October 2012 - Freeradius-Devel - lists.freeradius.org

SQL escaping
by Phil Mayers 05 Oct '12

05 Oct '12

All, I'd like to add a patch that uses the correct escaping function - for example, PQescapeStringConn in libpq - when expanding SQL strings. For various reason we find the "safe-characters" encoding a bit limiting for us. I did look at adding a per-module selectable escaping function with the current "safe" option as the default and a "\xNN" for non-ascii characters, but this again has some issues. It seems like it might be a good idea to use the underlying SQL driver escape function if one is present. Unfortunately this is a bit more complex than it first looks. In particular, the RADIUS_ESCAPE_FUNC prototype only receives the in, out and length params - no reference to the request or any other context it is called from. Also, it's not beyond the realm of possibility that someone might want to interpolate strings into a query other than arguments e.g. update control { Tmp-String-0 := "table1" } update control { Tmp-Integer-0 := "%{sql:select * from %{control:Tmp-String-0} ...}" } Does anyone have any insight into how to go about this? In particular, I note that the libpq API requires a reference to the connection object you're about to send the query down, because per-connection attributes (like client encoding) might affect the escaping. This could be doubly troublesome if you are talking to >1 backend with distinct SQL settings (a bad idea I know). Suggestions welcome - is this more trouble than it's worth? Cheers, Phil

3 16

Commit report for master branch
by announce＠freeradius.org 04 Oct '12

04 Oct '12

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Merge pull request #99 from sionescu/wip-fix-with-system-libtool Fix --with-system-libltdl and --with-system-libtool Alan DeKok@2012-10-04T12:40:51Z Files modified: * configure.in * debian/freeradius.default * raddb/README.rst * src/modules/rlm_pap/rlm_pap.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/15605a7fa862bfb7ee95… ====== Fix --with-system-libltdl and --with-system-libtool Stelian Ionescu@2012-10-02T20:00:24Z Files modified: * configure.in Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/0fbc2861a7a5d3fc548f… ====== Fix formatting Arran Cudbard-Bell@2012-10-03T19:31:21Z Files modified: * raddb/README.rst Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/7766f9abb33f762057f8… ====== Merge pull request #100 from mcnewton/rlm_pap_tidy Rlm pap tidy Arran Cudbard-Bell@2012-10-03T19:29:29Z Files modified: * raddb/README.rst * src/modules/rlm_pap/rlm_pap.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/bdf13e81987a3b11c20a… ====== update upgrade documentation with User-Password deprecation note Matthew Newton@2012-10-03T18:43:49Z Files modified: * raddb/README.rst Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/8a462ae09e86f8a7f4da… ====== remove auth check against User-Password, add autz warning Matthew Newton@2012-10-03T18:43:49Z Files modified: * src/modules/rlm_pap/rlm_pap.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/24d7921c043792b3428c… ====== -- This commit summary was generated @2012-10-04T18:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

building trouble
by marco perugini 04 Oct '12

04 Oct '12

hi list! saturday we tried to build latest snapshot from git but we got the following errors; does anyone know what is changed about libtool? are we missing something? we're on a centos 6.3 box.. thanks, marco ## make output ## ... Makefile:37: target `rlm_wimax' given more than once in the same rule. Making all in src/modules/rlm_wimax... Making all in src/modules/rlm_acctlog... Making all in src/modules/rlm_always... CC rlm_wimax.c CC rlm_acctlog.c Making all in src/modules/rlm_attr_filter... CC rlm_always.c CC rlm_attr_filter.c Making all in src/modules/rlm_attr_rewrite... Making all in src/modules/rlm_cache... Making all in src/modules/rlm_chap... Making all in src/modules/rlm_checkval... CC rlm_cache.c CC rlm_attr_rewrite.c CC rlm_chap.c CC rlm_checkval.c rlm_cache.c: In function 'cache_entry_free': rlm_cache.c:77: warning: passing argument 1 of 'free' discards qualifiers from pointer target type /usr/include/stdlib.h:488: note: expected 'void *' but argument is of type 'const char *' rlm_cache.c: In function 'cache_detach': rlm_cache.c:460: warning: passing argument 1 of 'free' discards qualifiers from pointer target type /usr/include/stdlib.h:488: note: expected 'void *' but argument is of type 'const char *' LINK rlm_acctlog.la rlm_acctlog.lo LINK rlm_always.la rlm_always.lo LINK rlm_chap.la rlm_chap.lo LINK rlm_checkval.la rlm_checkval.lo libtool: link: libtool library `rlm_acctlog.la' must begin with `lib' libtool: link: Try `libtool --help --mode=link' for more information. gmake[6]: *** [rlm_acctlog.la] Error 1 gmake[5]: *** [rlm_acctlog] Error 2 gmake[5]: *** Waiting for unfinished jobs.... libtool: link: libtool library `rlm_always.la' must begin with `lib' libtool: link: Try `libtool --help --mode=link' for more information. gmake[6]: *** [rlm_always.la] Error 1 gmake[5]: *** [rlm_always] Error 2 libtool: link: libtool library `rlm_chap.la' must begin with `lib' libtool: link: Try `libtool --help --mode=link' for more information. gmake[6]: *** [rlm_chap.la] Error 1 gmake[5]: *** [rlm_chap] Error 2 libtool: link: libtool library `rlm_checkval.la' must begin with `lib' libtool: link: Try `libtool --help --mode=link' for more information. gmake[6]: *** [rlm_checkval.la] Error 1 gmake[5]: *** [rlm_checkval] Error 2 LINK rlm_attr_filter.la rlm_attr_filter.lo libtool: link: libtool library `rlm_attr_filter.la' must begin with `lib' libtool: link: Try `libtool --help --mode=link' for more information. gmake[6]: *** [rlm_attr_filter.la] Error 1 gmake[5]: *** [rlm_attr_filter] Error 2 LINK rlm_wimax.la rlm_wimax.lo LINK rlm_cache.la rlm_cache.lo LINK rlm_attr_rewrite.la rlm_attr_rewrite.lo libtool: link: libtool library `rlm_attr_rewrite.la' must begin with `lib' libtool: link: Try `libtool --help --mode=link' for more information. gmake[6]: *** [rlm_attr_rewrite.la] Error 1 gmake[5]: *** [rlm_attr_rewrite] Error 2 libtool: link: libtool library `rlm_wimax.la' must begin with `lib' libtool: link: Try `libtool --help --mode=link' for more information. gmake[6]: *** [rlm_wimax.la] Error 1 gmake[5]: *** [rlm_wimax] Error 2 libtool: link: libtool library `rlm_cache.la' must begin with `lib' libtool: link: Try `libtool --help --mode=link' for more information. gmake[6]: *** [rlm_cache.la] Error 1 gmake[5]: *** [rlm_cache] Error 2 gmake[4]: *** [all] Error 2 gmake[3]: *** [modules] Error 2 gmake[2]: *** [all] Error 2 gmake[1]: *** [src] Error 2 make: *** [all] Error 2

