August 2012 - Freeradius-Devel - lists.freeradius.org

First steps in 3.0
by Stefan Winter 14 Aug '12

14 Aug '12

Hi, I've been poking 3.0 master (GIT from yesterday) with a stick. Despite some things that make "make install" fail, there's at least one thing preventing me from running it in build/ even. "BOILER=yes make" omits the rlm_sql_mysql driver for some reason. The libs and headers are there, and configure looks good: === configuring in ./drivers/rlm_sql_mysql (/root/freeradius-master/src/modules/rlm_sql/./drivers/rlm_sql_mysql) configure: running /bin/sh ./configure '--prefix=/usr/local/freeradius/3.0-20120813' '--sysconfdir=/usr/local/freeradius/config/' '--enable-ltdl-install' --cache-file=/dev/null --srcdir=. checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking for mysql_config... yes checking for pthread_create in -lpthread... yes checking for mysql_init in -lmysqlclient_r (using mysql_config)... yes checking for mysql.h (using mysql_config --cflags)... yes configure: creating ./config.status config.status: creating Makefile config.status: creating config.h === configuring in ... But then the build only picks up the rlm_sql_null driver: LINK build/lib/rlm_sometimess.la CC src/modules/rlm_sql/drivers/rlm_sql_null/sql_null.c In file included from /root/freeradius-master/src/modules/rlm_sql/rlm_sql.h:15, from src/modules/rlm_sql/drivers/rlm_sql_null/sql_null.c:28: /root/freeradius-master/src/freeradius-devel/modpriv.h:15:1: warning: "WITHOUT_LIBLTDL" redefined <command-line>: warning: this is the location of the previous definition src/modules/rlm_sql/drivers/rlm_sql_null/sql_null.c: In function ‘sql_init_socket’: src/modules/rlm_sql/drivers/rlm_sql_null/sql_null.c:45: warning: assignment discards qualifiers from pointer target type LINK build/lib/rlm_sql_null.la CC src/modules/rlm_sql/rlm_sql.c In file included from src/modules/rlm_sql/rlm_sql.h:15, from src/modules/rlm_sql/rlm_sql.c:40: /root/freeradius-master/src/freeradius-devel/modpriv.h:15:1: warning: "WITHOUT_LIBLTDL" redefined <command-line>: warning: this is the location of the previous definition CC src/modules/rlm_sql/sql.c In file included from src/modules/rlm_sql/rlm_sql.h:15, from src/modules/rlm_sql/sql.c:37: /root/freeradius-master/src/freeradius-devel/modpriv.h:15:1: warning: "WITHOUT_LIBLTDL" redefined <command-line>: warning: this is the location of the previous definition LINK build/lib/rlm_sql.la CC src/modules/rlm_sql_log/rlm_sql_log.c LINK build/lib/rlm_sql_log.la CC src/modules/rlm_sqlcounter/rlm_sqlcounter.c LINK build/lib/rlm_sqlcounter.la CC src/modules/rlm_sqlippool/rlm_sqlippool.c In file included from src/modules/rlm_sql/rlm_sql.h:15, from src/modules/rlm_sqlippool/rlm_sqlippool.c:32: /root/freeradius-master/src/freeradius-devel/modpriv.h:15:1: warning: "WITHOUT_LIBLTDL" redefined <command-line>: warning: this is the location of the previous definition LINK build/lib/rlm_sqlippool.la CC src/modules/rlm_unix/rlm_unix.c So I tried to call make directly in the driver subdir to see where I end up, and got a source error: rlm_sql_mysql # BOILER=yes make CC sql_mysql.c@ sql_mysql.c: In function ‘sql_query’: sql_mysql.c:189: error: ‘SQL_CONFIG’ has no member named ‘sqltrace’ make: *** [sql_mysql.lo] Error 1 I then deleted the offending lines 189+190 from sql_mysql.c, which made make fail a bit later; but still no joy. I'm on GNU make 3.81 which I understand is the very bare minimum, but should do. Any hints? Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

