March 2012 - Freeradius-Devel - lists.freeradius.org

rlm_sql_ocioracle driver v. 0.1
by Ge＠＠ru 14 Mar '15

14 Mar '15

Hi, in attachment patch to add rlm_sql_ocioracle driver to freeradius 2.1.x tree (it seems work yet on 3.x tree). This drivers permit to use function/procedure with CURSOR (through :Ret_Cursor string) like for example: group_membership_query = "begin :Ret_Cursor := \ pkRadius.group_membership_query('%{SQL-User-Name}'); end;" TODO for next release: - add support to oracle connection pool instead of open a new connection for every socket on startup; - enhancement on handle error (through error callback) on do query; - add documentation. Module need oracle instantclient library and ocilib library (http://orclib.sourceforge.net/) Good luck to rlm_sql_ocioracle driver!! Geaaru

2 5

Complete authorize & accounting redis module
by Manuel Guesdon 31 Oct '12

31 Oct '12

Hi, I've adapted rlm_sql to REDIS (http://redis.io/) key-store database. It handle authorize, accounting, checksimul and post-auth (only authorize is deeply tested). Authorize works like rlm_sql with groups, etc... Files are here: http://free.oxymium.net/freeradius/rlm_redisn/ Available as .tgz here: http://free.oxymium.net/freeradius/rlm_redisn-20111112-001.tgz Manuel -- ______________________________________________________________________ Manuel Guesdon - OXYMIUM

4 11

New build system
by Alan DeKok 21 Sep '12

21 Sep '12

OK, I've fixed a bug with dependencies, where it wouldn't re-build a C file if a header changed. I've also added some "configure" support. So modules like rlm_pam, python, perl, etc. only get built if their prerequisites are found. One benefit is that "make -j 8" now works. On my quad-core system I get this: $ time make -j 8 clean all ... real 0m4.357s user 0m24.702s sys 0m3.580s A complete build in less than 5 seconds. Very nice! Alan DeKok.

4 6

New Developer Intro / Help with building RPM
by Jason Rohm 27 Mar '12

27 Mar '12

Hello. I'm new to the community. I'm getting involved primarily out of interest in radsec improvements. My background is in networking, mostly Cisco stuff. I've been doing quite a bit of development around Cisco phone system automation. Primarily in PHP and Java, but I have some C experience in another life. I consider myself a linux 'power user' but not an expert. I've been successful in downloading the repo from git and compiling it locally. I was able to use the locally compiled code to begin testing but would like to roll it out to other hosts, most of which are not (and cannot) be setup for local compiling. I have NOT been successful in building an RPM directly from the git repo. I'm using the following Mandriva wiki page as a guide: 'http://wiki.mandriva.com/en/Rpmbuild_and_git' I am developing and testing on CentOS 6.2 64-bit. Most information I've found by consulting with Mr. Google describes only how to create them from and existing SRPM. I'd like some assistance in the form of a cheat sheet, wiki, or whatever you have to point me in the right direction. The current output of my 'rpmbuild' is attached below my signature. Jason Rohm Communication Architect SRC Technologies [xxxxx@freeradiusdev rpmbuild]$ rpmbuild -ba ~/rpmbuild/SPECS/freeradius.spec Executing(%prep): /bin/sh -e /var/tmp/rpm-tmp.udSl3C + umask 022 + cd /home/xxxxxx/rpmbuild/BUILD + LANG=C + export LANG + unset DISPLAY + cd /home/xxxxxx/rpmbuild/BUILD + rm -rf freeradius-server-2.2.0 + /usr/bin/bzip2 -dc /home/jtrohm/rpmbuild/SOURCES/freeradius-server-2.2.0.tar.bz2 + /bin/tar -xf - + STATUS=0 + '[' 0 -ne 0 ']' + cd freeradius-server-2.2.0 + /bin/chmod -Rf a+rX,u+w,g-w,o-w . + echo 'Patch #1 (freeradius-cert-config.patch):' Patch #1 (freeradius-cert-config.patch): + /bin/cat /home/xxxxx/rpmbuild/SOURCES/freeradius-cert-config.patch + /usr/bin/patch -s -p1 -b --suffix .cert-config --fuzz=0 1 out of 1 hunk FAILED -- saving rejects to file raddb/certs/ca.cnf.rej 1 out of 1 hunk FAILED -- saving rejects to file raddb/certs/client.cnf.

