May 2011 - Freeradius-Devel - lists.freeradius.org

GIT Log for 2011-05-20 23:33 GMT
by aland＠deployingradius.com 20 May '11

20 May '11

commit 7632eda05659dc39a6bef195bd3c866f11b6d420 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri May 20 15:48:50 2011 +0200 Build client certs for TLS Files changed: raddb/certs/Makefile | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 5a6d4f3dd1ae64bc2be5d5563b7c0cd918685b29 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri May 20 10:11:32 2011 +0200 Don't build radeapclient for now Files changed: src/modules/rlm_eap/Makefile.in | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 07bb68770e88e4385e84d009e6d46a5e1137cc8c Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri May 20 09:38:48 2011 +0200 Added deprecated flag to old config variables Files changed: src/modules/rlm_ldap/rlm_ldap.c | 16 ++++++++-------- 1 files changed, 8 insertions(+), 8 deletions(-) ====================================================================== commit 7c259c0ed42867755ed091a2435092da7e0a8d78 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu May 19 12:16:28 2011 +0200 Build without TLS Files changed: src/main/listen.c | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) ====================================================================== commit 5e6636218d9b5dd95fa24a8bf26a101b0c59e843 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu May 19 07:25:54 2011 +0200 Add installation rule for man page Files changed: src/modules/rlm_ippool/Makefile.in | 6 +++++- 1 files changed, 5 insertions(+), 1 deletions(-) ======================================================================

1 0

Multiple Cleartext-Password?
by Brian Candler 19 May '11

19 May '11

Has anyone made a patch to rlm_pap and rlm_chap so that it supports multiple instances of Cleartext-Password? The idea would be to succeed if the incoming request matches any one of them. (This could be helpful for a migration where a user could be logging in with one of several variants of the password in the database) Thanks, Brian.

4 7

GIT Log for 2011-05-18 23:33 GMT
by aland＠deployingradius.com 18 May '11

18 May '11

commit 785d718c9c5edd7565e0c54f915b5a3f6a6ce202 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed May 18 14:32:53 2011 +0200 Added deprecated flag to variables So that people will ugprade their configuration Files changed: src/include/conffile.h | 1 + src/main/conffile.c | 20 +++++++++++++++++--- src/main/mainconfig.c | 20 +++++++++++--------- src/main/radconf2xml.c | 1 + src/main/radmin.c | 1 + src/main/radwho.c | 1 + 6 files changed, 32 insertions(+), 12 deletions(-) ====================================================================== commit 9720c3b462833c1512cf1538a966e1059ac2b2ef Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed May 18 13:22:18 2011 +0200 Cleaned up the "checked write" code a fair bit Files changed: src/modules/rlm_detail/rlm_detail.c | 113 ++++++++++++++++------------------ 1 files changed, 53 insertions(+), 60 deletions(-) ====================================================================== commit 15250fc792d0f4c64bdff9e2cd890526161878c5 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed May 18 11:38:05 2011 +0200 Move the "install binaries" code to rules.mak This simplifies the sub-makefiles, and means it's harder to get things wrong Files changed: src/modules/rlm_dbm/Makefile.in | 11 +---------- src/modules/rlm_eap/Makefile.in | 1 - src/modules/rlm_ippool/Makefile.in | 8 +------- src/modules/rlm_mschap/Makefile | 7 +------ src/modules/rules.mak | 6 ++++++ 5 files changed, 9 insertions(+), 24 deletions(-) ======================================================================