3 10

rlm_sql_log: failure on Accounting-On / Off
by Stefan Winter 13 Aug '12

13 Aug '12

Hi, I'm still not happy with rlm_sql_log, and this time I'm reasonably sure it's not just me being dumb. I've recently received two Accounting-Offs, and got this in the logs: Mon Aug 13 13:53:18 2012 : Error: [sql-relay-acct-eduroam] Couldn't add SQL-User-Name attribute Mon Aug 13 13:53:18 2012 : Error: [sql-relay-acct-eduroam] Couldn't add SQL-User-Name attribute Well, sure. Accounting On/Off do not usually have a User-Name attribute in them as they are global status messages for the NAS. Looking at the code, this has more than effects than a misleading log message: if (sql_set_user(inst, request, sqlusername, NULL) <0) { radlog_request(L_ERR, 0, request, "Couldn't add SQL-User-Name attribute"); return RLM_MODULE_FAIL; } The module immediately returns FAIL, and will thus not construct nor save the SQL message (even though the SQL statement itself doesn't contain SQL-User-Name at all). The information from the Accounting-On/Off is lost. That's not nice. Could this code be wrapped around by a test which determines the packet type, and is more gentle on Accounting-On/Off? Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

2 3

rlm_protobuf as alternative rlm_rest: Re: Backporting rlm_rest to 2.1.x
by Ruslan Shevchenko 12 Aug '12

12 Aug '12

btw, you can look on freeradius-protobif module, which have functionality very close to rlm_rest (generic bridge but for protobuf over http instead rest) and have supported branch for freeradius-2.1 (see https://github.com/rssh/rlm_protobuf/ - master is compatible with 3.0, freeradius-2.1.x - with 2.1.x) This work in production for my of one clients. On Sat, Aug 11, 2012 at 6:34 PM, Gavin Alves <gavin.alves(a)gmail.com> wrote: >> how do you designate 'mature' software? old software can and does have >> bugs too - >> well used software might be 'mature' in way of updates/patches but then >> you >> have no features. we need more people to be running 3.0 so that we can >> find >> any other issues and maybe see a sooner release or 3.0.1 etc >> >> I've only running 3.0 HEAD on my test systems now - no longer looking at >> 2.1.x or >> 2.2.x updates - and it wont be long before it'll be just 3.x on production >> systems >> too. > > > Point taken. The reality is that many organisations will not upgrade > software until there are packages maintained in their distro, By this point > a business can assume at least some minimum standard of 3rd party quality > assurance and peer review. A really strong case would be needed for a home > brew release (which I don't think I could make as 2.1 works very well for > us). > > As for getting people onto 3.0; a classic catch 22. Updating the website, > api docs, distributing binary packages and so on might help. I was not even > aware of it until yesterday. > > > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/devel.html

1 0

Backporting rlm_rest to 2.1.x
by Gavin Alves 11 Aug '12

11 Aug '12

Hi, Can someone kindly give me some hints for getting rlm_rest working with freeradius 2.1. As a web developer, this is goes beyond my limited understanding of C. The module compiles fine from the master branch (3.0) but I really need it working in 2.1. So far I have taken the following steps: 1) Checkout and build tag 2.1.12 (builds ok). 2) Copy rlm_rest into modules/ 3) Copy connections.h into /src 4) cd modules/rlm_rest/; ./configure; make; Now I get the error below which I can't make head nor tail of. Is 3.0 using different compiler options or something? If anyone can help get this working it would be greatly appreciated! rlm_rest]# make /root/freeradius-server/libtool --mode=compile gcc -g -O2 -Wall -D_GNU_SOURCE -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I/root/freeradius-server/src -I/root/freeradius-server/libltdl -c rlm_rest.c gcc -g -O2 -Wall -D_GNU_SOURCE -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I/root/freeradius-server/src -I/root/freeradius-server/libltdl -c rlm_rest.c -fPIC -DPIC -o .libs/rlm_rest.o rlm_rest.c:142: error: expected declaration specifiers or '...' before 'rlm_components_t' rlm_rest.c: In function 'parse_sub_section': rlm_rest.c:146: error: 'section_type_value' undeclared (first use in this function) rlm_rest.c:146: error: (Each undeclared identifier is reported only once rlm_rest.c:146: error: for each function it appears in.) rlm_rest.c:146: error: 'comp' undeclared (first use in this function) rlm_rest.c: In function 'rlm_rest_instantiate': rlm_rest.c:248: error: too many arguments to function 'parse_sub_section' rlm_rest.c:250: error: too many arguments to function 'parse_sub_section' rlm_rest.c:252: error: too many arguments to function 'parse_sub_section' rlm_rest.c:254: error: too many arguments to function 'parse_sub_section' rlm_rest.c:256: error: too many arguments to function 'parse_sub_section' make: *** [rlm_rest.lo] Error 1

