April 2010 - Freeradius-Devel - lists.freeradius.org

Missing TLS Change Cipher Spec and TLS Finished in EAP-TLS exchanges
by arno＠natisbad.org 09 Jul '11

09 Jul '11

Hi, I upgraded an internal freeradius server (Linux, Debian unstable, libssl 0.9.8) used for EAP-TLS (802.11 WPA2 access) from 2.0.5 to 2.1.3. With 2.1.3, client authentication fails in the following way (wpasupplicant on Debian unstable, working with 2.0.5): - the TLS exchange is completed from freeradius point of view. It even sends the Access-Accept message to the NAS. - from the clients point of view, the TLS exchange is not over, it expects some more data from the server which are never sent. I took two pcap traces (sent to you privately, Alan), one with 2.0.5, one with 2.1.3. It looks like the TLS Change Cipher and TLS Tinished elements of the TLS exchange are not in the EAP encapsulated TLS packets sent by the server. Compare packet #23 of 2.1.3 trace with packet #27 of 2.0.5 trace. If you use wireshark, you will notice that the SSL layer is dissected; this is because #27 has a small brother: #29. It is not sent by 2.1.3. Alan, if you have an idea or a patch, I can test it on monday. Cheers, a+

5 15

eap2 in freeradius
by Chanthearith HUON 04 Apr '11

04 Apr '11

Hi everyone, I am testing eap2 in freeradius. I run "radiusd -X", I got following error message " radiusd: symbol lookup error: /usr/lib/rlm_eap2-2.1.0.so: undefined symbol: eap_server_register_methods " Anyone, have any idea what might be wrong with the configuration? Thank in advance, Thierry

5 10

Patch: avpair.c - empty reply VALUE_PAIR (0x0) for replies with unknown vendor attributes
by Stefan Karss 08 Jul '10

08 Jul '10

Hello again, when the RADIUS servers sends a reply packet with an attribute for an unknown vendor freeradius-client just skips over this when filling response VALUE_PAIR list. Unfortunately it doesn't for unknown attributes from known vendors - in that case rc_avpair_gen returns NULL in the first recursion which results in a NULL pointer for reply VALUE_PAIR. The attached patch just skips over unknown attributes for known vendors just like the lib skips over attributes from unknown vendors. Rgds, Stefan

4 13

Re: cannot get core dump of crashing freeradius
by Jakob Hirsch 07 May '10

07 May '10

Hi, follow from the users list, belongs not really there, I think. Alan DeKok, 2010-04-26 17:24: >> This will become a non-issue when the prctl() calls are moved into the >> fr_suid_* functions. :) >> Would you like me to prepare a patch for that or would you rather do >> that yourself? > Patch, please. It's just easier. Is attached. I found no way to enable the process's dumpable flag permanently, so I just re-enable it on every uid/gid change. Not really elegant... I also propose a second (one-line) patch that allows core dumps also when running in debug mode (as mentioned on the users list). Note that the patches are not really tested, will probably do that tomorrow...

2 2

Re: rlm_ldap & TCP KeepAlive
by Fred MAISON 03 May '10

03 May '10

> Message: 4 > Date: Fri, 30 Apr 2010 11:56:25 +0200 > From: Alan DeKok <aland at deployingradius.com> > Subject: Re: rlm_ldap & TCP KeepAlive > To: FreeRadius developers mailing list > <freeradius-devel at lists.freeradius.org> > Message-ID: <4BDAA949.3020100 at deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Fred MAISON wrote: > > Some stateful equipments like firewall or load-balancers tends to drop > > long-time idle tcp session to protect their session tables. > > To keep idle tcp session active and avoid this kind of deconnections, I > > found it could be useful to be able to configure TCP KeepAlive from > > rlm_ldap config file, exposing TCP KeepAlive options available in > > Openldap libraries to rlm_ldap config file : > > LDAP_OPT_X_KEEPALIVE_IDLE, LDAP_OPT_X_KEEPALIVE_PROBES, > > LDAP_OPT_X_KEEPALIVE_INTERVAL > > Yup. > > > Unfortunately, as Redhat released his 5.5, I don't have anymore access > > to jdennis binary repository, so I am in trouble to recompile 2.1.8 for > > CentOS 5.4 on x86_64. > > I have tried to recompile freeradius 2.1.8 with this patch from > > fedoraproject cvs sources, but I don't know how to integrate this patch > > in the source tree. > > Use the "patch" program: > > $ hg diff > patch > $ cd src/modules/rlm_ldap > $ patch -p1 < ../../patch > > Then build it. > > This can be done after the "configure" stage. > > > Once validated, could this kind of code be integrated in a future > > release ? > > Yes. John has a number of LDAP patches pending. > > Alan DeKok. I am interested with John's patches. Where are they available ? I am also interested with Alexander Coulter patches you talked about in a post dated 28 Jan 2010 17:36:46 +0100 regarding ldap redundancy & Ldap-Group checkItem in user file (message 4B61BD1E.1090005 at deployingradius.com) As you talked about integration of those patches in 2.2.0, How can I access freeradius 2.2.x cvs ? I tried cvs -d :pserver:anoncvs at cvs.freeradius.org:/source checkout radiusd, but the version retrieved there seems to be 2.0.6 ... Best regards, Fred MAISON

3 3

GIT Log for 2010-04-30 23:33 GMT
by aland＠deployingradius.com 30 Apr '10

30 Apr '10

commit 5037647cd93b53f65645761725bea78d13407286 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Apr 30 09:58:13 2010 +0200 Note Samba bug Files changed: raddb/eap.conf | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) ====================================================================== commit b6fd71ae1c01e158c3ea0c14d4f41da8f493162d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Apr 30 07:46:30 2010 +0200 Use pairadd() properly. Files changed: .../rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c | 4 ++-- .../rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) ======================================================================

