November 2009 - Freeradius-Devel - lists.freeradius.org

Missing TLS Change Cipher Spec and TLS Finished in EAP-TLS exchanges
by arno＠natisbad.org 09 Jul '11

09 Jul '11

Hi, I upgraded an internal freeradius server (Linux, Debian unstable, libssl 0.9.8) used for EAP-TLS (802.11 WPA2 access) from 2.0.5 to 2.1.3. With 2.1.3, client authentication fails in the following way (wpasupplicant on Debian unstable, working with 2.0.5): - the TLS exchange is completed from freeradius point of view. It even sends the Access-Accept message to the NAS. - from the clients point of view, the TLS exchange is not over, it expects some more data from the server which are never sent. I took two pcap traces (sent to you privately, Alan), one with 2.0.5, one with 2.1.3. It looks like the TLS Change Cipher and TLS Tinished elements of the TLS exchange are not in the EAP encapsulated TLS packets sent by the server. Compare packet #23 of 2.1.3 trace with packet #27 of 2.0.5 trace. If you use wireshark, you will notice that the SSL layer is dissected; this is because #27 has a small brother: #29. It is not sent by 2.1.3. Alan, if you have an idea or a patch, I can test it on monday. Cheers, a+

5 15

eap2 in freeradius
by Chanthearith HUON 04 Apr '11

04 Apr '11

Hi everyone, I am testing eap2 in freeradius. I run "radiusd -X", I got following error message " radiusd: symbol lookup error: /usr/lib/rlm_eap2-2.1.0.so: undefined symbol: eap_server_register_methods " Anyone, have any idea what might be wrong with the configuration? Thank in advance, Thierry

5 10

make_passwd(), rlm_perl and double quotes in the password
by Niko Tyni 28 Jan '10

28 Jan '10

Hi, we're seeing failed logins when proxying authentication requests through to another RADIUS server if the password contains a double quote ("). I've debugged the issue a bit, and what happens is that when the password does a roundtrip through the rlm_perl module, the value pair structure ends up with extra bytes at the end so that strlen(vp->data.strvalue) > vp->length. These extra bytes are the result of escaping the double quote before entering the Perl code and then unescaping it afterwards. For instance, the password abcdef" is passed as abcdef\" to the Perl code, and afterwards it becomes abcdef"" with length 7 (so the extra byte is not supposed to hurt AIUI.) Unfortunately make_passwd() rounds 'inlen' up to a multiple of 16 before copying the input string, so the extra bytes end up in the message authenticator of the proxied request. It seems to me that the escaping and unescaping done in rlm_perl via perl_store_vps() -> vp_prints_value() -> librad_safeprint() and get_hv_content() -> pairadd_sv() -> pairmake() -> pairparsevalue() is a bit unnecessary, and that the unescaping could zero out the extra bytes, but the main bug is in make_passwd() IMO. I have reproduced this with a Debian 2.0.4 freeradius package, a Fedora 2.1.3 package, and a current git.freeradius.org checkout (commit ef2a7db5e). I'm attaching a proposed patch to make_passwd(). Please let me know if you need more information, I can easily produce stack traces and the like. Thanks for your work on FreeRADIUS, -- Niko Tyni ntyni(a)cc.helsinki.fi

3 5

Re: vmps request: long attribute VQP-Ethernet-Frame
by Hermann Lauer 05 Jan '10

05 Jan '10

Alan DeKok wrote: > > 0x0c05 is VQP-Ethernet-Frame, which can of course be longer than 253 bytes, > > so there is a design issue here. One idea would be to cut the attribute to > > 253 bytes in vqp_recv(). Could this be done there without memory issues ? > > Yes, if you're not interested in the rest of the data. appended is a patch which implemeted the cutting. Seems to work. Please tell me if anybody sees any pitfall in it. Otherwise it should be cleaned up, which I probably will do in a week or so. Thanks, Hermann -- Netzwerkadministration/Zentrale Dienste, Interdiziplinaeres Zentrum fuer wissenschaftliches Rechnen der Universitaet Heidelberg IWR; INF 368; 69120 Heidelberg; Tel: (06221)54-8236 Fax: -5224 Email: Hermann.Lauer(a)iwr.uni-heidelberg.de

