May 2011 - Freeradius-Devel - lists.freeradius.org

rlm_sql_ocioracle driver v. 0.1
by Ge＠＠ru 14 Mar '15

14 Mar '15

Hi, in attachment patch to add rlm_sql_ocioracle driver to freeradius 2.1.x tree (it seems work yet on 3.x tree). This drivers permit to use function/procedure with CURSOR (through :Ret_Cursor string) like for example: group_membership_query = "begin :Ret_Cursor := \ pkRadius.group_membership_query('%{SQL-User-Name}'); end;" TODO for next release: - add support to oracle connection pool instead of open a new connection for every socket on startup; - enhancement on handle error (through error callback) on do query; - add documentation. Module need oracle instantclient library and ocilib library (http://orclib.sourceforge.net/) Good luck to rlm_sql_ocioracle driver!! Geaaru

2 5

Missing TLS Change Cipher Spec and TLS Finished in EAP-TLS exchanges
by arno＠natisbad.org 09 Jul '11

09 Jul '11

Hi, I upgraded an internal freeradius server (Linux, Debian unstable, libssl 0.9.8) used for EAP-TLS (802.11 WPA2 access) from 2.0.5 to 2.1.3. With 2.1.3, client authentication fails in the following way (wpasupplicant on Debian unstable, working with 2.0.5): - the TLS exchange is completed from freeradius point of view. It even sends the Access-Accept message to the NAS. - from the clients point of view, the TLS exchange is not over, it expects some more data from the server which are never sent. I took two pcap traces (sent to you privately, Alan), one with 2.0.5, one with 2.1.3. It looks like the TLS Change Cipher and TLS Tinished elements of the TLS exchange are not in the EAP encapsulated TLS packets sent by the server. Compare packet #23 of 2.1.3 trace with packet #27 of 2.0.5 trace. If you use wireshark, you will notice that the SSL layer is dissected; this is because #27 has a small brother: #29. It is not sent by 2.1.3. Alan, if you have an idea or a patch, I can test it on monday. Cheers, a+

5 15

RadSec ... anyone?
by Alan DeKok 08 Jun '11

08 Jun '11

Has anyone managed to test the radsec work in the "master" branch? After all of the requests for it, there has been a surprising lack of response to it's public release. Alan DeKok.

6 12

regex matching can be convinced to be TRUE if you're insistive enough?
by Stefan Winter 08 Jun '11

08 Jun '11

Hi, while working on server optimisations for one of our customers, I stumbled upon something funny (2.1.10). At one point, a huge regex needs to be executed. When the input string has a length n < ??, and the regex doesn't match, the result is FALSE - no surprise here. If I make the input string long enough to m > ?? > n, and the regex doesn't match, the result is TRUE. That is not what I'd usually expect; and it has some uneasy implications. Depending on what an incoming user manages to send, it could convince to make the server take a wrong code path; maybe sneaking in when he shouldn't. A simple test case to prove this: in authorize, add update control { Bla = "*1* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh", Bla += "*2* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh", Bla += "*3* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh", Bla += "*4* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh", Bla += "*5* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh", Bla += "*6* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh" } if ( "%{control:Bla[*]}" =~ /zzzz/ ) { update control { Bla2 := "Hit!" } } This doesn't match, and debug output tells you so: Tue May 24 16:09:56 2011 : Info: ++? if ("%{control:Bla[*]}" =~ /zzzz/ ) Tue May 24 16:09:56 2011 : Info: expand: %{control:Bla[*]} -> *1* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh *2* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh *3* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh *4* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh *5* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh *6* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh Tue May 24 16:09:56 2011 : Info: ? Evaluating ("%{control:Bla[*]}" =~ /zzzz/) -> FALSE Tue May 24 16:09:56 2011 : Info: ++? if ("%{control:Bla[*]}" =~ /zzzz/ ) -> FALSE Now, make the Bla blob larger: update control { RESTENA-Service-Type = "IMAP", Bla = "*1* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh", Bla += "*2* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh", Bla += "*3* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh", Bla += "*4* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh", Bla += "*5* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh", Bla += "*6* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh", Bla += "*7* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh", Bla += "*8* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh", Bla += "*9* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh", Bla += "*A* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh" } And you will get a TRUE: Tue May 24 16:11:42 2011 : Info: ++? if ("%{control:Bla[*]}" =~ /zzzz/ ) Tue May 24 16:11:42 2011 : Info: expand: %{control:Bla[*]} -> *1* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh *2* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh *3* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh *4* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh *5* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh *6* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh *7* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh *8* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh * Tue May 24 16:11:42 2011 : Info: ? Evaluating ("%{control:Bla[*]}" =~ /zzzz/) -> TRUE Tue May 24 16:11:42 2011 : Info: ++? if ("%{control:Bla[*]}" =~ /zzzz/ ) -> TRUE Note also that the debug output stops its string content output prematurely, but that's not as bad as the string regex mis-matching. My guess is that the breakage occurs when the string is longer than what's printed out in debug mode, but I didn't really try. Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

