September 2009 - Freeradius-Devel - lists.freeradius.org

TCP transport again
by Alan DeKok 28 Sep '09

28 Sep '09

I've just committed patches that enable TCP transport in the server. It was previously off by default. The code is a lot cleaner than the previous attempt, and (not surprisingly), smaller and easier to understand. It should provide all of the functionality of 2.1.7, plus TCP transport for high load systems. If anyone has spare cycles to check the usual edge cases, that would help a lot. Alan DeKok.

5 12

GIT Log for 2009-09-27 23:33 GMT
by aland＠deployingradius.com 27 Sep '09

27 Sep '09

commit 1fef8c64bf31668808bb9c2a67c480d9d0a7f2d6 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Sep 27 19:45:20 2009 +0200 Assign variable before using it Files changed: src/main/event.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) ====================================================================== commit 2db0b3fe16a9d460efc63cf76e38584419dcdfe0 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Sep 27 18:28:17 2009 +0200 Use new API Files changed: src/main/radclient.c | 12 ++++++++---- src/modules/frs_status/frs_status.c | 4 +--- 2 files changed, 9 insertions(+), 7 deletions(-) ====================================================================== commit 81f6cad3846b61227fd4c5f92959306a8b7e140c Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Sep 27 18:23:18 2009 +0200 Include proto in API, no matter what build options It's too hardware to have proto as a compile-time option for the API. Instead, we add it everywhere. This slows down the UDP-only case, but ensures that we can distinguish between a home server of (ip,port) udp, and a home server of the same (ip,port) and tcp Files changed: src/include/packet.h | 4 +- src/include/radiusd.h | 9 ++----- src/include/realms.h | 2 - src/include/smodule.h | 2 +- src/lib/packet.c | 38 ++++++++++++++++++++------------- src/main/client.c | 16 ++----------- src/main/event.c | 19 +++++++++++----- src/main/listen.c | 18 +++------------ src/main/realms.c | 2 +- src/modules/frs_control/frs_control.c | 9 +------- 10 files changed, 51 insertions(+), 68 deletions(-) ======================================================================

1 0

GIT Log for 2009-09-25 23:33 GMT
by aland＠deployingradius.com 25 Sep '09

25 Sep '09

commit 52880d0020b7b900ae8383b142b08e4e11cde639 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Sep 24 22:01:54 2009 +0200 Fixed typo && include attrs.access_challenge in build Files changed: raddb/Makefile | 2 +- raddb/modules/attr_filter | 2 +- suse/freeradius.spec | 1 + 3 files changed, 3 insertions(+), 2 deletions(-) ====================================================================== commit 5fe2ab70a782fc1389748897f8d7838e8b63efc2 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Sep 25 11:46:06 2009 +0200 Removed unnecessary line Files changed: src/main/event.c | 1 - 1 files changed, 0 insertions(+), 1 deletions(-) ====================================================================== commit 4ca219b1f1ab68fc8434072e51a8e4b95cf37c16 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Sep 25 11:21:50 2009 +0200 Be more flexible about parsing detail files Allow any operator, not just '=' Files changed: src/modules/frs_detail/frs_detail.c | 11 +++++++++-- 1 files changed, 9 insertions(+), 2 deletions(-) ====================================================================== commit 0d8afaf03ef7b5df7556304f2664ac43dbe822f7 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Sep 25 11:01:27 2009 +0200 Clean up state machine so it's more forgiving Files changed: src/main/event.c | 20 ++++---------------- 1 files changed, 4 insertions(+), 16 deletions(-) ======================================================================

1 0

accounting being saved in detail files with := attribute
by Joe Maimon 25 Sep '09

