April 2009 - Freeradius-Devel - lists.freeradius.org

Looking to pay for customization
by Eric Geier 14 Apr '09

14 Apr '09

Hi, if anyone is interested in customizing the source code for me, please check out either site: http://www.getacoder.com/projects/c_developer_radius_expe_102912.html http://www.odesk.com/jobs/Developer-with-RADIUS-Experience_~~f48a82c177d7e1b 3?tot=129&pos=7 I would like FreeRADIUS to check incoming requests based upon the domain (derived from the username), instead of the NAS IP addresses. Thanks! Eric Geier

5 4

Re: Module for Access Request - wait for some things - Accept/Reject
by Alan DeKok 13 Apr '09

13 Apr '09

John Bourke wrote: > I need to implement a extension which makes Access Request decisions in > batch. I need to queue up a bunch of requests, analyse them, and decide > which are Accepted or Rejected. This is for a resource allocation problem, > not an authentication problem. I want to batch 2-3 seconds of requests > which could be up to 150 requests, (I need to handle some exceptional peak > loads). That is very difficult to do in the current design of the server. And if your back-end system can't handle a steady stream of requests, it's likely time to get a better back-end system. Really. > "Similarly, the module infrastructure is NOT intended to allow servers, > applications, timed events, or anything other than handling incoming RADIUS > packets." > > So the best way is to push this problem off to another application via some > clean, non blocking, interface. Yes. > But. > > How may outstanding Access Requests can I have waiting on the > module/external to complete ? I guess this is a question about Free Radius > internal threading, queueing or blocking/non blocking. Lots. I would suggest *proxying* the requests to another RADIUS server that you write yourself. It can queue up the requests, and then respond in one big batch. > Does the Free Radius/Module architecture allow large numbers of outstanding > Access Requests, and if so, are they queued, or do they exist in 100's of > independent blocking threads, or is there some other mechanism ? If you block in a module, then it *will* use many threads. If you proxy the requests, it won't. I wouldn't recommend doing this, to be honest. It's going to be expensive, fragile, and completely non-standard. I would suggest instead fixing the back end system. Alan DeKok.

1 0

Module for Access Request - wait for some things - Accept/Reject
by John Bourke 13 Apr '09

13 Apr '09

Folks, I need to implement a extension which makes Access Request decisions in batch. I need to queue up a bunch of requests, analyse them, and decide which are Accepted or Rejected. This is for a resource allocation problem, not an authentication problem. I want to batch 2-3 seconds of requests which could be up to 150 requests, (I need to handle some exceptional peak loads). "Similarly, the module infrastructure is NOT intended to allow servers, applications, timed events, or anything other than handling incoming RADIUS packets." So the best way is to push this problem off to another application via some clean, non blocking, interface. But. How may outstanding Access Requests can I have waiting on the module/external to complete ? I guess this is a question about Free Radius internal threading, queueing or blocking/non blocking. Does the Free Radius/Module architecture allow large numbers of outstanding Access Requests, and if so, are they queued, or do they exist in 100's of independent blocking threads, or is there some other mechanism ? Many thanks John

1 0

GIT Log for 2009-04-11 23:33 GMT
by aland＠deployingradius.com 11 Apr '09

11 Apr '09

commit a38fb89e151413f3a99e324ef496ecfd09740882 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Apr 11 10:01:21 2009 +0200 Document retry_interval Files changed: raddb/sites-available/buffered-sql | 10 ++++++++++ 1 files changed, 10 insertions(+), 0 deletions(-) ====================================================================== commit 9e14026d0b2ae0bf5f67a26496d47c078cf187b0 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Apr 11 09:40:09 2009 +0200 Fixed detail file handler to not go crazy In short, the detail timer events are now inserted with a saved fr_event_t. This allows *existing* timer events to be deleted when a new one is added. The previous code would *add* timer events on top of the existing ones, causing geometric increases in the number of polls per second. Also, re-arranged the detail && listener code so that there's only one location where the timer gets inserted, and only one location where the delays get propogated from the detail to the event handlers Conflicts: src/main/event.c src/modules/frs_detail/frs_detail.c Files changed: src/main/event.c | 90 +++++++++++------------------------ src/modules/frs_detail/frs_detail.c | 68 ++++++++++++++++++-------- 2 files changed, 75 insertions(+), 83 deletions(-) ======================================================================

