August 2009 - Freeradius-Devel - lists.freeradius.org

GIT Log for 2009-08-17 23:33 GMT
by aland＠deployingradius.com 17 Aug '09

17 Aug '09

commit 9ce175f1d8fea11bf66cd84b5b2c99f832097786 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Aug 17 14:25:57 2009 +0200 Add notes on SHA1 versus MD5 Files changed: raddb/certs/README | 14 ++++++++++++++ 1 files changed, 14 insertions(+), 0 deletions(-) ====================================================================== commit d56fa223b90a4370d5b6200d97d6373cdb97b36e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Aug 17 12:14:01 2009 +0200 Allow "no response" to DHCPy Files changed: src/modules/frs_dhcp/frs_dhcp.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) ====================================================================== commit 08baab6769fea367bda5dd006b659621bb9aac18 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Aug 17 08:53:47 2009 +0200 Catch non-fatal race conditions Files changed: src/main/event.c | 11 +++++++++++ 1 files changed, 11 insertions(+), 0 deletions(-) ======================================================================

1 0

Seg fault
by Gabriel Blanchard 17 Aug '09

17 Aug '09

Something was committed recently that's causing it to seg fault. Aug 15 21:41:42 rad03 radiusd[62455]: Received conflicting packet from client ERXes port 50000 - ID: 98 due to unfinished request 390. Giving up on old request. Aug 15 21:41:42 rad03 radiusd[62455]: ASSERT FAILED event.c[2730]: request->ev != NULL Aug 15 21:41:42 rad03 kernel: pid 62455 (radiusd), uid 133: exited on signal 6 I'll have to dig up a bit deeper to find the cause, but this definitely doesn't happen with a stable snapshot from a few days ago.

2 3

GIT Log for 2009-08-15 23:33 GMT
by aland＠deployingradius.com 15 Aug '09

15 Aug '09

commit 43bc3e5369c3afc27f7a290cb58d660792729739 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Aug 15 07:45:05 2009 +0200 Fix typo in last commit src/lib/radius.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)

1 0

last commit
by Gabriel Blanchard 15 Aug '09

15 Aug '09

Alan, the last change you did yesterday appears to break shared secrets. commit c5967e80035e4fa2f66c22898a5cb7967e197c65 bsddev# radtest test(a)test.com test 127.0.0.1 1 blah Sending Access-Request of id 25 to 127.0.0.1 port 1812 ..... rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=25, length=56 rad_verify: Received Access-Accept packet from client 127.0.0.1 port 1812 with invalid signature (err=2)! (Shared secret is incorrect.) I then recompiled with the commit just before that 72547c293eb3981747e4dc8baf3849528fb6adcd and...no problem. bsddev# radtest test(a)test.com test 127.0.0.1 1 blah Sending Access-Request of id 228 to 127.0.0.1 port 1812 .... rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=228, length=56 I understand you may not be done yet with the patch...but anyway, that'll teach me for using the latest commit. -Gabe

2 3

GIT Log for 2009-08-14 23:33 GMT
by aland＠deployingradius.com 14 Aug '09

14 Aug '09

commit f29e167bb490404815001756427229d6a7bdf220 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Aug 14 14:53:24 2009 +0200 Chave the hash comparison algorithm to avoid timing attacks src/lib/radius.c | 26 +++++++++++++++++++++++--- 1 files changed, 23 insertions(+), 3 deletions(-)

