February 2012 - Freeradius-Devel - lists.freeradius.org

rlm_sql_ocioracle driver v. 0.1
by Ge＠＠ru 14 Mar '15

14 Mar '15

Hi, in attachment patch to add rlm_sql_ocioracle driver to freeradius 2.1.x tree (it seems work yet on 3.x tree). This drivers permit to use function/procedure with CURSOR (through :Ret_Cursor string) like for example: group_membership_query = "begin :Ret_Cursor := \ pkRadius.group_membership_query('%{SQL-User-Name}'); end;" TODO for next release: - add support to oracle connection pool instead of open a new connection for every socket on startup; - enhancement on handle error (through error callback) on do query; - add documentation. Module need oracle instantclient library and ocilib library (http://orclib.sourceforge.net/) Good luck to rlm_sql_ocioracle driver!! Geaaru

2 5

Complete authorize & accounting redis module
by Manuel Guesdon 31 Oct '12

31 Oct '12

Hi, I've adapted rlm_sql to REDIS (http://redis.io/) key-store database. It handle authorize, accounting, checksimul and post-auth (only authorize is deeply tested). Authorize works like rlm_sql with groups, etc... Files are here: http://free.oxymium.net/freeradius/rlm_redisn/ Available as .tgz here: http://free.oxymium.net/freeradius/rlm_redisn-20111112-001.tgz Manuel -- ______________________________________________________________________ Manuel Guesdon - OXYMIUM

4 11

New build system
by Alan DeKok 21 Sep '12

21 Sep '12

OK, I've fixed a bug with dependencies, where it wouldn't re-build a C file if a header changed. I've also added some "configure" support. So modules like rlm_pam, python, perl, etc. only get built if their prerequisites are found. One benefit is that "make -j 8" now works. On my quad-core system I get this: $ time make -j 8 clean all ... real 0m4.357s user 0m24.702s sys 0m3.580s A complete build in less than 5 seconds. Very nice! Alan DeKok.

4 6

TLS configuration
by Matthew Newton 06 Mar '12

06 Mar '12

Hi, We've been struggling a bit with the TLS config - not actually configuring it, but how it appears in the config file. The basic thoughts go something along the lines of: PEAP uses TLS EAP-TTLS uses TLS EAP-TLS uses TLS ... so why is the TLS config all inside EAP-TLS, and mysteriously PEAP and TTLS use EAP-TLS's config? When you go to configure PEAP/EAP-TLS things get more interesting, as you actually have to configure EAP-TLS+PEAP (outer), and then EAP-TLS (inner). To be honest, configuring PEAP/MS-CHAPv2 a year or so ago for the first time felt wierd too - "but I don't want EAP-TLS" :) This it not from a programming point of view - I can see why it's done like that. It's more for ease of understanding the configuration. There are other places where TLS crops up too, such as RADSEC and LDAP. The RADSEC one specifically says it's the same config as EAP-TLS (but at least it doesn't *use* EAP-TLS's config!) We wondered whether something like the following would be feasable, or worth trying to implement? In the main top-level config in radiusd.conf, have a new 'tls' section, that might look something like this: tls { outer-peap { certificate_file = ${certdir}/server.pem ... } inner-eap { private_key_file = ${certdir}/server.pem certificate_file = ${certdir}/server.pem CA_file = ${cadir}/ca.pem ... } outer-tls { ... } radsec { ... } ldap { ... } } where the sub-headings are just labels - instantiations of the 'tls' config. Then wherever a TLS configuration is required, we can have just "tls = outer-peap". For example, modules: eap { tls { tls = outer-tls fragment_size = 1200 ... } peap { tls = outer-peap default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" ... } } eap inner-eap { tls { tls = inner-tls cache { ... } fragment_size = 1024 verify { ... } } } This then makes it quite clear which TLS config belongs to which section, and allows sharing of TLS configs if really desired. The only potential problem I can see is if the TLS on EAP comes up first, before the EAP type is determined, but having looked at the protocol I don't believe that is the case - so the server should always know that it's the PEAP tls= config that is being used, as the EAP type was code 25, for example. I think we were thinking "hang on a sec, TLS is a generic server thing, nothing really to specifically do with EAP-TLS or PEAP, etc, so why is the config just in EAP-TLS - that's confusing". As a start, I guess the modules could keep their current TLS settings, but have an additional tls= option that would pull global config in at instantiation time. I'm not sure it needs to be any more difficult than that - except maybe in the PEAP/TTLS sections which don't have their own settings already. Are there any thoughts on this - is it worth persuing? I'm not sure if I'll have time to work on it or not, but thought it was worth throwing the idea out anyway. :) Thanks, Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Architect (UNIX and Networks), Network Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk>