3 4

[patch] Don't dereference a null pointer.
by Jonh Wendell 16 Mar '12

16 Mar '12

hi, folks. attached is a patch to fix a crash when the radiusclient.conf file doesn't have certain keys. it's applied against alandekok's github master tree. cheers, -- Jonh Wendell www.vexcorp.com

1 0

Spare threads not exiting
by Matt Ezell 08 Mar '12

08 Mar '12

Hello- I was originally running FreeRADIUS 2.1.10 that came with CentOS 6.2, but I've since compiled my own 2.1.12. It looks like the thread management isn't quite working like I expect it to. If I flood the server with a ton of concurrent requests, it will spawn new threads up to "max_servers". Then, if I slowly hit the server with requests (to allow the cleanup mechanism time to work), the number of threads does not go down to "max_spare_servers". Has anyone else seen this? I instrumented threads.c, and it appears that a thread's "request" field doesn't get set to NULL after it handles a requests*. This is a problem, because the thread reaper uses the condition (handle->request == NULL) to mark a thread as THREAD_CANCELLED. I tested a small patch that appears to allow threads to cleanup, but I'm not sure if it's the right way to proceed with this. I tried to setup a pull request on github, but it looks like it tired to push my entire 2.1.x branch onto master (https://github.com/alandekok/freeradius-server/pull/51) I understand that you normally request that people provide the output of "radiusd -X", but "single server" mode handles threading differently (i.e. I don't see the problem). Basically, I'm using the default "thread pool" settings, but all my requests go through an rlm_perl "authorize" module that sets Auth-Type to 'Accept' (for testing). Let me know if you still want this output to see some of my settings. I also understand that some of this code has been re-worked for MASTER. I understand if you don't plan on releasing another 2.1.x, but I would appreciate it if you let me know if this is an appropriate fix on 2.1.x. We are probably going to stick with this series for a while. Thanks for your time- ~Matt * I added the following code in threads.c in thread_pool_manage() if (handle->request != NULL) { DEBUG2("Threads: thread %d NOT canceled, processing %i\n",handle->thread_num,handle->request->number); }

2 1

TLS configuration
by Matthew Newton 06 Mar '12

06 Mar '12

Hi, We've been struggling a bit with the TLS config - not actually configuring it, but how it appears in the config file. The basic thoughts go something along the lines of: PEAP uses TLS EAP-TTLS uses TLS EAP-TLS uses TLS ... so why is the TLS config all inside EAP-TLS, and mysteriously PEAP and TTLS use EAP-TLS's config? When you go to configure PEAP/EAP-TLS things get more interesting, as you actually have to configure EAP-TLS+PEAP (outer), and then EAP-TLS (inner). To be honest, configuring PEAP/MS-CHAPv2 a year or so ago for the first time felt wierd too - "but I don't want EAP-TLS" :) This it not from a programming point of view - I can see why it's done like that. It's more for ease of understanding the configuration. There are other places where TLS crops up too, such as RADSEC and LDAP. The RADSEC one specifically says it's the same config as EAP-TLS (but at least it doesn't *use* EAP-TLS's config!) We wondered whether something like the following would be feasable, or worth trying to implement? In the main top-level config in radiusd.conf, have a new 'tls' section, that might look something like this: tls { outer-peap { certificate_file = ${certdir}/server.pem ... } inner-eap { private_key_file = ${certdir}/server.pem certificate_file = ${certdir}/server.pem CA_file = ${cadir}/ca.pem ... } outer-tls { ... } radsec { ... } ldap { ... } } where the sub-headings are just labels - instantiations of the 'tls' config. Then wherever a TLS configuration is required, we can have just "tls = outer-peap". For example, modules: eap { tls { tls = outer-tls fragment_size = 1200 ... } peap { tls = outer-peap default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" ... } } eap inner-eap { tls { tls = inner-tls cache { ... } fragment_size = 1024 verify { ... } } } This then makes it quite clear which TLS config belongs to which section, and allows sharing of TLS configs if really desired. The only potential problem I can see is if the TLS on EAP comes up first, before the EAP type is determined, but having looked at the protocol I don't believe that is the case - so the server should always know that it's the PEAP tls= config that is being used, as the EAP type was code 25, for example. I think we were thinking "hang on a sec, TLS is a generic server thing, nothing really to specifically do with EAP-TLS or PEAP, etc, so why is the config just in EAP-TLS - that's confusing". As a start, I guess the modules could keep their current TLS settings, but have an additional tls= option that would pull global config in at instantiation time. I'm not sure it needs to be any more difficult than that - except maybe in the PEAP/TTLS sections which don't have their own settings already. Are there any thoughts on this - is it worth persuing? I'm not sure if I'll have time to work on it or not, but thought it was worth throwing the idea out anyway. :) Thanks, Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Architect (UNIX and Networks), Network Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk>

2 11