July 2008 - Freeradius-Devel - lists.freeradius.org

IPv6 code for pam_radius-1.3.17
by kentaro aoki 18 Sep '08

18 Sep '08

Hi, I make the patch of ipv6 for pam_radius-1.3.17. Please use, if very well. Thank you. Kentaro Aoki The config file is following. /etc/raddb/server 127.0.0.1:1645 secret 1 127.0.0.1 secret 1 [::1]:1645 secret 1 ::1 secret 1 The patch is following. diff -c pam_radius-1.3.17/pam_radius_auth.c pam_radius-1.3.17-ipv6/pam_radius_auth.c *** pam_radius-1.3.17/pam_radius_auth.c 2007-03-26 18:36:13.000000000 +0900 --- pam_radius-1.3.17-ipv6/pam_radius_auth.c 2008-07-18 16:14:08.000000000 +0900 *************** *** 27,32 **** --- 27,33 ---- * 1.3.15 - Implement retry option, miscellanous bug fixes. * 1.3.16 - Miscellaneous fixes (see CVS for history) * 1.3.17 - Security fixes + * 1.3.17-ipv6 - Added ipv6 code by Kentaro Aoki <kentaro.aoki(a)gmail.com> * * * This program is free software; you can redistribute it and/or modify *************** *** 252,257 **** --- 253,315 ---- return(ntohl(*(UINT4 *)hp->h_addr)); } + int dup_addrinfo(struct addrinfo **pptr_dup_addrinfo, struct addrinfo *ptr_addrinfo) + { + int result = 0; + struct addrinfo *ptr_tmp_addrinfo; + struct addrinfo *ptr_tmp_dup_addrinfo = NULL;; + struct addrinfo *ptr_tmp_cur_addrinfo = NULL;; + + *pptr_dup_addrinfo = NULL; + for (ptr_tmp_addrinfo = ptr_addrinfo; ptr_tmp_addrinfo != NULL; ptr_tmp_addrinfo = ptr_tmp_addrinfo->ai_next) { + ptr_tmp_dup_addrinfo = malloc(sizeof(struct addrinfo)); + if (ptr_tmp_dup_addrinfo == NULL) { + continue; + } + memset(ptr_tmp_dup_addrinfo, 0, sizeof(struct addrinfo)); + + if (ptr_tmp_addrinfo->ai_addr == NULL || ptr_tmp_addrinfo->ai_addrlen <= 0) { + ptr_tmp_dup_addrinfo->ai_addr = NULL; + } else { + ptr_tmp_dup_addrinfo->ai_addr = malloc(ptr_tmp_addrinfo->ai_addrlen); + memcpy(ptr_tmp_dup_addrinfo->ai_addr, ptr_tmp_addrinfo->ai_addr, ptr_tmp_addrinfo->ai_addrlen); + } + ptr_tmp_dup_addrinfo->ai_addrlen = ptr_tmp_addrinfo->ai_addrlen; + if (ptr_tmp_addrinfo->ai_canonname != NULL) { + ptr_tmp_dup_addrinfo->ai_canonname = strdup(ptr_tmp_addrinfo->ai_canonname); + } else { + ptr_tmp_dup_addrinfo->ai_canonname = NULL; + } + ptr_tmp_dup_addrinfo->ai_family = ptr_tmp_addrinfo->ai_family; + ptr_tmp_dup_addrinfo->ai_flags = ptr_tmp_addrinfo->ai_flags; + ptr_tmp_dup_addrinfo->ai_protocol = ptr_tmp_addrinfo->ai_protocol; + ptr_tmp_dup_addrinfo->ai_socktype = ptr_tmp_addrinfo->ai_socktype; + ptr_tmp_dup_addrinfo->ai_next = NULL; + + if (*pptr_dup_addrinfo == NULL) { + *pptr_dup_addrinfo = ptr_tmp_dup_addrinfo; + } else { + ptr_tmp_cur_addrinfo->ai_next = ptr_tmp_dup_addrinfo; + } + ptr_tmp_cur_addrinfo = ptr_tmp_dup_addrinfo; + } + return result; + } + + void free_addrinfo(struct addrinfo **pptr_addrinfo) + { + if (*pptr_addrinfo != NULL) { + if ((*pptr_addrinfo)->ai_addr != NULL) { + free((*pptr_addrinfo)->ai_addr); + } + if ((*pptr_addrinfo)->ai_canonname != NULL) { + free((*pptr_addrinfo)->ai_canonname); + } + free(*pptr_addrinfo); + *pptr_addrinfo = NULL; + } + } + /* * take server->hostname, and convert it to server->ip and server->port */ *************** *** 260,314 **** { char *p; int ctrl = 1; /* for DPRINT */ ! ! if ((p = strchr(server->hostname, ':')) != NULL) { ! *(p++) = '\0'; /* split the port off from the host name */ } ! ! if ((server->ip.s_addr = get_ipaddr(server->hostname)) == ((UINT4)0)) { ! DPRINT(LOG_DEBUG, "DEBUG: get_ipaddr(%s) returned 0.\n", server->hostname); ! return PAM_AUTHINFO_UNAVAIL; } ! ! /* ! * If the server port hasn't already been defined, go get it. ! */ ! if (!server->port) { ! if (p && isdigit(*p)) { /* the port looks like it's a number */ ! unsigned int i = atoi(p) & 0xffff; ! ! if (!server->accounting) { ! server->port = htons((u_short) i); ! } else { ! server->port = htons((u_short) (i + 1)); ! } ! } else { /* the port looks like it's a name */ ! struct servent *svp; ! ! if (p) { /* maybe it's not "radius" */ ! svp = getservbyname (p, "udp"); ! /* quotes allow distinction from above, lest p be radius or radacct */ ! DPRINT(LOG_DEBUG, "DEBUG: getservbyname('%s', udp) returned %d.\n", p, svp); ! *(--p) = ':'; /* be sure to put the delimiter back */ ! } else { ! if (!server->accounting) { ! svp = getservbyname ("radius", "udp"); ! DPRINT(LOG_DEBUG, "DEBUG: getservbyname(radius, udp) returned %d.\n", svp); ! } else { ! svp = getservbyname ("radacct", "udp"); ! DPRINT(LOG_DEBUG, "DEBUG: getservbyname(radacct, udp) returned %d.\n", svp); ! } ! } ! ! if (svp == (struct servent *) 0) { ! /* debugging above... */ ! return PAM_AUTHINFO_UNAVAIL; ! } ! ! server->port = svp->s_port; ! } } ! return PAM_SUCCESS; } --- 318,372 ---- { char *p; int ctrl = 1; /* for DPRINT */ ! char *ptr_host = NULL; ! char *ptr_service = NULL; ! char *ptr_hostname; ! int i; ! struct addrinfo hintsaddr; ! struct addrinfo *peeraddrs; ! ! ptr_hostname = strdup(server->hostname); ! ptr_host = ptr_hostname; ! /* If the host name may be catenated ipv6-string with port, go get it. */ ! if (*ptr_host == '[') { ! ptr_host ++; ! p = strchr(ptr_host, ']'); ! *(p++) = '\0'; /* split the port off from the host name */ ! ptr_service = strchr(p, ':'); ! ptr_service++; ! } else { ! /* Checks the host name for ipv6. */ ! i = 0; ! for (p = ptr_host; *p != '\0'; p ++) { ! if (*p == ':') { ! i ++; ! } ! } ! /* If the host name may be ipv4-string, go get it. */ ! if (i < 2) { ! if ((ptr_service = strchr(ptr_host, ':')) != NULL) { ! *(ptr_service++) = '\0'; /* split the port off from the host name */ ! } ! } } ! if (ptr_service == NULL) { ! if (!server->accounting) { ! ptr_service = "radius"; ! } else { ! ptr_service = "radacct"; ! } } ! ! /* Resolves host with service. */ ! memset(&hintsaddr, 0, sizeof(struct addrinfo)); ! hintsaddr.ai_family = AF_UNSPEC; ! hintsaddr.ai_socktype = SOCK_DGRAM; ! if ((i = getaddrinfo(ptr_host, ptr_service, &hintsaddr, &peeraddrs)) != 0) { ! DPRINT(LOG_DEBUG, "DEBUG: getaddrinfo(%s, %s) returned %d.