August 2007 - Freeradius-Devel - lists.freeradius.org

rlm_sqlippool segfaults on wrong/missing rlm_sql instance
by Stephan Jaeger 03 Oct '07

03 Oct '07

Hi, rlm_sqlippool segfaults if you specify a non existing sql module instance. I modified it a bit to behave like rlm_sqlhpwippool, it now throws an error if the specified module instance does not exist: Tue Jul 31 11:23:16 2007 : Error: ERROR: Cannot find a configuration entry for module "foobar". Tue Jul 31 11:23:16 2007 : Error: sqlippool_instantiate: failed to find sql instance named foobar And also throws an error if the specified module is not an instance of rlm_sql: Tue Jul 31 11:28:24 2007 : Error: sqlippool_instantiate: given instance (expr) is not an instance of the rlm_sql module Regards Stephan Jaeger -- Stephan Jaeger <stephan.jaeger(a)ewetel.de> EWE TEL GmbH

2 1

Deleting reply items before post-proxy
by Eddie Stassen 04 Sep '07

04 Sep '07

Could someone please explain to me if there is any specific reasoning behind the following lines right in the beginning of proxy_receive() in proxy.c? (version 1.1.7, similar code in event.c in 2.0) /* * Delete any reply we had accumulated until now. */ pairfree(&request->reply->vps); I was trying to get rid of my 'post-proxy-authorize' dependency and found that any attributes added during the authorize stage are removed when the proxy reply is received. Surely this is not intended behaviour as further down in proxy_receive() we have the following lines: /* * Add the attributes left in the proxy reply to * the reply list. */ pairadd(&request->reply->vps, request->proxy_reply->vps); Removing the initial pairfree() gives me the behaviour I expected, i.e. add some stuff during authorize, proxy, then combine reply and proxy_reply items before responding. Am I missing something? Eddie

7 20

CVS Server
by Arran Cudbard-Bell 01 Sep '07

01 Sep '07

cvs update: Updating . cvs update: failed to create lock directory for `/source/radiusd' (/source/radiusd/#cvs.lock): No space left on device cvs update: failed to obtain dir lock in repository `/source/radiusd' cvs [update aborted]: read lock failed - giving up --- Arran

6 8

Automatic report from sources (radiusd) between 30.08.2007 - 31.08.2007 GMT
by Automatic cvs log generator 31 Aug '07

