February 2009 - Freeradius-Devel - lists.freeradius.org

Missing line in mssql-schema
by Sebastian Heil 19 Feb '09

19 Feb '09

Hello everybody, in the mssql-database-schema, there is one line missing. For the table radacct, in the section "ALTER TABLE [radacct] WITH NOCHECK ADD", there is no information for the column groupname. So, if the accounting packet has no information about the groupname, the insert/update-statement will fail. The following line in the schema.sql should fix this: ALTER TABLE [radacct] WITH NOCHECK ADD ........ CONSTRAINT [DF_radacct_GroupName] DEFAULT ('') FOR [GroupName], ........ Maybe someone can verify this, and add this to the current development-tree? Thanks. -- Jetzt 1 Monat kostenlos! GMX FreeDSL - Telefonanschluss + DSL für nur 17,95 Euro/mtl.!* http://dsl.gmx.de/?ac=OM.AD.PD003K11308T4569a

2 1

FreeRADIUS+unixODBC+BerkeleyDB
by Sourav Chakraborty 19 Feb '09

19 Feb '09

Hi, We want to use FreeRadius alongwith Oracle Berkeley DB as the backend DB.We have installed FreeRADIUS 1.1.3 and BerkeleyDB.We also have installed unixODBC-2.2.12.Please let us know how to configure FreeRADIUS with unixODBC and connect FreeRADIUS <-->unixODBC<-->BerkeleyDB. Thanks in advance for your help Regards Sourav

3 7

GIT Log for 2009-02-19 00:33 GMT
by aland＠deployingradius.com 18 Feb '09

18 Feb '09

commit bef107d13c9366cd5d0d288d0fe581be846861b3 Author: Chris Moules <chris(a)gms.lu> Date: Wed Feb 18 12:48:52 2009 +0000 Patch so that the "allocate-find" ippool lookup will match "expiry_time" when is NULL. This is its default state, so unless otherwise set, you will never get a IP from the pool. Files changed: raddb/sql/mysql/ippool.conf | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit b6453f333f6b86b7feb69d207e07d04f9c579404 Author: Chris Moules <chris(a)gms.lu> Date: Wed Feb 18 12:44:38 2009 +0000 Fix typo in MySQL ippool.conf and revert change from privous patch that modified one too many statements with "IS NULL" => "= NULL". One of these was in a WHERE clause where the "IS NULL" syntax is correct and needed. Files changed: raddb/sql/mysql/ippool.conf | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) ======================================================================

1 0

Previous MySQL fix only half correct - Corrected MySQL syntax to = NULL
by Chris Moules 18 Feb '09

18 Feb '09

Sorry for not supplying decent patch files, I don't have time right now. Chris Looks like the follow commit fixed some issues but broke other: commit 243983349ba6d831da15677c46ff1f07fe977d68 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Jan 28 14:59:42 2009 +0100 Corrected MySQL syntax to = NULL -- This patch seems to have blindly turned any instance of "IS NULL" into a "= NULL". This is wrong. The "IS NULL" syntax is correct for anything after the "WHERE" statement. You MUST use this syntax for checking for the NULL value. See http://dev.mysql.com/doc/refman/5.0/en/working-with-null.html The fix was correct in changing the assignment part of "UPDATE" statements from "IS NULL" to "= NULL". For example (snips from the commit log): Good ---- @@ -19,7 +19,7 @@ allocate-clear = "UPDATE ${ippool_table} \ SET nasipaddress = '', pool_key = 0, \ callingstationid = '', username = '', \ - expiry_time IS NULL \ + expiry_time = NULL \ WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND nasipaddress = '%{Nas-IP-Address}'" ---- This is an assignment therefore we use the '=' assignment operator. Bad ---- @@ -59,7 +59,7 @@ allocate-update = "UPDATE ${ippool_table} \ SET nasipaddress = '%{NAS-IP-Address}', pool_key = '${pool-key}', \ callingstationid = '%{Calling-Station-Id}', username = '%{User-Name}', \ expiry_time = NOW() + INTERVAL ${lease-duration} SECOND \ - WHERE framedipaddress = '%I' AND expiry_time IS NULL" + WHERE framedipaddress = '%I' AND expiry_time = NULL" ---- This is a comparison and therefore we need to use the "IS NULL" syntax. *-*-*-*-*-*-*-*-* If you are still reading at this point, here is a mini-patch from myself for the "sql/mysql/ippool.conf". ## The ORDER BY clause of this query tries to allocate the same IP-address ## which user had last session... allocate-find = "SELECT framedipaddress FROM ${ippool_table} \ - WHERE pool_name = '%{control:Pool-Name}' AND expiry_time < NOW() \ + WHERE pool_name = '%{control:Pool-Name}' AND (expiry_time < NOW() OR expiry_time IS NULL) \ ORDER BY (username <> '%{User-Name}'), \ (callingstationid <> '%{Calling-Station-Id}'), \ expiry_time \ If you do not check _explicitly_ for NULL then nothing will match (if expiry_time == NULL). As the 'ippool.sql' schema file sets 'default NULL' for expiry_time, this is likely to be the case. Example: mysql> select COUNT(*) from radippool WHERE pool_name = 'dummy' AND expiry_time < NOW(); +----------+ | COUNT(*) | +----------+ | 0 | +----------+ 1 row in set (0.00 sec) mysql> select COUNT(*) from radippool WHERE pool_name = 'dummy' AND (expiry_time < NOW() OR expiry_time IS NULL); +----------+ | COUNT(*) | +----------+ | 200 | +----------+ 1 row in set (0.00 sec)