\n", ptr_host, ptr_service, i); ! return PAM_AUTHINFO_UNAVAIL; } ! dup_addrinfo(&server->addressinfo, peeraddrs); ! free(ptr_hostname); return PAM_SUCCESS; } *************** *** 641,647 **** server->hostname = strdup(hostname); server->secret = strdup(secret); server->accounting = accounting; ! server->port = 0; if ((timeout < 1) || (timeout > 60)) { server->timeout = 3; --- 699,705 ---- server->hostname = strdup(hostname); server->secret = strdup(secret); server->accounting = accounting; ! server->addressinfo = NULL; if ((timeout < 1) || (timeout > 60)) { server->timeout = 3; *************** *** 699,705 **** build_radius_packet(AUTH_HDR *request, CONST char *user, CONST char *password, radius_conf_t *conf) { char hostname[256]; ! UINT4 ipaddr; hostname[0] = '\0'; gethostname(hostname, sizeof(hostname) - 1); --- 757,765 ---- build_radius_packet(AUTH_HDR *request, CONST char *user, CONST char *password, radius_conf_t *conf) { char hostname[256]; ! struct addrinfo hintsaddr; ! struct addrinfo *peeraddrs; ! struct addrinfo *peeraddr; hostname[0] = '\0'; gethostname(hostname, sizeof(hostname) - 1); *************** *** 725,746 **** add_password(request, PW_PASSWORD, "", conf->server->secret); } ! /* the packet is from localhost if on localhost, to make configs easier */ ! if ((conf->server->ip.s_addr == ntohl(0x7f000001)) || (!hostname[0])) { ! ipaddr = 0x7f000001; ! } else { ! struct hostent *hp; ! ! if ((hp = gethostbyname(hostname)) == (struct hostent *) NULL) { ! ipaddr = 0x00000000; /* no client IP address */ ! } else { ! ipaddr = ntohl(*(UINT4 *) hp->h_addr); /* use the first one available */ ! } } /* If we can't find an IP address, then don't add one */ ! if (ipaddr) { ! add_int_attribute(request, PW_NAS_IP_ADDRESS, ipaddr); } /* There's always a NAS identifier */ --- 785,814 ---- add_password(request, PW_PASSWORD, "", conf->server->secret); } ! if (hostname[0] == '\0') { ! strncpy(hostname, "127.0.0.1", sizeof(hostname)); } /* If we can't find an IP address, then don't add one */ ! if (hostname[0] != '\0') { ! hintsaddr.ai_family = AF_UNSPEC; ! hintsaddr.ai_socktype = SOCK_DGRAM; ! if (getaddrinfo(hostname, NULL, &hintsaddr, &peeraddrs) == 0) { ! for (peeraddr = peeraddrs; peeraddr != NULL; peeraddr = peeraddr->ai_next) { ! switch (peeraddr->ai_family) { ! case AF_INET: ! add_attribute(request, PW_NAS_IP_ADDRESS, ! (unsigned char *)&((struct sockaddr_in *)peeraddr->ai_addr)->sin_addr, 4); ! break; ! case AF_INET6: ! add_attribute(request, PW_NAS_IPV6_ADDRESS, ! (unsigned char *)&((struct sockaddr_in6 *)peeraddr->ai_addr)->sin6_addr, 16); ! break; ! default: ! break; ! } ! } ! } } /* There's always a NAS identifier */ *************** *** 766,780 **** talk_radius(radius_conf_t *conf, AUTH_HDR *request, AUTH_HDR *response, char *password, char *old_password, int tries) { ! int salen, total_length; fd_set set; struct timeval tv; time_t now, end; int rcode; ! struct sockaddr saremote; ! struct sockaddr_in *s_in = (struct sockaddr_in *) &saremote; radius_server_t *server = conf->server; ! int ok; int server_tries; int retval; --- 834,849 ---- talk_radius(radius_conf_t *conf, AUTH_HDR *request, AUTH_HDR *response, char *password, char *old_password, int tries) { ! int total_length; fd_set set; struct timeval tv; time_t now, end; int rcode; ! struct addrinfo *cur_addrinfo; ! struct sockaddr_in6 saremote; ! socklen_t salen = sizeof(struct sockaddr_in6); radius_server_t *server = conf->server; ! int ok = TRUE; int server_tries; int retval; *************** *** 804,957 **** } /* set up per-server IP && port configuration */ - memset ((char *) s_in, '\0', sizeof(struct sockaddr)); - s_in->sin_family = AF_INET; - s_in->sin_addr.s_addr = htonl(server->ip.s_addr); - s_in->sin_port = server->port; total_length = ntohs(request->length); if (!password) { /* make an RFC 2139 p6 request authenticator */ get_accounting_vector(request, server); } ! server_tries = tries; ! send: ! /* send the packet */ ! if (sendto(conf->sockfd, (char *) request, total_length, 0, ! &saremote, sizeof(struct sockaddr_in)) < 0) { ! _pam_log(LOG_ERR, "Error sending RADIUS packet to server %s: %s", ! server->hostname, strerror(errno)); ! ok = FALSE; ! goto next; /* skip to the next server */ ! } ! ! /* ************************************************************ */ ! /* Wait for the response, and verify it. */ ! salen = sizeof(struct sockaddr); ! tv.tv_sec = server->timeout; /* wait for the specified time */ ! tv.tv_usec = 0; ! FD_ZERO(&set); /* clear out the set */ ! FD_SET(conf->sockfd, &set); /* wait only for the RADIUS UDP socket */ ! ! time(&now); ! end = now + tv.tv_sec; ! ! /* loop, waiting for the select to return data */ ! ok = TRUE; ! while (ok) { ! ! rcode = select(conf->sockfd + 1, &set, NULL, NULL, &tv); ! ! /* select timed out */ ! if (rcode == 0) { ! _pam_log(LOG_ERR, "RADIUS server %s failed to