November 2011 - Freeradius-Devel - lists.freeradius.org

rlm_sql_ocioracle driver v. 0.1
by Ge＠＠ru 14 Mar '15

14 Mar '15

Hi, in attachment patch to add rlm_sql_ocioracle driver to freeradius 2.1.x tree (it seems work yet on 3.x tree). This drivers permit to use function/procedure with CURSOR (through :Ret_Cursor string) like for example: group_membership_query = "begin :Ret_Cursor := \ pkRadius.group_membership_query('%{SQL-User-Name}'); end;" TODO for next release: - add support to oracle connection pool instead of open a new connection for every socket on startup; - enhancement on handle error (through error callback) on do query; - add documentation. Module need oracle instantclient library and ocilib library (http://orclib.sourceforge.net/) Good luck to rlm_sql_ocioracle driver!! Geaaru

2 5

Complete authorize & accounting redis module
by Manuel Guesdon 31 Oct '12

31 Oct '12

Hi, I've adapted rlm_sql to REDIS (http://redis.io/) key-store database. It handle authorize, accounting, checksimul and post-auth (only authorize is deeply tested). Authorize works like rlm_sql with groups, etc... Files are here: http://free.oxymium.net/freeradius/rlm_redisn/ Available as .tgz here: http://free.oxymium.net/freeradius/rlm_redisn-20111112-001.tgz Manuel -- ______________________________________________________________________ Manuel Guesdon - OXYMIUM

4 11

rlm_perl issues, patch
by Eike Dehling 01 Dec '11

01 Dec '11

Hi List, we use freeradius for authentication wireless users and use rlm_perl to integrate perl scripts which determine e.g. vlan info from our database and lookup the users password. I was having some issues with freeradius segfaulting. In debug mode (-X) everything worked, but normal mode (multithreaded) it segfaults. The segfault would be at a seemingly random place in the perl library. The solution was in the way rlm_perl calls perl_clone (for creating perl-threads). The perl docs say this must be done one after the other, not in parallel. By adding a mutex around the perl_clone calls, the problem went away. I have attached a patch which solved the problem for me. Perhaps this patch is of use to someone else. Suggestions and improvements are welcome? Eike Dehling Quarantainenet

2 1

latest GIT doesnt compile..
by Alan Buxey 29 Nov '11

29 Nov '11

hi, latest git pull (clean clone) <snip> Making all in src/modules/rlm_sqlippool... Making all in src/modules/rlm_unix... Making all in src/modules/rlm_utf8... Making all in src/modules/rlm_wimax... Making all in src/main... /usr/src/freeradius-server/libtool --quiet --mode=link gcc -export-dynamic -dlopen self \ -o radiusd acct.lo auth.lo client.lo conffile.lo crypt.lo exec.lo files.lo listen.lo log.lo mainconfig.lo modules.lo modcall.lo radiusd.lo stats.lo soh.lo connection.lo session.lo threads.lo util.lo valuepair.lo version.lo xlat.lo process.lo realms.lo evaluate.lo vmps.lo detail.lo cb.lo tls.lo \ /usr/src/freeradius-server/src/lib/libfreeradius-radius.la -lnsl -lresolv -lpthread \ -lcrypt /usr/src/freeradius-server/libltdl/libltdl.la -lcrypto -lssl -lcrypto .libs/listen.o: In function `listen_bind': /usr/src/freeradius-server/src/main/listen.c:2070: undefined reference to `memcset' collect2: ld returned 1 exit status gmake[4]: *** [radiusd] Error 1 gmake[3]: *** [main] Error 2 gmake[2]: *** [all] Error 2 gmake[1]: *** [src] Error 2 make: *** [all] Error 2 guessing this is a typo on line 2070 of listen.c memcset > memset ? alan

