April 2009 - Freeradius-Devel - lists.freeradius.org

possible FIPS changes required
by William Rettig 16 Apr '09

16 Apr '09

Hello all. Thank you for FreeRADIUS. I am facing a requirement for FIPS compliant AES Key-wrap function. I have not found support for it in the docs I have skimmed the code to no avail. Before I go off and add the feature, I wanted to make sure that it is not already there either in whole or in part. In a nutshell AES Key-wrap is the name of a procedure to encrypt and package the Master Key sent to the Access Point in the RADIUS accept packet. So that I stay within the design intent of FreeRADIUS, I request some guidance with an approach that "stays between the lines". Thank you, Bill

2 1

GIT Log for 2009-04-15 23:33 GMT
by aland＠deployingradius.com 15 Apr '09

15 Apr '09

commit e24e246599eecbd334ebcb7d8c58f3a1da6ecdee Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 15 19:49:31 2009 +0200 Don't leak FD's on empty values. Patch from Stephan Jaeger Files changed: src/modules/rlm_linelog/rlm_linelog.c | 30 +++++++++++++++--------------- 1 files changed, 15 insertions(+), 15 deletions(-) ====================================================================== commit 502723464d9ded09c7d038d0b5cb51f698284c65 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 15 19:44:04 2009 +0200 Added infonet dictionary Files changed: share/dictionary | 1 + share/dictionary.infonet | 50 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 51 insertions(+), 0 deletions(-) ======================================================================

1 0

rlm_linelog is leeking fd's
by Stephan Jaeger 15 Apr '09

15 Apr '09

Hi, rlm_linelog seems to be massively leeking fd's, i guess moving the file open block after the goto would fix this issue. Regards Stephan Jäger

2 1

EAP-AKA support for Freeradius
by Narayanan Preethi-A12713 15 Apr '09

15 Apr '09

Hello, I have been reading that the EAP-AKA support is given by a patch at > I have downloaded patch from http://bugs.freeradius.org/show_bug.cgi?id=386. <http://bugs.freeradius.org/show_bug.cgi?id=386.> But, I cannot accedes this site. The error is: Network Error (tcp_error) A communication error occurred: "Operation timed out" The Web Server may be down, too busy, or experiencing other problems preventing it from responding to requests. You may wish to try again at a later time. I am using version 2.1.4. How can I use the EAP-AKA method in this version? thanks Preethi Preethi Narayanan Motorola Work: 8475233906 Cell: 8473348012 Text: 8473348012(a)txt.att.net

2 2

RE: Looking to pay for customization
by Eric Geier 15 Apr '09

15 Apr '09

Thank you all for your comments. What I don't understand is that it seems like it was very easy to do in a previous version: http://lists.cistron.nl/pipermail/freeradius-devel/2005-January/007870.html http://lists.cistron.nl/pipermail/freeradius-devel/2005-January/007871.html Can something similar be done in version 2? On 13-Apr-09, at 11:46 PM, Eric Geier wrote: > Hi, if anyone is interested in customizing the source code for me, > please check out either site: > > http://www.getacoder.com/projects/c_developer_radius_expe_102912.html > > http://www.odesk.com/jobs/Developer-with-RADIUS- > Experience_~~f48a82c177d7e1b > 3?tot=129&pos=7 > > I would like FreeRADIUS to check incoming requests based upon the > domain (derived from the username), instead of the NAS IP addresses. >

2 1

Looking to pay for customization
by Eric Geier 14 Apr '09

14 Apr '09

Hi, if anyone is interested in customizing the source code for me, please check out either site: http://www.getacoder.com/projects/c_developer_radius_expe_102912.html http://www.odesk.com/jobs/Developer-with-RADIUS-Experience_~~f48a82c177d7e1b 3?tot=129&pos=7 I would like FreeRADIUS to check incoming requests based upon the domain (derived from the username), instead of the NAS IP addresses. Thanks! Eric Geier

5 4

Re: Module for Access Request - wait for some things - Accept/Reject
by Alan DeKok 13 Apr '09