1 0

GIT Log for 2009-08-13 23:33 GMT
by aland＠deployingradius.com 13 Aug '09

13 Aug '09

commit 90dc2e55a5ee9b5200499d11ded9add39091cca8 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Aug 13 10:06:03 2009 +0200 Internal functions should be static Files changed: .../rlm_sql/drivers/rlm_sql_freetds/sql_freetds.c | 9 ++++----- 1 files changed, 4 insertions(+), 5 deletions(-) ====================================================================== commit 8b00e9bac59185f545db91ed5a191543d3db12bc Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Aug 13 10:03:27 2009 +0200 Added query_timeout parameter. For now, it does nothing. It is therefore not documented, either. Files changed: src/modules/rlm_sql/conf.h | 1 + src/modules/rlm_sql/drivers/lib/.gitignore | 1 - src/modules/rlm_sql/rlm_sql.c | 6 ++++++ 3 files changed, 7 insertions(+), 1 deletions(-) ====================================================================== commit 60b8bb26bd10c548461b1a55f8fd969d3dfee3a7 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Aug 13 10:01:42 2009 +0200 Alpha version from Gabriel Blanchard Files changed: .../rlm_sql/drivers/rlm_sql_freetds/sql_freetds.c | 363 ++++++++++++++++++++ 1 files changed, 363 insertions(+), 0 deletions(-) ======================================================================

1 0

Re: Free Radius Compilation Error on RHEL5.3
by Gabriel Blanchard 13 Aug '09

13 Aug '09

On 13-Aug-09, at 7:38 AM, Kamal Garg wrote: > /usr/include/argz.h:181: internal compiler error: Segmentation fault > Please submit a full bug report, > with preprocessed source if appropriate. > See <URL:http://bugzilla.redhat.com/bugzilla> for instructions. > Preprocessed source stored into /tmp/ccYFkazU.out file, please > attach this to your bugreport. I would probably file a report there, not here. Since it's the compiler that's Seg faulting...not good. > [root@VMWare freeradius-server-2.1.6]# gcc version > gcc: version: No such file or directory > gcc: no input files is gcc version "No such file or directory" a new release?... -Gabe

