April 2010 - Freeradius-Devel - lists.freeradius.org

contributions to client
by Valentin Nechayev 28 Apr '10

28 Apr '10

Hi, PortaOne, Inc. uses freeradius-client in some our products. We want to pass some of our changes to upstream. Which form is preferrable for this? - post a bug for each - post a patch for each to this list (LKML style) - post a description with link ? Currently they are - add generating of Message-Authenticator (RFC3579) - switching from gethostbyname*() to getaddrinfo() (suitable for all our platforms and conforms to latter standards) - printing unknown attributes in response using special syntax to aid in issue debugging, instead of dropping the whole response - generating correct error code in case of unparseable response - allow to differ source address and NAS-IP-Address in request - multiple servers in config file - remove endian check and macros as unused and conflicting - misc. fixes on compiler warnings -- Valentin Nechayev PortaOne Inc., Software Engineer mailto:netch@portaone.com

2 1

GIT Log for 2010-04-26 23:33 GMT
by aland＠deployingradius.com 26 Apr '10

26 Apr '10

commit 5aa70cd8e671ca98bb1cf52a1b0b3e38b6a35dff Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Apr 26 15:38:30 2010 +0200 Added prototype Files changed: src/main/event.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) ====================================================================== commit ca96fbe57257400f1e7f47ad64cb14448bd6a670 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Apr 26 15:32:29 2010 +0200 More WITH_PROXY fixes Files changed: src/modules/rlm_eap/rlm_eap.c | 15 +++++++++++++-- .../types/rlm_eap_mschapv2/rlm_eap_mschapv2.c | 10 ++++++++-- .../rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c | 8 ++++++++ src/modules/rlm_eap/types/rlm_eap_ttls/eap_ttls.h | 2 +- .../rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c | 12 +++++++----- 5 files changed, 37 insertions(+), 10 deletions(-) ====================================================================== commit 24d3a3c54c0277a283e689e4fc1d1fd9e02d9889 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 21 08:57:29 2010 +0200 Attributes for "cisco vsa hack" don't need to be string Files changed: src/modules/rlm_preprocess/rlm_preprocess.c | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-) ====================================================================== commit cfe6ab830f32459e4bdd507a5376c941a6677d96 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 21 08:56:54 2010 +0200 Better error messages for missing brace Files changed: src/main/conffile.c | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) ====================================================================== commit d21f476971324e2a927fcac1146fe643ba8ec11c Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 21 08:55:00 2010 +0200 Allow to build without pthreads Files changed: src/main/event.c | 72 +++++++++++++++++++++++++++--------------------------- 1 files changed, 36 insertions(+), 36 deletions(-) ====================================================================== commit c25ec429a06f91d1191f5c88f42952dcf79a6da5 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Apr 26 15:57:40 2010 +0200 Fix build error Files changed: src/main/event.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) ====================================================================== commit a79b7274f59943702f846f811dc062dda72fbf68 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 21 08:52:56 2010 +0200 Print out helpful error if a realm regex can't be parsed Files changed: src/main/realms.c | 13 ++++++++++--- 1 files changed, 10 insertions(+), 3 deletions(-) ====================================================================== commit 505598df79a090e334ed82d7efce96825787fefc Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 21 08:52:21 2010 +0200 Prefer IPv4. Files changed: src/main/radclient.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) ====================================================================== commit 1eebb2ab3c7a755a18321b25a04c68b462dbe008 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 21 08:51:58 2010 +0200 Added WITH_PROXY to allow it to build without proxying Files changed: src/main/modules.c | 2 ++ src/main/util.c | 2 ++ src/modules/rlm_eap/types/rlm_eap_peap/peap.c | 21 +++++++++++++++++---- src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c | 14 +++++++++----- 4 files changed, 30 insertions(+), 9 deletions(-) ======================================================================