respond", ! server->hostname); ! if (--server_tries) ! goto send; ! ok = FALSE; ! break; /* exit from the select loop */ ! } else if (rcode < 0) { ! ! /* select had an error */ ! if (errno == EINTR) { /* we were interrupted */ ! time(&now); ! ! if (now > end) { ! _pam_log(LOG_ERR, "RADIUS server %s failed to respond", ! server->hostname); ! if (--server_tries) ! goto send; ! ok = FALSE; ! break; /* exit from the select loop */ ! } ! ! tv.tv_sec = end - now; ! if (tv.tv_sec == 0) { /* keep waiting */ ! tv.tv_sec = 1; ! } ! ! } else { /* not an interrupt, it was a real error */ ! _pam_log(LOG_ERR, "Error waiting for response from RADIUS server %s: %s", ! server->hostname, strerror(errno)); ! ok = FALSE; ! break; } ! ! /* the select returned OK */ ! } else if (FD_ISSET(conf->sockfd, &set)) { ! ! /* try to receive some data */ ! if ((total_length = recvfrom(conf->sockfd, (char *) response, ! BUFFER_SIZE, ! 0, &saremote, &salen)) < 0) { ! _pam_log(LOG_ERR, "error reading RADIUS packet from server %s: %s", ! server->hostname, strerror(errno)); ! ok = FALSE; ! break; ! ! /* there's data, see if it's valid */ ! } else { ! char *p = server->secret; ! ! if ((ntohs(response->length) != total_length) || ! (ntohs(response->length) > BUFFER_SIZE)) { ! _pam_log(LOG_ERR, "RADIUS packet from server %s is corrupted", ! server->hostname); ! ok = FALSE; ! break; ! } ! ! /* Check if we have the data OK. We should also check request->id */ ! ! if (password) { ! if (old_password) { #ifdef LIVINGSTON_PASSWORD_VERIFY_BUG_FIXED ! p = old_password; /* what it should be */ ! #else ! p = ""; /* what it really is */ ! #endif ! } ! /* ! * RFC 2139 p.6 says not do do this, but the Livingston 1.16 ! * server disagrees. If the user says he wants the bug, give in. ! */ ! } else { /* authentication request */ ! if (conf->accounting_bug) { ! p = ""; ! } ! } ! ! if (!verify_packet(p, response, request)) { ! _pam_log(LOG_ERR, "packet from RADIUS server %s fails verification: The shared secret is probably incorrect.", ! server->hostname); ! ok = FALSE; ! break; ! } ! ! /* ! * Check that the response ID matches the request ID. ! */ ! if (response->id != request->id) { ! _pam_log(LOG_WARNING, "Response packet ID %d does not match the request packet ID %d: verification of packet fails", response->id, request->id); ! ok = FALSE; ! break; ! } ! } ! ! /* ! * Whew! The select is done. It hasn't timed out, or errored out. ! * It's our descriptor. We've got some data. It's the right size. ! * The packet is valid. ! * NOW, we can skip out of the select loop, and process the packet ! */ ! break; ! } ! /* otherwise, we've got data on another descriptor, keep select'ing */ ! } /* go to the next server if this one didn't respond */ next: ! if (!ok) { radius_server_t *old; /* forget about this server */ old = server; --- 873,1058 ---- } /* set up per-server IP && port configuration */ total_length = ntohs(request->length); if (!password) { /* make an RFC 2139 p6 request authenticator */ get_accounting_vector(request, server); } ! for (cur_addrinfo = server->addressinfo ! ; cur_addrinfo != NULL ! ; cur_addrinfo = cur_addrinfo->ai_next) { ! ! struct sockaddr_in peer_sockaddr; ! struct sockaddr_in6 peer_sockaddr6; ! const struct in6_addr in6addr_any = IN6ADDR_ANY_INIT; ! u_short local_port; ! struct sockaddr *sockaddr_ptr; ! int sockaddr_len; ! int sockfd; ! ! ok = TRUE; ! if (cur_addrinfo->ai_family != AF_INET && cur_addrinfo->ai_family != AF_INET6) { ! ok = FALSE; ! continue; ! } ! /* send the packet */ ! sockfd = socket(cur_addrinfo->ai_family, ! cur_addrinfo->ai_socktype, ! cur_addrinfo->ai_protocol); ! if (sockfd < 0) { ! ok = FALSE; ! continue; ! } ! ! /* ! * Use our process ID as a local port for RADIUS. ! */ ! local_port = (getpid() & 0x7fff) + 1024; ! do { ! local_port++; ! if (cur_addrinfo->ai_family == AF_INET) { ! peer_sockaddr.sin_family = cur_addrinfo->ai_family; ! peer_sockaddr.sin_addr.s_addr = htonl(INADDR_ANY); ! peer_sockaddr.sin_port = htons(local_port); ! sockaddr_ptr = (struct sockaddr *)&peer_sockaddr; ! sockaddr_len = sizeof(struct sockaddr_in); ! } else if (cur_addrinfo->ai_family == AF_INET6) { ! peer_sockaddr6.sin6_family = cur_addrinfo->ai_family; ! peer_sockaddr6.sin6_addr = in6addr_any; ! peer_sockaddr6.sin6_port = htons(local_port); ! sockaddr_ptr = (struct sockaddr *)&peer_sockaddr6; ! sockaddr_len = sizeof(struct sockaddr_in6); ! } else { ! continue; ! } ! } while ((bind(sockfd, sockaddr_ptr, sockaddr_len) < 0) && ! (local_port < 64000)); ! if (local_port >= 64000) { ! close(sockfd); ! _pam_log(LOG_ERR, "No open port we could bind to."); ! continue; ! } ! ! if (sendto(sockfd, (char *) request, total_length, 0, ! cur_addrinfo->ai_addr, cur_addrinfo->ai_addrlen) < 0) { ! _pam_log(LOG_ERR, "Error sending RADIUS packet to server %s: %s", ! server->hostname, strerror(errno)); ! close(sockfd); ! continue; ! } ! server_tries = tries; ! do { ! tv.tv_sec = server->timeout; /* wait for the specified time */ ! tv.tv_usec = 0; ! FD_ZERO(&set); /* clear out the set */ ! FD_SET(sockfd, &set); /* wait only for the RADIUS UDP socket */ ! rcode = select(sockfd + 1, &set, NULL, NULL, &tv); ! /* select timed out */ ! if (rcode == 0) { ! _pam_log(LOG_ERR, "RADIUS server %s failed to respond(time out %d(sec))", ! server->hostname, server->timeout); ! if (--server_tries) { ! continue; ! } ! ok = FALSE; ! break; /* exit from the select loop */ ! } else if (rcode < 0) { ! /* select had an error */ ! if (errno == EINTR) { /* we were interrupted */ ! time(&now); ! if (now > end) { ! _pam_log(LOG_ERR, "RADIUS server %s failed to respond", ! server->hostname); ! if (--server_tries) { ! continue; ! } ! ok = FALSE; ! break; /* exit from the select loop */ ! } ! tv.tv_sec = end - now; ! if (tv.tv_sec == 0) { /* keep waiting */ ! tv.tv_sec = 1; ! } ! } else { /* not an interrupt, it was a real error */ ! _pam_log(LOG_ERR, "Error waiting for response from RADIUS server %s: %s", ! server->hostname, strerror(errno)); ! ok = FALSE; ! break; ! } ! /* the select returned OK */ ! } else if (FD_ISSET(sockfd, &set)) { ! /* try to receive some data */ ! if ((total_length = recvfrom(sockfd, (char *) response, BUFFER_SIZE, 0, (struct sockaddr *)&saremote, &salen)) < 0) { ! _pam_log(LOG_ERR, "error reading RADIUS packet from server %s: %s", ! server->hostname, strerror(errno)); ! ok = FALSE; ! break; ! /* there's data, see if it's valid */ ! } ! } ! } while (0); ! close(sockfd); ! if (ok != FALSE) { ! break; ! } } ! do { ! if (ok == TRUE) { ! char *p = server->secret; ! if ((ntohs(response->length) != total_length) || ! (ntohs(response->length) > BUFFER_SIZE)) { ! _pam_log(LOG_ERR, "RADIUS packet from server %s is corrupted", ! server->hostname); ! ok = FALSE; ! break; ! } ! /* Check if we have the data OK. We should also check request->id */ ! if (password) { ! if (old_password) { #ifdef LIVINGSTON_PASSWORD_VERIFY_BUG_FIXED ! p = old_password; /* what it should be */ ! #else next: + p = ""; /* what it really is */ + #endif + } + /* + * RFC 2139 p.6 says not do do this, but the Livingston 1.16 + * server disagrees. If the user says he wants the bug, give in. + */ + } else { /* authentication request */ + if (conf->accounting_bug) { + p = ""; + } + } + if (!verify_packet(p, response, request)) { + _pam_log(LOG_ERR, "packet from RADIUS server %s fails verification: The shared secret is probably incorrect.", + server->hostname); + ok = FALSE; + break; + } + /* + * Check that the response ID matches the request ID. + */ + if (response->id != request->id) { + _pam_log(LOG_WARNING, "Response packet ID %d does not match the request packet ID %d: verification of packet fails", response->id, request->id); + ok = FALSE; + break; + } + /* + * Whew! The select is done. It hasn't timed out, or errored out. + * It's our descriptor. We've got some data. It's the right size. + * The packet is valid. + * NOW, we can skip out of the select loop, and process the packet + */ + break; + } + /* otherwise, we've got data on another descriptor, keep select'ing */ + } while (0); /* go to the next server if this one didn't respond */ next: ! if (ok == FALSE) { radius_server_t *old; /* forget about this server */ old = server; *************** *** 960,965 **** --- 1061,1067 ---- _pam_forget(old->secret); free(old->hostname); + free_addrinfo(&old->addressinfo); free(old); if (server) { /* if there's more servers to check */ *************** *** 1137,1143 **** if(password) { password = strdup(password); - DPRINT(LOG_DEBUG, "Got password %s", password); } /* no previous password: maybe get one from the user */ --- 1239,1244 ---- diff -c pam_radius-1.3.17/pam_radius_auth.conf pam_radius-1.3.17-ipv6/pam_radius_auth.conf *** pam_radius-1.3.17/pam_radius_auth.conf 2000-07-11 04:18:42.000000000 +0900 --- pam_radius-1.3.17-ipv6/pam_radius_auth.conf 2008-07-18 16:36:15.000000000 +0900 *************** *** 8,14 **** # lines. Blank lines or lines beginning with '#' are treated as # comments, and are ignored. The fields are: # ! # server[:port] secret [timeout] # # the port name or number is optional. The default port name is # "radius", and is looked up from /etc/services The timeout field is --- 8,17 ---- # lines. Blank lines or lines beginning with '#' are treated as # comments, and are ignored. The fields are: # ! # hostname-server[:port] secret [timeout] ! # ipv4-server[:port] secret [timeout] ! # ipv6-server secret [timeout] ! # \[ipv6-server\]:port secret [timeout] # # the port name or number is optional. The default port name is # "radius", and is looked up from /etc/services The timeout field is *************** *** 23,28 **** --- 26,35 ---- # deciding that the server has failed to respond. # # server[:port] shared_secret timeout (s) + # ex. + # ::1 secret 1 + # [::1]:1645 secret 1 + 127.0.0.1 secret 1 other-server other-secret 3 diff -c pam_radius-1.3.17/pam_radius_auth.h pam_radius-1.3.17-ipv6/pam_radius_auth.h *** pam_radius-1.3.17/pam_radius_auth.h 2007-03-26 14:35:31.000000000 +0900 --- pam_radius-1.3.17-ipv6/pam_radius_auth.h 2008-07-18 16:14:19.000000000 +0900 *************** *** 36,43 **** typedef struct radius_server_t { struct radius_server_t *next; ! struct in_addr ip; ! u_short port; char *hostname; char *secret; int timeout; --- 36,42 ---- typedef struct radius_server_t { struct radius_server_t *next; ! struct addrinfo *addressinfo; char *hostname; char *secret; int timeout; diff -c pam_radius-1.3.17/radius.h pam_radius-1.3.17-ipv6/radius.h *** pam_radius-1.3.17/radius.h 2000-08-23 00:24:47.000000000 +0900 --- pam_radius-1.3.17-ipv6/radius.h 2008-07-18 16:07:34.000000000 +0900 *************** *** 125,130 **** --- 125,131 ---- #define PW_LOGIN_LAT_PORT 63 /* string */ #define PW_PROMPT 64 /* integer */ + #define PW_NAS_IPV6_ADDRESS 95 /* address */ /* * INTEGER TRANSLATIONS */