3 14

Changes to VALUE_PAIR structure
by Alan DeKok 23 Nov '11

23 Nov '11

I've pushed some changes to the VALUE_PAIR structure: - rearrange struct members to remove padding This saves ~8 bytes of memory on 64-bit machines - allocate only the needed part of the "data" field This prevents allocating 256 entry array for "integers" The result is that the VP structure is now 52 bytes for most common attributes (integer, ipaddr), instead of 312. For many VPs, that should save a *lot* of memory. I'm also investigating moving the "name", "attribute", and "vendor" fields out of the VP, and replacing them with a pointer to a DICT_ATTR. That should save only a small amount of memory, and may not be worth it. For a busy system managing ~10K requests, each having 10 attributes (request + control + reply), this means a savings of 25M of memory. That should in turn raise performance somewhat. I've taken a sweep through the code to remove everything which assumed you could print to vp_strvalue for an integer. It looks good, passes the tests, and shows no valgrind errors. So it should be OK. Let me know if you have any issues. I don't see much point in trying to reduce the memory footprint any further. What would help is allowing arbitrary length strings, but that requires changing a *lot* of code. Alan DeKok.

4 5

Fwd: Re: Fwd: License for the dictionaries
by John Dennis 23 Nov '11

23 Nov '11

I sent this question to our non-lawyer license guru, Tom Callaway who watches over licensing issues for Fedora. This is Tom's response. BTW, we do have in-house attorneys who specialize in open source licensing and I could probably ping one of them if a clarification was needed but we generally do not bother the real lawyers unless it's really important and Tom can't answer it. HTH, John -------- Original Message -------- Subject: Re: Fwd: License for the dictionaries Date: Mon, 21 Nov 2011 16:01:23 -0500 From: Tom Callaway <tcallawa(a)redhat.com> To: John Dennis <jdennis(a)redhat.com> On 11/21/2011 03:53 PM, John Dennis wrote: > Hi Spot: > > This question came up on the FreeRADIUS developers list. Do you have a > suggestion for a license type for these files. FWIW they are text files > that map integers to "attributes". I suppose they might be in the same > class of file as ASN.1 descriptions (e.g. this number means that). Well, those files might not be copyrightable in the United States. The ODBL is a giant pile of legalese that hasn't been reviewed by Fedora, mostly because it tries to protect the "database right owner" (note, this is different from copyright owner) in certain European jurisdictions where theoretically there is the capability to hold special rights on a database set that are different from copyright. None of that has any case law backing, so for the most part, it is the noise of overly-paranoid lawyers. My advice would be to instead use one of the Creative Commons licenses, as they apply well to Content, are widely used. The Free ones (the ones that are okay for Fedora) are: CC-0 (essentially a public domain declaration) CC-BY (Attribution requirement) CC-BY-SA (Attribution and Share Alike, meaning that derivatives inherit the license) Any of the CC licenses with the "Non Commercial (NC)" or "No Derivatives (ND)" clauses are Non-Free and not okay for Fedora. hth, ~tom == Fedora Project

3 3

Install freeradius modules after the main installation is done.
by artaxerxe 22 Nov '11

22 Nov '11

Hello! I installed freeradius successfully in my ubuntu 11.04. After some configurations, I realized that I need to install the rlm_postgre_sql module. Can anybody say me if is possible to add this module separately to freeradius installation, or need to reinstall freeradius? If yes, have you some hints on this? Thank you! -- View this message in context: http://freeradius.1045715.n5.nabble.com/Install-freeradius-modules-after-th… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

3 4

License for the dictionaries
by Alan DeKok 22 Nov '11

22 Nov '11

It's come to my attention that we need to clarify the license for the dictionaries. I've recently had "interesting" discussions with people off-list. Some people seem to think that the dictionaries are theirs to use as they wish, with no attribution, copyright, etc. I disagree. After some looking around, it appears that the most applicable license is the open database license: http://www.opendatacommons.org/wp-content/uploads/2009/06/odbl-10.txt The dictionaries aren't really "code", so using the GPL seems difficult. Opinions? Alan DeKok.

