April 2008 - Freeradius-Devel - lists.freeradius.org

rlm_sql: default Acct-On/Off query for all backends is somewhat bogus
by Stefan Winter 05 May '08

05 May '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, the query states (in variants): ~ accounting_onoff_query = "\ ~ UPDATE ${acct_table1} \ ~ SET \ ~ acctstoptime = '%S', \ ~ acctsessiontime = unix_timestamp('%S') - \ ~ unix_timestamp(acctstarttime), \ ~ acctterminatecause = '%{Acct-Terminate-Cause}', \ ~ acctstopdelay = %{%{Acct-Delay-Time}:-0} \ ~ WHERE acctsessiontime = 0 \ ~ AND acctstoptime = NULL \ ~ AND nasipaddress = '%{NAS-IP-Address}' \ ~ AND acctstarttime <= '%S'" and the acctsessiontime = 0 is bad: acctsessiontime gets updated whenever an interim record updates the session. The job of the query should be to close all open sessions, not just all open sessions that have been opened recently enough to not have received an update yet. I suggest to change the WHERE to ~ WHERE acctstoptime = NULL \ ~ AND nasipaddress = '%{NAS-IP-Address}' \ ~ AND acctstarttime <= '%S'" (leaving out the acctsessiontime = 0 constraint) Greetings, Stefan Winter -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.4-svn0 (GNU/Linux) Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org iD8DBQFIFtC/+jm90f8eFWYRAi7SAJ9jFGjLwKl7yyDhSAvWukgKkd8hNQCeKjrj s4DcCitbUu0FIEx+slNwB/A= =qNWG -----END PGP SIGNATURE-----

5 9

Automatic report from sources (radiusd) between 29.04.2008 - 30.04.2008 GMT
by Automatic cvs log generator 30 Apr '08

30 Apr '08

CVS log entries from 29.04.2008 (Tue) 08:00:00 - 30.04.2008 (Wed) 08:00:00 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/doc/ChangeLog; Revisions: 1.94 File: radiusd/raddb/sql/postgresql/nas.sql; Revisions: 1.2 File: radiusd/raddb/sql/oracle/nas.sql; Revisions: 1.2 File: radiusd/raddb/sql/mysql/nas.sql; Revisions: 1.2 File: radiusd/src/modules/rlm_sql/rlm_sql.c; Revisions: 1.179 File: radiusd/scripts/create-users.pl; Revisions: 1.4 ===================================================== Combined list of identical log entries ===================================================== Description: Add example "server" entry (commented out) Modified files: File: radiusd/raddb/sql/mysql/nas.sql; Revision: 1.2; Date: 2008/04/29 08:14:34; Author: aland; Lines: (+1 -0) File: radiusd/raddb/sql/oracle/nas.sql; Revision: 1.2; Date: 2008/04/29 08:14:34; Author: aland; Lines: (+3 -0) File: radiusd/raddb/sql/postgresql/nas.sql; Revision: 1.2; Date: 2008/04/29 08:14:34; Author: aland; Lines: (+3 -0) ===================================================== Log entries ===================================================== Description: Note recent updates Modified files: File: radiusd/doc/ChangeLog; Revision: 1.94; Date: 2008/04/29 08:14:47; Author: aland; Lines: (+4 -1) ------------------------------- Description: Use Cleartext-Password, not User-Password Modified files: File: radiusd/scripts/create-users.pl; Revision: 1.4; Date: 2008/04/29 09:06:20; Author: aland; Lines: (+1 -1) ------------------------------- Description: Added ability to read virtual server from SQL. Patch from Michael Bretterklieber Modified files: File: radiusd/src/modules/rlm_sql/rlm_sql.c; Revision: 1.179; Date: 2008/04/29 08:10:37; Author: aland; Lines: (+10 -5) ===================================================== Summary of modified files ===================================================== File: radiusd/doc/ChangeLog Revisions: 1.94 Authors: aland (+4 -1) ------------------------------- File: radiusd/raddb/sql/mysql/nas.sql Revisions: 1.2 Authors: aland (+1 -0) ------------------------------- File: radiusd/raddb/sql/oracle/nas.sql Revisions: 1.2 Authors: aland (+3 -0) ------------------------------- File: radiusd/raddb/sql/postgresql/nas.sql Revisions: 1.2 Authors: aland (+3 -0) ------------------------------- File: radiusd/scripts/create-users.pl Revisions: 1.4 Authors: aland (+1 -1) ------------------------------- File: radiusd/src/modules/rlm_sql/rlm_sql.c Revisions: 1.179 Authors: aland (+10 -5) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

nas-list from db vs. vserver
by Michael Bretterklieber 29 Apr '08

29 Apr '08

Hi, we found a small issue, when reading the naslist/client-list from a sql-db, it's not possible to get the vserver-name like in the clients.conf. Here's small patch whitch solves the problem: --- rlm_sql.c.orig 2008-04-28 11:49:06.000000000 +0200 +++ rlm_sql.c 2008-04-28 11:49:11.000000000 +0200 @@ -221,6 +221,7 @@ RADCLIENT *c; char *prefix_ptr = NULL; unsigned int i = 0; + int numf = 0; DEBUG("rlm_sql (%s): Processing generate_sql_clients", inst->config->xlat_name); @@ -254,6 +255,7 @@ * 2. Shortname * 3. Type * 4. Secret + * 5. Virtual Server (optional) */ if (!row[0]){ radlog(L_ERR, "rlm_sql (%s): No row id found on pass %d",inst->config->xlat_name,i); @@ -322,16 +324,21 @@ } /* - * Other values (secret, shortname, nastype) + * Other values (secret, shortname, nastype, virtual_server) */ c->secret = strdup(row[4]); c->shortname = strdup(row[2]); if(row[3] != NULL) c->nastype = strdup(row[3]); - DEBUG("rlm_sql (%s): Adding client %s (%s) to clients list", + numf = (inst->module->sql_num_fields)(sqlsocket, inst->config); + if (numf > 5) + if (row[5] != NULL) + c->server = strdup(row[5]); + + DEBUG("rlm_sql (%s): Adding client %s (%s, server=%s) to clients list", inst->config->xlat_name, - c->longname,c->shortname); + c->longname,c->shortname, c->server ? c->server : "<none>"); if (!client_add(NULL, c)) { DEBUG("rlm_sql (%s): Failed to add client %s (%s) to clients list. Maybe there's a duplicate?", inst->config->xlat_name, the NASquery could then look like: nas_query = "SELECT id, nasname, shortname, type, secret, virtual_server FROM ${nas_table}" The additional vserver field is optional, so it's backwards-compatible. any chance to get it commited? thanx, bye, Michi

2 4

Automatic report from sources (radiusd) between 28.04.2008 - 29.04.2008 GMT
by Automatic cvs log generator 29 Apr '08

29 Apr '08

CVS log entries from 28.04.2008 (Mon) 08:00:00 - 29.04.2008 (Tue) 08:00:00 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/raddb/sites-available/robust-proxy-accounting; Revisions: 1.2 File: radiusd/src/modules/rlm_sqlippool/rlm_sqlippool.c; Revisions: 1.38 ===================================================== Log entries ===================================================== Description: More comments Modified files: File: radiusd/raddb/sites-available/robust-proxy-accounting; Revision: 1.2; Date: 2008/04/28 14:53:17; Author: aland; Lines: (+10 -1) ------------------------------- Description: Re-format for whitespace changes and some debug messages Modified files: File: radiusd/src/modules/rlm_sqlippool/rlm_sqlippool.c; Revision: 1.38; Date: 2008/04/28 12:25:23; Author: aland; Lines: (+169 -95) ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/sites-available/robust-proxy-accounting Revisions: 1.2 Authors: aland (+10 -1) ------------------------------- File: radiusd/src/modules/rlm_sqlippool/rlm_sqlippool.c Revisions: 1.38 Authors: aland (+169 -95) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

freeradius resources
by wlan＠mac.com 28 Apr '08

28 Apr '08

Hello all, If you work with java, this may be of interest. Added to the JRadius subversion is a iBATIS abator configuration and generated files for the mod-sql database. Abator config: http://dev.coova.org/svn/cjradius/abatorConfig.xml Generated files: http://dev.coova.org/svn/cjradius/java/dal/net/ jradius/dal/ In addition to the standard abator data layer classes and xml, there are also generated "JSON" conversion classes (used for a user interface). There is also a development snapshot of JRadius available: http://coova.org/phpBB3/viewtopic.php?f=5&t=707 It uses the above data and json layers to create a user interface for the database - in addition to a work-in-progress GUI for FreeRADIUS itself. Cheers, David

1 0

pam_radius_auth: simultaneous requests for improved failover behaviour
by Stefan Winter 28 Apr '08