1 0

rlm_ldap ignores password_radius_attribute
by Alexander Clouter 26 Apr '10

26 Apr '10

Hi, Looks like the rlm_ldap module ignores 'password_radius_attribute'[1] so something like the following completely untested patch is needed. The Novhell eDirectory code probably needs tweaking also to honour this variable, or alternatively remove 'password_radius_attribute' altogether and make: ---- int attr = PW_CLEARTEXT_PASSWORD; ---- Something needs to be done, otherwise there is no way to deal with: ---- ldap_local] performing user authorization for 0021040f7c04 [ldap_local] expand: (&(objectClass=ieee802Device)(cn=%{Stripped-User-Name})) -> (&(objectClass=ieee802Device)(cn=0021040f7c04)) [ldap_local] expand: ou=comms,o=soas -> ou=comms,o=soas [ldap_local] ldap_get_conn: Checking Id: 0 [ldap_local] ldap_get_conn: Got Id: 0 [ldap_local] performing search in ou=comms,o=soas, with filter (&(objectClass=ieee802Device)(cn=0021040f7c04)) [ldap_local] Added User-Password = <AHEM> in check items [ldap_local] No default NMAS login sequence [ldap_local] looking for check items in directory... [ldap_local] looking for reply items in directory... [ldap_local] user 0021040f7c04 authorized to use remote access [ldap_local] ldap_release_conn: Release Id: 0 +++[ldap_local] returns ok ++- if (Stripped-User-Name =~ /^[0-9a-f]{12}$/) returns ok ++ ... skipping else for request 2048: Preceding "if" was taken Found Auth-Type = digest !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! +- entering group authenticate {...} [digest] rlm_digest: Converting Digest-Attributes to something sane... Digest-User-Name = "0021040f7c04" Digest-Realm = "soas.ac.uk" Digest-Nonce = <AHEM> Digest-URI = "sip:soas.ac.uk" Digest-Method = "REGISTER" ---- Cheers [1] http://wiki.freeradius.org/Rlm_ldap diff --git a/src/modules/rlm_ldap/rlm_ldap.c b/src/modules/rlm_ldap/rlm_ldap.c index 133bcb6..0155aa4 100644 --- a/src/modules/rlm_ldap/rlm_ldap.c +++ b/src/modules/rlm_ldap/rlm_ldap.c @@ -148,6 +148,7 @@ typedef struct { char *access_attr; char *passwd_hdr; char *passwd_attr; + char *passwd_rad_attr; int auto_header; char *dictionary_mapping; char *groupname_attr; @@ -263,6 +264,8 @@ static const CONF_PARSER module_config[] = { offsetof(ldap_instance,passwd_hdr), NULL, NULL}, {"password_attribute", PW_TYPE_STRING_PTR, offsetof(ldap_instance,passwd_attr), NULL, NULL}, + {"password_radius_attribute", PW_TYPE_STRING_PTR, + offsetof(ldap_instance,passwd_rad_attr), NULL, NULL}, {"auto_header", PW_TYPE_BOOLEAN, offsetof(ldap_instance,auto_header), NULL, "no"}, @@ -1497,7 +1500,9 @@ static int ldap_authorize(void *instance, REQUEST * request) if (passwd_vals) for (i = 0; passwd_vals[i] != NULL; i++) { - int attr = PW_USER_PASSWORD; + int attr = (inst->passwd_rad_attr) + ? dict_attrbyname(inst->passwd_rad_attr) + : PW_USER_PASSWORD; /* should this not default to now PW_CLEARTEXT_PASSWORD */ if (strlen(passwd_vals[i]) == 0) continue;

3 3

Patch to allow FreeRADIUS server 2.1.8 to compile on non-GCC systems
by Scott Neugroschl 21 Apr '10

