March 2011 - Freeradius-Devel - lists.freeradius.org

rlm_sql_ocioracle driver v. 0.1
by Ge＠＠ru 14 Mar '15

14 Mar '15

Hi, in attachment patch to add rlm_sql_ocioracle driver to freeradius 2.1.x tree (it seems work yet on 3.x tree). This drivers permit to use function/procedure with CURSOR (through :Ret_Cursor string) like for example: group_membership_query = "begin :Ret_Cursor := \ pkRadius.group_membership_query('%{SQL-User-Name}'); end;" TODO for next release: - add support to oracle connection pool instead of open a new connection for every socket on startup; - enhancement on handle error (through error callback) on do query; - add documentation. Module need oracle instantclient library and ocilib library (http://orclib.sourceforge.net/) Good luck to rlm_sql_ocioracle driver!! Geaaru

2 5

Missing TLS Change Cipher Spec and TLS Finished in EAP-TLS exchanges
by arno＠natisbad.org 09 Jul '11

09 Jul '11

Hi, I upgraded an internal freeradius server (Linux, Debian unstable, libssl 0.9.8) used for EAP-TLS (802.11 WPA2 access) from 2.0.5 to 2.1.3. With 2.1.3, client authentication fails in the following way (wpasupplicant on Debian unstable, working with 2.0.5): - the TLS exchange is completed from freeradius point of view. It even sends the Access-Accept message to the NAS. - from the clients point of view, the TLS exchange is not over, it expects some more data from the server which are never sent. I took two pcap traces (sent to you privately, Alan), one with 2.0.5, one with 2.1.3. It looks like the TLS Change Cipher and TLS Tinished elements of the TLS exchange are not in the EAP encapsulated TLS packets sent by the server. Compare packet #23 of 2.1.3 trace with packet #27 of 2.0.5 trace. If you use wireshark, you will notice that the SSL layer is dissected; this is because #27 has a small brother: #29. It is not sent by 2.1.3. Alan, if you have an idea or a patch, I can test it on monday. Cheers, a+

5 15

eap2 in freeradius
by Chanthearith HUON 04 Apr '11

04 Apr '11

Hi everyone, I am testing eap2 in freeradius. I run "radiusd -X", I got following error message " radiusd: symbol lookup error: /usr/lib/rlm_eap2-2.1.0.so: undefined symbol: eap_server_register_methods " Anyone, have any idea what might be wrong with the configuration? Thank in advance, Thierry

5 10

Server key exchange
by Yan Zhang 30 Mar '11

30 Mar '11

Hello, I have a question about authentication with FreeRadius server need your help. Why no server key exchange in my authentication procedure? If anything need t be configured of server side? I found a configuration item "rsa_key_exchange" in configuration of tls. It seems no function to this issue. Have anybody has the experience of this expect? Thanks very much. Regards Yan