2 1

Free Radius Compilation Error on RHEL5.3
by Kamal Garg 13 Aug '09

13 Aug '09

Hi, I am facing problem while making freeradius-server-2.1.6 on RHEL5.3, however I am able to successfully build and install the freeradius-server-2.1.6 on RHEL4.0. Following are the error logs I am getting while building freeradius server on RHEL5.3. [root@VMWare freeradius-server-2.1.6]# make gmake[1]: Entering directory `/home/freeradius-server-2.1.6' Making all in libltdl... gmake[2]: Entering directory `/home/freeradius-server-2.1.6/libltdl' /usr/bin/gmake all-am gmake[3]: Entering directory `/home/freeradius-server-2.1.6/libltdl' /bin/sh ./libtool --tag=CC --mode=compile gcc -DHAVE_CONFIG_H -I. -I. -I. -g -O2 -c -o ltdl.lo ltdl.c mkdir .libs gcc -DHAVE_CONFIG_H -I. -I. -I. -g -O2 -c ltdl.c -fPIC -DPIC -o .libs/ltdl.o ltdl.c: In function 'lt_dladderror': ltdl.c:967: warning: passing argument 4 of '__assert_fail' discards qualifiers from pointer target type ltdl.c: In function 'tryall_dlopen_module': ltdl.c:2482: warning: passing argument 4 of '__assert_fail' discards qualifiers from pointer target type ltdl.c:2483: warning: passing argument 4 of '__assert_fail' discards qualifiers from pointer target type ltdl.c:2484: warning: passing argument 4 of '__assert_fail' discards qualifiers from pointer target type ltdl.c: In function 'canonicalize_path': ltdl.c:2575: warning: passing argument 4 of '__assert_fail' discards qualifiers from pointer target type ltdl.c:2576: warning: passing argument 4 of '__assert_fail' discards qualifiers from pointer target type ltdl.c: In function 'argzize_path': ltdl.c:2639: warning: passing argument 4 of '__assert_fail' discards qualifiers from pointer target type ltdl.c:2640: warning: passing argument 4 of '__assert_fail' discards qualifiers from pointer target type ltdl.c:2641: warning: passing argument 4 of '__assert_fail' discards qualifiers from pointer target type ltdl.c: In function 'foreach_dirinpath': ltdl.c:2710: warning: passing argument 4 of '__assert_fail' discards qualifiers from pointer target type ltdl.c: In function 'find_file_callback': ltdl.c:2750: warning: passing argument 4 of '__assert_fail' discards qualifiers from pointer target type ltdl.c:2751: warning: passing argument 4 of '__assert_fail' discards qualifiers from pointer target type ltdl.c:2752: warning: passing argument 4 of '__assert_fail' discards qualifiers from pointer target type ltdl.c: In function 'try_dlopen': ltdl.c:3068: warning: passing argument 4 of '__assert_fail' discards qualifiers from pointer target type ltdl.c:3069: warning: passing argument 4 of '__assert_fail' discards qualifiers from pointer target type ltdl.c:3095: warning: passing argument 4 of '__assert_fail' discards qualifiers from pointer target type ltdl.c:3127: warning: passing argument 4 of '__assert_fail' discards qualifiers from pointer target type ltdl.c:3333: warning: passing argument 4 of '__assert_fail' discards qualifiers from pointer target type ltdl.c: In function 'lt_dlopenext': ltdl.c:3477: warning: passing argument 4 of '__assert_fail' discards qualifiers from pointer target type ltdl.c: In function 'lt_argz_insertinorder': ltdl.c:3606: warning: passing argument 4 of '__assert_fail' discards qualifiers from pointer target type ltdl.c:3607: warning: passing argument 4 of '__assert_fail' discards qualifiers from pointer target type ltdl.c:3608: warning: passing argument 4 of '__assert_fail' discards qualifiers from pointer target type ltdl.c: In function 'lt_argz_insertdir': ltdl.c:3636: warning: passing argument 4 of '__assert_fail' discards qualifiers from pointer target type ltdl.c:3637: warning: passing argument 4 of '__assert_fail' discards qualifiers from pointer target type ltdl.c:3638: warning: passing argument 4 of '__assert_fail' discards qualifiers from pointer target type ltdl.c:3672: warning: passing argument 4 of '__assert_fail' discards qualifiers from pointer target type ltdl.c: In function 'list_files_by_dir': ltdl.c:3697: warning: passing argument 4 of '__assert_fail' discards qualifiers from pointer target type ltdl.c:3698: warning: passing argument 4 of '__assert_fail' discards qualifiers from pointer target type ltdl.c:3699: warning: passing argument 4 of '__assert_fail' discards qualifiers from pointer target type ltdl.c:3700: warning: passing argument 4 of '__assert_fail' discards qualifiers from pointer target type ltdl.c: In function 'lt_dlpath_insertdir': ltdl.c:3993: warning: passing argument 4 of '__assert_fail' discards qualifiers from pointer target type ltdl.c:3994: warning: passing argument 4 of '__assert_fail' discards qualifiers from pointer target type ltdl.c:4002: warning: passing argument 4 of '__assert_fail' discards qualifiers from pointer target type ltdl.c:4007: warning: passing argument 4 of '__assert_fail' discards qualifiers from pointer target type ltdl.c:4008: warning: passing argument 4 of '__assert_fail' discards qualifiers from pointer target type ltdl.c:4017: warning: passing argument 4 of '__assert_fail' discards qualifiers from pointer target type ltdl.c:4032: warning: passing argument 4 of '__assert_fail' discards qualifiers from pointer target type ltdl.c:4033: warning: passing argument 4 of '__assert_fail' discards qualifiers from pointer target type /usr/include/argz.h: In function 'argz_next': /usr/include/argz.h:181: internal compiler error: Segmentation fault Please submit a full bug report, with preprocessed source if appropriate. See <URL:http://bugzilla.redhat.com/bugzilla> for instructions. Preprocessed source stored into /tmp/ccYFkazU.out file, please attach this to your bugreport. gmake[3]: *** [ltdl.lo] Error 1 gmake[3]: Leaving directory `/home/freeradius-server-2.1.6/libltdl' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/home/freeradius-server-2.1.6/libltdl' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/home/freeradius-server-2.1.6' make: *** [all] Error 2 [root@VMWare freeradius-server-2.1.6]# gcc version gcc: version: No such file or directory gcc: no input files Is there any compatibility issues between freeradius and RHEL5.3? Is there any way out to successfully build freeradius server on RHEL5.3 ? Thanks & Regards, Kamal

