April 2011 - Freeradius-Devel - lists.freeradius.org

rlm_sql_ocioracle driver v. 0.1
by Ge＠＠ru 14 Mar '15

14 Mar '15

Hi, in attachment patch to add rlm_sql_ocioracle driver to freeradius 2.1.x tree (it seems work yet on 3.x tree). This drivers permit to use function/procedure with CURSOR (through :Ret_Cursor string) like for example: group_membership_query = "begin :Ret_Cursor := \ pkRadius.group_membership_query('%{SQL-User-Name}'); end;" TODO for next release: - add support to oracle connection pool instead of open a new connection for every socket on startup; - enhancement on handle error (through error callback) on do query; - add documentation. Module need oracle instantclient library and ocilib library (http://orclib.sourceforge.net/) Good luck to rlm_sql_ocioracle driver!! Geaaru

2 5

Missing TLS Change Cipher Spec and TLS Finished in EAP-TLS exchanges
by arno＠natisbad.org 09 Jul '11

09 Jul '11

Hi, I upgraded an internal freeradius server (Linux, Debian unstable, libssl 0.9.8) used for EAP-TLS (802.11 WPA2 access) from 2.0.5 to 2.1.3. With 2.1.3, client authentication fails in the following way (wpasupplicant on Debian unstable, working with 2.0.5): - the TLS exchange is completed from freeradius point of view. It even sends the Access-Accept message to the NAS. - from the clients point of view, the TLS exchange is not over, it expects some more data from the server which are never sent. I took two pcap traces (sent to you privately, Alan), one with 2.0.5, one with 2.1.3. It looks like the TLS Change Cipher and TLS Tinished elements of the TLS exchange are not in the EAP encapsulated TLS packets sent by the server. Compare packet #23 of 2.1.3 trace with packet #27 of 2.0.5 trace. If you use wireshark, you will notice that the SSL layer is dissected; this is because #27 has a small brother: #29. It is not sent by 2.1.3. Alan, if you have an idea or a patch, I can test it on monday. Cheers, a+

5 15

Re: fr_packet_cmp again
by Josip Almasi 02 May '11

02 May '11

Josip Almasi wrote: > Alan DeKok wrote: >> >> Grab the "master" branch. See http://git.freeradius.org for >> instructions. The internal state machine has been *completely* >> re-written so that it's sane. If the bug still exists there, I'll be >> shocked. > > Will try. Died 7 mins after with Error: ASSERT FAILED threads.c[423]: request->magic == REQUEST_MAGIC :/ Started with -s, segfault in libfreeradius-radius-3.0.0.so. Dang its still there!:)))) -------------------------- Program received signal SIGSEGV, Segmentation fault. fr_packet_cmp (a=0xda9130, b=0x6e6f6b7369050d5b) at packet.c:141 141 if (a->sockfd < b->sockfd) return -1; #0 fr_packet_cmp (a=0xda9130, b=0x6e6f6b7369050d5b) at packet.c:141 #1 0x00007ffff7bc0adb in list_find (ht=0x841840, data=0x7fffffffe158) at hash.c:191 #2 fr_hash_table_find (ht=0x841840, data=0x7fffffffe158) at hash.c:454 #3 0x00007ffff7bc0b29 in fr_hash_table_finddata (ht=<value optimized out>, data=<value optimized out>) at hash.c:484 #4 0x00007ffff7bd067a in fr_packet_list_find (pl=<value optimized out>, request=0xda9130) at packet.c:577 #5 0x0000000000428203 in request_receive (listener=0x858090, packet=0xda9130, client=0x7a3050, fun=0x407f60 <rad_accounting>) at process.c:1181 #6 0x0000000000415bb2 in acct_socket_recv (listener=0x858090) at listen.c:1382 #7 0x00000000004295ca in event_socket_handler (xel=<value optimized out>, fd=<value optimized out>, ctx=0x858090) at process.c:3125 #8 0x00007ffff7bd141b in fr_event_loop (el=0x841e00) at event.c:413 #9 0x000000000041d334 in main (argc=<value optimized out>, argv=<value optimized out>) at radiusd.c:412 (gdb) print a=0xda9130 $1 = (const RADIUS_PACKET *) 0xda9130 (gdb) print $1->sockfd $2 = 9 (gdb) print b=0x6e6f6b7369050d5b $3 = (const RADIUS_PACKET *) 0x6e6f6b7369050d5b (gdb) print $3->sockfd Cannot access memory at address 0x6e6f6b7369050d5b -------------------------- Still running another instance of 1.2.11 under valgrind memtest, some 3M packets later it's still fine. Could it be some sort of timing issue, i.e. I have faster box than you so you cant reproduce it? FTR I have 16 cores, 4 x Xeon 2.8 GHz. BTW I like what I saw in 3, response time under heavy load is way better. Regards...