2 3

GIT Log for 2011-03-26 00:33 GMT
by aland＠deployingradius.com 26 Mar '11

26 Mar '11

commit be83cc6f00e9e623df86fd65452e1d520e63a605 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Mar 25 15:26:53 2011 +0100 Fix for 3.0 API Files changed: src/main/auth.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 92caaa4aa5233fde81c6b13669b2982b025f8255 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Mar 25 13:53:10 2011 +0100 Correct debug log for internal proxied requests Files changed: src/main/auth.c | 11 ++++++++++- 1 files changed, 10 insertions(+), 1 deletions(-) ====================================================================== commit 3b644ab186218ca9e31d47f24ec33d927737c178 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Mar 25 10:21:07 2011 +0100 Fix generation of autoheader, and re-build it Files changed: Makefile | 10 ++-------- src/include/autoconf.h.in | 15 +++++++++++++++ 2 files changed, 17 insertions(+), 8 deletions(-) ====================================================================== commit 6d6fa321e8c5457b46ab4e86612811f88423c3b9 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Mar 25 10:14:57 2011 +0100 Fix typo in last commit Files changed: Makefile | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 47def5e27cfb10e32fb9dea4bb93ed92f7c9d68b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Mar 25 10:09:33 2011 +0100 Re-build more on reconfig Files changed: Makefile | 5 ++++- 1 files changed, 4 insertions(+), 1 deletions(-) ====================================================================== commit cefb78d4c57b5ac446bbc7936d3e4bdc59de088c Author: John Dennis <jdennis(a)redhat.com> Date: Thu Mar 24 11:59:37 2011 -0400 Fix autogen.sh The script is invoked with -e which causes the script to exit immediately if a subshell command enclosed in parentheses has a non-zero exit status. The command grep "^AC_CONFIG_HEADER" configure.in > /dev/null returns non-zero for many of the subdirs which causes the autogen.sh script to immediately exit. In fact it exits on the very first subdirectory (src/modules/rlm_sql) prematurely aborting the entire operation. Files changed: autogen.sh | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 5b35e0ca9db32ea715b359efc79adb0f3f48274f Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Mar 25 11:10:25 2011 +0100 Removed many VP_TRACE macros The new method of printing the hex version of the attributes is much better. Also added a "debug_pair" to the hard-coded Message-Authenticator Files changed: src/lib/radius.c | 9 +-------- 1 files changed, 1 insertions(+), 8 deletions(-) ====================================================================== commit a45678ac7bd24176d89c5275eb3a50fceece42be Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Mar 24 15:25:42 2011 +0100 Fixed "encode TLV" API. We need to track the START vp, and the NEXT vp. Previously, we were tracking the *current* VP and the next one, which didn't work. The issue was that if the TLV encoding recursed twice, it would not back up twice, and instead encode the next level 1 TLV as part of the current one. Also updated the location of "debug_pair", to put it into vp2data_any, which is really where it should go. Files changed: src/lib/radius.c | 25 +++++++++---------------- 1 files changed, 9 insertions(+), 16 deletions(-) ====================================================================== commit 6468fa17314d2f75dd03ec64625bb578e532daf7 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Mar 24 14:57:46 2011 +0100 Fix typos. Classifer -> ClassifIer Files changed: share/dictionary.wimax.alvarion | 18 +++++++++--------- 1 files changed, 9 insertions(+), 9 deletions(-) ======================================================================

1 0

GIT Log for 2011-03-25 00:33 GMT
by aland＠deployingradius.com 25 Mar '11

25 Mar '11

commit 3abd9fc1f272959cb36659839d8d8a8b495d8bd4 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Mar 24 14:03:05 2011 +0100 Fix bugs in last commit Encode was off by one byte (oops). Debugging output now is a bit better. Files changed: src/lib/radius.c | 109 ++++++++++++++++++++++++++++++++++++++++-------------- 1 files changed, 81 insertions(+), 28 deletions(-) ====================================================================== commit eb74b50024b92e2d34d1039862dde03c7919ddc9 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Mar 24 12:19:38 2011 +0100 Print out hex version of encoded attributes This makes debugging the encoder much easier Files changed: src/lib/radius.c | 134 ++++++++++++++++++++++++++++++++++++++++++++---------- 1 files changed, 110 insertions(+), 24 deletions(-) ====================================================================== commit 24bcf9587ce5cdc4edb44abeb5d4208df2a48785 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Mar 24 09:11:35 2011 +0100 Print VSAs in a slightly better format Files changed: src/lib/radius.c | 18 ++++++++++++++++-- 1 files changed, 16 insertions(+), 2 deletions(-) ====================================================================== commit 5d2bb283e13d8565986d91d1d9572d9518aaaef0 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Mar 24 09:02:42 2011 +0100 Print hex versions of the packet for debug*4 (-x -x -x -x) Files changed: src/lib/radius.c | 8 ++++++++ 1 files changed, 8 insertions(+), 0 deletions(-) ======================================================================

1 0

dlopen issues in 2.1.10 (was: perl dynamic expansion in unlang?)
by John Dennis 24 Mar '11