2 5

PATCH: allow detail listeners to write to other files
by John Morrissey 06 Dec '09

06 Dec '09

I noticed[1] that detail listeners refuse to write detail entries to files, even if the destination filename is different from the source filename. The attached patch fixes that. It also centralizes the listen_detail_t definition, removing the 'stub' definition in src/main/event.c. john [1] https://lists.freeradius.org/pipermail/freeradius-users/2009-October/msg001… -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

2 6

Setting Client-IP-Address in rlm_preprocess
by John Morrissey 04 Dec '09

04 Dec '09

Client-IP-Address is dynamically set by xlat_packet(). AFAICT, there's no way to trigger this in rlm_perl, so Client-IP-Address is never available in rlm_perl handlers. This leads to some interesting unlang to set Client-IP-Address in the request so rlm_perl can access it: authorize { update request { Client-IP-Address := "%{Client-IP-Address}" } } rlm_preprocess sets NAS-IP-Address if it's not set. Alan, would you accept a patch to add similar behavior for Client-IP-Address? john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

3 7

[PATCH] Fix phat fingering in rlm_ldap.c
by Alexander Clouter 30 Nov '09

30 Nov '09

Fix phat fingering in 3d63215138cbe66dc5e656fec00e836a3b0e3262 that prevented src/modules/rlm_ldap/rlm_ldap.c from compiling. Signed-off-by: Alexander Clouter <alex(a)digriz.org.uk> --- src/modules/rlm_ldap/rlm_ldap.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/modules/rlm_ldap/rlm_ldap.c b/src/modules/rlm_ldap/rlm_ldap.c index fa1416f..e7cd600 100644 --- a/src/modules/rlm_ldap/rlm_ldap.c +++ b/src/modules/rlm_ldap/rlm_ldap.c @@ -2322,9 +2322,9 @@ static LDAP *ldap_connect(void *instance, const char *dn, const char *password, if (ldap_int_tls_config(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, (inst->tls_require_cert)) != LDAP_OPT_SUCCESS) { ldap_get_option(ld, LDAP_OPT_ERROR_NUMBER, &ldap_errno); - radlog(L_ERR, " [%s] could not set ", inst->xlat_name + radlog(L_ERR, " [%s] could not set " "LDAP_OPT_X_TLS_REQUIRE_CERT option to %s: %s", - inst->tls_require_cert, + inst->xlat_name, inst->tls_require_cert, ldap_err2string(ldap_errno)); } #endif -- 1.5.6.5

2 1

GIT Log for 2009-11-30 00:33 GMT
by aland＠deployingradius.com 30 Nov '09

30 Nov '09

commit 139c45b4c51c945414b53ece36bbeb42edb1b2a7 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Nov 29 16:07:23 2009 +0100 Clean up state machine. This error happens when "max_request_time" is set VERY low. i.e. lower than "response_window". (12s versus 30s). The current logic for enforcing the various timers is pretty bad. There is one timer per request, and it bounces around between the different requirements. At the time it was written, it seemed simpler than trying to manage 3-4 simultaneous timers per request. When the request is proxied, the timer being applied is for "response_window". BUT by the time that expires, the "max_request_time" has expired. The code *does* notice that it has expired. BUT it doesn't notice that there's no child thread processing the request. So it waits for the child thread to exit... forever. At some point, a timer overflows, and it dies. There are a few changes to make: 1) check for "no child" in this situation, and clean up the request rather than waiting forever. 2) cap the timer to 5 minutes (this can still happen, for example, when a bad DB locks a thread for hours at a time). 3) don't overflow when adding timer values. src/main/event.c | 64 ++++++++++++++++++++++++----------------------------- 1 files changed, 29 insertions(+), 35 deletions(-)