1 0

Re: Freeradius-Devel Digest, Vol 60, Issue 16
by Fred MAISON 30 Apr '10

30 Apr '10

Le vendredi 30 avril 2010 à 12:00 +0200, freeradius-devel-request(a)lists.freeradius.org a écrit : > Send Freeradius-Devel mailing list submissions to > freeradius-devel(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-devel > or, via email, send a message with subject or body 'help' to > freeradius-devel-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-devel-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Devel digest..." > > > Today's Topics: > > 1. Re: cannot get core dump of crashing freeradius (Jakob Hirsch) > 2. GIT Log for 2010-04-29 23:33 GMT (aland) > 3. rlm_ldap & TCP KeepAlive (Fred MAISON) > 4. Re: rlm_ldap & TCP KeepAlive (Alan DeKok) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 29 Apr 2010 18:01:27 +0200 > From: Jakob Hirsch <jh(a)plonk.de> > Subject: Re: cannot get core dump of crashing freeradius > To: FreeRadius developers mailing list > <freeradius-devel(a)lists.freeradius.org> > Message-ID: <4BD9AD57.3010807(a)Message-ID.plonk.de> > Content-Type: text/plain; charset="iso-8859-1" > > Hi, > > follow from the users list, belongs not really there, I think. > > Alan DeKok, 2010-04-26 17:24: > >> This will become a non-issue when the prctl() calls are moved into the > >> fr_suid_* functions. :) > >> Would you like me to prepare a patch for that or would you rather do > >> that yourself? > > Patch, please. It's just easier. > > Is attached. > I found no way to enable the process's dumpable flag permanently, so I > just re-enable it on every uid/gid change. Not really elegant... > > I also propose a second (one-line) patch that allows core dumps also > when running in debug mode (as mentioned on the users list). > > Note that the patches are not really tested, will probably do that > tomorrow... >

2 1

rlm_ldap & TCP KeepAlive
by Fred MAISON 30 Apr '10

30 Apr '10

Hello, Some stateful equipments like firewall or load-balancers tends to drop long-time idle tcp session to protect their session tables. To keep idle tcp session active and avoid this kind of deconnections, I found it could be useful to be able to configure TCP KeepAlive from rlm_ldap config file, exposing TCP KeepAlive options available in Openldap libraries to rlm_ldap config file : LDAP_OPT_X_KEEPALIVE_IDLE, LDAP_OPT_X_KEEPALIVE_PROBES, LDAP_OPT_X_KEEPALIVE_INTERVAL Unfortunately, as Redhat released his 5.5, I don't have anymore access to jdennis binary repository, so I am in trouble to recompile 2.1.8 for CentOS 5.4 on x86_64. I have tried to recompile freeradius 2.1.8 with this patch from fedoraproject cvs sources, but I don't know how to integrate this patch in the source tree. Can you help ? Once validated, could this kind of code be integrated in a future release ? Best regards, Fred MAISON hg diff diff -r 9bc9e5b4d605 rlm_ldap.c --- a/rlm_ldap.c Fri Apr 30 10:18:42 2010 +0000 +++ b/rlm_ldap.c Fri Apr 30 10:32:05 2010 +0000 @@ -173,8 +173,12 @@ int edir_account_policy_check; #endif int set_auth_type; + int keepalive_idle; + int keepalive_probes; + int keepalive_interval; } ldap_instance; + /* The default setting for TLS Certificate Verification */ #define TLS_DEFAULT_VERIFY "allow" @@ -315,6 +319,9 @@ #endif {"set_auth_type", PW_TYPE_BOOLEAN, offsetof(ldap_instance,set_auth_type), NULL, "yes"}, + {"keepalive_idle", PW_TYPE_INTEGER, offsetof(ldap_instance,keepalive_idle), NULL, "60"} + {"keepalive_probes", PW_TYPE_INTEGER, offsetof(ldap_instance,keepalive_probes), NULL, "3"} + {"keepalive_interval", PW_TYPE_INTEGER, offsetof(ldap_instance,keepalive_interval), NULL, "30"} {NULL, -1, 0, NULL, NULL} }; @@ -2272,6 +2279,24 @@ radlog(L_ERR, " [%s] Could not set LDAP version to V3: %s", inst->xlat_name, ldap_err2string(ldap_errno)); } + if (ldap_set_option(ld, LDAP_OPT_X_KEEPALIVE_IDLE, + (void *) &(inst->keepalive_idle)) != LDAP_OPT_SUCCESS) { + ldap_get_option(ld, LDAP_OPT_ERROR_NUMBER, &ldap_errno); + radlog(L_ERR, " [%s] Could not set LDAP_OPT_X_KEEPALIVE_IDLE %d: % s", inst->xlat_name, inst->keepalive_idle, ldap_err2string(ldap_errno)); + } + if (ldap_set_option(ld, LDAP_OPT_X_KEEPALIVE_PROBES, + (void *) &(inst->keepalive_probes)) != LDAP_OPT_SUCCESS) { + ldap_get_option(ld, LDAP_OPT_ERROR_NUMBER, &ldap_errno); + radlog(L_ERR, " [%s] Could not set LDAP_OPT_X_KEEPALIVE_PROBES %d: % s", inst->xlat_name, inst->keepalive_probes, ldap_err2string(ldap_errno)); + } + if (ldap_set_option(ld, LDAP_OPT_X_KEEPALIVE_INTERVAL, + (void *) &(inst->keepalive_interval)) != LDAP_OPT_SUCCESS) { + ldap_get_option(ld, LDAP_OPT_ERROR_NUMBER, &ldap_errno); + radlog(L_ERR, " [%s] Could not set LDAP_OPT_X_KEEPALIVE_INTERVAL %d: %s", inst->xlat_name, inst->keepalive_interval, ldap_err2string(ldap_errno)); + } + + + #ifdef HAVE_LDAP_START_TLS if (inst->tls_mode) { DEBUG(" [%s] setting TLS mode to %d", inst->xlat_name, inst->tls_mode);