28 Apr '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello list, we have been using pam_radius_auth for numerous services. They are in a failover scenario against two FreeRADIUS servers with a sane timeout to trigger querying the second host. Standard failover works sufficiently well for most services. There are some, however, that die horribly when the primary server isn't responding. One such example is Horde IMP: it needs six consecutive authentications for login: the first for access verification on the web frontend, and another five IMAP logins to retrieve quota information, mail index, folder list, whatnot. Even small timeouts get too large when having them * 6. It gets worse because Horde opens its database connection in the very beginning and blocks its web server thread until all six authentications have been done, and it thereby effectively blocks lots of SQL threads for a long time. In short: using failover based on timeout wrecks web server and database, even though conceptually, everything should be fine from the RADIUS side. A colleague of mine, Bruno Prémont, has created a patch to pam_radius_auth which allows to configure parallelity for user authentication requests. Basically, it can be used to fire auth requests to all servers in the list simultaneously and takes the first answer it gets. This is effectively a 0-delay failover. It can also be used for a more cautious behaviour of waiting non-zero, but less time than timeout for a server's answer. The patch is on the tracker under #550 (http://bugs.freeradius.org/show_bug.cgi?id=550) and inline at the end of this mail. Compile tests: ~ x86_32 ~ x86_64 Runtime tested: ~ x86_32 ~ x86_64 I know that this is kindof hacky. It introduces double load on the backend servers. It does appear to solve our problem though. :-) I'm also aware that it will skew statistics, because from a server's view, twice as many people are authenticated. For us it's a minor thing, but if there's interest, this could be mitigated by introducing a unique attribute into all the requests that belong to a single attempt. That shouldn't be too hard to do. Greetings, Stefan Winter ========= part 1 (fix compiler warnings) ======== diff -NurpP pam_radius-1.3.17.orig/pam_radius_auth.c pam_radius-1.3.17/pam_radius_auth.c - --- pam_radius-1.3.17.orig/pam_radius_auth.c 2007-03-26 11:36:13.000000000 +0200 +++ pam_radius-1.3.17/pam_radius_auth.c 2008-04-24 14:57:34.928405141 +0200 @@ -766,7 +766,8 @@ static int ~ talk_radius(radius_conf_t *conf, AUTH_HDR *request, AUTH_HDR *response, ~ char *password, char *old_password, int tries) ~ { - - int salen, total_length; + socklen_t salen; + int total_length; ~ fd_set set; ~ struct timeval tv; ~ time_t now, end; @@ -1099,7 +1100,7 @@ pam_sm_authenticate(pam_handle_t *pamh,i ~ DPRINT(LOG_DEBUG, "Got PAM_RUSER name %s", userinfo); ~ if (!strcmp("root", user)) { - - user = userinfo; + user = *userinfo; ~ DPRINT(LOG_DEBUG, "Username now %s from ruser", user); ~ } else { ~ DPRINT(LOG_DEBUG, "Skipping ruser for non-root auth"); ========= part 2 (introduce pdelay) ======== diff -NurpP pam_radius-1.3.17.orig/pam_radius_auth.c pam_radius-1.3.17/pam_radius_auth.c - --- pam_radius-1.3.17.orig/pam_radius_auth.c 2007-03-26 11:36:13.000000000 +0200 +++ pam_radius-1.3.17/pam_radius_auth.c 2008-04-24 14:57:34.928405141 +0200 @@ -591,6 +591,7 @@ initialize(radius_conf_t *conf, int acco ~ radius_server_t *server = NULL; ~ struct sockaddr_in * s_in; ~ int timeout; + int pdelay; ~ int line = 0; ~ /* the first time around, read the configuration file */ @@ -621,7 +622,8 @@ initialize(radius_conf_t *conf, int acco ~ } ~ timeout = 3; - - if (sscanf(p, "%s %s %d", hostname, secret, &timeout) < 2) { + pdelay = -1; + if (sscanf(p, "%s %s %d %d", hostname, secret, &timeout, &pdelay) < 2) { ~ _pam_log(LOG_ERR, "ERROR reading %s, line %d: Could not read hostname or secret\n", ~ conf_file, line); ~ continue; /* invalid line */ @@ -648,6 +650,7 @@ initialize(radius_conf_t *conf, int acco ~ } else { ~ server->timeout = timeout; ~ } + server->pdelay = pdelay < -1 ? -1 : (pdelay > 600 ? 600 : pdelay); ~ server->next = NULL; ~ } ~ } @@ -666,6 +669,13 @@ initialize(radius_conf_t *conf, int acco ~ return PAM_AUTHINFO_UNAVAIL; ~ } + pdelay = fcntl(conf->sockfd, F_GETFL); + if (pdelay == -1 || fcntl(conf->sockfd, F_SETFL, pdelay | O_NONBLOCK) == -1) { + _pam_log(LOG_ERR, "Failed to flag RADIUS socket O_NONBLOCK: %s\n", + strerror(errno)); + return PAM_AUTHINFO_UNAVAIL; + } + ~ /* set up the local end of the socket communications */ ~ s_in = (struct sockaddr_in *) &salocal; ~ memset ((char *) s_in, '\0', sizeof(struct sockaddr)); @@ -770,15 +780,24 @@ static int ~ int total_length; ~ fd_set set; ~ struct timeval tv; - - time_t now, end; + time_t now; ~ int rcode; ~ struct sockaddr saremote; ~ struct sockaddr_in *s_in = (struct sockaddr_in *) &saremote; - - radius_server_t *server = conf->server; - - int ok; - - int server_tries; + radius_server_t *server_prev, *server = conf->server; + int server_left = 0; ~ int retval; + /* + Cleanup our server structs + */ + for (server = conf->server; server; server = server->next) { + server->attempts = tries; + server->sendtime = 0; + server_left++; + server->reqid = request->vector[server_left % AUTH_VECTOR_LEN]; + } + ~ /* ************************************************************ */ ~ /* Now that we're done building the request, we can send it */ @@ -791,214 +810,235 @@ talk_radius(radius_conf_t *conf, AUTH_HD ~ sequence, on the off chance that one may have ended up fixing itself. ~ */ - - - - /* loop over all available servers */ - - while (server != NULL) { - - /* only look up IP information as necessary */ - - if ((retval = host2server(server)) != PAM_SUCCESS) { - - _pam_log(LOG_ERR, - - "Failed looking up IP address for RADIUS server %s (errcode=%d)", - - server->hostname, retval); - - ok = FALSE; - - goto next; /* skip to the next server */ - - } - - - - /* set up per-server IP && port configuration */ - - memset ((char *) s_in, '\0', sizeof(struct sockaddr)); - - s_in->sin_family = AF_INET; - - s_in->sin_addr.s_addr = htonl(server->ip.s_addr); - - s_in->sin_port = server->port; - - total_length = ntohs(request->length); - - - - if (!password) { /* make an RFC 2139 p6 request authenticator */ - - get_accounting_vector(request, server); - - } - - - - server_tries = tries; - -send: - - /* send the packet */ - - if (sendto(conf->sockfd, (char *) request, total_length, 0, - - &saremote, sizeof(struct sockaddr_in)) < 0) { - - _pam_log(LOG_ERR, "Error sending RADIUS packet to server %s: %s", - - server->hostname, strerror(errno)); - - ok = FALSE; - - goto next; /* skip to the next server */ - - } - - - - /* ************************************************************ */ - - /* Wait for the response, and verify it. */ - - salen = sizeof(struct sockaddr); - - tv.tv_sec = server->timeout; /* wait for the specified time */ + /* loop over all available servers */ + while (server_left > 0) { + tv.tv_sec = 60; ~ tv.tv_usec = 0; - - FD_ZERO(&set); /* clear out the set */ - - FD_SET(conf->sockfd, &set); /* wait only for the RADIUS UDP socket */ - - - - time(&now); - - end = now + tv.tv_sec; + server = conf->server; + server_prev = NULL; - - /* loop, waiting for the select to return data */ - - ok = TRUE; - - while (ok) { - - - - rcode = select(conf->sockfd + 1, &set, NULL, NULL, &tv); - - - - /* select timed out */ - - if (rcode == 0) { - - _pam_log(LOG_ERR, "RADIUS server %s failed to respond", - - server->hostname); - - if (--server_tries) - - goto send; - - ok = FALSE; - - break; /* exit from the select loop */ - - } else if (rcode < 0) { - - - - /* select had an error */ - - if (errno == EINTR) { /* we were interrupted */ + while (server) { + time(&now); + + /* Attempt this server if we don't have to wait */ + if (server_prev && server_prev->attempts >= 0 && server_prev->sendtime + server->pdelay > now) { + // reduce tv.tv_sec if needed + if (tv.tv_sec > server_prev->sendtime + server->pdelay - now) + tv.tv_sec = server_prev->sendtime + server->pdelay - now; + goto receive; + } else if (server->attempts >= 0 && server->sendtime + server->timeout > now) { + if (tv.tv_sec > server->timeout) + tv.tv_sec = server->timeout; + if (tv.tv_sec > server->timeout + server->sendtime - now) + tv.tv_sec = server->timeout + server->sendtime - now; + goto skip; + } else if (server->attempts >= 0 && server->timeout < tv.tv_sec) + tv.tv_sec = server->timeout; + + if (server->sendtime == 0) { + if ((retval = host2server(server)) != PAM_SUCCESS) { + _pam_log(LOG_ERR, + "Failed looking up IP address for RADIUS server %s (errcode=%d)", + server->hostname, retval); + server->attempts = -1; + server_left--; + goto skip; + } else { + server->sendtime = now; ~ time(&now); - - - - if (now > end) { - - _pam_log(LOG_ERR, "RADIUS server %s failed to respond", - - server->hostname); - - if (--server_tries) - - goto send; - - ok = FALSE; - - break; /* exit from the select loop */ - - } - - - - tv.tv_sec = end - now; - - if (tv.tv_sec == 0) { /* keep waiting */ - - tv.tv_sec = 1; - - } + get_random_vector(server->vector); + } + } + + if (server->attempts > 0) { + /* set up per-server IP && port configuration */ + memset ((char *) s_in, '\0', sizeof(struct sockaddr)); + s_in->sin_family = AF_INET; + s_in->sin_addr.s_addr = htonl(server->ip.s_addr); + s_in->sin_port = server->port; + total_length = ntohs(request->length); + /* fill in our packet */ + memcpy(request->vector, server->vector, AUTH_VECTOR_LEN); + request->id = server->reqid; - - } else { /* not an interrupt, it was a real error */ - - _pam_log(LOG_ERR, "Error waiting for response from RADIUS server %s: %s", + if (!password) { /* make an RFC 2139 p6 request authenticator */ + get_accounting_vector(request, server); + } else { + if (old_password) { /* password change request */ + add_password(request, PW_PASSWORD, password, old_password); + add_password(request, PW_OLD_PASSWORD, old_password, old_password); + } else { /* authentication request */ + add_password(request, PW_PASSWORD, password, server->secret); + } + } + + if (sendto(conf->sockfd, (char *) request, total_length, 0, + &saremote, sizeof(struct sockaddr_in)) < 0) { + _pam_log(LOG_ERR, "Error sending RADIUS packet to server %s: %s", ~ server->hostname, strerror(errno)); - - ok = FALSE; - - break; + server->attempts = -1; + server_left--; + goto skip; + } else + server->attempts--; + } else { + if (server->sendtime + server->timeout < now && server->attempts == 0) { + _pam_log(LOG_ERR, "RADIUS server %s failed to respond", + server->hostname); + server->attempts = -1; + server_left--; ~ } + } + +skip: + server_prev = server; + server = server->next; + } + goto receive; - - /* the select returned OK */ - - } else if (FD_ISSET(conf->sockfd, &set)) { - - - - /* try to receive some data */ - - if ((total_length = recvfrom(conf->sockfd, (char *) response, - - BUFFER_SIZE, - - 0, &saremote, &salen)) < 0) { - - _pam_log(LOG_ERR, "error reading RADIUS packet from server %s: %s", - - server->hostname, strerror(errno)); - - ok = FALSE; +select: + if (server_left <= 0) + break; + /* select() on our socket */ + FD_ZERO(&set); /* clear out the set */ + FD_SET(conf->sockfd, &set); /* wait only for the RADIUS UDP socket */ + rcode = select(conf->sockfd + 1, &set, NULL, NULL, &tv); + if (rcode < 0) { + /* some error while calling select() */ + if (errno == EINTR) { + /* we were interrupted */ + continue; + } else { + /* not an interrupt, it was a real error */ + _pam_log(LOG_ERR, "Error waiting for response from RADIUS server %s: %s", + server->hostname, strerror(errno)); + continue; + } + } else if (rcode > 0 && FD_ISSET(conf->sockfd, &set)) { + /* try to receive some data */ +receive: + salen = sizeof(struct sockaddr); + if ((total_length = recvfrom(conf->sockfd, (char *) response, + BUFFER_SIZE, + 0, &saremote, &salen)) < 0) { + if (errno == EAGAIN) + goto select; + _pam_log(LOG_ERR, "error reading RADIUS packet from server %s: %s", + server->hostname, strerror(errno)); + continue; + } else { + /* there's data, see if it's valid */ + char *p; + + // check origin of response + for (server = conf->server; server; server = server->next) { + if (server->sendtime == 0) + continue; + if (s_in->sin_family != AF_INET) + continue; + if (s_in->sin_port != server->port) + continue; + if (s_in->sin_addr.s_addr != htonl(server->ip.s_addr)) + continue; ~ break; + } + if (server == NULL) { + _pam_log(LOG_ERR, "RADIUS answer from martian source %s:%d", inet_ntoa(s_in->sin_addr), + s_in->sin_port); + continue; + } else + p = server->secret; + + if (total_length < 2 || (ntohs(response->length) != total_length) || + (ntohs(response->length) > BUFFER_SIZE)) { + _pam_log(LOG_ERR, "RADIUS packet from server %s is corrupted", + server->hostname); + continue; + } + + /* restore request to the state of resposne server */ + memcpy(request->vector, server->vector, AUTH_VECTOR_LEN); + request->id = server->reqid; - - /* there's data, see if it's valid */ + if (!password) { /* make an RFC 2139 p6 request authenticator */ + get_accounting_vector(request, server); ~ } else { - - char *p = server->secret; - - - - if ((ntohs(response->length) != total_length) || - - (ntohs(response->length) > BUFFER_SIZE)) { - - _pam_log(LOG_ERR, "RADIUS packet from server %s is corrupted", - - server->hostname); - - ok = FALSE; - - break; + if (old_password) { /* password change request */ + add_password(request, PW_PASSWORD, password, old_password); + add_password(request, PW_OLD_PASSWORD, old_password, old_password); + } else { /* authentication request */ + add_password(request, PW_PASSWORD, password, server->secret); ~ } + } - - /* Check if we have the data OK. We should also check request->id */ - - - - if (password) { - - if (old_password) { + /* Check if we have the data OK. We should also check request->id */ + if (password) { + if (old_password) { ~ #ifdef LIVINGSTON_PASSWORD_VERIFY_BUG_FIXED - - p = old_password; /* what it should be */ + p = old_password; /* what it should be */ ~ #else - - p = ""; /* what it really is */ + p = ""; /* what it really is */ ~ #endif - - } - - /* - - * RFC 2139 p.6 says not do do this, but the Livingston 1.16 - - * server disagrees. If the user says he wants the bug, give in. - - */ - - } else { /* authentication request */ - - if (conf->accounting_bug) { - - p = ""; - - } ~ } - - - - if (!verify_packet(p, response, request)) { - - _pam_log(LOG_ERR, "packet from RADIUS server %s fails verification: The shared secret is probably incorrect.", - - server->hostname); - - ok = FALSE; - - break; - - } - - - - /* - - * Check that the response ID matches the request ID. + /* + * RFC 2139 p.6 says not do do this, but the Livingston 1.16 + * server disagrees. If the user says he wants the bug, give in. ~ */ - - if (response->id != request->id) { - - _pam_log(LOG_WARNING, "Response packet ID %d does not match the request packet ID %d: verification of packet fails", response->id, request->id); - - ok = FALSE; - - break; + } else { /* authentication request */ + if (conf->accounting_bug) { + p = ""; ~ } ~ } + if (!verify_packet(p, response, request)) { + _pam_log(LOG_ERR, "packet from RADIUS server %s fails verification: The shared secret is probably incorrect.", + server->hostname); + continue; + } + + /* + * Check that the response ID matches the request ID. + */ + if (response->id != request->id) { + _pam_log(LOG_WARNING, "Response packet ID %d does not match the request packet ID %d: verification of packet fails", response->id, request->id); + continue; + } + ~ /* ~ * Whew! The select is done. It hasn't timed out, or errored out. ~ * It's our descriptor. We've got some data. It's the right size. ~ * The packet is valid. ~ * NOW, we can skip out of the select loop, and process the packet ~ */ - - break; + goto success; ~ } - - /* otherwise, we've got data on another descriptor, keep select'ing */ ~ } + } - - /* go to the next server if this one didn't respond */ - - next: - - if (!ok) { - - radius_server_t *old; /* forget about this server */ - - - - old = server; - - server = server->next; - - conf->server = server; + _pam_log(LOG_ERR, "All RADIUS servers failed to respond."); + if (conf->localifdown) + retval = PAM_IGNORE; + else + retval = PAM_AUTHINFO_UNAVAIL; + goto out; - - _pam_forget(old->secret); - - free(old->hostname); - - free(old); - - - - if (server) { /* if there's more servers to check */ - - /* get a new authentication vector, and update the passwords */ - - get_random_vector(request->vector); - - request->id = request->vector[0]; - - - - /* update passwords, as appropriate */ - - if (password) { - - get_random_vector(request->vector); - - if (old_password) { /* password change request */ - - add_password(request, PW_PASSWORD, password, old_password); - - add_password(request, PW_OLD_PASSWORD, old_password, old_password); - - } else { /* authentication request */ - - add_password(request, PW_PASSWORD, password, server->secret); - - } - - } +success: + retval = PAM_SUCCESS; + live_server = server; + if (conf->server != live_server) { + for (server = conf->server; server; server = server->next) + if (server->next == live_server) { + server->next = live_server->next; + break; ~ } - - continue; - - - - } else { - - /* we've found one that does respond, forget about the other servers */ - - cleanup(server->next); - - server->next = NULL; - - live_server = server; /* we've got a live one! */ - - break; - - } - - } - - - - if (!server) { - - _pam_log(LOG_ERR, "All RADIUS servers failed to respond."); - - if (conf->localifdown) - - retval = PAM_IGNORE; - - else - - retval = PAM_AUTHINFO_UNAVAIL; - - } else { - - retval = PAM_SUCCESS; - - } + } else + conf->server = live_server->next; + live_server->next = NULL; + +out: + cleanup(conf->server); + conf->server = NULL; ~ return retval; ~ } diff -NurpP pam_radius-1.3.17.orig/pam_radius_auth.conf pam_radius-1.3.17/pam_radius_auth.conf - --- pam_radius-1.3.17.orig/pam_radius_auth.conf 2000-07-10 21:18:42.000000000 +0200 +++ pam_radius-1.3.17/pam_radius_auth.conf 2008-04-23 16:06:36.178404122 +0200 @@ -8,11 +8,13 @@ ~ # lines. Blank lines or lines beginning with '#' are treated as ~ # comments, and are ignored. The fields are: ~ # - -# server[:port] secret [timeout] +# server[:port] secret [timeout] [parallel delay] ~ # ~ # the port name or number is optional. The default port name is - -# "radius", and is looked up from /etc/services The timeout field is - -# optional. The default timeout is 3 seconds. +# "radius", and is looked up from /etc/services. The timeout field is +# optional. The default timeout is 3 seconds. The paralell delay field +# is optional. The default paralell delay is -1 which means no, +# paralellism, maximum is timeout is 1 minute (60) ~ # ~ # If multiple RADIUS server lines exist, they are tried in order. The ~ # first server to return success or failure causes the module to return @@ -22,9 +24,9 @@ ~ # The timeout field controls how many seconds the module waits before ~ # deciding that the server has failed to respond. ~ # - -# server[:port] shared_secret timeout (s) +# server[:port] shared_secret timeout (s) pdelay (s) ~ 127.0.0.1 secret 1 - -other-server other-secret 3 +other-server other-secret 3 1 ~ # ~ # having localhost in your radius configuration is a Good Thing. diff -NurpP pam_radius-1.3.17.orig/pam_radius_auth.h pam_radius-1.3.17/pam_radius_auth.h - --- pam_radius-1.3.17.orig/pam_radius_auth.h 2007-03-26 07:35:31.000000000 +0200 +++ pam_radius-1.3.17/pam_radius_auth.h 2008-04-24 11:27:33.009599859 +0200 @@ -16,6 +16,7 @@ ~ #include <utmp.h> ~ #include <time.h> ~ #include <netinet/in.h> +#include <arpa/inet.h> ~ #include <netdb.h> ~ #include <fcntl.h> @@ -41,7 +42,12 @@ typedef struct radius_server_t { ~ char *hostname; ~ char *secret; ~ int timeout; + int pdelay; ~ int accounting; + time_t sendtime; + int attempts; + u_char reqid; + u_char vector[AUTH_VECTOR_LEN]; ~ } radius_server_t; ~ typedef struct radius_conf_t { -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.4-svn0 (GNU/Linux) Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org iD8DBQFIFZuV+jm90f8eFWYRApBHAJ4nauU3k6sg47qTHNmRhjwJdT5TNwCfakKc 4IUxngbm1X7/M3TmPNwpG+I= =6mdH -----END PGP SIGNATURE-----

