April 2009 - Freeradius-Devel - lists.freeradius.org

dynamic number of SQL sockets?
by Stefan Winter 24 Apr '09

24 Apr '09

Hi, we've been having fun with the SQL backend connection from our FR 2.1.4 yesterday night, when auth load suddenly increased tenfold. The issue at hand was that we execute a query in post-auth that takes ~ 300 milliseconds. We have configured the rlm_sql_mysql instance for 5 sockets to the MySQL backend, which means an approximate 15 logins per second sustainable (which is way more than enough for us during normal operation). As the auth load increased, so did the number of queries, and it went beyond 15. Auths would have failed (but luckily the query was in a redundant { ... ok } block, and so nothing serious happened). It's important to note that the actual *load* on the MySQL backend was negligible all the time, so this is not the usually-reported "database too slow" problem. These queries simply are quite sophisticated, and they take some time to execute. In short: more sockets would have solved the problem. But you wouldn't want so many sockets day-to-day. Something dynamic would be a really nice feature. In a way just like the thread pool of FreeRADIUS itself is managed: define a minimum number of SQL sockets, and a min-spare, max-spare, max-total pair so that the number of connections grows and shrinks as required. Does that feature make sense? Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

3 3

GIT Log for 2009-04-23 23:33 GMT
by aland＠deployingradius.com 23 Apr '09

23 Apr '09

commit 32e79e23a990f4b23c9a24fa3fa0b74bcd64667e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 23 19:28:10 2009 +0200 Load ALL virtual servers on HUP, even if one fails Files changed: src/main/modules.c | 55 ++++++++++++++++++++++++++++++++++------------------ 1 files changed, 36 insertions(+), 19 deletions(-) ====================================================================== commit 0a155e140c9c0dda366a70be7a583683c5067c19 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 23 17:14:46 2009 +0200 Return 0 on error, not -1 Files changed: src/modules/frs_control/frs_control.c | 15 +++++++++------ 1 files changed, 9 insertions(+), 6 deletions(-) ====================================================================== commit e61c0a055df42a0a43628bb1c1b9c595cf654325 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 23 16:41:35 2009 +0200 Include function that seems to have been missed before. Files changed: src/main/listen.c | 39 +++++++++++++++++++++++++++++++++++++++ 1 files changed, 39 insertions(+), 0 deletions(-) ====================================================================== commit 1fe50d77a7e7bb6ff083776ae7de3fa00165bfec Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 23 13:04:48 2009 +0200 Reload module configuration on HUP Files changed: src/main/mainconfig.c | 41 +++++++++++++++-------------------------- 1 files changed, 15 insertions(+), 26 deletions(-) ====================================================================== commit 3cc9b74437a8ca1da0200915f1b7b85289068dd5 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 23 13:03:15 2009 +0200 Whoops... server->name could be NULL Files changed: src/main/modules.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) ====================================================================== commit ecac8e68d9efb5106de05457be35f5cde82593b3 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 23 11:20:02 2009 +0200 Ensure we don't delete servers that are in use Files changed: src/main/modules.c | 20 ++++++++++++++++++-- 1 files changed, 18 insertions(+), 2 deletions(-) ====================================================================== commit 06b26545c014ffcc3b03ac7be66916b9ed64c2ba Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 23 11:00:10 2009 +0200 Allow virtual servers to be reloaded dynamically on HUP Files changed: src/include/modules.h | 7 +++++ src/main/mainconfig.c | 60 ++++++++++++++++++++++++++++++++++++++++++++++++- src/main/modules.c | 51 ++++++++++++++++++++++++++++------------- 3 files changed, 101 insertions(+), 17 deletions(-) ====================================================================== commit cad5aa8c0f45ecf443e2f104a1a04622b1e84ae0 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 23 10:20:24 2009 +0200 Created and use virtual_server_t structure The module loading code is now abstracted to load and look for modules ONLY by virtual server. Each virtual server has its own component tree, that is not shared with any other virtual server. The virtual servers themselves are now in a simple hash table, which lets them be dynamically reloaded. Files changed: src/main/modules.c | 237 +++++++++++++++++++++++++++++++++++----------------- 1 files changed, 159 insertions(+), 78 deletions(-) ====================================================================== commit 3e189e8c634304abc6d2ea132d3ac685f6dd8cad Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 23 08:59:02 2009 +0200 Moved HUP code to mainconfig Files changed: src/include/radiusd.h | 1 + src/main/mainconfig.c | 5 +++++ src/main/radiusd.c | 6 +++++- 3 files changed, 11 insertions(+), 1 deletions(-) ====================================================================== commit 82a55c5a27dc9c70ef670dc0881fd5b8f5cd030a Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 23 07:07:20 2009 +0200 Allow administrators to force_check_config Files changed: src/main/modules.c | 14 ++++++++++++-- 1 files changed, 12 insertions(+), 2 deletions(-) ======================================================================