2 1

assertions in cvs code from 20080720
by Joe Maimon 10 Aug '08

10 Aug '08

Error: ASSERT FAILED stats.c[318]: request->listener->type == RAD_LISTEN_NONE This one comes from sending a status with a message-authenticator, to a configuration unchanged from 1.0 Mon Jul 28 02:56:32 2008 : Error: ASSERT FAILED threads.c[399]: (*request)->magic == REQUEST_MAGIC This one I dont know quite yet what its from. Its a patched version, available deb binary and source packaged on http://apt-repo.ttec.com/ I am trying to hunt it down over here, but any help would be appreciated. Thanks, Joe

2 2

Bug 398 regressed in V2?
by Garber, Neal 31 Jul '08

31 Jul '08

It appears as though the fix for bug 398 was regressed in v2. Should I submit a new bug with the equivalent update for v2? Thanks..

1 0

GIT Log for 2008-07-30 23:33 GMT
by aland＠deployingradius.com 30 Jul '08

30 Jul '08

1 0

Need help on adding new attributes(Tunnel protocol support)
by ramesh p 28 Jul '08

28 Jul '08

How to configure free radius to support the radius attributes that would contain the information for Client IP Address, Session-ID, Tunnel-ID : Tunnel-Client-Endpoint, Acct-Tunnel-Connection, Tunnel-Assignment-Id. Do i need to change sql.conf file? Please help me in this! Thanks, Ramesh. On 7/24/08, freeradius-devel-request(a)lists.freeradius.org < freeradius-devel-request(a)lists.freeradius.org> wrote: > > Send Freeradius-Devel mailing list submissions to > freeradius-devel(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-devel > or, via email, send a message with subject or body 'help' to > freeradius-devel-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-devel-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Devel digest..." > > > Today's Topics: > > 1. attr_filter and accounting packets (Stefan Winter) > 2. Re: attr_filter and accounting packets (Alan DeKok) > 3. does anyone have a "fast reauth(session resumption)" patch??? > (Cristian Novac) > 4. Does anyone have a "fast reauth(session resumption)" patch > for freeradius server??? (Cristian Novac) > 5. Re: Freeradius-Devel Digest, Vol 39, Issue 18 (ramesh p) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 23 Jul 2008 14:01:58 +0200 > From: Stefan Winter <stefan.winter(a)restena.lu> > Subject: attr_filter and accounting packets > To: freeradius-devel(a)lists.freeradius.org > Message-ID: <48871DB6.4080000(a)restena.lu> > Content-Type: text/plain; charset=ISO-8859-15; format=flowed > > Hello, > > apparently, the behaviour of rlm_attr_filter changed from 1.1.7 to > 2.0.5. In 1.1.7, the pre_proxy function of attr_filter only filtered > authentication requests, the relevant lines in rlm_attr_filter.c being > > if (request->packet->code != PW_AUTHENTICATION_REQUEST) { > return (RLM_MODULE_NOOP); > } > > > That way, it could safely be used in the pre-proxy section to white-list > attributes in authentication requests, but give away the accounting info > unconditionally to a home server. > > In 2.0.5, the preproxy function only executes the "common" filtering > functions: > > static int attr_filter_preproxy(void *instance, REQUEST *request) > { > return attr_filter_common(instance, request, &request->proxy->vps); > } > > which in turn works on auth and acct packets. > > Was this intentional? Then the default attrs.pre-proxy should contain at > least the basic accounting-specific attribute like Acct-Status-Type - > otherwise, the module will by default cripple every accounting request > to uselessness. But actually, my preferred way of resolving this would > be to let accounting packets untouched... > > Greetings, > > Stefan Winter > > -- > Stefan WINTER > Ingenieur de Recherche > Fondation RESTENA - R?seau T?l?informatique de l'Education Nationale et de > la Recherche > 6, rue Richard Coudenhove-Kalergi > L-1359 Luxembourg > > Tel: +352 424409 1 > Fax: +352 422473 > > > > ------------------------------ > > Message: 2 > Date: Wed, 23 Jul 2008 15:02:26 +0200 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: attr_filter and accounting packets > To: FreeRadius developers mailing list > <freeradius-devel(a)lists.freeradius.org> > Message-ID: <48872BE2.3090202(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-15 > > Stefan Winter wrote: > > That way, it could safely be used in the pre-proxy section to white-list > > attributes in authentication requests, but give away the accounting info > > unconditionally to a home server. > > This can still be done: > > pre-proxy { > ... > if (Packet-Type != Accounting-Request) { > attr_filter_preproxy > } > ... > } > > > Was this intentional? > > Yes. The previous behavior made it *impossible* to do filtering on > accounting packets in preproxy. > > > Then the default attrs.pre-proxy should contain at > > least the basic accounting-specific attribute like Acct-Status-Type - > > otherwise, the module will by default cripple every accounting request > > to uselessness. > > That's probably true, too... > > > But actually, my preferred way of resolving this would > > be to let accounting packets untouched... > > Welcome to the power of "unlang". :) > > Alan DeKok. > > > ------------------------------ > > Message: 3 > Date: Wed, 23 Jul 2008 15:59:51 +0300 > From: Cristian Novac <Cristian.Novac(a)alcatel-lucent.ro> > Subject: does anyone have a "fast reauth(session resumption)" patch??? > To: freeradius-devel(a)lists.freeradius.org, > freeradius-users(a)lists.freeradius.org > Message-ID: <48872B47.5010106(a)alcatel-lucent.ro> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Thank you ! > Cristian NOVAC > > > ------------------------------ > > Message: 4 > Date: Wed, 23 Jul 2008 16:45:42 +0300 > From: Cristian Novac <Cristian.Novac(a)alcatel-lucent.ro> > Subject: Does anyone have a "fast reauth(session resumption)" patch > for freeradius server??? > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org>, FreeRadius > developers mailing > list <freeradius-devel(a)lists.freeradius.org> > Message-ID: <48873606.3040705(a)alcatel-lucent.ro> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Thank you!!! > Cristian Novac. > > > ------------------------------ > > Message: 5 > Date: Thu, 24 Jul 2008 13:53:17 +0530 > From: "ramesh p" <rock786143(a)gmail.com> > Subject: Re: Freeradius-Devel Digest, Vol 39, Issue 18 > To: freeradius-devel(a)lists.freeradius.org > Message-ID: > <6b6aa6710807240123gca3dffau3a2993ac572506f6(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > <freeradius-devel(a)lists.freeradius.org>Hi, > > How to configure free radius to support the radius attributes that would > contain the information for Client IP Address, Session-ID, Tunnel-ID : > > Tunnel-Client-Endpoint, > Acct-Tunnel-Connection, > Tunnel-Assignment-Id. > > Do i need to change sql.conf file? > > Please help me in this! > > Thanks, > Ramesh. > > On Wed, Jul 23, 2008 at 3:30 PM, < > freeradius-devel-request(a)lists.freeradius.org> wrote: > > > Send Freeradius-Devel mailing list submissions to > > freeradius-devel(a)lists.freeradius.org > > > > To subscribe or unsubscribe via the World Wide Web, visit > > http://lists.freeradius.org/mailman/listinfo/freeradius-devel > > or, via email, send a message with subject or body 'help' to > > freeradius-devel-request(a)lists.freeradius.org > > > > You can reach the person managing the list at > > freeradius-devel-owner(a)lists.freeradius.org > > > > When replying, please edit your Subject line so it is more specific > > than "Re: Contents of Freeradius-Devel digest..." > > > > > > Today's Topics: > > > > 1. GIT Log for 2008-07-22 23:33 GMT (aland) > > 2. Critical bug in rlm_eap/mem.c (???) > > 3. bug in rlm_eap/mem.c (???) > > 4. Re: bug in rlm_eap/mem.c (Alan DeKok) > > 5. help (ramesh p) > > > > > > ---------------------------------------------------------------------- > > > > Message: 1 > > Date: Wed, 23 Jul 2008 01:33:02 +0200 (CEST) > > From: aland(a)deployingradius.com (aland) > > Subject: GIT Log for 2008-07-22 23:33 GMT > > To: <freeradius-devel(a)lists.freeradius.org> > > Message-ID: <20080722233302.296E31234235(a)liberty.deployingradius.com> > > > > commit df40e592710c1553bfb5873d06f0455b93e6db56 > > Author: Alan T. DeKok <aland(a)freeradius.org> > > Date: Tue Jul 22 21:54:11 2008 +0200 > > > > Fixed typos > > raddb/sql/mysql/schema.sql | 4 ++-- > > 1 files changed, 2 insertions(+), 2 deletions(-) > > > > > > ------------------------------ > > > > Message: 2 > > Date: Wed, 23 Jul 2008 10:57:00 +0900 > > From: ??? <syyang(a)unet.kr> > > Subject: Critical bug in rlm_eap/mem.c > > To: <freeradius-devel(a)lists.freeradius.org> > > Message-ID: <003d01c8ec67$656abde0$304039a0$@kr> > > Content-Type: text/plain; charset="ks_c_5601-1987" > > > > The following is a patch for bug in mem.c > > > > In some condition bug in mem.c leads to a memory leak and crash > > > > > > > > *** mem.c 2008-02-10 04:18:10.000000000 -0500 > > > > --- mem.c.patch 2008-07-19 20:04:35.000000000 -0400 > > > > *************** > > > > *** 390,395 **** > > > > --- 390,396 ---- > > > > handler->next->prev = NULL; > > > > } else { > > > > inst->session_head = NULL; > > > > + inst->session_tail = NULL; > > > > } > > > > eap_handler_free(handler); > > > > } > > > >