3 4

Automatic report from sources (radiusd) between 26.04.2008 - 27.04.2008 GMT
by Automatic cvs log generator 27 Apr '08

27 Apr '08

CVS log entries from 26.04.2008 (Sat) 08:00:01 - 27.04.2008 (Sun) 08:00:00 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/raddb/sites-available/copy-acct-to-home-server; Revisions: 1.3 File: radiusd/src/main/detail.c; Revisions: 1.14 File: radiusd/raddb/sites-available/robust-proxy-accounting; Revisions: 1.1 File: radiusd/configure.in; Revisions: 1.262 File: radiusd/raddb/radiusd.conf.in; Revisions: 1.272 File: radiusd/configure; Revisions: 1.148 File: radiusd/src/include/autoconf.h.in; Revisions: 1.74 ===================================================== Combined list of identical log entries ===================================================== Description: Look for <glob.h> Modified files: File: radiusd/configure; Revision: 1.148; Date: 2008/04/26 15:10:09; Author: aland; Lines: (+3 -1) File: radiusd/configure.in; Revision: 1.262; Date: 2008/04/26 15:10:09; Author: aland; Lines: (+2 -1) File: radiusd/src/include/autoconf.h.in; Revision: 1.74; Date: 2008/04/26 15:10:11; Author: aland; Lines: (+3 -0) ===================================================== Log entries ===================================================== Description: Mention the "detail" file Modified files: File: radiusd/raddb/radiusd.conf.in; Revision: 1.272; Date: 2008/04/26 15:14:33; Author: aland; Lines: (+3 -1) ------------------------------- Description: Document file globbing for the detail reader Modified files: File: radiusd/raddb/sites-available/copy-acct-to-home-server; Revision: 1.3; Date: 2008/04/26 15:23:43; Author: aland; Lines: (+10 -1) ------------------------------- Description: Example of accounting where no packet is lost. Modified files: File: radiusd/raddb/sites-available/robust-proxy-accounting; Revision: 1.1; Date: 2008/04/27 06:34:52; Author: aland; ------------------------------- Description: Added file globbing, and some simple sorting Modified files: File: radiusd/src/main/detail.c; Revision: 1.14; Date: 2008/04/26 15:07:43; Author: aland; Lines: (+50 -8) ===================================================== Summary of modified files ===================================================== File: radiusd/configure Revisions: 1.148 Authors: aland (+3 -1) ------------------------------- File: radiusd/configure.in Revisions: 1.262 Authors: aland (+2 -1) ------------------------------- File: radiusd/raddb/radiusd.conf.in Revisions: 1.272 Authors: aland (+3 -1) ------------------------------- File: radiusd/raddb/sites-available/copy-acct-to-home-server Revisions: 1.3 Authors: aland (+10 -1) ------------------------------- File: radiusd/raddb/sites-available/robust-proxy-accounting Revisions: 1.1 Authors: aland ------------------------------- File: radiusd/src/include/autoconf.h.in Revisions: 1.74 Authors: aland (+3 -0) ------------------------------- File: radiusd/src/main/detail.c Revisions: 1.14 Authors: aland (+50 -8) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 24.04.2008 - 25.04.2008 GMT
by Automatic cvs log generator 25 Apr '08