1 0

GIT Log for 2009-04-22 23:33 GMT
by aland＠deployingradius.com 22 Apr '09

22 Apr '09

commit 27cad6993d9b90406d363d87180d7b8919328206 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 22 14:42:13 2009 +0200 Don't lose tags Files changed: src/modules/rlm_perl/rlm_perl.c | 16 +++++++++++++--- 1 files changed, 13 insertions(+), 3 deletions(-) ====================================================================== commit d959e728c5928eececf9bd1d4ff0dca1f51d9306 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 22 13:37:53 2009 +0200 Added tunnel attributes Files changed: raddb/ldap.attrmap | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) ======================================================================

1 0

Releasing 2.1.5 or 2.1.6
by John Dennis 22 Apr '09

22 Apr '09

I'd like to package up the current release but I can't because the current tar files have version problems. What is currently on the download link is 2.1.4 but builds as 2.1.5. There have been two different versions of the 2.1.4 tar file. This means we can never release a 2.1.4 RPM because it's versioning is ambiguous. IMHO the 2.1.4 release should be considered defunct. There is a 2.1.5 trial version on the build server that I've lightly tested, perhaps others should as well. Can we move the next release forward to an official release so we can get a release out to supercede the current version, which to my thinking is 2.1.3 (because 2.1.4 is not identifiable). P.S.: We also need to be careful, if what becomes 2.1.5 is not identical to what's in the 2.1.4 tar file we should go to 2.1.6 because we won't be able to disambiguate between a 2.1.5 built from a 2.1.4 tar file and the actual 2.1.5 built from a 2.1.5 tar file. This means the next release should probably be 2.1.6 with 2.14 and 2.1.5 marked as suspect in the changelog. -- John Dennis <jdennis(a)redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/

2 2

GIT Log for 2009-04-21 23:33 GMT
by aland＠deployingradius.com 21 Apr '09

21 Apr '09

commit 07ef810688718886a78b7d277c8a58c9d3e460a5 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Apr 21 17:07:46 2009 +0200 Added "control" as alias for "config. Patch from Alexander Clouter Files changed: src/modules/rlm_attr_rewrite/rlm_attr_rewrite.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) ====================================================================== commit 843e404bda8e737b46f5958866496a2e2dd11239 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Apr 21 16:12:55 2009 +0200 Note where unlang can go, and where it can't go Files changed: man/man5/unlang.5 | 10 ++++++++-- 1 files changed, 8 insertions(+), 2 deletions(-) ======================================================================

1 0

Does freeradius-client library support CHAP protocol?
by Tarkshya 21 Apr '09

21 Apr '09

Hi all, I was trying to figure out whether CHAP protocol is supported by freeradius-client library or not. I am reaching two contradictory conclusions using my own dubious analysis. Hence the request for help. If my understanding is correct, (and I might be totally wrong here), then the PAP protocol sends the user passwords in clear text over the wire. On the other hand, CHAP protocol uses a shared secret between the client and server to encrypt the passwords being sent over the wire. Since I do see the use of shared secret in freeradius-client library configuration file, I assume that the library does support CHAP. However, in the source code of the library, I notice that the section doing the CHAP processing is turned off using the #if 0 directive. Meaning CHAP is not being used. What gives? Also, after wading through the archives of this mailing list, I came across the post of one user who had asked exactly the same question, that is to say, whether CHAP is supported or not. The answer he got was that, "at this stage, better not use CHAP". This is an ambiguous reply as far as I am concerned because it evades a direct answer. Please reply Tarkshya