1 0

GIT Log for 2009-11-28 00:33 GMT
by aland＠deployingradius.com 28 Nov '09

28 Nov '09

commit 7074e78ce2be752ed5e1cf6d6bf803851b9f6170 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Nov 27 15:58:58 2009 +0100 L_INFO, "PROXY:... --> L_PROXY, "... Simplifies and regularizes the log messages Files changed: src/main/event.c | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) ====================================================================== commit d9c1a2535a0226d07d19b3489b51b548b73b8121 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Nov 27 13:01:06 2009 +0100 Fix typo Files changed: raddb/proxy.conf | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 657d34ff7449d1a81bf72e4301d8a482019708eb Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Nov 27 12:07:25 2009 +0100 Initialize timers for Status-Server For some weird reason they weren't initialized in debugging mode, so we force it here. This WAS tested to work... so I have no idea why it stopped. We also ignore Status-Server packets when marking home_servers as alive. That way, the ping_check will work properly... Files changed: src/main/event.c | 6 +++++- 1 files changed, 5 insertions(+), 1 deletions(-) ====================================================================== commit aa458464b16c1f3d96b863e6bfacaf96fded7d23 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Nov 27 11:53:29 2009 +0100 Use new home_server_find API Files changed: src/main/event.c | 2 +- src/main/stats.c | 2 +- src/modules/frs_status/frs_status.c | 3 ++- 3 files changed, 4 insertions(+), 3 deletions(-) ====================================================================== commit 943007dc6f3fed810a3f0b06eb23a09a3d54f9c4 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Nov 27 11:47:56 2009 +0100 Add tcp/udp to CLI for home_servers Files changed: src/include/realms.h | 2 +- src/main/realms.c | 8 ++++- src/modules/frs_control/frs_control.c | 61 +++++++++++++++++++++++--------- 3 files changed, 52 insertions(+), 19 deletions(-) ======================================================================

1 0

GIT Log for 2009-11-27 00:33 GMT
by aland＠deployingradius.com 27 Nov '09

27 Nov '09

commit 208ec58bcf9f2e7969d26275bcdc6e3d366ff2ca Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Nov 26 19:10:44 2009 +0100 Remove erroneous handling of option 82 Files changed: src/modules/frs_dhcp/dhcp.c | 6 ------ 1 files changed, 0 insertions(+), 6 deletions(-) ====================================================================== commit f2323bf8826454b0fb1b433efa2353c21074b6c4 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Nov 26 18:16:00 2009 +0100 Change some DEBUG to radlog So that interesting state changes / internal events will get logged Files changed: src/main/event.c | 16 ++++++++-------- 1 files changed, 8 insertions(+), 8 deletions(-) ====================================================================== commit 103d7fb2e4c381421b22abea934776538937ccdc Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Nov 26 14:24:30 2009 +0100 Log more messages, rather than just doing debug with them Files changed: src/main/event.c | 13 +++++++------ 1 files changed, 7 insertions(+), 6 deletions(-) ======================================================================

1 0

FreeRadius + EAP-AKA support
by Kumar, Sunil 26 Nov '09

26 Nov '09

Hi, We are trying to use FreeRadius1.1.4 as authentication server for EAP-AKA implementation with our product toolkit. As per the RFC 4187 AT_RES The value field of this attribute begins with the 2-byte RES Length, which identifies the exact length of the RES in bits. The RES length is followed by the AKA RES parameter. According to [TS33.105], the length of the AKA RES can vary between 32 and 128 bits. Because the length of the AT_RES attribute must be a multiple of 4 bytes, the sender pads the RES with zero bits where necessary. In the freeradius1.1.4 implementation, for EAP-AKA the value of RES length is always considered as constant EAPSIM_RES_SIZE (16). It doesn't take care of the values other than 16 bytes. We in our toolkit needs to support all the variable length of RES values from 32 bits (4 bytes) to 128 bits (16 bytes). So I have modified the FreeRadius implementation for the same support. The intention of writing such mail is to get the information that if somebody has already noticed and fixed this issue in the latest releases, so please share that information as well. In case it's not been fixed as yet, then may be I could contribute my patch for freeradius 1.1.4 version to support all variable length RES value varying from 32 bits to 128 bits. Thanks. Warm regards. Sunil Kumar The information contained in this electronic mail transmission may be privileged and confidential, and therefore, protected from disclosure. If you have received this communication in error, please notify us immediately by replying to this message and deleting it from your computer without copying or disclosing it.