4 10

GIT Log for 2011-04-29 23:33 GMT
by aland＠deployingradius.com 29 Apr '11

29 Apr '11

commit 058bc1d7898b21d06f894db23738e01e2a8e6d61 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Apr 29 13:17:24 2011 +0200 Update timers in slightly different place Files changed: src/main/process.c | 9 +++++---- 1 files changed, 5 insertions(+), 4 deletions(-) ====================================================================== commit 10307f6eb5e0f17170bd511ca3102a18b74ad0b3 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Apr 29 13:16:01 2011 +0200 Move packet IP/ID handling to rbtrees Apparently bug #35 is caused by the hash table used to track IPs and IDs. It's too difficult to figure out what the heck is wrong with the hash table. However, replacing it with a red-black tree avoids the problem entirely. Files changed: src/lib/packet.c | 39 +++++++++++++++++---------------------- 1 files changed, 17 insertions(+), 22 deletions(-) ====================================================================== commit 6554c3178485d4f416e612b6a5b113f820291567 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Apr 29 13:12:12 2011 +0200 More and better sanity checks Files changed: src/main/threads.c | 15 +++++++++++---- 1 files changed, 11 insertions(+), 4 deletions(-) ====================================================================== commit 60e6420ba180d84e89907c67a867efb446ccf394 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Apr 29 13:09:27 2011 +0200 Fix edge condition Files changed: src/lib/fifo.c | 13 +++++-------- 1 files changed, 5 insertions(+), 8 deletions(-) ====================================================================== commit 079ebb2844c2775e8e28e4fc6ca47cc3e61770b1 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Apr 29 12:17:07 2011 +0200 Be slightly more careful about conflicting packets There are race conditions where the child thread sends a reply, and the master thread receives the "next" packet before the child thread has marked the request as DONE. In that case, don't print a message about conflicting packets. Files changed: src/main/process.c | 8 ++++++++ 1 files changed, 8 insertions(+), 0 deletions(-) ====================================================================== commit 8ece9ac1d220a4216d7046b8937672d7ca17c381 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Apr 29 12:16:45 2011 +0200 Don't free a NULL pointer Files changed: src/main/command.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) ====================================================================== commit b3be5af65352acc510bf657da0e8f9240feff7cb Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Apr 29 12:11:50 2011 +0200 Simplify statistics code Files changed: src/include/stats.h | 2 +- src/main/command.c | 20 +++++++++++--------- src/main/stats.c | 42 ++++++++++++++++++++++-------------------- 3 files changed, 34 insertions(+), 30 deletions(-) ======================================================================