1 0

buffered-sql detail
by Gabriel Blanchard 13 Aug '09

13 Aug '09

The type detail server appears to be broken again in stable git. The server logs fine I put the sql module in the main accounting block of the virtual server. if I move the sql block back inside the buffered-sql detail server it moves the detail file to -> .work but then never does anything with it, even worst, it deletes the .work file without sending anything. I had this exact same config with a previous version of freeradius and it worked just fine. Unfortunately I don't remember what version that was. bsddev# radiusd -v radiusd: FreeRADIUS Version 2.1.6, for host amd64-portbld-freebsd7.2, built on Aug 4 2009 at 15:32:18 server buffered-sql { listen { type = detail filename = ${radacctdir}/sqlrelay load_factor = 10 } preacct { files } accounting { sql } } [sqlrelay] Processing sql_log_postauth [sqlrelay-teksavvy] expand: INSERT into radius.dbo.radpostauth (username, pass, reply, authdate) values ('%{User-Name}', '%{User- Password:-Chap-Password}' [sqlrelay] expand: /var/log/radacct/sqlrelay -> /var/log/radacct/ sqlrelay ++[sqlrelay-teksavvy] returns ok } # server teksavvy Sending Access-Accept of id 231 to 127.0.0.1 port 57073 Finished request 0. Going to the next request Waking up in 0.2 seconds. Polling for detail file /var/log/radacct/sqlrelay detail_recv: Renaming /var/log/radacct/sqlrelay -> /var/log/radacct/ sqlrelay.work --> Here I'm expecting the sql module to wake up and send the log, but it never does. Waking up in 1.1 seconds. Polling for detail file /var/log/radacct/sqlrelay

4 27

GIT Log for 2009-08-12 23:33 GMT
by aland＠deployingradius.com 12 Aug '09

12 Aug '09

commit 7fcd37cad20fe911985f8f9332fce2586060cd7e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Aug 12 14:15:58 2009 +0200 Look up home servers by type, too. Files changed: src/include/realms.h | 2 +- src/main/client.c | 5 +++-- src/main/realms.c | 3 ++- 3 files changed, 6 insertions(+), 4 deletions(-) ====================================================================== commit ba3da06e2e0edd6b64822c0aa4e729b3d7977eed Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Aug 12 11:12:49 2009 +0200 Remove final restrictions on attributes > 32767 Files changed: src/include/libradius.h | 2 +- src/lib/dict.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) ====================================================================== commit 437eaf0fd47dc92a6dc5daee2fe899cb03c6c56f Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Aug 12 10:48:12 2009 +0200 Move restrictions on vendor ID from 32767 to 65535 Now that "attr" is stored as an unsigned integer. Based on a patch from Rafael Ugolini Files changed: src/lib/dict.c | 2 +- src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) ====================================================================== commit e9fe00fb9cc7c6e35543c163e9ffb6875af9b0e6 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Aug 12 10:22:23 2009 +0200 Moved prototypes to a better place Files changed: src/include/missing.h | 3 +++ src/modules/frs_dhcp/dhcp.h | 8 -------- 2 files changed, 3 insertions(+), 8 deletions(-) ====================================================================== commit 9e06d41e9343434974bee1c0544da73a1927d120 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Aug 12 10:10:45 2009 +0200 Move "attr" to unsigned int So that we don't have to worry about whether or not the high bit is set Files changed: src/include/libradius.h | 10 +++++----- src/lib/dict.c | 6 +++--- src/lib/radius.c | 21 ++++++++++++--------- 3 files changed, 20 insertions(+), 17 deletions(-) ====================================================================== commit 5021d65e202689487facfc32c3b8ec33bbdace71 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Aug 12 07:46:21 2009 +0200 Add "const" and remove compiler warningsy Files changed: src/include/libradius.h | 2 +- src/lib/print.c | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) ======================================================================

