August 2009 - Freeradius-Devel - lists.freeradius.org

GIT Log for 2009-08-10 23:33 GMT
by aland＠deployingradius.com 10 Aug '09

10 Aug '09

commit 8d0ad75b615f35f557bee0e6c3f96c659c2e6a36 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Aug 10 19:14:39 2009 +0200 request may be NULL Files changed: src/modules/rlm_expr/paircmp.c | 6 +++++- 1 files changed, 5 insertions(+), 1 deletions(-) ====================================================================== commit 4f02141e5ee092f0f9a4a8b8b364897ad273d2a3 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Aug 10 12:17:11 2009 +0200 RFC 5580 and dictionary Files changed: doc/rfc/rfc5580.txt | 2971 ++++++++++++++++++++++++++++++++++++++++++++++ share/dictionary | 1 + share/dictionary.rfc5580 | 41 + 3 files changed, 3013 insertions(+), 0 deletions(-) ======================================================================

1 0

GIT Log for 2009-08-09 23:33 GMT
by aland＠deployingradius.com 09 Aug '09

09 Aug '09

commit a7c6fb0ffaa5014618b9723059196454f948251d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Aug 9 17:26:41 2009 +0200 Cache module lists for VMPS and DHCP src/main/modules.c | 24 +++++++++++++----------- 1 files changed, 13 insertions(+), 11 deletions(-)

1 0

Detail file reader header detection sucks
by Arran Cudbard-Bell 09 Aug '09

09 Aug '09

Hi, src/modules/frs_detail/frs_detail.c 650 /* 651 * Look for date/time header, and read VP's if 652 * found. If not, keep reading lines until we 653 * find one. 654 */ 655 if (data->state == STATE_HEADER) { 656 int y; 657 658 if (sscanf(buffer, "%*s %*s %*d %*d:%*d:%*d %d", &y)) { 659 data->state = STATE_READING; 660 } 661 continue; 662 } This'd be fine, except the format of the detail file header is user definable! Wouldn't it be safer to just assume that the first line that doesn't start with a \t is the header? if (data->state == STATE_HEADER && (buffer[0] != '\t')) { continue; } It's not like the detail file listener actually does anything with the data from the record header. Best regards, Arran

3 4

Re: Patch for raddb/sql/mysql/ippool.conf
by Peter Nixon 07 Aug '09

07 Aug '09

Hi Chris I have a deployment very similar to yours. I specifically use the IMSI as the pool key only in order to always give the same IP to the phone, and solve the disconnect/reconnect/timeout issue with a Packet-of-Disconnect sent to the GGSN for the old session during the authorization stage for the new session.. Regards Peter On Fri 31 Jul 2009, Chris Moules wrote: > Sorry this is not a GIT patch. > > Here are two minor fixes to the MySQL ippool.conf file. > > 1) A Syntax correction for the alternative 'allocate-find' query. > > 2) There was an issue with the 'start-update' query updating more than it > should. I am using IMSI codes as my pool-key. In the case that a phone > disconnects, but no Acct-Stop is received the expiry_time is updated every > time that this phone reconnects as only the NAS and the pool-key are used > as update limiters. > > By including at least the framedipaddress this is solved. > > As both the 'stop-clear' and 'alive-update' sections are using the 3 > additional qualifiers, it makes sense to use them here too. (I see no > reason no to). > > Regards > > Chris > > --- ippool.conf.orig 2009-07-31 15:16:38.000000000 +0200 > +++ ippool.conf 2009-07-31 15:17:57.000000000 +0200 > @@ -39,7 +39,7 @@ > # ## use this query instead > # allocate-find = "SELECT framedipaddress FROM ${ippool_table} \ > # WHERE pool_name = '%{control:Pool-Name}' \ > -# AND expiry_time = NULL \ > +# AND expiry_time IS NULL \ > # ORDER BY RAND() \ > # LIMIT 1 \ > # FOR UPDATE" > @@ -67,7 +67,10 @@ > ## START record arrives > start-update = "UPDATE ${ippool_table} \ > SET expiry_time = NOW() + INTERVAL ${lease-duration} SECOND \ > - WHERE nasipaddress = '%{NAS-IP-Address}' AND pool_key = '${pool-key}'" > + WHERE nasipaddress = '%{NAS-IP-Address}' AND pool_key = '${pool-key}' \ > + AND username = '%{User-Name}' \ > + AND callingstationid = '%{Calling-Station-Id}' \ > + AND framedipaddress = '%{Framed-IP-Address}'" > > ## This series of queries frees an IP number when an accounting > ## STOP record arrives > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/devel.html -- Peter Nixon IT & Systems Engineering Manager AirTies Wireless Networks tel :+90 212 318 6200 http://www.airties.com Don't worry about people stealing an idea. If it's original, you will have to ram it down their throats - Howard Aiken

2 1

Need help for configuration authorization with LDAP
by Steffen Langhammer 06 Aug '09

06 Aug '09

Hi all, I have to do: - On the wlan-client a LDAP-User with his password should logon wit PEAP Credentials. - The LDAP-User should get an authorization if username and passwort is right AND if he is in LDAP a member of group "wlanclients" I have done: - the freeradius 2.1.6 Server is running - if LDAPUser and it's password is right, the client is getting access I need help: - I was creating a definition of the groupmembershipfilter in the ldap configuration file: groupmembership_filter = "(|(&(objectclass=groupofnames)(member=%(control:Ldap-UserDN)(cn=wlanclient)))" groupmembership_attribute = member compare_check_items = yes The result for member is: "cn=steffen,ou=company" it's the same as the user from login I think my definition is wrong, what I have to do ? So I need a sample for a user which is member in group of wlanclient. If he's not a member he is not allowed to get authorization. Thank you and best regards Steffen

1 0

GIT Log for 2009-08-05 23:33 GMT
by aland＠deployingradius.com 05 Aug '09

05 Aug '09

commit 1288965984a801b59083a5f4ac6b9e08ee151431 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Aug 5 15:36:21 2009 +0200 Remove wrong documentation raddb/sites-available/default | 2 -- 1 files changed, 0 insertions(+), 2 deletions(-)

1 0

GIT Log for 2009-08-03 23:33 GMT
by aland＠deployingradius.com 03 Aug '09

03 Aug '09

commit 23599703759e0bd383159f62dc819a8b6130130a Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Aug 3 11:35:27 2009 +0200 Use more fields in the query. These are the same fields used for the other queries, so it makes sense to use them here Based on a patch from Chris Moules. Files changed: raddb/sql/mysql/ippool.conf | 5 ++++- 1 files changed, 4 insertions(+), 1 deletions(-) ====================================================================== commit 3b08e02d6174135cb2083e201c788978c6ed2094 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Aug 3 11:27:12 2009 +0200 Allow home_server_pools to exist without realms via a pretty bad hack. The previous code assumed that the home servers were all loaded, which wasn't true. This fix is temporary, and should be replaced by one that: 1 loads all home servers 2 loads all home_server_pools 3 loads all realms Right now, it loads the realms, and uses those to bootstrap the pools and servers. This is arguably wrong. Files changed: src/main/realms.c | 44 +++++++++++++++++++++++++++++++++++++------- 1 files changed, 37 insertions(+), 7 deletions(-) ======================================================================

1 0