1 0

GIT Log for 2011-04-28 23:33 GMT
by aland＠deployingradius.com 28 Apr '11

28 Apr '11

commit 1e36b19e9bcde6dbb6982b04f575ca6a739eba92 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 28 18:52:26 2011 +0200 Fixed tv_sub function Files changed: src/main/stats.c | 30 ++++++++++++++++++++---------- 1 files changed, 20 insertions(+), 10 deletions(-) ====================================================================== commit 53bb97efa4ab3e7ed9cea2fc50e4d4b58e2a046b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 28 17:59:11 2011 +0200 Set unresponsive child time correctly Files changed: src/main/process.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 7b47fc895db514213966390efbdcba57b93b1d4e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 28 17:51:37 2011 +0200 Count statistics for duplicate packets i.e. packets retransmitted by the client Files changed: src/main/process.c | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) ====================================================================== commit 05397efc6f3c3032bee48df9b270fcdae0b21205 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 28 17:14:06 2011 +0200 Track and print time-based statistics Now that we track packet->timestamp for requests and replies, it can be used to keep track of client/global/home-server auth/acct statistics for elapsed time. We track the elapsed time (reply - request) to see how long it takes for the server to respond to requests. We need to do the same thing for CoA packets, too. Right now we don't... Files changed: src/include/stats.h | 1 + src/main/command.c | 9 +++++ src/main/stats.c | 96 +++++++++++++++++++++++++++++++++++++++++++------- 3 files changed, 92 insertions(+), 14 deletions(-) ====================================================================== commit 013fe5b7da2901d4fd96522400b31d2013140e1a Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 28 15:33:02 2011 +0200 Fixed typo Files changed: src/main/stats.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 5a88ed9a06ccf64e25dee0533137032177697a2f Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 28 15:07:52 2011 +0200 Moved timestamps to RADIUS_PACKET structure Files changed: src/include/radiusd.h | 4 ---- src/main/detail.c | 4 ++-- src/main/process.c | 28 ++++++++++++++-------------- 3 files changed, 16 insertions(+), 20 deletions(-) ====================================================================== commit 15d8c035f8bc8b8bee3218a3b46ec755b3ab8ee4 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 28 14:58:06 2011 +0200 Make packet timestamp be "struct timeval" Files changed: src/include/libradius.h | 2 +- src/main/detail.c | 4 ++-- src/main/listen.c | 2 +- src/main/process.c | 3 +-- 4 files changed, 5 insertions(+), 6 deletions(-) ====================================================================== commit 083c67bba258f8251cc7c204a09310dcde655446 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 28 12:39:59 2011 +0200 Check for OpenSSL MD4/MD5/SHA functions Files changed: configure | 3 +++ configure.in | 3 +++ src/include/autoconf.h.in | 9 +++++++++ 3 files changed, 15 insertions(+), 0 deletions(-) ====================================================================== commit 3e4efb47bbac387713094685fb47408a7f4e6d3e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 28 12:24:30 2011 +0200 Fix compile warnings Files changed: src/main/radattr.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) ====================================================================== commit 35701ac789a4bbdabdce9ad3b7dddbd3e6a38c58 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 28 11:09:45 2011 +0200 pairmake may return NULL if the dictionaries are broken. The code should check for this, and behave gracefully Files changed: src/main/soh.c | 24 +++++++++++++++++++++++- 1 files changed, 23 insertions(+), 1 deletions(-) ====================================================================== commit 407f40cc9e5dccea0b5b5a66fe859d0fddd16c83 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 28 11:07:07 2011 +0200 Fix typo in attribute name Files changed: src/main/soh.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 3106f200c051871b217f84b14a32f11026dcb119 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 28 10:38:34 2011 +0200 Minor cleanups In-lined a function, and clarified the logic flow Files changed: src/main/process.c | 55 ++++++++++++++++++++++----------------------------- 1 files changed, 24 insertions(+), 31 deletions(-) ====================================================================== commit f20a7e228ff68ac9aaac7c60e27f2af61bfff0d5 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 28 09:30:06 2011 +0200 Minor changes to ifdef's to build with various flags So that we can do #undef WITH_TCP or WITH_PROXY, etc. and it will still compile and work Files changed: src/main/process.c | 8 +++++--- 1 files changed, 5 insertions(+), 3 deletions(-) ====================================================================== commit 347d26d5fc8e66864f059c857c5b7f3415c62b23 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 27 14:50:28 2011 +0200 Merged post-handler and cleanup into request_finish This also lets us run "Post-Auth-Type Reject" before sending the Access-Reject, which is probably a good idea... Files changed: src/main/process.c | 34 ++++++++++++---------------------- 1 files changed, 12 insertions(+), 22 deletions(-) ======================================================================