24 Mar '11

On 03/18/2011 12:39 PM, Fajar A. Nugraha wrote: > On a side note, in RHEL6's freeradius-perl RPM, rlm_perl is unusable: > Can't load '/usr/lib64/perl5/auto/Data/Dumper/Dumper.so' for module > Data::Dumper: /usr/lib64/perl5/auto/Data/Dumper/Dumper.so: undefined > symbol: Perl_sv_cmp at /usr/lib64/perl5/XSLoader.pm line 70. This was filed as https://bugzilla.redhat.com/show_bug.cgi?id=689045 I finally tracked this down and since it affects other people building 2.1.10 I thought I would pass along the info. Alan please also note there is a git formatted patch attached against the v2.1.x git branch and I think you also need to run autogen.sh again (see below). It turns out the fix is to use lt_dladvise* and Alan checked in a fix for it on 12/9/2009 in commit 7115d751. However that code does not get turned on unless HAVE_LT_DLADVISE_INIT is defined. Alan checked in a fix on 8/6/2010 in commit 323229c2 which added the check for lt_dladvise in configure.in and if found sets HAVE_LT_DLADVISE_INIT opps, but not really the actual symbol which was defined was HAVE_HAVE_LT_DLADVISE_INIT (note the extra HAVE_) This was corrected on 1/7/2011 in commit 03993758. So if you modify HAVE_HAVE_LT_DLADVISE_INIT to be HAVE_LT_DLADVISE_INIT in the 2.1.10 tree, run configure again you should pick up the lt_dladvise fixes right? Wrong. Why? Because src/include/autoconf.h.in which configure rewrites as src/include/autoconf.h does not have the HAVE_LT_DLADVISE_INIT symbol in it. Why? Because autoheader was not rerun after modifying configure.in. According to the git log it appears as if the headers were last updated on 1/29/2009, about two years ago. So the answer is to run autogen.sh right? Sort of, except autogen.sh has a bug in it which causes it to exit prematurely before it's performed 90% of its work (it misses updating *all* the modules although it does update src/include/autoconf.h.in). The fix for this is in the attached 0001-Fix-autogen.sh-the-script-is-invoked-with-e-which-ca.patch. So what do you need to do if you want to enable lt_dladvise in 2.1.10? 1) change HAVE_HAVE_LT_DLADVISE_INIT to HAVE_LT_DLADVISE_INIT 2) patch autogen.sh so it doesn't exit prematurely (not strictly necessary for lt_dladvise, but a good idea, who knows what else was getting missed because of it) 3) run autogen.sh 4) do the configure, make, & install dance Note, steps 1&2 are implemented in attached freeradius-lt-dladvise.patch Alan: I think you need to apply 0001-Fix-autogen.sh-the-script-is-invoked-with-e-which-ca.patch, then run autogen.sh, and then do a git commit. HTH, John -- John Dennis <jdennis(a)redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/

1 0

A Suggestion for rlm_ldap.
by Alister Winfield 24 Mar '11

24 Mar '11

A problem we have had and will continue to have without a small change to rlm_ldap's connection handling is that it defeats the ability of a load balancer to do its job. The issue being that if there is a temporary problem or maintenance on a bunch of LDAP servers all the active connections can end up on a tiny proportion of the servers. I understand that doing 1 query per connection would be terrible for performance so how about have 'max-requests-per-connection' in the code and drop the current connection after doing that many searches. Roughly (and untested) something like this. dogmatix:rlm_ldap alister$ git diff diff --git a/src/modules/rlm_ldap/rlm_ldap.c b/src/modules/rlm_ldap/rlm_ldap.c index 450279b..5eb1834 100644 --- a/src/modules/rlm_ldap/rlm_ldap.c +++ b/src/modules/rlm_ldap/rlm_ldap.c @@ -78,6 +78,10 @@ RCSID("$Id$") #define MAX_FAILED_CONNS_RESTART 4 #define MAX_FAILED_CONNS_START 5 +/* When connecting to a server farm its a good idea to reconnect regularly + * to allow a load balancer to do its job correctly.*/ +#define MAX_REQUESTS_PER_CONNECTION 2000 + #ifdef NOVELL_UNIVERSAL_PASSWORD /* Universal Password Length */ @@ -116,6 +120,7 @@ typedef struct ldap_conn { char bound; char locked; int failed_conns; + int query_count; #ifdef HAVE_PTHREAD_H pthread_mutex_t mutex; #endif @@ -856,12 +861,21 @@ retry: } conn->bound = 1; conn->failed_conns = 0; + conn->query_count = 0; + } + /* If we have performed greater than a fixed number of queries on this connection force a reconnect */ + if (conn->query_count > MAX_REQUESTS_PER_CONNECTION) { + conn->bound=0; + conn->query_count=0; + goto retry; } tv.tv_sec = inst->timeout; tv.tv_usec = 0; DEBUG2(" [%s] performing search in %s, with filter %s", inst->xlat_name, search_basedn ? search_basedn : "(null)" , filter); + + conn->query_count++; switch (ldap_search_st(conn->ld, search_basedn, scope, filter, attrs, 0, &tv, result)) { case LDAP_SUCCESS: @@ -1939,7 +1953,6 @@ static int ldap_authenticate(void *instance, REQUEST * request) if (conn1->failed_conns >= MAX_FAILED_CONNS_END){ conn1->failed_conns = MAX_FAILED_CONNS_RESTART; conn1->bound = 0; - } } retry: if (!conn1->bound || conn1->ld == NULL) { @@ -1955,6 +1968,7 @@ retry: } conn1->bound = 1; conn1->failed_conns = 0; + conn1->query_count = 0; } RDEBUG("Performing NMAS Authentication for user: %s, seq: %s \n", user_dn,seq);