2 1

GIT Log for 2010-04-29 23:33 GMT
by aland＠deployingradius.com 29 Apr '10

29 Apr '10

commit 19fc3940db2e2bbd354c59303c50b230c77d7653 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 29 10:26:47 2010 +0200 Document more proxy functionality If the NAS doesn't retransmit, we don't either. Files changed: raddb/proxy.conf | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-) ====================================================================== commit fd06854aa64fd6dbf3794f1e695a4ac613637a56 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 29 10:25:47 2010 +0200 More debugging messages So that the user knows when a socket is closed due to lifetime or max_queries Files changed: src/modules/rlm_sql/sql.c | 8 +++++--- 1 files changed, 5 insertions(+), 3 deletions(-) ====================================================================== commit 8dbc696916652fca8e10d2c001d1a2f96187d9ab Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 29 10:25:12 2010 +0200 Removed unnecessary fflush() Files changed: src/modules/frs_dhcp/dhcp.c | 1 - 1 files changed, 0 insertions(+), 1 deletions(-) ====================================================================== commit 8d6622aa511c9c803e3bd020a15b437723a4738a Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 29 10:16:59 2010 +0200 Ignore autoconf files Hopefully for 2.2.0, we can start getting rid of that horrible system Files changed: .gitignore | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) ====================================================================== commit 5b5fc292113861b65b8bb786e260fbccc7ba98af Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 28 16:52:05 2010 +0200 Add sub-options to Option 82 Files changed: share/dictionary.dhcp | 21 ++++++++++++++++++++- 1 files changed, 20 insertions(+), 1 deletions(-) ====================================================================== commit 97c36635617bc8330f21d2b7a7474d6ece462525 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 28 16:50:13 2010 +0200 Large code cleanups. Fix error messages (no fprintf) Enable option 82 sub-options Allow it to originate DHCP packets, too Files changed: src/modules/frs_dhcp/dhcp.c | 588 +++++++++++++++++++++++++++---------------- 1 files changed, 374 insertions(+), 214 deletions(-) ====================================================================== commit e0736545494890e825ec28fbb46c1321480a17e4 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 28 13:47:35 2010 +0200 Make dhcp_socket_t structure fall in line with listen_socket_t Files changed: src/modules/frs_dhcp/frs_dhcp.c | 11 +++++++---- 1 files changed, 7 insertions(+), 4 deletions(-) ====================================================================== commit 67d995975096c7fa8ece4693161ad3674f600c21 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 28 13:39:46 2010 +0200 Fixed typo Files changed: src/modules/frs_dhcp/frs_dhcp.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit ed96d5b83d2f3c53fe316699450257acc7249924 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 28 11:01:14 2010 +0200 Use readline only if we have the header files Otherwise people install libreadline, and then the compile stage fails because there's no header files Files changed: src/main/radmin.c | 25 +++++++++++++------------ 1 files changed, 13 insertions(+), 12 deletions(-) ====================================================================== commit 46de542209627674034535ee2a8970ddb94bdd81 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Apr 27 18:53:17 2010 +0200 Fix error message for people who don't understand it Files changed: src/main/modcall.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit c66a88291f75dad80a73a9c47705768a3dafb869 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Apr 27 11:02:54 2010 +0200 Corrected documentation Files changed: raddb/certs/README | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit e7118e7e2d88a07d8d7078f8a9a8daf294f9afb3 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Apr 27 09:47:38 2010 +0200 Try to fix link issues, as posted to the list Files changed: src/modules/rlm_python/configure.in | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) ====================================================================== commit 044b291410a3c6d3cc8c4e52b4a2764f6b2a47df Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Apr 27 09:46:37 2010 +0200 Use rebind_proc only if args==3 This means that systems which have args != 3 will still build Files changed: src/modules/rlm_ldap/rlm_ldap.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) ====================================================================== commit 4d976d1234f0e04beda8de74247f59c66282678d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Apr 26 17:24:41 2010 +0200 Work around for bug #35. The packet is apparently getting freed when the request structure is still in the list. Since it's hard to tell when / why this is happening, the short-term fix is to work around it. It's better to leak memory slowly than to crash quickly. Files changed: src/lib/packet.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) ====================================================================== commit bf6bc8b9be4176c35b1fd4c4be69e1a2394114d6 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Apr 26 19:56:54 2010 +0200 Remove from proxy hash after packet has been verified This avoids some esoteric conditions where an attacker who can monitor the RADIUS packet stream could cause the server to sometimes forget about packets that it proxied. Also cleaned up other issues related to counters (home/listener) when proxying. Files changed: src/main/event.c | 114 +++++++++++++++++++++++++++++++----------------------- 1 files changed, 65 insertions(+), 49 deletions(-) ======================================================================

1 0

Patch to server list initialization for FreeRADIUS client lib 1.1.6
by Scott Neugroschl 28 Apr '10

28 Apr '10

DESCRIPTION: FreeRADIUS client library 1.1.6 In lib/config.c, in set_option_srv(), when the serverlist is allocated, the allocated memory currently isn't zeroed. This shouldn't be a problem, as we only search up to serv->max, but in rc_find_server(), we check to see if {acct,auth}servers->secret[i] is NULL. If we don't zero out the SERVER structure upon allocation, this value could be non-zero, and the test for NULL could fail, leading to segfault. The attached patch to lib/config.c addresses this issue by zeroing out the SERVER structure upon allocation. Scott Neugroschl

2 1

contributions to client
by Valentin Nechayev 28 Apr '10

28 Apr '10

Hi, PortaOne, Inc. uses freeradius-client in some our products. We want to pass some of our changes to upstream. Which form is preferrable for this? - post a bug for each - post a patch for each to this list (LKML style) - post a description with link ? Currently they are - add generating of Message-Authenticator (RFC3579) - switching from gethostbyname*() to getaddrinfo() (suitable for all our platforms and conforms to latter standards) - printing unknown attributes in response using special syntax to aid in issue debugging, instead of dropping the whole response - generating correct error code in case of unparseable response - allow to differ source address and NAS-IP-Address in request - multiple servers in config file - remove endian check and macros as unused and conflicting - misc. fixes on compiler warnings -- Valentin Nechayev PortaOne Inc., Software Engineer mailto:netch@portaone.com

2 1

GIT Log for 2010-04-26 23:33 GMT
by aland＠deployingradius.com 26 Apr '10

26 Apr '10

commit 5aa70cd8e671ca98bb1cf52a1b0b3e38b6a35dff Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Apr 26 15:38:30 2010 +0200 Added prototype Files changed: src/main/event.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) ====================================================================== commit ca96fbe57257400f1e7f47ad64cb14448bd6a670 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Apr 26 15:32:29 2010 +0200 More WITH_PROXY fixes Files changed: src/modules/rlm_eap/rlm_eap.c | 15 +++++++++++++-- .../types/rlm_eap_mschapv2/rlm_eap_mschapv2.c | 10 ++++++++-- .../rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c | 8 ++++++++ src/modules/rlm_eap/types/rlm_eap_ttls/eap_ttls.h | 2 +- .../rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c | 12 +++++++----- 5 files changed, 37 insertions(+), 10 deletions(-) ====================================================================== commit 24d3a3c54c0277a283e689e4fc1d1fd9e02d9889 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 21 08:57:29 2010 +0200 Attributes for "cisco vsa hack" don't need to be string Files changed: src/modules/rlm_preprocess/rlm_preprocess.c | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-) ====================================================================== commit cfe6ab830f32459e4bdd507a5376c941a6677d96 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 21 08:56:54 2010 +0200 Better error messages for missing brace Files changed: src/main/conffile.c | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) ====================================================================== commit d21f476971324e2a927fcac1146fe643ba8ec11c Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 21 08:55:00 2010 +0200 Allow to build without pthreads Files changed: src/main/event.c | 72 +++++++++++++++++++++++++++--------------------------- 1 files changed, 36 insertions(+), 36 deletions(-) ====================================================================== commit c25ec429a06f91d1191f5c88f42952dcf79a6da5 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Apr 26 15:57:40 2010 +0200 Fix build error Files changed: src/main/event.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) ====================================================================== commit a79b7274f59943702f846f811dc062dda72fbf68 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 21 08:52:56 2010 +0200 Print out helpful error if a realm regex can't be parsed Files changed: src/main/realms.c | 13 ++++++++++--- 1 files changed, 10 insertions(+), 3 deletions(-) ====================================================================== commit 505598df79a090e334ed82d7efce96825787fefc Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 21 08:52:21 2010 +0200 Prefer IPv4. Files changed: src/main/radclient.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) ====================================================================== commit 1eebb2ab3c7a755a18321b25a04c68b462dbe008 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 21 08:51:58 2010 +0200 Added WITH_PROXY to allow it to build without proxying Files changed: src/main/modules.c | 2 ++ src/main/util.c | 2 ++ src/modules/rlm_eap/types/rlm_eap_peap/peap.c | 21 +++++++++++++++++---- src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c | 14 +++++++++----- 4 files changed, 30 insertions(+), 9 deletions(-) ======================================================================

