July 2009 - Freeradius-Devel - lists.freeradius.org

Missing TLS Change Cipher Spec and TLS Finished in EAP-TLS exchanges
by arno＠natisbad.org 09 Jul '11

09 Jul '11

Hi, I upgraded an internal freeradius server (Linux, Debian unstable, libssl 0.9.8) used for EAP-TLS (802.11 WPA2 access) from 2.0.5 to 2.1.3. With 2.1.3, client authentication fails in the following way (wpasupplicant on Debian unstable, working with 2.0.5): - the TLS exchange is completed from freeradius point of view. It even sends the Access-Accept message to the NAS. - from the clients point of view, the TLS exchange is not over, it expects some more data from the server which are never sent. I took two pcap traces (sent to you privately, Alan), one with 2.0.5, one with 2.1.3. It looks like the TLS Change Cipher and TLS Tinished elements of the TLS exchange are not in the EAP encapsulated TLS packets sent by the server. Compare packet #23 of 2.1.3 trace with packet #27 of 2.0.5 trace. If you use wireshark, you will notice that the SSL layer is dissected; this is because #27 has a small brother: #29. It is not sent by 2.1.3. Alan, if you have an idea or a patch, I can test it on monday. Cheers, a+

5 15

eap2 in freeradius
by Chanthearith HUON 04 Apr '11

04 Apr '11

Hi everyone, I am testing eap2 in freeradius. I run "radiusd -X", I got following error message " radiusd: symbol lookup error: /usr/lib/rlm_eap2-2.1.0.so: undefined symbol: eap_server_register_methods " Anyone, have any idea what might be wrong with the configuration? Thank in advance, Thierry

5 10

make_passwd(), rlm_perl and double quotes in the password
by Niko Tyni 28 Jan '10

28 Jan '10

Hi, we're seeing failed logins when proxying authentication requests through to another RADIUS server if the password contains a double quote ("). I've debugged the issue a bit, and what happens is that when the password does a roundtrip through the rlm_perl module, the value pair structure ends up with extra bytes at the end so that strlen(vp->data.strvalue) > vp->length. These extra bytes are the result of escaping the double quote before entering the Perl code and then unescaping it afterwards. For instance, the password abcdef" is passed as abcdef\" to the Perl code, and afterwards it becomes abcdef"" with length 7 (so the extra byte is not supposed to hurt AIUI.) Unfortunately make_passwd() rounds 'inlen' up to a multiple of 16 before copying the input string, so the extra bytes end up in the message authenticator of the proxied request. It seems to me that the escaping and unescaping done in rlm_perl via perl_store_vps() -> vp_prints_value() -> librad_safeprint() and get_hv_content() -> pairadd_sv() -> pairmake() -> pairparsevalue() is a bit unnecessary, and that the unescaping could zero out the extra bytes, but the main bug is in make_passwd() IMO. I have reproduced this with a Debian 2.0.4 freeradius package, a Fedora 2.1.3 package, and a current git.freeradius.org checkout (commit ef2a7db5e). I'm attaching a proposed patch to make_passwd(). Please let me know if you need more information, I can easily produce stack traces and the like. Thanks for your work on FreeRADIUS, -- Niko Tyni ntyni(a)cc.helsinki.fi

3 5

Re: vmps request: long attribute VQP-Ethernet-Frame
by Hermann Lauer 05 Jan '10

05 Jan '10

Alan DeKok wrote: > > 0x0c05 is VQP-Ethernet-Frame, which can of course be longer than 253 bytes, > > so there is a design issue here. One idea would be to cut the attribute to > > 253 bytes in vqp_recv(). Could this be done there without memory issues ? > > Yes, if you're not interested in the rest of the data. appended is a patch which implemeted the cutting. Seems to work. Please tell me if anybody sees any pitfall in it. Otherwise it should be cleaned up, which I probably will do in a week or so. Thanks, Hermann -- Netzwerkadministration/Zentrale Dienste, Interdiziplinaeres Zentrum fuer wissenschaftliches Rechnen der Universitaet Heidelberg IWR; INF 368; 69120 Heidelberg; Tel: (06221)54-8236 Fax: -5224 Email: Hermann.Lauer(a)iwr.uni-heidelberg.de