1 0

GIT Log for 2009-04-10 23:33 GMT
by aland＠deployingradius.com 10 Apr '09

10 Apr '09

commit 9d82cac27b7a3ccbc11560a679bae488e42a900e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Apr 10 16:17:48 2009 +0200 Fixed double quote issue Files changed: man/man5/unlang.5 | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) ====================================================================== commit e456bbf6ed259d4213eb2f7b9a51aad8ef53e9c8 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Apr 10 16:12:18 2009 +0200 Make other balance types work Files changed: src/main/realms.c | 23 ++++++++++++++++++----- 1 files changed, 18 insertions(+), 5 deletions(-) ======================================================================

1 0

Add radius server hostname to tickets
by Stephan Jaeger 09 Apr '09

09 Apr '09

Hi, i'd like to add the radius server's hostname to the tickets, do be able to identify over which server it came in later. For that i've added a new internal freeradius attribute "Server-Hostname" and a block with a gethostname() call to xlat.c. I now update the requests with unlang and add an attribute with %{Server-Hostname} as value. Would you accept a patch for this? Or this there a better way to do this? Regards Stephan Jaeger

6 8

GIT Log for 2009-04-09 23:33 GMT
by aland＠deployingradius.com 09 Apr '09

09 Apr '09

commit 2d4ce3bff567d03e348742b36b4c9e890b88b060 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 9 10:35:38 2009 +0200 Do recursive xlat src/main/xlat.c | 8 +++++++- 1 files changed, 7 insertions(+), 1 deletions(-)

1 0

How to find out from which section a module was called
by Stephan Jaeger 09 Apr '09

09 Apr '09

Hi, is it possible to get the information from which section a module was called? Maybe from the request struct? If have a problem with modules like rlm_linelog which have a common function for all sections. Following the example configuration logs the same string for access-request and access-accept/reject (the access-request one) because the packet type from the request is access-request in both request and reply. So i guess if not i have to configure different rlm_linelog instances to handle requests and replies. I also had that problem with a self made module so i had to make different module functions for every section. -- i. A. Stephan Jäger Abteilung Dienste Telefon: (0441)8000-2873 Telefax: (0441)8000-2599 mailto:stephan.jaeger@ewetel.de ___________________________________ EWE TEL GmbH Cloppenburger Straße 310 26133 Oldenburg Handelsregister Amtsgericht Oldenburg HRB 3723 Vorsitzender des Aufsichtsrates: Heiko Harms Geschäftsführung: Hans-Joachim Iken (Vorsitzender), Dr. Norbert Schulz, Dirk Thole Homepage: http://www.ewetel.de/

2 1

GIT Log for 2009-04-08 23:33 GMT
by aland＠deployingradius.com 08 Apr '09

08 Apr '09

commit 865cc41c4e95f2ee6353932e444d4ecee2580134 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 8 16:58:31 2009 +0200 Added md5 xlat Files changed: src/main/xlat.c | 35 ++++++++++++++++++++++++++++++++++- 1 files changed, 34 insertions(+), 1 deletions(-) ====================================================================== commit 660226e1ff60a51fea2c690171f9f44c857861e3 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 8 15:45:03 2009 +0200 Corrected typo Files changed: src/modules/rlm_ldap/rlm_ldap.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 11f8a544f0d1c5ca7b7a0debff0d81df7ff9e42b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 8 14:12:43 2009 +0200 Updates, as posted to the list Files changed: share/dictionary.fortinet | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) ====================================================================== commit ee9a86594689aba2bc132a3c8780a94b856c6d0e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Apr 5 02:44:37 2009 +0200 Don't load pre/post-proxy sections if we're not proxying Files changed: src/main/modules.c | 12 ++++++++++++ 1 files changed, 12 insertions(+), 0 deletions(-) ======================================================================

1 0

Bug server dead - did anyone keep a copy of the HTTP-Digest auth patch?
by Andrew Krywaniuk 08 Apr '09