31 Aug '07

CVS log entries from 30.08.2007 (Thu) 08:00:02 - 31.08.2007 (Fri) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/modules/rlm_ldap/rlm_ldap.c; Revisions: 1.186 File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_unixodbc/sql_unixodbc.c; Revisions: 1.22, 1.11.2.2.2.2 File: radiusd/src/main/event.c; Revisions: 1.48, 1.47 File: radiusd/src/main/threads.c; Revisions: 1.133 File: radiusd/src/main/mainconfig.c; Revisions: 1.120 File: radiusd/src/lib/valuepair.c; Revisions: 1.125, 1.82.2.1.2.6 ===================================================== Log entries ===================================================== Description: time_t may be 64 bits, so we can't pass &vp->vp_date directly to a function that expects (time_t *) Modified files: File: radiusd/src/lib/valuepair.c; Revision: 1.125; Date: 2007/08/30 08:53:26; Author: aland; Lines: (+24 -7) ------------------------------- Description: Pull time_t fix from CVS head Modified files: File: radiusd/src/lib/valuepair.c; Revision: 1.82.2.1.2.6; Date: 2007/08/30 08:55:06; Author: aland; Lines: (+22 -8) ------------------------------- Description: Moved more code into common section Modified files: File: radiusd/src/main/event.c; Revision: 1.48; Date: 2007/08/30 08:38:05; Author: aland; Lines: (+42 -39) ------------------------------- Description: Moved more paircreate() to radius_paircreate() Modified files: File: radiusd/src/main/event.c; Revision: 1.47; Date: 2007/08/30 08:29:44; Author: aland; Lines: (+7 -15) ------------------------------- Description: Replaced calls to exit(1) with better code Modified files: File: radiusd/src/main/mainconfig.c; Revision: 1.120; Date: 2007/08/30 08:46:02; Author: aland; Lines: (+33 -33) ------------------------------- Description: Removed one more call to exit() Modified files: File: radiusd/src/main/threads.c; Revision: 1.133; Date: 2007/08/30 08:42:52; Author: aland; Lines: (+4 -4) ------------------------------- Description: After ldap_authorize, if there's no "known good" password, COMPLAIN. This might help the people who can't be bothered to read the documentation. Modified files: File: radiusd/src/modules/rlm_ldap/rlm_ldap.c; Revision: 1.186; Date: 2007/08/30 12:15:33; Author: aland; Lines: (+12 -1) ------------------------------- Description: Port fix from 1.1.x. Modified files: File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_unixodbc/sql_unixodbc.c; Revision: 1.22; Date: 2007/08/30 09:01:16; Author: aland; Lines: (+3 -3) ------------------------------- Description: SQLNumResultCols takes a "short", not an "int". Use the correct variable type Modified files: File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_unixodbc/sql_unixodbc.c; Revision: 1.11.2.2.2.2; Date: 2007/08/30 09:00:24; Author: aland; Lines: (+2 -2) ===================================================== Summary of modified files ===================================================== File: radiusd/src/lib/valuepair.c Revisions: 1.125, 1.82.2.1.2.6 Authors: aland (+24 -7), aland (+22 -8) ------------------------------- File: radiusd/src/main/event.c Revisions: 1.48, 1.47 Authors: aland (+42 -39), aland (+7 -15) ------------------------------- File: radiusd/src/main/mainconfig.c Revisions: 1.120 Authors: aland (+33 -33) ------------------------------- File: radiusd/src/main/threads.c Revisions: 1.133 Authors: aland (+4 -4) ------------------------------- File: radiusd/src/modules/rlm_ldap/rlm_ldap.c Revisions: 1.186 Authors: aland (+12 -1) ------------------------------- File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_unixodbc/sql_unixodbc.c Revisions: 1.22, 1.11.2.2.2.2 Authors: aland (+3 -3), aland (+2 -2) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 29.08.2007 - 30.08.2007 GMT
by Automatic cvs log generator 30 Aug '07

30 Aug '07

CVS log entries from 29.08.2007 (Wed) 08:00:01 - 30.08.2007 (Thu) 08:00:02 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/main/event.c; Revisions: 1.46 File: radiusd/src/main/threads.c; Revisions: 1.132 File: radiusd/INSTALL; Revisions: 1.9 ===================================================== Combined list of identical log entries ===================================================== Description: Replaced exit(1) with return -1; Modified files: File: radiusd/src/main/event.c; Revision: 1.46; Date: 2007/08/30 04:15:35; Author: aland; Lines: (+5 -3) File: radiusd/src/main/threads.c; Revision: 1.132; Date: 2007/08/30 04:15:34; Author: aland; Lines: (+13 -13) ===================================================== Log entries ===================================================== Description: Added notes on upgrading Modified files: File: radiusd/INSTALL; Revision: 1.9; Date: 2007/08/29 08:37:45; Author: aland; Lines: (+47 -2) ===================================================== Summary of modified files ===================================================== File: radiusd/INSTALL Revisions: 1.9 Authors: aland (+47 -2) ------------------------------- File: radiusd/src/main/event.c Revisions: 1.46 Authors: aland (+5 -3) ------------------------------- File: radiusd/src/main/threads.c Revisions: 1.132 Authors: aland (+13 -13) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 28.08.2007 - 29.08.2007 GMT
by Automatic cvs log generator 29 Aug '07