2 5

FreeRadius + EAP-AKA support
by Kumar, Sunil 26 Nov '09

26 Nov '09

Hi, We are trying to use FreeRadius1.1.4 as authentication server for EAP-AKA implementation with our product toolkit. As per the RFC 4187 AT_RES The value field of this attribute begins with the 2-byte RES Length, which identifies the exact length of the RES in bits. The RES length is followed by the AKA RES parameter. According to [TS33.105], the length of the AKA RES can vary between 32 and 128 bits. Because the length of the AT_RES attribute must be a multiple of 4 bytes, the sender pads the RES with zero bits where necessary. In the freeradius1.1.4 implementation, for EAP-AKA the value of RES length is always considered as constant EAPSIM_RES_SIZE (16). It doesn't take care of the values other than 16 bytes. We in our toolkit needs to support all the variable length of RES values from 32 bits (4 bytes) to 128 bits (16 bytes). So I have modified the FreeRadius implementation for the same support. The intention of writing such mail is to get the information that if somebody has already noticed and fixed this issue in the latest releases, so please share that information as well. In case it's not been fixed as yet, then may be I could contribute my patch for freeradius 1.1.4 version to support all variable length RES value varying from 32 bits to 128 bits. Thanks. Warm regards. Sunil Kumar The information contained in this electronic mail transmission may be privileged and confidential, and therefore, protected from disclosure. If you have received this communication in error, please notify us immediately by replying to this message and deleting it from your computer without copying or disclosing it.

4 5

ChangeLog for 2.1.6 question: Make rlm_perl keep tags for tagged attributes in more situations
by Alexandr Kovalenko 18 Aug '09

18 Aug '09

Hello, I've read ChangeLog for FreeRADIUS 2.1.6 and found there: # Make rlm_perl keep tags for tagged attributes in more situations Could anyone please point me to exact commits/diffs so I can see if this will fix my issue with tagged attributes, which I experienced - tagged attributes ERX-Service-Activate, ERX-Service-Statistics and similar were sent back to NAS without tags. I had to switch to rlm_python because of this, which is workaround for me, as long as everything here works using perl, and only this module uses python. Thanks in advance. -- Alexandr Kovalenko http://uafug.org.ua/

2 3

udpfromto works for the server but not from radclient
by Joe Maimon 11 Aug '09

11 Aug '09

The server operates properly and returns responses from the correct ip addresses out of multiple on the server, but the radtest client refuses to run and returns radclient: socket: cannot initialize udpfromto: Function not implemented The server does not operate correctly when built without udpfromto. The system is a current testing debian and the package is a custom rebuild based on the current git source. Thanks, Joe

2 7

Patch for raddb/sql/mysql/ippool.conf
by Chris Moules 11 Aug '09

11 Aug '09

Sorry this is not a GIT patch. Here are two minor fixes to the MySQL ippool.conf file. 1) A Syntax correction for the alternative 'allocate-find' query. 2) There was an issue with the 'start-update' query updating more than it should. I am using IMSI codes as my pool-key. In the case that a phone disconnects, but no Acct-Stop is received the expiry_time is updated every time that this phone reconnects as only the NAS and the pool-key are used as update limiters. By including at least the framedipaddress this is solved. As both the 'stop-clear' and 'alive-update' sections are using the 3 additional qualifiers, it makes sense to use them here too. (I see no reason no to). Regards Chris --- ippool.conf.orig 2009-07-31 15:16:38.000000000 +0200 +++ ippool.conf 2009-07-31 15:17:57.000000000 +0200 @@ -39,7 +39,7 @@ # ## use this query instead # allocate-find = "SELECT framedipaddress FROM ${ippool_table} \ # WHERE pool_name = '%{control:Pool-Name}' \ -# AND expiry_time = NULL \ +# AND expiry_time IS NULL \ # ORDER BY RAND() \ # LIMIT 1 \ # FOR UPDATE" @@ -67,7 +67,10 @@ ## START record arrives start-update = "UPDATE ${ippool_table} \ SET expiry_time = NOW() + INTERVAL ${lease-duration} SECOND \ - WHERE nasipaddress = '%{NAS-IP-Address}' AND pool_key = '${pool-key}'" + WHERE nasipaddress = '%{NAS-IP-Address}' AND pool_key = '${pool-key}' \ + AND username = '%{User-Name}' \ + AND callingstationid = '%{Calling-Station-Id}' \ + AND framedipaddress = '%{Framed-IP-Address}'" ## This series of queries frees an IP number when an accounting ## STOP record arrives

