June 2011 - Freeradius-Devel - lists.freeradius.org

rlm_sql_ocioracle driver v. 0.1
by Ge＠＠ru 14 Mar '15

14 Mar '15

Hi, in attachment patch to add rlm_sql_ocioracle driver to freeradius 2.1.x tree (it seems work yet on 3.x tree). This drivers permit to use function/procedure with CURSOR (through :Ret_Cursor string) like for example: group_membership_query = "begin :Ret_Cursor := \ pkRadius.group_membership_query('%{SQL-User-Name}'); end;" TODO for next release: - add support to oracle connection pool instead of open a new connection for every socket on startup; - enhancement on handle error (through error callback) on do query; - add documentation. Module need oracle instantclient library and ocilib library (http://orclib.sourceforge.net/) Good luck to rlm_sql_ocioracle driver!! Geaaru

2 5

LDAP timeouts during failure conditions
by Phil Mayers 15 Aug '11

15 Aug '11

So, some discussion on the JANET-ROAMING list leads me to believe that, during an "ldap server down" condition, rlm_ldap will incur "net_timeout" on every (or many) passes through the module. I don't really understand the MAX_FAILED_* logic at the start of perform_search, but it seems to conflict with the comments at the top of the file: * If conn->failed_conns > MAX_FAILED_CONNS_START then we don't * try to do anything and we just do conn->failed_conns++ and * return RLM_MODULE_FAIL ...perform_search has no such logic; in any event, it seems like it would be better to do an optional time-based per-server "fast fail" so that: redundant { ldap1 ldap2 } ...fails quickly if ldap1 is down. In some ways it's a shame we can't use a worker thread to manage the LDAP connection(s); that way, the module could be marked "fast fail" unless and until a live connection exists. Is there any scope for that? Cheers, Phil

5 19

Missing TLS Change Cipher Spec and TLS Finished in EAP-TLS exchanges
by arno＠natisbad.org 09 Jul '11

09 Jul '11

Hi, I upgraded an internal freeradius server (Linux, Debian unstable, libssl 0.9.8) used for EAP-TLS (802.11 WPA2 access) from 2.0.5 to 2.1.3. With 2.1.3, client authentication fails in the following way (wpasupplicant on Debian unstable, working with 2.0.5): - the TLS exchange is completed from freeradius point of view. It even sends the Access-Accept message to the NAS. - from the clients point of view, the TLS exchange is not over, it expects some more data from the server which are never sent. I took two pcap traces (sent to you privately, Alan), one with 2.0.5, one with 2.1.3. It looks like the TLS Change Cipher and TLS Tinished elements of the TLS exchange are not in the EAP encapsulated TLS packets sent by the server. Compare packet #23 of 2.1.3 trace with packet #27 of 2.0.5 trace. If you use wireshark, you will notice that the SSL layer is dissected; this is because #27 has a small brother: #29. It is not sent by 2.1.3. Alan, if you have an idea or a patch, I can test it on monday. Cheers, a+

5 15

Fix message-authenticator attribute check for rfc 5997
by Frederic Leroy 01 Jul '11

01 Jul '11

Hello, I have a device which adds message-authenticator attribute (80) in its accounting-response. If I understand correctly, it follows rfc5997 ( see section 5 ) which is informational. Using radclient, it rejects the accounting-response of my device. So here is a patch to libfreeradius to make it works. Regards, -- Frederic Leroy

2 3

Repeatable problem with Client-Shortname
by Brian Candler 30 Jun '11

30 Jun '11

Here's a strange problem: the Client-Shortname attribute won't match a regexp unless it's inside a string expansion. Simple example: # Fails if (Client-Shortname =~ /./) { update reply { Reply-Message += "XXX" } } # Succeeds if ("%{Client-Shortname}" =~ /./) { update reply { Reply-Message += "YYY" } } (Uncomment "shortname = localhost" from clients.conf). The first test fails to match, but the second one matches. Debug output: ... [files] users: Matched entry steve at line 76 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++? if (Client-Shortname =~ /./) (Attribute Client-Shortname was not found) ? Evaluating (Client-Shortname =~ /./) -> FALSE ++? if (Client-Shortname =~ /./) -> FALSE ++? if ("%{Client-Shortname}" =~ /./) expand: %{Client-Shortname} -> localhost ? Evaluating ("%{Client-Shortname}" =~ /./) -> TRUE ++? if ("%{Client-Shortname}" =~ /./) -> TRUE ++- entering if ("%{Client-Shortname}" =~ /./) {...} +++[reply] returns noop ++- if ("%{Client-Shortname}" =~ /./) returns noop ++[pap] returns updated Found Auth-Type = PAP ... This is built from the latest code on the v2.1.x branch. If I try with a different request attribute, like Client-IP-Address, it works fine. It's not a big issue, because I can just put the attribute in a string expansion to resolve it, but it was a bit confusing. Thanks, Brian.