29 Aug '07

CVS log entries from 28.08.2007 (Tue) 08:00:00 - 29.08.2007 (Wed) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/modules/rlm_krb5/configure; Revisions: 1.14 File: radiusd/src/main/realms.c; Revisions: 1.28, 1.27 File: radiusd/raddb/proxy.conf; Revisions: 1.28 File: radiusd/src/modules/rlm_krb5/configure.in; Revisions: 1.11 File: radiusd/src/lib/print.c; Revisions: 1.51, 1.50 ===================================================== Combined list of identical log entries ===================================================== Description: Fail the build if there's no krb5.h Modified files: File: radiusd/src/modules/rlm_krb5/configure; Revision: 1.14; Date: 2007/08/28 08:03:12; Author: aland; Lines: (+3 -0) File: radiusd/src/modules/rlm_krb5/configure.in; Revision: 1.11; Date: 2007/08/28 08:03:14; Author: aland; Lines: (+4 -1) ------------------------------- Description: Removed extraneous "hostname" configuration entry from realms Modified files: File: radiusd/raddb/proxy.conf; Revision: 1.28; Date: 2007/08/28 08:23:21; Author: aland; Lines: (+14 -11) File: radiusd/src/main/realms.c; Revision: 1.27; Date: 2007/08/28 08:23:22; Author: aland; Lines: (+7 -10) ===================================================== Log entries ===================================================== Description: Add check for delimitst < 0 back in. Modified files: File: radiusd/src/lib/print.c; Revision: 1.51; Date: 2007/08/28 13:01:50; Author: aland; Lines: (+6 -2) ------------------------------- Description: Allow valid UTF-8 characters when printing things. Modified files: File: radiusd/src/lib/print.c; Revision: 1.50; Date: 2007/08/28 09:45:56; Author: aland; Lines: (+130 -29) ------------------------------- Description: Updated error message Modified files: File: radiusd/src/main/realms.c; Revision: 1.28; Date: 2007/08/28 08:24:43; Author: aland; Lines: (+3 -3) ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/proxy.conf Revisions: 1.28 Authors: aland (+14 -11) ------------------------------- File: radiusd/src/lib/print.c Revisions: 1.51, 1.50 Authors: aland (+6 -2), aland (+130 -29) ------------------------------- File: radiusd/src/main/realms.c Revisions: 1.28, 1.27 Authors: aland (+3 -3), aland (+7 -10) ------------------------------- File: radiusd/src/modules/rlm_krb5/configure Revisions: 1.14 Authors: aland (+3 -0) ------------------------------- File: radiusd/src/modules/rlm_krb5/configure.in Revisions: 1.11 Authors: aland (+4 -1) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

