February 2013 - Freeradius-Devel - lists.freeradius.org

Commit report for v2.x.x branch
by announce＠freeradius.org 15 Feb '13

15 Feb '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== EAP-Key-Name is octets, not printable text Alan T. DeKok@2013-02-15T14:37:12Z Files modified: * share/dictionary.rfc4072 Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/c4f8267c56e25f2137fc… ====== Don't use radius_paircreate in a library Alan T. DeKok@2013-02-15T14:37:11Z Files modified: * src/modules/rlm_eap/libeap/eap_tls.c * src/modules/rlm_eap/libeap/eap_tls.h * src/modules/rlm_eap/libeap/mppe_keys.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/2667ed4ebdb70468ba4b… ====== Merge pull request #191 from candlerb/candlerb/redis_fixes_v2.x.x Bug fixes for rlm_redis v2.x.x Arran Cudbard-Bell@2013-02-15T06:25:12Z Files modified: * src/modules/rlm_rediswho/rlm_rediswho.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/9a720357d344b4f7c42c… ====== rlm_rediswho: fix trim functionality (query result is not available after redis_finish_query has been called) Brian Candler@2013-02-14T13:24:32Z Files modified: * src/modules/rlm_rediswho/rlm_rediswho.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/c7ce0b04f05259dc18ee… ====== rlm_rediswho: initialize rcode for Accounting-On and Accounting-Off requests Brian Candler@2013-02-14T13:24:06Z Files modified: * src/modules/rlm_rediswho/rlm_rediswho.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/91b7831d83ee71e18cb8… ====== -- This commit summary was generated @2013-02-16T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

exec examples
by Brian Candler 15 Feb '13

15 Feb '13

Minor issue: [raddb/modules/exec] exec { wait = no input_pairs = request shell_escape = yes output = none } However it looks like "output = none" is spurious since rlm_exec doesn't accept an "output" parameter. I think it should be "output_pairs = none" ? (Aside: if I set garbage like "zoutput = none" it's happy with that too) Regards, Brian.

2 2

Commit report for master branch
by announce＠freeradius.org 14 Feb '13

14 Feb '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Update autoconf json-c stuff Arran Cudbard-Bell@2013-02-14T20:30:59Z Files modified: * src/modules/rlm_rest/configure * src/modules/rlm_rest/configure.in Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/5b4e1e82c04620b034ef… ====== -- This commit summary was generated @2013-02-15T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v2.x.x branch
by announce＠freeradius.org 14 Feb '13

14 Feb '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Update the example to show EAP-Key-Name Alan T. DeKok@2013-02-14T17:56:34Z Files modified: * raddb/sites-available/default Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/74b4dbb13a53ea3935fe… ====== Added preliminary support for EAP-Key-Name We use EAP-Session-Id internally, as not everyone wants to send EAP-Key-Name in a packet. The eaptls_gen_eap_key() function generates the EAP-Session-Id. The eaptls_success() function calls the "gen key" function on success. This means that the key is available on all TLS-based EAP methods If someone wants to send EAP-Key-Name, they should use unlang to make EAP-Session-Id to EAP-Key-Name Alan T. DeKok@2013-02-14T17:53:11Z Files modified: * share/dictionary.freeradius.internal * src/include/radius.h * src/modules/rlm_eap/libeap/eap_tls.c * src/modules/rlm_eap/libeap/eap_tls.h * src/modules/rlm_eap/libeap/mppe_keys.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/36932d8d56c408ced51e… ====== -- This commit summary was generated @2013-02-15T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