3 10

Setting items in perl and accessing them in C
by Samuel Muñoz Hidalgo 20 Apr '09

20 Apr '09

Hello I have the perl module enabled and customized to my needs. Inside it, I add a new attribute called token in the authorize function $RAD_CHECK{'token'} = 'mytoken'; . So, when executing it I see in the debug output (-X parameter) something like: ... Added pair token = mytoken ... Apart from this, I' ve modified the function eappeap_success (file peap.c) so I can add a TLV (the token) inside the success packet and send it to the client. My question is, how can I get the $RAD_CHECK{'token'} value inside the eappeap_success function? I've seen the structures handler (EAP_PEAP type) and tls_session (tls_sesion type) but I only find values related to the request, not to the response or radcheck arrays. Thanks!

2 1

GIT Log for 2009-04-18 23:33 GMT
by aland＠deployingradius.com 18 Apr '09

18 Apr '09

commit 6dc3e492e480e21fb69e83c931b2009494f4c58e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Apr 18 08:41:06 2009 +0200 Removed LICENSE and re-generated "configure" The main FreeRADIUS source has the same LICENSE, so it doesn't need to be here, too. The "configure" scripts in the server are all generated on the same machine, using the same version of autoconf. That seems to ensure that the autoconf magic is happy. Files changed: src/modules/rlm_ruby/LICENSE | 280 --------- src/modules/rlm_ruby/configure | 1302 +++++++++++++++++----------------------- 2 files changed, 553 insertions(+), 1029 deletions(-) ====================================================================== commit d8f127c49752b69a2df4761774f565a330a6a82e Author: Antti <refresh.xss(a)gmail.com> Date: Fri Apr 17 19:17:30 2009 +0300 Adding rlm_ruby module. Files changed: src/modules/rlm_ruby/LICENSE | 280 +++ src/modules/rlm_ruby/Makefile.in | 10 + src/modules/rlm_ruby/configure | 4153 +++++++++++++++++++++++++++++++++++++ src/modules/rlm_ruby/configure.in | 99 + src/modules/rlm_ruby/example.rb | 25 + src/modules/rlm_ruby/rlm_ruby.c | 459 ++++ 6 files changed, 5026 insertions(+), 0 deletions(-) ======================================================================

1 0

GIT Log for 2009-04-17 23:33 GMT
by aland＠deployingradius.com 17 Apr '09

17 Apr '09

commit 4214f8e3eacb38639272a62e1094c98b785b7623 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Apr 17 16:03:20 2009 +0200 More documentation for weird WiMAX stuff Files changed: raddb/sites-available/default | 15 ++++++++++++++- 1 files changed, 14 insertions(+), 1 deletions(-) ====================================================================== commit 7ee8c26e827bac9f0a47c8af0e38c5ddb1b9905c Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Apr 17 15:57:28 2009 +0200 Added configuration to delete the MS-MPPE-*-Keys Files changed: raddb/modules/wimax | 21 ++++++++- src/modules/rlm_wimax/rlm_wimax.c | 90 +++++++++++++++++++++++++++++++++++- 2 files changed, 107 insertions(+), 4 deletions(-) ====================================================================== commit 62679e9106f4db4f1582e02a668772120472e6cd Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Apr 17 15:12:30 2009 +0200 Allow operations OTHER than == to work for Packet-Src-IP-Address ... and associated virtual attributes. The issue is that the paircompare_register'd functions return 0 for match, and 1 for didn't match. This is wrong. They should just return the results of the comparison. And then radius_callback_compare should check the results of the comparison against the operators, to see if the CONDITION succeeded or failed. Files changed: src/modules/rlm_expr/paircmp.c | 27 +++++++++++++++++++++++++-- 1 files changed, 25 insertions(+), 2 deletions(-) ======================================================================

1 0

Issue with how to see the authentication requests
by yiyongyun 17 Apr '09

17 Apr '09

hi, all: I want to see the authentication requests in the log file, so I set radiusd.conf as below: log_auth = yes prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct log_file = ${logdir}/radius.log But in radius.log, I can only see something as below: Fri Apr 17 16:06:15 2009 : Info: Using deprecated naslist file. Support for this will go away soon. Fri Apr 17 16:06:15 2009 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Fri Apr 17 16:06:15 2009 : Info: Ready to process requests. So,how can I see the authentication requests comes from client? best regard yiyongyun

1 0