6 10

Re: pairmake w/ regexps in master
by Alan Buxey 03 Oct '12

03 Oct '12

...this seems familiar...similar to issue I had with a regular expression I had in attrs file which I had to sort out when I migrated to 3 when the master first appeared... alan

3 2

rlm_pap code tidy
by Matthew Newton 03 Oct '12

03 Oct '12

Hi, More tidying - this time in rlm_pap. In chunks, it's at https://github.com/mcnewton/freeradius-server/commits/rlm_pap_tidy I've submitted a pull request; details for any comments below: faa17a14 - removed the 'encryption_scheme' option entirely, together with the worthless switch() at the bottom. a9d0b282 - the first update in getting rid of the spaghetti gotos. moves the crypt auth check into a separate function. patch looks messier than it is, as there's a lot of indentation changes. d71b7e3b - the main update - move each auth test into a separate small function, to drastically reduce the size of pap_authenticate() and get rid of all the gotos. (I'm not against gotos, but when they jump in and out of ifs and switch()s, it's really hard to follow the code path!) df48421a - previous introduced an few if()s inside the main attribute check loop, and returned within the loop. this tidies that up and moves that outside. also removes the reliance on RLM_MODULE_INVALID as a loop end test, which I wasn't keen on. 52b68318 - moves header-like stuff into rlm_pap.h It now uses a function pointers to select the right auth function depending on the config attribute found. I was slightly worried that calling functions on this might slow things down a bit. However, running 1000 auths in a tight loop (non-threaded server, debug off) shows essentially no difference on my system - over three runs, old code avg 23.516s, new code avg 23.464s. Cheers, Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Architect (UNIX and Networks), Network Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk>

3 5

pairmake w/ regexps in master
by Phil Mayers 03 Oct '12

03 Oct '12

I think "pairmake" might not be quite right in master: https://github.com/FreeRADIUS/freeradius-server/blob/master/src/lib/valuepa… If "vp->operator" is T_OP_REG_{EQ,NE} then: 1. value is checked - if null, error 2. pairmake_xlat is called 3. this calls pairmake with value==NULL - goto 1, fail This causes problems with regexps in users files e.g. DEFAULT Attr =~ "some(.+)" ...which error out at startup with: Parse error (check) for entry blah: No regular expression found in ICzone

1 0

radius_compare_vps & regexps w/ multiple match
by Phil Mayers 03 Oct '12

03 Oct '12

All, This appears to be unintentional, but you can't do this - with a packet: User-Name = foo Attrib = val1=x Attrib = val2=y ...and a "users" file entry of: DEFAULT Attrib =~ "^val1=(.+)" # do something DEFAULT Attrib =~ "^val2=(.+)" # do something else The reason seems to be that valuepair.c:radius_compare_vps doesn't use the passed-in value of "vp" if you're doing a regexp check. Instead, it calls: sprintf(buf, "%%{%s}", check->name) radius_xlat(value, REQUEST, buf, ...) regexec(..., value) i.e. it "xlat"s "%{checkname}" then performs the regexp against that. This is wrong AFAICT - by using "xlat", it throws away "vp" completely, which breaks the cases where you have >1 value of the same name in the packet. However: is this intentional? Does it do something I'm missing? I think maybe replacing that "radius_xlat" call with a "vp_prints_value" call on the "vp" argument is the right thing to do?

1 0

Commit report for master branch
by announce＠freeradius.org 03 Oct '12

03 Oct '12

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Look for /usr/local/etc/freeradius and use it in preference to /etc/freeradius Arran Cudbard-Bell@2012-10-03T02:03:00Z Files modified: * debian/freeradius.default Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/c9871b816dcc9cd3056f… ====== -- This commit summary was generated @2012-10-03T18:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v2.1.x branch
by announce＠freeradius.org 03 Oct '12

03 Oct '12

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Look for /usr/local/etc/freeradius and use it in preference to /etc/freeradius Arran Cudbard-Bell@2012-10-03T02:02:40Z Files modified: * debian/freeradius.default Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/0e79e0dc4756285b6334… ====== -- This commit summary was generated @2012-10-03T18:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v2.1.x branch
by announce＠freeradius.org 02 Oct '12

02 Oct '12

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Update changelog for 2.2.1 Arran Cudbard-Bell@2012-10-02T00:20:33Z Files modified: * debian/changelog Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/fce8d86236d63e34e091… ====== -- This commit summary was generated @2012-10-02T18:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0