1 0

rlm_ldap ignores password_radius_attribute
by Alexander Clouter 26 Apr '10

26 Apr '10

Hi, Looks like the rlm_ldap module ignores 'password_radius_attribute'[1] so something like the following completely untested patch is needed. The Novhell eDirectory code probably needs tweaking also to honour this variable, or alternatively remove 'password_radius_attribute' altogether and make: ---- int attr = PW_CLEARTEXT_PASSWORD; ---- Something needs to be done, otherwise there is no way to deal with: ---- ldap_local] performing user authorization for 0021040f7c04 [ldap_local] expand: (&(objectClass=ieee802Device)(cn=%{Stripped-User-Name})) -> (&(objectClass=ieee802Device)(cn=0021040f7c04)) [ldap_local] expand: ou=comms,o=soas -> ou=comms,o=soas [ldap_local] ldap_get_conn: Checking Id: 0 [ldap_local] ldap_get_conn: Got Id: 0 [ldap_local] performing search in ou=comms,o=soas, with filter (&(objectClass=ieee802Device)(cn=0021040f7c04)) [ldap_local] Added User-Password = <AHEM> in check items [ldap_local] No default NMAS login sequence [ldap_local] looking for check items in directory... [ldap_local] looking for reply items in directory... [ldap_local] user 0021040f7c04 authorized to use remote access [ldap_local] ldap_release_conn: Release Id: 0 +++[ldap_local] returns ok ++- if (Stripped-User-Name =~ /^[0-9a-f]{12}$/) returns ok ++ ... skipping else for request 2048: Preceding "if" was taken Found Auth-Type = digest !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! +- entering group authenticate {...} [digest] rlm_digest: Converting Digest-Attributes to something sane... Digest-User-Name = "0021040f7c04" Digest-Realm = "soas.ac.uk" Digest-Nonce = <AHEM> Digest-URI = "sip:soas.ac.uk" Digest-Method = "REGISTER" ---- Cheers [1] http://wiki.freeradius.org/Rlm_ldap diff --git a/src/modules/rlm_ldap/rlm_ldap.c b/src/modules/rlm_ldap/rlm_ldap.c index 133bcb6..0155aa4 100644 --- a/src/modules/rlm_ldap/rlm_ldap.c +++ b/src/modules/rlm_ldap/rlm_ldap.c @@ -148,6 +148,7 @@ typedef struct { char *access_attr; char *passwd_hdr; char *passwd_attr; + char *passwd_rad_attr; int auto_header; char *dictionary_mapping; char *groupname_attr; @@ -263,6 +264,8 @@ static const CONF_PARSER module_config[] = { offsetof(ldap_instance,passwd_hdr), NULL, NULL}, {"password_attribute", PW_TYPE_STRING_PTR, offsetof(ldap_instance,passwd_attr), NULL, NULL}, + {"password_radius_attribute", PW_TYPE_STRING_PTR, + offsetof(ldap_instance,passwd_rad_attr), NULL, NULL}, {"auto_header", PW_TYPE_BOOLEAN, offsetof(ldap_instance,auto_header), NULL, "no"}, @@ -1497,7 +1500,9 @@ static int ldap_authorize(void *instance, REQUEST * request) if (passwd_vals) for (i = 0; passwd_vals[i] != NULL; i++) { - int attr = PW_USER_PASSWORD; + int attr = (inst->passwd_rad_attr) + ? dict_attrbyname(inst->passwd_rad_attr) + : PW_USER_PASSWORD; /* should this not default to now PW_CLEARTEXT_PASSWORD */ if (strlen(passwd_vals[i]) == 0) continue;

3 3

Patch to allow FreeRADIUS server 2.1.8 to compile on non-GCC systems
by Scott Neugroschl 21 Apr '10

