September 2012 - Freeradius-Devel - lists.freeradius.org

Commit report for v2.1.x branch
by announce＠freeradius.org 28 Sep '12

28 Sep '12

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Prepare for 2.2.1 Alan T. DeKok@2012-09-28T10:37:51Z Files modified: * VERSION * doc/ChangeLog Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/ab03534ed7df7fa2b05f… ====== Add options for -4 and -6 IP families, like radclient. Patch from John Dennis Alan T. DeKok@2012-09-28T10:31:03Z Files modified: * man/man1/radeapclient.1 * src/modules/rlm_eap/radeapclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/d6eabce01b5b9cc111d0… ====== rse PPPHint better Alan T. DeKok@2012-09-28T10:31:03Z Files modified: * src/main/radtest.in Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/abfdbd0d68a09fe43228… ====== debug: should output previous level instead of the level that was just set. Don't set debug to 0 if no fmt string was passed, do nothing. Arran Cudbard-Bell@2012-09-27T20:09:32Z Files modified: * src/main/xlat.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/4f1bf7e015839d89a7ac… ====== -- This commit summary was generated @2012-09-28T18:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

auth.c and rlm_pap tidying patches
by Matthew Newton 28 Sep '12

28 Sep '12

Hi, Been hacking on (mainly) rad_check_password in auth.c. It's got sections marked as FIXME, and lots of it is duplicated in rlm_pap and rlm_chap. There are a series of patches here: https://github.com/mcnewton/freeradius-server/commits/auth_tidy In order, they are: 5843221b3 - remove the large chunk of code that finds Crypt-Password, or User-Password or Cleartext-Password, sets Auth-Type to 'Crypt' or 'Local', and checks auth for these. It's completely duplicated in rlm_pap and rlm_chap, so unnecessary here. Still throws up warnings telling the user to fix their config to use pap or chap if Auth-Type has not been set (but Cleartext-Password or User-Password are set) before failing auth. e12867d57 - no longer copy User-Password to Cleartext-Password if the admin configured it wrong. a) it's unnecessary because the login checks here have been removed, and b) rlm_pap will use both anyway, so no need to copy. Still throws up the big !!! warning !!! about using Cleartext-Password instead. 0cb1cb3cd - move the !!! warning !!! about User-Password from auth.c into rlm_pap.c, which is where it is checked. There's no reason for it to clutter up rad_check_password any more really. c5350ba22 - tidy up comments in rad_check_password fdd53ce23 - updates to rlm_pap.c - the (undocumented) encryption_scheme option was completely broken, so change 'scheme' to 'inst->sch' to fix that, and update it so that any forced encryption type with this option must compare with Cleartext-Password, not User-Password. Warn and fail if this is not the case. The next step would be either to document the PAP encryption_scheme option correctly, or to remove it entirely - I'm not sure of its history, whether it has ever worked, and if it is wanted or not. It seems a potentially useful option, but maybe {type} has superseeded it. If it is removed, the rlm_pap.c could potentially be tidied up quite a lot. Cheers, Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Architect (UNIX and Networks), Network Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk>

2 2

[patch] radtest PPPhint option is not parsed properly
by John Dennis 28 Sep '12

28 Sep '12

Attached is a patch that fixes a problem with radtest. This is the original bug report: https://bugzilla.redhat.com/show_bug.cgi?id=760193 John -- John Dennis <jdennis(a)redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/

3 4

[patch] add ip address family support to radeapclient
by John Dennis 28 Sep '12

28 Sep '12

Attached is a patch that adds support for the -4 and -6 ip address family selection command line arguments that many of the other commands accept. The original bug report that triggered the creation of this patch is: https://bugzilla.redhat.com/show_bug.cgi?id=712803 John -- John Dennis <jdennis(a)redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/

2 1

Minor changes to github
by Alan DeKok 27 Sep '12

27 Sep '12

Github now allows Open Source organizations. So to keep things a little more general, I've created a "FreeRADIUS" organization. This means that the code repository is now owned by FreeRADIUS, not by me. My old repo exists, so that people can still reach it. But it's marked as "DON"T USE THIS" The new repo has all of the issues && pull requests moved over. It's now at: https://github.com/FreeRADIUS/freeradius-server/ Let us know if any links need to be updated. We now have: Master repo: https://github.com/FreeRADIUS/freeradius-server/ Local mirror: git://git.freeradius.org/freeradius-server.git My personal hacks: https://github.com/alandekok/freeradius-server/ Anyone forking my repo on github should automatically track the new FreeRADIUS one. Anyone cloning my repo externally should do: $ git remote set-url origin https://github.com/FreeRADIUS/freeradius-server/ Thanks. Alan DeKok.

