March 2013 - Freeradius-Devel - lists.freeradius.org

rlm_sql_ocioracle driver v. 0.1
by Ge＠＠ru 14 Mar '15

14 Mar '15

Hi, in attachment patch to add rlm_sql_ocioracle driver to freeradius 2.1.x tree (it seems work yet on 3.x tree). This drivers permit to use function/procedure with CURSOR (through :Ret_Cursor string) like for example: group_membership_query = "begin :Ret_Cursor := \ pkRadius.group_membership_query('%{SQL-User-Name}'); end;" TODO for next release: - add support to oracle connection pool instead of open a new connection for every socket on startup; - enhancement on handle error (through error callback) on do query; - add documentation. Module need oracle instantclient library and ocilib library (http://orclib.sourceforge.net/) Good luck to rlm_sql_ocioracle driver!! Geaaru

2 5

Patch for updated EAP-TNC support for freeradius from tnc@fhh
by Avesh Agarwal 19 Jul '13

19 Jul '13

Hello Alan, I have created a forked version of latest freeradius v2 branch on github and merged the updated EAP-TNC support from tnch@fhh. The link is here: https://github.com/aveshagarwal/freeradius-server/commit/40104449aa7bce926a… I have tested the patch on a testbed with 802.1x managed switch and wpa_supplicant and freeradius-server with EAP-TTLS as outer tunnel and EAP-MD5 and EAP-TNC as two inner EAP methods. I would appreciate any feedback on this patch to get it merged upstream. Thanks and Regards Avesh On Fri, Feb 1, 2013 at 4:32 PM, Alan DeKok <aland(a)deployingradius.com>wrote: > Avesh Agarwal wrote: > > Thanks for your response. But if you could tell some specific reasons > > why it is not enabled by default that would really help me understand > > what is required to be done. > > Because I don't think it works. I haven't had time to look into it. > > > It is here: https://github.com/trustatfhh/tnc-fhh > > OK. > > > Yes, I agree. But some specifics would really help. > > I don't have many. Make sure it works. Make sure the code is clean, > and formatted correctly. Make sure the patches are readable. > > I know pretty much nothing about EAP-TNC. So all I can give is > general guidelines for getting code into the server. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/devel.html >

3 13

Re: Release of Version 2.2.1
by Stefan Winter 15 Jul '13

15 Jul '13

Hi, > I've added the patch to set rcode=1 on clean exit. > > The patch to remove free_mainconfig() is made unnecessary by other > cleanups. The SEGV was a result of mis-ordered free's. There was > conflict between the modules free'ing their data, and the main > configuration code free'ing its data. That was fixed. > > The code was run through valgrind repeatedly until it shows no errors > on exit. Well, this morning's GIT doesn't quite agree. Sending a TERM to the server running -X: Listening on authentication address :: port 1812 Listening on accounting address :: port 1813 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address :: port 1814 Ready to process requests. Ready to process requests. Signalled to terminate Exiting normally. Speicherzugriffsfehler Speicherzugriffsfehler is my locale for Segmentation fault. gdb during termination time shows that there's something wrong inside free'ing eap types, it seems: Listening on authentication address :: port 1812 Listening on accounting address :: port 1813 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address :: port 1814 Ready to process requests. Program received signal SIGTERM, Terminated. 0x00007ffff6608623 in select () from /lib64/libc.so.6 (gdb) bt #0 0x00007ffff6608623 in select () from /lib64/libc.so.6 #1 0x00007ffff7bca538 in fr_event_loop (el=0x889640) at event.c:391 #2 0x0000000000429f21 in radius_event_process () at event.c:3800 #3 0x0000000000409f7c in main (argc=<optimized out>, argv=<optimized out>) at radiusd.c:421 (gdb) c Continuing. Ready to process requests. Signalled to terminate Exiting normally. Program received signal SIGSEGV, Segmentation fault. 0x00007ffff65a5634 in free () from /lib64/libc.so.6 (gdb) bt #0 0x00007ffff65a5634 in free () from /lib64/libc.so.6 #1 0x000000000040e2c0 in cf_section_parse_free (cs=0x675240, base=0x8209c0) at conffile.c:344 #2 0x00007ffff56e0d31 in eaptype_free (i=0x8247f0) at mem.c:253 #3 0x00007ffff56de877 in eap_detach (instance=0x823ad0) at rlm_eap.c:69 #4 0x000000000041ad31 in module_instance_free (data=0x823990) at modules.c:385 #5 0x00007ffff7bc3dfd in FreeWalker (tree=0x7f8130, X=0x825a70) at rbtree.c:63 #6 0x00007ffff7bc3dee in FreeWalker (tree=0x7f8130, X=0x81a9c0) at rbtree.c:61 #7 0x00007ffff7bc3ddd in FreeWalker (tree=0x7f8130, X=0x7f9f50) at rbtree.c:60 #8 0x00007ffff7bc3ddd in FreeWalker (tree=0x7f8130, X=0x822d30) at rbtree.c:60 #9 0x00007ffff7bc418d in rbtree_free (tree=0x7f8130) at rbtree.c:74 #10 0x000000000041bc40 in detach_modules () at modules.c:441 #11 0x0000000000409fd4 in main (argc=<optimized out>, argv=<optimized out>) at radiusd.c:465 (gdb) Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

