May 2009 - Freeradius-Devel - lists.freeradius.org

GIT Log for 2009-05-13 23:33 GMT
by aland＠deployingradius.com 13 May '09

13 May '09

commit c8f57f3d5d688b9c3ac0b04c68a2fe00c677de87 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed May 13 08:52:09 2009 +0200 More typos Files changed: scripts/radwatch.in | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) ====================================================================== commit 5138e7691c78ae2f674a82a5e077666c4109b0fd Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed May 13 08:51:53 2009 +0200 Corrected typo in last commit Files changed: share/dictionary.cisco | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) ======================================================================

1 0

GIT Log for 2009-05-12 23:33 GMT
by aland＠deployingradius.com 12 May '09

12 May '09

commit 5ca19fe93bc7352c9c3b5fa4b2962dc6862f485b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue May 12 21:26:20 2009 +0200 Return from function Files changed: src/main/event.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 8b4d25254fdfc732ec715a310fecb9f409769842 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue May 12 20:43:22 2009 +0200 Include rad_assert.h to define rad_assert Files changed: src/modules/rlm_sql_log/rlm_sql_log.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) ====================================================================== commit 5fa7e726be9cd34e397e02a00bd7e18f3d31c0fa Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue May 12 12:29:33 2009 +0200 Fixed typo Files changed: raddb/certs/bootstrap | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit ec580b4610eb862460a79c1c4ace633fe9d4f4e6 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue May 12 10:59:26 2009 +0200 Added notes on certificate compatibility Files changed: raddb/certs/README | 43 +++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 43 insertions(+), 0 deletions(-) ====================================================================== commit 2ed203156e5da86bd6b0da812dce6ff98cc488e7 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue May 12 08:50:12 2009 +0200 Added policy up/down Files changed: share/dictionary.cisco | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) ====================================================================== commit 4fb7048454e455d763be784c7d36d7cde77e3001 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue May 12 08:38:20 2009 +0200 A number of fixes to make it work - reset signal handlers to NULL just before any sleep, which allows us to exit - save our PID file along with radiusd.pid - correct minor typos - automatically figure out which arguments to pass to "tail" Files changed: scripts/radwatch.in | 48 +++++++++++++++++++++++++++++++----------------- 1 files changed, 31 insertions(+), 17 deletions(-) ======================================================================

1 0

Porting rlm_eap_tls to GnuTLS - eaptls_handle_idx only needed for session caching?
by Carolin Latze 12 May '09

12 May '09

Hi everybody, I am examining the rlm_eap_tls source code in order to replace the OpenSSL calls with GnuTLS calls. That seems to work pretty straight forward, but I found some lines of code, where I am not sure, whether I understood them right or not: /* * Register the application indices. We can't use * hard-coded "0" and "1" as before, because we need to * set up a "free" handler for the cached session * information. */ if (eaptls_handle_idx < 0) { eaptls_handle_idx = SSL_get_ex_new_index(0, "eaptls_handle_idx", NULL, NULL, NULL); } if (eaptls_conf_idx < 0) { eaptls_conf_idx = SSL_get_ex_new_index(0, "eaptls_conf_idx", NULL, NULL, NULL); } if (eaptls_session_idx < 0) { eaptls_session_idx = SSL_get_ex_new_index(0, "eaptls_session_idx", NULL, NULL, eaptls_session_free); } I would say, these lines are needed in order to implement session caching. Is that right? If yes, I would delete them first in order to get a simple setup for the first test and replace them later. Regards Carolin

5 7

EAP-AKA support for Freeradius-1.1.4
by Kumar, Sunil 12 May '09

12 May '09

Hi, Finally, I have created a patch for FreeRadius to support EAP-AKA implementation. Please find the attached patch (freeradius-1.1.4_eap_aka_support.diff) in the rar file for freeradius-1.1.4 version release. I hope with small effort that can also be applied on the latest version releases as well. Apart from adding EAP-AKA support changes in patch, I have also added some fixes for EAP-Aka to handle variable RES length support. As far as configuration is concerned, there are very small changes required in "eap.conf" and "users" files to make it working and those changes are as follows 1. eap.conf a) Remove the default eap type from md5 in EAP configuration b) Add the EAP types of sim and aka along with md5 2. Users Add the user domain along with EAP types and their respective parameters for validation. I have created a patch (freeradius-1.1.4_eap_aka_support_conf.diff) for the configuration changes. Please find attached freeradius-1.1.4_eap_aka_support_conf.diff patch file in the attached rar file for the reference. Feel free to revert, in case there are some clarifications required. Thanks. Warm regards. Sunil Kumar The information contained in this electronic mail transmission may be privileged and confidential, and therefore, protected from disclosure. If you have received this communication in error, please notify us immediately by replying to this message and deleting it from your computer without copying or disclosing it.

