May 2012 - Freeradius-Devel - lists.freeradius.org

rlm_sql_ocioracle driver v. 0.1
by Ge＠＠ru 14 Mar '15

14 Mar '15

Hi, in attachment patch to add rlm_sql_ocioracle driver to freeradius 2.1.x tree (it seems work yet on 3.x tree). This drivers permit to use function/procedure with CURSOR (through :Ret_Cursor string) like for example: group_membership_query = "begin :Ret_Cursor := \ pkRadius.group_membership_query('%{SQL-User-Name}'); end;" TODO for next release: - add support to oracle connection pool instead of open a new connection for every socket on startup; - enhancement on handle error (through error callback) on do query; - add documentation. Module need oracle instantclient library and ocilib library (http://orclib.sourceforge.net/) Good luck to rlm_sql_ocioracle driver!! Geaaru

2 5

Complete authorize & accounting redis module
by Manuel Guesdon 31 Oct '12

31 Oct '12

Hi, I've adapted rlm_sql to REDIS (http://redis.io/) key-store database. It handle authorize, accounting, checksimul and post-auth (only authorize is deeply tested). Authorize works like rlm_sql with groups, etc... Files are here: http://free.oxymium.net/freeradius/rlm_redisn/ Available as .tgz here: http://free.oxymium.net/freeradius/rlm_redisn-20111112-001.tgz Manuel -- ______________________________________________________________________ Manuel Guesdon - OXYMIUM

4 11

New build system
by Alan DeKok 21 Sep '12

21 Sep '12

OK, I've fixed a bug with dependencies, where it wouldn't re-build a C file if a header changed. I've also added some "configure" support. So modules like rlm_pam, python, perl, etc. only get built if their prerequisites are found. One benefit is that "make -j 8" now works. On my quad-core system I get this: $ time make -j 8 clean all ... real 0m4.357s user 0m24.702s sys 0m3.580s A complete build in less than 5 seconds. Very nice! Alan DeKok.

4 6

interesting issue with dictionary file in FR 3.x GIT
by alan buxey 30 May '12

30 May '12

hi, we have an interesting issue with dictionaries in 3.x with 2.x we have the following in /etc/raddb/dictionary ...and can see the following in detail logs VENDOR Cisco-ASA55x0 3076 BEGIN-VENDOR Cisco-ASA55x0 ATTRIBUTE Cisco-ASA55x0-Banner1 15 string ATTRIBUTE Cisco-ASA55x0-Class 25 string ATTRIBUTE Cisco-ASA55x0-Bookmark 71 string ATTRIBUTE Cisco-ASA55x0-Member-Of 145 string ATTRIBUTE Cisco-ASA55x0-IPv6-Pool 218 string ATTRIBUTE Cisco-ASA55x0-URL-1 223 string END-VENDOR Cisco-ASA55x0 Cisco-ASA55x0-Attr-146 = 0x44666661756c4457454356504e47726f7570 Cisco-ASA55x0-Attr-150 = 0x00000002 on 3.x we have the same dictionary file...but the detail logs show this: Attr-26.3076.146 = 0x44666661756c4457454356504e47726f7570 Attr-26.3076.150 = 0x00000002 ...so the dictionary file parsing is wrong/absent alan

3 4

Re: PEAP/MSCHAP doesn't run post-auth in inner-tunnel for reject?
by Phil Mayers 20 May '12