25 Apr '08

CVS log entries from 24.04.2008 (Thu) 08:00:00 - 25.04.2008 (Fri) 08:00:00 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/main/detail.c; Revisions: 1.13 File: radiusd/src/include/radius.h; Revisions: 1.93 File: radiusd/share/dictionary.freeradius.internal; Revisions: 1.26 Author: pnixon File: radiusd/src/modules/rlm_sqlippool/rlm_sqlippool.c; Revisions: 1.37 ===================================================== Combined list of identical log entries ===================================================== Description: Added Packet-Original-Timestamp Modified files: File: radiusd/share/dictionary.freeradius.internal; Revision: 1.26; Date: 2008/04/25 06:20:55; Author: aland; Lines: (+2 -1) File: radiusd/src/include/radius.h; Revision: 1.93; Date: 2008/04/25 06:20:55; Author: aland; Lines: (+2 -1) File: radiusd/src/main/detail.c; Revision: 1.13; Date: 2008/04/25 06:20:55; Author: aland; Lines: (+10 -2) ===================================================== Log entries ===================================================== Description: This should close Bug #548 as it is no longer necessary to check for NAS-Port as the pool-key is configured in the SQL query. Modified files: File: radiusd/src/modules/rlm_sqlippool/rlm_sqlippool.c; Revision: 1.37; Date: 2008/04/24 11:53:47; Author: pnixon; Lines: (+2 -22) ===================================================== Summary of modified files ===================================================== File: radiusd/share/dictionary.freeradius.internal Revisions: 1.26 Authors: aland (+2 -1) ------------------------------- File: radiusd/src/include/radius.h Revisions: 1.93 Authors: aland (+2 -1) ------------------------------- File: radiusd/src/main/detail.c Revisions: 1.13 Authors: aland (+10 -2) ------------------------------- File: radiusd/src/modules/rlm_sqlippool/rlm_sqlippool.c Revisions: 1.37 Authors: pnixon (+2 -22) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 23.04.2008 - 24.04.2008 GMT
by Automatic cvs log generator 24 Apr '08

24 Apr '08

CVS log entries from 23.04.2008 (Wed) 08:00:00 - 24.04.2008 (Thu) 08:00:00 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/share/dictionary.netscreen; Revisions: 1.4 File: radiusd/raddb/radiusd.conf.in; Revisions: 1.271 ===================================================== Log entries ===================================================== Description: Corrected typo noted by Stefan Winter. Free Internet access in Tallin Airport thanks to Skype. Modified files: File: radiusd/raddb/radiusd.conf.in; Revision: 1.271; Date: 2008/04/23 08:10:08; Author: aland; Lines: (+2 -2) ------------------------------- Description: New attributes, as posted to the list. Modified files: File: radiusd/share/dictionary.netscreen; Revision: 1.4; Date: 2008/04/23 08:16:16; Author: aland; Lines: (+3 -0) ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/radiusd.conf.in Revisions: 1.271 Authors: aland (+2 -2) ------------------------------- File: radiusd/share/dictionary.netscreen Revisions: 1.4 Authors: aland (+3 -0) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

typo in radiusd.conf / expr
by Stefan Winter 23 Apr '08

23 Apr '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, radiusd.conf of 2.0.3 reads: ~ # The 'expression' module currently has no configuration. ~ # ~ # This module is useful only for 'xlat'. To use it, ~ # put 'exec' into the 'instantiate' section. You can then ~ # do dynamic translation of attributes like: Shouldn't that be: put 'expr' into the 'instantiate' section? Greetings, Stefan Winter -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.4-svn0 (GNU/Linux) Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org iD8DBQFIDtsx+jm90f8eFWYRAtddAJ4/H0RHt3usCK3yLwcnSFhklbuY3wCfVLRS cplh/5zJIP3LQw5q5sxUAEA= =TC2A -----END PGP SIGNATURE-----

2 1

Automatic report from sources (radiusd) between 20.04.2008 - 21.04.2008 GMT
by Automatic cvs log generator 21 Apr '08

21 Apr '08

CVS log entries from 20.04.2008 (Sun) 08:00:00 - 21.04.2008 (Mon) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/share/dictionary.dhcp; Revisions: 1.1 File: radiusd/configure.in; Revisions: 1.261, 1.260 File: radiusd/src/lib/missing.c; Revisions: 1.22 File: radiusd/src/main/listen.c; Revisions: 1.122 File: radiusd/src/include/radiusd.h; Revisions: 1.262 File: radiusd/src/lib/dhcp.c; Revisions: 1.1 File: radiusd/doc/ChangeLog; Revisions: 1.93 File: radiusd/raddb/sites-available/dhcp; Revisions: 1.1 File: radiusd/src/modules/rlm_sqlcounter/rlm_sqlcounter.c; Revisions: 1.39 File: radiusd/src/main/modules.c; Revisions: 1.159 File: radiusd/share/dictionary; Revisions: 1.155 File: radiusd/src/lib/Makefile; Revisions: 1.39 File: radiusd/src/main/client.c; Revisions: 1.79 File: radiusd/src/main/event.c; Revisions: 1.100 File: radiusd/src/include/dhcp.h; Revisions: 1.1 File: radiusd/src/main/dhcpd.c; Revisions: 1.1 File: radiusd/configure; Revisions: 1.147, 1.146 File: radiusd/src/include/autoconf.h.in; Revisions: 1.73 ===================================================== Combined list of identical log entries ===================================================== Description: Integrate more into the server. Dp4 Modified files: File: radiusd/src/main/client.c; Revision: 1.79; Date: 2008/04/20 15:00:06; Author: aland; Lines: (+14 -2) File: radiusd/src/main/dhcpd.c; Revision: 1.1; Date: 2008/04/20 15:00:06; Author: aland; File: radiusd/src/main/event.c; Revision: 1.100; Date: 2008/04/20 15:00:06; Author: aland; Lines: (+10 -2) File: radiusd/src/main/listen.c; Revision: 1.122; Date: 2008/04/20 15:00:06; Author: aland; Lines: (+28 -4) File: radiusd/src/main/modules.c; Revision: 1.159; Date: 2008/04/20 15:00:07; Author: aland; Lines: (+39 -5) ------------------------------- Description: corrected typo Modified files: File: radiusd/configure; Revision: 1.147; Date: 2008/04/20 15:14:03; Author: aland; Lines: (+4 -3) File: radiusd/configure.in; Revision: 1.261; Date: 2008/04/20 15:14:02; Author: aland; Lines: (+4 -3) ------------------------------- Description: New dictionary (commented out). Dp2 Modified files: File: radiusd/share/dictionary; Revision: 1.155; Date: 2008/04/20 14:47:55; Author: aland; Lines: (+2 -1) File: radiusd/share/dictionary.dhcp; Revision: 1.1; Date: 2008/04/20 14:47:55; Author: aland; ------------------------------- Description: Added new option to the build. Dp1 Modified files: File: radiusd/configure; Revision: 1.146; Date: 2008/04/20 14:46:13; Author: aland; Lines: (+42 -24) File: radiusd/configure.in; Revision: 1.260; Date: 2008/04/20 14:46:13; Author: aland; Lines: (+12 -1) File: radiusd/src/include/autoconf.h.in; Revision: 1.73; Date: 2008/04/20 14:46:12; Author: aland; Lines: (+3 -0) ------------------------------- Description: Send/receive packets. Dp3 Modified files: File: radiusd/src/include/dhcp.h; Revision: 1.1; Date: 2008/04/20 14:51:25; Author: aland; File: radiusd/src/lib/dhcp.c; Revision: 1.1; Date: 2008/04/20 14:51:25; Author: aland; File: radiusd/src/lib/missing.c; Revision: 1.22; Date: 2008/04/20 14:51:25; Author: aland; Lines: (+42 -2) ===================================================== Log entries ===================================================== Description: Note new functionality Modified files: File: radiusd/doc/ChangeLog; Revision: 1.93; Date: 2008/04/20 15:19:33; Author: aland; Lines: (+7 -1) ------------------------------- Description: Sample configuration. Dp3 Modified files: File: radiusd/raddb/sites-available/dhcp; Revision: 1.1; Date: 2008/04/20 14:52:18; Author: aland; ------------------------------- Description: Define DHCP listener Modified files: File: radiusd/src/include/radiusd.h; Revision: 1.262; Date: 2008/04/20 17:39:17; Author: aland; Lines: (+3 -2) ------------------------------- Description: Include encode/decode packet stuff. Dp5 Modified files: File: radiusd/src/lib/Makefile; Revision: 1.39; Date: 2008/04/20 15:18:39; Author: aland; Lines: (+2 -2) ------------------------------- Description: Signed/unsigned issues Modified files: File: radiusd/src/modules/rlm_sqlcounter/rlm_sqlcounter.c; Revision: 1.39; Date: 2008/04/20 14:19:46; Author: aland; Lines: (+18 -15) ===================================================== Summary of modified files ===================================================== File: radiusd/configure Revisions: 1.147, 1.146 Authors: aland (+4 -3), aland (+42 -24) ------------------------------- File: radiusd/configure.in Revisions: 1.261, 1.260 Authors: aland (+4 -3), aland (+12 -1) ------------------------------- File: radiusd/doc/ChangeLog Revisions: 1.93 Authors: aland (+7 -1) ------------------------------- File: radiusd/raddb/sites-available/dhcp Revisions: 1.1 Authors: aland ------------------------------- File: radiusd/share/dictionary Revisions: 1.155 Authors: aland (+2 -1) ------------------------------- File: radiusd/share/dictionary.dhcp Revisions: 1.1 Authors: aland ------------------------------- File: radiusd/src/include/autoconf.h.in Revisions: 1.73 Authors: aland (+3 -0) ------------------------------- File: radiusd/src/include/dhcp.h Revisions: 1.1 Authors: aland ------------------------------- File: radiusd/src/include/radiusd.h Revisions: 1.262 Authors: aland (+3 -2) ------------------------------- File: radiusd/src/lib/Makefile Revisions: 1.39 Authors: aland (+2 -2) ------------------------------- File: radiusd/src/lib/dhcp.c Revisions: 1.1 Authors: aland ------------------------------- File: radiusd/src/lib/missing.c Revisions: 1.22 Authors: aland (+42 -2) ------------------------------- File: radiusd/src/main/client.c Revisions: 1.79 Authors: aland (+14 -2) ------------------------------- File: radiusd/src/main/dhcpd.c Revisions: 1.1 Authors: aland ------------------------------- File: radiusd/src/main/event.c Revisions: 1.100 Authors: aland (+10 -2) ------------------------------- File: radiusd/src/main/listen.c Revisions: 1.122 Authors: aland (+28 -4) ------------------------------- File: radiusd/src/main/modules.c Revisions: 1.159 Authors: aland (+39 -5) ------------------------------- File: radiusd/src/modules/rlm_sqlcounter/rlm_sqlcounter.c Revisions: 1.39 Authors: aland (+18 -15) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 18.04.2008 - 19.04.2008 GMT
by Automatic cvs log generator 19 Apr '08