4 5

GIT Log for 2009-11-23 00:33 GMT
by aland＠deployingradius.com 23 Nov '09

23 Nov '09

commit 9eec5347f5a20ce3e726f2eb67194987cc4e7420 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Nov 22 16:56:14 2009 +0100 Print names for unsupported eap types Files changed: src/modules/rlm_eap/eap.c | 12 ++++++++++-- 1 files changed, 10 insertions(+), 2 deletions(-) ====================================================================== commit 208edab2d078a46d9fe21c3e37072375b364d24c Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Nov 22 16:47:29 2009 +0100 More warnings Modifying the values of a virtual attribute is a bad idea. Files changed: src/main/evaluate.c | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) ====================================================================== commit 10437eefa5c77bef81ee1db043d498d2bc2c2887 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Nov 22 16:35:20 2009 +0100 Check for NULL Files changed: src/modules/rlm_expr/paircmp.c | 6 +++++- 1 files changed, 5 insertions(+), 1 deletions(-) ====================================================================== commit 58f959b0e33c91a16163df0b4a0a1b1776ff8595 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Nov 22 09:26:51 2009 +0100 Fixed typo Files changed: man/man8/raddebug.8 | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 84f8a34bef9830fcf23b975605f00b98668c56bc Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Nov 22 09:18:16 2009 +0100 As posted to the list Files changed: src/modules/rlm_jradius/rlm_jradius.c | 16 ++++++++++++++++ 1 files changed, 16 insertions(+), 0 deletions(-) ====================================================================== commit 95b21f458d12a29b0f7c4e6c1ad24e4d96ca9358 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Nov 22 09:16:22 2009 +0100 Move definition so that it doesn't cause issues Use the RFC definitions for the name Files changed: share/dictionary.ascend | 1 - share/dictionary.compat | 1 + 2 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit a021a0c6df2c9a8f80138983cab53278429f6508 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Nov 22 09:12:15 2009 +0100 Revert "errormsg may be NULL" This reverts commit 45877bf44b02d418b6fb263a39e5de07ced58b6e. It doesn't fix the problem, and it seems to cause issues for other people Files changed: .../drivers/rlm_sql_postgresql/sql_postgresql.c | 3 --- 1 files changed, 0 insertions(+), 3 deletions(-) ======================================================================