13 Apr '09

John Bourke wrote: > I need to implement a extension which makes Access Request decisions in > batch. I need to queue up a bunch of requests, analyse them, and decide > which are Accepted or Rejected. This is for a resource allocation problem, > not an authentication problem. I want to batch 2-3 seconds of requests > which could be up to 150 requests, (I need to handle some exceptional peak > loads). That is very difficult to do in the current design of the server. And if your back-end system can't handle a steady stream of requests, it's likely time to get a better back-end system. Really. > "Similarly, the module infrastructure is NOT intended to allow servers, > applications, timed events, or anything other than handling incoming RADIUS > packets." > > So the best way is to push this problem off to another application via some > clean, non blocking, interface. Yes. > But. > > How may outstanding Access Requests can I have waiting on the > module/external to complete ? I guess this is a question about Free Radius > internal threading, queueing or blocking/non blocking. Lots. I would suggest *proxying* the requests to another RADIUS server that you write yourself. It can queue up the requests, and then respond in one big batch. > Does the Free Radius/Module architecture allow large numbers of outstanding > Access Requests, and if so, are they queued, or do they exist in 100's of > independent blocking threads, or is there some other mechanism ? If you block in a module, then it *will* use many threads. If you proxy the requests, it won't. I wouldn't recommend doing this, to be honest. It's going to be expensive, fragile, and completely non-standard. I would suggest instead fixing the back end system. Alan DeKok.

1 0

Module for Access Request - wait for some things - Accept/Reject
by John Bourke 13 Apr '09

13 Apr '09

Folks, I need to implement a extension which makes Access Request decisions in batch. I need to queue up a bunch of requests, analyse them, and decide which are Accepted or Rejected. This is for a resource allocation problem, not an authentication problem. I want to batch 2-3 seconds of requests which could be up to 150 requests, (I need to handle some exceptional peak loads). "Similarly, the module infrastructure is NOT intended to allow servers, applications, timed events, or anything other than handling incoming RADIUS packets." So the best way is to push this problem off to another application via some clean, non blocking, interface. But. How may outstanding Access Requests can I have waiting on the module/external to complete ? I guess this is a question about Free Radius internal threading, queueing or blocking/non blocking. Does the Free Radius/Module architecture allow large numbers of outstanding Access Requests, and if so, are they queued, or do they exist in 100's of independent blocking threads, or is there some other mechanism ? Many thanks John

1 0

GIT Log for 2009-04-11 23:33 GMT
by aland＠deployingradius.com 11 Apr '09

11 Apr '09

commit a38fb89e151413f3a99e324ef496ecfd09740882 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Apr 11 10:01:21 2009 +0200 Document retry_interval Files changed: raddb/sites-available/buffered-sql | 10 ++++++++++ 1 files changed, 10 insertions(+), 0 deletions(-) ====================================================================== commit 9e14026d0b2ae0bf5f67a26496d47c078cf187b0 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Apr 11 09:40:09 2009 +0200 Fixed detail file handler to not go crazy In short, the detail timer events are now inserted with a saved fr_event_t. This allows *existing* timer events to be deleted when a new one is added. The previous code would *add* timer events on top of the existing ones, causing geometric increases in the number of polls per second. Also, re-arranged the detail && listener code so that there's only one location where the timer gets inserted, and only one location where the delays get propogated from the detail to the event handlers Conflicts: src/main/event.c src/modules/frs_detail/frs_detail.c Files changed: src/main/event.c | 90 +++++++++++------------------------ src/modules/frs_detail/frs_detail.c | 68 ++++++++++++++++++-------- 2 files changed, 75 insertions(+), 83 deletions(-) ======================================================================

1 0

GIT Log for 2009-04-10 23:33 GMT
by aland＠deployingradius.com 10 Apr '09

10 Apr '09

commit 9d82cac27b7a3ccbc11560a679bae488e42a900e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Apr 10 16:17:48 2009 +0200 Fixed double quote issue Files changed: man/man5/unlang.5 | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) ====================================================================== commit e456bbf6ed259d4213eb2f7b9a51aad8ef53e9c8 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Apr 10 16:12:18 2009 +0200 Make other balance types work Files changed: src/main/realms.c | 23 ++++++++++++++++++----- 1 files changed, 18 insertions(+), 5 deletions(-) ======================================================================

1 0