19 Apr '08

CVS log entries from 18.04.2008 (Fri) 08:00:00 - 19.04.2008 (Sat) 08:00:00 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/main/event.c; Revisions: 1.99 File: radiusd/src/main/auth.c; Revisions: 1.178 File: radiusd/src/main/acct.c; Revisions: 1.46 File: radiusd/src/lib/valuepair.c; Revisions: 1.141 File: radiusd/src/main/realms.c; Revisions: 1.52, 1.51 File: radiusd/share/dictionary.nokia; Revisions: 1.7 File: radiusd/src/main/conffile.c; Revisions: 1.199, 1.198 File: radiusd/raddb/proxy.conf; Revisions: 1.34 File: radiusd/src/include/realms.h; Revisions: 1.19 ===================================================== Combined list of identical log entries ===================================================== Description: Define realm_find2() where the argument is the realm name previously found in realm_find(). Make the appropriate functions use it. Document regex realms. Modified files: File: radiusd/raddb/proxy.conf; Revision: 1.34; Date: 2008/04/18 09:29:50; Author: aland; Lines: (+62 -1) File: radiusd/src/include/realms.h; Revision: 1.19; Date: 2008/04/18 09:29:49; Author: aland; Lines: (+4 -3) File: radiusd/src/main/acct.c; Revision: 1.46; Date: 2008/04/18 09:29:49; Author: aland; Lines: (+3 -3) File: radiusd/src/main/auth.c; Revision: 1.178; Date: 2008/04/18 09:29:49; Author: aland; Lines: (+3 -3) File: radiusd/src/main/event.c; Revision: 1.99; Date: 2008/04/18 09:29:49; Author: aland; Lines: (+3 -3) File: radiusd/src/main/realms.c; Revision: 1.52; Date: 2008/04/18 09:29:49; Author: aland; Lines: (+38 -5) ===================================================== Log entries ===================================================== Description: Added Nokia-AVPair (ugh) Modified files: File: radiusd/share/dictionary.nokia; Revision: 1.7; Date: 2008/04/18 10:04:27; Author: aland; Lines: (+2 -1) ------------------------------- Description: In pairmake(), attribute is a const, so copy tagged attributes to a local buffer Modified files: File: radiusd/src/lib/valuepair.c; Revision: 1.141; Date: 2008/04/18 14:09:56; Author: aland; Lines: (+11 -5) ------------------------------- Description: Delete unused variable Modified files: File: radiusd/src/main/conffile.c; Revision: 1.199; Date: 2008/04/18 13:51:12; Author: aland; Lines: (+2 -3) ------------------------------- Description: Handle tags in unlang Modified files: File: radiusd/src/main/conffile.c; Revision: 1.198; Date: 2008/04/18 13:47:06; Author: aland; Lines: (+6 -12) ------------------------------- Description: Allow regexes in realms. Modified files: File: radiusd/src/main/realms.c; Revision: 1.51; Date: 2008/04/18 08:46:24; Author: aland; Lines: (+110 -2) ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/proxy.conf Revisions: 1.34 Authors: aland (+62 -1) ------------------------------- File: radiusd/share/dictionary.nokia Revisions: 1.7 Authors: aland (+2 -1) ------------------------------- File: radiusd/src/include/realms.h Revisions: 1.19 Authors: aland (+4 -3) ------------------------------- File: radiusd/src/lib/valuepair.c Revisions: 1.141 Authors: aland (+11 -5) ------------------------------- File: radiusd/src/main/acct.c Revisions: 1.46 Authors: aland (+3 -3) ------------------------------- File: radiusd/src/main/auth.c Revisions: 1.178 Authors: aland (+3 -3) ------------------------------- File: radiusd/src/main/conffile.c Revisions: 1.199, 1.198 Authors: aland (+2 -3), aland (+6 -12) ------------------------------- File: radiusd/src/main/event.c Revisions: 1.99 Authors: aland (+3 -3) ------------------------------- File: radiusd/src/main/realms.c Revisions: 1.52, 1.51 Authors: aland (+38 -5), aland (+110 -2) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 17.04.2008 - 18.04.2008 GMT
by Automatic cvs log generator 18 Apr '08

18 Apr '08

CVS log entries from 17.04.2008 (Thu) 08:00:01 - 18.04.2008 (Fri) 08:00:00 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/modules/rlm_realm/rlm_realm.c; Revisions: 1.72 File: radiusd/doc/ChangeLog; Revisions: 1.92 File: radiusd/src/lib/valuepair.c; Revisions: 1.140 File: radiusd/src/include/libradius.h; Revisions: 1.153 File: radiusd/raddb/clients.conf; Revisions: 1.13 File: radiusd/src/modules/rlm_attr_filter/rlm_attr_filter.c; Revisions: 1.42, 1.41 File: radiusd/src/main/listen.c; Revisions: 1.121 ===================================================== Combined list of identical log entries ===================================================== Description: Correct documentation, and allow client lists without the "clients" name. Closes #546. Modified files: File: radiusd/raddb/clients.conf; Revision: 1.13; Date: 2008/04/17 12:22:23; Author: aland; Lines: (+2 -2) File: radiusd/src/main/listen.c; Revision: 1.121; Date: 2008/04/17 12:22:23; Author: aland; Lines: (+5 -2) ------------------------------- Description: API to copy just one VP. Modified files: File: radiusd/src/include/libradius.h; Revision: 1.153; Date: 2008/04/17 08:24:28; Author: aland; Lines: (+3 -2) File: radiusd/src/lib/valuepair.c; Revision: 1.140; Date: 2008/04/17 08:24:28; Author: aland; Lines: (+29 -16) ===================================================== Log entries ===================================================== Description: Note recent bug fixes Modified files: File: radiusd/doc/ChangeLog; Revision: 1.92; Date: 2008/04/17 12:24:15; Author: aland; Lines: (+13 -3) ------------------------------- Description: Update request->username && request->password, too Modified files: File: radiusd/src/modules/rlm_attr_filter/rlm_attr_filter.c; Revision: 1.42; Date: 2008/04/17 08:37:19; Author: aland; Lines: (+12 -2) ------------------------------- Description: Use new API to copy VP's. Don't do it by hand, as it's a bad idea! Modified files: File: radiusd/src/modules/rlm_attr_filter/rlm_attr_filter.c; Revision: 1.41; Date: 2008/04/17 08:26:32; Author: aland; Lines: (+10 -23) ------------------------------- Description: Move proxying message to after checks for LOCAL realm Modified files: File: radiusd/src/modules/rlm_realm/rlm_realm.c; Revision: 1.72; Date: 2008/04/17 08:11:23; Author: aland; Lines: (+5 -5) ===================================================== Summary of modified files ===================================================== File: radiusd/doc/ChangeLog Revisions: 1.92 Authors: aland (+13 -3) ------------------------------- File: radiusd/raddb/clients.conf Revisions: 1.13 Authors: aland (+2 -2) ------------------------------- File: radiusd/src/include/libradius.h Revisions: 1.153 Authors: aland (+3 -2) ------------------------------- File: radiusd/src/lib/valuepair.c Revisions: 1.140 Authors: aland (+29 -16) ------------------------------- File: radiusd/src/main/listen.c Revisions: 1.121 Authors: aland (+5 -2) ------------------------------- File: radiusd/src/modules/rlm_attr_filter/rlm_attr_filter.c Revisions: 1.42, 1.41 Authors: aland (+12 -2), aland (+10 -23) ------------------------------- File: radiusd/src/modules/rlm_realm/rlm_realm.c Revisions: 1.72 Authors: aland (+5 -5) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 16.04.2008 - 17.04.2008 GMT
by Automatic cvs log generator 17 Apr '08

17 Apr '08

CVS log entries from 16.04.2008 (Wed) 08:00:01 - 17.04.2008 (Thu) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/modules/rlm_ldap/rlm_ldap.c; Revisions: 1.194 File: radiusd/src/main/detail.c; Revisions: 1.12 File: radiusd/raddb/sql/mssql/schema.sql; Revisions: 1.2 ===================================================== Log entries ===================================================== Description: Added postauth table. Closes #545. Modified files: File: radiusd/raddb/sql/mssql/schema.sql; Revision: 1.2; Date: 2008/04/17 06:32:36; Author: aland; Lines: (+22 -1) ------------------------------- Description: Delay 1s, not 1 usec. Modified files: File: radiusd/src/main/detail.c; Revision: 1.12; Date: 2008/04/16 14:25:05; Author: aland; Lines: (+3 -3) ------------------------------- Description: LDAP-UserDN is now in config items Modified files: File: radiusd/src/modules/rlm_ldap/rlm_ldap.c; Revision: 1.194; Date: 2008/04/17 07:59:21; Author: aland; Lines: (+2 -2) ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/sql/mssql/schema.sql Revisions: 1.2 Authors: aland (+22 -1) ------------------------------- File: radiusd/src/main/detail.c Revisions: 1.12 Authors: aland (+3 -3) ------------------------------- File: radiusd/src/modules/rlm_ldap/rlm_ldap.c Revisions: 1.194 Authors: aland (+2 -2) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 14.04.2008 - 15.04.2008 GMT
by Automatic cvs log generator 15 Apr '08

