February 2013 - Freeradius-Devel - lists.freeradius.org

Commit report for master branch
by announce＠freeradius.org 12 Feb '13

12 Feb '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Add function to create unknown attributes from text strings Arran Cudbard-Bell@2013-02-12T21:17:52Z Files modified: * src/include/libradius.h * src/lib/dict.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/6d19c4d18c28fb8c8443… ====== Fix indentation in pairparsevalue Arran Cudbard-Bell@2013-02-12T20:20:46Z Files modified: * src/lib/valuepair.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/2b9efa65fbd0de7b944f… ====== Additional dictionary functions for working with dynamic attributes Arran Cudbard-Bell@2013-02-12T20:20:46Z Files modified: * src/include/libradius.h * src/lib/dict.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/21612addf4189cfd7d1b… ====== Actually print out encoded options in debug mode. Alan T. DeKok@2013-02-12T20:18:25Z Files modified: * src/lib/dhcp.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/d1ec0730b6fc003300a5… ====== As found on the net Alan T. DeKok@2013-02-12T20:16:36Z Files modified: * share/dictionary * share/dictionary.zeus Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/9d9e96287739b31f2d5a… ====== Added radmin command "hup main.log". Closes issue #121 Alan T. DeKok@2013-02-12T20:16:19Z Files modified: * src/include/radiusd.h * src/main/command.c * src/main/mainconfig.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/928cffed328fb33f749f… ====== Clarify decoding code Alan T. DeKok@2013-02-12T19:47:06Z Files modified: * src/lib/radius.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/28ecdec08dd838431e39… ====== Added dict_attrbytype(attr, vendor, type) for dealing with combo-ip attributes Alan T. DeKok@2013-02-12T19:46:32Z Files modified: * src/include/libradius.h * src/lib/dict.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/22d0dc7cae53098300b1… ====== Use hard-coded numbers for dictionary entries. There's no reason to expect that the server binary will be incompatible with the dictionaries Alan T. DeKok@2013-02-12T16:35:00Z Files modified: * src/modules/rlm_cache/rlm_cache.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/659697aeb14b81c2184d… ====== Rename unknown_attr to is_unkown (like is_tlv) Arran Cudbard-Bell@2013-02-12T15:56:18Z Files modified: * src/include/libradius.h * src/lib/dict.c * src/lib/valuepair.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/9d4fc70c4da8357dc70b… ====== Ignore warnings.txt (output of make warnings) Arran Cudbard-Bell@2013-02-12T15:56:17Z Files modified: * .gitignore Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/14a38412233f6d4cb235… ====== Check return code of dict_addattr, and use correct argument order and print a useful error message Alan T. DeKok@2013-02-12T15:30:10Z Files modified: * src/modules/rlm_sql/rlm_sql.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/eca49611ca7b37419f9f… ====== Added "default" to switch statement Alan T. DeKok@2013-02-12T02:45:46Z Files modified: * src/lib/print.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/c779df5d7d13f5dd4f3c… ====== Add dict_attrunknown function for when we don't have dictionary entries but still need to assign a DA to a VP. Arran Cudbard-Bell@2013-02-12T02:37:17Z Files modified: * src/include/libradius.h * src/lib/dict.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/957801d9254145af6b4c… ====== Decode extended TLVs correctly. This uses the new dict_attrbyparent() API to avoid doing magic on "nest". The code becomes a bit easier to read. Alan T. DeKok@2013-02-12T01:36:39Z Files modified: * src/lib/radius.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/4d301538ffb141126001… ====== VP_TRACE using hex values for VID / attr It's easier to read Alan T. DeKok@2013-02-12T01:36:39Z Files modified: * src/lib/radius.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/1855d2e95b23e9bbe39a… ====== Look for extended attrs before RFC format ones Alan T. DeKok@2013-02-12T01:36:39Z Files modified: * src/lib/radius.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/d840147b88f619fbd553… ====== Added dict_attrbyparent() Which gets a DICT_ATTR based on a parent reference, and an attr number This is so that any magic of playing with attr/vendor is hidden inside of one function, rather than being in multiple places Alan T. DeKok@2013-02-12T01:36:39Z Files modified: * src/include/libradius.h * src/lib/dict.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/8bdf152294d5c73a6a7e… ====== Refer to cache_eap authorize method, not authenticate Alan T. DeKok@2013-02-12T01:36:39Z Files modified: * raddb/policy.d/eap Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/fb2049ecdaf2b490abaa… ====== Enable cache_eap module by default Alan T. DeKok@2013-02-12T01:36:39Z Files modified: * raddb/Makefile Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/9a08506f0bde5b2307e5… ====== Define value types as an enum Arran Cudbard-Bell@2013-02-12T01:07:07Z Files modified: * src/include/libradius.h * src/include/radius.h Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/6488df80d7bb188e7c33… ====== -- This commit summary was generated @2013-02-13T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for master branch
by announce＠freeradius.org 11 Feb '13