25 Sep '09

I recall this being brought up here recently, but I dont know if there is a fix in yet. Anyways I have these pair of patches for the problem, encountered when using detail_reader, since it skips all AVP's with += or := #! /bin/sh /usr/share/dpatch/dpatch-run ## 450-pairmove-set-operator.dpatch by <joe@debian09> ## ## All lines beginning with `## DP:' are a description of the patch. ## DP: No description. @DPATCH@ diff -urNad freeradius-server~/src/lib/valuepair.c freeradius-server/src/lib/valuepair.c --- freeradius-server~/src/lib/valuepair.c 2009-09-23 09:40:54.000000000 -0400 +++ freeradius-server/src/lib/valuepair.c 2009-09-24 18:16:41.000000000 -0400 @@ -542,6 +542,7 @@ * here, so instead we over-write * the vp that it's pointing to. */ + i->operator = T_OP_EQ; memcpy(found, i, sizeof(*found)); found->next = mynext; @@ -563,6 +564,7 @@ * if similar ones already exist. */ default: + i->operator = T_OP_EQ; case T_OP_ADD: /* += */ break; } diff -urNad freeradius-server~/src/main/valuepair.c freeradius-server/src/main/valuepair.c --- freeradius-server~/src/main/valuepair.c 2009-09-24 18:10:49.000000000 -0400 +++ freeradius-server/src/main/valuepair.c 2009-09-24 18:16:51.000000000 -0400 @@ -795,6 +795,7 @@ VALUE_PAIR *vp; vp = found->next; + i->operator = T_OP_EQ; memcpy(found, i, sizeof(*found)); found->next = vp; continue; @@ -814,6 +815,7 @@ */ default: case T_OP_ADD: /* += */ + i->operator = T_OP_EQ; break; } #! /bin/sh /usr/share/dpatch/dpatch-run ## 460-detail-reader-opset.dpatch by <joe@debian09> ## ## All lines beginning with `## DP:' are a description of the patch. ## DP: No description. @DPATCH@ diff -urNad freeradius-server~/src/main/detail.c freeradius-server/src/main/detail.c --- freeradius-server~/src/main/detail.c 2009-09-23 09:40:54.000000000 -0400 +++ freeradius-server/src/main/detail.c 2009-09-24 18:28:12.000000000 -0400 @@ -510,7 +510,11 @@ * FIXME: print an error for badly formatted attributes? */ if (sscanf(buffer, "%255s = %1023s", key, value) != 2) { - continue; + if (sscanf(buffer, "%255s := %1023s", key, value) != 2) { + if (sscanf(buffer, "%255s += %1023s", key, value) != 2) { + continue; + } + } } /*

2 2

GIT Log for 2009-09-24 23:33 GMT
by aland＠deployingradius.com 24 Sep '09

24 Sep '09

commit 92ab5fef40320d1dbc3fe59db82cb20a3ec69249 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Sep 24 17:37:07 2009 +0200 Fixed compile error Files changed: src/modules/rlm_mschap/rlm_mschap.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 7c638d0134c07c2481d0e7c866c1f8dd9d346048 Author: bduncan <bduncan(a)apple.com> Date: Tue Sep 22 09:24:57 2009 -0700 64-bit fixes. Files changed: src/modules/rlm_opendirectory/rlm_opendirectory.c | 34 +++++++++++++------- 1 files changed, 22 insertions(+), 12 deletions(-) ====================================================================== commit 1a176810b6786c78ba744e1839d808cc6804788e Author: bduncan <bduncan(a)apple.com> Date: Tue Sep 22 09:23:47 2009 -0700 Check for NOOP from opendir.c Files changed: src/modules/rlm_mschap/rlm_mschap.c | 15 +++++++++++---- 1 files changed, 11 insertions(+), 4 deletions(-) ====================================================================== commit 215cb16a373f3cdb88a6c196c7cb53ef69b5fb4c Author: bduncan <bduncan(a)apple.com> Date: Tue Sep 22 09:22:49 2009 -0700 64-bit fixes and return NOOP for AD users. Files changed: src/modules/rlm_mschap/opendir.c | 98 +++++++++++++++++++++---------------- 1 files changed, 56 insertions(+), 42 deletions(-) ====================================================================== commit 28d8dd3de3e4251b252a6b2846bfc4079df09c66 Author: bduncan <bduncan(a)apple.com> Date: Tue Sep 22 09:20:02 2009 -0700 Get private key passphrase from keychain using certadmin command. Files changed: .../rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c | 43 ++++++++++++++++++++ 1 files changed, 43 insertions(+), 0 deletions(-) ====================================================================== commit e04b62f1bd257489bd92ccc584b0886c7e2011e8 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Sep 24 17:28:56 2009 +0200 Jumbo patch to clean up socket handling The transport protocol code is now more merged, and the "fr_tcp_radius_t" structure and API are deleted. The resulting code is simpler and smaller. Cleaned up how the listeners and even handlers deal with sockets. The proxy sockets are now pushed into the proxy packet list, and are not used in the main listener list. The proxy packet list now deals with src/dst, and not just destination. Files changed: src/include/libradius.h | 4 + src/include/packet.h | 12 +- src/include/radiusd.h | 11 +- src/include/realms.h | 11 +- src/include/tcp.h | 51 +--- src/lib/packet.c | 412 +++++++++++-------- src/lib/tcp.c | 61 ++-- src/main/event.c | 1052 +++++++++++++++++++++++------------------------ src/main/listen.c | 491 +++++++++++----------- src/main/radclient.c | 16 +- src/main/realms.c | 194 ++------- 11 files changed, 1103 insertions(+), 1212 deletions(-) ====================================================================== commit fa0e98d1056e22fa413078dbd8c3fe0d85532826 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Sep 24 17:12:53 2009 +0200 Changed order of code to avoid race conditions Files changed: src/lib/event.c | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-) ====================================================================== commit fbdc02ad699b9bc4d410daaa54f76df7141d2f64 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Sep 24 17:12:33 2009 +0200 Ensure that cached SSL sessions have data Files changed: src/modules/rlm_eap/libeap/eap_tls.c | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) ======================================================================