2 2

Need help on testing freeradius (problems with radclient)...
by artaxerxe 21 Nov '11

21 Nov '11

Hello! A had freeradius installed via apt-get into my ubuntu 11.04. Because I need to install it with JRadius module, I decided to install it from source code (via configure, make, make install). After some issues, I achieved it well, with radiusd running in my machine. Trying to configure my /etc/raddb/users so that I can test it, I get this error when I try to run radtest: > radtest "John Doe" hello 127.0.0.1 0 radiussecret /usr/local/bin/radclient: error while loading shared libraries: libfreeradius-radius-2.2.0.so: cannot open shared object file: No such file or directory Can anybody help me on this? -- View this message in context: http://freeradius.1045715.n5.nabble.com/Need-help-on-testing-freeradius-pro… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

4 8

DHCP not functional in master?
by Phil Mayers 20 Nov '11

20 Nov '11

I'm having trouble getting the "master" branch to work with dhcp. The sites-available/dhcp file says: """ In order for this to work, you will need to run configure: $ ./configure --with-dhcp $ make $ vi share/dictionary ## Un-comment the line containing $INCLUDE dictionary.dhcp ## Then, save the file. $ make install """ ...problem being those instructions don't work - there is no "dictionary.dhcp" line. If I add it and perform "make install", then when I try to start a server with the example "dhcp" virtual server enabled, it bombs out with: sites-enabled/dhcp[114]: Post-Auth-Type DHCP-Discover Not previously configured Looking at the main/modules.c code, it seems that: server { dhcp DHCP-Discover { .. } } ...is supposed to effectively map to: server { post-auth { Post-Auth-Type DHCP-Discover { .. } } } ...but I don't see how the code there can currently work; it seems it will always fail unless there is some kind of dictionary definition for: VALUE Post-Auth-Type DHCP-Discover x ...and so on. Am I missing something?

3 4

git version make error are only happen when --with-dhcp option
by ziyen 19 Nov '11

19 Nov '11

git version make error are only happen when additional options are ./configure --with-dhcp only but ./configure are not happen. Thanks listen.c: In function 'client_listener_find': listen.c:237: warning: assignment discards qualifiers from pointer target type In file included from listen.c:1365: dhcpd.c:158:2: error: #error "DHCP as a Relay requires WITH_UDPFROMTO compilation flag" In file included from listen.c:1365: dhcpd.c: In function 'dhcp_socket_parse': dhcpd.c:497: warning: assignment discards qualifiers from pointer target type In file included from listen.c:1367: command.c: In function 'command_socket_parse': command.c:1947: warning: comparison between signed and unsigned integer expressions command.c:1947: warning: comparison between signed and unsigned integer expressions gmake[4]: *** [listen.lo] Error 1 gmake[4]: Leaving directory `/home/admin/FR/SVN/20111118/freeradius-server/src/main'

1 0

git version make error...
by ziyen 19 Nov '11

19 Nov '11

Hi when using git version have some error like below... listen.c: In function 'client_listener_find': listen.c:237: warning: assignment discards qualifiers from pointer target type In file included from listen.c:1365: dhcpd.c:158:2: error: #error "DHCP as a Relay requires WITH_UDPFROMTO compilation flag" In file included from listen.c:1365: dhcpd.c: In function 'dhcp_socket_parse': dhcpd.c:497: warning: assignment discards qualifiers from pointer target type In file included from listen.c:1367: command.c: In function 'command_socket_parse': command.c:1947: warning: comparison between signed and unsigned integer expressions command.c:1947: warning: comparison between signed and unsigned integer expressions gmake[4]: *** [listen.lo] Error 1 Thanks

2 1

How to install freeradius2.1.12 ? Warnings are generated at ./configure time
by artaxerxe 18 Nov '11

