February 2008 - Freeradius-Devel - lists.freeradius.org

Not working in changing SQL queries in sql.conf
by johnson elangbam 28 Feb '08

28 Feb '08

hi, I've tried changing SQL queries in sql.conf in order to read the username and password only from my customized table, but it doesn't work. It seems like I have to change the code in something like sql.c or rlm_sql.c, Please help. Here is the output of the radius server after rejecting the user. rad_recv: Access-Request packet from host 127.0.0.1 port 32834, id=56, length=58 User-Name = "magnum" User-Password = "opus" NAS-IP-Address = 192.168.2.227 NAS-Port = 0 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "magnum", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop expand: %{User-Name} -> magnum rlm_sql (sql): sql_set_user escaped user --> 'magnum' rlm_sql (sql): Reserving sql socket id: 4 expand: SELECT UserName,Value FROM radcheck WHERE Username = '%{SQL-User-Name}' -> SELECT UserName,Value FROM radcheck WHERE Username = 'magnum' query: SELECT UserName,Value FROM radcheck WHERE Username = 'magnum' rlm_sql: The 'Attribute' field is empty or NULL, skipping the entire row. rlm_sql (sql): Error getting data from database rlm_sql (sql): SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 4 ++[sql] returns fail Invalid user: [magnum/opus] (from client localhost port 0) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> magnum attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 56 to 127.0.0.1 port 32834 Waking up in 4.9 seconds. Cleaning up request 0 ID 56 with timestamp +14 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 32834, id=115, length=56 User-Name = "john" User-Password = "john" NAS-IP-Address = 192.168.2.227 NAS-Port = 0 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "john", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop expand: %{User-Name} -> john rlm_sql (sql): sql_set_user escaped user --> 'john' rlm_sql (sql): Reserving sql socket id: 3 expand: SELECT UserName,Value FROM radcheck WHERE Username = '%{SQL-User-Name}' -> SELECT UserName,Value FROM radcheck WHERE Username = 'john' query: SELECT UserName,Value FROM radcheck WHERE Username = 'john' rlm_sql: The 'Attribute' field is empty or NULL, skipping the entire row. rlm_sql (sql): Error getting data from database rlm_sql (sql): SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 3 ++[sql] returns fail Invalid user: [john/john] (from client localhost port 0) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> john attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 115 to 127.0.0.1 port 32834 Waking up in 4.9 seconds. Cleaning up request 1 ID 115 with timestamp +23 Ready to process requests. With Regards Elangbam Johnson

2 1

Automatic report from sources (radiusd) between 27.02.2008 - 28.02.2008 GMT
by Automatic cvs log generator 28 Feb '08

28 Feb '08

CVS log entries from 27.02.2008 (Wed) 09:00:00 - 28.02.2008 (Thu) 09:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/modules/rlm_linelog/rlm_linelog.c; Revisions: 1.16 File: radiusd/raddb/sites-available/vmps; Revisions: 1.6, 1.5, 1.4, 1.3 ===================================================== Log entries ===================================================== Description: Corrected typo Modified files: File: radiusd/raddb/sites-available/vmps; Revision: 1.6; Date: 2008/02/27 12:26:08; Author: aland; Lines: (+3 -2) ------------------------------- Description: Note that proxying of VMPS requests is not supported Modified files: File: radiusd/raddb/sites-available/vmps; Revision: 1.5; Date: 2008/02/27 12:25:10; Author: aland; Lines: (+2 -5) ------------------------------- Description: Added a few more examples Modified files: File: radiusd/raddb/sites-available/vmps; Revision: 1.4; Date: 2008/02/27 12:24:31; Author: aland; Lines: (+10 -5) ------------------------------- Description: Add samples of creating VMPS-Mac field, if it doesn't exist Modified files: File: radiusd/raddb/sites-available/vmps; Revision: 1.3; Date: 2008/02/27 12:18:54; Author: aland; Lines: (+16 -1) ------------------------------- Description: added preliminary syslog support Modified files: File: radiusd/src/modules/rlm_linelog/rlm_linelog.c; Revision: 1.16; Date: 2008/02/27 14:15:48; Author: aland; Lines: (+61 -14) ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/sites-available/vmps Revisions: 1.6, 1.5, 1.4, 1.3 Authors: aland (+3 -2), aland (+2 -5), aland (+10 -5), aland (+16 -1) ------------------------------- File: radiusd/src/modules/rlm_linelog/rlm_linelog.c Revisions: 1.16 Authors: aland (+61 -14) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

how to customize my database
by johnson elangbam 27 Feb '08

27 Feb '08

hi, I am using free radius 2 with MS Sql 2000. I want to make a database schema of my own to store only username and password in MS Sql. I would like to modify the query so that the radius server reads only this information from my customized table. Should I modified at rlm_sql.c or in sql.c With Regards Elangbam Johnson