3 14

GIT Log for 2011-05-31 23:33 GMT
by aland＠deployingradius.com 31 May '11

31 May '11

commit 1daa6e3c158d131ffc8d046f66b9197a0e1d3752 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue May 31 21:21:23 2011 +0200 Added MS-CHAP-V2 Files changed: share/dictionary.freeradius.internal | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) ====================================================================== commit fe8a67731ac7024ff558c43ae5ff621050b4951b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue May 31 20:39:42 2011 +0200 Last set of vp_print fixes Files changed: src/include/libradius.h | 2 -- 1 files changed, 0 insertions(+), 2 deletions(-) ====================================================================== commit 8197decb55e6df8f7d40b5db498a46e3af27db9a Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue May 31 13:20:12 2011 +0200 Move \t into vp_print, just like the last commit Files changed: src/lib/print.c | 2 +- src/main/valuepair.c | 2 -- src/modules/rlm_digest/rlm_digest.c | 1 - 3 files changed, 1 insertions(+), 4 deletions(-) ====================================================================== commit d6ef8b75df19c3429fd6917edf7ea991b57e06fd Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue May 31 09:32:20 2011 +0200 vp_print should add a "\n" to the end All callers already do this, so it's best to move that code into vp_print Files changed: src/lib/print.c | 2 +- src/main/valuepair.c | 2 -- src/modules/rlm_digest/rlm_digest.c | 1 - 3 files changed, 1 insertions(+), 4 deletions(-) ======================================================================

1 0

detail log type wrong (SPACE)
by ziyen 31 May '11

31 May '11

Hi Quick patch Thanks. but, old version's are like below good format, Tue May 31 18:42:51 2011 *<TAB>*Packet-Type = Access-Request *<TAB>*NAS-Port-Type = Wireless-802.11 *<TAB>*User-Name = "test01" *<TAB>*NAS-IP-Address = 192.168.255.6 *<TAB>*Message-Authenticator = 0xea14bd1a18cd682bdeb15acc163762e5 Tue May 31 18:42:51 2011 *<TAB>*Packet-Type = Access-Accept *<TAB>*Cleartext-Password := "test0101" But Patches version's are like below.. Tue May 31 20:06:49 2011 *<TAB>*Packet-Type = Access-Request NAS-Port-Type = Wireless-802.11 User-Name = "test01" NAS-IP-Address = 192.168.255.6 Message-Authenticator = 0x93707c01792928c6593334475463736a Tue May 31 20:06:49 2011 *<TAB>*Packet-Type = Access-Accept Cleartext-Password := "test0101" Tue May 31 20:10:20 2011 Acct-Status-Type = Interim-Update Acct-Session-Id = "002257968FC0-34159EDCF366-116460751" NAS-IP-Address = 192.168.254.9 Acct-Input-Octets = 18836 Acct-Output-Octets = 370 Acct-Input-Packets = 139 Acct-Output-Packets = 3 User-Name = "test01" Called-Station-Id = "00-22-57-96-8F-C0" Calling-Station-Id = "34-15-9E-DC-F3-66" NAS-Identifier = "3Com Access Point 7760" Vendor-Specific = 0x564c414e2049442069733a2030 Vendor-Specific = 0x656e74726f5f39 Acct-Session-Time = 602 Acct-Unique-Session-Id = "68e23ed7c01340b3" *<TAB>*Timestamp = 1306872620 Thanks..