18 Nov '11

Hello! Here is my issue: Anytime when I try to install freeradius, I get the following warnings (this are only the warnings without the rest of output): configure: WARNING: snmpget not found - Simultaneous-Use and checkrad.pl may not work configure: WARNING: snmpwalk not found - Simultaneous-Use and checkrad.pl may not work configure: WARNING: pcap library not found, silently disabling the RADIUS sniffer. configure: WARNING: silently not building rlm_counter. configure: WARNING: FAILURE: rlm_counter requires: libgdbm. configure: WARNING: FAILURE: rlm_dbm requires: (ndbm.h or gdbm/ndbm.h or gdbm-ndbm.h) (libndbm or libgdbm or libgdbm_compat). configure: WARNING: silently not building rlm_dbm. configure: WARNING: silently not building rlm_eap_peap. configure: WARNING: FAILURE: rlm_eap_peap requires: OpenSSL. configure: WARNING: silently not building rlm_eap_ttls. configure: WARNING: FAILURE: rlm_eap_ttls requires: OpenSSL. configure: WARNING: silently not building rlm_eap_tls. configure: WARNING: FAILURE: rlm_eap_tls requires: OpenSSL. configure: WARNING: silently not building rlm_eap_ikev2. configure: WARNING: FAILURE: rlm_eap_ikev2 requires: libeap-ikev2 EAPIKEv2/connector.h. configure: WARNING: the TNCS library isn't found! configure: WARNING: silently not building rlm_eap_tnc. configure: WARNING: FAILURE: rlm_eap_tnc requires: -lTNCS. configure: WARNING: silently not building rlm_ippool. configure: WARNING: FAILURE: rlm_ippool requires: libgdbm. configure: WARNING: neither krb5 'k5crypto' nor 'crypto' libraries are found! configure: WARNING: the comm_err library isn't found! configure: WARNING: silently not building rlm_krb5. configure: WARNING: FAILURE: rlm_krb5 requires: krb5.h krb5. configure: WARNING: silently not building rlm_ldap. configure: WARNING: FAILURE: rlm_ldap requires: libldap_r ldap.h. configure: WARNING: silently not building rlm_otp. configure: WARNING: FAILURE: rlm_otp requires: openssl-libs openssl-includes openssl-includes openssl-includes openssl-includes openssl-includes. configure: WARNING: silently not building rlm_pam. configure: WARNING: FAILURE: rlm_pam requires: libpam. configure: WARNING: silently not building rlm_perl. configure: WARNING: FAILURE: rlm_perl requires: libperl.so libperl.so. configure: WARNING: silently not building rlm_python. configure: WARNING: FAILURE: rlm_python requires: Python.h libpython2.7. configure: WARNING: silently not building rlm_sql_iodbc. configure: WARNING: FAILURE: rlm_sql_iodbc requires: libiodbc isql.h. configure: WARNING: MySQL libraries not found. Use --with-mysql-lib-dir=<path>. configure: WARNING: MySQL headers not found. Use --with-mysql-include-dir=<path>. configure: WARNING: silently not building rlm_sql_mysql. configure: WARNING: FAILURE: rlm_sql_mysql requires: libmysqlclient_r mysql.h. configure: WARNING: silently not building rlm_sql_postgresql. configure: WARNING: FAILURE: rlm_sql_postgresql requires: libpq-fe.h libpq. configure: WARNING: oracle headers not found. Use --with-oracle-include-dir=<path>. configure: WARNING: silently not building rlm_sql_oracle. configure: WARNING: FAILURE: rlm_sql_oracle requires: oci.h. configure: WARNING: silently not building rlm_sql_unixodbc. configure: WARNING: FAILURE: rlm_sql_unixodbc requires: libodbc sql.h. If I install it (make and make install) I get an error when I try to run radius.d Can anybody give me some help on this? Thanks in advance! -- View this message in context: http://freeradius.1045715.n5.nabble.com/How-to-install-freeradius2-1-12-War… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