21 Apr '10

Change Description: * Allow code to compile on non-GCC systems, by providing const casting when necessary (command.c, for example) * Allow code to compile on non-GCC systems, by fixing variable declarations that are not at the beginning of a block (ltdl.c, for example) diff -urN freeradius-server-2.1.8/libltdl/ltdl.c freeradiusd-gnucleanup/libltdl/ltdl.c --- freeradius-server-2.1.8/libltdl/ltdl.c 2009-12-30 07:44:35.000000000 -0800 +++ freeradiusd-gnucleanup/libltdl/ltdl.c 2010-04-20 07:25:27.000000000 -0700 @@ -2442,12 +2442,14 @@ while (loader) { + lt_user_data data; /* san */ if (useloader && strcmp(loader->loader_name, useloader)) { loader = loader->next; continue; } - lt_user_data data = loader->dlloader_data; +/* lt_user_data data = loader->dlloader_data; */ /* SAN */ + data = loader->dlloader_data; /* SAN */ cur->module = loader->module_open (data, filename); diff -urN freeradius-server-2.1.8/src/main/auth.c freeradiusd-gnucleanup/src/main/auth.c --- freeradius-server-2.1.8/src/main/auth.c 2009-12-30 07:44:35.000000000 -0800 +++ freeradiusd-gnucleanup/src/main/auth.c 2010-04-20 09:28:18.000000000 -0700 @@ -175,9 +175,13 @@ */ cur_config_item = request->config_items; while(((auth_type_pair = pairfind(cur_config_item, PW_AUTH_TYPE))) != NULL) { + DICT_VALUE *dv = NULL; /* SAN */ auth_type = auth_type_pair->vp_integer; auth_type_count++; - DICT_VALUE *dv = dict_valbyattr(auth_type_pair->attribute, +/* SAN DICT_VALUE *dv = dict_valbyattr(auth_type_pair->attribute, + auth_type_pair->vp_integer); +*/ + dv = dict_valbyattr(auth_type_pair->attribute, auth_type_pair->vp_integer); RDEBUG2("Found Auth-Type = %s", diff -urN freeradius-server-2.1.8/src/main/command.c freeradiusd-gnucleanup/src/main/command.c --- freeradius-server-2.1.8/src/main/command.c 2009-12-30 07:44:35.000000000 -0800 +++ freeradiusd-gnucleanup/src/main/command.c 2010-04-20 09:33:16.000000000 -0700 @@ -842,7 +842,7 @@ return 0; } - cf_section2file(fp, client->cs); + cf_section2file(fp, /* SAN */(CONF_SECTION*)client->cs); fclose(fp); return 1; diff -urN freeradius-server-2.1.8/src/main/listen.c freeradiusd-gnucleanup/src/main/listen.c --- freeradius-server-2.1.8/src/main/listen.c 2009-12-30 07:44:35.000000000 -0800 +++ freeradiusd-gnucleanup/src/main/listen.c 2010-04-20 09:33:05.000000000 -0700 @@ -126,7 +126,7 @@ last_printed = now; } - listener->print(listener, name, sizeof(name)); + listener->print(/* SAN */(rad_listen_t*)listener, name, sizeof(name)); radlog(L_ERR, "Ignoring request to %s from unknown client %s port %d", name, inet_ntop(ipaddr->af, &ipaddr->ipaddr, @@ -206,7 +206,7 @@ request = request_alloc(); if (!request) goto unknown; - request->listener = listener; + request->listener = /* SAN */(rad_listen_t*)listener; request->client = client; request->packet = rad_recv(listener->fd, 0x02); /* MSG_PEEK */ if (!request->packet) { /* badly formed, etc */ diff -urN freeradius-server-2.1.8/src/main/log.c freeradiusd-gnucleanup/src/main/log.c --- freeradius-server-2.1.8/src/main/log.c 2009-12-30 07:44:35.000000000 -0800 +++ freeradiusd-gnucleanup/src/main/log.c 2010-04-20 09:35:58.000000000 -0700 @@ -384,7 +384,7 @@ s[1] = '\0'; } - s = fr_int2str(levels, (lvl & ~L_CONS), ": "); + s = /* SAN */ (char *) fr_int2str(levels, (lvl & ~L_CONS), ": "); strcat(buffer, s); len = strlen(buffer); diff -urN freeradius-server-2.1.8/src/main/xlat.c freeradiusd-gnucleanup/src/main/xlat.c --- freeradius-server-2.1.8/src/main/xlat.c 2009-12-30 07:44:35.000000000 -0800 +++ freeradiusd-gnucleanup/src/main/xlat.c 2010-04-20 09:49:52.000000000 -0700 @@ -572,7 +572,7 @@ * Register the internal packet xlat's. */ for (i = 0; internal_xlat[i] != NULL; i++) { - xlat_register(internal_xlat[i], xlat_packet, &xlat_inst[i]); + xlat_register(internal_xlat[i], xlat_packet, /* SAN */(void*)&xlat_inst[i]); c = xlat_find(internal_xlat[i]); rad_assert(c != NULL); c->internal = TRUE; @@ -581,7 +581,7 @@ /* * New name: "control" */ - xlat_register("control", xlat_packet, &xlat_inst[0]); + xlat_register("control", xlat_packet, /* SAN */(void*)&xlat_inst[0]); c = xlat_find("control"); rad_assert(c != NULL); c->internal = TRUE; @@ -593,7 +593,7 @@ buffer[1] = '\0'; for (i = 0; i <= REQUEST_MAX_REGEX; i++) { buffer[0] = '0' + i; - xlat_register(buffer, xlat_regex, &xlat_inst[i]); + xlat_register(buffer, xlat_regex, /* SAN */(void*)&xlat_inst[i]); c = xlat_find(buffer); rad_assert(c != NULL); c->internal = TRUE; @@ -601,12 +601,12 @@ #endif /* HAVE_REGEX_H */ - xlat_register("debug", xlat_debug, &xlat_inst[0]); + xlat_register("debug", xlat_debug, /* SAN */(void*)&xlat_inst[0]); c = xlat_find("debug"); rad_assert(c != NULL); c->internal = TRUE; - xlat_register("md5", xlat_md5, &xlat_inst[0]); + xlat_register("md5", xlat_md5, /* SAN */(void*)&xlat_inst[0]); c = xlat_find("md5"); rad_assert(c != NULL); c->internal = TRUE; diff -urN freeradius-server-2.1.8/src/modules/rlm_dbm/rlm_dbm.c freeradiusd-gnucleanup/src/modules/rlm_dbm/rlm_dbm.c --- freeradius-server-2.1.8/src/modules/rlm_dbm/rlm_dbm.c 2009-12-30 07:44:35.000000000 -0800 +++ freeradiusd-gnucleanup/src/modules/rlm_dbm/rlm_dbm.c 2010-04-20 07:43:17.000000000 -0700 @@ -206,7 +206,7 @@ if ( parse_state == SMP_PATTERN ) { /* pattern line found */ DEBUG2("process pattern"); /* check pattern against request */ - if ( paircompare(req, request, vp, reply ) == 0 ) { + if ( paircompare(req, /* SAN */ (VALUE_PAIR*)request, vp, reply ) == 0 ) { DEBUG2("rlm_dbm: Pattern matched, look for request"); pairmove(&tmp_config, &vp); pairfree(&vp); diff -urN freeradius-server-2.1.8/src/modules/rlm_policy/parse.c freeradiusd-gnucleanup/src/modules/rlm_policy/parse.c --- freeradius-server-2.1.8/src/modules/rlm_policy/parse.c 2009-12-30 07:44:35.000000000 -0800 +++ freeradiusd-gnucleanup/src/modules/rlm_policy/parse.c 2010-04-20 09:24:14.000000000 -0700 @@ -1532,7 +1532,7 @@ } if ((lexer->debug & POLICY_DEBUG_PRINT_POLICY) != 0) { - rlm_policy_print(this); + rlm_policy_print(/* SAN */(policy_item_t*)this); } return 1;