1 0

fr_packet_cmp again
by Josip Almasi 28 Apr '11

28 Apr '11

Hi, compiled current 2.1.11 branch on RHEL 6.0 and RHEL 5.5, hit it with about 7.5K req/s, and it dies on both, after about 1-3.5M requests. Hit it with about 1000 req/s, it still dies. It's always segfault in libfreeradius. (there's more issues on RHEL 6 but they're not critical) It's got nothing to do with max_request_time; tried changing it just in case, but I get response time in milliseconds anyway. It's not about threads; tried with -s, and it still dies. I'm reasonably sure it's not about load either, just I can't wait like 100000 secs for fail. All the time, I get decent response time (<20ms auth, <200ms acct) and no retries. Well at least there's no 'ignoring dupes' repored in radius.log. Well there's nothing except 'ready' in radius.log. In fact, it seems bug #35 is still on: ----------------- Program received signal SIGSEGV, Segmentation fault. fr_packet_cmp (a=0x11edc90, b=0xfb0b098dddf10f89) at packet.c:139 139 if (a->sockfd < b->sockfd) return -1; (gdb) bt #0 fr_packet_cmp (a=0x11edc90, b=0xfb0b098dddf10f89) at packet.c:139 #1 0x00007ffff7bc551b in list_find (ht=0x85aa80, data=0x7fffffffe1c8) at hash.c:191 #2 fr_hash_table_find (ht=0x85aa80, data=0x7fffffffe1c8) at hash.c:454 #3 0x00007ffff7bc5569 in fr_hash_table_finddata (ht=<value optimized out>, data=<value optimized out>) at hash.c:484 #4 0x00007ffff7bd30ea in fr_packet_list_find (pl=<value optimized out>, request=0x11edc90) at packet.c:583 #5 0x0000000000428569 in received_request (listener=0x8686a0, packet=0x11edc90, prequest=0x7fffffffe320, client=0x79d680) at event.c:2833 #6 0x0000000000414ee3 in auth_socket_recv (listener=0x8686a0, pfun=0x7fffffffe328, prequest=0x7fffffffe320) at listen.c:857 #7 0x00000000004291a0 in event_socket_handler (xel=<value optimized out>, fd=<value optimized out>, ctx=0x8686a0) at event.c:3423 #8 0x00007ffff7bd437b in fr_event_loop (el=0x854c50) at event.c:413 #9 0x000000000041beb4 in main (argc=<value optimized out>, argv=<value optimized out>) at radiusd.c:408 (gdb) print a=0x11edc90 $1 = (const RADIUS_PACKET *) 0x11edc90 (gdb) print $1->sockfd $2 = 10 (gdb) print b=0xfb0b098dddf10f89 $3 = (const RADIUS_PACKET *) 0xfb0b098dddf10f89 (gdb) print $3->sockfd Cannot access memory at address 0xfb0b098dddf10f89 ----------------- Did this a number of times, sometimes it's auth_socket_recv but mostly acct_socket_recv. So it seems something still frees data before yanking list...? Well, beats me. Any hints? Now, how to reproduce: - get spizd 0.5 from http://sourceforge.net/projects/spizd/files/ - unzip, have java in path - edit etc/dictionary.txt, enter at least one username:password pair - run bin/spizd-radius.sh <server>, verify you get Access-Accept - edit etc/spizd.properties: change verboseThis and verboseThat to false, change spizd.circular to true - run spizd-radius.sh again and wait, it dies about 10-15 mins later - optionally, increase maxThreads to kill it faster What this test does: Access-Request, Acct Start, (optionally a number of Interim-Update), Acct Stop - sending request imediatelly after response to previous request is received, thread per session. Regards...

2 3

GIT Log for 2011-04-27 23:33 GMT
by aland＠deployingradius.com 27 Apr '11

27 Apr '11

commit ddc48bbe675e2d2fdf17e646729569d56b2e9ab1 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 27 11:38:20 2011 +0200 Fix logic so proxying inner-tunnel requests works the "post-process" stage is really "just before we send the reply" Files changed: src/main/process.c | 35 ++++++++++++++++++----------------- 1 files changed, 18 insertions(+), 17 deletions(-) ====================================================================== commit d43c329fb7483d258a7cac8b16ac85038fb45b3b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 27 09:41:08 2011 +0200 Load the default virtual server before any others This avoids user surprise Files changed: src/main/modules.c | 40 +++++++++++++++++++++++++--------------- 1 files changed, 25 insertions(+), 15 deletions(-) ====================================================================== commit 35834589bf5918410ca17a921a387510b5ca17ee Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 21 09:00:09 2011 +0200 Mark the module as HUP-safe Files changed: src/modules/rlm_mschap/rlm_mschap.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ======================================================================

1 0

SNMP Traps
by Alan DeKok 27 Apr '11

27 Apr '11

See raddb/trigger.conf in the "master" git branch. The server can now send traps when it starts, when a home server is marked "dead", "alive", etc. The functionality is abstracted so that it doesn't *have* to be SNMP traps. Instead, a set of triggers is pre-defined in the server, and those triggers cause arbitrary scripts to be run. The scripts currently send triggers, but they can also be changed to send email, etc. Alan DeKok.

