November 2011 - Freeradius-Devel - lists.freeradius.org

rlm_sql_ocioracle driver v. 0.1
by Ge＠＠ru 14 Mar '15

14 Mar '15

Hi, in attachment patch to add rlm_sql_ocioracle driver to freeradius 2.1.x tree (it seems work yet on 3.x tree). This drivers permit to use function/procedure with CURSOR (through :Ret_Cursor string) like for example: group_membership_query = "begin :Ret_Cursor := \ pkRadius.group_membership_query('%{SQL-User-Name}'); end;" TODO for next release: - add support to oracle connection pool instead of open a new connection for every socket on startup; - enhancement on handle error (through error callback) on do query; - add documentation. Module need oracle instantclient library and ocilib library (http://orclib.sourceforge.net/) Good luck to rlm_sql_ocioracle driver!! Geaaru

2 5

Complete authorize & accounting redis module
by Manuel Guesdon 31 Oct '12

31 Oct '12

Hi, I've adapted rlm_sql to REDIS (http://redis.io/) key-store database. It handle authorize, accounting, checksimul and post-auth (only authorize is deeply tested). Authorize works like rlm_sql with groups, etc... Files are here: http://free.oxymium.net/freeradius/rlm_redisn/ Available as .tgz here: http://free.oxymium.net/freeradius/rlm_redisn-20111112-001.tgz Manuel -- ______________________________________________________________________ Manuel Guesdon - OXYMIUM

4 11

rlm_perl issues, patch
by Eike Dehling 01 Dec '11

01 Dec '11

Hi List, we use freeradius for authentication wireless users and use rlm_perl to integrate perl scripts which determine e.g. vlan info from our database and lookup the users password. I was having some issues with freeradius segfaulting. In debug mode (-X) everything worked, but normal mode (multithreaded) it segfaults. The segfault would be at a seemingly random place in the perl library. The solution was in the way rlm_perl calls perl_clone (for creating perl-threads). The perl docs say this must be done one after the other, not in parallel. By adding a mutex around the perl_clone calls, the problem went away. I have attached a patch which solved the problem for me. Perhaps this patch is of use to someone else. Suggestions and improvements are welcome? Eike Dehling Quarantainenet

2 1

latest GIT doesnt compile..
by Alan Buxey 29 Nov '11

29 Nov '11

hi, latest git pull (clean clone) <snip> Making all in src/modules/rlm_sqlippool... Making all in src/modules/rlm_unix... Making all in src/modules/rlm_utf8... Making all in src/modules/rlm_wimax... Making all in src/main... /usr/src/freeradius-server/libtool --quiet --mode=link gcc -export-dynamic -dlopen self \ -o radiusd acct.lo auth.lo client.lo conffile.lo crypt.lo exec.lo files.lo listen.lo log.lo mainconfig.lo modules.lo modcall.lo radiusd.lo stats.lo soh.lo connection.lo session.lo threads.lo util.lo valuepair.lo version.lo xlat.lo process.lo realms.lo evaluate.lo vmps.lo detail.lo cb.lo tls.lo \ /usr/src/freeradius-server/src/lib/libfreeradius-radius.la -lnsl -lresolv -lpthread \ -lcrypt /usr/src/freeradius-server/libltdl/libltdl.la -lcrypto -lssl -lcrypto .libs/listen.o: In function `listen_bind': /usr/src/freeradius-server/src/main/listen.c:2070: undefined reference to `memcset' collect2: ld returned 1 exit status gmake[4]: *** [radiusd] Error 1 gmake[3]: *** [main] Error 2 gmake[2]: *** [all] Error 2 gmake[1]: *** [src] Error 2 make: *** [all] Error 2 guessing this is a typo on line 2070 of listen.c memcset > memset ? alan

3 14

Changes to VALUE_PAIR structure
by Alan DeKok 23 Nov '11

23 Nov '11

I've pushed some changes to the VALUE_PAIR structure: - rearrange struct members to remove padding This saves ~8 bytes of memory on 64-bit machines - allocate only the needed part of the "data" field This prevents allocating 256 entry array for "integers" The result is that the VP structure is now 52 bytes for most common attributes (integer, ipaddr), instead of 312. For many VPs, that should save a *lot* of memory. I'm also investigating moving the "name", "attribute", and "vendor" fields out of the VP, and replacing them with a pointer to a DICT_ATTR. That should save only a small amount of memory, and may not be worth it. For a busy system managing ~10K requests, each having 10 attributes (request + control + reply), this means a savings of 25M of memory. That should in turn raise performance somewhat. I've taken a sweep through the code to remove everything which assumed you could print to vp_strvalue for an integer. It looks good, passes the tests, and shows no valgrind errors. So it should be OK. Let me know if you have any issues. I don't see much point in trying to reduce the memory footprint any further. What would help is allowing arbitrary length strings, but that requires changing a *lot* of code. Alan DeKok.