5 21

freeradius-client cross compile fail
by Bertrand Jacquin 28 Jun '11

28 Jun '11

Hi there, radiusclient-ng configure failed when cross compiling as no fallback method to handling this : checking for stricmp... no checking for random... yes checking for rand... yes checking for snprintf... yes checking for vsnprintf... yes checking for field domainname in struct utsname... configure: error: in `/usr/i586-geode-linux-gnu/tmp/portage/net-dialup/freeradius-client-1.1.6/work/freeradius-client-1.1.6': configure: error: cannot run test program while cross compiling See `config.log' for more details Here is a patch to let user define utsname status by defining ac_cv_struct_utsname There is another fix for /dev/urandom that is tested on build host. But this file can don't exist on target host. So let user define ac_cv_file__dev_urandom -- Beber On Lady Voodoo

1 1

git 2.1.x /src/lib/radius.c first line mis tyop
by ziyen 27 Jun '11

27 Jun '11

Hi git 2.1.x /src/lib/radius.c first line ">" included Thanks.

2 1

[PATCH] rlm_mschap: silence gcc buffer overflow detection mechanism
by Petr Uzel 27 Jun '11

27 Jun '11

Signed-off-by: Petr Uzel <petr.uzel(a)suse.cz> --- src/modules/rlm_mschap/rlm_mschap.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/modules/rlm_mschap/rlm_mschap.c b/src/modules/rlm_mschap/rlm_mschap.c index ab9c4b1..da50daa 100644 --- a/src/modules/rlm_mschap/rlm_mschap.c +++ b/src/modules/rlm_mschap/rlm_mschap.c @@ -1780,10 +1780,10 @@ static int mschap_authenticate(void * instance, REQUEST *request) inst->allow_retry); if (inst->retry_msg) { - snprintf(buffer + 9, sizeof(buffer), " C="); + snprintf(buffer + 9, sizeof(buffer) - 9, " C="); for (i = 0; i < 16; i++) { snprintf(buffer + 12 + i*2, - sizeof(buffer), "%02x", + sizeof(buffer) - 12 - i*2, "%02x", fr_rand() & 0xff); } snprintf(buffer + 12 + 32, sizeof(buffer) - 45, -- 1.7.3.4 Petr -- Petr Uzel IRC: ptr_uzl @ freenode

2 1

Failed creating handler
by Cornel Cruceru 27 Jun '11

27 Jun '11

Hi, I'm running FreeRADIUS 2.1.11 on Gentoo compiled with specific patches (qafixes, versionless, pkglibdir) and a small patch of my own (byminute, adds an extra var in xlat.c, nothing big). I'm experiencing a weird crash of which I've found absolutely nothing online: "Failed creating handler". Source code says this one comes from src/main/event.c when calling fr_event_insert() but I can't figure out anything else. The server does decoupled accounting, one site has only one module in accounting, rlm_detail and the other listens on the detail logs with only one module in accounting, rlm_python. cleanup_delay is 5, max_requests 10240, 16 threads, max_requests_per_server = 1500 Any idea what could be the problem? tx, amne

4 3

Build system / win32
by Phil Mayers 26 Jun '11

26 Jun '11

So... There was some discussion last week on the JANET-ROAMING list which culminated in several people expressing a desire for a native windows version of FreeRADIUS. I spent a bit of time this weekend with the mingw32 cross-compiler and pthread/openssl cross-compiled libraries, and it does look like this might be possible. It will have a limit of 63 sockets because of the way select() works on Windows, and it'll need some slight portability tweaks, but the basic concept is sound; I've got a version that will start up and parse the config file... ...unfortunately that's as far as it'll get, because the build has trouble generating the various shared libraries in DLL form, namely libfreeradius-radius and libfreeradius-eap, as well as the rlm_xx. The main reason seems to be the build system; If you have a fully autoconf/automake and libtool-ised source base, the cross-compile seems to work this all out for you, but in the case of FreeRADIUS there seem to be a mix - autoconf is used, but automake isn't and the libtool stuff seems to be hand-crafted to work around the various bugs it's had? Before I spend any more time on this - what's the future of the build system? I'm only passingly familiar with autotools, but if we want to keep it, I'm happy to take a look? If on the other hand the desire is to junk it (and in particular libtool) then there's no point spending any time on it, and I'll try a different approach (possibly a hand-crafted makefile.mingw32) Cheers, Phil

2 3