15 Apr '08

CVS log entries from 14.04.2008 (Mon) 08:00:01 - 15.04.2008 (Tue) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/doc/ChangeLog; Revisions: 1.91 File: radiusd/src/main/realms.c; Revisions: 1.50, 1.49 File: radiusd/raddb/proxy.conf; Revisions: 1.33 File: radiusd/src/main/listen.c; Revisions: 1.120 File: radiusd/src/main/client.c; Revisions: 1.78 ===================================================== Combined list of identical log entries ===================================================== Description: Added, and documented "fallback" in home server pool Modified files: File: radiusd/doc/ChangeLog; Revision: 1.91; Date: 2008/04/14 08:09:29; Author: aland; Lines: (+19 -4) File: radiusd/raddb/proxy.conf; Revision: 1.33; Date: 2008/04/14 08:09:29; Author: aland; Lines: (+16 -1) File: radiusd/src/main/realms.c; Revision: 1.49; Date: 2008/04/14 08:09:29; Author: aland; Lines: (+10 -2) ===================================================== Log entries ===================================================== Description: When adding a client, it's OK to be in a subsection if the subsection is "clients". Modified files: File: radiusd/src/main/client.c; Revision: 1.78; Date: 2008/04/14 15:17:24; Author: aland; Lines: (+16 -6) ------------------------------- Description: Look up "clients" configuration by ("clients", ref), instead of trying to find a top-level section named "ref" Modified files: File: radiusd/src/main/listen.c; Revision: 1.120; Date: 2008/04/14 15:18:08; Author: aland; Lines: (+6 -4) ------------------------------- Description: Add additional check for NULL/DEFAULT duplicate realms Modified files: File: radiusd/src/main/realms.c; Revision: 1.50; Date: 2008/04/14 15:04:52; Author: aland; Lines: (+3 -3) ===================================================== Summary of modified files ===================================================== File: radiusd/doc/ChangeLog Revisions: 1.91 Authors: aland (+19 -4) ------------------------------- File: radiusd/raddb/proxy.conf Revisions: 1.33 Authors: aland (+16 -1) ------------------------------- File: radiusd/src/main/client.c Revisions: 1.78 Authors: aland (+16 -6) ------------------------------- File: radiusd/src/main/listen.c Revisions: 1.120 Authors: aland (+6 -4) ------------------------------- File: radiusd/src/main/realms.c Revisions: 1.50, 1.49 Authors: aland (+3 -3), aland (+10 -2) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 13.04.2008 - 14.04.2008 GMT
by Automatic cvs log generator 14 Apr '08

14 Apr '08

CVS log entries from 13.04.2008 (Sun) 08:00:01 - 14.04.2008 (Mon) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/tests/digest-01/digest-auth-MD5_Sess; Revisions: 1.1 File: radiusd/src/tests/digest-auth-noalgo; Revisions: 1.3 File: radiusd/src/tests/digest-01/digest-auth-MD5; Revisions: 1.1 File: radiusd/src/tests/digest-auth-MD5_Sess; Revisions: 1.3 File: radiusd/src/tests/runtests.sh; Revisions: 1.4 File: radiusd/src/tests/digest-auth-MD5; Revisions: 1.3 File: radiusd/src/tests/digest-01/digest-auth_int-noalgo; Revisions: 1.1 File: radiusd/src/tests/digest-01/digest-auth-int; Revisions: 1.1 File: radiusd/src/tests/digest-01/digest-auth_int-MD5_Sess; Revisions: 1.1 File: radiusd/src/tests/digest-auth_int-noalgo; Revisions: 1.3 File: radiusd/src/tests/digest-auth-int; Revisions: 1.3 File: radiusd/src/tests/digest-01/digest-auth_int-MD5; Revisions: 1.1 File: radiusd/src/tests/config/test.conf; Revisions: 1.3, 1.2 File: radiusd/src/tests/digest-auth_int-MD5_Sess; Revisions: 1.3 File: radiusd/src/tests/digest-01/digest-md5-sess; Revisions: 1.1 File: radiusd/src/tests/digest-auth_int-MD5; Revisions: 1.3 File: radiusd/src/tests/digest-01/digest; Revisions: 1.1 File: radiusd/src/tests/Makefile; Revisions: 1.11 File: radiusd/src/tests/digest-md5-sess; Revisions: 1.3 File: radiusd/src/tests/digest; Revisions: 1.2 File: radiusd/src/main/realms.c; Revisions: 1.48, 1.47, 1.46 File: radiusd/src/tests/test.example.com; Revisions: 1.1 File: radiusd/src/tests/digest-01/digest-auth-noalgo; Revisions: 1.1 File: radiusd/raddb/proxy.conf; Revisions: 1.32 File: radiusd/src/include/realms.h; Revisions: 1.18 ===================================================== Combined list of identical log entries ===================================================== Description: Moved digest tests to their own directory Modified files: File: radiusd/src/tests/digest; Revision: 1.2; Date: 2008/04/13 10:32:03; Author: aland; Lines: (+0 -0) File: radiusd/src/tests/digest-auth-MD5; Revision: 1.3; Date: 2008/04/13 10:32:03; Author: aland; Lines: (+0 -0) File: radiusd/src/tests/digest-auth-MD5_Sess; Revision: 1.3; Date: 2008/04/13 10:32:03; Author: aland; Lines: (+0 -0) File: radiusd/src/tests/digest-auth-int; Revision: 1.3; Date: 2008/04/13 10:32:02; Author: aland; Lines: (+0 -0) File: radiusd/src/tests/digest-auth-noalgo; Revision: 1.3; Date: 2008/04/13 10:32:03; Author: aland; Lines: (+0 -0) File: radiusd/src/tests/digest-auth_int-MD5; Revision: 1.3; Date: 2008/04/13 10:32:03; Author: aland; Lines: (+0 -0) File: radiusd/src/tests/digest-auth_int-MD5_Sess; Revision: 1.3; Date: 2008/04/13 10:32:03; Author: aland; Lines: (+0 -0) File: radiusd/src/tests/digest-auth_int-noalgo; Revision: 1.3; Date: 2008/04/13 10:32:03; Author: aland; Lines: (+0 -0) File: radiusd/src/tests/digest-md5-sess; Revision: 1.3; Date: 2008/04/13 10:32:03; Author: aland; Lines: (+0 -0) File: radiusd/src/tests/digest-01/digest; Revision: 1.1; Date: 2008/04/13 10:32:03; Author: aland; File: radiusd/src/tests/digest-01/digest-auth-MD5; Revision: 1.1; Date: 2008/04/13 10:32:03; Author: aland; File: radiusd/src/tests/digest-01/digest-auth-MD5_Sess; Revision: 1.1; Date: 2008/04/13 10:32:03; Author: aland; File: radiusd/src/tests/digest-01/digest-auth-int; Revision: 1.1; Date: 2008/04/13 10:32:03; Author: aland; File: radiusd/src/tests/digest-01/digest-auth-noalgo; Revision: 1.1; Date: 2008/04/13 10:32:04; Author: aland; File: radiusd/src/tests/digest-01/digest-auth_int-MD5; Revision: 1.1; Date: 2008/04/13 10:32:04; Author: aland; File: radiusd/src/tests/digest-01/digest-auth_int-MD5_Sess; Revision: 1.1; Date: 2008/04/13 10:32:04; Author: aland; File: radiusd/src/tests/digest-01/digest-auth_int-noalgo; Revision: 1.1; Date: 2008/04/13 10:32:04; Author: aland; File: radiusd/src/tests/digest-01/digest-md5-sess; Revision: 1.1; Date: 2008/04/13 10:32:04; Author: aland; ------------------------------- Description: Added "fallback" in home server pool. call strdup() for virtual home servers Modified files: File: radiusd/src/include/realms.h; Revision: 1.18; Date: 2008/04/14 07:52:31; Author: aland; Lines: (+6 -4) File: radiusd/src/main/realms.c; Revision: 1.48; Date: 2008/04/14 07:52:31; Author: aland; Lines: (+72 -42) ------------------------------- Description: Added test for simple proxying Modified files: File: radiusd/src/tests/Makefile; Revision: 1.11; Date: 2008/04/13 10:05:39; Author: aland; Lines: (+2 -2) File: radiusd/src/tests/test.example.com; Revision: 1.1; Date: 2008/04/13 10:05:39; Author: aland; File: radiusd/src/tests/config/test.conf; Revision: 1.3; Date: 2008/04/13 10:05:39; Author: aland; Lines: (+23 -1) ===================================================== Log entries ===================================================== Description: Document virtual_server in home_server_pool Modified files: File: radiusd/raddb/proxy.conf; Revision: 1.32; Date: 2008/04/14 07:58:27; Author: aland; Lines: (+12 -1) ------------------------------- Description: Initialize all of the data structure Modified files: File: radiusd/src/main/realms.c; Revision: 1.47; Date: 2008/04/13 08:07:48; Author: aland; Lines: (+3 -2) ------------------------------- Description: Initialize home->server for lookups Modified files: File: radiusd/src/main/realms.c; Revision: 1.46; Date: 2008/04/13 08:02:15; Author: aland; Lines: (+3 -2) ------------------------------- Description: Use newer style references Modified files: File: radiusd/src/tests/config/test.conf; Revision: 1.2; Date: 2008/04/13 10:01:01; Author: aland; Lines: (+18 -4) ------------------------------- Description: More fixes Modified files: File: radiusd/src/tests/runtests.sh; Revision: 1.4; Date: 2008/04/13 10:36:15; Author: aland; Lines: (+3 -2) ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/proxy.conf Revisions: 1.32 Authors: aland (+12 -1) ------------------------------- File: radiusd/src/include/realms.h Revisions: 1.18 Authors: aland (+6 -4) ------------------------------- File: radiusd/src/main/realms.c Revisions: 1.48, 1.47, 1.46 Authors: aland (+72 -42), aland (+3 -2), aland (+3 -2) ------------------------------- File: radiusd/src/tests/Makefile Revisions: 1.11 Authors: aland (+2 -2) ------------------------------- File: radiusd/src/tests/config/test.conf Revisions: 1.3, 1.2 Authors: aland (+23 -1), aland (+18 -4) ------------------------------- File: radiusd/src/tests/digest Revisions: 1.2 Authors: aland (+0 -0) ------------------------------- File: radiusd/src/tests/digest-01/digest Revisions: 1.1 Authors: aland ------------------------------- File: radiusd/src/tests/digest-01/digest-auth-MD5 Revisions: 1.1 Authors: aland ------------------------------- File: radiusd/src/tests/digest-01/digest-auth-MD5_Sess Revisions: 1.1 Authors: aland ------------------------------- File: radiusd/src/tests/digest-01/digest-auth-int Revisions: 1.1 Authors: aland ------------------------------- File: radiusd/src/tests/digest-01/digest-auth-noalgo Revisions: 1.1 Authors: aland ------------------------------- File: radiusd/src/tests/digest-01/digest-auth_int-MD5 Revisions: 1.1 Authors: aland ------------------------------- File: radiusd/src/tests/digest-01/digest-auth_int-MD5_Sess Revisions: 1.1 Authors: aland ------------------------------- File: radiusd/src/tests/digest-01/digest-auth_int-noalgo Revisions: 1.1 Authors: aland ------------------------------- File: radiusd/src/tests/digest-01/digest-md5-sess Revisions: 1.1 Authors: aland ------------------------------- File: radiusd/src/tests/digest-auth-MD5 Revisions: 1.3 Authors: aland (+0 -0) ------------------------------- File: radiusd/src/tests/digest-auth-MD5_Sess Revisions: 1.3 Authors: aland (+0 -0) ------------------------------- File: radiusd/src/tests/digest-auth-int Revisions: 1.3 Authors: aland (+0 -0) ------------------------------- File: radiusd/src/tests/digest-auth-noalgo Revisions: 1.3 Authors: aland (+0 -0) ------------------------------- File: radiusd/src/tests/digest-auth_int-MD5 Revisions: 1.3 Authors: aland (+0 -0) ------------------------------- File: radiusd/src/tests/digest-auth_int-MD5_Sess Revisions: 1.3 Authors: aland (+0 -0) ------------------------------- File: radiusd/src/tests/digest-auth_int-noalgo Revisions: 1.3 Authors: aland (+0 -0) ------------------------------- File: radiusd/src/tests/digest-md5-sess Revisions: 1.3 Authors: aland (+0 -0) ------------------------------- File: radiusd/src/tests/runtests.sh Revisions: 1.4 Authors: aland (+3 -2) ------------------------------- File: radiusd/src/tests/test.example.com Revisions: 1.1 Authors: aland -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Using X.509 Cert. subject and issuer for authorization with EAP-TLS
by arno＠natisbad.org 14 Apr '08