3 5

A Question on patch posting etiquette
by Scott Neugroschl 21 Apr '10

21 Apr '10

To avoid yet another submission of the gcc-ism fixes, and to have proper netiquette, I've got a question. Should patches be inlined (per doc/DIFFS) or submitted as attachments, as I've seen other people do here? Thank you, Scott Neugroschl

2 1

RE: contributions to client
by Lewis Adam-VNQM87 21 Apr '10

21 Apr '10

Hi, while I cannot offer any advice, I am in a similar situation in that I am trying to get the client code to work and am fixing problems (e.g. missing Message-authenticator and support for CHAP) as I find them. Maybe those in charge can offer some guidelines about the direction the client code is going in. As I see it, freeRADIUS has 2 different and unrelated solutions for providing client functionality. 1. freeradius-client 2. radclient which is provided as part of freeradius-server As freeradius-client seems to offer a more complete client implementation, I have found myself using it as a base and then grafting on fixes from (what looks like) the more recent radclient. There are many differences between the underlying mechanisms and structures used by the 2 code bases which makes porting that much more time-consuming. So, is there a plan for freeradius-client or at least a preferred direction? Is there an aim to make the code bases more consistent? Radclient definitely seems to have some useful ideas that could be re-used. Adam. > Hi, > PortaOne, Inc. uses freeradius-client in some our products. > We want to pass some of our changes to upstream. > Which form is preferrable for this? > - post a bug for each > - post a patch for each to this list (LKML style) > - post a description with link > ? > > Currently they are > - add generating of Message-Authenticator (RFC3579) > - switching from gethostbyname*() to getaddrinfo() (suitable > for all our > platforms and conforms to latter standards) > - printing unknown attributes in response using special syntax > to aid in issue debugging, instead of dropping the whole response > - generating correct error code in case of unparseable response > - allow to differ source address and NAS-IP-Address in request > - multiple servers in config file > - remove endian check and macros as unused and conflicting > - misc. fixes on compiler warnings

2 1

freeradius-client | multiple authservers and REJECT_RC
by Stefan Karss 21 Apr '10

21 Apr '10

Hello, configuring multiple authserver in freeradius client the client retries to authenticate a user to all authservers configured although REJECT_RC is returned. This means an unauthenticated user (wrong password, no access rights) gets retried on all other authservers: line 117-119 (buildreq.c): for (i=0; (i < aaaserver->max) && (result != OK_RC) && (result != BADRESP_RC) ; i++, now = rc_getctime()) { This means that only if the result is OK (login succeeded) or the result is bogus (BADRESP_RC) the login is not retried. Is this the expected behaviour? I'd expect a failover to the other authservers on return codes other than OK_RC or REJECT_RC - as those are the only real radius replies. Could someone please also shed some light on the question: Will radius_deadtime work for other requests than PW_ACCOUNTING_REQUEST, as start_time gets initialized only if request_type is PW_ACCOUNTING_REQUEST? I don't seem to get the meaning of the code here... Rgds, Stefan

2 3

another dictionary conflict for Operator-Name (126)
by Stefan Winter 21 Apr '10

21 Apr '10

Hi, yesterday I stumbled over dictionary.usr: # dictionary.usr USR Robotics dictionary. # USR specific attributes # ATTRIBUTE Multi-Link-Flag 126 integer VALUE Multi-Link-Flag True 1 VALUE Multi-Link-Flag False 0 This is another case of clashing IETF-space attributes with vendor ignorance (just like with Ascend-Temporary-Routes a few weeks back). I think that U.S. Robotics rests in peace since quite a while now. Could this attribute be commented out for 2.2.0? We are seriously looking into depending on Operator-Name (string) and it doesn't really help that multiple conflicting dictionaries re-assign it to an integer :-( Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

1 1

FreeRADIUS 2.1.8 fails to build when configured --without-pthreads
by Scott Neugroschl 20 Apr '10

20 Apr '10

FreeRADIUS 2.1.8 HP NonStop OSS src/main/event.c compile fails when configured --without-pthreads, because WITH_PROXY is still defined in radius.h I defined WITHOUT_PROXY and WITHOUT_COA and am still getting a lot of errors. Any advice? Also, how should WITHOUT_PROXY/WITHOUT_COA/whatever be specified during configure -- by using CPPFLAGS? And how should I report nitpicky gcc-isms?

3 6

rlm_ldap.c patch
by Kenneth Grady 19 Apr '10

19 Apr '10

$ diff -c rlm_ldap.c.orig freeradius-server-2.1.8v3/src/modules/rlm_ldap/rlm_ldap.c *** rlm_ldap.c.orig Mon Apr 19 10:44:27 2010 --- freeradius-server-2.1.8v3/src/modules/rlm_ldap/rlm_ldap.c Mon Apr 19 10:40:35 2010 *************** *** 2241,2248 **** LDAP_OPT_ON); if (inst->rebind == 1) { ! ldap_set_rebind_proc(ld, ldap_rebind, ! inst); } } else { rc=ldap_set_option(ld, LDAP_OPT_REFERRALS, --- 2241,2252 ---- LDAP_OPT_ON); if (inst->rebind == 1) { ! ldap_set_rebind_proc(ld, ! #if LDAP_SET_REBIND_PROC_ARGS != 3 ! ldap_rebind); ! #else ! ldap_rebind, inst); ! #endif } } else { rc=ldap_set_option(ld, LDAP_OPT_REFERRALS,