1 0

Re: Freeradius-Devel Digest, Vol 39, Issue 18
by ramesh p 24 Jul '08

24 Jul '08

<freeradius-devel(a)lists.freeradius.org>Hi, How to configure free radius to support the radius attributes that would contain the information for Client IP Address, Session-ID, Tunnel-ID : Tunnel-Client-Endpoint, Acct-Tunnel-Connection, Tunnel-Assignment-Id. Do i need to change sql.conf file? Please help me in this! Thanks, Ramesh. On Wed, Jul 23, 2008 at 3:30 PM, < freeradius-devel-request(a)lists.freeradius.org> wrote: > Send Freeradius-Devel mailing list submissions to > freeradius-devel(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-devel > or, via email, send a message with subject or body 'help' to > freeradius-devel-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-devel-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Devel digest..." > > > Today's Topics: > > 1. GIT Log for 2008-07-22 23:33 GMT (aland) > 2. Critical bug in rlm_eap/mem.c (???) > 3. bug in rlm_eap/mem.c (???) > 4. Re: bug in rlm_eap/mem.c (Alan DeKok) > 5. help (ramesh p) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 23 Jul 2008 01:33:02 +0200 (CEST) > From: aland(a)deployingradius.com (aland) > Subject: GIT Log for 2008-07-22 23:33 GMT > To: <freeradius-devel(a)lists.freeradius.org> > Message-ID: <20080722233302.296E31234235(a)liberty.deployingradius.com> > > commit df40e592710c1553bfb5873d06f0455b93e6db56 > Author: Alan T. DeKok <aland(a)freeradius.org> > Date: Tue Jul 22 21:54:11 2008 +0200 > > Fixed typos > raddb/sql/mysql/schema.sql | 4 ++-- > 1 files changed, 2 insertions(+), 2 deletions(-) > > > ------------------------------ > > Message: 2 > Date: Wed, 23 Jul 2008 10:57:00 +0900 > From: ??? <syyang(a)unet.kr> > Subject: Critical bug in rlm_eap/mem.c > To: <freeradius-devel(a)lists.freeradius.org> > Message-ID: <003d01c8ec67$656abde0$304039a0$@kr> > Content-Type: text/plain; charset="ks_c_5601-1987" > > The following is a patch for bug in mem.c > > In some condition bug in mem.c leads to a memory leak and crash > > > > *** mem.c 2008-02-10 04:18:10.000000000 -0500 > > --- mem.c.patch 2008-07-19 20:04:35.000000000 -0400 > > *************** > > *** 390,395 **** > > --- 390,396 ---- > > handler->next->prev = NULL; > > } else { > > inst->session_head = NULL; > > + inst->session_tail = NULL; > > } > > eap_handler_free(handler); > > } > >

1 0

Does anyone have a "fast reauth(session resumption)" patch for freeradius server???
by Cristian Novac 23 Jul '08

23 Jul '08

Thank you!!! Cristian Novac.