1 0

Re: Problem with Vendor ID greater then 32767
by Rafael Ugolini 12 Aug '09

12 Aug '09

----- "Alan DeKok" <aland(a)deployingradius.com> wrote: | Arran Cudbard-Bell wrote: | > Did you not think they'd get past 32K? Int is dead, long live long :) | | I thought it would take longer than that... | | But the limitation in FreeRADIUS has been there for about 10 years... | I guess it's OK for IANA to take 10 years to allocate 32K vendor ID's. | Anyway, why would you guys use long if int in 32bit arch can go from −2,147,483,648 to 2,147,483,647 ? Rafael Ugolini

4 3

Problem with Vendor ID greater then 32767
by Rafael Ugolini 12 Aug '09

12 Aug '09

Hi, I was trying to use VSA with my private enterprise number registered with IANA (as describe in the documentation) and I found a little problem. In dict.c at dict_addvendor function you have this: if (value >= 32767) { fr_strerror_printf("dict_addvendor: Cannot handle vendor ID larger than 65535"); return -1; } and my number is 34045, so I got a return -1. So, after this I was looking for more of this limitation with vendor id, and I found one more in rlm_eap_ttls.c, I attached the patch to solve this problem. Ty, Rafael Ugolini Vex - Engineering Coordinator rafael.ugolini(a)vexcorp.com http://www.vexcorp.com Office: +55 11 4932 5932 Cel: +55 11 9467 8489

3 3

GIT Log for 2009-08-11 23:33 GMT
by aland＠deployingradius.com 11 Aug '09

11 Aug '09

commit 56e4c1dd604b02b8fa7e2619dd3999a726147654 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Aug 11 14:35:29 2009 +0200 Make code consistent with examples. Fixes bug #10 src/modules/rlm_wimax/rlm_wimax.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)

1 0

udpfromto works for the server but not from radclient
by Joe Maimon 11 Aug '09

11 Aug '09

The server operates properly and returns responses from the correct ip addresses out of multiple on the server, but the radtest client refuses to run and returns radclient: socket: cannot initialize udpfromto: Function not implemented The server does not operate correctly when built without udpfromto. The system is a current testing debian and the package is a custom rebuild based on the current git source. Thanks, Joe

2 7

Patch for raddb/sql/mysql/ippool.conf
by Chris Moules 11 Aug '09

11 Aug '09

Sorry this is not a GIT patch. Here are two minor fixes to the MySQL ippool.conf file. 1) A Syntax correction for the alternative 'allocate-find' query. 2) There was an issue with the 'start-update' query updating more than it should. I am using IMSI codes as my pool-key. In the case that a phone disconnects, but no Acct-Stop is received the expiry_time is updated every time that this phone reconnects as only the NAS and the pool-key are used as update limiters. By including at least the framedipaddress this is solved. As both the 'stop-clear' and 'alive-update' sections are using the 3 additional qualifiers, it makes sense to use them here too. (I see no reason no to). Regards Chris --- ippool.conf.orig 2009-07-31 15:16:38.000000000 +0200 +++ ippool.conf 2009-07-31 15:17:57.000000000 +0200 @@ -39,7 +39,7 @@ # ## use this query instead # allocate-find = "SELECT framedipaddress FROM ${ippool_table} \ # WHERE pool_name = '%{control:Pool-Name}' \ -# AND expiry_time = NULL \ +# AND expiry_time IS NULL \ # ORDER BY RAND() \ # LIMIT 1 \ # FOR UPDATE" @@ -67,7 +67,10 @@ ## START record arrives start-update = "UPDATE ${ippool_table} \ SET expiry_time = NOW() + INTERVAL ${lease-duration} SECOND \ - WHERE nasipaddress = '%{NAS-IP-Address}' AND pool_key = '${pool-key}'" + WHERE nasipaddress = '%{NAS-IP-Address}' AND pool_key = '${pool-key}' \ + AND username = '%{User-Name}' \ + AND callingstationid = '%{Calling-Station-Id}' \ + AND framedipaddress = '%{Framed-IP-Address}'" ## This series of queries frees an IP number when an accounting ## STOP record arrives