2 2

GIT Log for 2009-07-30 23:33 GMT
by aland＠deployingradius.com 30 Jul '09

30 Jul '09

commit 4412c8bde4d6f12393f1246847fe64b5962a4374 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Jul 29 17:32:23 2009 +0200 As posted to bug #7 Files changed: share/dictionary | 1 + share/dictionary.iea | 15 +++++++++++++++ 2 files changed, 16 insertions(+), 0 deletions(-) ====================================================================== commit 71c41a6865d48892b97b32bb6e2e26958d312283 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Jul 29 17:30:20 2009 +0200 Log reasons for failure. Closes bug #8 Files changed: src/modules/rlm_eap/rlm_eap.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) ======================================================================

1 0

GIT Log for 2009-07-29 23:33 GMT
by aland＠deployingradius.com 29 Jul '09

29 Jul '09

commit 6eab3d7e64586dd467041174eb3eb193ceb4f07c Author: Boian Jordanov <boianjordanov(a)dhcp-120.staff.orbitel.bg> Date: Wed Jul 29 10:56:54 2009 +0300 Moved pthread keys to the "perl_inst" struct. Keys are allocated per thread, and not via pthread_once. src/modules/rlm_perl/rlm_perl.c | 31 ++++++++++++++++++------------- 1 files changed, 18 insertions(+), 13 deletions(-)

1 0

GIT Log for 2009-07-27 23:33 GMT
by aland＠deployingradius.com 27 Jul '09

27 Jul '09

commit a6e2def7a1d006204a9d749c78b578c370f5ec43 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Jul 27 10:04:44 2009 +0200 Move chown to place where it checks for log file existence Files changed: src/main/mainconfig.c | 10 +++++----- 1 files changed, 5 insertions(+), 5 deletions(-) ====================================================================== commit 97b9cf33b8fa38cd90b1fa181c657bbab4bef29b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Jul 27 09:56:48 2009 +0200 Don't increment total_requests for proxied packets This causes double counting. Instead, only touch outstanding_requests which is protected by the proxy mutex Files changed: src/main/event.c | 1 - 1 files changed, 0 insertions(+), 1 deletions(-) ====================================================================== commit 2287c37549a935ef0d7e51a27d41484e1f039be5 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Jul 27 09:50:55 2009 +0200 Set state to RUNNING when proxying fails Files changed: src/main/event.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) ====================================================================== commit d0b0d78cb50387ee8002c34f783fab56f2ff0ccf Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Jul 27 09:34:48 2009 +0200 Make %l work Files changed: src/main/xlat.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 66ce895afd2021e74aab27e0703181225c9b290d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Jul 27 09:33:33 2009 +0200 Fix use of memset. This closes bug #6 Files changed: src/modules/frs_dhcp/dhcp.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ======================================================================

1 0

freeradius -X aborts on chown of log file
by Joe Maimon 27 Jul '09

27 Jul '09

current git apparently mainconfig.c is missing a check for null before trying to chown logfile.

