July 2011 - Freeradius-Devel - lists.freeradius.org

rlm_sql_ocioracle driver v. 0.1
by Ge＠＠ru 14 Mar '15

14 Mar '15

Hi, in attachment patch to add rlm_sql_ocioracle driver to freeradius 2.1.x tree (it seems work yet on 3.x tree). This drivers permit to use function/procedure with CURSOR (through :Ret_Cursor string) like for example: group_membership_query = "begin :Ret_Cursor := \ pkRadius.group_membership_query('%{SQL-User-Name}'); end;" TODO for next release: - add support to oracle connection pool instead of open a new connection for every socket on startup; - enhancement on handle error (through error callback) on do query; - add documentation. Module need oracle instantclient library and ocilib library (http://orclib.sourceforge.net/) Good luck to rlm_sql_ocioracle driver!! Geaaru

2 5

LDAP timeouts during failure conditions
by Phil Mayers 15 Aug '11

15 Aug '11

So, some discussion on the JANET-ROAMING list leads me to believe that, during an "ldap server down" condition, rlm_ldap will incur "net_timeout" on every (or many) passes through the module. I don't really understand the MAX_FAILED_* logic at the start of perform_search, but it seems to conflict with the comments at the top of the file: * If conn->failed_conns > MAX_FAILED_CONNS_START then we don't * try to do anything and we just do conn->failed_conns++ and * return RLM_MODULE_FAIL ...perform_search has no such logic; in any event, it seems like it would be better to do an optional time-based per-server "fast fail" so that: redundant { ldap1 ldap2 } ...fails quickly if ldap1 is down. In some ways it's a shame we can't use a worker thread to manage the LDAP connection(s); that way, the module could be marked "fast fail" unless and until a live connection exists. Is there any scope for that? Cheers, Phil

5 19

NAS-Identifier instead of IP
by Gunther 27 Jul '11

27 Jul '11

I have seen several requests in this mailing list regarding the use of the NAS-Identifier for the past 8 or so years. But somehow, there seems to be still no solution on the horizon. The addition of the dynamic client feature provided great relief compared to the static client/nas list which is only loaded during the radiusd startup or SIGHUP. Anyhow, I still have the problem that clients using ISPs with shared IP addresses (e.g. some satellite providers etc) have to use exactly the same shared secret for all routers (nas) despite they might be different customers. In addition, we have clients with the nas installed on vessels and they roam between different satellite links and IP addresses. At times vessels from different companies are using the same IP address at the same time. In my test setup I am now using dynamic clients with sql and rlm_raw on FR 2.1.11. I am extracting the NAS-Identifier within 'dynamic-clients': if ("%{sql: SELECT nas_identifier FROM phs_nas WHERE nas_identifier = '%{raw:NAS-Identifier}'}") { This works fine as only a nas with the correct NAS-Identifier will be allowed. After the first Access-Request the IP address of the NAS is added to the (memory resident) client/nas list. In my sql nas table I like to use the NAS-Identifier instead of the IP address (at least that is my intention). The standard scenario is working fine using the NAS-Identifier: rad_recv: Access-Request packet from host 192.168.25.215 port 49481, id=39, length=222 Wed Jul 27 04:25:18 2011 : Debug: server dynamic_client_server { Wed Jul 27 04:25:18 2011 : Debug: rlm_raw: (raw_xlat) Wed Jul 27 04:25:18 2011 : Debug: rlm_raw: NAS-Identifier = myTestID123 Wed Jul 27 04:25:18 2011 : Debug: rlm_sql_mysql: query: SELECT nasname FROM phs_nas WHERE nasname = 'myTestID123' ... Wed Jul 27 04:25:18 2011 : Debug: } # server dynamic_client_server Wed Jul 27 04:25:18 2011 : Debug: - Added client 192.168.25.215 with shared secret HereIsMySharedSecret1 rad_recv: Access-Request packet from host 192.168.25.215 port 49481, id=39, length=222 User-Name = " myuser" NAS-Identifier = "myTestID123" ... Wed Jul 27 04:25:19 2011 : Info: ++[exec] returns noop Sending Access-Accept of id 39 to 192.168.25.215 port 49481 Here comes the problem! Now radiusd receives a request from a different client/NAS, but with the same IP address: Since the IP is already in the memory resident client/nas list, there is no need to search the database again. The different NAS-Identifier and different shared secret is ignored and the Access-Request is accepted. rad_recv: Access-Request packet from host 192.168.25.215 port 53237, id=42, length=222 User-Name = "thisUser " NAS-Identifier = "myTestID456" ... Sending Access-Accept of id 42 to 192.168.25.215 port 53237 While the request (id=42) is getting through, the reply is using a different shared secret, the one found in the first access-request (id=39) and the reply will therefore not be accepted by the nas and the NAS log shows: RADIUS server is not responding My conclusion: I like to use the e.g. NAS-Identifier for a unique identification of a client/nas instead of the IP. I do not want to change anything on the client side (e.g. vpn etc.). All client/nas have to use unique NAS-Identifiers and Shared Secrets which is easy to achieve during setup. Any hints using FreeRadius with the NAS-Identifier in this context are appreciated! Or if FreeRadius cannot support this, are there other Radius server which could do this job? Is there by chance anywhere Freeradius developer documentation available or is the 'documented' source code the documentation? Thank you!