08 Apr '09

Hi, I'm looking for a copy of the experimental patch for HTTP digest authentication mentioned on http://wiki.freeradius.org/RFC that was previously stored on the now-defunct bugs server (http://bugs.freeradius.org/show_bug.cgi?id=391) If anyone kept a copy of this patch and could send it to me, I would appreciate it. My private e-mail is the rot13 of nxeljnavhx(at)sbegvarg(dot)pbz. BTW, I noticed that the list of custom attributes in the dictionary.fortinet file is out of date. Please update the list as follows: ATTRIBUTE Fortinet-Group-Name 1 string ATTRIBUTE Fortinet-Client-IP-Address 2 ipaddr ATTRIBUTE Fortinet-Vdom-Name 3 string ATTRIBUTE Fortinet-Client-IPv6-Address 4 octets ATTRIBUTE Fortinet-Interface-Name 5 string ATTRIBUTE Fortinet-Access-Profile 6 string Andrew _________________________________________________________________ Internet Explorer 8 helps keep your personal info safe. http://go.microsoft.com/?linkid=9655581

2 1

GIT Log for 2009-04-02 23:33 GMT
by aland＠deployingradius.com 03 Apr '09

03 Apr '09

commit 90c05e048d12082ce91e2baece1c1f90f265867d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 2 13:45:51 2009 +0200 Added "rebind" option to re-authenticate on rebind Also, change chase_referrals default to unset. This allows us to use the OpenLDAP default, OR to force it on/off. rebind is done only when chase_referrals is true, AND rebind is true Files changed: ====================================================================== commit e428b72171c57473bed5ccb1575e408cca07acfb Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 2 11:45:41 2009 +0200 Added chase_referrals option Files changed: ====================================================================== commit f60fe639e7562df9a710ab319f347e5934b92738 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 2 11:21:03 2009 +0200 Note limitations with -n Files changed: ======================================================================

3 2

compile error with option --with-system-libtool
by Hermann Lauer 02 Apr '09

02 Apr '09

Dear developers, while building a deb package on lenny(sparc) with the debian/rules file included in the 2.1.4 tarball compilation fails due to some libtools issues, see output below. After removing the --with-system-libtool from the configure options in debian/rules the package was build sucessfull. I'm not familiar with libtool, but a path of ./libtools looks somehow wrong. Thanks, Hermann --------------------------------------- Making all in rlm_acctlog... make[7]: Entering directory `/home/hlauer/tmp/freeradius-server-2.1.4/src/modules/rlm_acctlog' ./libtool --mode=compile gcc -Wall -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I/home/hlauer/tmp/freeradius-server-2.1.4/src -I/home/hlauer/tmp/freeradius-server-2.1.4/libltdl -c rlm_acctlog.c make[7]: ./libtool: Command not found make[7]: *** [rlm_acctlog.lo] Error 127 make[7]: Leaving directory `/home/hlauer/tmp/freeradius-server-2.1.4/src/modules/rlm_acctlog' make[6]: *** [common] Error 2 make[6]: Leaving directory `/home/hlauer/tmp/freeradius-server-2.1.4/src/modules' make[5]: *** [all] Error 2 make[5]: Leaving directory `/home/hlauer/tmp/freeradius-server-2.1.4/src/modules' make[4]: *** [common] Error 2 make[4]: Leaving directory `/home/hlauer/tmp/freeradius-server-2.1.4/src' make[3]: *** [all] Error 2 make[3]: Leaving directory `/home/hlauer/tmp/freeradius-server-2.1.4/src' make[2]: *** [common] Error 2 make[2]: Leaving directory `/home/hlauer/tmp/freeradius-server-2.1.4' make[1]: *** [all] Error 2 make[1]: Leaving directory `/home/hlauer/tmp/freeradius-server-2.1.4' make: *** [build-arch-stamp] Error 2 dpkg-buildpackage: failure: debian/rules build gave error exit status 2 -- Netzwerkadministration/Zentrale Dienste, Interdiziplinaeres Zentrum fuer wissenschaftliches Rechnen der Universitaet Heidelberg IWR; INF 368; 69120 Heidelberg; Tel: (06221)54-8236 Fax: -5224 Email: Hermann.Lauer(a)iwr.uni-heidelberg.de

2 1