1 0

GIT Log for 2011-04-22 23:33 GMT
by aland＠deployingradius.com 22 Apr '11

22 Apr '11

commit a45e659257933f0e26c3dff4542545d494e46cb1 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Apr 22 15:26:52 2011 +0200 Added SQL triggers Files changed: src/modules/rlm_sql/rlm_sql.c | 1 + src/modules/rlm_sql/rlm_sql.h | 1 + src/modules/rlm_sql/sql.c | 3 +++ 3 files changed, 5 insertions(+), 0 deletions(-) ====================================================================== commit 65788dc8173ac683d2adebac640704687d897535 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Apr 22 14:01:23 2011 +0200 Added triggers for HUP, TERM, home server alive/zombie/dead Files changed: src/include/realms.h | 2 ++ src/main/exec.c | 11 ++++++++--- src/main/process.c | 39 ++++++++++++++++++++++++++++++++++++++- src/main/realms.c | 18 ++++++++++++++++++ 4 files changed, 66 insertions(+), 4 deletions(-) ====================================================================== commit 8b52274e38a1856d7b4433dd0600d7a5deea2602 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Oct 11 12:01:10 2010 +0200 Install docs Files changed: README.snmp | 58 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 58 insertions(+), 0 deletions(-) ====================================================================== commit 5d1c7fd235f22bb2c47e112efaa02f8ae1e17b74 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Oct 9 18:09:43 2010 +0200 Triggers for thread start/stop Files changed: src/main/threads.c | 9 ++++++--- 1 files changed, 6 insertions(+), 3 deletions(-) ====================================================================== commit 9728d6a679bb80d4c37bd58068e400b49be9edaf Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Oct 9 18:09:25 2010 +0200 Trigger when adding a new dynamic client. There is currently no trigger for when one expires. Files changed: src/main/listen.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) ====================================================================== commit 09dc46b8e30949749d88f3effcc415ba074c2bd7 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Nov 30 09:26:15 2010 +0100 Added client mibs Files changed: mibs/RADIUS-ACC-CLIENT-MIB.txt | 647 +++++++++++++++++++++++++++++++++++ mibs/RADIUS-AUTH-CLIENT-MIB.txt | 708 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 1355 insertions(+), 0 deletions(-) ====================================================================== commit e52360ed45fdd54cf322e28fdfa70a31aaceb836 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Oct 9 18:08:14 2010 +0200 Added start / stop server triggers Files changed: src/main/radiusd.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) ====================================================================== commit ceac49be917bb332b066882927543c1635f83cb9 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Oct 9 18:05:22 2010 +0200 Added function to run SNMP triggers Files changed: src/include/radiusd.h | 1 + src/main/exec.c | 68 +++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 69 insertions(+), 0 deletions(-) ====================================================================== commit 1b05e83d623e5445cda097dcd8400ac0c3c46de5 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Apr 22 13:39:27 2011 +0200 Added sample trigger.conf Files changed: raddb/Makefile | 5 +- raddb/radiusd.conf.in | 8 ++ raddb/trigger.conf | 218 +++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 230 insertions(+), 1 deletions(-) ====================================================================== commit 6a4612f208801e5ed0b11cc6745fec7915f4bb32 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Oct 9 18:04:14 2010 +0200 New / updated notification MIBs Files changed: mibs/FREERADIUS-MGMT-MIB.txt | 34 ++++++++ mibs/FREERADIUS-NOTIFICATION-MIB.txt | 135 +++++++++++++++++++++++++++++++ mibs/FREERADIUS-PRODUCT-RADIUSD-MIB.txt | 38 +++++++++ mibs/FREERADIUS-SMI.txt | 2 + 4 files changed, 209 insertions(+), 0 deletions(-) ====================================================================== commit 58508e9e9179f4da10aaac1e9de9c7cf16352b15 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 13 15:11:00 2011 +0200 Move state machine checks to a macro Files changed: src/main/process.c | 46 ++++++++++++---------------------------------- 1 files changed, 12 insertions(+), 34 deletions(-) ======================================================================

1 0

compiling freeradius source code
by ashwini b 22 Apr '11

22 Apr '11

Hi, I'm giving a detailed description of my problem here Im setting up 802.1x port based authentication using wire1x as supplicant and freeradius as the server.I have configured switch for 802.1x and using eap-tls as authentication protocol.freeradius is configured to authenticate the client with username and password. My problem is i want to sent a bit(P bit) along with this username which will be taken into account for the authentication.for this i planned to send the username as P<specialcharacter>UserName.and wire1x will send the username as usual. Now at the freeradius side i have to seperate this new user name to P and UserName.and and make the authentication as(hypothetically): if(recieved (username,password)=(username,password)in clients.conf)&&bit P==1) { authenticate(return 0) } I found that the username,password checking is done in auth.c file.i have to add 1 more condition to that. Hope i have explained my problem well.and hope u will give enough suggestions. thank you On Thu, Apr 21, 2011 at 4:22 PM, Brian Candler <B.Candler(a)pobox.com> wrote: > On Wed, Apr 20, 2011 at 08:30:28PM +0530, ashwini b wrote: > > thank you for the suggestion.but as i mentioned earlier i'm really a > > newcomer in this field.. > > > > where should i make these changes?and i hav to authenticate the user > > based on username ,password and the checkbit(as mentioned earlier).Can > > u suggest how i could accomplish this.a detailed explanation will be a > > great help... > > You will make the change in sites-available/default in the "authorize" > section. "man unlang" will tell you more about the language you can use in > here. > > I can't give you any more detailled description of the solution, because > you > haven't given a detailled description of the problem. All you've said is > you're "sending a bit along with the username". Maybe you could give an > example of what the modified username looks like, and how you want the > username to look after restoring it? >