11 Feb '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Fix horrible code and memory leak Alan T. DeKok@2013-02-11T16:40:11Z Files modified: * src/modules/rlm_perl/rlm_perl.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/a4636a3ab20ab856c200… ====== -- This commit summary was generated @2013-02-12T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

What is CHAP-Challenge for?
by JCA 11 Feb '13

11 Feb '13

I am looking into CHAP authentication, and I am having difficulties understanding what the CHAP-Challenge attribute is exactly for. Using the radclient utility that ships with freeradius-server 2.2.0 I can do the following: echo "User-Name = MyName, CHAP-Password = MyPassword, CHAP-Challenge = 0123456789" | ./radclient 192.168.0.2 auth SharedSecret Provided that the RADIUS server at 192.168.0.2 is alive and correctly configured (i.e. username, password and shared all match the values above) everything works fine, in that the CHAP authentication succeeds, as expected. However, if I do echo "User-Name = MyName, CHAP-Password = MyPassword" | ./radclient 192.168.0.2 auth SharedSecret this also succeeds. So, what's the use of the CHAP-Challenge attribute? RFC 2865 says that if its value is 16 bytes long then this value can be that of the Request Authenticator field, thus disposing of CHAP-Challenge altogether. What does therefore CHAP-Challenge do that is not already done by the Request Authenticator field? Are there any sets of circumstances in which using the CHAP-Challenge attribute is advisable? Actually, what's the point of using CHAP-Password at all, when User-Password seems to be at least as, if not more, secure a protocol?

2 3

Commit report for master branch
by announce＠freeradius.org 10 Feb '13

10 Feb '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Remove maximum length checks in rad_packet_ok() If the network cwlayercode allows for more than 4K of data, who are we to argue? This code only checks to see if the packet is "well formed" Alan T. DeKok@2013-02-10T22:53:54Z Files modified: * src/lib/radius.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/73920de1be10d9780190… ====== -- This commit summary was generated @2013-02-11T00:00:03Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

pap challenge in radius client
by Crne We 10 Feb '13

10 Feb '13

Looks like ACCESS-CHALLENGE as part of PAP authentication is not supported in the freeradius client library. Should I contribute that feature?

2 2

Commit report for master branch
by announce＠freeradius.org 09 Feb '13

09 Feb '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Remove examples for modules that have been removed from 3.0 Arran Cudbard-Bell@2013-02-09T17:06:13Z Files modified: * raddb/experimental.conf Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/6b612f87ebeea670bfe8… ====== -- This commit summary was generated @2013-02-10T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

