; Author: aland; Lines: (+20 -6) File: radiusd/src/modules/rlm_eap/eap.c; Revision: 1.65; Date: 2007/05/03 09:03:17; Author: aland; Lines: (+4 -4) ------------------------------- Description: Add section start/stop debug output. Modified files: File: radiusd/src/main/listen.c; Revision: 1.69; Date: 2007/05/03 09:17:31; Author: aland; Lines: (+6 -2) File: radiusd/src/main/realms.c; Revision: 1.8; Date: 2007/05/03 09:17:50; Author: aland; Lines: (+55 -39) ------------------------------- Description: More readable debug output Modified files: File: radiusd/src/main/conffile.c; Revision: 1.156; Date: 2007/05/03 08:29:27; Author: aland; Lines: (+14 -2) File: radiusd/src/main/modules.c; Revision: 1.121; Date: 2007/05/03 08:29:27; Author: aland; Lines: (+2 -9) File: radiusd/src/modules/rlm_eap/eap.c; Revision: 1.64; Date: 2007/05/03 08:29:27; Author: aland; Lines: (+6 -3) ------------------------------- Description: Reformatted debug output to make it easier to read Modified files: File: radiusd/src/main/conffile.c; Revision: 1.155; Date: 2007/05/03 08:01:38; Author: aland; Lines: (+9 -51) File: radiusd/src/main/modules.c; Revision: 1.120; Date: 2007/05/03 08:01:42; Author: aland; Lines: (+11 -4) ===================================================== Log entries ===================================================== Description: Reformatted debugging output to make it easier to read. Modified files: File: radiusd/src/main/modcall.c; Revision: 1.61; Date: 2007/05/03 08:02:04; Author: aland; Lines: (+21 -23) ------------------------------- Description: Make "-c" work Modified files: File: radiusd/src/main/radclient.c; Revision: 1.111; Date: 2007/05/03 09:31:38; Author: aland; Lines: (+6 -5) ------------------------------- Description: Re-arrange parsing order so that home servers aren't nested in server pools, and server pools aren't nested in realms. This makes debugging output easier to read. Modified files: File: radiusd/src/main/realms.c; Revision: 1.9; Date: 2007/05/03 12:47:38; Author: aland; Lines: (+79 -61) ------------------------------- Description: Copy outer src/dst IP/port to inner tunnel, so Packet-Src-IP-Address etc. can work Modified files: File: radiusd/src/main/util.c; Revision: 1.56; Date: 2007/05/03 09:32:12; Author: aland; Lines: (+36 -34) ===================================================== Summary of modified files ===================================================== File: radiusd/src/main/conffile.c Revisions: 1.157, 1.156, 1.155 Authors: aland (+22 -17), aland (+14 -2), aland (+9 -51) ------------------------------- File: radiusd/src/main/listen.c Revisions: 1.69 Authors: aland (+6 -2) ------------------------------- File: radiusd/src/main/modcall.c Revisions: 1.61 Authors: aland (+21 -23) ------------------------------- File: radiusd/src/main/modules.c Revisions: 1.122, 1.121, 1.120 Authors: aland (+20 -6), aland (+2 -9), aland (+11 -4) ------------------------------- File: radiusd/src/main/radclient.c Revisions: 1.111 Authors: aland (+6 -5) ------------------------------- File: radiusd/src/main/realms.c Revisions: 1.9, 1.8 Authors: aland (+79 -61), aland (+55 -39) ------------------------------- File: radiusd/src/main/util.c Revisions: 1.56 Authors: aland (+36 -34) ------------------------------- File: radiusd/src/modules/rlm_eap/eap.c Revisions: 1.65, 1.64 Authors: aland (+4 -4), aland (+6 -3) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Debug output changes
by Alan DeKok 03 May '07