3 4

bug in token.c ?
by Oliver Schröder 26 Jul '11

26 Jul '11

Hello List, I believe I found a bug in token.c, more precisely in static FR_TOKEN getthing(...) The exact point is the part handling backslahes: --- cut --- if (quote && (*p == '\\')) { p++; switch(*p) { case 'r': *s++ = '\r'; break; case 'n': *s++ = '\n'; break; case 't': *s++ = '\t'; break; case '\0': *s++ = '\\'; p--; /* force EOS */ break; default: if (*p >= '0' && *p <= '9' && sscanf(p, "%3o", &x) == 1) { *s++ = x; p += 2; } else *s++ = *p; break; } p++; continue; } --- cut --- This piece of code removes all backslashes from the input string, which gives incorrect results when parsing strings for regular expressions with excaped characters. At a first glance, the fix is easy: --- cut --- default: if (*p >= '0' && *p <= '9' && sscanf(p, "%3o", &x) == 1) { *s++ = x; p += 2; } else { *s++ = '\\'; /* copy the '\' too */ *s++ = *p; } break; --- cut --- which solves the problem. On the other hand, I'm not sure if it breaks anything else. Is there a reason to remove backslashes on purpose? Or is this really a bug? Regards, Oliver Schröder

3 6

PCRE in 3.0?
by Phil Mayers 25 Jul '11

25 Jul '11

Do we think there's value in using a better regexp library in 3.0? The Exim guys wrote PCRE and bundled it with the Exim source until relatively recently, so if we don't want an external dependency that might be an option (having said that, they removed it about a year ago and it's a dependency now)

4 6

Document required for rlm_python
by Lingfeng Xiong 25 Jul '11

25 Jul '11

hi all, I am very sorry to bother you, but I need the documents for rlm_python. I have searched the wiki and documentation page and found nothing, The project I am working on required me to write a authentication backend for FreeRadius to authenticate with a Django website via HTTP. I wanna make this program by rlm_python to simplify the development. Thanks in advanced.