2 2

GIT Log for 2009-08-10 23:33 GMT
by aland＠deployingradius.com 10 Aug '09

10 Aug '09

commit 8d0ad75b615f35f557bee0e6c3f96c659c2e6a36 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Aug 10 19:14:39 2009 +0200 request may be NULL Files changed: src/modules/rlm_expr/paircmp.c | 6 +++++- 1 files changed, 5 insertions(+), 1 deletions(-) ====================================================================== commit 4f02141e5ee092f0f9a4a8b8b364897ad273d2a3 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Aug 10 12:17:11 2009 +0200 RFC 5580 and dictionary Files changed: doc/rfc/rfc5580.txt | 2971 ++++++++++++++++++++++++++++++++++++++++++++++ share/dictionary | 1 + share/dictionary.rfc5580 | 41 + 3 files changed, 3013 insertions(+), 0 deletions(-) ======================================================================

1 0

GIT Log for 2009-08-09 23:33 GMT
by aland＠deployingradius.com 09 Aug '09

09 Aug '09

commit a7c6fb0ffaa5014618b9723059196454f948251d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Aug 9 17:26:41 2009 +0200 Cache module lists for VMPS and DHCP src/main/modules.c | 24 +++++++++++++----------- 1 files changed, 13 insertions(+), 11 deletions(-)

1 0

Detail file reader header detection sucks
by Arran Cudbard-Bell 09 Aug '09

09 Aug '09

Hi, src/modules/frs_detail/frs_detail.c 650 /* 651 * Look for date/time header, and read VP's if 652 * found. If not, keep reading lines until we 653 * find one. 654 */ 655 if (data->state == STATE_HEADER) { 656 int y; 657 658 if (sscanf(buffer, "%*s %*s %*d %*d:%*d:%*d %d", &y)) { 659 data->state = STATE_READING; 660 } 661 continue; 662 } This'd be fine, except the format of the detail file header is user definable! Wouldn't it be safer to just assume that the first line that doesn't start with a \t is the header? if (data->state == STATE_HEADER && (buffer[0] != '\t')) { continue; } It's not like the detail file listener actually does anything with the data from the record header. Best regards, Arran