1 0

2.1.7 package and configuration
by leopold 24 Sep '09

24 Sep '09

Maybe I am wrong, but please take a look 1) Was there any reason behind not including %config(noreplace) /etc/raddb/attrs.access_challenge inside freeradius.spec file? Same inside raddb/Makefile FILES = ...attrs.access_access_challenge 2) modules/attr_filter TYPO Instead of attr_filter attr_filter_access_challenge Should be attr_filter attr_filter.access_challenge right? -- View this message in context: http://www.nabble.com/2.1.7-package-and-configuration-tp25578011p25578011.h… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

2 1

eaptls CN case insensitive checking
by leopold 24 Sep '09

24 Sep '09

When using check_cert_cn option in eap.conf and when some old Windows supplicants send certificate FreeRADIUS fails when comparing "identity" and cert.CN because username/machine case does not match. Most often supplicant client sends identity which corresponds to cert.CN (exact match), we can't explain why sometimes it sends wrong case Would it be beneficial to have a configuration option and force FreeRADIUS to compare CN with ignore case option? If you feel this is a good option I can supply diff file for 2.1.7 Something like new option in rlm_eap_tls.c { "ignore_case_cn_check", PW_TYPE_BOOLEAN, offsetof(EAP_TLS_CONF, ignore_case_cn_check), NULL, "yes" }, if (strcmp(cn_str, common_name) != 0) { int strcmpRet=0; if (conf->ignore_case_cn_check) { strcmpRet = strcasecmp(cn_str, common_name); } else { strcmpRet = strcmp(cn_str, common_name); } -- View this message in context: http://www.nabble.com/eaptls-CN-case-insensitive-checking-tp25578025p255780… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

1 0

possible bug in rlm_sql.c
by leopold 24 Sep '09

24 Sep '09

It seems like even in the latest release 2.1.7 rlm_sql.c does not handle "database down" conditions properly. When calling rlm_sql_fetch_row from underlying driver and it returns result < 0 which is FAIL condition and not NOT_FOUND condition in this case rlm_sql should return FAIL and not NOT_FOUND. For example sql_get_grouplist should fail when DB is down. We want to differentiate conditions when user is trully "not found" in SQL DB vs DB is down and in this case the server should not respond. Will it make sense to do something like this? 531a532 > int ret; 554c555 < while (rlm_sql_fetch_row(sqlsocket, inst) == 0) { --- > while ((ret=rlm_sql_fetch_row(sqlsocket, inst)) == 0) { 574a576,580 > if (ret < 0) > { > /* sql fetch failed */ > num_groups = -1; > } -- View this message in context: http://www.nabble.com/possible-bug-in-rlm_sql.c-tp25578009p25578009.html Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

1 0

How to return "Reply-Message" from python script
by Александра Белова 24 Sep '09

24 Sep '09

I use the python a script for authorisation, for this purpose I in radiusd.conf have placed in section modules exec auth { profram = "/user/local/etc/raddb/auth.py" wait = yse inpyt_pairs = request shell_escape = yes output = no output_pairs = reply } As I have understood inpyt_pairs = request shell_escape = yes places attributes of request in variable environments of a script, and output_pairs = reply should allow to return to transfer atributes value pairs generated by a script in the server reply.As I have understood values returned by a script, 0 - ok, 1 - reject, the server answer to authorise or not the user, I besides it would would like to return to the user the message "Reply-Message", but I can not understand as it to make.My script looks in the simplified sort so def handleUserList (p): u_name = p [' USER_NAME '] u_pwd = p [' USER_PASSWORD '] ................ if (well user): sys.exit (3) else: sys.exit (1) if __ name __ == "__ main __": import os hendleUserList (os.eniron) And it works correctly, but he does not allow to transfer the message to the user. As I saw in prepaid.py for message return is used return (RLM_MODULE_XX, ((' Auth-Type ', ' python '), (' Reply-Message ', ' text '))) when I use similar string return (3, ((' Reply-Message ', ' text '))) the message is not transferred to the user and exec-Program: returned: 0 always.Please illustrate on an example how value pairs for attributes of the answer of a server are formed and transferred to it.

1 0

FW: C++ library for Radius
by Nazim Oztahtaci 24 Sep '09

24 Sep '09

Hello, I am a master student in KTH University, Stockholm. We are working on a project inwhich we are implementing a Darwin Streaming Server. We have to implement a custom authentication module in that in C++. We have a running Free Radius server on our platform. We need to make external connection between DSS and Radius so DSS will send user information to DSS and will get validation response. Is there any suitable library for that in C++? Best regards, Nazim Oztahtaci Diğer Windows Live™ özelliklerine göz atın. Sadece e-posta iletilerinden daha fazlası _________________________________________________________________ Windows Live tüm arkadaşlarınızla tek bir yerden iletişim kurmanıza yardımcı olur. http://www.microsoft.com/turkiye/windows/windowslive/products/social-networ…

3 9