2 1

Automatic report from sources (radiusd) between 26.02.2008 - 27.02.2008 GMT
by Automatic cvs log generator 27 Feb '08

27 Feb '08

CVS log entries from 26.02.2008 (Tue) 09:00:01 - 27.02.2008 (Wed) 09:00:00 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/modules/rlm_dbm/rlm_dbm_parser.c; Revisions: 1.18 File: radiusd/src/lib/radius.c; Revisions: 1.217 File: radiusd/raddb/eap.conf; Revisions: 1.24 File: radiusd/src/modules/rlm_dbm/rlm_dbm.c; Revisions: 1.23 File: radiusd/raddb/Makefile; Revisions: 1.37 File: radiusd/doc/rfc/rfc5176.txt; Revisions: 1.1 File: radiusd/src/main/event.c; Revisions: 1.90 File: radiusd/raddb/sites-available/inner-tunnel; Revisions: 1.5 ===================================================== Combined list of identical log entries ===================================================== Description: Added notes on inner/outer tunnel identities being different. Enable "inner-tunnel" by default, and install it. Also by default, do NOT proxy inner tunnel sessions. Modified files: File: radiusd/raddb/Makefile; Revision: 1.37; Date: 2008/02/26 09:32:29; Author: aland; Lines: (+5 -1) File: radiusd/raddb/eap.conf; Revision: 1.24; Date: 2008/02/26 09:32:29; Author: aland; Lines: (+5 -5) File: radiusd/raddb/sites-available/inner-tunnel; Revision: 1.5; Date: 2008/02/26 09:32:29; Author: aland; Lines: (+23 -1) ===================================================== Log entries ===================================================== Description: Obseletes RFC 3576 Modified files: File: radiusd/doc/rfc/rfc5176.txt; Revision: 1.1; Date: 2008/02/26 16:28:58; Author: aland; ------------------------------- Description: Clean up warning messages. Add PW_COA_REQUEST to verification of incoming packet. Move PW_DISCONNECT_REQUEST for verification to use the accounting request calculation, not the auth request calculation Modified files: File: radiusd/src/lib/radius.c; Revision: 1.217; Date: 2008/02/26 14:04:44; Author: aland; Lines: (+10 -8) ------------------------------- Description: Corrected typo Modified files: File: radiusd/src/main/event.c; Revision: 1.90; Date: 2008/02/26 14:06:12; Author: aland; Lines: (+3 -3) ------------------------------- Description: Corrected typo. Closes bug #521 Modified files: File: radiusd/src/modules/rlm_dbm/rlm_dbm.c; Revision: 1.23; Date: 2008/02/26 09:11:33; Author: aland; Lines: (+3 -3) ------------------------------- Description: Corrected typo. Close bug #522 Modified files: File: radiusd/src/modules/rlm_dbm/rlm_dbm_parser.c; Revision: 1.18; Date: 2008/02/26 09:11:18; Author: aland; Lines: (+4 -4) ===================================================== Summary of modified files ===================================================== File: radiusd/doc/rfc/rfc5176.txt Revisions: 1.1 Authors: aland ------------------------------- File: radiusd/raddb/Makefile Revisions: 1.37 Authors: aland (+5 -1) ------------------------------- File: radiusd/raddb/eap.conf Revisions: 1.24 Authors: aland (+5 -5) ------------------------------- File: radiusd/raddb/sites-available/inner-tunnel Revisions: 1.5 Authors: aland (+23 -1) ------------------------------- File: radiusd/src/lib/radius.c Revisions: 1.217 Authors: aland (+10 -8) ------------------------------- File: radiusd/src/main/event.c Revisions: 1.90 Authors: aland (+3 -3) ------------------------------- File: radiusd/src/modules/rlm_dbm/rlm_dbm.c Revisions: 1.23 Authors: aland (+3 -3) ------------------------------- File: radiusd/src/modules/rlm_dbm/rlm_dbm_parser.c Revisions: 1.18 Authors: aland (+4 -4) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

