July 2009 - Freeradius-Devel - lists.freeradius.org

GIT Log for 2009-07-27 23:33 GMT
by aland＠deployingradius.com 27 Jul '09

27 Jul '09

commit a6e2def7a1d006204a9d749c78b578c370f5ec43 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Jul 27 10:04:44 2009 +0200 Move chown to place where it checks for log file existence Files changed: src/main/mainconfig.c | 10 +++++----- 1 files changed, 5 insertions(+), 5 deletions(-) ====================================================================== commit 97b9cf33b8fa38cd90b1fa181c657bbab4bef29b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Jul 27 09:56:48 2009 +0200 Don't increment total_requests for proxied packets This causes double counting. Instead, only touch outstanding_requests which is protected by the proxy mutex Files changed: src/main/event.c | 1 - 1 files changed, 0 insertions(+), 1 deletions(-) ====================================================================== commit 2287c37549a935ef0d7e51a27d41484e1f039be5 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Jul 27 09:50:55 2009 +0200 Set state to RUNNING when proxying fails Files changed: src/main/event.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) ====================================================================== commit d0b0d78cb50387ee8002c34f783fab56f2ff0ccf Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Jul 27 09:34:48 2009 +0200 Make %l work Files changed: src/main/xlat.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 66ce895afd2021e74aab27e0703181225c9b290d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Jul 27 09:33:33 2009 +0200 Fix use of memset. This closes bug #6 Files changed: src/modules/frs_dhcp/dhcp.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ======================================================================

1 0

freeradius -X aborts on chown of log file
by Joe Maimon 27 Jul '09

27 Jul '09

current git apparently mainconfig.c is missing a check for null before trying to chown logfile.

2 1

Module for FreeRADIUS wirtten in C++
by krzychk2 21 Jul '09

21 Jul '09

Hi. I have written a module for FreeRADIUS in C++. Now I have a big problem with compilation. When I am trying to compile the attached file by g++ and I have the following error: g++ -D_POSIX_PTHREAD_SEMANTICS -D_REENTRANT -D_GNU_SOURCE -DNDEBUG -I/usr/local/include -I/usr/include/mysql++ -I/usr/include/mysql -O2 -g -Wall -c -fmessage-length=0 -MMD -MP -MF"src/rlm_tokensms.d" -MT"src/rlm_tokensms.d" -o"src/rlm_tokensms.o" "../src/rlm_tokensms.cpp" In file included from /usr/local/include/freeradius/radiusd.h:30, from ../src/rlm_tokensms.cpp:18: /usr/local/include/freeradius/libradius.h:160: error: expected type-specifier before ‘;’ token /usr/local/include/freeradius/libradius.h:338: error: expected ‘,’ or ‘...’ before ‘operator’ In file included from /usr/local/include/freeradius/radiusd.h:33, from ../src/rlm_tokensms.cpp:18: /usr/local/include/freeradius/conffile.h:94: error: expected ‘,’ or ‘...’ before ‘template’ In file included from ../src/rlm_tokensms.cpp:18: /usr/local/include/freeradius/radiusd.h:243: error: declaration of ‘home_server* auth_req::home_server’ /usr/local/include/freeradius/realms.h:85: error: changes meaning of ‘home_server’ from ‘typedef struct home_server home_server’ /usr/local/include/freeradius/radiusd.h:577: error: expected ‘,’ or ‘...’ before ‘operator’ I am googling about the proper way of compilation values but the only topics I have found, were from year 2002. I am not familiar with mixing C with C++ so I would like to ask You for help. I do not want to rewrite my code for C, because it will be such a loss of my work. -- krzychk2 <krzychk2(a)tlen.pl>

4 6

Framed-IP-Address - Framed-Route filter
by Gabriel Blanchard 21 Jul '09

21 Jul '09

I'm fairly sure this functionality currently doesn't exist so I'll ask. I checked the code already for rlm_attribute_filter and it definitely doesn't do it. I'm trying to setup radius so that I can filter proxy responses with subnets that don't belong to them, right now the module only appears to support direct matches. I can't specify something like "anything within this /24 is allowed". It would probably be easier to simply code a module but that would mean repeating configuration regarding realms so it would probably make more sense if it would be part of proxy.conf. I'm thinking a configuration like below would make sense. filter filter1 { subnet "10.10.10.0/24" accept } filter filter1 { subnet "10.10.10.0/24" deny } filter_list filter_foo { filter filter1 filter filter2 } realm test.com { pool = foo filter_list = filter_foo }