1 0

GIT Log for 2011-05-16 23:33 GMT
by aland＠deployingradius.com 16 May '11

16 May '11

commit 3e44169d595d0b0ca08bf8a11d1a860f32019ad8 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon May 16 14:23:04 2011 +0200 Removed unused variable Files changed: src/lib/fifo.c | 2 -- 1 files changed, 0 insertions(+), 2 deletions(-) ====================================================================== commit 646afab48f4b733c33cad73e78619102016aae5b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon May 16 14:21:34 2011 +0200 Fix issues bound by clang Files changed: src/lib/radius.c | 7 ++----- 1 files changed, 2 insertions(+), 5 deletions(-) ====================================================================== commit 4ec37bdd62349851d1f44d525e82ee1d912bedaa Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon May 16 14:17:40 2011 +0200 Removed duplicate code Files changed: src/lib/hash.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit efd365d675b649701a4e6f98dbab8d436d4dc6b3 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon May 16 14:16:07 2011 +0200 Ensure we initialize all entries Files changed: src/lib/dict.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) ======================================================================

1 0

GIT Log for 2011-05-13 23:33 GMT
by aland＠deployingradius.com 13 May '11

13 May '11

commit f05c22d9435cb934ec06caa133b7f476cf2ade69 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri May 13 16:58:16 2011 +0200 Support outer.control in dynamic xlat Files changed: src/main/xlat.c | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-) ====================================================================== commit 7cb14f8e4243ef36d25b30957bfb88958ef34ed8 Author: Ruslan Shevchenko <ruslan(a)shevchenko.kiev.ua> Date: Tue May 10 22:15:26 2011 +0300 added support of dhcp to rlm_ippool Files changed: src/include/dhcp.h | 5 +++ src/modules/rlm_ippool/rlm_ippool.c | 49 +++++++++++++++++++++++++++-------- 2 files changed, 43 insertions(+), 11 deletions(-) ====================================================================== commit 141258e9fddab3057677bb508369b6db6c2113eb Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri May 13 13:44:35 2011 +0200 Set "last packet" entry for all sockets This will help us track TCP connections Files changed: src/main/listen.c | 1 + src/main/process.c | 22 ++++++++++++++++++---- 2 files changed, 19 insertions(+), 4 deletions(-) ====================================================================== commit 3cb0e2cd0c8b7c81f22453f5c6e13c213eed614d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri May 13 11:05:08 2011 +0200 Create TLS-* attrs only for EAP, not RadSec Files changed: src/main/tls.c | 25 +++++++++++++++++++------ 1 files changed, 19 insertions(+), 6 deletions(-) ====================================================================== commit da4bd80476caff4fbd6d4211cf05a1305288dfb9 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri May 13 10:50:40 2011 +0200 Put checks for non-threaded TLS in a better place. The TLS code requires threads to work. Files changed: src/main/listen.c | 21 ++++++++------------- 1 files changed, 8 insertions(+), 13 deletions(-) ====================================================================== commit 7a93efce7704679e44a0c71b2b31037adb3eea4b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri May 13 10:44:18 2011 +0200 RadSec sockets don't have a user identity Files changed: src/main/tls.