serious problem with 2.0 rlm_sql?
by Hoppál Felicián 26 Feb '08

26 Feb '08

Hello, I'm new to this list but not to FreeRADIUS. There's a quite big change in 2.0 which might lead to serious issues with more complex FreeRADIUS setups but I'm not sure if it's a bug. In 1.x you could use any attribute in authorize_group_check_query to validate the user. I mean if you specified a Huntgroup-Name in the groupcheck sql table it worked, the rlm_sql module returned a not found if those pairs didn't match: if (paircmp(request, request->packet->vps, check_tmp, &reply_tmp) != 0) { radlog(L_INFO, "rlm_sql (%s): No matching entry in the database for request from user [%s]", inst->config->xlat_name, sqlusername); /* Remove the username we (maybe) added above */ pairdelete(&request->packet->vps, PW_SQL_USER_NAME); pairfree(&reply_tmp); pairfree(&check_tmp); return RLM_MODULE_NOTFOUND; } We use this for example the ADSL group has a Huntgroup-Name =~ pppoe|dialup This changed in 2.0 with separating rlm_sql_process_groups(). If you put these checks in the usercheck table they will still work, FreeRADIUS won't find the user and will return an Access-Reject to the client. But if you put it in the radgroupcheck table see what happens: The rlm_sql_authorize() checks if these pairs match with the Access-Request and the usercheck table: /* * Only do this if *some* check pairs were returned */ if (paircompare(request, request->packet->vps, check_tmp, &request->reply->vps) == 0) { found = 1; They will match because Huntgroup-Name is in the groupcheck table and not in the usercheck. So the user is found and FreeRADIUS will process the groups. And the problem in rlm_sql_process_groups: } else if (rows > 0) { /* * Only do this if *some* check pairs were returned */ if (paircompare(request, request->packet->vps, check_tmp, &request->reply->vps) == 0) { found = 1; DEBUG2("rlm_sql (%s): User found in group %s", inst->config->xlat_name, group_list_tmp->groupname); /* * Now get the reply pairs since the paircompare matched */ if (!radius_xlat(querystr, sizeof(querystr), inst->config->authorize_group_reply_query, request, sql_escape_func)) { radlog(L_ERR, "rlm_sql (%s): Error generating query; rejecting user", inst->config->xlat_name); /* Remove the grouup we added above */ pairdelete(&request->packet->vps, PW_SQL_GROUP); pairfree(&check_tmp); return -1; } if (sql_getvpdata(inst, sqlsocket, &reply_tmp, querystr) < 0) { radlog(L_ERR, "rlm_sql (%s): Error retrieving reply pairs for group %s", inst->config->xlat_name, group_list_tmp->groupname); /* Remove the grouup we added above */ pairdelete(&request->packet->vps, PW_SQL_GROUP); pairfree(&check_tmp); pairfree(&reply_tmp); return -1; } *dofallthrough = fallthrough(reply_tmp); pairxlatmove(request, &request->reply->vps, &reply_tmp); pairxlatmove(request, &request->config_items, &check_tmp); } The paircompare() won't be true because the Huntgroup-Name doesn't match, but the USER WON'T GET ACCESS-REJECT! The only thing that happens is the user won't get the pairs specified in the groupreply table because the paircompare() won't be true. So the rlm_sql_process_groups returns without the groupreply pairs and rlm_sql_authorize lets the user in: if (!found) { radlog(L_DBG, "rlm_sql (%s): User %s not found", inst->config->xlat_name, sqlusername); return RLM_MODULE_NOTFOUND; } else { return RLM_MODULE_OK; } I think it's a quite serious problem. Best regards, Felician Hoppal

1 0

Automatic report from sources (radiusd) between 25.02.2008 - 26.02.2008 GMT
by Automatic cvs log generator 26 Feb '08

26 Feb '08

CVS log entries from 25.02.2008 (Mon) 09:00:00 - 26.02.2008 (Tue) 09:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/main/evaluate.c; Revisions: 1.38 ===================================================== Log entries ===================================================== Description: use strncmp, not memcmp Modified files: File: radiusd/src/main/evaluate.c; Revision: 1.38; Date: 2008/02/25 11:07:09; Author: aland; Lines: (+10 -10) ===================================================== Summary of modified files ===================================================== File: radiusd/src/main/evaluate.c Revisions: 1.38 Authors: aland (+10 -10) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Strange packet causing radius to crash.
by Matthew Schumacher 21 Feb '08

21 Feb '08

List, A long while ago I posted some requests to have the NAS_Idenitfier passed to the session_zap function so that stop messages created to zap sessions would have the correct NAS_Identifier. I need this because I made some accounting decisions based on this attribute. I posted in bugzilla and even wrote a patch for it: http://bugs.freeradius.org/show_bug.cgi?id=381 The patch proved to be unreliable, and now I'm trying to figure out why. Most of the time it works fine, but every now and then it crashes the radius server. In digging around trying to figure out why it doesn't work I was able to capture the Access-Request packet that crashes the server. In wireshark it shows the error, "VSA too short": User Datagram Protocol, Src Port: 1645 (1645), Dst Port: 1645 (1645) Source port: 1645 (1645) Destination port: 1645 (1645) Length: 163 Checksum: 0x96d2 [correct] Radius Protocol Code: Access-Request (1) Packet identifier: 0xa0 (160) Length: 155 Authenticator: 1CC1E84AA40F3B2168FD1A0CF4D60DFB Attribute Value Pairs AVP: l=11 t=User-Name(1): michael.s User-Name: michael.s AVP: l=18 t=User-Password(2): Encrypted User-Password: \221- AVP: l=6 t=NAS-IP-Address(4): x.x.x.x NAS-IP-Address: x.x.x.x (x.x.x.x) AVP: l=6 t=NAS-Port(5): 257 NAS-Port: 257 AVP: l=10 t=Acct-Session-Id(44): 16779082 Acct-Session-Id: 16779082 AVP: l=14 t=Vendor-Specific(26) v=UTStarcom Incorporated(429) [VSA too short] Does anyone know what the deal is with this? Reading the RFC it looks like I should get the 1 byte for the type, 1 byte for length, 4 bytes for id, then string. In the capture I have this, but there are ~ 48 bytes after this. Any help would be greatly appreciated. Oh, before I forget, platform is linux, radius is 1.1.7. Thanks, schu