2 1

Module for FreeRADIUS wirtten in C++
by krzychk2 21 Jul '09

21 Jul '09

Hi. I have written a module for FreeRADIUS in C++. Now I have a big problem with compilation. When I am trying to compile the attached file by g++ and I have the following error: g++ -D_POSIX_PTHREAD_SEMANTICS -D_REENTRANT -D_GNU_SOURCE -DNDEBUG -I/usr/local/include -I/usr/include/mysql++ -I/usr/include/mysql -O2 -g -Wall -c -fmessage-length=0 -MMD -MP -MF"src/rlm_tokensms.d" -MT"src/rlm_tokensms.d" -o"src/rlm_tokensms.o" "../src/rlm_tokensms.cpp" In file included from /usr/local/include/freeradius/radiusd.h:30, from ../src/rlm_tokensms.cpp:18: /usr/local/include/freeradius/libradius.h:160: error: expected type-specifier before ‘;’ token /usr/local/include/freeradius/libradius.h:338: error: expected ‘,’ or ‘...’ before ‘operator’ In file included from /usr/local/include/freeradius/radiusd.h:33, from ../src/rlm_tokensms.cpp:18: /usr/local/include/freeradius/conffile.h:94: error: expected ‘,’ or ‘...’ before ‘template’ In file included from ../src/rlm_tokensms.cpp:18: /usr/local/include/freeradius/radiusd.h:243: error: declaration of ‘home_server* auth_req::home_server’ /usr/local/include/freeradius/realms.h:85: error: changes meaning of ‘home_server’ from ‘typedef struct home_server home_server’ /usr/local/include/freeradius/radiusd.h:577: error: expected ‘,’ or ‘...’ before ‘operator’ I am googling about the proper way of compilation values but the only topics I have found, were from year 2002. I am not familiar with mixing C with C++ so I would like to ask You for help. I do not want to rewrite my code for C, because it will be such a loss of my work. -- krzychk2 <krzychk2(a)tlen.pl>

4 6

Framed-IP-Address - Framed-Route filter
by Gabriel Blanchard 21 Jul '09

21 Jul '09

I'm fairly sure this functionality currently doesn't exist so I'll ask. I checked the code already for rlm_attribute_filter and it definitely doesn't do it. I'm trying to setup radius so that I can filter proxy responses with subnets that don't belong to them, right now the module only appears to support direct matches. I can't specify something like "anything within this /24 is allowed". It would probably be easier to simply code a module but that would mean repeating configuration regarding realms so it would probably make more sense if it would be part of proxy.conf. I'm thinking a configuration like below would make sense. filter filter1 { subnet "10.10.10.0/24" accept } filter filter1 { subnet "10.10.10.0/24" deny } filter_list filter_foo { filter filter1 filter filter2 } realm test.com { pool = foo filter_list = filter_foo }

1 0

GIT Log for 2009-07-17 23:33 GMT
by aland＠deployingradius.com 17 Jul '09

17 Jul '09

commit de3071dc86cf5a3957116a8eacbb7f4106c47146 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Jul 17 16:07:33 2009 +0200 suid down earlier, ensure log files have correct ownership Files changed: src/main/mainconfig.c | 95 +++++++++++++++++++++++++------------------------ 1 files changed, 48 insertions(+), 47 deletions(-) ====================================================================== commit b08e96509725a992e114e4a5f6bd6ad58733598a Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Jul 17 14:45:15 2009 +0200 Move zombie checks to later so other rules apply, too Files changed: src/main/realms.c | 23 ++++++++++++----------- 1 files changed, 12 insertions(+), 11 deletions(-) ====================================================================== commit d5e5d7c11d45e9eb663d0cad60cd49548c8a5f5d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Jul 17 14:33:23 2009 +0200 Allow requests to fail over to live servers earlier Files changed: raddb/proxy.conf | 38 +++++++++++++++++++++++++++++--------- src/include/realms.h | 1 + src/main/event.c | 24 ++++++++++++++++-------- src/main/realms.c | 21 +++++++++++++++++++++ 4 files changed, 67 insertions(+), 17 deletions(-) ======================================================================