2 1

compiling freeradius source code
by ash 21 Apr '11

21 Apr '11

I'm a beginner in freeradius and i'm not familiar with the code.i'm setting up 802.1x authentication using freeradius and it works fine.but before authenticating the user based on username and password and assigning to a vlan i have to check one more condition (whether a file is present in client or not.for this i'm sending a bit along with username.if file is present, the bit is set to 1).so to separate the bit from username at the freeradius for authentication i edited the auth.c file.now how should i compile the modified code and install it? is it enough to simple change the code...and give ./build and install thanks for ur time and consideration... -- View this message in context: http://freeradius.1045715.n5.nabble.com/compiling-freeradius-source-code-tp… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

3 3

proxy.conf: no_response_fail
by Josip Almasi 20 Apr '11

20 Apr '11

Hi, there is a scenario that might require "no_response_fail = yes". First, network breaks; power outage, spanking trees, something other but massive. Then clients start comming online, put some heavy load on backend server. Retry, retry, and - clients DoS backend. In that case I might want to send Access-Reject, to get some breathing space. I had one case much like this with a buggy BRAS a few years ago. And I was involved in another, where Access-Reject made things much worse, due to buggy IADs - once rejected, they reset to factory defaults:> So, although I can't really say I need this feature, I know of cases that make it usefull. Regards...

3 3

GIT Log for 2011-04-13 23:33 GMT
by aland＠deployingradius.com 13 Apr '11

13 Apr '11

commit c92c7685c8107e9f1a0e57b87046c3ace441ab9e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 13 09:57:18 2011 +0200 New state machine for 3.0 It's about the same amount of code as the previous one, but is much simpler. Files changed: src/include/detail.h | 3 +- src/include/process.h | 64 + src/include/radiusd.h | 21 +- src/include/realms.h | 1 + src/include/vmps.h | 3 +- src/main/command.c | 52 +- src/main/detail.c | 10 +- src/main/dhcpd.c | 7 +- src/main/listen.c | 129 +- src/main/process.c | 4847 +++++++++++++++++++++++-------------------------- src/main/threads.c | 161 +-- src/main/vmps.c | 8 +- 12 files changed, 2426 insertions(+), 2880 deletions(-) ====================================================================== commit 8ac744242692979e672d5cd64cbad0044d0276b5 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 13 09:46:23 2011 +0200 Use paged arrays rather than linked lists There's less memory allocation on every fifo insert/free Files changed: src/lib/fifo.c | 183 ++++++++++++++++++++++++++++---------------------------- 1 files changed, 91 insertions(+), 92 deletions(-) ====================================================================== commit f91aa6d78f202ac09630b30334b73b05954d8877 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 13 09:43:34 2011 +0200 Move source in preparation for new code The new event handler is simpler than the old one, and needs to be in a separate file, to make it clear that it's a major change to the server core. Files changed: src/main/Makefile.in | 2 +- src/main/event.c | 4254 -------------------------------------------------- src/main/process.c | 4254 ++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 4255 insertions(+), 4255 deletions(-) ======================================================================

1 0

New state machine in the server core.
by Alan DeKok 13 Apr '11

13 Apr '11

I've just pushed a new state machine to the server core. For people doing "git pull", this means editing src/main/Makefile, and changing "event.c" to "process.c". Or, just re-run "configure" The new state machine is about the same amount of code as the old one. The difference is that it's conceptually much simpler. It has all of the functionality of the old one, and hopefully none of the bugs. The old state machine was an inter-connected mess that was getting to be impossible to extend or debug. The new one is much, much, better. I've attached some SVG diagrams of the state machines, taken from an automated analysis of the code. "event.svg" is the old one. "process.svg" is the new one. You'll note that "process.svg" doesn't look a lot simpler... So "process-simplified.svg" removes the "book-keeping" functions, along with the proxy and CoA functions. The result is a state machine that handles authentication / accounting / coa requests, processes them, and replies. That state machine is much simpler. Please test it, and see what you think. I've done a number of tests with all packet types, proxying, etc. I think that the functionality is identical to the old one, or sometimes even better. It also has the ability to debug the internal state machine. Define a flag DEBUG_STATE_MACHINE, and it will then print out every state transition that a request goes through. It's valuable for understanding how it all works. Alan DeKok.