1 0

attr_filter and accounting packets
by Stefan Winter 23 Jul '08

23 Jul '08

Hello, apparently, the behaviour of rlm_attr_filter changed from 1.1.7 to 2.0.5. In 1.1.7, the pre_proxy function of attr_filter only filtered authentication requests, the relevant lines in rlm_attr_filter.c being if (request->packet->code != PW_AUTHENTICATION_REQUEST) { return (RLM_MODULE_NOOP); } That way, it could safely be used in the pre-proxy section to white-list attributes in authentication requests, but give away the accounting info unconditionally to a home server. In 2.0.5, the preproxy function only executes the "common" filtering functions: static int attr_filter_preproxy(void *instance, REQUEST *request) { return attr_filter_common(instance, request, &request->proxy->vps); } which in turn works on auth and acct packets. Was this intentional? Then the default attrs.pre-proxy should contain at least the basic accounting-specific attribute like Acct-Status-Type - otherwise, the module will by default cripple every accounting request to uselessness. But actually, my preferred way of resolving this would be to let accounting packets untouched... Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

2 1

does anyone have a "fast reauth(session resumption)" patch???
by Cristian Novac 23 Jul '08

23 Jul '08

Thank you ! Cristian NOVAC

1 0

help
by ramesh p 23 Jul '08

23 Jul '08

Hi, How to configure free radius to support the radius attributes that would contain the information for Client IP Address, Session-ID, Tunnel-ID : Tunnel-Client-Endpoint, Acct-Tunnel-Connection, Tunnel-Assignment-Id. Do i need to change sql.conf file? Please help me in this! Thanks, Ramesh.

1 0

bug in rlm_eap/mem.c
by 양승용 23 Jul '08

23 Jul '08

The following is a patch for bug in mem.c (2.0.5 version) In some condition bug in mem.c leads to a memory leak and crash *** mem.c 2008-02-10 04:18:10.000000000 -0500 --- mem.c.patch 2008-07-19 20:04:35.000000000 -0400 *************** *** 390,395 **** --- 390,396 ---- handler->next->prev = NULL; } else { inst->session_head = NULL; + inst->session_tail = NULL; } eap_handler_free(handler); }

2 1

Critical bug in rlm_eap/mem.c
by 양승용 23 Jul '08

23 Jul '08

The following is a patch for bug in mem.c In some condition bug in mem.c leads to a memory leak and crash *** mem.c 2008-02-10 04:18:10.000000000 -0500 --- mem.c.patch 2008-07-19 20:04:35.000000000 -0400 *************** *** 390,395 **** --- 390,396 ---- handler->next->prev = NULL; } else { inst->session_head = NULL; + inst->session_tail = NULL; } eap_handler_free(handler); }

1 0

GIT Log for 2008-07-22 23:33 GMT
by aland＠deployingradius.com 22 Jul '08

22 Jul '08

commit df40e592710c1553bfb5873d06f0455b93e6db56 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Jul 22 21:54:11 2008 +0200 Fixed typos raddb/sql/mysql/schema.sql | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-)

1 0

Does "watchRegistrationPID" work?
by Patrick 21 Jul '08

21 Jul '08

Hello All, I've read the config file under /etc/slp.conf. Inside it, there is a section ;net.slp.watchRegistrationPID = false I think this is about the openslp watching on the services (or process, i.e. sshd, ftpd) in SA. And if the running services is down, or the pid disappears, SA will know that, and automatically dereg that service out from itself. Am I right? If I'm right. I've traced into the code at ./libslp/Libslp_reg.c in line 255. ****************************************************************************** if(SLPPropertyAsBoolean(SLPGetProperty("net.slp.watchRegistrationPID"))) { extoffset = curpos - buf; ToUINT16(curpos,SLP_EXTENSION_ID_REG_PID); curpos += 2; ToUINT24(curpos,0); curpos += 3; ToUINT32(curpos,SLPPidGet()); curpos += 4; } ****************************************************************************** It seems that slpd will get the pid of something. Normally, it's its own pid, if I didn't miss something. I also added an printf after it, like this, printf("pid is : %d\n",*curpos); But the output is alway 0. I did the same thing before there a little bit, and I can get the service name. But the pid is alway 0. The problem is, 1. Does the OpenSLP implement the PID watching? The SLPPidGet seems only get pid of slpd....... 2. When the service process disappears, if OpenSLP can know that? 3. Do I need to notice OpenSLP the pid of a specific service? How to do....... Or only the name is enough. Thanks a lot for any response! Best Patrick & Sha

1 0

GIT Log for 2008-07-20 23:33 GMT
by aland＠deployingradius.com 20 Jul '08

20 Jul '08

commit 226b5e2d06f908fc08a47cde0966ebea68816d12 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Jul 20 09:49:09 2008 +0200 Document rlm_linelog, and expand it's capabilities Files changed: raddb/modules/linelog | 67 +++++++++++++++++++++++++++++++++ src/modules/rlm_linelog/rlm_linelog.c | 50 ++++++++++++++++++++---- 2 files changed, 108 insertions(+), 9 deletions(-) ====================================================================== commit fcf48f4b8730ce37d11d81c676ab3a6f8b135e8c Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Jul 20 10:16:21 2008 +0200 New SNMP code! Files changed: scripts/snmp-proxy/README | 32 ++ scripts/snmp-proxy/dictionary.hacked | 132 ++++++ scripts/snmp-proxy/freeradius-snmp.pl | 464 ++++++++++++++++++++ .../net-radius-freeradius-dictionary.diff | 81 ++++ 4 files changed, 709 insertions(+), 0 deletions(-) ====================================================================== commit 649f58b6c3faa38421d9504fbb4e69f1160b4cd6 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Jul 20 15:42:34 2008 +0200 Rely on rules in Makefile to build everything Files changed: raddb/certs/bootstrap | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 2f1b9e7e4cc572e2940a65e3967caf120a1d4b1e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Jul 20 15:43:20 2008 +0200 Make CA && Server certs depend on their cnf files Files changed: raddb/certs/Makefile | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) ======================================================================

1 0

GIT Log for 2008-07-18 23:33 GMT
by aland＠deployingradius.com 18 Jul '08

18 Jul '08

1 0

GIT Log for 2008-07-17 23:33 GMT
by aland＠deployingradius.com 18 Jul '08

18 Jul '08

2 1

Re: Freeradius-Devel Digest, Vol 39, Issue 11
by ramesh p 16 Jul '08

16 Jul '08

How to Configure mysql conf file(sql.conf) with radius attributes Tunnel-Client-Endpoint, Tunnel-Assignment-ID and Acct-Tunnel-Connection. Please help me! Thanks, Parsa.