1 0

GIT Log for 2009-07-17 23:33 GMT
by aland＠deployingradius.com 17 Jul '09

17 Jul '09

commit de3071dc86cf5a3957116a8eacbb7f4106c47146 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Jul 17 16:07:33 2009 +0200 suid down earlier, ensure log files have correct ownership Files changed: src/main/mainconfig.c | 95 +++++++++++++++++++++++++------------------------ 1 files changed, 48 insertions(+), 47 deletions(-) ====================================================================== commit b08e96509725a992e114e4a5f6bd6ad58733598a Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Jul 17 14:45:15 2009 +0200 Move zombie checks to later so other rules apply, too Files changed: src/main/realms.c | 23 ++++++++++++----------- 1 files changed, 12 insertions(+), 11 deletions(-) ====================================================================== commit d5e5d7c11d45e9eb663d0cad60cd49548c8a5f5d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Jul 17 14:33:23 2009 +0200 Allow requests to fail over to live servers earlier Files changed: raddb/proxy.conf | 38 +++++++++++++++++++++++++++++--------- src/include/realms.h | 1 + src/main/event.c | 24 ++++++++++++++++-------- src/main/realms.c | 21 +++++++++++++++++++++ 4 files changed, 67 insertions(+), 17 deletions(-) ======================================================================

1 0

lowercase User-Name
by Gabriel Blanchard 16 Jul '09

16 Jul '09

We just upgraded all 3 of our radius servers from 1.x to 2.x and noticed that freeradius 2.x is case sensitive for the User-Name attribute. I've searched the mailing list and found that the only "hack" available is to run a perl script as a module that lowercases the username. Yes I understand that I really shouldn't be doing this in the first place but this caught me off guard so I had to get it going with the perl script. Anyways, is there any better option? Should I just submit a patch that would allow to give the option to lowercase it like 1.x used to do? (As far as I can tell anyway). -Gabe

1 0

GIT Log for 2009-07-15 23:33 GMT
by aland＠deployingradius.com 15 Jul '09

15 Jul '09

commit 2b532cf476389348426c0c2654c3ea601b1a69db Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Jul 15 15:37:54 2009 +0200 Added wildcard to sub-dirs So that you can delete directories you don't need after configure Files changed: Makefile | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 8083ba93f4df140c492fd3759cb1e0b1c2d981a8 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Jul 15 12:04:54 2009 +0200 Fix typo Files changed: src/modules/frs_dhcp/frs_dhcp.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 23ebb8eecb275baf7f5301ce20d5d5e14c5cc2d0 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Jul 15 11:04:47 2009 +0200 Better handle variable that isn't in the module instance This kind of thing should be discouraged... Files changed: src/modules/rlm_sql/rlm_sql.c | 7 ++++++- 1 files changed, 6 insertions(+), 1 deletions(-) ======================================================================

1 0

rlm_sqlite
by Gabriel Blanchard 15 Jul '09

15 Jul '09

Just submitted bug #3 ...Did you guys have a problem with bugzilla? Anyway, added a couple little things. The db name is no longer static, can be defined using sql { sql_file = "foo123" } Code checks if the file actually exists instead of dumbly touch'ing one without any content. And added a few more error checks. Anyway. A few questions. I plan on adding a few more features in the module such as supporting the "v2" functions of sqlite. Would that be welcome? Also, how to I make radiusd fail to launch if it's unable to open the database? I'm returning -1 but it still goes ahead and launches. Gabriel Blanchard Network Administrator/Development TekSavvy Solutions Inc. 330 Richmond Street, Suite 205 Chatham, ON, N7M 1P7 T: 519-360-4705 C: 519-437-0564

3 7

sql.c
by Gabriel Blanchard 15 Jul '09

15 Jul '09

While coding the rlm_sql_sqlite module I found that even though it fails to "connect" to the database it doesn't stop Freeradius from launching. While I understand that once it's started it may need to reconnect, would it not be a good behavior to stop execution under sql_init_socketpool() ? if (!success) { radlog(L_DBG, "rlm_sql (%s): Failed to connect to any SQL server.", inst->config->xlat_name); } Why not return -1 here within this block?