4 8

radius + ppoe user and clients.conf
by karthik kumar 03 Aug '12

03 Aug '12

> > > > > > > > Hi Fajar, > > First of all thanks for fast reply . I have used following config changes > in users and clients.conf , do ppoe session requires any special changes. > Please suggest me inline questions. > > > http://www.iana.org/assignments/radius-types/radius-types.xml#radius-types-3 > > Attribute value 61 ---> Nas-port-type > > 32 PPPoEoE - PPP over Ethernet over Ethernet > Should this be configured for users.conf or client.conf file ? > > > > > > [root@PC4-Abhi raddb]# more users > cisco Auth-Type := Local, User-Password = "cisco" > cisco-avpair = "shell:Admin=Admin default-domain karthik > karthik1" > > DEFAULT Framed-Protocol == PPP > Framed-Protocol = PPP, > Framed-Compression = Van-Jacobson-TCP-IP > > > > > > [root@PC4-Abhi raddb]# more clients.conf .. > > > client 78.0.0.0/16 { > secret = cisco > shortname = cisco > nastype = cisco >>>>>>>>>>>>>>>>>> > should it be other ? do we have to configure NAS-ip and attribute value and > type ? > } > > > > > Thanks, > K. Karthik Kumar > > > > > > > > > > > On Wed, Aug 1, 2012 at 3:30 PM, < > freeradius-devel-request(a)lists.freeradius.org> wrote: > >> Send Freeradius-Devel mailing list submissions to >> freeradius-devel(a)lists.freeradius.org >> >> To subscribe or unsubscribe via the World Wide Web, visit >> http://lists.freeradius.org/mailman/listinfo/freeradius-devel >> or, via email, send a message with subject or body 'help' to >> freeradius-devel-request(a)lists.freeradius.org >> >> You can reach the person managing the list at >> freeradius-devel-owner(a)lists.freeradius.org >> >> When replying, please edit your Subject line so it is more specific >> than "Re: Contents of Freeradius-Devel digest..." >> >> >> Today's Topics: >> >> 1. BNG(BRAS) + free radius (karthik kumar) >> 2. Re: BNG(BRAS) + free radius (Fajar A. Nugraha) >> >> >> ---------------------------------------------------------------------- >> >> Message: 1 >> Date: Wed, 1 Aug 2012 13:04:57 +0530 >> From: karthik kumar <mail2karthek(a)gmail.com> >> To: freeradius-devel(a)lists.freeradius.org >> Subject: BNG(BRAS) + free radius >> Message-ID: >> < >> CANHveityOa4QmOe2EX6K4CsX8zdATxPqEBUD-muaFbRb3PCLLw(a)mail.gmail.com> >> Content-Type: text/plain; charset="utf-8" >> >> Hi Team, >> >> >> >> I have used free radius for authentication purpose but I never tried for >> BNG. >> >> >> >> >> >> MY requirement is as follows: >> >> >> >> >> >> >> >> PPOE client (router) -----------------------? PPOE >> server(router) -------------? Free >> radius >> >> >> >> >> >> >> When many internet users try to connect to isp router the free radius >> connected to the ppoe server should authenticate all the users in the >> client. What are the configuration changes need to be applied in the free >> radius. >> >> >> >> >> >> >> >> >> >> https://supportforums.cisco.com/docs/DOC-19726 >>>>>>>>>>>>. >> Configuration explaination >> >> >> >> >> >> Thanks, >> >> K. Karthik Kumar >>

1 0

Inconsistent behaviour with duplicate dictionary entries
by Brian Candler 02 Aug '12

