May 2010 - Freeradius-Devel - lists.freeradius.org

GIT Log for 2010-05-04 23:33 GMT
by aland＠deployingradius.com 04 May '10

04 May '10

commit 908db49448c9560f1b43c1d0b63cd77a47d4fe13 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue May 4 14:36:42 2010 +0200 Enable core dumps after suid_down Files changed: src/main/mainconfig.c | 138 ++++++++++++++++++++++++------------------------ 1 files changed, 69 insertions(+), 69 deletions(-) ====================================================================== commit 73fe4311083eb684b3d7f8592d5c1a9cfe68415e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue May 4 11:30:50 2010 +0200 Treat bad records as EOF. This helps when the disk is full, and rlm_detail writes a partial record. Files changed: src/modules/frs_detail/frs_detail.c | 11 ++++++++++- 1 files changed, 10 insertions(+), 1 deletions(-) ======================================================================

1 0

Freeradius + opensips-1.6.2-tls + mysql
by kévin 04 May '10

04 May '10

Dear, I'm a french student. I have to build a model with freeradius, opensips-1.6-tls and mysql I'm working under Linux: localhost:/etc/freeradius# uname -a Linux localhost 2.6.26-2-686 #1 SMP Tue Mar 9 17:35:51 UTC 2010 i686 GNU/Linux (Opensips, freeradius and mysql are all on the same computer) I've got some problems: when I ran /etc/init.d/freeradius, I can't have any logs in /var/log/freeradius.log or /var/log/freeradius/radacct radwtmp... If I ran freeradius in debuging mode (freeradius -X) I have some message, but when I make a call, I've got the following error: Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Accounting-Request packet from host 127.0.0.1 port 52934, id=186, length=268 Acct-Status-Type = Interim-Update Service-Type = 0 Sip-Response-Code = 200 Sip-Method = ACK Event-Timestamp = "May 4 2010 10:35:55 CEST" Sip-From-Tag = "4067e8d8-acca-4d3b-8972-9956b34718b2" Sip-To-Tag = "4fed310e-df10-489e-9af1-3d54fa2b7423" Acct-Session-Id = "97dfa858-9c80-4644-906b-b93c99b9f0b9" User-Name = "1001(a)192.168.1.35" Calling-Station-Id = "sip:1001@192.168.1.35" Called-Station-Id = "sip:1002@192.168.1.35" Sip-Translated-Request-URI = "sip:192.168.1.35;lr" NAS-Port = 5060 Acct-Delay-Time = 0 NAS-IP-Address = 127.0.0.1 +- entering group preacct Segmentation fault Any advice? many thanks -- View this message in context: http://old.nabble.com/Freeradius-%2B-opensips-1.6.2-tls-%2B-mysql-tp2844541… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

2 1

Failed assertion in detail reader on incomplete packet read
by John Morrissey 03 May '10

03 May '10

We've had a few FreeRADIUS instances run out of space in /var due to unresponsive remote accounting servers. When this happens, a short packet can be written to a detail file, causing this assertion failure: ASSERT FAILED detail.c[573]: data->state == STATE_QUEUED when the VP-reading loop hits EOF and falls through to the alloc_packet label without having read a trailing newline indicating end of packet: while (fgets(buffer, sizeof(buffer), data->fp)) { [...] /* * We're reading VP's, and got a blank line. * Queue the packet. */ if ((data->state == STATE_READING) && (buffer[0] == '\n')) { data->state = STATE_QUEUED; break; } [...] } [...] alloc_packet: rad_assert(data->state == STATE_QUEUED); The writes in rlm_detail's do_detail() are unchecked, so failed writes allow a successful Accounting-Response to be returned to the NAS even though the detail is incomplete and won't be processed by the detail reader. It seems the best way around this is for do_detail() to keep track of the number of bytes it's written, ftruncate() the detail file on a short write, and return RLM_MODULE_FAIL. fprintf() would need to be replaced with separate sprintf() and fwrite() in order to keep track of the number of bytes written for the current packet. Does this course of action make sense? I can work on this, but it may be a few weeks before I have more time. john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

2 1

Re: rlm_ldap & TCP KeepAlive
by Fred MAISON 03 May '10

03 May '10

> Message: 4 > Date: Fri, 30 Apr 2010 11:56:25 +0200 > From: Alan DeKok <aland at deployingradius.com> > Subject: Re: rlm_ldap & TCP KeepAlive > To: FreeRadius developers mailing list > <freeradius-devel at lists.freeradius.org> > Message-ID: <4BDAA949.3020100 at deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Fred MAISON wrote: > > Some stateful equipments like firewall or load-balancers tends to drop > > long-time idle tcp session to protect their session tables. > > To keep idle tcp session active and avoid this kind of deconnections, I > > found it could be useful to be able to configure TCP KeepAlive from > > rlm_ldap config file, exposing TCP KeepAlive options available in > > Openldap libraries to rlm_ldap config file : > > LDAP_OPT_X_KEEPALIVE_IDLE, LDAP_OPT_X_KEEPALIVE_PROBES, > > LDAP_OPT_X_KEEPALIVE_INTERVAL > > Yup. > > > Unfortunately, as Redhat released his 5.5, I don't have anymore access > > to jdennis binary repository, so I am in trouble to recompile 2.1.8 for > > CentOS 5.4 on x86_64. > > I have tried to recompile freeradius 2.1.8 with this patch from > > fedoraproject cvs sources, but I don't know how to integrate this patch > > in the source tree. > > Use the "patch" program: > > $ hg diff > patch > $ cd src/modules/rlm_ldap > $ patch -p1 < ../../patch > > Then build it. > > This can be done after the "configure" stage. > > > Once validated, could this kind of code be integrated in a future > > release ? > > Yes. John has a number of LDAP patches pending. > > Alan DeKok. I am interested with John's patches. Where are they available ? I am also interested with Alexander Coulter patches you talked about in a post dated 28 Jan 2010 17:36:46 +0100 regarding ldap redundancy & Ldap-Group checkItem in user file (message 4B61BD1E.1090005 at deployingradius.com) As you talked about integration of those patches in 2.2.0, How can I access freeradius 2.2.x cvs ? I tried cvs -d :pserver:anoncvs at cvs.freeradius.org:/source checkout radiusd, but the version retrieved there seems to be 2.0.6 ... Best regards, Fred MAISON

3 3