2 4

Automatic report from sources (radiusd) between 19.02.2008 - 20.02.2008 GMT
by Automatic cvs log generator 20 Feb '08

20 Feb '08

CVS log entries from 19.02.2008 (Tue) 09:00:00 - 20.02.2008 (Wed) 09:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/main/event.c; Revisions: 1.89, 1.88 File: radiusd/src/main/detail.c; Revisions: 1.9 File: radiusd/src/include/detail.h; Revisions: 1.2 ===================================================== Combined list of identical log entries ===================================================== Description: Clean up handling of detail files && events. It's much more understandable now... Note also that SNMP appears to be broken. Oops... Modified files: File: radiusd/src/include/detail.h; Revision: 1.2; Date: 2008/02/19 09:44:14; Author: aland; Lines: (+3 -2) File: radiusd/src/main/detail.c; Revision: 1.9; Date: 2008/02/19 09:44:14; Author: aland; Lines: (+57 -37) File: radiusd/src/main/event.c; Revision: 1.89; Date: 2008/02/19 09:44:14; Author: aland; Lines: (+118 -183) ===================================================== Log entries ===================================================== Description: Initialize buffer properly... Modified files: File: radiusd/src/main/event.c; Revision: 1.88; Date: 2008/02/19 09:36:41; Author: aland; Lines: (+4 -6) ===================================================== Summary of modified files ===================================================== File: radiusd/src/include/detail.h Revisions: 1.2 Authors: aland (+3 -2) ------------------------------- File: radiusd/src/main/detail.c Revisions: 1.9 Authors: aland (+57 -37) ------------------------------- File: radiusd/src/main/event.c Revisions: 1.89, 1.88 Authors: aland (+118 -183), aland (+4 -6) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

message digests and modulus sizes supported in free radius
by Jagadish 19 Feb '08

19 Feb '08

Hi, Can anybody please tell me which standard does free radius supports for signature generation and signature verification? I mean, there are standards like (1) PKCS1_V1_5 (2) PSS (3) ANSIX9.31 Which standard does free radius support? I have one more doubt on type of message digest algorithms and modulus sizes supported in free radius. I generated certificates with sha1 and with modulus size 1024. This is working fine. I want to know if it works with other message digests like sha224, sha256, sha384, sha512 and modulus sizes like 1536, 2048, 3072, 4096. Please help me in this regard. thanks in advance, Jagadish

2 1

Automatic report from sources (radiusd) between 18.02.2008 - 19.02.2008 GMT
by Automatic cvs log generator 19 Feb '08

19 Feb '08

CVS log entries from 18.02.2008 (Mon) 09:00:01 - 19.02.2008 (Tue) 09:00:00 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/modules/rlm_eap/types/rlm_eap_peap/peap.c; Revisions: 1.35 File: radiusd/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c; Revisions: 1.44 ===================================================== Combined list of identical log entries ===================================================== Description: Set fake->request->src_ipaddr from request->packet->src_ipaddr, just like rad_alloc_fake() does. This lets certain multi-stage proxying of inner tunnel PEAP/TTLS sessions work. Bug found && patch by Dmitry Sergienko Modified files: File: radiusd/src/modules/rlm_eap/types/rlm_eap_peap/peap.c; Revision: 1.35; Date: 2008/02/18 23:56:25; Author: aland; Lines: (+4 -6) File: radiusd/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c; Revision: 1.44; Date: 2008/02/18 23:56:25; Author: aland; Lines: (+3 -2) ===================================================== Log entries ===================================================== ===================================================== Summary of modified files ===================================================== File: radiusd/src/modules/rlm_eap/types/rlm_eap_peap/peap.c Revisions: 1.35 Authors: aland (+4 -6) ------------------------------- File: radiusd/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c Revisions: 1.44 Authors: aland (+3 -2) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0