20 May '12

On 05/18/2012 10:23 PM, Alan DeKok wrote: > Phil Mayers wrote: >> Am I being dumb / getting something wrong or does the post-auth session >> not get called if PEAP/MSCHAP returns a reject? >> >> It seems to run for successful auths, but not failures. > > That is the case. > >> This is in the context of us not seeing log messages for EAP auth >> failures; I suspect that the client may just "hang up" and let the EAP >> session expire, and since the inner post-auth doesn't run, and the outer >> session expires, I have no logs. > > There was talk about getting it to do Post-Auth-Type Reject in the > inner tunnel. No code yet, tho. Ok, so after a bit (well, a lot) of digging, the cause seems to be that "Post-Auth-Type REJECT" is actually implemented in event.c:request_post_handler as opposed to auth.c:rad_authenticate - the latter handles successful post-auth, but the former rejects. The post handler doesn't seem to be called for the PEAP (and presumably TTLS) fake requests, but I gave up trying to track down which code path invokes request_post_handler - the socket or thread code? The comments in rad_authenticate initially suggested this is probably not the intention: /* * Result should be >= 0 here - if not, it means the user * is rejected, so we just process post-auth and return. */ if (result < 0) { return RLM_MODULE_REJECT; } ...and of course the code doesn't process post-auth, it just returns. But it looks like this changed here, so in fact it's just an out-of-date comment: https://github.com/alandekok/freeradius-server/commit/1b26bbb7576fabed84c47… What's the appropriate way to fix this? Presumably, if "rad_authenticate" doesn't call post-auth for reject, then ANY caller of rad_authenticate must take responsibility for doing so, but also somehow ensure that request_post_handler doesn't call it a 2nd time?

1 1

Compilation issues on freeradius-server v2.1.x for rlm_eap2
by JustinP 19 May '12

19 May '12

I am trying to configure EAP-FAST on freeradius-server v2.1.x Once I download the source. There is no issue if I do:- ./configure make make install But I get compilation issue on rlm_eap2 if I follow the below steps:- ./configure --with-experimental-modules --with-rlm_eap2 make Its giving error for not able to include header files. For some reason the include paths specified in CFLAGS and RLM_CFLAGS are not getting picked up. I am using 32 bit Ubuntu lucid Release 10.04 running on Intel Pentium 4. Is anybody else seeing this issue? Any help on this will be appreciated. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Compilation-issues-on-freeradius-se… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

3 8

radclient and Message-Authenticator validation
by Jouni Malinen 07 May '12

07 May '12

It looks like the Message-Authenticator validation done by radclient for Disconnect-ACK/NAK and CoA-ACK/NAK messages does not match with the mechanism described in RFC 5176. Message-Authenticator is generated correctly for Disconnect-Request and CoA-Request, but I needed to modify rad_verify() to get this matching with the code I'm writing for hostapd. RFC 5176, 3.4: When a Message-Authenticator Attribute is included within a CoA- ACK, CoA-NAK, Disconnect-ACK, or Disconnect-NAK, it is calculated as follows: Message-Authenticator = HMAC-MD5 (Type, Identifier, Length, Request Authenticator, Attributes) When the HMAC-MD5 message integrity check is calculated, the Message-Authenticator Attribute MUST be considered to be sixteen octets of zero. The Request Authenticator is taken from the corresponding CoA/Disconnect-Request. The Message-Authenticator is calculated and inserted in the packet before the Response Authenticator is calculated. It is that "The Request Authenticator is taken from the corresponding CoA/Disconnect-Request" part that does not seem to be followed by the current rad_verify() implementation. It clears the Authenticator field to all zeros (which is the mechanism used for the Request message) instead of using the Authenticator field from the Request message when validating the ACK/NAK message. Is this a workaround for some deployed NAS implementations or can this be fixed to match with RFC 5176? The following change was enough to make this interoperate with my hostapd implementation. diff --git a/src/lib/radius.c b/src/lib/radius.c index 7025573..dec3849 100644 --- a/src/lib/radius.c +++ b/src/lib/radius.c @@ -2619,11 +2619,7 @@ int rad_verify(RADIUS_PACKET *packet, RADIUS_PACKET *original, case PW_ACCOUNTING_REQUEST: case PW_DISCONNECT_REQUEST: - case PW_DISCONNECT_ACK: - case PW_DISCONNECT_NAK: case PW_COA_REQUEST: - case PW_COA_ACK: - case PW_COA_NAK: memset(packet->data + 4, 0, AUTH_VECTOR_LEN); break; @@ -2631,6 +2627,10 @@ int rad_verify(RADIUS_PACKET *packet, RADIUS_PACKET *original, case PW_AUTHENTICATION_ACK: case PW_AUTHENTICATION_REJECT: case PW_ACCESS_CHALLENGE: + case PW_DISCONNECT_ACK: + case PW_DISCONNECT_NAK: + case PW_COA_ACK: + case PW_COA_NAK: if (!original) { fr_strerror_printf("ERROR: Cannot validate Message-Authenticator in response packet without a request packet."); return -1; -- Jouni Malinen PGP id EFC895FA