3 2

xlat UTF-8 stuff for 1.1.x backport
by Enrik Berkhan 28 Aug '07

28 Aug '07

Hi, using the attached patch my LDAP-requests returning UTF-8 and embedded commas work now using 1.1.7. This should fix bug #411, too. Enrik Index: src/lib/print.c =================================================================== RCS file: /source/radiusd/src/lib/print.c,v retrieving revision 1.26.2.1.2.2 diff -u -b -r1.26.2.1.2.2 print.c --- src/lib/print.c 15 Mar 2006 15:37:56 -0000 1.26.2.1.2.2 +++ src/lib/print.c 28 Aug 2007 14:26:07 -0000 @@ -33,28 +33,123 @@ #include "libradius.h" /* - * Convert a string to something printable. - * The output string has to be _at least_ 4x the size - * of the input string! + * Checks for utf-8, taken from: + * + * http://www.w3.org/International/questions/qa-forms-utf-8 + * + * Note that we don't care about the length of the input string, + * because '\0' is an invalid UTF-8 character. + */ +static int utf8_char(uint8_t *str) +{ + if (*str < 0x20) return 0; + + if (*str <= 0x7e) return 1; /* 1 */ + + if (*str <= 0xc1) return 0; + + if ((str[0] >= 0xc2) && /* 2 */ + (str[0] <= 0xdf) && + (str[1] >= 0x80) && + (str[1] <= 0xbf)) { + return 2; + } + + if ((str[0] == 0xe0) && /* 3 */ + (str[1] >= 0xa0) && + (str[1] <= 0xbf) && + (str[2] >= 0x80) && + (str[2] <= 0xbf)) { + return 3; + } + + if ((str[0] >= 0xe1) && /* 4a */ + (str[0] <= 0xec) && + (str[1] >= 0x80) && + (str[1] <= 0xbf) && + (str[2] >= 0x80) && + (str[2] <= 0xbf)) { + return 3; + } + + if ((str[0] >= 0xee) && /* 4b */ + (str[0] <= 0xef) && + (str[1] >= 0x80) && + (str[1] <= 0xbf) && + (str[2] >= 0x80) && + (str[2] <= 0xbf)) { + return 3; + } + + if ((str[0] == 0xed) && /* 5 */ + (str[1] >= 0x80) && + (str[1] <= 0x9f) && + (str[2] >= 0x80) && + (str[2] <= 0xbf)) { + return 3; + } + + if ((str[0] == 0xf0) && /* 6 */ + (str[1] >= 0x90) && + (str[1] <= 0xbf) && + (str[2] >= 0x80) && + (str[2] <= 0xbf) && + (str[3] >= 0x80) && + (str[3] <= 0xbf)) { + return 4; + } + + if ((str[0] >= 0xf1) && /* 6 */ + (str[1] <= 0xf3) && + (str[1] >= 0x80) && + (str[1] <= 0xbf) && + (str[2] >= 0x80) && + (str[2] <= 0xbf) && + (str[3] >= 0x80) && + (str[3] <= 0xbf)) { + return 4; + } + + + if ((str[0] == 0xf4) && /* 7 */ + (str[1] >= 0x80) && + (str[1] <= 0x8f) && + (str[2] >= 0x80) && + (str[2] <= 0xbf) && + (str[3] >= 0x80) && + (str[3] <= 0xbf)) { + return 4; + } + + /* + * Invalid UTF-8 Character + */ + return 0; +} + +/* + * Convert a string to something printable. The output string + * has to be larger than the input string by at least 5 bytes. + * If not, the output is silently truncated... */ void librad_safeprint(char *in, int inlen, char *out, int outlen) { unsigned char *str = (unsigned char *)in; - int done = 0; int sp = 0; + int utf8 = 0; if (inlen < 0) inlen = strlen(in); - while (inlen-- > 0 && (done + 3) < outlen) { + /* + * + */ + while ((inlen > 0) && (outlen > 4)) { /* * Hack: never print trailing zero. * Some clients send strings with an off-by-one * length (confused with strings in C). */ - if (inlen == 0 && *str == 0) - break; - - sp = 0; + if ((inlen == 0) && (*str == 0)) break; switch (*str) { case '\\': @@ -69,25 +164,38 @@ case '\t': sp = 't'; break; + case '"': + sp = '"'; + break; default: - if (*str < 32 || (*str >= 128)){ - snprintf(out, outlen, "\\%03o", *str); - done += 4; - out += 4; - outlen -= 4; - } else { - *out++ = *str; - outlen--; - done++; - } + sp = 0; + break; } + if (sp) { *out++ = '\\'; *out++ = sp; outlen -= 2; - done += 2; + str++; + inlen--; + continue; } + + utf8 = utf8_char((uint8_t *)str); + if (!utf8) { + snprintf(out, outlen, "\\%03o", *str); + out += 4; + outlen -= 4; str++; + inlen--; + continue; + } + + do { + *out++ = *str++; + outlen--; + inlen--; + } while (--utf8 > 0); } *out = 0; } @@ -117,18 +225,23 @@ if (vp->attribute == PW_NAS_PORT) a = (char *)vp->strvalue; else { - if (delimitst && vp->flags.has_tag) { + if (delimitst == 1 && vp->flags.has_tag) { /* Tagged attribute: print delimter and ignore tag */ buf[0] = '"'; librad_safeprint((char *)(vp->strvalue), vp->length, buf + 1, sizeof(buf) - 2); strcat(buf, "\""); - } else if (delimitst) { + } else if (delimitst == 1) { /* Non-tagged attribute: print delimter */ buf[0] = '"'; librad_safeprint((char *)vp->strvalue, vp->length, buf + 1, sizeof(buf) - 2); strcat(buf, "\""); + + } else if (delimitst < 0) { /* xlat.c */ + strlcpy(out, vp->strvalue, outlen); + return strlen(out); + } else { /* Non-tagged attribute: no delimiter */ librad_safeprint((char *)vp->strvalue, Index: src/main/xlat.c =================================================================== RCS file: /source/radiusd/src/main/xlat.c,v retrieving revision 1.72.2.7.2.5 diff -u -b -r1.72.2.7.2.5 xlat.c --- src/main/xlat.c 14 Jul 2007 11:07:54 -0000 1.72.2.7.2.5 +++ src/main/xlat.c 28 Aug 2007 14:26:08 -0000 @@ -72,7 +72,7 @@ char buffer[MAX_STRING_LEN * 4]; if (pair != NULL) { - vp_prints_value(buffer, sizeof(buffer), pair, 0); + vp_prints_value(buffer, sizeof(buffer), pair, -1); return func(out, outlen, buffer); }