2 1

detail log type wrong
by ziyen 31 May '11

31 May '11

*Hi * *last git 2.1.x version's are like* Tue May 31 15:43:44 2011 Packet-Type = Access-Accept MS-MPPE-Recv-Key = 0x6a4087da64a2340990e620284bf68f58776bc15df80f15c55a5a4a0fdfe53978 MS-MPPE-Send-Key = 0xd29504a39dc3f9b2e3a259d8d16c0e5e5b209bd3ddd33b41e64e731f8a496e11 EAP-MSK = 0x6a4087da64a2340990e620284bf68f58776bc15df80f15c55a5a4a0fdfe53978d29504a39dc3f9b2e3a259d8d16c0e5e5b209bd3ddd33b41e64e731f8a496e11 EAP-EMSK = 0x75069c36523115dcc2e2b06d195aa41022987cb6d00b52bffa76c9e78ca4e903cda38a6b7ee8a06107fbc8ea4c470a36f6aec55f59bcc431b93c229b2b2355d7 EAP-Message = 0x03220004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "test01" *but today like below..* Tue May 31 14:15:31 2011 Packet-Type = Access-Accept MS-MPPE-Recv-Key = 0x5ae6736835c76d1873265c1e2d1e6ac1013b1a96bd2fcbf03633d5a854a7aaceMS-MPPE-Send-Key = 0x02f78bce4af77a7cc8a78fbbaaad0faad9dfde27167761af539189c789652138EAP-MSK = 0x5ae6736835c76d1873265c1e2d1e6ac1013b1a96bd2fcbf03633d5a854a7aace02f78bce4af77a7cc8a78fbbaaad0faad9dfde27167761af539189c789652138EAP-EMSK = 0x8094d14277078bd19bfb7cc0f1c887128254be8b272685b14b440bb6da5c1f6fb8285b48a60d36c3ccd65557cae1fd8703f9d0685a881c0c59af456e77f08007EAP-Message = 0x03060004Message-Authenticator = 0x00000000000000000000000000000000User-Name = "test01" I think " \n\" are need.. Thakns.

2 1

GIT Log for 2011-05-30 23:33 GMT
by aland＠deployingradius.com 30 May '11

30 May '11

commit 1df682e2e40503c574600df0257f988b21482a0a Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon May 30 17:14:18 2011 +0200 Revert most of the "checked_write" code. It apparently caused crashes on some machines. This code reverts (mostly) back to the original code which worked, but it should also notice when the disk is full, and return FAIL src/modules/rlm_detail/rlm_detail.c | 123 +++++++++-------------------------- 1 files changed, 31 insertions(+), 92 deletions(-)

1 0

GIT Log for 2011-05-28 23:33 GMT
by aland＠deployingradius.com 28 May '11

28 May '11

commit 55d659874d1330011e960c96bdf6131606f87561 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat May 28 17:58:09 2011 +0200 Added support for "break" Files changed: man/man5/unlang.5 | 8 +++++- src/main/modcall.c | 58 ++++++++++++++++++++++++++++++++++++++++++++++----- 2 files changed, 58 insertions(+), 8 deletions(-) ====================================================================== commit de60e732c576f7cbceb1a96741abef70059f014c Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat May 28 12:48:25 2011 +0200 Make copy of "foreach" variable This lets it be deleted or modified in the loop, without changing the value of the variable being looped over. i.e. the variable being looped over can't be modified. But the underlying attribute can be deleted or free'd, and the server won't crash Files changed: src/main/modcall.c | 37 +++++++++++++++++++++++++++++-------- src/main/xlat.c | 13 +++++++------ 2 files changed, 36 insertions(+), 14 deletions(-) ====================================================================== commit ba18f024b15e40420cde5006e7d3c7540b489983 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat May 28 10:36:11 2011 +0200 Make debug output easier to read. Print group names, value of "foreach" variables, and change punctuation to whitespace (which is easier to read) Files changed: src/main/log.c | 2 +- src/main/modcall.c | 51 ++++++++++++++++++++++++++++++++++++++++----------- 2 files changed, 41 insertions(+), 12 deletions(-) ======================================================================

1 0

GIT Log for 2011-05-27 23:33 GMT
by aland＠deployingradius.com 27 May '11

27 May '11

commit 4053d65e8d9c3b36416d661aef1cdbf5e060c0a8 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri May 27 14:49:17 2011 +0200 Document the "locking" configuration item Files changed: raddb/modules/detail | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) ====================================================================== commit 11aa444213a951eb8f393c66e33385a0bfc2a48d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri May 27 13:08:03 2011 +0200 Fix typo Files changed: src/main/modcall.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit a3221304b5f36c9ff76a1f307524d55133b2d403 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri May 27 12:58:39 2011 +0200 Added "foreach" to unlang There's no "break" yet. Files changed: man/man5/unlang.5 | 26 ++++++++++++++- src/main/modcall.c | 91 ++++++++++++++++++++++++++++++++++++++++++++++++++-- src/main/xlat.c | 45 +++++++++++++++++++++++++ 3 files changed, 158 insertions(+), 4 deletions(-) ====================================================================== commit 2d64950b01c94832080d0b8cd00ff029da83b49d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri May 27 10:47:09 2011 +0200 Make home server coa config match raddb/proxy.conf Files changed: src/main/realms.c | 24 ++++++++++++++++-------- 1 files changed, 16 insertions(+), 8 deletions(-) ======================================================================

2 1