2 2

EAP-PEAP issues with session resumption disabled
by Jouni Malinen 18 Feb '09

18 Feb '09

It looks like FreeRADIUS is currently checking whether session resumption is enabled very late during EAP-PEAP negotiation. Even the protected result indication for success is completed before FreeRADIUS does this and sends EAP-Failure. However, at that point the client is going to discard the EAP-Failure since the only allowed message after successfully completed result indication is EAP-Success. Would it be possible to move the session resumption enabled/disabled check to be done much earlier during the process? Ideally, this would be done when processing the TLS ClientHello so that server could just fall back to using full authentication without causing authentication problems. If that is not feasible for some reason, it would be useful for the protected result indication to result in Failure, not Success, so that the peer implementation would actually accept the EAP-Failure in the end. The code that triggers the current behavior is in eap_tls.c, eaptls_success(). Debug log shows this: [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Success [peap] FAIL: Forcibly stopping session resumption as it is not allowed. The EAP-TLV there was the end of the protected result (Success) indication. -- Jouni Malinen PGP id EFC895FA

2 1

GIT Log for 2009-02-18 00:33 GMT
by aland＠deployingradius.com 17 Feb '09

17 Feb '09

commit cc3baab2e70eb0d85c18d76ec57479fe2354c3dc Author: Chris Moules <chris(a)gms.lu> Date: Tue Feb 17 14:19:20 2009 +0000 Fix typo Files changed: raddb/sql/mysql/ippool.conf | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 2d6ab03583f9e794220c268c4068cf1b7c85e60f Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Feb 17 14:14:18 2009 +0100 Fixed debug message. Noted by Dave Anderson. Files changed: src/modules/rlm_wimax/rlm_wimax.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 28571bd977d8e0de0a5700d4cb1456490ba4dfc6 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Feb 17 14:13:07 2009 +0100 WiMAX needs OpenSSL for proper functionality Files changed: src/modules/rlm_wimax/Makefile | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit a85798c1e7862113f0253fcb65a015fe53c06eef Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Feb 17 14:11:31 2009 +0100 Remove broken macro. C preprocessor directives aren't allowed in macros Files changed: src/main/listen.c | 15 +++++++++++++++ 1 files changed, 15 insertions(+), 0 deletions(-) ====================================================================== commit 9593cf2d31d5aa165ec26382a5914dcf27e93cdf Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Feb 17 14:09:30 2009 +0100 This was moved earlier Files changed: raddb/otp.conf | 78 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 78 insertions(+), 0 deletions(-) ====================================================================== commit be8d29fcd13c194068a6853e1d07503e9fdb998c Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Feb 17 14:07:32 2009 +0100 Answer vmps reconfirmation request Patch from Hermann Lauer. Files changed: raddb/sites-available/vmps | 8 -------- 1 files changed, 0 insertions(+), 8 deletions(-) ====================================================================== commit 6b993089edd0e0c8a09e0cbeed0ea2d8d0b19b9d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Feb 17 14:06:59 2009 +0100 Sample logrotate script Files changed: scripts/logrotate.freeradius | 12 ------------ 1 files changed, 0 insertions(+), 12 deletions(-) ======================================================================