1 0

Problem with expansion of %{Ldap-UserDn} containing UTF-8 (cf. Bug #411)
by Enrik Berkhan 28 Aug '07

28 Aug '07

Hi, there is a problem at least with LDAP group compares when Ldap-UserDn contains UTF-8 which seems not to be uncommon nowadays :) (see Bug #411) I have a setup where I use Active Directory for authorization via groupmembership_filter. Assume the following: basedn = "dc=example,dc=com" filter = "(userPrincipalName=%{Stripped-User-Name})" base_filter = "(objectclass=user)" groupmembership_filter = "(&(objectClass=group)(member=%{Ldap-UserDn}))" users file: DEFAULT ldap-group == "CN=allow-members-of-this-group,OU=Groups,DC=example,DC=com" The entry in the users file triggers the LDAP group compare function, which in turn first searches for the user (assume Ldap-UserDn has not been set before) and then does a second search using the group DN as base DN and groupmembership_filter as filter. Assume now the first search returns a user_dn containing UTF-8. The %{Ldap-UserDn} in the groupmembership_filter will then be expanded by xlat.c using \ooo (octal) for the 8bit characters. Then, the second search can not match, because the member attribute of the group contains member DNs in UTF-8, but the value to compare has been 'destroyed' by xlat. 1. How can this issue be solved for Ldap-UserDn? Or does a solution already exists that I have overlooked? 2. Is this a general issue for variable expansions handling _all_ 8bit characters as kind of 'non-printable', may be 'unsafe' characters? Remember that most query expansions like in rlm_ldap and rlm_sql have their own notion of unsafe characters and escape again ... Thanks for any ideas. Enrik

2 20

problem with proxy and 2.0pre2
by A.L.M.Buxey＠lboro.ac.uk 28 Aug '07

28 Aug '07

hi, I've been upgrading a few 1.1.7 boxes to 2.0pre2 due to now requiring the extensive new features and fixes ;-) anyway, i am facing an issue with proxying.... leaving the config pretty much as was the default I see the following with rlm_realm in the radiusd -X logging ++[auth_log] returns ok ++[mschap] returns noop rlm_realm: Looking up realm "example.co.uk" for User-Name = "testuser(a)example.co.uk" rlm_realm: No such realm "example.co.uk" ...i have a DEFAULT entry realm in the proxy.conf - as before - but it is not being used or, it seems, detected. a NULL entry is happily used and my locally defined realms and LOCAL realm are also being used. I'll carry on digging to see if theres an assumption or peculiarity being made here. alan