2 1

GIT Log for 2010-04-16 23:33 GMT
by aland＠deployingradius.com 16 Apr '10

16 Apr '10

commit ee478c06e48fc57190d20e9cf708c413efa89399 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Apr 16 16:12:01 2010 +0200 Don't block when doing 'exec wait', and reading from pipe. If the child is slow, then reading from the pipe will block until the child exits. This will happen even if we intend later to wait only 10 seconds for the child pid. The solution is to call select() on the pipe. After 10 seconds, if no progress has been made: kill -TERM the child, close the pipe, and clean up the child PID. Files changed: src/main/exec.c | 95 ++++++++++++++++++++++++++++++++++++++++++++++++++++++- 1 files changed, 94 insertions(+), 1 deletions(-) ====================================================================== commit a2b12c6682e567e2e20f19bc989ac897ec2158f1 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 14 05:00:39 2010 +0200 append tunneled reply, rather than moving it This means that the operators are ignored, and any proxied packet (with operators '=' for multiple VSAs of the same name) will get handled properly. Files changed: .../rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 75e1d596966d89995e57b50d91cc4e5bb13a51ec Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 14 04:59:26 2010 +0200 Fix node comparison on delete This could be the cause of bug #35. Files changed: src/lib/hash.c | 9 +-------- 1 files changed, 1 insertions(+), 8 deletions(-) ====================================================================== commit f3a0d669dff5ca73b12f0724f38e66f00a360ea7 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Apr 13 15:16:10 2010 +0200 Fixed typo. This should help divorce CoA from normal packets. The previous fix worked, but this one is the real source of the bug Files changed: src/main/event.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit aab6b744e4afa1568985a320dc9e70c1c4d501f4 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Apr 12 11:36:52 2010 +0200 Print out hex for invalid data in PEAP tunnel. This helps debug issues. Also change the "had sent TLV failure" message to a LONG set of instructions for people who can't be bothered reading the debug output. Files changed: src/modules/rlm_eap/types/rlm_eap_peap/peap.c | 45 +++++++++++++++---------- 1 files changed, 27 insertions(+), 18 deletions(-) ====================================================================== commit a9be9015fff08fa9940ffed572a21729ebca3a5e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Apr 9 16:53:03 2010 +0200 Make request->number unsigned So that we don't print negative numbers Files changed: src/include/radiusd.h | 2 +- src/main/event.c | 53 ++++++++++++++++++++++++------------------------- 2 files changed, 27 insertions(+), 28 deletions(-) ====================================================================== commit 88cda786d8ce29cbccaf9be832d29abf16c1b6f8 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Apr 9 12:17:36 2010 +0200 Ensure correct build order include -> lib -> modules -> main Files changed: src/Makefile | 8 ++++++++ 1 files changed, 8 insertions(+), 0 deletions(-) ======================================================================

1 0

Status-Server support for RADIUS client
by Lewis Adam-VNQM87 14 Apr '10

14 Apr '10

Hi, I'm in the process of developing an embedded client based on the 1.1.6 client code. We have a requirement for issuing a Status-Server request and I can see, as it stands, the code doesn't work. The freeRADIUS server I am working with expects a PW_MESSAGE_AUTHENTICATOR attribute. The function rc_check() in lib\buildreq.c currently does not add the PW_MESSAGE_AUTHENTICATOR attribute. Searching for PW_MESSAGE_AUTHENTICATOR in the server code, I found the following code in src\module\rlm_eam\eap.c : vp = paircreate(PW_MESSAGE_AUTHENTICATOR, PW_TYPE_OCTETS); memset(vp->vp_octets, 0, AUTH_VECTOR_LEN); vp->length = AUTH_VECTOR_LEN; pairadd(&(request->reply->vps), vp); So, my questions are: 1. If the Status-Server request is experimental, is it known whether (many) other commercial RADIUS server products are supporting it? 2. Are there requirements and if so guidelines for creating meaningful authenticator values rather than all zeroes as above? 3. Are there any plans to update the client code with support for the PW_MESSAGE_AUTHENTICATOR attribute? Regards, Adam.

2 1

Two queries or SQL command for account on and acct off
by Toledo, Luis Carlos 14 Apr '10

14 Apr '10

Is it possible to have two diferent queries or SQL commands for "accounting on" and "accounting off" requests without change rlm_sql.c code ? Thanks Luis

2 1

Re: Re: Re: Radius server crash due to 35# bug
by Liu Linyong 14 Apr '10

14 Apr '10

Hello Alan, I have a question. For V2-1-7, in hash.c, please refer to the follows, static int list_delete(fr_hash_table_t *ht, fr_hash_entry_t **head, fr_hash_entry_t *node) { ...... for (cur = *head; cur != &ht->null; cur = cur->next) { if (cur == node) { // WHY NOT "if (cur->reversed == node->reversed)" ??? if (ht->cmp) { int cmp = ht->cmp(node->data, cur->data); // If cur == node, IS THIS NECESSARY? if (cmp > 0) break; if (cmp < 0) continue; } ....... } > Date: Thu, 08 Apr 2010 18:21:26 +0200 > From: Alan DeKok <aland@???> > Subject: Re: Radius server crash due to 35# bug > To: FreeRadius developers mailing list > <freeradius-devel@???> > Message-ID: <4BBE0286.50509@???> > Content-Type: text/plain; charset=ISO-8859-1 > > Liu Linyong wrote: > > 4K requests/sec. > > start_servers = 5 and max_servers = 32. But totally 9 threads were created.(That is: 3 more threads were created after initializing) > > > > Oh, I've set max_requests = 102400 in radiusd.conf. > > Hmm... I've tested it with sustained 30K packets/s for ~12 hours, and > haven't seen an issue. > > This seems to be a hard problem to reproduce. > > Alan DeKok. >

2 2

Re: Re: Re: Radius server crash due to 35# bug
by Liu Linyong 13 Apr '10

13 Apr '10

> Date: Thu, 08 Apr 2010 18:21:26 +0200 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: Radius server crash due to 35# bug > To: FreeRadius developers mailing list > <freeradius-devel(a)lists.freeradius.org> > Message-ID: <4BBE0286.50509(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Liu Linyong wrote: > > 4K requests/sec. > > start_servers = 5 and max_servers = 32. But totally 9 threads were created.(That is: 3 more threads were created after initializing) > > > > Oh, I've set max_requests = 102400 in radiusd.conf. > > Hmm... I've tested it with sustained 30K packets/s for ~12 hours, and > haven't seen an issue. > > This seems to be a hard problem to reproduce. > > Alan DeKok. > [V2-1-7] Maybe the test environments are different, so I can always reproduce the problem in an hour or so in my test ;) Yesterday, I removed the codes associated to 'hash' when receiving a request from NAS. That is: In main/event.c received_request(), will not find node from hash table, nor inserte into. BUT just add to FIFOs by thread_pool_addrequest(). Then test it for 12 hours, it work fine!! There may be something wrong with the 'hash' codes, I guess ;) Hmm... it's hard for me to understand the fr_hash_table_fixup(), then I think this 'black box' may have something wrong, haha... Besides, in src/main/event.c Ln1199, should "#ifdef WTH_COA " to be "#ifdef WITH_COA "? V2-1-8 also has this code.

2 1

Failed to insert event?
by Josip Almasi 09 Apr '10

09 Apr '10

Hi all, today my 2.0.2 died with 'Failed to insert event' message in wait_a_bit function (main/event.c). From what I've read, this can easily be fixed by assuring delay longer than timer resolution in fr_event_insert (lib/event.c). And, that was already fixed, during 2.0.3. Right? Thanks! Regards...