1 0

segfault in presufcmp()
by Jakob Hirsch 22 Nov '09

22 Nov '09

Hi, comparing Suffix or Prefix without it being set lets the server crash (see backtrace below). This is easily reproducable with this: authorize { # also happens with Prefix if (Suffix == "blub") { } ... This happens on x86 and x64, with 2.1.7 as well as git stable. I guess there should be a check somewhere, maybe for req==NULL in presufcmp(), but I'm not sure. The obvious work around is setting these attributes (with update request) to empty strings or checking them like "if (Prefix && Prefix == ...)". Besides that, I'm surprised that there is special handling for Prefix and Suffix. I thought they are just some attributes I can use as I wish. I parse User-Name with a regex and set them accordingly with %{1} etc. > rad_recv: Access-Request packet from host 127.0.0.1 port 54511, id=178, length=67 > User-Name = "does_not_matter" > User-Password = "b" > NAS-IP-Address = 172.17.13.190 > NAS-Port = 1 > +- entering group authorize {...} > ++? if (Suffix == "blub") > > Program received signal SIGSEGV, Segmentation fault. > 0x00000035b3c7f541 in strlen () from /lib64/libc.so.6 > (gdb) bt > #0 0x00000035b3c7f541 in strlen () from /lib64/libc.so.6 > #1 0x00007ffff750b790 in presufcmp (instance=0x0, req=0x7e5a10, request=0x0, check=0x7e6120, check_pairs=0x0, reply_pairs=0x0) at paircmp.c:134 > #2 0x00000000004273a3 in radius_callback_compare (req=0x7e5a10, request=0x0, check=0x7e6120, check_pairs=0x0, reply_pairs=0x0) at valuepair.c:270 > #3 0x0000000000438260 in radius_do_cmp (request=0x7e5a10, presult=0x7fffffffc280, lt=T_BARE_WORD, pleft=0x7fffffffbe70 "Suffix", token=T_OP_CMP_EQ, rt=T_DOUBLE_QUOTED_STRING, > pright=0x7fffffffba70 "blub", cflags=0, modreturn=6) at evaluate.c:360 > #4 0x0000000000439385 in radius_evaluate_condition (request=0x7e5a10, modreturn=6, depth=1, ptr=0x7fffffffc330, evaluate_it=1, presult=0x7fffffffd360) at evaluate.c:833 > #5 0x0000000000438c61 in radius_evaluate_condition (request=0x7e5a10, modreturn=6, depth=0, ptr=0x7fffffffd810, evaluate_it=1, presult=0x7fffffffd81c) at evaluate.c:614 > #6 0x000000000041eb9d in modcall (component=1, c=0x780500, request=0x7e5a10) at modcall.c:432 > #7 0x000000000041cb89 in indexed_modcall (comp=1, idx=0, request=0x7e5a10) at modules.c:691 > #8 0x000000000041e035 in module_authorize (autz_type=0, request=0x7e5a10) at modules.c:1453 > #9 0x0000000000409421 in rad_authenticate (request=0x7e5a10) at auth.c:565 > #10 0x000000000043327e in radius_handle_request (request=0x7e5a10, fun=0x409226 <rad_authenticate>) at event.c:3693 > #11 0x00000000004258e1 in thread_pool_addrequest (request=0x7e5a10, fun=0x409226 <rad_authenticate>) at threads.c:841 > #12 0x0000000000432850 in event_socket_handler (xel=0x7df710, fd=22, ctx=0x7e57c0) at event.c:3317 > #13 0x00007ffff7df36d3 in fr_event_loop (el=0x7df710) at event.c:400 > #14 0x0000000000433189 in radius_event_process () at event.c:3679 > #15 0x00000000004223e9 in main (argc=2, argv=0x7fffffffe588) at radiusd.c:398 Regards Jakob

2 1

rlm_jradius wimax support patch
by wlanmac 22 Nov '09

22 Nov '09

Hello, Please find the attached patch (given to us by a contributor) that adds a bit of WiMAX support to the rlm_jradius module. Cheers, David

2 1

GIT Log for 2009-11-19 00:33 GMT
by aland＠deployingradius.com 19 Nov '09

19 Nov '09

commit a809dea0195e11fb924b6651c29aa2546708d83a Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Nov 18 18:34:17 2009 +0100 As posted to the list share/dictionary.juniper | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-)