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit dcdb5c82a2bac03c8275a570415ba3dae02bcc22 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri May 13 10:38:53 2011 +0200 Add support for -P Files changed: src/main/radtest.in | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) ====================================================================== commit 372dccbbf459c5870dbd129758ebc73bbf9d7f2c Author: Phil Mayers <p.mayers(a)imperial.ac.uk> Date: Tue Apr 19 15:34:27 2011 +0100 add mschap docs Files changed: doc/mschap.rst | 196 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 196 insertions(+), 0 deletions(-) ====================================================================== commit 5d1dddb41e7872ed926cb62729aee2d9aad5d589 Author: Phil Mayers <p.mayers(a)imperial.ac.uk> Date: Tue Apr 19 15:24:11 2011 +0100 DEBUG message changes to make it more obvious which authentication has failed if we are proxying PEAP/TTLS inner Files changed: .../types/rlm_eap_mschapv2/rlm_eap_mschapv2.c | 8 +++++--- 1 files changed, 5 insertions(+), 3 deletions(-) ====================================================================== commit 75aa5d0b6aaa91dd07e623dd828213df3fd36009 Author: Phil Mayers <p.mayers(a)imperial.ac.uk> Date: Tue Apr 19 15:23:08 2011 +0100 re-work rlm_eap_mschapv2 state machine - handle mschapv2 password changes Files changed: .../rlm_eap/types/rlm_eap_mschapv2/eap_mschapv2.h | 3 +- .../types/rlm_eap_mschapv2/rlm_eap_mschapv2.c | 262 ++++++++++++-------- 2 files changed, 158 insertions(+), 107 deletions(-) ====================================================================== commit 6878fcf4833655097c11a347371f55c146e066ca Author: Phil Mayers <p.mayers(a)imperial.ac.uk> Date: Tue Apr 19 15:20:46 2011 +0100 save the new challenge in MS-CHAP-Error, to allow authentication retries to succeed Files changed: .../types/rlm_eap_mschapv2/rlm_eap_mschapv2.c | 24 ++++++++++++++++++- 1 files changed, 22 insertions(+), 2 deletions(-) ====================================================================== commit 7ff11d2d5e6f4d58c7661e048c48bea6f254c2cd Author: Phil Mayers <p.mayers(a)imperial.ac.uk> Date: Tue Apr 19 15:16:27 2011 +0100 add support for MS-CHAPv2 password changes to rlm_mschap Files changed: raddb/modules/mschap | 26 ++ share/dictionary.freeradius.internal | 2 + src/include/radius.h | 5 +- src/modules/rlm_mschap/rlm_mschap.c | 576 ++++++++++++++++++++++++++++++++-- src/modules/rlm_mschap/smbdes.c | 2 +- src/modules/rlm_mschap/smbdes.h | 1 + 6 files changed, 589 insertions(+), 23 deletions(-) ====================================================================== commit 195c31acfd4864b99516951eb16daa0faed73406 Author: Phil Mayers <p.mayers(a)imperial.ac.uk> Date: Tue Apr 19 15:10:11 2011 +0100 split exec functionality into 3 parts Files changed: src/include/radiusd.h | 7 ++ src/main/exec.c | 200 ++++++++++++++++++++++++++++++------------------ 2 files changed, 132 insertions(+), 75 deletions(-) ====================================================================== commit ed2e9cd1e31722a2711f058551d48f95da97a5c2 Author: Dante <dante(a)dante.org.uk> Date: Thu May 12 15:04:54 2011 +0200 Glue TLS code into listen.c Files changed: src/main/listen.c | 20 +++++++ src/main/tls.c | 57 ++++++++++++------- src/modules/rlm_eap/libeap/eap_tls.c | 5 +-- .../rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c | 43 +-------------- 4 files changed, 58 insertions(+), 67 deletions(-) ====================================================================== commit b02522813ae39d53d0b647bbd52f76606e716d0b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu May 12 15:04:43 2011 +0200 Add rules for attribute encodings Files changed: src/tests/Makefile | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) ====================================================================== commit 7a6ef8f47a2fdd49b4a58e03a56b81e9ceed5cea Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu May 12 15:04:19 2011 +0200 Define EAP-MD5-Password In preparation for removing radeapclient Files changed: share/dictionary.freeradius.internal | 3 +-- src/include/radius.h | 1 + 2 files changed, 2 insertions(+), 2 deletions(-) ======================================================================