1 0

GIT Log for Sun Jul 13 01:33:01 CEST 2008
by aland＠deployingradius.com 13 Jul '08

13 Jul '08

4 4

How FR accesses the database
by Lidan Hu 12 Jul '08

12 Jul '08

Hello, I'm working on a master project. I need to create new table in database(mysql) via FR. And write some codes for checking some data in the database. So, could you give some clues about where can I find the codes for accessing the database? Thanks a lot for any responses! Best Patrick

3 2

GIT Log for Sat Jul 12 01:33:01 CEST 2008
by aland＠deployingradius.com 11 Jul '08

11 Jul '08

1 0

GIT Log for Fri Jul 11 01:33:01 CEST 2008
by aland＠deployingradius.com 10 Jul '08

10 Jul '08

1 0

GIT Log for Thu Jul 10 12:07:06 CEST 2008
by aland＠deployingradius.com 10 Jul '08

10 Jul '08

commit b9a109c16d6dafda632222516756c1d7c07b3115 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Jul 9 16:36:58 2008 +0200 Use new RDEBUG macro in rlm_eap Files changed: src/modules/rlm_eap/eap.c | 70 +++++++++++++++++++++-------------------- src/modules/rlm_eap/mem.c | 4 +- src/modules/rlm_eap/rlm_eap.c | 28 ++++++++-------- 3 files changed, 52 insertions(+), 50 deletions(-) ====================================================================== commit e304cc46dc3f6f67c0926aa784c88931f6b5b065 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Jul 9 18:02:04 2008 +0200 Fake requests inherit debugging from their parent Files changed: src/main/util.c | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) ====================================================================== commit 650547652574ef5afb45c6f464ce72e113ab4a08 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Jul 9 18:02:26 2008 +0200 Fix compiler warnings and potential crash Files changed: src/main/listen.c | 26 +++++++++++++------------- 1 files changed, 13 insertions(+), 13 deletions(-) ====================================================================== commit 8d89e4ce7aa5c735e95b19ecbb1d67904d960638 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Jul 9 18:02:57 2008 +0200 Lots of .gitignore files Files changed: .gitignore | 18 ++++++++++++++++++ raddb/.gitignore | 3 +++ raddb/certs/.gitignore | 11 +++++++++++ scripts/.gitignore | 6 ++++++ src/.gitignore | 1 + src/main/.gitignore | 8 ++++++++ src/modules/rlm_acctlog/.gitignore | 1 + src/modules/rlm_attr_rewrite/.gitignore | 1 + src/modules/rlm_checkval/.gitignore | 1 + src/modules/rlm_counter/.gitignore | 2 ++ src/modules/rlm_dbm/.gitignore | 3 +++ src/modules/rlm_eap/.gitignore | 2 ++ src/modules/rlm_eap/types/rlm_eap_ikev2/.gitignore | 1 + src/modules/rlm_eap/types/rlm_eap_peap/.gitignore | 2 ++ src/modules/rlm_eap/types/rlm_eap_tls/.gitignore | 2 ++ src/modules/rlm_eap/types/rlm_eap_tnc/.gitignore | 1 + src/modules/rlm_eap/types/rlm_eap_ttls/.gitignore | 2 ++ src/modules/rlm_ippool/.gitignore | 3 +++ src/modules/rlm_krb5/.gitignore | 1 + src/modules/rlm_ldap/.gitignore | 1 + src/modules/rlm_mschap/.gitignore | 1 + src/modules/rlm_otp/.gitignore | 1 + src/modules/rlm_pam/.gitignore | 2 ++ src/modules/rlm_perl/.gitignore | 2 ++ src/modules/rlm_python/.gitignore | 1 + src/modules/rlm_radutmp/.gitignore | 2 ++ src/modules/rlm_sql/.gitignore | 1 + src/modules/rlm_sql/drivers/.gitignore | 1 + src/modules/rlm_sql/drivers/lib/.gitignore | 1 + .../rlm_sql/drivers/rlm_sql_iodbc/.gitignore | 1 + .../rlm_sql/drivers/rlm_sql_mysql/.gitignore | 2 ++ .../rlm_sql/drivers/rlm_sql_oracle/.gitignore | 1 + .../rlm_sql/drivers/rlm_sql_postgresql/.gitignore | 1 + .../rlm_sql/drivers/rlm_sql_unixodbc/.gitignore | 1 + src/modules/rlm_sqlcounter/.gitignore | 1 + src/modules/rlm_sqlippool/.gitignore | 1 + src/modules/rlm_unix/.gitignore | 2 ++ 37 files changed, 92 insertions(+), 0 deletions(-) ====================================================================== commit a9ec3bc8c8cf36ef2a4ea58ec0ffa411b61977c3 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Jul 9 18:03:30 2008 +0200 Turn on developer flags if .git exists, too Files changed: configure.in | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) ====================================================================== commit de9cdae3da67a1abbeb6f0b3ca831b294be071fa Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Jul 9 18:04:23 2008 +0200 Set request->module to EAP type for clarity Files changed: src/modules/rlm_eap/eap.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) ====================================================================== commit 35a65b7fc4aa1809a26d981f481450ecdb510b32 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Jul 9 18:05:00 2008 +0200 Use new RDEBUG macro Files changed: src/modules/rlm_eap/libeap/cb.c | 12 +++++-- src/modules/rlm_eap/libeap/eap_tls.c | 7 ++-- src/modules/rlm_eap/libeap/tls.c | 12 ++++++- .../rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c | 34 +++++++++++--------- 4 files changed, 42 insertions(+), 23 deletions(-) ======================================================================

2 1

How to add new elements in database (fa-2.0.5)
by Lidan Hu 09 Jul '08

09 Jul '08

Hello, I'm working on a master thesis in KTH in Sweden. In normal way, the radius server will receive the EAP package, and check the user name and password. If it's authenticated, and return something, such as a 1 to open service, or 0 to reject request. My task is, create two elements in database (we use mysql in opensuse). One is max bandwidth, other one is current bandwidth (or request bandwidth). And we add one data, request bandwidth, in EAP package. And in the programme, we gonna do, 1, receive EAP, and get request bandwidth. 2, compare it with max bandwidth, if large, then goto 4. 3, return this request bandwidth. then goto 5. 4, return some error. 5, finish, and loop to 1 And for the max bandwidth in the database, we need to create it at the first time when the program runs. Do you have any suggestion for me about which files I should focus on? Thanks a lot! BR Patrick

2 1

Version 2 - lowercase in MySQL schema.sql
by Dirk van der Walt 07 Jul '08

07 Jul '08

Hi List, I'm the author of Hotcakes Hotspot Manager. It is a LAMP application which includes the MySQL tables used with FreeRADIUS. In version 2.0.5 the schema tables in 'etc/raddb/sql/mysql/schema.sql' all has lower-case names for the columns. Was this a conscious decision, and will it remain like this in future versions? If so I'd like to correct my program so it reflects this new convention. Many thanks

2 1