1 0

lowercase User-Name
by Gabriel Blanchard 16 Jul '09

16 Jul '09

We just upgraded all 3 of our radius servers from 1.x to 2.x and noticed that freeradius 2.x is case sensitive for the User-Name attribute. I've searched the mailing list and found that the only "hack" available is to run a perl script as a module that lowercases the username. Yes I understand that I really shouldn't be doing this in the first place but this caught me off guard so I had to get it going with the perl script. Anyways, is there any better option? Should I just submit a patch that would allow to give the option to lowercase it like 1.x used to do? (As far as I can tell anyway). -Gabe

1 0

GIT Log for 2009-07-15 23:33 GMT
by aland＠deployingradius.com 15 Jul '09

15 Jul '09

commit 2b532cf476389348426c0c2654c3ea601b1a69db Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Jul 15 15:37:54 2009 +0200 Added wildcard to sub-dirs So that you can delete directories you don't need after configure Files changed: Makefile | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 8083ba93f4df140c492fd3759cb1e0b1c2d981a8 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Jul 15 12:04:54 2009 +0200 Fix typo Files changed: src/modules/frs_dhcp/frs_dhcp.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 23ebb8eecb275baf7f5301ce20d5d5e14c5cc2d0 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Jul 15 11:04:47 2009 +0200 Better handle variable that isn't in the module instance This kind of thing should be discouraged... Files changed: src/modules/rlm_sql/rlm_sql.c | 7 ++++++- 1 files changed, 6 insertions(+), 1 deletions(-) ======================================================================

1 0

rlm_sqlite
by Gabriel Blanchard 15 Jul '09

15 Jul '09

Just submitted bug #3 ...Did you guys have a problem with bugzilla? Anyway, added a couple little things. The db name is no longer static, can be defined using sql { sql_file = "foo123" } Code checks if the file actually exists instead of dumbly touch'ing one without any content. And added a few more error checks. Anyway. A few questions. I plan on adding a few more features in the module such as supporting the "v2" functions of sqlite. Would that be welcome? Also, how to I make radiusd fail to launch if it's unable to open the database? I'm returning -1 but it still goes ahead and launches. Gabriel Blanchard Network Administrator/Development TekSavvy Solutions Inc. 330 Richmond Street, Suite 205 Chatham, ON, N7M 1P7 T: 519-360-4705 C: 519-437-0564

3 7

sql.c
by Gabriel Blanchard 15 Jul '09

15 Jul '09

While coding the rlm_sql_sqlite module I found that even though it fails to "connect" to the database it doesn't stop Freeradius from launching. While I understand that once it's started it may need to reconnect, would it not be a good behavior to stop execution under sql_init_socketpool() ? if (!success) { radlog(L_DBG, "rlm_sql (%s): Failed to connect to any SQL server.", inst->config->xlat_name); } Why not return -1 here within this block?

