September 2011 - Freeradius-Devel - lists.freeradius.org

rlm_sql_ocioracle driver v. 0.1
by Ge＠＠ru 14 Mar '15

14 Mar '15

Hi, in attachment patch to add rlm_sql_ocioracle driver to freeradius 2.1.x tree (it seems work yet on 3.x tree). This drivers permit to use function/procedure with CURSOR (through :Ret_Cursor string) like for example: group_membership_query = "begin :Ret_Cursor := \ pkRadius.group_membership_query('%{SQL-User-Name}'); end;" TODO for next release: - add support to oracle connection pool instead of open a new connection for every socket on startup; - enhancement on handle error (through error callback) on do query; - add documentation. Module need oracle instantclient library and ocilib library (http://orclib.sourceforge.net/) Good luck to rlm_sql_ocioracle driver!! Geaaru

2 5

[libfreeradius-client] Send request to non-standard ports
by Kevin Lemonnier 05 Oct '11

05 Oct '11

Hi, I'm trying to send radius auth request to the 11812 port. So i've placed 11812 as second parameter of the rc_auth function. On my server's log, I can see that the NAS-PORT is set, in the request, to 11812. But the request itself is sent to the standard 1812 port .. How can I change that ? I need to send some request to 1812 and some others to 11812 (two radius servers are running). I've looked at the example code but they are just using the port parameter of rc_auth, so I can't find a way to make it work. (I'll need to do the same with accounting too) Thanks

4 12

RADIUS Disconnect scenarios
by vikraman.p36＠wipro.com 29 Sep '11

29 Sep '11

Hi , Please provide me the solution for the following , What are the scenarios/conditions cause the RADIUS server to send RADIUS Disconnect Request to RADIUS client (NAS) ? Thanks, Vikram Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

3 2

rlm_sim_files pairadd only ? Is there any need to pairdelete ?
by Ming-Ching Tiew 24 Sep '11

24 Sep '11

I am fairly new to writing modules for freeradius. While reading the sources for rlm_sim_files, in the authorize section the code adds the needed attributes by using pairadd(...). I am just wondering if the authorize section keeps adding things into the memory by using pairadd(), at some point in time ( say after authentication ) these values will have to be removed from the memory, otherwise after many times of invocations, that will constitute a memory leak. How is the housekeeping been carried out ?

2 1

radtest should always send Message-Authenticator
by John Dennis 22 Sep '11

22 Sep '11

Here is a small 1-line patch for radtest. This was originally filed as a bug by the NSA (https://bugzilla.redhat.com/show_bug.cgi?id=630072) It would be nice if this could be applied to 2.1.12 before it's released. The patch is attached in git format and can be applied with either "git am" or "git apply <attachement>" if you save the attachment. I wrote up the justification for the change: ------------------------------------------------------------------ Originally Message-Authenticator was introduced to provide message integrity for EAP messages and originally the Message-Authenticator attribute was only required for EAP messages. But then RFC 5080 came along and suggested Message-Authenticator always be sent as best practice. Any Access-Request packet that performs authorization checks, including Call Check, SHOULD contain a Message-Authenticator attribute. RFC 5080 then goes on to say: ... server implementations may be configured to require the presence of a Message-Authenticator attribute in Access-Request packets. Requests not containing a Message-Authenticator attribute MAY then be silently discarded. The raddb/clients.conf has this configuration option to satisfy the above suggestion in RFC 5080: require_message_authenticator = no|yes If require_message_authenticator == yes then non-EAP auth-requests generated by radtest will fail because currently radtest only supplies the Message-Authenticator if EAP is being performed. With modern Radius servers (e.g. FreeRADIUS) there is no harm in providing the Message-Authenticator attribute for non-EAP packets, in fact it's actually recommended in RFC 5080. Therefore radtest should ALWAYS send the Message-Authenticator attribute. If it's EAP or if the server is configured with require_message_authenticator it must be present. If those conditions do not hold it's benign. However if require_message_authenticator is configured radtest will fail for non-EAP. -- John Dennis <jdennis(a)redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/

5 6

freeradius-users is down... is this?
by Alan DeKok 19 Sep '11

19 Sep '11

2 1

asynchronous nature of eap_sim_db functionality inside eap2 module
by Ming-Ching Tiew 14 Sep '11

14 Sep '11

While trying out the eap_sim_db functionality of eap2 module, for the purpose of retrieving authentication information from external sources, I found that the it works in a somewhat asynchronous manner, specifically when a call to eap_sim_db_get_gsm_triplet() is made via eap2 module, the functions returns PENDING to the caller. And this is in the code :- /* ..... * When using an external server for GSM triplets, this function can always * start a request and return EAP_SIM_DB_PENDING immediately if authentication * triplets are not available. Once the triplets are received, callback * function registered with eap_sim_db_init() is called to notify EAP state * machine to reprocess the message. This eap_sim_db_get_gsm_triplets() * function will then be called again and the newly received triplets will then * be given to the caller. When hard-coding the data to return immediately, I notice that the authentication from radius client will succeed. But when using this asynchronous behaviour, authentication will not succeed. By the way, I am using eapol_test for the testing. Should I just make it synchronous ( ie block until the gsm data comes back ) or there is a way to accomodate this inside freeradius ? Best regards.