4 5

Fwd: Re: Fwd: License for the dictionaries
by John Dennis 23 Nov '11

23 Nov '11

I sent this question to our non-lawyer license guru, Tom Callaway who watches over licensing issues for Fedora. This is Tom's response. BTW, we do have in-house attorneys who specialize in open source licensing and I could probably ping one of them if a clarification was needed but we generally do not bother the real lawyers unless it's really important and Tom can't answer it. HTH, John -------- Original Message -------- Subject: Re: Fwd: License for the dictionaries Date: Mon, 21 Nov 2011 16:01:23 -0500 From: Tom Callaway <tcallawa(a)redhat.com> To: John Dennis <jdennis(a)redhat.com> On 11/21/2011 03:53 PM, John Dennis wrote: > Hi Spot: > > This question came up on the FreeRADIUS developers list. Do you have a > suggestion for a license type for these files. FWIW they are text files > that map integers to "attributes". I suppose they might be in the same > class of file as ASN.1 descriptions (e.g. this number means that). Well, those files might not be copyrightable in the United States. The ODBL is a giant pile of legalese that hasn't been reviewed by Fedora, mostly because it tries to protect the "database right owner" (note, this is different from copyright owner) in certain European jurisdictions where theoretically there is the capability to hold special rights on a database set that are different from copyright. None of that has any case law backing, so for the most part, it is the noise of overly-paranoid lawyers. My advice would be to instead use one of the Creative Commons licenses, as they apply well to Content, are widely used. The Free ones (the ones that are okay for Fedora) are: CC-0 (essentially a public domain declaration) CC-BY (Attribution requirement) CC-BY-SA (Attribution and Share Alike, meaning that derivatives inherit the license) Any of the CC licenses with the "Non Commercial (NC)" or "No Derivatives (ND)" clauses are Non-Free and not okay for Fedora. hth, ~tom == Fedora Project

3 3

Install freeradius modules after the main installation is done.
by artaxerxe 22 Nov '11

22 Nov '11

Hello! I installed freeradius successfully in my ubuntu 11.04. After some configurations, I realized that I need to install the rlm_postgre_sql module. Can anybody say me if is possible to add this module separately to freeradius installation, or need to reinstall freeradius? If yes, have you some hints on this? Thank you! -- View this message in context: http://freeradius.1045715.n5.nabble.com/Install-freeradius-modules-after-th… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

3 4

License for the dictionaries
by Alan DeKok 22 Nov '11

22 Nov '11

It's come to my attention that we need to clarify the license for the dictionaries. I've recently had "interesting" discussions with people off-list. Some people seem to think that the dictionaries are theirs to use as they wish, with no attribution, copyright, etc. I disagree. After some looking around, it appears that the most applicable license is the open database license: http://www.opendatacommons.org/wp-content/uploads/2009/06/odbl-10.txt The dictionaries aren't really "code", so using the GPL seems difficult. Opinions? Alan DeKok.

2 2

Need help on testing freeradius (problems with radclient)...
by artaxerxe 21 Nov '11

21 Nov '11

Hello! A had freeradius installed via apt-get into my ubuntu 11.04. Because I need to install it with JRadius module, I decided to install it from source code (via configure, make, make install). After some issues, I achieved it well, with radiusd running in my machine. Trying to configure my /etc/raddb/users so that I can test it, I get this error when I try to run radtest: > radtest "John Doe" hello 127.0.0.1 0 radiussecret /usr/local/bin/radclient: error while loading shared libraries: libfreeradius-radius-2.2.0.so: cannot open shared object file: No such file or directory Can anybody help me on this? -- View this message in context: http://freeradius.1045715.n5.nabble.com/Need-help-on-testing-freeradius-pro… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

4 8

DHCP not functional in master?
by Phil Mayers 20 Nov '11

20 Nov '11

I'm having trouble getting the "master" branch to work with dhcp. The sites-available/dhcp file says: """ In order for this to work, you will need to run configure: $ ./configure --with-dhcp $ make $ vi share/dictionary ## Un-comment the line containing $INCLUDE dictionary.dhcp ## Then, save the file. $ make install """ ...problem being those instructions don't work - there is no "dictionary.dhcp" line. If I add it and perform "make install", then when I try to start a server with the example "dhcp" virtual server enabled, it bombs out with: sites-enabled/dhcp[114]: Post-Auth-Type DHCP-Discover Not previously configured Looking at the main/modules.c code, it seems that: server { dhcp DHCP-Discover { .. } } ...is supposed to effectively map to: server { post-auth { Post-Auth-Type DHCP-Discover { .. } } } ...but I don't see how the code there can currently work; it seems it will always fail unless there is some kind of dictionary definition for: VALUE Post-Auth-Type DHCP-Discover x ...and so on. Am I missing something?

3 4