1 0

EAP proxing with client-balance
by Alexander Clouter 18 Nov '09

18 Nov '09

Hi, Being part of the 'eduroam' clan we have a lot of EAP traffic proxying about the place, even more so being part of the 'University Triangle' in London so those peskey students and staff mooch where ever they can. My setup is generally: ---- home_server_pool eduroam { #type = fail-over <-- works #type = client-balance <-- grumbles #type = client-port-balance <-- grumbles type = keyed-balance <-- grumbles home_server = jrs.0 home_server = jrs.1 home_server = jrs.2 } ---- The proxy topology in eduroam (incase you do not know) is: [us x 2] ---------- [ .ja.net proxies x 3 ] ---------- [them x 2] <ramble> I used 'keyed-balance' as 'client-balance'/'client-port-balance' load balance terribly when your NAS's use the same source port and most of our traffic comes from the same IP (the single infernal WLC 4400 we have). This however is not important, as I only started to use 'keyed-balance' about an hour ago. I noticed after the summer FreeRADIUS overhaul I am finishing off that a number of proxied requests to particular realms failed for no reason. Speaking to my counterparts at the other universities they could see nothing wrong in their *FreeRADIUS* installations. Because I have a general knowledge of whats going on in the nearby universities I know there are some filthy MS IAS installations about and pretty quickly noticed queries to these places were working fine whilst request to my FreeRADIUS buddies did not. </ramble> Looking closer at the detail logs I saw that mid-EAP conversation the packets started to get proxied to different national proxies which resulted (expectedly) with a Access-Reject; also explaining why my counterparts never saw an inner authentication. Looks like MS IAS does not really care where the proxied packets come from, it only key's on Proxy-State (I'm guessing here); FreeRADIUS being a lot more picky...which is just what I like :) With this in mind I moved to 'fail-over' and everything started working. Alas I cannot leave it on 'fail-over' otherwise Alan Buxey gets grumbly. <ramble> I figured out how to enable super verbosity to get at those RDEBUG3's in realms.c:home_server_ldb() and saw (when using anything other than 'fail-over'): ---- [first packet] PROXY jrs 2.0 jrs 0.0 PROXY jrs 2.0 jrs 1.0 [a latter EAP packet had something like] PROXY jrs 2.0 jrs 0.0 PROXY jrs 1.0 jrs 0.0 ---- I think this was a red herring for me, but it got me to look more closer at the realms.c code. </ramble> The conclusion, we should not be paying any attention to 'currently_outstanding' or 'fr_rand()' when there is EAP traffic; I decided to add the clause !HOME_POOL_LOAD_BALANCE; things now work. What do you think of the following patch, I think there is sound reasoning behind it, however of course I am just a network monkey? Cheers -- Alexander Clouter .sigmonster says: There is no grief which time does not lessen and soften. diff --git a/src/main/realms.c b/src/main/realms.c index a0cb796..71640d0 100644 --- a/src/main/realms.c +++ b/src/main/realms.c @@ -1938,8 +1938,12 @@ home_server *home_server_ldb(const char *realmname, /* * We've found the first "live" one. Use that. + * The !HOME_POOL_LOAD_BALANCE clause is for the EAP + * case when we want to do CLIENT/KEY based balancing + * and avoid inconsistent proxying */ - if (pool->type == HOME_POOL_FAIL_OVER) { + if (pool->type == HOME_POOL_FAIL_OVER + || pool->type != HOME_POOL_LOAD_BALANCE) { found = home; break; }

4 14

GIT Log for 2009-11-18 00:33 GMT
by aland＠deployingradius.com 18 Nov '09

18 Nov '09

commit 60cd814a9a14d38eb4ee36dc86db563fc71fb7da Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Nov 17 11:19:17 2009 +0100 Move user/group/chroot/core to bootstrap config It adds some extra stuff when starting in debug mode as root, but it also means that "allow_core_dumps" works again. src/main/mainconfig.c | 30 +++++++++++++++++------------- 1 files changed, 17 insertions(+), 13 deletions(-)

1 0

GIT Log for 2009-11-15 00:33 GMT
by aland＠deployingradius.com 15 Nov '09

15 Nov '09

commit 2cface50032b72b1bf57b23b1893c72a731b39e9 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Nov 14 10:29:40 2009 +0100 Make templates work again src/main/conffile.c | 11 +++++++++-- 1 files changed, 9 insertions(+), 2 deletions(-)

1 0

GIT Log for 2009-11-14 00:33 GMT
by aland＠deployingradius.com 14 Nov '09

14 Nov '09

commit 65ef5bbc7c68a10a1050a27577fe7ae127ad8d14 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Nov 13 14:15:51 2009 +0100 Allow !* to work The code to delete all attributes (as documented in unlang) was previously added in evaluate.c. But the parser hadn't been updated, so it was impossible to actually use that functionality. src/main/conffile.c | 1 + src/main/evaluate.c | 3 +-- src/main/modcall.c | 1 + 3 files changed, 3 insertions(+), 2 deletions(-)

1 0

GIT Log for 2009-11-13 00:33 GMT
by aland＠deployingradius.com 13 Nov '09

13 Nov '09

commit bdb12579578217cf978c8f95d966932e4e3051bd Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Nov 12 16:19:25 2009 +0100 Print commands from radmin when in debug mode Files changed: src/modules/frs_control/frs_control.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) ====================================================================== commit ed993033d2f3c0efbe927161cc22b0518ccfd05e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Nov 12 12:25:03 2009 +0100 Fix WiMAX encoding bug introduced in 326a68b90a1a Files changed: src/lib/radius.c | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-) ====================================================================== commit 13c45d5fedc25fe45e74a92a1fd6603b00f36796 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Nov 6 08:16:42 2009 -0500 As posted to the list Files changed: share/dictionary.alcatel.sr | 62 +++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 62 insertions(+), 0 deletions(-) ====================================================================== commit 48f0232ec399bbd39ce66adb5957d944440d9210 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Nov 3 16:40:03 2009 -0500 From bug #45 Files changed: share/dictionary.acme | 227 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 227 insertions(+), 0 deletions(-) ======================================================================