3 3

rlm_sql and UTF8 encoded strings
by Stephan Jaeger 12 May '09

12 May '09

Hello, I have a problem with german umlauts in Acct-(Multi-)Session-Id. RFC2866 states that the string should be UTF8 encoded which it is. But the sql_escape_func of rlm_sql does not account for utf characters and iterates the string byte by byte. What approach would be best here? Regards Stephan -- i. A. Stephan Jäger Abteilung Dienste Telefon: (0441)8000-2873 Telefax: (0441)8000-2599 mailto:stephan.jaeger@ewetel.de ___________________________________ EWE TEL GmbH Cloppenburger Straße 310 26133 Oldenburg Handelsregister Amtsgericht Oldenburg HRB 3723 Vorsitzender des Aufsichtsrates: Heiko Harms Geschäftsführung: Hans-Joachim Iken (Vorsitzender), Dr. Norbert Schulz, Dirk Thole Homepage: http://www.ewetel.de/

2 3

GIT Log for 2009-05-11 23:33 GMT
by aland＠deployingradius.com 11 May '09

11 May '09

commit 9ec21851eeeb515c0c6fd71809bdf64640afb4ad Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon May 11 17:07:44 2009 +0200 This corrects the typo (sigh) Files changed: src/main/event.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit b3f4f5c19a71613809212f9982346829f8ec00f6 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon May 11 15:59:10 2009 +0200 Corrected typo Validate reply against packet, not against reply Files changed: src/main/event.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ======================================================================

1 0

GIT Log for 2009-05-10 23:33 GMT
by aland＠deployingradius.com 10 May '09

10 May '09

commit c77acbc4582b4c9c89ab50bacf2337cb04478c29 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun May 10 19:33:32 2009 +0200 Moved verifiation of proxy responses to earlier in the packet handling This slows down the main server thread a bit, but means that we catch attackers earlier, i.e. before pushing a request to a child thread. Files changed: src/main/event.c | 23 +++++++++++++++++------ src/modules/frs_proxy/frs_proxy.c | 7 +++---- 2 files changed, 20 insertions(+), 10 deletions(-) ====================================================================== commit c615bd540c1d91292235b9a3c6cb09ca0f768270 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun May 10 19:26:57 2009 +0200 Added event wrapper around request_free This function takes care of removing the request from the various hashes && event lists Files changed: src/main/event.c | 81 ++++++++++++++++++++++++++++++++--------------------- src/main/util.c | 3 +- 2 files changed, 51 insertions(+), 33 deletions(-) ====================================================================== commit 50463ff397c776e87952c869134db1caecd04ec9 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun May 10 12:49:33 2009 +0200 Don't touch request after it was proxied Files changed: src/main/event.c | 17 ++++++++--------- 1 files changed, 8 insertions(+), 9 deletions(-) ======================================================================