2 1

Commit report for master branch
by announce＠freeradius.org 27 Sep '12

27 Sep '12

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Update share/dictionary.bskyb Arran Cudbard-Bell@2012-09-27T14:58:30Z Files modified: * share/dictionary.bskyb Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/ac5373f0a8c6afdcdafa… ====== Latest updates Arran Cudbard-Bell@2012-09-27T14:57:52Z Files modified: * share/dictionary.bskyb Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/1a5e30a32319ea4e48c7… ====== Document cache parameters in listen + tls, too Alan T. DeKok@2012-09-27T13:46:40Z Files modified: * raddb/sites-available/tls Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/50771a98b665d87e8d95… ====== Merge pull request #93 from mcnewton/rad_virtual_server Update post-auth handling in rad_authenticate etc Alan DeKok@2012-09-27T12:07:56Z Files modified: * src/include/radiusd.h * src/main/auth.c * src/main/process.c * src/modules/rlm_eap/types/rlm_eap_peap/peap.c * src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c * src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c * configure.in * raddb/mods-available/eap * src/include/tls.h * src/main/tls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/3ae34205e42965ce7928… ====== rlm_eap virtual servers now call postauth for both accept and reject Matthew Newton@2012-09-26T00:24:10Z Files modified: * src/modules/rlm_eap/types/rlm_eap_peap/peap.c * src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c * src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/c625bf1734f708bd9d75… ====== Add rad_virtual_server to call rad_authenticate and rad_postauth Matthew Newton@2012-09-26T00:04:04Z Files modified: * src/include/radiusd.h * src/main/auth.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/00cadac7c473ee25fe95… ====== Move rad_postauth ACCEPT from rad_authenticate to request_finish Matthew Newton@2012-09-25T23:42:26Z Files modified: * src/main/auth.c * src/main/process.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/5f03313da5ac4af88b9f… ====== Merge pull request #92 from philmayers/sess-persist add the ability to persist SSL session cache to disk across server restarts Alan DeKok@2012-09-27T12:07:27Z Files modified: * configure.in * raddb/mods-available/eap * src/include/tls.h * src/main/tls.c * configure * configure.in * raddb/mods-available/expr * scripts/jlibtool.c * scripts/libtool.mk * share/dictionary.alcatel.sr * src/include/autoconf.h.in * src/lib/Makefile * src/main/radiusd.c * src/main/version.c * src/modules/rlm_eap/libeap/Makefile * src/modules/rlm_expr/rlm_expr.c * src/modules/rules.mak Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/6bd1be05f09a3a816d6c… ====== add the ability to persist SSL session cache to disk across server restarts Phil Mayers@2012-09-21T14:45:22Z Files modified: * configure.in * raddb/mods-available/eap * src/include/tls.h * src/main/tls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/d5e02c4ae3e6624cc20a… ====== -- This commit summary was generated @2012-09-27T18:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v2.1.x branch
by announce＠freeradius.org 27 Sep '12

27 Sep '12

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Update share/dictionary.bskyb Arran Cudbard-Bell@2012-09-27T17:25:00Z Files modified: * share/dictionary.bskyb Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/145b617eb02b3fe1b3b3… ====== Latest updates Arran Cudbard-Bell@2012-09-27T17:24:46Z Files modified: * share/dictionary.bskyb Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/175feb18d074c630755f… ====== -- This commit summary was generated @2012-09-27T18:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Re: Reporting from logs
by Phil Mayers 27 Sep '12

27 Sep '12

On 25/09/12 17:25, Matthew Newton wrote: > I've been looking at the code recently to also see if the > Post-Auth REJECT in inner-tunnel can be fixed. I can see an easy > and fairly obvious of doing it, but the right way seems to involve > the core event system, where I don't really want to go. That would > fix up the one thing that is missing from our logs (outer reject > doesn't log inner username, so it's hard to find these). I could > then stop relaying outer auths to the central log entirely, as > they're generally uninteresting. [moving to -devel] Ah I remember this. It's because rad_authenticate calls rad_postauth if authentication succeeds, but relies on request_finish to call rad_postauth in the case of failure. I did think about this myself; one option is to call rad_postauth manually if rad_authenticate(fake) fails in peap.c - which I guess is the easy/obvious solution you're referring to? Certainly preferable to the current situation IMO. The "Post-Auth-Type REJECT" stuff did originally live in rad_authenticate - it was removed in commit 47a090897a. Not sure what the rationale was - something to do with reject_delay? - so I was unwilling to fiddle. Alan, can you comment?

3 9

Commit report for master branch
by announce＠freeradius.org 26 Sep '12

26 Sep '12

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Remove duplicate version/copyright info Print compilation flags at DEBUG >= 3 (this is actually useful if you're using a package version) Arran Cudbard-Bell@2012-09-25T22:07:03Z Files modified: * src/main/radiusd.c * src/main/version.c Commit diff: https://github.com/alandekok/freeradius-server/commit/26c8b9b0e76b086207b8e… ====== Pass rpath when installing libeap Arran Cudbard-Bell@2012-09-25T17:30:53Z Files modified: * src/modules/rlm_eap/libeap/Makefile Commit diff: https://github.com/alandekok/freeradius-server/commit/6d48f6d1260d86d5dd07f… ====== -- This commit summary was generated @2012-09-26T18:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v2.1.x branch
by announce＠freeradius.org 26 Sep '12

26 Sep '12

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Remove duplicate version/copyright info Print compilation flags at DEBUG >= 3 (this is actually useful if you're using a package version) Arran Cudbard-Bell@2012-09-25T21:59:57Z Files modified: * src/main/radiusd.c * src/main/version.c Commit diff: https://github.com/alandekok/freeradius-server/commit/884b9f0f688014ba19b8f… ====== -- This commit summary was generated @2012-09-26T18:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0