2 3

possible bug on HUP (2.1.6)
by Stefan Winter 15 Jul '09

15 Jul '09

Hi, after upgrading my FreeRADIUS installation to 2.1.6, I tried SIGHUP and got a SIGSEGV back :-/ It didn't happen immediately, but only after the next auth attempt was processed. I have attached my virtual server "Monitoring" - this is the spot in the server where I changed something; the password for this User-Name was changed. Before changing that password and HUPing, auth worked consistently. I attached with gdb to find out what's wrong, the bt is at the end: it failed while xlat'ing User-Name for an sql relay. That's really surprising because I didn't change the User-Name, only the control item Cleartext-Password. Greetings, Stefan Winter ######### virtual server config server Monitoring { authorize { update request { RESTENA-Service-Type := "Nagios-Monitoring" } if ( User-Name == "testuser.monitor(a)testrealm.lu" ) { update control { Cleartext-Password := "obfuscated" <------------ this is what I changed } } auth_log # users.Nagios pap } authenticate { pap } preacct { } accounting { } session { } post-auth { reply_log sql_relay_main Post-Auth-Type REJECT { reply_log sql_relay_main } } pre-proxy { } post-proxy { } } ########### gdb session with bt Program received signal SIGHUP, Hangup. 0xb7f9a424 in __kernel_vsyscall () (gdb) c Continuing. Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0xb79d4b90 (LWP 7097)] 0xb7c48073 in strchr () from /lib/libc.so.6 (gdb) bt #0 0xb7c48073 in strchr () from /lib/libc.so.6 #1 0xb71bae13 in sql_escape_func (out=0xb79d27d0 "", outlen=3964, in=0xb79d1d34 "testuser.monitor(a)testrealm.lu") at rlm_sql_log.c:160 #2 0x08067a42 in valuepair2str (out=0xb79d27d0 "", outlen=3964, pair=0x8d0c3b8, type=0, func=0xb71bad80 <sql_escape_func>) at xlat.c:72 #3 0x08069532 in xlat_packet (instance=0x807d9a4, request=0x8d0bcb0, fmt=0xb79d2414 "User-Name", out=0xb79d27d0 "", outlen=3964, func=0xb71bad80 <sql_escape_func>) at xlat.c:383 #4 0x08068887 in radius_xlat (out=0xb79d274c "INSERT INTO radpostauth", ' ' <repeats 37 times>, "(id, user, pass, reply, date)", ' ' <repeats 30 times>, "VALUES ('', '", outlen=4096, fmt=0x8d0d568 "INSERT INTO radpostauth", ' ' <repeats 37 times>, "(id, user, pass, reply, date)", ' ' <repeats 30 times>, "VALUES ('', '%{User-Name}', '%{RESTENA-Service-Type}', '%{reply:Packet-Type}', '%"..., request=0x8d0bcb0, func=0xb71bad80 <sql_escape_func>) at xlat.c:911 #5 0xb71bac38 in sql_xlat_query (inst=0xb79d261e, request=0x8d0bcb0, query=0x8d0d568 "INSERT INTO radpostauth", ' ' <repeats 37 times>, "(id, user, pass, reply, date)", ' ' <repeats 30 times>, "VALUES ('', '%{User-Name}', '%{RESTENA-Service-Type}', '%{reply:Packet-Type}', '%"..., xlat_query=0xb79d274c "INSERT INTO radpostauth", ' ' <repeats 37 times>, "(id, user, pass, reply, date)", ' ' <repeats 30 times>, "VALUES ('', '", len=4096) at rlm_sql_log.c:258 #6 0xb71bb187 in sql_log_postauth (instance=0x8c53a40, request=0x8d0bcb0) at rlm_sql_log.c:398 #7 0x08062bd8 in modcall (component=7, c=0x8d2af90, request=0x8d0bcb0) at modcall.c:286 #8 0x0805f782 in indexed_modcall (comp=7, idx=13835320, request=0x8d0bcb0) at modules.c:631 #9 0x0805f89c in module_post_auth (postauth_type=13835320, request=0x8d0bcb0) at modules.c:1452 #10 0x0804ee17 in rad_postauth (request=0x8d0bcb0) at auth.c:410 #11 0x0806d14d in request_post_handler (request=0x8d0bcb0) at event.c:2333 #12 0x0806d5b3 in radius_handle_request (request=0x8d0bcb0, fun=0x804ee60 <rad_authenticate>) at event.c:3652 #13 0x08065760 in request_handler_thread (arg=0x8ce21d8) at threads.c:492 #14 0xb7f2f1b5 in start_thread () from /lib/libpthread.so.0 #15 0xb7ca638e in clone () from /lib/libc.so.6 (gdb) -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

2 2