2 2

GIT Log for 2010-04-08 23:33 GMT
by aland＠deployingradius.com 08 Apr '10

08 Apr '10

commit 39f2b8581c9c6bb5a4142670b39f780be69589a3 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 8 09:59:55 2010 +0200 Make subdirs before modules Fixes "cannot build from clean directory" problem after switching to the new method of using "make" for recursing into subdirs Files changed: src/modules/Makefile | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) ====================================================================== commit 397533ff05725eef2c64898c15c34ad712041f9c Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 7 01:59:57 2010 +0200 Add missing 'break' to escape '%' properly. Files changed: src/modules/rlm_sqlcounter/rlm_sqlcounter.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) ====================================================================== commit c5da5a8f1af076c690463b5fb5010163377a2a8b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 7 01:58:00 2010 +0200 On DHCP Discover fail, don't send a NAK Instead, just don't respond Files changed: src/modules/frs_dhcp/frs_dhcp.c | 12 ++++++++---- 1 files changed, 8 insertions(+), 4 deletions(-) ======================================================================

1 0

Re: Re: Radius server crash due to 35# bug
by Liu Linyong 08 Apr '10

08 Apr '10

Please refer to the following post. ========================= > Author: Alan DeKok > Date: 2010-04-07 19:52 +800 > To: FreeRadius developers mailing list > Subject: Re: Radius server crash due to 35# bug > > Liu Linyong wrote: > > The conclusion: > > The 35# bug can recur rather easily. > > Hmm... I've run the server at 40K packets/s for *days*, and have been > unable to reproduce it. > > > We found FreeRadius server crash sometimes with load. > ... > > Then use gdb to run 'radiusd', and do load test with LoadRunner, which sending thousands of requests per second. > > How many requests in parallel? How many threads is the server using? ====> 4K requests/sec. start_servers = 5 and max_servers = 32. But totally 9 threads were created.(That is: 3 more threads were created after initializing) Oh, I've set max_requests = 102400 in radiusd.conf. > > > FreeRadius will cost little mem(16M) and cpu(1.6%). > > After an hour or so, the server will crash. These can be repeated easily. gdb show the position: > > It looks like a race condition, where data is accessed after it's been > freed. However, tracking it down is hard. > > Alan DeKok. ================================= Liu Linyong 2010-04-08

2 1

Radius server crash due to 35# bug
by Liu Linyong 07 Apr '10

07 Apr '10

Hi, The conclusion: The 35# bug can recur rather easily. We found FreeRadius server crash sometimes with load. To test the stability of the FreeRadius architecture, I modify the two functions: rad_authenticate() / rad_accounting(), they will do very simple things, and will not use any modules. int rad_accounting(REQUEST *request) { request->reply->code = PW_ACCOUNTING_RESPONSE; return RLM_MODULE_OK; } int rad_authenticate(REQUEST *request) { VALUE_PAIR *reply_tmp = NULL; reply_tmp = pairmake( "Service-Type", "Framed-User", T_OP_EQ); if( reply_tmp ) { pairxlatmove(request, &request->reply->vps, &reply_tmp); pairfree(&reply_tmp); } if (request->reply->code == 0) { request->reply->code = PW_AUTHENTICATION_ACK; } return RLM_MODULE_OK; } Then use gdb to run 'radiusd', and do load test with LoadRunner, which sending thousands of requests per second. FreeRadius will cost little mem(16M) and cpu(1.6%). After an hour or so, the server will crash. These can be repeated easily. gdb show the position: Program received signal SIGSEGV, Segmentation fault. 0xff376a6c in fr_packet_cmp (a=0x3d4070, b=0x0) at packet.c:139 139 if (a->sockfd < b->sockfd) return -1; (gdb) (gdb) (gdb) bt #0 0xff376a6c in fr_packet_cmp (a=0x3d4070, b=0x0) at packet.c:139 #1 0xff3680ec in list_find (ht=0x156fc8, head=0x156fe4, reversed=2911412273, data=0xffbff808) at hash.c:191 #2 0xff3685ec in fr_hash_table_finddata (ht=0x2469d0, data=0x156fe4) at hash.c:491 #3 0xff3771d0 in fr_packet_list_find (pl=0x156aa8, request=0x3d4070) at packet.c:557 #4 0x00032b88 in received_request (listener=0x15b848, packet=0x3d4070, prequest=0xffbff938, client=0x1101d8) at event.c:2746 #5 0x0001d5bc in acct_socket_recv (listener=0x15b848, pfun=0xffbff93c, prequest=0xffbff938) at listen.c:908 #6 0x000337d0 in event_socket_handler (xel=0x158450, fd=10, ctx=0x15b848) at event.c:3316 #7 0xff377f84 in fr_event_loop (el=0x158450) at event.c:400 #8 0x000284b4 in main (argc=2, argv=0xffbffb3c) at radiusd.c:398 The problem seems to be the same with 35# bug. (https://bugs.freeradius.org/bugzilla/show_bug.cgi?id=35) Environmnet: MEM: 24G phys mem OS: Solaris 5.10, sparc GCC: 3.3.2 GMAKE: 3.80 GDB: 6.8 CLIENT: LoadRunner (sending packages: auth & acct start & acct stop) FreeRadius server: 2-1-7 Is there any information else I should post here? *********************************************** Liu Linyong 2010-04-07

2 1

should discard packet when received AUTH header length < 20 ?
by WANG Tinggong 01 Apr '10

01 Apr '10

hi all, in src/main/listen.c , auth_socket_recv function, rad_recv_header uses MSG_PEEK flag. in case 0 <= rcode < 20, malfromed request still in the receive queue, should it be cleaned before line 757 ? 751 rcode = rad_recv_header(listener->fd, &src_ipaddr, &src_port, &code ); 752 if (rcode < 0) return 0; 753 754 RAD_STATS_TYPE_INC(listener, total_requests); 755 756 if (rcode < 20) { /* AUTH_HDR_LEN */ 757 RAD_STATS_TYPE_INC(listener, total_malformed_requests); 758 return 0; 759 } here is my patch against branch v2.1.x , does it make sense? thanks Tinggong --- src/main/listen.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/src/main/listen.c b/src/main/listen.c index 59ff314..855ee9c 100644 --- a/src/main/listen.c +++ b/src/main/listen.c @@ -754,6 +754,7 @@ static int auth_socket_recv(rad_listen_t *listener, RAD_STATS_TYPE_INC(listener, total_requests); if (rcode < 20) { /* AUTH_HDR_LEN */ + rad_recv_discard(listener->fd); RAD_STATS_TYPE_INC(listener, total_malformed_requests); return 0; }

2 1