1 0

GIT Log for 2011-04-12 23:33 GMT
by aland＠deployingradius.com 12 Apr '11

12 Apr '11

commit 9209b7c206316116cabe7b9e1e18cf2ed929fdd5 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Apr 12 11:03:59 2011 +0200 Fix arguments for 3.0 API Files changed: .../types/rlm_eap_mschapv2/rlm_eap_mschapv2.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 30d731c60b2e60e4434e9771477b9383b2d5e894 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Apr 10 16:28:27 2011 +0200 Fix arguments to pairmove2 Files changed: .../types/rlm_eap_mschapv2/rlm_eap_mschapv2.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) ======================================================================

1 0

GIT Log for 2011-04-10 23:33 GMT
by aland＠deployingradius.com 10 Apr '11

10 Apr '11

commit a6a1064ae86fb775f1d83077423dee88e16a6eec Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Apr 10 08:02:05 2011 +0200 Don't set "EAP Failure" when sending error message back .../types/rlm_eap_mschapv2/rlm_eap_mschapv2.c | 1 - 1 files changed, 0 insertions(+), 1 deletions(-)

1 0

GIT Log for 2011-04-08 23:33 GMT
by aland＠deployingradius.com 08 Apr '11

08 Apr '11

commit f3e3212b70e81da6f54d979912a17cd82f3dadc8 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Apr 8 13:04:25 2011 +0200 The file may be closed when there are no VPs Files changed: src/main/detail.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 899024045aecf72adfbd48c386c1f722e129940f Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Apr 8 09:36:49 2011 +0200 Make error sending configurable Files changed: raddb/modules/eap | 17 +++++++++++++++++ .../rlm_eap/types/rlm_eap_mschapv2/eap_mschapv2.h | 2 -- .../types/rlm_eap_mschapv2/rlm_eap_mschapv2.c | 12 ++++++++++-- 3 files changed, 27 insertions(+), 4 deletions(-) ====================================================================== commit 84fe588bf11671f0ef3b01c7ea5b3a1d87edce21 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 7 16:29:20 2011 +0200 Handle failures Files changed: .../types/rlm_eap_mschapv2/rlm_eap_mschapv2.c | 29 +++++++++++++------ 1 files changed, 20 insertions(+), 9 deletions(-) ====================================================================== commit e35f3fce3f0ee84fd9c61b7f39b8f03e33ac6690 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 7 16:18:27 2011 +0200 Add allow_retry and retry_msg functionality Based on a patch from John Hayward. Setting "allow_retry=0" and "retry_msg = hello" seems to help with EAP-MSCHAPv2 and cached passwords... Files changed: raddb/modules/mschap | 7 +++++++ src/modules/rlm_mschap/rlm_mschap.c | 33 +++++++++++++++++++++++++++------ 2 files changed, 34 insertions(+), 6 deletions(-) ====================================================================== commit 3f1d4a562c63bffc89b35b9c0720b04225792925 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 7 16:11:58 2011 +0200 Allow MS-CHAP-Error in Access-Reject Files changed: raddb/attrs.access_reject | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) ====================================================================== commit c2e8b249ecc1bda362cd766292afa37394f971cd Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 7 09:44:26 2011 +0200 Don't over-write a fail code with a success code. Closes bug #152 Files changed: src/main/valuepair.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 36fd25dbd57899eb03ae653d4bffeae9ae55256a Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 6 16:06:18 2011 +0200 Fix prototype Files changed: src/include/radiusd.h | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ======================================================================

1 0

Re: multi language support question?
by ziyen 07 Apr '11

07 Apr '11

> > Hi > When i auth request not english username then > "Invalid user: [\261\342\274\372\301\366\277\370/test01]" happen > when "\261\342\274\372\301\366\277\370" is not englist string > is it a method to solve this? > > Thanks. > > >