03 May '07

I've just committed some fixes to debugging output. It now prints the section names as it's parsing them: foo { bar = stuff } Which is a lot cleaner than what was there before. Also, the lines with brackets are indented one space for every section nesting, which makes it easier to track sections && subsections. The rest of the messages printed out during server initialization have been normalized to a more standard form. The debug output for handling packets has changed. There's less text on the screen, which makes it easier to read (for the people who actually read it.) It also shows some limited nesting via "+". After some back and forth, I decided it was clearer to use "+" rather than anything else. e.g. +- entering group authorize ++[foo] returns ok ++[bar] returns noop ... +- group authorize returns ok The individual module debug output is still indented with spaces, which makes it easier to tell the difference between server messages && module messages. All told, it's very different from 1.x, and I hope much easier to understand. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

3 6

Library filename changes
by Alan DeKok 03 May '07

03 May '07

In keeping with the recent addition of the freeradius-client library, I think we should rename the libraries in the server, too: libradius -> libfreeradius-radius libeap -> libfreeradius-eap The directory names can stay the same, but the names of the targets can change. Objections? Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

3 6

Automatic report from sources (radiusd) between 02.05.2007 - 03.05.2007 GMT
by Automatic cvs log generator 03 May '07

03 May '07

CVS log entries from 02.05.2007 (Wed) 08:00:01 - 03.05.2007 (Thu) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/modules/rlm_pap/rlm_pap.c; Revisions: 1.52 File: radiusd/src/modules/rlm_eap/eap.c; Revisions: 1.63 File: radiusd/src/modules/rlm_eap/rlm_eap.c; Revisions: 1.44 File: radiusd/raddb/radiusd.conf.in; Revisions: 1.243 ===================================================== Combined list of identical log entries ===================================================== Description: In the authorize stage, return OK if we see TTLS or PEAP, which means that the administrator can use configurable failover to skip whole chunks of LDAP lookups, etc. if the outer tunnel setup is going on Modified files: File: radiusd/src/modules/rlm_eap/eap.c; Revision: 1.63; Date: 2007/05/02 13:19:02; Author: aland; Lines: (+8 -2) File: radiusd/src/modules/rlm_eap/rlm_eap.c; Revision: 1.44; Date: 2007/05/02 13:19:01; Author: aland; Lines: (+5 -2) ===================================================== Log entries ===================================================== Description: Add more documentation to the LDAP module. Note "ok = return" for EAP, to avoid the round trips of TTLS and PEAP. Modified files: File: radiusd/raddb/radiusd.conf.in; Revision: 1.243; Date: 2007/05/02 13:25:42; Author: aland; Lines: (+48 -2) ------------------------------- Description: Don't complain about no "known good" passwords for EAP-TLS, TTLS, and PEAP. Modified files: File: radiusd/src/modules/rlm_pap/rlm_pap.c; Revision: 1.52; Date: 2007/05/02 13:32:36; Author: aland; Lines: (+14 -2) ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/radiusd.conf.in Revisions: 1.243 Authors: aland (+48 -2) ------------------------------- File: radiusd/src/modules/rlm_eap/eap.c Revisions: 1.63 Authors: aland (+8 -2) ------------------------------- File: radiusd/src/modules/rlm_eap/rlm_eap.c Revisions: 1.44 Authors: aland (+5 -2) ------------------------------- File: radiusd/src/modules/rlm_pap/rlm_pap.c Revisions: 1.52 Authors: aland (+14 -2) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Oracle Stored Procedures for AAA : your suggestinos..
by Shahzada Hatim 02 May '07

02 May '07

Greetings, For a project I need to make freeradius utilize oracle stored procedures. These stored procedures will be used for the AAA of the radius server. The resultant radius server will be slightly different from a typical PPP-Dialup system (it will be monitering SIP(Voip) calls). This means that there would be changes beyond the SQL module (i.e. within the Authentication, Authorization and Accounting modules) What options do I have in this regard? -Can direct replacement of queries work , or a complete module has to be written for calling stored procedure?. The stored procedures are not compatible (i.e. they have completely different inputs and outputs as compared to the SQL queries already present) -A new module rlm_sql_sp can simplify things for the long run, but it is not an easy route. Any other suggestions and comments are more than welcome. -- Shahzada Hatim (Sofware Engineer) Iphonica LLC (www.iphonica.com)

3 2