1 0

GIT Log for 2011-03-24 00:33 GMT
by aland＠deployingradius.com 24 Mar '11

24 Mar '11

commit 2ecf8834ccf04ce0bda3041eae6dfa31384d47e6 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Mar 23 08:59:22 2011 +0100 Move illegal attributes around And enable the Motorola VSA dictionary Files changed: share/dictionary | 1 + share/dictionary.motorola | 14 -------------- share/dictionary.motorola.illegal | 26 ++++++++++++++++++++++++++ 3 files changed, 27 insertions(+), 14 deletions(-) ====================================================================== commit 228dff83d838803a2ab1771586b6a5298bfe4120 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Mar 23 17:19:18 2011 +0100 Note borken vendor-specific version of a dictionary Files changed: share/dictionary.wimax.alvarion | 514 +++++++++++++++++++++++++++++++++++++++ 1 files changed, 514 insertions(+), 0 deletions(-) ====================================================================== commit e352207c94e5eb45b2d22b5755c015251e7c021b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Mar 23 08:41:38 2011 +0100 Remove trailing whitespace Files changed: share/format.pl | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) ====================================================================== commit 555d3fd980f68ac2b6482395f76ea9206b92916d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Mar 23 08:41:21 2011 +0100 More Canopy attributes as posted to the list Files changed: share/dictionary.motorola | 66 ++++++++++++++++++++++++++++++++++++++++++--- 1 files changed, 62 insertions(+), 4 deletions(-) ====================================================================== commit ed47fb829f1ca16518b773bbd7b0c3cfa2fdebe6 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Mar 23 08:40:21 2011 +0100 Fix typos Files changed: share/dictionary.3gpp | 22 ++++++++++++++++++++-- 1 files changed, 20 insertions(+), 2 deletions(-) ====================================================================== commit d9c534dd80cb18ee43d18df5002663214d84f980 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Mar 20 08:11:05 2011 +0100 Clearer warnings about unsupported operators Files changed: src/main/evaluate.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) ====================================================================== commit 933d4cf6763591f1cc8bfd17dad966decc1fe69b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Mar 20 08:10:47 2011 +0100 Expose API to get token names Files changed: src/include/token.h | 1 + src/lib/token.c | 5 +++++ 2 files changed, 6 insertions(+), 0 deletions(-) ====================================================================== commit c86f16b8cdf2dd90825c9282d196e1fafee46309 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Mar 19 16:16:12 2011 +0100 How RADIUS should be done. Files changed: doc/rfc/rfc6158.txt | 2131 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 2131 insertions(+), 0 deletions(-) ====================================================================== commit ce1480146a0101064e0a2359b9ed399aa1234eba Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Mar 17 10:28:38 2011 +0100 Fix build error in test environment Files changed: src/main/modcall.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit a1eebb57c2fe6b86c3affa7cb27b311d65432611 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Mar 16 15:20:28 2011 +0100 Note extended-vendor-specific formats Files changed: man/man5/dictionary.5 | 10 +++++++--- 1 files changed, 7 insertions(+), 3 deletions(-) ======================================================================

1 0

Motorola Canopy Dictionary
by Ben Wiechman 23 Mar '11

23 Mar '11

Updated dictionary for Motorola Canopy. Used with the RADIUS auth/authz supported under Release 11.0+ Ben

2 1