21 Apr '10

Change Description: * Allow code to compile on non-GCC systems, by providing const casting when necessary (command.c, for example) * Allow code to compile on non-GCC systems, by fixing variable declarations that are not at the beginning of a block (ltdl.c, for example) diff -urN freeradius-server-2.1.8/libltdl/ltdl.c freeradiusd-gnucleanup/libltdl/ltdl.c --- freeradius-server-2.1.8/libltdl/ltdl.c 2009-12-30 07:44:35.000000000 -0800 +++ freeradiusd-gnucleanup/libltdl/ltdl.c 2010-04-20 07:25:27.000000000 -0700 @@ -2442,12 +2442,14 @@ while (loader) { + lt_user_data data; /* san */ if (useloader && strcmp(loader->loader_name, useloader)) { loader = loader->next; continue; } - lt_user_data data = loader->dlloader_data; +/* lt_user_data data = loader->dlloader_data; */ /* SAN */ + data = loader->dlloader_data; /* SAN */ cur->module = loader->module_open (data, filename); diff -urN freeradius-server-2.1.8/src/main/auth.c freeradiusd-gnucleanup/src/main/auth.c --- freeradius-server-2.1.8/src/main/auth.c 2009-12-30 07:44:35.000000000 -0800 +++ freeradiusd-gnucleanup/src/main/auth.c 2010-04-20 09:28:18.000000000 -0700 @@ -175,9 +175,13 @@ */ cur_config_item = request->config_items; while(((auth_type_pair = pairfind(cur_config_item, PW_AUTH_TYPE))) != NULL) { + DICT_VALUE *dv = NULL; /* SAN */ auth_type = auth_type_pair->vp_integer; auth_type_count++; - DICT_VALUE *dv = dict_valbyattr(auth_type_pair->attribute, +/* SAN DICT_VALUE *dv = dict_valbyattr(auth_type_pair->attribute, + auth_type_pair->vp_integer); +*/ + dv = dict_valbyattr(auth_type_pair->attribute, auth_type_pair->vp_integer); RDEBUG2("Found Auth-Type = %s", diff -urN freeradius-server-2.1.8/src/main/command.c freeradiusd-gnucleanup/src/main/command.c --- freeradius-server-2.1.8/src/main/command.c 2009-12-30 07:44:35.000000000 -0800 +++ freeradiusd-gnucleanup/src/main/command.c 2010-04-20 09:33:16.000000000 -0700 @@ -842,7 +842,7 @@ return 0; } - cf_section2file(fp, client->cs); + cf_section2file(fp, /* SAN */(CONF_SECTION*)client->cs); fclose(fp); return 1; diff -urN freeradius-server-2.1.8/src/main/listen.c freeradiusd-gnucleanup/src/main/listen.c --- freeradius-server-2.1.8/src/main/listen.c 2009-12-30 07:44:35.000000000 -0800 +++ freeradiusd-gnucleanup/src/main/listen.c 2010-04-20 09:33:05.000000000 -0700 @@ -126,7 +126,7 @@ last_printed = now; } - listener->print(listener, name, sizeof(name)); + listener->print(/* SAN */(rad_listen_t*)listener, name, sizeof(name)); radlog(L_ERR, "Ignoring request to %s from unknown client %s port %d", name, inet_ntop(ipaddr->af, &ipaddr->ipaddr, @@ -206,7 +206,7 @@ request = request_alloc(); if (!request) goto unknown; - request->listener = listener; + request->listener = /* SAN */(rad_listen_t*)listener; request->client = client; request->packet = rad_recv(listener->fd, 0x02); /* MSG_PEEK */ if (!request->packet) { /* badly formed, etc */ diff -urN freeradius-server-2.1.8/src/main/log.c freeradiusd-gnucleanup/src/main/log.c --- freeradius-server-2.1.8/src/main/log.c 2009-12-30 07:44:35.000000000 -0800 +++ freeradiusd-gnucleanup/src/main/log.c 2010-04-20 09:35:58.000000000 -0700 @@ -384,7 +384,7 @@ s[1] = '\0'; } - s = fr_int2str(levels, (lvl & ~L_CONS), ": "); + s = /* SAN */ (char *) fr_int2str(levels, (lvl & ~L_CONS), ": "); strcat(buffer, s); len = strlen(buffer); diff -urN freeradius-server-2.1.8/src/main/xlat.c freeradiusd-gnucleanup/src/main/xlat.c --- freeradius-server-2.1.8/src/main/xlat.c 2009-12-30 07:44:35.000000000 -0800 +++ freeradiusd-gnucleanup/src/main/xlat.c 2010-04-20 09:49:52.000000000 -0700 @@ -572,7 +572,7 @@ * Register the internal packet xlat's. */ for (i = 0; internal_xlat[i] != NULL; i++) { - xlat_register(internal_xlat[i], xlat_packet, &xlat_inst[i]); + xlat_register(internal_xlat[i], xlat_packet, /* SAN */(void*)&xlat_inst[i]); c = xlat_find(internal_xlat[i]); rad_assert(c != NULL); c->internal = TRUE; @@ -581,7 +581,7 @@ /* * New name: "control" */ - xlat_register("control", xlat_packet, &xlat_inst[0]); + xlat_register("control", xlat_packet, /* SAN */(void*)&xlat_inst[0]); c = xlat_find("control"); rad_assert(c != NULL); c->internal = TRUE; @@ -593,7 +593,7 @@ buffer[1] = '\0'; for (i = 0; i <= REQUEST_MAX_REGEX; i++) { buffer[0] = '0' + i; - xlat_register(buffer, xlat_regex, &xlat_inst[i]); + xlat_register(buffer, xlat_regex, /* SAN */(void*)&xlat_inst[i]); c = xlat_find(buffer); rad_assert(c != NULL); c->internal = TRUE; @@ -601,12 +601,12 @@ #endif /* HAVE_REGEX_H */ - xlat_register("debug", xlat_debug, &xlat_inst[0]); + xlat_register("debug", xlat_debug, /* SAN */(void*)&xlat_inst[0]); c = xlat_find("debug"); rad_assert(c != NULL); c->internal = TRUE; - xlat_register("md5", xlat_md5, &xlat_inst[0]); + xlat_register("md5", xlat_md5, /* SAN */(void*)&xlat_inst[0]); c = xlat_find("md5"); rad_assert(c != NULL); c->internal = TRUE; diff -urN freeradius-server-2.1.8/src/modules/rlm_dbm/rlm_dbm.c freeradiusd-gnucleanup/src/modules/rlm_dbm/rlm_dbm.c --- freeradius-server-2.1.8/src/modules/rlm_dbm/rlm_dbm.c 2009-12-30 07:44:35.000000000 -0800 +++ freeradiusd-gnucleanup/src/modules/rlm_dbm/rlm_dbm.c 2010-04-20 07:43:17.000000000 -0700 @@ -206,7 +206,7 @@ if ( parse_state == SMP_PATTERN ) { /* pattern line found */ DEBUG2("process pattern"); /* check pattern against request */ - if ( paircompare(req, request, vp, reply ) == 0 ) { + if ( paircompare(req, /* SAN */ (VALUE_PAIR*)request, vp, reply ) == 0 ) { DEBUG2("rlm_dbm: Pattern matched, look for request"); pairmove(&tmp_config, &vp); pairfree(&vp); diff -urN freeradius-server-2.1.8/src/modules/rlm_policy/parse.c freeradiusd-gnucleanup/src/modules/rlm_policy/parse.c --- freeradius-server-2.1.8/src/modules/rlm_policy/parse.c 2009-12-30 07:44:35.000000000 -0800 +++ freeradiusd-gnucleanup/src/modules/rlm_policy/parse.c 2010-04-20 09:24:14.000000000 -0700 @@ -1532,7 +1532,7 @@ } if ((lexer->debug & POLICY_DEBUG_PRINT_POLICY) != 0) { - rlm_policy_print(this); + rlm_policy_print(/* SAN */(policy_item_t*)this); } return 1;