1 0

GIT Log for 2009-05-08 23:33 GMT
by aland＠deployingradius.com 08 May '09

08 May '09

commit 1d96d58110fc378aa210ae508fdfa8b7a52f911a Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat May 9 00:40:05 2009 +0200 Portability fixes tail -n is in /usr/xpg4/bin on Solaris. date +%s is *BSD && Linux, but not Solaris. Work around this for now... Files changed: scripts/radwatch.in | 25 ++++++++++++++++--------- 1 files changed, 16 insertions(+), 9 deletions(-) ====================================================================== commit 166d9ed5ed0f7ee7a670e46527729a13ec93f548 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri May 8 17:17:26 2009 +0200 Fix radwatch for "wait" exit codes on Solaris Files changed: scripts/radwatch.in | 23 +++++++++++++++++++++-- 1 files changed, 21 insertions(+), 2 deletions(-) ====================================================================== commit 3031b0822d8422a397375f625d6e60e431e673a1 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri May 8 15:40:07 2009 +0200 Expose radius_get_vp, and make switch {} use it This allows bare words to be used for switch statements. If the statement is a bare word, the server looks for a VALUE_PAIR of that name, and prints its value. Files changed: src/main/evaluate.c | 3 +-- src/main/modcall.c | 19 ++++++++++++++++--- 2 files changed, 17 insertions(+), 5 deletions(-) ====================================================================== commit 3e42135afce9b256e1c165d1e4fca40caeacd999 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri May 8 15:20:26 2009 +0200 Corrected typo Files changed: src/modules/rlm_krb5/rlm_krb5.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 6cdb795b1940892830334d19b7c64169936ad40b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri May 8 15:00:41 2009 +0200 More LLVM checks Files changed: src/main/radsniff.c | 2 +- src/modules/rlm_otp/otp_pw_valid.c | 2 +- src/modules/rlm_otp/otp_rlm.c | 3 +-- 3 files changed, 3 insertions(+), 4 deletions(-) ====================================================================== commit 9e218d6e4ee011ca0759fc1854777c4f65e635b7 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri May 8 14:49:39 2009 +0200 Minor changes in "remove from proxy hash" This avoids esoteric race conditions that no one has seen in practice Files changed: src/main/event.c | 28 ++++++++++++++++++++++++---- 1 files changed, 24 insertions(+), 4 deletions(-) ====================================================================== commit 6ca2f66f59f3649c696d259c65219832ce1d7bc1 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri May 8 13:05:46 2009 +0200 Catch invalid ACKs Files changed: src/modules/rlm_eap/libeap/eap_tls.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) ====================================================================== commit 026abca8bd2478d6314b910607437f31445d22df Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri May 8 12:53:02 2009 +0200 Fix issues found by LLVM checker. These are mostly dead stores, etc. Files changed: Make.inc.in | 7 +++++++ src/lib/Makefile | 2 +- src/lib/valuepair.c | 19 +++++++++++++++---- src/main/Makefile.in | 2 +- src/main/evaluate.c | 3 +++ src/main/modcall.c | 17 ++++++++++++----- src/main/modules.c | 1 - src/main/radmin.c | 5 +---- src/main/realms.c | 2 -- src/modules/Makefile | 4 ++++ src/modules/rlm_acct_unique/rlm_acct_unique.c | 4 +--- src/modules/rlm_attr_rewrite/rlm_attr_rewrite.c | 4 ++-- src/modules/rlm_detail/rlm_detail.c | 2 ++ src/modules/rlm_expr/paircmp.c | 5 +++-- src/modules/rlm_expr/rlm_expr.c | 8 ++++++++ src/modules/rlm_krb5/rlm_krb5.c | 10 ++++++++-- src/modules/rlm_mschap/rlm_mschap.c | 2 +- src/modules/rlm_pap/rlm_pap.c | 2 +- src/modules/rlm_policy/parse.c | 6 +++--- src/modules/rlm_preprocess/rlm_preprocess.c | 2 +- src/modules/rlm_radutmp/rlm_radutmp.c | 8 -------- src/modules/rlm_realm/rlm_realm.c | 2 +- src/modules/rlm_sql/rlm_sql.c | 1 + src/modules/rlm_sql_log/rlm_sql_log.c | 8 ++++++++ src/modules/rlm_unix/rlm_unix.c | 12 +++++------- src/modules/rules.mak | 2 +- 26 files changed, 90 insertions(+), 50 deletions(-) ======================================================================

1 0

GnuTLS and FreeRADIUS
by Carolin Latze 08 May '09

08 May '09

Hi everybody, I was searching for some time now and I found a lot of messages from people who wanted to replace the OpenSSL dependencies in FreeRADIUS with GnuTLS. But so far it seems, that nobody really did that, is that right? Or has there been work on that and it failed for some reason? To be honest I have absolutely no idea how complicated that will be but at least I don't expect it to be easy. :) Regards Carolin

5 6

GIT Log for 2009-05-07 23:33 GMT
by aland＠deployingradius.com 07 May '09

07 May '09

commit 104143a884d39712b478e19802da9297ec556b2f Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu May 7 12:14:26 2009 +0200 Added ability to send mail when something goes wrong This is rate-limited to once per hour, and includes the last portion of the log file. Files changed: scripts/radwatch.in | 74 ++++++++++++++++++++++++++++++++++++++++++++------- 1 files changed, 64 insertions(+), 10 deletions(-) ====================================================================== commit f427645a17784deb20c17cb0c1b9ab5e6335b285 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu May 7 11:52:41 2009 +0200 Fixed sleep to be in one location. Files changed: scripts/radwatch.in | 29 +++++++++++++++++++++-------- 1 files changed, 21 insertions(+), 8 deletions(-) ====================================================================== commit f52f9b07fb8bda42e50216ec1fbf5ea805f20547 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu May 7 10:55:58 2009 +0200 Check before dereference Files changed: src/main/conffile.c | 8 ++++++-- 1 files changed, 6 insertions(+), 2 deletions(-) ====================================================================== commit 0493f4c74aa8047588d0df22683e0fcc8e3a146b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu May 7 10:43:27 2009 +0200 Add option "include_length" for TTLS, too. We've always set it to "yes" in the past, by inheriting the value from the TLS configuration. In contrast, PEAP always sets it to "no". However... RFC 5281 says that we should set it to "no". Since the previous code works with everyone, we don't want to change the defaults. But we DO add the flag that allows it to be RFC compliant.y Files changed: raddb/eap.conf | 5 +++++ .../rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c | 16 ++++++++++++++++ 2 files changed, 21 insertions(+), 0 deletions(-) ======================================================================

1 0