5 29

Commit report for master branch
by announce＠freeradius.org 31 Mar '13

31 Mar '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Get rid of warning At the cost of duplicating minor bits of code Alan T. DeKok@2013-03-31T23:47:26Z Files modified: * src/main/radwho.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/047d96577836140a7ded… ====== Add -isystem So it doesn't complain about build warnings in the ruby headers Alan T. DeKok@2013-03-31T23:39:30Z Files modified: * src/modules/rlm_ruby/m4/ax_ruby_devel.m4 Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/1d31ffb835adda0d6d9c… ====== Include module-specific m4 directories, too Alan T. DeKok@2013-03-31T23:38:14Z Files modified: * Makefile Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/3f2889c7f46f954ddbc0… ====== Fix typo Alan T. DeKok@2013-03-31T22:58:12Z Files modified: * src/modules/rlm_wimax/rlm_wimax.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/3963452aa55d77aa26be… ====== Massive cleanups to module instantiation. The mod_instantiate() now takes void*instance, instead of void**instance. The module_t struct now has sizeof(rlm_foo_t), along with CONF_PARSER*module_config. The server core allocates instance = module->size and runs CONF_PARSER (if available) only if that passes does it call the mod_insantiate routine Alan T. DeKok@2013-03-31T22:54:20Z Files modified: * src/include/modules.h * src/main/modules.c * src/modules/rlm_always/rlm_always.c * src/modules/rlm_attr_filter/rlm_attr_filter.c * src/modules/rlm_attr_rewrite/rlm_attr_rewrite.c * src/modules/rlm_cache/rlm_cache.c * src/modules/rlm_chap/rlm_chap.c * src/modules/rlm_checkval/rlm_checkval.c * src/modules/rlm_counter/rlm_counter.c * src/modules/rlm_cram/rlm_cram.c * src/modules/rlm_detail/rlm_detail.c * src/modules/rlm_dhcp/rlm_dhcp.c * src/modules/rlm_digest/rlm_digest.c * src/modules/rlm_dynamic_clients/rlm_dynamic_clients.c * src/modules/rlm_eap/rlm_eap.c * src/modules/rlm_eap2/rlm_eap2.c * src/modules/rlm_example/rlm_example.c * src/modules/rlm_exec/rlm_exec.c * src/modules/rlm_expiration/rlm_expiration.c * src/modules/rlm_expr/rlm_expr.c * src/modules/rlm_files/rlm_files.c * src/modules/rlm_ippool/rlm_ippool.c * src/modules/rlm_krb5/rlm_krb5.c * src/modules/rlm_ldap/rlm_ldap.c * src/modules/rlm_linelog/rlm_linelog.c * src/modules/rlm_logintime/rlm_logintime.c * src/modules/rlm_mschap/rlm_mschap.c * src/modules/rlm_opendirectory/rlm_opendirectory.c * src/modules/rlm_otp/extern.h * src/modules/rlm_otp/otp_mppe.c * src/modules/rlm_otp/otp_pw_valid.c * src/modules/rlm_otp/otp_pw_valid.h * src/modules/rlm_otp/rlm_otp.c * src/modules/rlm_pam/rlm_pam.c * src/modules/rlm_pap/rlm_pap.c * src/modules/rlm_passwd/rlm_passwd.c * src/modules/rlm_perl/rlm_perl.c * src/modules/rlm_preprocess/rlm_preprocess.c * src/modules/rlm_python/rlm_python.c * src/modules/rlm_radutmp/rlm_radutmp.c * src/modules/rlm_realm/rlm_realm.c * src/modules/rlm_redis/rlm_redis.c * src/modules/rlm_rediswho/rlm_rediswho.c * src/modules/rlm_replicate/rlm_replicate.c * src/modules/rlm_rest/rlm_rest.c * src/modules/rlm_ruby/rlm_ruby.c * src/modules/rlm_securid/rlm_securid.c * src/modules/rlm_smsotp/rlm_smsotp.c * src/modules/rlm_soh/rlm_soh.c * src/modules/rlm_sometimes/rlm_sometimes.c * src/modules/rlm_sql/rlm_sql.c * src/modules/rlm_sql/rlm_sql.h * src/modules/rlm_sqlcounter/rlm_sqlcounter.c * src/modules/rlm_sqlhpwippool/rlm_sqlhpwippool.c * src/modules/rlm_sqlippool/rlm_sqlippool.c * src/modules/rlm_unix/rlm_unix.c * src/modules/rlm_utf8/rlm_utf8.c * src/modules/rlm_wimax/rlm_wimax.c * src/modules/rlm_yubikey/rlm_yubikey.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/a49ded0eab03c1f776e8… ====== Use cf_log_err_cs() instead of L_ERR Alan T. DeKok@2013-03-31T19:38:15Z Files modified: * src/modules/rlm_rest/rlm_rest.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/450709c996e79931e86b… ====== Remove duplicate code Alan T. DeKok@2013-03-31T19:33:39Z Files modified: * src/modules/rlm_files/rlm_files.c * src/modules/rlm_sometimes/rlm_sometimes.