2 11

Tracking packet/s in the server
by Alan DeKok 24 Feb '12

24 Feb '12

The "listen" sections in 3.0 have a new entry: max_pps = 300 If that socket receives MORE than that many packets/s, it throws away all new packets. The packet/s counter is tracked in a sliding window over the last second. That means "the number of packets received in the second immediately before receiving the current packet". It's not tracking the number of packets in the current wall-clock second. The feature is mainly intended for accounting sockets. It is *very* expensive to process accounting packets. They can usually be discarded without a problem, as the NAS will retransmit them. The idea is to set the "max_pps" to some fairly large value. Then if the server receives a sudden influx of traffic, it won't die. Instead, it will continue to make progress at a steady rate. The feature has another configuration entry in the "thread pool" section: auto_limit_acct = yes/no If set to "yes", it auto-limits accounting packets. The server maintains a queue of packets for child threads. With auto_limit_acct=yes, it tracks the rate at which packets leave the queue, and the rate at which they enter the queue. If the queue is more than half full, AND the rate of entry is larger than the exit rate, it throws the accounting packet away. All other packet types are unaffected. The idea here is for the server to automatically adapt to overload conditions. If it's getting traffic than it can handle, it starts to throw away that traffic. Suggestions for better heuristics are welcomed. Testing is also welcomed. :) Alan DeKok.

4 7

Re: Tracking packet/s in the server
by Alan Buxey 23 Feb '12

23 Feb '12

Quoting.... control: variable to the server{} block; that way, if you wanted to, local sites could do this: preacct { if (control:FreeRADIUS-Acct-QueueLoad > 50) { ok } else { .. } } if you have this sort I'd thing exposed you could even then just decide to take the load off your server...either sending the packet to disk or off to another server.. buffered-sql or proxy-to-home... alan

2 1

Re: Tracking packet/s in the server
by Alan Buxey 23 Feb '12

23 Feb '12

I assume that these values are exposed to eg the status server so we can see them with current monitoring probes, eg monit ? ...and likewise send out an snmptrap via triggers.conf? alan

3 5

rlm_detail packet selection
by Matthew Newton 17 Feb '12

17 Feb '12

Hi, After the virtual server for eap-tls, I realised that there was no way to get rlm_detail to log the request packet in post-auth. As the TLS-* attribs are added to the request, but only available in post-auth, there's a problem if you want to use rlm_detail unless you set up the eap-tls virtual server. This patch adds a log_packet option to detail, which has the options 'request', 'reply', 'proxy-request' and 'proxy-reply', to select the packet to log. If not specified, or the requested packet has nothing in it, it falls back to the previous default. https://github.com/mcnewton/freeradius-server/commit/ad07620e9fd97c38b78527… Rather than just allow it log the request in post-auth, I thought it would be more flexible to allow the admin to set what they want to log, although I couldn't think of any other non-debug use cases myself. Cheers, Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Architect (UNIX and Networks), Network Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk>

1 1

MySQL default charset
by Stefan Winter 17 Feb '12

17 Feb '12

Hello, for the n'th time, I ran into character set problems, where our database server is well-configured for UTF-8, but the libmysqlclient on the FreeRADIUS server end is not. I kept pulling my hair out on the question why e-accent characters come in as latin1 ( 0xe9 ) instead of proper UTF-8. In the end I figured: the version of libmysqlclient that I have defaults (compile-time default of the library) to latin1. The character set is not configurable in FreeRADIUS. After some searching, I realised that I need a my.cnf with some magic words in /etc. I wonder if either FreeRADIUS should make the charset configurable in the sql/mysql/dialup.conf (my MySQL gurus say that it should better be) - or at least this caveat should be documented. Since the latter is just a config change, a diff -u to that end is below. Greetings, Stefan Winter diff -u dialup.conf dialup.conf.new --- dialup.conf 2011-09-30 16:12:07.000000000 +0200 +++ dialup.conf.new 2012-02-17 13:43:15.946237891 +0100 @@ -10,6 +10,17 @@ #safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" ####################################################################### + # Connection config + ####################################################################### + # The character set is not configurable. The default character set of + # the mysql client library is used. To control the character set, + # create/edit my.cnf (typically in /etc/mysql/my.cnf or /etc/my.cnf) + # and enter + # [client] + # default-character-set = utf8 + # + + ####################################################################### # Query config: Username ####################################################################### # This is the username that will get substituted, escaped, and added -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

2 1

FR 3 GIT segmentation fault
by Alan Buxey 16 Feb '12

16 Feb '12

hi, GIT release of FR 3 segfaults with incoming EAP authentication - have updated (as the version we were running was a week old) and still failing. looks like its related to some changes regarding EAP caching and TLS code. i think theres something just missing from the code (or an erroneous paste). another server running 3 GIT from around 3 weeks ago is unaffected. debug log attached... valuepair.c line 282 - which matches src/lib/valuepair.c not sr/main/valuepair.c is the culprit alan

2 1