segfault in current master
by Brian Candler 14 Feb '13

14 Feb '13

Just tried to build current master branch under OSX: ./configure -with-redis-include-dir=/usr/local/include/hiredis --enable-boilermake --prefix=/Users/brian/Build/freeradius-master && make && make install (Note: This is from a git checkout where I had switched branches, but I have done a "make distclean" first) Then I symlinked ../mods-available/redis and rediswho into mods-enabled/. That's the only config change I made. Started it with sbin/radiusd -X (as unpriviledged user), send a radclient packet like this: echo -e "User-Name = brian\nFramed-IP-Address = 1.2.3.4\nAcct-Status-Type = Start\n" | bin/radclient localhost acct testing123 and this is what happened: rad_recv: Accounting-Request packet from host 127.0.0.1 port 54630, id=248, length=39 User-Name = "brian" Framed-IP-Address = 1.2.3.4 Acct-Status-Type = Start (0) # Executing section preacct from file /Users/brian/Build/freeradius-master/etc/raddb/sites-enabled/default (0) group preacct { (0) - entering group preacct {...} (0) [preprocess] = ok (0) policy acct_unique { (0) - entering policy acct_unique {...} (0) ? if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) (0) expand: '%{string:Class}' -> '' Segmentation fault: 11 Oops. But annoyingly, running it again under gdb it was fine: gdb sbin/radiusd run -X ... rad_recv: Accounting-Request packet from host 127.0.0.1 port 62354, id=3, length=39 User-Name = "brian" Framed-IP-Address = 1.2.3.4 Acct-Status-Type = Start (0) # Executing section preacct from file /Users/brian/Build/freeradius-master/etc/raddb/sites-enabled/default (0) group preacct { (0) - entering group preacct {...} (0) [preprocess] = ok (0) policy acct_unique { (0) - entering policy acct_unique {...} (0) ? if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) (0) expand: '%{string:Class}' -> '' (0) ? Evaluating ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) -> FALSE (0) ? if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) -> FALSE (0) else else { (0) - entering else else {...} (0) update request { (0) expand: '%{User-Name}%{Acct-Session-ID}%{NAS-IP-Address}%{NAS-Identifier}%{NAS-Port-ID}%{NAS-Port}' -> 'brian127.0.0.1' (0) expand: '%{md5:%{User-Name}%{Acct-Session-ID}%{NAS-IP-Address}%{NAS-Identifier}%{NAS-Port-ID}%{NAS-Port}}' -> '434d399a6c4094ac3ee91533331275e8' (0) } # update request = ok (0) - else else returns ok (0) - policy acct_unique returns ok (0) suffix : No '@' in User-Name = "brian", looking up realm NULL (0) suffix : No such realm "NULL" (0) [suffix] = noop (0) [files] = noop (0) # Executing section accounting from file /Users/brian/Build/freeradius-master/etc/raddb/sites-enabled/default (0) group accounting { (0) - entering group accounting {...} (0) detail : expand: '%{Packet-Src-IP-Address}' -> '127.0.0.1' (0) detail : expand: '/Users/brian/Build/freeradius-master/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d' -> '/Users/brian/Build/freeradius-master/var/log/radius/radacct/127.0.0.1/detail-20130214' (0) detail : /Users/brian/Build/freeradius-master/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /Users/brian/Build/freeradius-master/var/log/radius/radacct/127.0.0.1/detail-20130214 (0) detail : expand: '%t' -> 'Thu Feb 14 14:58:07 2013' (0) [detail] = ok (0) [unix] = noop (0) [exec] = noop (0) attr_filter.accounting_response : expand: '%{User-Name}' -> 'brian' (0) attr_filter.accounting_response : Matched entry DEFAULT at line 12 (0) [attr_filter.accounting_response] = updated Sending Accounting-Response of id 3 from 0.0.0.0 port 1813 to 127.0.0.1 port 62354 (0) Finished request 0. Waking up in 0.3 seconds. (0) Cleaning up request packet ID 3 with timestamp +41 Ready to process requests. Running again without gdb, it still crashes. So next thing is to try to get a core dump: (configure: allow_core_dumps = yes in radiusd.conf) (check /cores directory is writeable) ulimit -c unlimited sbin/radiusd -X Crashes but no dump :-( Suspiciously, the message "Core dumps are enabled." does not appear on the console output. I'll keep poking around, but if someone knows why the core dumps aren't being created, that would save me some time. Cheers, Brian.

3 6

Took too long to generate dh parameters
by Brian Candler 14 Feb '13

14 Feb '13

(v2.x.x branch) Just a minor note when starting up after a fresh make install then sbin/radiusd -X Generating DH parameters, 1024 bit long safe prime, generator 2 This is going to take a long time ...................................+....................................................................................................................................................+.....................................................+............................+.................................................................................................+.................................................................................................................................................+.......................+.+................................................................................................................+..................................................+........+...........................................................................................................+................................................................................+.....................................................................................+............................................................................+............................................................................................................................+............................+.................................+.............................................................................................................................................................................+........+............................................+.......................+..................................................Child PID 24010 (/Users/brian/Build/freeradius/etc/raddb/certs/bootstrap) is taking too much time: forcing failure and killing child. rlm_eap: Failed to initialize type tls /Users/brian/Build/freeradius/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /Users/brian/Build/freeradius/etc/raddb/sites-enabled/default[310]: Failed to find "eap" in the "modules" section. /Users/brian/Build/freeradius/etc/raddb/sites-enabled/default[252]: Errors parsing authenticate section. Brians-MacBook-Air:freeradius $ ...........+..............+...............................................................+...........+.................................+........................................................................................+.....+....................................................................++*++*++* unable to write 'random state' This is on a Macbook Air i7: not a slovenly machine, but it looks like 10 seconds isn't enough. However on a second run of radiusd it starts OK.

2 1

rlm_redis in master
by Brian Candler 14 Feb '13

14 Feb '13

rlm_redis is broken in master: it segfaults unconditionally because of a consistent null pointer dereference. A fix for this, plus a bunch of other fixes (all lightly tested), at https://github.com/FreeRADIUS/freeradius-server/pull/190 Regards, Brian.