2 3

possible bug on HUP (2.1.6)
by Stefan Winter 15 Jul '09

15 Jul '09

Hi, after upgrading my FreeRADIUS installation to 2.1.6, I tried SIGHUP and got a SIGSEGV back :-/ It didn't happen immediately, but only after the next auth attempt was processed. I have attached my virtual server "Monitoring" - this is the spot in the server where I changed something; the password for this User-Name was changed. Before changing that password and HUPing, auth worked consistently. I attached with gdb to find out what's wrong, the bt is at the end: it failed while xlat'ing User-Name for an sql relay. That's really surprising because I didn't change the User-Name, only the control item Cleartext-Password. Greetings, Stefan Winter ######### virtual server config server Monitoring { authorize { update request { RESTENA-Service-Type := "Nagios-Monitoring" } if ( User-Name == "testuser.monitor(a)testrealm.lu" ) { update control { Cleartext-Password := "obfuscated" <------------ this is what I changed } } auth_log # users.Nagios pap } authenticate { pap } preacct { } accounting { } session { } post-auth { reply_log sql_relay_main Post-Auth-Type REJECT { reply_log sql_relay_main } } pre-proxy { } post-proxy { } } ########### gdb session with bt Program received signal SIGHUP, Hangup. 0xb7f9a424 in __kernel_vsyscall () (gdb) c Continuing. Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0xb79d4b90 (LWP 7097)] 0xb7c48073 in strchr () from /lib/libc.so.6 (gdb) bt #0 0xb7c48073 in strchr () from /lib/libc.so.6 #1 0xb71bae13 in sql_escape_func (out=0xb79d27d0 "", outlen=3964, in=0xb79d1d34 "testuser.monitor(a)testrealm.lu") at rlm_sql_log.c:160 #2 0x08067a42 in valuepair2str (out=0xb79d27d0 "", outlen=3964, pair=0x8d0c3b8, type=0, func=0xb71bad80 <sql_escape_func>) at xlat.c:72 #3 0x08069532 in xlat_packet (instance=0x807d9a4, request=0x8d0bcb0, fmt=0xb79d2414 "User-Name", out=0xb79d27d0 "", outlen=3964, func=0xb71bad80 <sql_escape_func>) at xlat.c:383 #4 0x08068887 in radius_xlat (out=0xb79d274c "INSERT INTO radpostauth", ' ' <repeats 37 times>, "(id, user, pass, reply, date)", ' ' <repeats 30 times>, "VALUES ('', '", outlen=4096, fmt=0x8d0d568 "INSERT INTO radpostauth", ' ' <repeats 37 times>, "(id, user, pass, reply, date)", ' ' <repeats 30 times>, "VALUES ('', '%{User-Name}', '%{RESTENA-Service-Type}', '%{reply:Packet-Type}', '%"..., request=0x8d0bcb0, func=0xb71bad80 <sql_escape_func>) at xlat.c:911 #5 0xb71bac38 in sql_xlat_query (inst=0xb79d261e, request=0x8d0bcb0, query=0x8d0d568 "INSERT INTO radpostauth", ' ' <repeats 37 times>, "(id, user, pass, reply, date)", ' ' <repeats 30 times>, "VALUES ('', '%{User-Name}', '%{RESTENA-Service-Type}', '%{reply:Packet-Type}', '%"..., xlat_query=0xb79d274c "INSERT INTO radpostauth", ' ' <repeats 37 times>, "(id, user, pass, reply, date)", ' ' <repeats 30 times>, "VALUES ('', '", len=4096) at rlm_sql_log.c:258 #6 0xb71bb187 in sql_log_postauth (instance=0x8c53a40, request=0x8d0bcb0) at rlm_sql_log.c:398 #7 0x08062bd8 in modcall (component=7, c=0x8d2af90, request=0x8d0bcb0) at modcall.c:286 #8 0x0805f782 in indexed_modcall (comp=7, idx=13835320, request=0x8d0bcb0) at modules.c:631 #9 0x0805f89c in module_post_auth (postauth_type=13835320, request=0x8d0bcb0) at modules.c:1452 #10 0x0804ee17 in rad_postauth (request=0x8d0bcb0) at auth.c:410 #11 0x0806d14d in request_post_handler (request=0x8d0bcb0) at event.c:2333 #12 0x0806d5b3 in radius_handle_request (request=0x8d0bcb0, fun=0x804ee60 <rad_authenticate>) at event.c:3652 #13 0x08065760 in request_handler_thread (arg=0x8ce21d8) at threads.c:492 #14 0xb7f2f1b5 in start_thread () from /lib/libpthread.so.0 #15 0xb7ca638e in clone () from /lib/libc.so.6 (gdb) -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