1 0

patch for typo in sql/mysql/ippool.conf
by Chris Moules 17 Feb '09

17 Feb '09

Missing slash in sql/mysql/ippool.conf causes freeradius not to start if sqlippool is configured with MySQL. Chris

2 1

[patch] correct answer of a VMPS-Reconfirm-Request
by Hermann Lauer 17 Feb '09

17 Feb '09

Hello Developers, please consider the appended configuration patch for inclusion. It allows radiusd to correctly answer vmps reconfirmation request as OpenVMPS (http://vmps.sourceforge.net/) does this. Thanks, Hermann -- Netzwerkadministration/Zentrale Dienste, Interdiziplinaeres Zentrum fuer wissenschaftliches Rechnen der Universitaet Heidelberg IWR; INF 368; 69120 Heidelberg; Tel: (06221)54-8236 Fax: -5224 Email: Hermann.Lauer(a)iwr.uni-heidelberg.de

2 1

GIT Log for 2009-02-17 00:33 GMT
by aland＠deployingradius.com 16 Feb '09

16 Feb '09

commit fdcf5b756f6b26b85e8e439ead6fd725959e3806 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Feb 16 22:42:02 2009 +0100 Fix compile errors src/main/event.c | 2 +- src/modules/frs_detail/frs_detail.c | 8 ++------ 2 files changed, 3 insertions(+), 7 deletions(-)

1 0

GIT Log for 2009-02-16 00:33 GMT
by aland＠deployingradius.com 15 Feb '09

15 Feb '09

commit 1cbf67ed784fd37dddbfa69493a1b1ebe640089d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Feb 15 12:05:55 2009 +0100 Added sample commands Files changed: man/man8/radmin.8 | 83 ++--------------------------------------------------- 1 files changed, 3 insertions(+), 80 deletions(-) ====================================================================== commit 1a96258719cc5c808d8e127e8d2c4013befff45b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Feb 15 11:49:36 2009 +0100 Added "help -r" This prints *all* of the available help Files changed: src/modules/frs_control/frs_control.c | 38 +++++++++----------------------- 1 files changed, 11 insertions(+), 27 deletions(-) ====================================================================== commit 02cfd3edbb412492ff9f3be18b4f7a42844d6a6a Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Feb 15 11:31:23 2009 +0100 Set Accounting-Response in post-proxy fail Files changed: src/modules/rlm_detail/rlm_detail.c | 8 +------- 1 files changed, 1 insertions(+), 7 deletions(-) ====================================================================== commit 652cc8fa317966880361d2199da4cf4ff1895a04 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Feb 15 09:29:45 2009 +0100 Allow the detail poll interval to be configurable Files changed: raddb/sites-available/buffered-sql | 8 -------- src/include/detail.h | 1 + src/main/event.c | 8 ++++---- src/modules/frs_detail/frs_detail.c | 23 ++++------------------- 4 files changed, 9 insertions(+), 31 deletions(-) ====================================================================== commit 1cb7ac79d2d909872c5dd8b4d3915f19c1624e83 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Feb 15 09:04:10 2009 +0100 More documentation Files changed: raddb/modules/wimax | 7 +------ 1 files changed, 1 insertions(+), 6 deletions(-) ====================================================================== commit 9eca88636bb1e3689ef649357a9c472518ac7e26 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Feb 15 09:00:28 2009 +0100 Documentation for raddebug Files changed: man/man8/raddebug.8 | 96 --------------------------------------------------- 1 files changed, 0 insertions(+), 96 deletions(-) ====================================================================== commit b49f751ac57fd9f518f44c35da6495638307c66e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Feb 15 08:44:38 2009 +0100 Minor cleanups Added -d and usage Files changed: scripts/raddebug | 20 +++++++------------- 1 files changed, 7 insertions(+), 13 deletions(-) ======================================================================

1 0