4 4

<<URGENT>> : Free Radius behavior
by kalk 21 Jul '11

21 Jul '11

Hi Experts, I have the below setup. [Agilent] ------------[Router]--------------------------------------------------- [ Free Radius Server] 50.0.0.2 50.0.0.1 172.52.1.1 eth0 eth1 eth0 The Router sends AAA Request to the Free Radius Server through the interface ( its ip 50.0.0.2) with Destination IP address as 172.52.1.1. But, when router receives response from the Radius server, the response has Source IP as as (50.0.0.1). When I looked into the radius-server, it has the below config. listen { ipaddr = * } it means, the radius can run on any IP address. My question here is, since the router sends request to Radius with the assumption of Radius server runs on (172.52.1.1.), the radius server should listen on that IP address. Is this correct ? Or can it run on any IP address. Since the radius replies with SRC_IP as 50.0.0.1, sessions are not coming up with the Router. Can some one clarify me asap. Appreciating your helps... Thanks, Kaliyaperumal K -- View this message in context: http://freeradius.1045715.n5.nabble.com/URGENT-Free-Radius-behavior-tp46192… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

2 1

Compile FreeRADIUS with Cygwin..
by jeroenvanwissen 19 Jul '11

19 Jul '11

For a project I need to have FreeRADIUS on a Windows 2008 server. I've used FreeRADIUS.net's 1.1.7 binary, but that only works in debug mode for some strange reason. I get errors that cygheap base mismatch detected. Incompatible versions of cygwin1.dll That dll comes with the installer ... strange. So .. someone here got a working config for make'ing any version of freeradius on cygwin ? -- View this message in context: http://freeradius.1045715.n5.nabble.com/Compile-FreeRADIUS-with-Cygwin-tp46… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

2 1

More debian voodoo for libfreeradius3.
by Stephen R. van den Berg 10 Jul '11

10 Jul '11

--- It compiles and spits out .deb files (finally). Debian packaging is not my strong suite, so if anyone actually knows what all these install-files do, please verify my changes/additions. I'm just guessing at what seems sane(r). debian/libfreeradius2.install | 2 +- debian/libfreeradius3.install | 1 + debian/libfreeradius3.lintian-overrides | 1 + 3 files changed, 3 insertions(+), 1 deletions(-) create mode 100644 debian/libfreeradius3.install create mode 100644 debian/libfreeradius3.lintian-overrides diff --git a/debian/libfreeradius2.install b/debian/libfreeradius2.install index 0019b93..0dc4405 100644 --- a/debian/libfreeradius2.install +++ b/debian/libfreeradius2.install @@ -1 +1 @@ -usr/lib/freeradius/libfreeradius*2*.so +usr/lib/freeradius/libfreeradius*-2.*.so diff --git a/debian/libfreeradius3.install b/debian/libfreeradius3.install new file mode 100644 index 0000000..7d27cc7 --- /dev/null +++ b/debian/libfreeradius3.install @@ -0,0 +1 @@ +usr/lib/freeradius/libfreeradius*-3.*.so diff --git a/debian/libfreeradius3.lintian-overrides b/debian/libfreeradius3.lintian-overrides new file mode 100644 index 0000000..835bea5 --- /dev/null +++ b/debian/libfreeradius3.lintian-overrides @@ -0,0 +1 @@ +libfreeradius3: binary-or-shlib-defines-rpath -- 1.7.5.4 -- Stephen. "Having a non-smoking section in a restaurant is like having a non-peeing section in a pool."

2 1

Maintenance of the current radiusclient codebase
by freeradius developer/user identity 10 Jul '11

10 Jul '11

Alan, Thank you for the patches, but I'm confused. If the plan is to replace radiusclient completely within a few months with code that is currently being developed, why patch the current code with patches more than a year old? When you announced that you would be replacing radiusclient, I assumed that a separate maintainer for the old codebase would not be needed. Thank you again - Larry On Sat, Jul 09, 2011 at 11:34:47PM +0200, Alan DeKok wrote: > > More patches.. > From: Alex Massover <alex(a)jajah.com> > To: FreeRadius developers mailing list <freeradius-devel(a)lists.freeradius.org> > Date: Tue, 2 Mar 2010 17:39:15 +0200 > Subject: RE: radiusclient thread-safety > ....

2 1