02 Aug '12

(freeradius 2.1.12) I have noticed an inconsistency when there are duplicate dictionary entries for the same attribute, in particular this one from dictionary.redback: ATTRIBUTE Qos-Policy-Metering 88 string ATTRIBUTE Qos-Metering-Profile-Name 88 string When radtest/radclient is decoding response packets it uses the second entry (this makes sense, it's the last entry read which takes precedence). However the debug output from freeradius -X displays the first entry instead. Example: $ echo -e 'User-Name = "foo(a)example.com"\nCalling-Station-Id="12345678"\nNAS-IP-Address=255.255.255.244\n' | radclient localhost auth testing123 Received response ID 166, code 2, length = 68 Qos-Metering-Profile-Name = "24M_P" Double-Authentication = 1 but freeradius -X shows: ... Sending Access-Accept of id 67 to 127.0.0.1 port 42234 Qos-Policy-Metering := "24M_P" Double-Authentication := 1 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 67 with timestamp +2 This is only significant because I have a GUI wrapper with a radtest function which displays the debug output. This uses the control socket to inject the packet, so I get slightly different output from freeradius -X, but it also shows the first dictionary entry: ... Injected Access-Accept packet to host 127.0.0.1 port 0 code=2, id=3 Qos-Policy-Metering := "24M_P" Double-Authentication := 1 Finished request 3. Going to the next request Thread 44 waiting to be assigned a request Anyway, this suggests to me that there may be two different code paths for looking up attribute numbers to names; maybe they could be unified? Regards, Brian.

2 2

Re: Freeradius-Devel Digest, Vol 88, Issue 1
by karthik kumar 01 Aug '12

01 Aug '12

Hi Fajar, First of all thanks for fast reply . I have used following config changes in users and clients.conf , do ppoe session requires any special changes. Please suggest me inline questions. http://www.iana.org/assignments/radius-types/radius-types.xml#radius-types-3 Attribute value 61 ---> Nas-port-type 32PPPoEoE - PPP over Ethernet over Ethernet Should this be configured for users.conf or client.conf file ? [root@PC4-Abhi raddb]# more users cisco Auth-Type := Local, User-Password = "cisco" cisco-avpair = "shell:Admin=Admin default-domain karthik karthik1" DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP [root@PC4-Abhi raddb]# more clients.conf .. client 78.0.0.0/16 { secret = cisco shortname = cisco nastype = cisco >>>>>>>>>>>>>>>>>> should it be other ? do we have to configure NAS-ip and attribute value and type ? } Thanks, K. Karthik Kumar On Wed, Aug 1, 2012 at 3:30 PM, < freeradius-devel-request(a)lists.freeradius.org> wrote: > Send Freeradius-Devel mailing list submissions to > freeradius-devel(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-devel > or, via email, send a message with subject or body 'help' to > freeradius-devel-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-devel-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Devel digest..." > > > Today's Topics: > > 1. BNG(BRAS) + free radius (karthik kumar) > 2. Re: BNG(BRAS) + free radius (Fajar A. Nugraha) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 1 Aug 2012 13:04:57 +0530 > From: karthik kumar <mail2karthek(a)gmail.com> > To: freeradius-devel(a)lists.freeradius.org > Subject: BNG(BRAS) + free radius > Message-ID: > < > CANHveityOa4QmOe2EX6K4CsX8zdATxPqEBUD-muaFbRb3PCLLw(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > Hi Team, > > > > I have used free radius for authentication purpose but I never tried for > BNG. > > > > > > MY requirement is as follows: > > > > > > > > PPOE client (router) -----------------------? PPOE > server(router) -------------? Free > radius > > > > > > > When many internet users try to connect to isp router the free radius > connected to the ppoe server should authenticate all the users in the > client. What are the configuration changes need to be applied in the free > radius. > > > > > > > > > > https://supportforums.cisco.com/docs/DOC-19726 >>>>>>>>>>>>. > Configuration explaination > > > > > > Thanks, > > K. Karthik Kumar >

1 0

BNG(BRAS) + free radius
by karthik kumar 01 Aug '12

01 Aug '12

Hi Team, I have used free radius for authentication purpose but I never tried for BNG. MY requirement is as follows: PPOE client (router) ----------------------- PPOE server(router) ------------- Free radius When many internet users try to connect to isp router the free radius connected to the ppoe server should authenticate all the users in the client. What are the configuration changes need to be applied in the free radius. https://supportforums.cisco.com/docs/DOC-19726 >>>>>>>>>>>>. Configuration explaination Thanks, K. Karthik Kumar

2 1