2 1

FreeRADIUS can't make progress under certain load
by rihad 12 Sep '11

12 Sep '11

Hi, sometimes when a NAS with many users reboots FreeRADIUS is unable to cope with the number of incoming requests: Sat Sep 10 13:23:16 2011 : Auth: Login OK: [5702018] (from client 10.10.70.100 port 0) Sat Sep 10 13:23:16 2011 : Error: Received conflicting packet from client 10.10.70.98 port 1645 - ID: 131 due to unfinished request 2814. Giving up on old request. Sat Sep 10 13:23:16 2011 : Auth: Login OK: [5026706] (from client 10.10.70.38 port 0) Sat Sep 10 13:23:16 2011 : Error: Received conflicting packet from client 10.10.70.93 port 1646 - ID: 117 due to unfinished request 1036. Giving up on old request. Sat Sep 10 13:23:16 2011 : Auth: Login OK: [4925140] (from client 10.10.70.93 port 0) Sat Sep 10 13:23:16 2011 : Error: Received conflicting packet from client 10.10.70.60 port 1645 - ID: 109 due to unfinished request 3370. Giving up on old request. Sat Sep 10 13:23:16 2011 : Auth: Login OK: [4977364] (from client 10.10.70.38 port 0) Sat Sep 10 13:23:16 2011 : Error: Received conflicting packet from client 10.10.70.93 port 1646 - ID: 118 due to unfinished request 1040. Giving up on old request. Sat Sep 10 13:23:16 2011 : Error: Received conflicting packet from client 10.10.70.60 port 1645 - ID: 110 due to unfinished request 3373. Giving up on old request. Sat Sep 10 13:23:16 2011 : Auth: Login OK: [4529464] (from client 10.10.70.28 port 0) Sat Sep 10 13:23:16 2011 : Error: Received conflicting packet from client 10.10.70.98 port 1645 - ID: 132 due to unfinished request 2829. Giving up on old request. and ad infinitum. The duplicate requests come from PPPoE clients after they fail to receive a response within 5 seconds or so. The problem can then be solved by restarting the daemon once or twice and watching the errors go away. The fact that dropping all current work helped gave me this idea: wouldn't it be nice if FreeRADIUS dropped both the old _and_ the new request at the time it logged that "giving up" message? That would at least allow it to make progress. BTW, I'm not sure why, but under comparable workloads openradius does not exhibit this problem. I looked in the code, namely in src/main/event.c /* * FUTURE: Add checks for system load. If the system is * busy, start dropping requests... * * We can probably keep some statistics ourselves... if * there are more requests coming in than we can handle, * start dropping some. */ Sure the time has come for us :) Here's my try to drop them both when receiving a dupe: --- freeradius-server-2.1.11/src/main/event.c 2011-06-20 19:57:14.000000000 +0500 +++ event.c 2011-09-10 20:44:34.000000000 +0500 @@ -2894,7 +2894,7 @@ received_conflicting_request(request, client); request = NULL; - break; + return 0; case REQUEST_REJECT_DELAY: case REQUEST_CLEANUP_DELAY: Any thoughts?

5 31

Bug in function sql_oracle.c - sql_init_socket - OCILogon
by Angelo Compagnucci 11 Sep '11

11 Sep '11

Hi List, I wrote for this bug some months ago, but I had no replies. I opened the bug number 172. http://bugs.freeradius.org/bugzilla/show_bug.cgi?id=172 The bug persists on the last trunk version on github. Can you confirm and eventually solve it? Thank you!

2 4

playing with eap2 - access-challenge instead of access-accept
by Ming-Ching Tiew 10 Sep '11

10 Sep '11

I am playing with eap2 module using libeap.so from the hostapd 0.7.3 stable ( plus Makefile modifications ). I have got it to a stage where it can be instantiated - despite a few other off topic issues. But when I put that 'eap2' in place of 'eap' in the authentication section, nothing happens, eap2 module is not invoked. So I changed it to :- Auth-Type eap { eap2 } The module is then invoked. But I am still not coming close to being able get it to authenticate, because when I tested the simplest case of eap md5, this is what I got from radius debug :- Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group eap {...} CTRL-EVENT-EAP-STARTED 00:00:00:00:00:00 CTRL-EVENT-EAP-PROPOSED-METHOD method=1 CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=25 ==> Request ++[eap2] returns handled Sending Access-Challenge of id 250 to 127.0.0.1 port 52414 EAP-Message = 0x01d300061920 State = 0xe3c425eb267c641f82d999e1c9808ce1 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 0. Verses this is what I get if I use 'eap' module :- [eap] Request found, released from the list [eap] EAP/md5 [eap] processing type md5 [eap] Freeing handler ++[eap] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 160 to 127.0.0.1 port 50702 EAP-Message = 0x03d30004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "eapmd5" Finished request 1. Seems eap2 is always returning access-challenge while eap is able to complete with access-accept. Is it that the rlm_eap2.c source needs further modifications ? Best regards.

2 2