3 5

Automatic report from sources (radiusd) between 24.08.2007 - 25.08.2007 GMT
by Automatic cvs log generator 25 Aug '07

25 Aug '07

CVS log entries from 24.08.2007 (Fri) 08:00:02 - 25.08.2007 (Sat) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/include/vmps.h; Revisions: 1.1 File: radiusd/src/main/radiusd.c; Revisions: 1.371 File: radiusd/src/main/listen.c; Revisions: 1.98, 1.97 File: radiusd/README; Revisions: 1.8 File: radiusd/src/main/Makefile.in; Revisions: 1.69 File: radiusd/src/main/detail.c; Revisions: 1.1 File: radiusd/src/main/vmps.c; Revisions: 1.3 File: radiusd/src/include/detail.h; Revisions: 1.1 File: radiusd/src/main/evaluate.c; Revisions: 1.28 ===================================================== Combined list of identical log entries ===================================================== Description: Cleaned up socket print routine moved VMPS stuff from listen.c to its own file Modified files: File: radiusd/src/main/listen.c; Revision: 1.97; Date: 2007/08/25 03:56:43; Author: aland; Lines: (+37 -91) File: radiusd/src/main/radiusd.c; Revision: 1.371; Date: 2007/08/25 03:56:44; Author: aland; Lines: (+4 -21) File: radiusd/src/main/vmps.c; Revision: 1.3; Date: 2007/08/25 03:56:44; Author: aland; Lines: (+86 -2) ------------------------------- Description: Moved detail file handling to its own source file Modified files: File: radiusd/src/include/detail.h; Revision: 1.1; Date: 2007/08/25 04:06:59; Author: aland; File: radiusd/src/main/Makefile.in; Revision: 1.69; Date: 2007/08/25 04:06:59; Author: aland; Lines: (+2 -2) File: radiusd/src/main/detail.c; Revision: 1.1; Date: 2007/08/25 04:06:58; Author: aland; File: radiusd/src/main/listen.c; Revision: 1.98; Date: 2007/08/25 04:06:59; Author: aland; Lines: (+5 -690) ===================================================== Log entries ===================================================== Description: More notes on 2.0 Modified files: File: radiusd/README; Revision: 1.8; Date: 2007/08/24 12:42:03; Author: aland; Lines: (+33 -23) ------------------------------- Description: Referenced from src/main/vmps.c Modified files: File: radiusd/src/include/vmps.h; Revision: 1.1; Date: 2007/08/25 03:58:40; Author: aland; ------------------------------- Description: Expand regular expressions, too Modified files: File: radiusd/src/main/evaluate.c; Revision: 1.28; Date: 2007/08/24 12:42:55; Author: aland; Lines: (+3 -4) ===================================================== Summary of modified files ===================================================== File: radiusd/README Revisions: 1.8 Authors: aland (+33 -23) ------------------------------- File: radiusd/src/include/detail.h Revisions: 1.1 Authors: aland ------------------------------- File: radiusd/src/include/vmps.h Revisions: 1.1 Authors: aland ------------------------------- File: radiusd/src/main/Makefile.in Revisions: 1.69 Authors: aland (+2 -2) ------------------------------- File: radiusd/src/main/detail.c Revisions: 1.1 Authors: aland ------------------------------- File: radiusd/src/main/evaluate.c Revisions: 1.28 Authors: aland (+3 -4) ------------------------------- File: radiusd/src/main/listen.c Revisions: 1.98, 1.97 Authors: aland (+5 -690), aland (+37 -91) ------------------------------- File: radiusd/src/main/radiusd.c Revisions: 1.371 Authors: aland (+4 -21) ------------------------------- File: radiusd/src/main/vmps.c Revisions: 1.3 Authors: aland (+86 -2) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0