1 0

how to add MSCHAPV2 Retry Max
by John.Hayward＠wheaton.edu 13 May '11

13 May '11

Free Radius Developers, Can someone point me to how to: 1) add a configuration value (the retry count allowed). 2) add a state value associated with a session (current retry count). The motivation is: When a windows xp box is authenticating against freeradius with patches to support retry and freeradius is configured to allow retry and the user enters a wrong username the user is presented with a balloon which has: ==== Wireless Network Connection -- Click here to process your login information for the network yyyy ==== The duologue window pops up with title "Re-enter Credentials" The User name entry shows the entered username grayed out The Password has dots for each letter entered The Domain is grayed out There is an Ok and Cancel button. The user cannot correct the wrong username. If they hit either Ok a new balloon pops up with the same info. If they hit cancel in a while (seems about 30 sec) a new balloon pops up. After about 2 minutes a different balloon pops up where they can enter their credentials of User name, password and login domain. If retry is not enabled no balloon which results in a "Re-enter Credentials" dialog box occurs - after a long while (over 2 minutes) a balloon pops up where the user can enter their User name, password and login domain. There seems to be a problem when retry is not enabled of getting the windows client to detect there is a problem and giving up in a quicker time frame. That issue aside I would like to implement a retry count so that if say a retry count of 3 the user would be presented with at most 3 "Re-enter Credentials" dialog box before having the client go into a different mode where it fails and then gives the user a chance to enter user name and password. TIA johnh...

3 6

DHCP and rlm_ippool [was: Re: MSCHAP password changes]
by Ruslan Shevchenko 13 May '11

13 May '11

btw, I implemented DHCP support in rlm_ippool (plan to start pull process next week) On Fri, May 13, 2011 at 3:42 PM, Alan DeKok <aland(a)deployingradius.com> wrote: > Garber, Neal wrote: >>> I've pushed Phil's changes for MSCHAPv2 to the git "master" branch. >> >> I assume the "master" branch is 3.0. Just curious, is there an anticipated release date for 3.0 (or is it still too far out to know)? > > Hopefully early in the summer. It's pretty close to being finalized. > > I was waiting for the RadSec stuff to go in. The rest is pretty nice, > too. SNMP triggers, better WiMAX support, new encoders. > > I hope to be able to add some more DHCP functionality, too. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html >

1 0

MSCHAP password changes
by Alan DeKok 13 May '11

13 May '11

I've pushed Phil's changes for MSCHAPv2 to the git "master" branch. Let me know if it works. :) Alan DeKok.

2 2

RadSec is now available
by Alan DeKok 13 May '11

13 May '11

I've pushed changes to the git "master" branch which enable RadSec to work. So far, all I've done is to test the server proxying to itself. i.e. opening an outgoing radsec connection, then accepting it, and doing TLS. Please download && test it. For now, it only accepts one type of packet on a RadSec socket, so doing "auth+acct" is not possible. That can be fixed later. I *believe* that the code is stable. 90% of it is the pre-existing rlm_eap_tls code, which has been moved to the server core. The rest is a bit of "glue" code to tie the TLS code into the sockets. The result is that the TLS configuration is *identical* in EAP-TLS and in RadSec. Even better, all of the features of EAP-TLS, like certificate checking, OCSP, etc. are automatically features of RadSec. Alan DeKok.

1 0

GIT Log for 2011-05-12 23:33 GMT
by aland＠deployingradius.com 12 May '11

12 May '11

commit 7923580f7a90a48c5c1d233bef0e4f12c0ae76a0 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu May 12 12:27:59 2011 +0200 Add needed variable Files changed: src/main/tls.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) ====================================================================== commit d78b82883c59e50f8448f0e2a66adf19dd662095 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu May 12 10:38:03 2011 +0200 Hack radeapclient to make it build. People should be using eapol_test instead. It's SO much better. We probably also need to make radclient handle EAP-MD5, for simplicity of testing Files changed: src/modules/rlm_eap/radeapclient.c | 8 ++++++++ 1 files changed, 8 insertions(+), 0 deletions(-) ====================================================================== commit 7f56544ba034df198ee8d7e74a1542d650a39ea0 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu May 12 10:26:05 2011 +0200 "invalid attribute" means "create raw" Files changed: src/tests/extended.txt | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) ====================================================================== commit fe37b7ec46541a641a7c9a8975befd371f7fce23 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu May 12 10:24:56 2011 +0200 CUI is allowed to have zero-length Files changed: src/lib/radius.c | 11 +++++++++-- 1 files changed, 9 insertions(+), 2 deletions(-) ======================================================================

1 0