3 4

Re: Patch for raddb/sql/mysql/ippool.conf
by Peter Nixon 07 Aug '09

07 Aug '09

Hi Chris I have a deployment very similar to yours. I specifically use the IMSI as the pool key only in order to always give the same IP to the phone, and solve the disconnect/reconnect/timeout issue with a Packet-of-Disconnect sent to the GGSN for the old session during the authorization stage for the new session.. Regards Peter On Fri 31 Jul 2009, Chris Moules wrote: > Sorry this is not a GIT patch. > > Here are two minor fixes to the MySQL ippool.conf file. > > 1) A Syntax correction for the alternative 'allocate-find' query. > > 2) There was an issue with the 'start-update' query updating more than it > should. I am using IMSI codes as my pool-key. In the case that a phone > disconnects, but no Acct-Stop is received the expiry_time is updated every > time that this phone reconnects as only the NAS and the pool-key are used > as update limiters. > > By including at least the framedipaddress this is solved. > > As both the 'stop-clear' and 'alive-update' sections are using the 3 > additional qualifiers, it makes sense to use them here too. (I see no > reason no to). > > Regards > > Chris > > --- ippool.conf.orig 2009-07-31 15:16:38.000000000 +0200 > +++ ippool.conf 2009-07-31 15:17:57.000000000 +0200 > @@ -39,7 +39,7 @@ > # ## use this query instead > # allocate-find = "SELECT framedipaddress FROM ${ippool_table} \ > # WHERE pool_name = '%{control:Pool-Name}' \ > -# AND expiry_time = NULL \ > +# AND expiry_time IS NULL \ > # ORDER BY RAND() \ > # LIMIT 1 \ > # FOR UPDATE" > @@ -67,7 +67,10 @@ > ## START record arrives > start-update = "UPDATE ${ippool_table} \ > SET expiry_time = NOW() + INTERVAL ${lease-duration} SECOND \ > - WHERE nasipaddress = '%{NAS-IP-Address}' AND pool_key = '${pool-key}'" > + WHERE nasipaddress = '%{NAS-IP-Address}' AND pool_key = '${pool-key}' \ > + AND username = '%{User-Name}' \ > + AND callingstationid = '%{Calling-Station-Id}' \ > + AND framedipaddress = '%{Framed-IP-Address}'" > > ## This series of queries frees an IP number when an accounting > ## STOP record arrives > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/devel.html -- Peter Nixon IT & Systems Engineering Manager AirTies Wireless Networks tel :+90 212 318 6200 http://www.airties.com Don't worry about people stealing an idea. If it's original, you will have to ram it down their throats - Howard Aiken

2 1

Need help for configuration authorization with LDAP
by Steffen Langhammer 06 Aug '09

06 Aug '09

Hi all, I have to do: - On the wlan-client a LDAP-User with his password should logon wit PEAP Credentials. - The LDAP-User should get an authorization if username and passwort is right AND if he is in LDAP a member of group "wlanclients" I have done: - the freeradius 2.1.6 Server is running - if LDAPUser and it's password is right, the client is getting access I need help: - I was creating a definition of the groupmembershipfilter in the ldap configuration file: groupmembership_filter = "(|(&(objectclass=groupofnames)(member=%(control:Ldap-UserDN)(cn=wlanclient)))" groupmembership_attribute = member compare_check_items = yes The result for member is: "cn=steffen,ou=company" it's the same as the user from login I think my definition is wrong, what I have to do ? So I need a sample for a user which is member in group of wlanclient. If he's not a member he is not allowed to get authorization. Thank you and best regards Steffen

1 0

GIT Log for 2009-08-05 23:33 GMT
by aland＠deployingradius.com 05 Aug '09

05 Aug '09

commit 1288965984a801b59083a5f4ac6b9e08ee151431 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Aug 5 15:36:21 2009 +0200 Remove wrong documentation raddb/sites-available/default | 2 -- 1 files changed, 0 insertions(+), 2 deletions(-)

1 0

GIT Log for 2009-08-03 23:33 GMT
by aland＠deployingradius.com 03 Aug '09

03 Aug '09

commit 23599703759e0bd383159f62dc819a8b6130130a Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Aug 3 11:35:27 2009 +0200 Use more fields in the query. These are the same fields used for the other queries, so it makes sense to use them here Based on a patch from Chris Moules. Files changed: raddb/sql/mysql/ippool.conf | 5 ++++- 1 files changed, 4 insertions(+), 1 deletions(-) ====================================================================== commit 3b08e02d6174135cb2083e201c788978c6ed2094 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Aug 3 11:27:12 2009 +0200 Allow home_server_pools to exist without realms via a pretty bad hack. The previous code assumed that the home servers were all loaded, which wasn't true. This fix is temporary, and should be replaced by one that: 1 loads all home servers 2 loads all home_server_pools 3 loads all realms Right now, it loads the realms, and uses those to bootstrap the pools and servers. This is arguably wrong. Files changed: src/main/realms.c | 44 +++++++++++++++++++++++++++++++++++++------- 1 files changed, 37 insertions(+), 7 deletions(-) ======================================================================

1 0