1 0

Commit report for master branch
by announce＠freeradius.org 13 Feb '13

13 Feb '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Just call the normal attr2vp function Alan T. DeKok@2013-02-13T20:24:35Z Files modified: * src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/15b4f1b4969245af0f57… ====== Added -x, like other programs Alan T. DeKok@2013-02-13T20:23:47Z Files modified: * src/main/radattr.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/2d0fd6038c272f3e644d… ====== Fix typo. Fail when NOT inserting attrs Alan T. DeKok@2013-02-13T20:17:02Z Files modified: * src/lib/dict.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/0a2d49a42372f0150c9f… ====== Quiet doxygen Arran Cudbard-Bell@2013-02-13T19:44:24Z Files modified: * src/modules/rlm_otp/otp_radstate.c * src/modules/rlm_otp/rlm_otp.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/22b3d29add56b18aa38d… ====== Use xlat for generating the OTP challenge reply-message Remove otp specific bin2hex hex2bin functions and use FR ones Fix formatting Fix warnings about signdedness of various strings. Insert Reply-Message attribute with T_OP_SET instead of T_OP_EQ Add basic code documentation for some functions Arran Cudbard-Bell@2013-02-13T19:37:31Z Files modified: * raddb/mods-available/otp * share/dictionary.freeradius.internal * src/include/libradius.h * src/include/radius.h * src/lib/misc.c * src/modules/rlm_otp/extern.h * src/modules/rlm_otp/otp.h * src/modules/rlm_otp/otp_pw_valid.c * src/modules/rlm_otp/otp_pwe.c * src/modules/rlm_otp/otp_radstate.c * src/modules/rlm_otp/otp_util.c * src/modules/rlm_otp/rlm_otp.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/397006810d88cf22f203… ====== Typo Arran Cudbard-Bell@2013-02-13T01:01:27Z Files modified: * src/lib/dict.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/db2fa1d7c4c4ce14e3b0… ====== Add CONST to functions that return DICT_ATTR Reformat documentation for some structs Change VALUE_PAIR type from int to PW_TYPE Arran Cudbard-Bell@2013-02-13T00:58:51Z Files modified: * src/include/libradius.h * src/lib/dhcp.c * src/lib/dict.c * src/lib/print.c * src/lib/radius.c * src/lib/valuepair.c * src/main/client.c * src/main/evaluate.c * src/main/modules.c * src/main/xlat.c * src/modules/rlm_attr_rewrite/rlm_attr_rewrite.c * src/modules/rlm_cache/rlm_cache.c * src/modules/rlm_checkval/rlm_checkval.c * src/modules/rlm_counter/rlm_counter.c * src/modules/rlm_detail/rlm_detail.c * src/modules/rlm_ldap/rlm_ldap.c * src/modules/rlm_otp/extern.h * src/modules/rlm_otp/otp_pwe.c * src/modules/rlm_passwd/rlm_passwd.c * src/modules/rlm_policy/parse.c * src/modules/rlm_preprocess/rlm_preprocess.c * src/modules/rlm_sometimes/rlm_sometimes.c * src/modules/rlm_sql/rlm_sql.c * src/modules/rlm_sqlcounter/rlm_sqlcounter.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/bc06a68ef97c654f54f6… ====== free_dict_attr should set pointer to NULL after freeing Arran Cudbard-Bell@2013-02-12T23:38:17Z Files modified: * src/include/libradius.h * src/lib/dict.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/ff1327631634e1e6390e… ====== -- This commit summary was generated @2013-02-14T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

cache_eap and policy
by A.L.M.Buxey＠lboro.ac.uk 12 Feb '13

12 Feb '13

hi, just lookign at latest GIT pull onto my config.... the server fails due to a call in policy.d/eap - cache_eap module. okay. cache_eap moduel in mods-available but not live. fixed. then I get /etc/raddb/policy.d/eap[37]: "cache" modules aren't allowed in 'authenticate' sections -- they have no such method. /etc/raddb/policy.d/eap[37]: Failed to parse "cache_eap" entry. /etc/raddb/policy.d/eap[36]: Failed to parse "if" subsection. the policy has: # Populate cache with responses from the EAP module # eap.authenticate { eap { handled = 1 } if (handled) { cache_eap handled } cache_eap } so, its calling this cache method in the authenticate section. meant to? I guess so. .... for now policy removed. alan

2 7

Commit report for v2.x.x branch
by announce＠freeradius.org 12 Feb '13

12 Feb '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Note recent changes Alan T. DeKok@2013-02-12T16:17:48Z Files modified: * doc/ChangeLog Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/6134974a5e9765e59f6b… ====== Prune changelog from before 2.2.0 Alan T. DeKok@2013-02-12T16:13:49Z Files modified: * doc/ChangeLog Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/dfc17e1fbcfddd6e766f… ====== Actually print out encoded options in debug mode. Alan T. DeKok@2013-02-12T16:10:21Z Files modified: * src/lib/dhcp.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/94263b5027520da91958… ====== Added radmin command "hup main.log". Closes issue #121 Alan T. DeKok@2013-02-12T15:56:48Z Files modified: * src/include/radiusd.h * src/main/command.c * src/main/mainconfig.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/70e3f4587f7871ce7216… ====== As found on the net Alan T. DeKok@2013-02-11T14:13:41Z Files modified: * share/dictionary * share/dictionary.zeus Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/9cf5799d1558c0df5227… ====== -- This commit summary was generated @2013-02-13T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0