14 Apr '08

Hi, >From my understanding (don't hesitate to correct me), the authorization step being done before the authentication step (for the purpose of selecting the allowed authentication method), it does not seem possible to use attributes from the X.509 Certificate provided by the client for the purpose of authorization (it comes too late). I expected I would be able to extract the information from the client Cert during authentication and make it available for Post-Auth in order to decide what to do in a more precise manner (change attribute, reject, ...). The main idea is to be able to put users from unknown subtrees of my PKI in some guest VLANs by pushing specific attribute to the NAS (a switch or AP). Known users would be put in a specific VLAN associated with their profile. Other users would be rejected. After looking at the source code, I decided to define some specific vendor attributes that I would expect to have only a local meaning (not seen on the cable but infered from the TLS exchange) but I basically failed to see how to do the following *properly*: - where to store the information grabbed in the SSL callback, - how to make that information usable in a transparent fashion for Post-Auth modules like rlm_files, ... - how to force a reject and not only change attributes, ... Thanks for your time. Don't hesitate if you have questions. Cheers, a+

4 16

Automatic report from sources (radiusd) between 11.04.2008 - 12.04.2008 GMT
by Automatic cvs log generator 12 Apr '08

12 Apr '08

CVS log entries from 11.04.2008 (Fri) 08:00:00 - 12.04.2008 (Sat) 08:00:00 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_postgresql/sql_postgresql.c; Revisions: 1.59 File: radiusd/src/main/event.c; Revisions: 1.98 File: radiusd/src/main/auth.c; Revisions: 1.177 File: radiusd/src/lib/radius.c; Revisions: 1.219 File: radiusd/Makefile; Revisions: 1.57 File: radiusd/src/main/threads.c; Revisions: 1.142 File: radiusd/redhat/freeradius.spec; Revisions: 1.30 ===================================================== Log entries ===================================================== Description: Add target to make test certificates Modified files: File: radiusd/Makefile; Revision: 1.57; Date: 2008/04/11 09:49:22; Author: aland; Lines: (+8 -1) ------------------------------- Description: Update spec file so that it builds Modified files: File: radiusd/redhat/freeradius.spec; Revision: 1.30; Date: 2008/04/11 09:58:25; Author: aland; Lines: (+1 -1) ------------------------------- Description: Be a little more generous Modified files: File: radiusd/src/lib/radius.c; Revision: 1.219; Date: 2008/04/11 09:55:02; Author: aland; Lines: (+3 -3) ------------------------------- Description: Look at correct field Modified files: File: radiusd/src/main/auth.c; Revision: 1.177; Date: 2008/04/11 12:12:51; Author: aland; Lines: (+3 -3) ------------------------------- Description: Fixed crash... Modified files: File: radiusd/src/main/event.c; Revision: 1.98; Date: 2008/04/11 09:01:49; Author: aland; Lines: (+8 -3) ------------------------------- Description: Don't leak memory on catastrophic conditions. Closes #538 Modified files: File: radiusd/src/main/threads.c; Revision: 1.142; Date: 2008/04/11 08:58:52; Author: aland; Lines: (+4 -2) ------------------------------- Description: Checks for ifdef's not in 7.x Modified files: File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_postgresql/sql_postgresql.c; Revision: 1.59; Date: 2008/04/11 12:00:42; Author: aland; Lines: (+5 -2) ===================================================== Summary of modified files ===================================================== File: radiusd/Makefile Revisions: 1.57 Authors: aland (+8 -1) ------------------------------- File: radiusd/redhat/freeradius.spec Revisions: 1.30 Authors: aland (+1 -1) ------------------------------- File: radiusd/src/lib/radius.c Revisions: 1.219 Authors: aland (+3 -3) ------------------------------- File: radiusd/src/main/auth.c Revisions: 1.177 Authors: aland (+3 -3) ------------------------------- File: radiusd/src/main/event.c Revisions: 1.98 Authors: aland (+8 -3) ------------------------------- File: radiusd/src/main/threads.c Revisions: 1.142 Authors: aland (+4 -2) ------------------------------- File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_postgresql/sql_postgresql.c Revisions: 1.59 Authors: aland (+5 -2) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Re: radius.log behaviour change v1 -> v2
by Stefan Winter 11 Apr '08

11 Apr '08

Hi, following up on myself: > Wed Dec 5 21:11:11 2007 : Auth: Login OK: [stefan.winter(a)restena.lu] (from > client localhost port 0) > Wed Dec 5 21:11:11 2007 : Auth: Login OK: [@restena.lu] (from client > radius-1 port 1 cli 00-13-ce-c2-b1-86) > > v2 format is: both are logged as coming from real client, like: > Thu Mar 27 11:00:00 2008 : Auth: Login incorrect: [x.y(a)uni.lu] (from client > WLC-Walferdange2 port 0) > > Thu Mar 27 11:00:00 2008 : Auth: Login incorrect: [x.y(a)uni.lu] (from > client WLC-Walferdange2 port 29 cli 00-1C-BF-73-E6-0A) > > That makes parsing the log file more difficult, if the number of > authentications happening is to be taken out of the radius.log file. If a > NAS doesn't send Calling-Station-Id, the two are almost not correlatable, > except for the timestamp and a possibly different port (both seem whacky > ways of doing it). > > Was this change advertantly? Can I get the old behaviour back? Or at least, > add "-inner" to the client name for inner requests? Digging through the code, I noticed that there should already be a notification by adding "via TLS tunnel" at the end of the log line, the code in question in auth_name() in auth.c being a ternary op: (request->packet->src_port == 0) ? " via TLS tunnel" : ""); This log line never manifested in my setups so far. I don't fully understand the inner tunneling code in ttls and peap, I can only say that there was no obvious place where packet->src_port is set to 0 when crafting the inner request. I wonder under what circumstances this ternary is supposed to evaluate to "via TLS tunnel"... Can someone shed some light on this? Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

2 1

Modifying User-Name and User-Password attributes in a module
by Arash Yadegarnia 11 Apr '08

11 Apr '08

Hi, I've been working on a freeradius module which will operate in pre-proxy and post-proxy mode. I need to modify the user-password (PW_USER_PASSWORD) attribute in pre-proxy and return an RLM_MODULE_UPDATED. My first question is, Do I only need to update the user-password attribute in proxy packet ? or I also have to update user-password vp in packet structure ? I mean vp = pairfind (request->packet->vps, PW_USER_PASSWORD); Also, what are those "username" and "password" value pairs in main request structure ? AFAIK, they're not just pointers to values in packet, proxy, reply and proxy_reply. Do I have to update them too ? And last question, Is it safe to modify the Proxy-State attribute in pre-proxy stage? somewhere in event.c, the comments says that, RFC requires it (Proxy-State) but freeradius doesn't need it, and just fills it with packet->id (which is a random number). Since RFC forbids adding more than one Proxy-State too the packet, and also having in mind that I don't want to introduce a new attribute (bothering dictionary files), Can I use the same Proxy-State (filed by freeradius with packet->id) to store my own data in it ? Thanks,

2 6

Automatic report from sources (radiusd) between 08.04.2008 - 09.04.2008 GMT
by Automatic cvs log generator 09 Apr '08

09 Apr '08

CVS log entries from 08.04.2008 (Tue) 08:00:01 - 09.04.2008 (Wed) 08:00:00 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/raddb/attrs.pre-proxy; Revisions: 1.3, 1.2 File: radiusd/raddb/attrs; Revisions: 1.8 ===================================================== Combined list of identical log entries ===================================================== Description: Added Message-Authenticator Modified files: File: radiusd/raddb/attrs; Revision: 1.8; Date: 2008/04/09 07:18:25; Author: aland; Lines: (+2 -1) File: radiusd/raddb/attrs.pre-proxy; Revision: 1.3; Date: 2008/04/09 07:18:25; Author: aland; Lines: (+2 -1) ===================================================== Log entries ===================================================== Description: Added EAP and MS-CHAP attributes as allowed Modified files: File: radiusd/raddb/attrs.pre-proxy; Revision: 1.2; Date: 2008/04/09 06:25:47; Author: aland; Lines: (+5 -2) ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/attrs Revisions: 1.8 Authors: aland (+2 -1) ------------------------------- File: radiusd/raddb/attrs.pre-proxy Revisions: 1.3, 1.2 Authors: aland (+2 -1), aland (+5 -2) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

attrs.pre-proxy: suggested new default list
by Stefan Winter 09 Apr '08

09 Apr '08

Hi, after my first production installation of a FR 2.0 server, I have a small suggestion: attrs.pre-proxy should list two more attributes to enable EAP proxying: EAP-Message =* ANY, State =* ANY Just like in the case we had with the attrs file in FR 1.1. Greetings, Stefan -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