3 5

A Question on patch posting etiquette
by Scott Neugroschl 21 Apr '10

21 Apr '10

To avoid yet another submission of the gcc-ism fixes, and to have proper netiquette, I've got a question. Should patches be inlined (per doc/DIFFS) or submitted as attachments, as I've seen other people do here? Thank you, Scott Neugroschl

2 1

RE: contributions to client
by Lewis Adam-VNQM87 21 Apr '10

21 Apr '10

Hi, while I cannot offer any advice, I am in a similar situation in that I am trying to get the client code to work and am fixing problems (e.g. missing Message-authenticator and support for CHAP) as I find them. Maybe those in charge can offer some guidelines about the direction the client code is going in. As I see it, freeRADIUS has 2 different and unrelated solutions for providing client functionality. 1. freeradius-client 2. radclient which is provided as part of freeradius-server As freeradius-client seems to offer a more complete client implementation, I have found myself using it as a base and then grafting on fixes from (what looks like) the more recent radclient. There are many differences between the underlying mechanisms and structures used by the 2 code bases which makes porting that much more time-consuming. So, is there a plan for freeradius-client or at least a preferred direction? Is there an aim to make the code bases more consistent? Radclient definitely seems to have some useful ideas that could be re-used. Adam. > Hi, > PortaOne, Inc. uses freeradius-client in some our products. > We want to pass some of our changes to upstream. > Which form is preferrable for this? > - post a bug for each > - post a patch for each to this list (LKML style) > - post a description with link > ? > > Currently they are > - add generating of Message-Authenticator (RFC3579) > - switching from gethostbyname*() to getaddrinfo() (suitable > for all our > platforms and conforms to latter standards) > - printing unknown attributes in response using special syntax > to aid in issue debugging, instead of dropping the whole response > - generating correct error code in case of unparseable response > - allow to differ source address and NAS-IP-Address in request > - multiple servers in config file > - remove endian check and macros as unused and conflicting > - misc. fixes on compiler warnings