3 7

Patch to fix shadows password expiration
by Tomi Leppikangas 14 Nov '11

14 Nov '11

Hi, I discovered that freeradius doesn't handle shadow password expiration correctly. It only looks for account expiration date, not password expiration. Also log entry for account expiration says incorrectly "password expired". I reported bug to RedHat bugzilla, but bug seems to be in master tree also. Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=753764 -- Tomi Leppikangas

1 0

Standardised JSON VP list format
by Arran Cudbard-Bell 11 Nov '11

11 Nov '11

Hi All, I'm proposing the following JSON structures for VP lists being sent from and parsed by FreeRADIUS. If anyone has any suggestions regarding other fields they'd like to see included, let me know. Outbound (request): { "<attribute>":{ type:"<type>" , # RADIUS or internal attribute type value:[<values>] # Always an array, may contain string, integer, float, JSON object (nested VP) }, "User-Name":{ type:"string", value:["user(a)example.org"] } } Inbound (response): { "[qualifiers:]<attribute>":{ op:"<operator>", # One of the standard update construct operators value:<value> # May be array (multivalued, or nested vps (JSON object)), value or JSON object (nested VP) }, # Alternative "[qualifiers:]<attribute>":<value> # Value may be anything but a JSON object, array values may still hold multiple JSON objects } All values will be XLATd. I'm thinking for the response, maybe two optional bools (for the expanded JSON object format): no_xlat - where no_xlat:true disables xlat expansion is_json - where is_json:true disables JSON parsing of the value (you can write JSON structure to an attribute for later parsing) Thoughts? If we can decide on a standard format, future modules will be required to implement it if they're just bridges to an external service (and the external service does not have predefined JSON structures). Note: The outbound request will only use attributes from the request list. If you think attributes should be included from multiple lists, please explain why. -Arran Arran Cudbard-Bell a.cudbardb(a)networkradius.com Technical consultant and solutions architect 15 Ave. du Granier, Meylan, France +33 4 69 66 54 50

6 24

Crash of "master"
by Phil Mayers 04 Nov '11

04 Nov '11

All, The copy of "master" we have running on our development radius server died last night, logging: Thu Nov 3 11:48:50 2011 : Error: Discarding duplicate request from client 51net port 42138 - ID: 210 due to unfinished request 2646 Thu Nov 3 11:49:23 2011 : Error: WARNING: Unresponsive child for request 2646, in component authorize module Thu Nov 3 11:49:23 2011 : Error: ASSERT FAILED process.c[436]: request->child_pid == NO_SUCH_CHILD_PID This particular process is a relatively simple one - all it does is mac-based vlans. The server is not getting any traffic except monitoring / test auths from our nagios system every 5 minutes. Sorry I don't have more info, but I thought I should mention it.

2 1

freeradius and google protocol buffers.
by Ruslan Shevchenko 03 Nov '11

03 Nov '11

Good day, community. 1. I need to organize interaction of freeradius with java-based backend, running as web service. So, I wrote small module, which packed received radius packet into google protocol buffer message and submit one to web service via persistent http connection: https://github.com/rssh/rlm_protobuf Interaction is done via next 'idl': https://github.com/rssh/rlm_protobuf/blob/master/src/vsa.proto freeradius give to service request_reply, then return with allow_reply_request set of actions, which we do need with pairs (add new one or remove or change) I want submit this module to freeradius, when It will be mature, but not sure: will one be generally useful and are you will be happy with 2 new optional dependencies (curl and protobuf-c) [?]. If yes -- I will start submit path requests after achieving working state. (now I assured that requests flow works, but yet not test all possible issues with authorization and service restart) 2. Yet one question for community -- it's about how people prefer to see representation of radius attributes in protocol buffers IDL. In present 'zero' version all nontrivial attributes are stored as array of bytes. In my task this is enough, but potentially such choice can cause issues with byte ordering, so may be better to create special message types for each type of attribute. So, I will be happy to see community opinion: (especially for #define PW_TYPE_ETHERNET and PW_TYPE_IFID) At last, I will be glad to see any feedback about this idea and thanks for great software. Regards !

2 2