2 2

crash at [event.c:969] Failed to insert event
by Stefan Winter 08 Apr '08

08 Apr '08

Hi, when I was playing with attrs.pre-proxy, at first I only added EAP-Message to the list, but not State. In the result, when an answre froma proxy came back, the above error message occured and the server exited (with -X). Version is 2.0.3. Full debug of the packet in question: Going to the next request Waking up in 0.3 seconds. Rejecting request 2 due to lack of any response from home server 158.64.1.220 port 1812 There was no response configured: rejecting request 2 Found Post-Auth-Type Reject +- entering group REJECT expand: /var/log/radius/radacct/%Y%m%d/%{RESTENA-Service-Type}-service/reply-detail -> /var/log/radius/radacct/20080408/eduroam-lu-service/reply-detail rlm_detail: /var/log/radius/radacct/%Y%m%d/%{RESTENA-Service-Type}-service/reply-detail expands to /var/log/radius/radacct/20080408/eduroam-lu-service/reply-detail expand: %t -> Tue Apr 8 11:11:18 2008 ++[reply_log] returns ok Finished request 2. [event.c:969] Failed to insert event I could reproduce this several times by proxying EAP and filtering State. It's okay if stuff doesn't work in that case, but crashing is not so good. Greetings, Stefan -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

2 1

Automatic report from sources (radiusd) between 03.04.2008 - 04.04.2008 GMT
by Automatic cvs log generator 04 Apr '08

04 Apr '08

CVS log entries from 03.04.2008 (Thu) 08:00:00 - 04.04.2008 (Fri) 08:00:04 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/main/event.c; Revisions: 1.97 File: radiusd/src/tests/Makefile; Revisions: 1.10 File: radiusd/src/main/threads.c; Revisions: 1.141 File: radiusd/src/main/detail.c; Revisions: 1.11 File: radiusd/raddb/radiusd.conf.in; Revisions: 1.270 File: radiusd/src/main/radclient.c; Revisions: 1.120 File: radiusd/src/lib/fifo.c; Revisions: 1.11 File: radiusd/man/man5/unlang.5; Revisions: 1.18 ===================================================== Log entries ===================================================== Description: Minor clarifications Modified files: File: radiusd/man/man5/unlang.5; Revision: 1.18; Date: 2008/04/03 20:25:51; Author: aland; Lines: (+8 -6) ------------------------------- Description: More docs for mschap && ntlm_auth Modified files: File: radiusd/raddb/radiusd.conf.in; Revision: 1.270; Date: 2008/04/04 06:05:27; Author: aland; Lines: (+9 -1) ------------------------------- Description: Use correct pointer to avoid memleak. Closes bug #537 Modified files: File: radiusd/src/lib/fifo.c; Revision: 1.11; Date: 2008/04/03 08:37:07; Author: aland; Lines: (+3 -3) ------------------------------- Description: Call fr_printf_log instead of printf Modified files: File: radiusd/src/main/detail.c; Revision: 1.11; Date: 2008/04/03 20:04:39; Author: aland; Lines: (+4 -6) ------------------------------- Description: Work-around for callback==NULL problem Modified files: File: radiusd/src/main/event.c; Revision: 1.97; Date: 2008/04/03 19:41:01; Author: aland; Lines: (+21 -2) ------------------------------- Description: -q means -q Modified files: File: radiusd/src/main/radclient.c; Revision: 1.120; Date: 2008/04/03 13:43:12; Author: aland; Lines: (+4 -3) ------------------------------- Description: Don't signal detail file handlers. That's taken care of elsewhere Modified files: File: radiusd/src/main/threads.c; Revision: 1.141; Date: 2008/04/03 14:40:03; Author: aland; Lines: (+2 -36) ------------------------------- Description: Updated test suite Modified files: File: radiusd/src/tests/Makefile; Revision: 1.10; Date: 2008/04/03 20:09:09; Author: aland; Lines: (+10 -9) ===================================================== Summary of modified files ===================================================== File: radiusd/man/man5/unlang.5 Revisions: 1.18 Authors: aland (+8 -6) ------------------------------- File: radiusd/raddb/radiusd.conf.in Revisions: 1.270 Authors: aland (+9 -1) ------------------------------- File: radiusd/src/lib/fifo.c Revisions: 1.11 Authors: aland (+3 -3) ------------------------------- File: radiusd/src/main/detail.c Revisions: 1.11 Authors: aland (+4 -6) ------------------------------- File: radiusd/src/main/event.c Revisions: 1.97 Authors: aland (+21 -2) ------------------------------- File: radiusd/src/main/radclient.c Revisions: 1.120 Authors: aland (+4 -3) ------------------------------- File: radiusd/src/main/threads.c Revisions: 1.141 Authors: aland (+2 -36) ------------------------------- File: radiusd/src/tests/Makefile Revisions: 1.10 Authors: aland (+10 -9) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 02.04.2008 - 03.04.2008 GMT
by Automatic cvs log generator 03 Apr '08

03 Apr '08

CVS log entries from 02.04.2008 (Wed) 08:00:00 - 03.04.2008 (Thu) 08:00:00 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/modules/rlm_ldap/rlm_ldap.c; Revisions: 1.193 File: radiusd/share/dictionary; Revisions: 1.154 File: radiusd/raddb/Makefile; Revisions: 1.39 File: radiusd/share/dictionary.clavister; Revisions: 1.1 ===================================================== Combined list of identical log entries ===================================================== Description: Added Clavister dictionary, from http://www.clavister.com/support/kb/10021/ Modified files: File: radiusd/share/dictionary; Revision: 1.154; Date: 2008/04/02 11:59:17; Author: aland; Lines: (+2 -1) File: radiusd/share/dictionary.clavister; Revision: 1.1; Date: 2008/04/02 11:59:17; Author: aland; ===================================================== Log entries ===================================================== Description: Now that inner-tunnel is in the default config, ensure that it's in sites-enabled for testing, too Modified files: File: radiusd/raddb/Makefile; Revision: 1.39; Date: 2008/04/03 01:36:30; Author: aland; Lines: (+4 -1) ------------------------------- Description: This was supposed to go in 2.0.3, and didn't make it. Modified files: File: radiusd/src/modules/rlm_ldap/rlm_ldap.c; Revision: 1.193; Date: 2008/04/03 00:51:16; Author: aland; Lines: (+18 -11) ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/Makefile Revisions: 1.39 Authors: aland (+4 -1) ------------------------------- File: radiusd/share/dictionary Revisions: 1.154 Authors: aland (+2 -1) ------------------------------- File: radiusd/share/dictionary.clavister Revisions: 1.1 Authors: aland ------------------------------- File: radiusd/src/modules/rlm_ldap/rlm_ldap.c Revisions: 1.193 Authors: aland (+18 -11) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 01.04.2008 - 02.04.2008 GMT
by Automatic cvs log generator 02 Apr '08

02 Apr '08

CVS log entries from 01.04.2008 (Tue) 08:00:00 - 02.04.2008 (Wed) 08:00:00 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/raddb/sites-available/default; Revisions: 1.8 File: radiusd/src/modules/rlm_passwd/rlm_passwd.c; Revisions: 1.38 File: radiusd/raddb/sites-available/vmps; Revisions: 1.7 File: radiusd/src/main/auth.c; Revisions: 1.176 File: radiusd/src/main/event.c; Revisions: 1.96 File: radiusd/raddb/sites-available/virtual.example.com; Revisions: 1.1 File: radiusd/src/main/realms.c; Revisions: 1.45 File: radiusd/raddb/radiusd.conf.in; Revisions: 1.269 File: radiusd/raddb/proxy.conf; Revisions: 1.31 File: radiusd/src/include/realms.h; Revisions: 1.17 ===================================================== Combined list of identical log entries ===================================================== Description: Added sample "mac2vlan" module for VMPS. Modified files: File: radiusd/raddb/radiusd.conf.in; Revision: 1.269; Date: 2008/04/01 08:20:12; Author: aland; Lines: (+16 -1) File: radiusd/raddb/sites-available/vmps; Revision: 1.7; Date: 2008/04/01 08:20:13; Author: aland; Lines: (+8 -1) ------------------------------- Description: Allow "virtual_server" in realm && home_server configuration. It doesn't do anything right now, but that code is coming. Modified files: File: radiusd/src/include/realms.h; Revision: 1.17; Date: 2008/04/01 08:57:53; Author: aland; Lines: (+3 -3) File: radiusd/src/main/realms.c; Revision: 1.45; Date: 2008/04/01 08:57:53; Author: aland; Lines: (+80 -46) ------------------------------- Description: Document new functionality. Modified files: File: radiusd/raddb/proxy.conf; Revision: 1.31; Date: 2008/04/01 10:20:59; Author: aland; Lines: (+35 -2) File: radiusd/raddb/sites-available/virtual.example.com; Revision: 1.1; Date: 2008/04/01 10:20:59; Author: aland; ===================================================== Log entries ===================================================== Description: Add more rants for people who think that destroying the default configuration is a good idea. Modified files: File: radiusd/raddb/sites-available/default; Revision: 1.8; Date: 2008/04/01 08:34:31; Author: aland; Lines: (+29 -1) ------------------------------- Description: use correct field Modified files: File: radiusd/src/main/auth.c; Revision: 1.176; Date: 2008/04/01 10:13:28; Author: aland; Lines: (+3 -3) ------------------------------- Description: Look for "virtual_server" in "home_server". If found, "proxy" it by running the virtual-server in place. Modified files: File: radiusd/src/main/event.c; Revision: 1.96; Date: 2008/04/01 08:59:09; Author: aland; Lines: (+48 -4) ------------------------------- Description: Enable passwd to be listed in accounting && post-auth Modified files: File: radiusd/src/modules/rlm_passwd/rlm_passwd.c; Revision: 1.38; Date: 2008/04/01 08:11:03; Author: aland; Lines: (+5 -7) ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/proxy.conf Revisions: 1.31 Authors: aland (+35 -2) ------------------------------- File: radiusd/raddb/radiusd.conf.in Revisions: 1.269 Authors: aland (+16 -1) ------------------------------- File: radiusd/raddb/sites-available/default Revisions: 1.8 Authors: aland (+29 -1) ------------------------------- File: radiusd/raddb/sites-available/virtual.example.com Revisions: 1.1 Authors: aland ------------------------------- File: radiusd/raddb/sites-available/vmps Revisions: 1.7 Authors: aland (+8 -1) ------------------------------- File: radiusd/src/include/realms.h Revisions: 1.17 Authors: aland (+3 -3) ------------------------------- File: radiusd/src/main/auth.c Revisions: 1.176 Authors: aland (+3 -3) ------------------------------- File: radiusd/src/main/event.c Revisions: 1.96 Authors: aland (+48 -4) ------------------------------- File: radiusd/src/main/realms.c Revisions: 1.45 Authors: aland (+80 -46) ------------------------------- File: radiusd/src/modules/rlm_passwd/rlm_passwd.c Revisions: 1.38 Authors: aland (+5 -7) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0