2 2

rlm_sqlite and sqlite3_step(), sqlite schema
by Ben West 15 Jul '09

15 Jul '09

Apologies for posting on the freeradius-user list about this. I serendipitously happened across this list's sqlite-related thread, and the related bugzilla entry, on very same day I was playing around with sqlite on v2.1.6 myself. https://bugs.freeradius.org/bugzilla/show_bug.cgi?id=3 An issue not addressed in the patch proposed in that bug entry is that the sql_sqlite.c apparently only invokes sqlite3_step() in its function sql_fetch_row(), which AFAIK is only called for SELECT queries. This has the effect of UPDATE, DELETE, INSERT queries being compiled but never executed. Below is the kludge I did to to sql_query() to get around this, but it does not account for lower case or leading spaces in querystr. Since this happened in unwitting parallel, my version of sql_query() is out of step with the patch in bugzilla. static int sql_query(SQLSOCK * sqlsocket, SQL_CONFIG *config, char *querystr) { int status; rlm_sql_sqlite_sock *sqlite_sock = sqlsocket->conn; const char *zTail; if (config->sqltrace) radlog(L_DBG,"rlm_sql_sqlite: query: %s", querystr); if (sqlite_sock->pDb == NULL) { radlog(L_ERR, "rlm_sql_sqlite: Socket not connected"); return SQL_DOWN; } status = sqlite3_prepare(sqlite_sock->pDb, querystr, strlen(querystr), &sqlite_sock->pStmt, &zTail); radlog(L_DBG, "rlm_sql_sqlite: sqlite3_prepare() = %d\n", status); sqlite_sock->columnCount = 0; if (strstr(querystr, "SELECT") == querystr) { return (status == SQLITE_OK) ? 0 : SQL_DOWN; } /* If this is not SELECT statement, must go ahead and invoke sqlite3_step() */ else if (strstr(querystr, "INSERT") == querystr || strstr(querystr, "UPDATE") == querystr || strstr(querystr, "DELETE") == querystr ) { status = sqlite3_step(sqlite_sock->pStmt); radlog(L_DBG, "rlm_sql_sqlite: sqlite3_step = %d\n", status); return (status == SQLITE_DONE) ? 0 : SQL_DOWN; } } I also have versions of the schema and conf files for sqlite (i.e. raddb/sql/sqlite/*) but I wanted to ping the list first to make sure that is not already underway with someone else. -- Ben West westbywest(a)gmail.com

3 2

GIT Log for 2009-07-13 23:33 GMT
by aland＠deployingradius.com 13 Jul '09

13 Jul '09

commit eb0a6f2d9056916837bb76df9c6ab421d43d60c8 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Jul 13 16:23:06 2009 +0200 Allow response_window && zombie_period to be smaller. Accept values outside of the recommended range. Also when proxying, skip home servers that are marked zombie. They're not responding, so for *new* requests, we treat them like they're dead src/main/realms.c | 13 ++++++++----- 1 files changed, 8 insertions(+), 5 deletions(-)

1 0

EAP-TLS rfc 5216 support
by Fernando Pereñíguez 10 Jul '09

10 Jul '09

Dear all, I'm interested in testing last version of EAP-TLS defined in RFC 5216, that optionally supports a privacy mode where the client certificate is pushed through the SSL tunnel. Does current FreeRadius version support this version? If it does not, when it's expected to support it? Regards, Fernando.

2 1

GIT Log for 2009-07-09 23:33 GMT
by aland＠deployingradius.com 09 Jul '09

09 Jul '09

commit bae3836b726c3abf6d246bca9c36cb3671bd1466 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Jul 9 15:00:06 2009 +0200 Fix for newer versions of MySQL Files changed: raddb/sql/mysql/wimax.sql | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 9cea08f3927b660102772d4d2dc910e94dd0ea89 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Jul 9 10:46:14 2009 +0200 Use postgresl style comments Based on patch from Wickert Akkerman Files changed: raddb/sql/postgresql/admin.sql | 54 +++++++++++++++++++++------------------ 1 files changed, 29 insertions(+), 25 deletions(-) ======================================================================

1 0

postgres admin.sql fixes
by Wichert Akkerman 09 Jul '09

09 Jul '09

The postgresql/admin.sql that ships in current Debian stable unfortunately does not work: psql does not accept the comment syntax used, host/domain names in roles or database names in columns for GRANT statements. The attached patch below fixes this. There may still be problems with missing GRANTs for the sequences, I'll recheck those tomorrow. This might of course all be fixes in the current sourcetree, in which case I apologize for the noise. Wichert.

3 3