1 0

Fw:Re: RE: FreeRadius + EAP-AKA support
by xiningtom_1986 07 Nov '09

07 Nov '09

Hi?Kumar, ????Would?you?please?also?send?me?a?copy?of?the?patch???Thank?you?very?much. xiningtom_1986(a)gmail.com Hi?Kumar, ????Would?you?please?also?send?me?a?copy?of?the?patch???Thank?you?very?much. cht.maillist(a)gmail.com BillGets 2009.11.06 --?Kumar,?Sunil?wrote?:? Hi?Alan Please?find?the?attached?patch?to?fix?the?variable?length?issue?for AT_RES?with?EAP-AKA?support. I?have?created?this?patch?on?top?of?FreeRadius?1.1.4?release?version. Please?provide?your?valuable?comments?or?feedback?for?the?same. Thanks. Warm?regards. Sunil?Kumar >?-----Original?Message----- >?From:?Alan?DeKok?[mailto:aland@depl...] >?Sent:?Thursday,?February?26,?2009?1:53?PM >?To:?FreeRadius?developers?mailing?list >?Cc:?Kumar,?Sunil >?Subject:?Re:?FreeRadius?+?EAP-AKA?support >? >?Kumar,?Sunil?wrote: >?>?We?are?trying?to?use?FreeRadius1.1.4?as?authentication?server?for >?>?EAP-AKA?implementation?with?our?product?toolkit. >? >???Hm...?if?you've?applied?the?EAP-AKA?patch,?could?you?send?a?copy?to >?me???bugs.freeradius.org?has?gone?down,?and?I'm?not?sure?I?have?a?copy >?of?the?patch?anywhere. >? >?>?We?in?our?toolkit?needs?to?support?all?the?variable?length?of?RES values >?>?from?32?bits?(4?bytes)?to?128?bits?(16?bytes).?So?I?have?modified the >?>?FreeRadius?implementation?for?the?same?support. >? >???Nice.??Please?send?us?the?patch! >? >?>?The?intention?of?writing?such?mail?is?to?get?the?information?that?if >?>?somebody?has?already?noticed?and?fixed?this?issue?in?the?latest >?>?releases,?so?please?share?that?information?as?well. >? >???No?one?else?has?seen?this?issue. >? >?>?In?case?it's?not?been?fixed?as?yet,?then?may?be?I?could?contribute my >?>?patch?for?freeradius?1.1.4?version?to?support?all?variable?length RES >?>?value?varying?from?32?bits?to?128?bits. >? >???Please?send?the?patch?for?EAP-AKA!??Or?even?the?entire?rlm_eap >?directory?that?you're?using,?and?we'll?work?out?the?patch. >? >???Alan?DeKok. The?information?contained?in?this?electronic?mail?transmission? may?be?privileged?and?confidential,?and?therefore,?protected? from?disclosure.?If?you?have?received?this?communication?in? error,?please?notify?us?immediately?by?replying?to?this? message?and?deleting?it?from?your?computer?without?copying? or?disclosing?it. -- This?message?was?sent?on?behalf?of?cht.maillist(a)gmail.com?at?openSubscriber.com http://www.opensubscriber.com/message/freeradius-devel@lists.freeradius.org… - List?info/subscribe/unsubscribe??See?http://www.freeradius.org/list/devel.h…

1 0

Freeradius and Sync ppp connection
by Daniele Ferrara 04 Nov '09

04 Nov '09

Hi all I have two server freeradius and PPPoe Server. My problem is when restart server freeradius not sysnc with pppoe server. how to resolve this problem? Daniele

3 4