2 1

freeradius-client | multiple authservers and REJECT_RC
by Stefan Karss 21 Apr '10

21 Apr '10

Hello, configuring multiple authserver in freeradius client the client retries to authenticate a user to all authservers configured although REJECT_RC is returned. This means an unauthenticated user (wrong password, no access rights) gets retried on all other authservers: line 117-119 (buildreq.c): for (i=0; (i < aaaserver->max) && (result != OK_RC) && (result != BADRESP_RC) ; i++, now = rc_getctime()) { This means that only if the result is OK (login succeeded) or the result is bogus (BADRESP_RC) the login is not retried. Is this the expected behaviour? I'd expect a failover to the other authservers on return codes other than OK_RC or REJECT_RC - as those are the only real radius replies. Could someone please also shed some light on the question: Will radius_deadtime work for other requests than PW_ACCOUNTING_REQUEST, as start_time gets initialized only if request_type is PW_ACCOUNTING_REQUEST? I don't seem to get the meaning of the code here... Rgds, Stefan

2 3

another dictionary conflict for Operator-Name (126)
by Stefan Winter 21 Apr '10

21 Apr '10

Hi, yesterday I stumbled over dictionary.usr: # dictionary.usr USR Robotics dictionary. # USR specific attributes # ATTRIBUTE Multi-Link-Flag 126 integer VALUE Multi-Link-Flag True 1 VALUE Multi-Link-Flag False 0 This is another case of clashing IETF-space attributes with vendor ignorance (just like with Ascend-Temporary-Routes a few weeks back). I think that U.S. Robotics rests in peace since quite a while now. Could this attribute be commented out for 2.2.0? We are seriously looking into depending on Operator-Name (string) and it doesn't really help that multiple conflicting dictionaries re-assign it to an integer :-( Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

1 1

FreeRADIUS 2.1.8 fails to build when configured --without-pthreads
by Scott Neugroschl 20 Apr '10

20 Apr '10

FreeRADIUS 2.1.8 HP NonStop OSS src/main/event.c compile fails when configured --without-pthreads, because WITH_PROXY is still defined in radius.h I defined WITHOUT_PROXY and WITHOUT_COA and am still getting a lot of errors. Any advice? Also, how should WITHOUT_PROXY/WITHOUT_COA/whatever be specified during configure -- by using CPPFLAGS? And how should I report nitpicky gcc-isms?

3 6

rlm_ldap.c patch
by Kenneth Grady 19 Apr '10

19 Apr '10

$ diff -c rlm_ldap.c.orig freeradius-server-2.1.8v3/src/modules/rlm_ldap/rlm_ldap.c *** rlm_ldap.c.orig Mon Apr 19 10:44:27 2010 --- freeradius-server-2.1.8v3/src/modules/rlm_ldap/rlm_ldap.c Mon Apr 19 10:40:35 2010 *************** *** 2241,2248 **** LDAP_OPT_ON); if (inst->rebind == 1) { ! ldap_set_rebind_proc(ld, ldap_rebind, ! inst); } } else { rc=ldap_set_option(ld, LDAP_OPT_REFERRALS, --- 2241,2252 ---- LDAP_OPT_ON); if (inst->rebind == 1) { ! ldap_set_rebind_proc(ld, ! #if LDAP_SET_REBIND_PROC_ARGS != 3 ! ldap_rebind); ! #else ! ldap_rebind, inst); ! #endif } } else { rc=ldap_set_option(ld, LDAP_OPT_REFERRALS,

2 1