3 2

slow recovery from SIGHUP
by Bruce Bauman 07 May '12

07 May '12

We are running freeradius 2.1.10 in a moderately busy environment. We send our server a SIGHUP daily to rotate our logfiles. The server seems to sometimes take > 15 minutes to recover from the SIGHUP and start responding to requests again. Our monitoring software then generates alerts because it thinks the server is dead. I quickly perused the code and nothing obvious jumped out at me. Any suggestions as to how to "fix" this? Thanks. -- Bruce

3 2

FR Developer for hire: Adding Accounting support to the rlm_ldap module?
by Peter Lambrechtsen 04 May '12

04 May '12

Hello I was wanting to know if someone would be interested in being paid to add "accounting" support into the RLM_LDAP module. For this I am wanting when calling the ldap module during the "accounting" section so it can update/delete records in the LDAP directory based on the Acct-Status-Type and using a new field type into the ldap.attrmap. Ideally I would be looking for when you get an accounting Start it adds or updates an attribute, for an Interim-Update also add/update and for a Stop then removes the attribute. In the ldap.attrmap the following ItemType should be extended to support both accounting start / interim update and stop verbs over and above the current checkItem/replyItem. checkItem NAS-IP-Address radiusNASIpAddress replyItem Framed-IP-Address radiusIpAddress acctStartItem NAS-Port-Id radiusNASPortId acctIntUpdItem NAS-Port-Id radiusNASPortId acctStopItem NAS-Port-Id radiusNASPortId This would mean that when an accounting start packet came through the same LDAP Filter lookup used for the authenticate & authorize would be done for the customer record and query for the acctStartItem attributes if the accounting request had the matching VSA then the LDAP Module would do a LDAP replace attribute or if the attribute didn't exist do a ldap add attribute. The same applies for an Interim-Update and subsequently for a stop packet remove the attribute from the directory if it exists. The wrinkle with LDAP is you can't always do a LDAP add, you need to use replace if the attribute exists. I've written this in Perl and it works reasonably well but it would be ideal to have this working inside ldap as then the custom perl code I wrote wouldn't be needed. Below is the perl i've written. my $ldap = Net::LDAP->new ( "127.0.0.1" ) or die "$@"; my $mesg = $ldap->bind ( "cn=admin,o=admin", password => "password", version => 3 ); my $attrs = [ 'radiusNASPortId' ]; my $result = $ldap->search ( base => "o=Identities", scope => "sub", filter => "(radiusRemoteID=$RAD_REQUEST{'ADSL-Agent-Remote-Id'})", attrs => $attrs ); my $attrcount = $result->count; if ($result->count > 0) { my @entries = $result->entries; my $userdn = @entries[0]->dn; my $sessionfound = @entries[0]->exists('radiusNASPortId'); if ( $RAD_REQUEST{'Acct-Status-Type'} =~ "Start" ) { if ( @entries[0]->exists('radiusNASPortId') ) { my $newresult = $ldap->modify($userdn , replace => { 'radiusNASPortId' => "$RAD_REQUEST{'NAS-Port-Id'}" } ); } else { my $newresult = $ldap->modify($userdn , add => { 'radiusNASPortId' => "$RAD_REQUEST{'NAS-Port-Id'}" } ); } } if ( $RAD_REQUEST{'Acct-Status-Type'} =~ "Stop" ) { if ( @entries[0]->exists('radiusNASPortId') ) { my $newresult = $ldap->modify($userdn , delete => { 'radiusNASPortId' => [] } ); } } } To get someone who is familiar with the freeradius code base and can write code which would be acceptable to be committed back into the mainline FR codebase as this should be code contributed back to the community. How much development effort would be required (x days?) and who would be interested in being paid (and how much) to do the work? Feel free to email me directly off list if you're interested. Cheers Peter

7 8

Re: LDAP module
by Alan Buxey 04 May '12

04 May '12

I'd contact the Novell guys I seem to recall who wrote/submitted that code asking for thev required work to be done...discussion on this list is fine but contributers may not be reading it.... alan

3 2