rlm_exec and quoted strings?
by Brian Candler 09 Feb '13

09 Feb '13

This is something I came across while doing some refactoring (#186), and I thought I'd raise it here for discussion. When exec splits a line into an argv array, at the moment any quoted values retain their quotes. For example, %{exec:/bin/bash -c 'echo -n hello world'} gives argv of "/bin/bash" "-c" "'echo -n hello world'" // note the enclosed single-quotes which doesn't work: /bin/bash: echo -n hello world: command not found I think it should strip the outer quotes, but as this is a behaviour change I wonder if anyone could be relying on the old behaviour? Does this need to be made configurable with a flag? Some code which implements this change and also factors out the argv splitting into rad_expand_xlat() is at https://github.com/candlerb/freeradius-server/commits/candlerb/expand_xlat (for v2.x.x) The reason for looking at this is to be able to share the argv splitting code with rlm_redis, e.g. %{redis:LPUSH 'my key' %{User-Name}} where User-Name may also contain spaces. Comments welcomed. Regards, Brian.

2 1

Commit report for master branch
by announce＠freeradius.org 08 Feb '13

08 Feb '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Reorder xlat, too Alan T. DeKok@2013-02-08T18:16:41Z Files modified: * src/main/radiusd.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/79a1e18a431ddb3be507… ====== Track priorities for default action return If the default action is return, take it ONLY if we're at priority 0 Alan T. DeKok@2013-02-08T18:16:41Z Files modified: * src/main/modcall.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/5ca30f8dd0ee861825be… ====== Clarify handling of priority and result. Alan T. DeKok@2013-02-08T18:16:41Z Files modified: * src/main/modcall.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/9d2e849eed2bc9420687… ====== Use rlm_cache to deal with proxy failovers Arran Cudbard-Bell@2013-02-08T16:25:22Z Files modified: * raddb/mods-available/cache_eap * raddb/policy.d/eap Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/c7bf39c0edc0c928cd2f… ====== Update share/dictionary.erx guydavies (via Arran Cudbard-Bell)@2013-02-08T16:25:22Z Files modified: * share/dictionary.erx Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/1dc809ff73d78c1709a9… ====== -- This commit summary was generated @2013-02-09T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v2.x.x branch
by announce＠freeradius.org 08 Feb '13

08 Feb '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Track priorities for default action return If the default action is return, take it ONLY if we're at priority 0 Alan T. DeKok@2013-02-08T18:09:26Z Files modified: * src/main/modcall.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/74db4b13a60f97694881… ====== Clarify handling of priority and result. Alan T. DeKok@2013-02-08T18:09:25Z Files modified: * src/main/modcall.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/bb0c025586a389c8ca65… ====== Update share/dictionary.erx guydavies (via Arran Cudbard-Bell)@2013-02-08T16:26:44Z Files modified: * share/dictionary.erx Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/2fc4b3e811c6bfb71b93… ====== -- This commit summary was generated @2013-02-09T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

rlm_redis fixes
by Brian Candler 08 Feb '13

08 Feb '13

I have been running a 2.2.0 server with a couple of rlm_redis patches for several weeks now with no ill effects (processing some tens or hundreds of accounting packets per second). They are the top two commits in https://github.com/candlerb/freeradius-server/tree/candlerb/redis_escaping The earlier one, https://github.com/candlerb/freeradius-server/commit/fe7ffbe1e016684a3b791f… changes the way that redis escaping is done to allow for values containing spaces. It does this by tokenising the source string on spaces and then calling xlat on each part individually, building an array of separately expanded arguments to pass to redis. This is an approach which was suggested to me on the list. It is however a behaviour change. Given rlm_rediswho with start-insert = "LPUSH %{User-Name} %l" and username "foo bar": * originally rlm_rediswho would fail * as of commit 6e8e5ab2 it would insert "foo=20bar" * with this patch it will insert "foo bar" The second one, https://github.com/candlerb/freeradius-server/commit/bb7b54637812e787ade8bc… is a bug fix for rlm_rediswho: the TRIM functionality wasn't working, because it was checking the value returned by redis after redis_finish_query() was called, and hence was always reading zero. Do you think these can be merged? Thanks, Brian.

2 3