1 0

GIT Log for 2011-04-05 23:33 GMT
by aland＠deployingradius.com 05 Apr '11

05 Apr '11

commit ee85d5dd440df5f6ebf4d46748f2336a0f977713 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Apr 5 16:56:33 2011 +0200 Add -4 and -6 options These force NAS-IP-Address or NAS-IPv6-Address Files changed: man/man1/radtest.1 | 12 +++++++++++- src/main/radtest.in | 15 ++++++++++++++- 2 files changed, 25 insertions(+), 2 deletions(-) ====================================================================== commit 8147ce1304531e62804d249f7554e15073891acf Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Apr 2 18:17:50 2011 +0200 Revert "Make event timer callback take el pointer" As it turns out, this isn't a good idea. This reverts commit 21d97638c32c7619994ca521e4c4f01e420c9a5b. Files changed: src/include/event.h | 2 +- src/lib/event.c | 2 +- src/main/command.c | 2 +- src/main/event.c | 62 +++++++++++++++++++++++++------------------------- 4 files changed, 34 insertions(+), 34 deletions(-) ====================================================================== commit bb1eebb0f767abc7eb97b6c4db20a6975738938d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Apr 1 10:04:12 2011 +0200 Skip zero-length attributes rather than looping forvever trying to encode them Files changed: src/lib/radius.c | 34 ++++++++++++++++++++++++++-------- 1 files changed, 26 insertions(+), 8 deletions(-) ====================================================================== commit 7cb2317510dddca9cdce8df1deba0a93c5f3b93d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Mar 30 08:37:00 2011 +0200 Accept accounting packets via TCP Files changed: src/main/listen.c | 22 ++++++++++++++++------ 1 files changed, 16 insertions(+), 6 deletions(-) ====================================================================== commit bd6b7163a98cad9da3faaa5c3e5559c79ce1d251 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Mar 30 08:27:54 2011 +0200 Fix build/run errors when not using proxying Files changed: src/modules/rlm_realm/rlm_realm.c | 8 +++++--- 1 files changed, 5 insertions(+), 3 deletions(-) ====================================================================== commit 45ae14194ee3170e31dcad7fd2a1c43642ceaa81 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Mar 29 15:53:01 2011 +0200 Fix handling of "-l stdout" Files changed: src/main/log.c | 8 +------- src/main/radiusd.c | 14 ++++++++------ 2 files changed, 9 insertions(+), 13 deletions(-) ====================================================================== commit 08258a6193ef076139b346efbdd2c34528a9d8f5 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Mar 29 12:50:08 2011 +0200 More build fixes Files changed: src/main/modules.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) ====================================================================== commit 26e0f27d0552771479655d5d9b479393d4a79e5c Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Mar 29 09:46:30 2011 +0200 Build with various compile flags. The WITH/WITHOUT_FOO features allow us to build the server with or without certain features. However, setting the flags to various values *should* allow the server to build. This patch fixes that. Files changed: src/include/radiusd.h | 38 ++++++++++++++++++-------------------- src/main/log.c | 4 ++-- src/main/realms.c | 2 +- 3 files changed, 21 insertions(+), 23 deletions(-) ====================================================================== commit 987d003328a7b005c833e66a719c3e454e2c14cc Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Mar 29 09:08:00 2011 +0200 Fix function prototype Files changed: src/include/radiusd.h | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit b8d635b65de272e5e5dfaa360d7e6ec096eb9413 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Mar 27 21:00:10 2011 +0200 Cap response_window at max_request_time Files changed: src/main/realms.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) ====================================================================== commit e97630f6da3d813a6a1af0d3586b7a4da812b68d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Mar 25 16:06:40 2011 +0100 Set min/max for max_request_time, cleanup_delay, and reject_delay Files changed: src/main/mainconfig.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) ====================================================================== commit 21d97638c32c7619994ca521e4c4f01e420c9a5b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Mar 25 15:44:57 2011 +0100 Make event timer callback take el pointer It's just too useful to ignore Files changed: src/include/event.h | 2 +- src/lib/event.c | 2 +- src/main/command.c | 2 +- src/main/event.c | 62 +++++++++++++++++++++++++------------------------- 4 files changed, 34 insertions(+), 34 deletions(-) ======================================================================

1 0

eap2 in freeradius
by Chanthearith HUON 04 Apr '11

04 Apr '11

Hi everyone, I am testing eap2 in freeradius. I run "radiusd -X", I got following error message " radiusd: symbol lookup error: /usr/lib/rlm_eap2-2.1.0.so: undefined symbol: eap_server_register_methods " Anyone, have any idea what might be wrong with the configuration? Thank in advance, Thierry

5 10