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/fea726366f6a5f23d363… ====== Don't call mod_detach() from instantiate The server core takes care of this Alan T. DeKok@2013-03-31T19:32:41Z Files modified: * src/modules/rlm_counter/rlm_counter.c * src/modules/rlm_eap/rlm_eap.c * src/modules/rlm_eap2/rlm_eap2.c * src/modules/rlm_exec/rlm_exec.c * src/modules/rlm_expr/rlm_expr.c * src/modules/rlm_ldap/rlm_ldap.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/1c7ed23b0d85e20508bf… ====== Use PW_TYPE_REQUIRED and PW_TYPE_ATTRIBUTE Checked via "grep", but there are probably more modules which need converting Alan T. DeKok@2013-03-31T19:23:09Z Files modified: * src/modules/rlm_attr_rewrite/rlm_attr_rewrite.c * src/modules/rlm_cache/rlm_cache.c * src/modules/rlm_checkval/rlm_checkval.c * src/modules/rlm_counter/rlm_counter.c * src/modules/rlm_ippool/rlm_ippool.c * src/modules/rlm_linelog/rlm_linelog.c * src/modules/rlm_passwd/rlm_passwd.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/ef8d75271d077ace9f94… ====== Added REQUIRED and ATTRIBUTE types for CONF_PARSER To simplify the rest of the code Alan T. DeKok@2013-03-31T19:23:02Z Files modified: * src/include/conffile.h * src/main/conffile.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/03f125e92c2feeab3ff9… ====== Cleaned up radlog(L_ERR, ... in mod_initialize to cf_log_err_cs(conf, ... where appropriate Alan T. DeKok@2013-03-31T18:37:23Z Files modified: * src/modules/rlm_attr_rewrite/rlm_attr_rewrite.c * src/modules/rlm_cache/rlm_cache.c * src/modules/rlm_chap/rlm_chap.c * src/modules/rlm_checkval/rlm_checkval.c * src/modules/rlm_counter/rlm_counter.c * src/modules/rlm_detail/rlm_detail.c * src/modules/rlm_eap/rlm_eap.c * src/modules/rlm_eap2/rlm_eap2.c * src/modules/rlm_exec/rlm_exec.c * src/modules/rlm_expiration/rlm_expiration.c * src/modules/rlm_files/rlm_files.c * src/modules/rlm_ippool/rlm_ippool.c * src/modules/rlm_krb5/rlm_krb5.c * src/modules/rlm_linelog/rlm_linelog.c * src/modules/rlm_logintime/rlm_logintime.c * src/modules/rlm_mschap/rlm_mschap.c * src/modules/rlm_otp/rlm_otp.c * src/modules/rlm_passwd/rlm_passwd.c * src/modules/rlm_perl/rlm_perl.c * src/modules/rlm_preprocess/rlm_preprocess.c * src/modules/rlm_python/rlm_python.c * src/modules/rlm_radutmp/rlm_radutmp.c * src/modules/rlm_realm/rlm_realm.c * src/modules/rlm_rest/rlm_rest.c * src/modules/rlm_securid/rlm_securid.c * src/modules/rlm_yubikey/rlm_yubikey.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/ac3cac8a82b46196f41e… ====== -- This commit summary was generated @2013-04-01T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for master branch
by announce＠freeradius.org 30 Mar '13

30 Mar '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Hack for #251 talloc context for certs / vps is NULL, not "ssn". Otherwise, when "ssn" goes away, so do the certs / vps. This isn't the definitive fix, but it's a start Alan T. DeKok@2013-03-30T15:11:24Z Files modified: * src/main/tls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/28ba5873ef18132041f4… ====== -- This commit summary was generated @2013-03-31T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v2.x.x branch
by announce＠freeradius.org 29 Mar '13

29 Mar '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Run through the format script Alan T. DeKok@2013-03-29T15:28:03Z Files modified: * share/dictionary.meru Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/9fa924636e143d756590… ====== Fix typo and do chrgrp of radiusd (if applicable) Manual fix for pull #262 Alan T. DeKok@2013-03-29T15:27:28Z Files modified: * scripts/raddebug Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/1f11110b4a33c4ec4552… ====== Added "show config <path>" to radmin Alan T. DeKok@2013-03-29T15:27:28Z Files modified: * src/main/command.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/8044fb5ee7c9229ae363… ====== -- This commit summary was generated @2013-03-30T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for master branch
by announce＠freeradius.org 29 Mar '13

29 Mar '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Don't encode empty eap-message Alan T. DeKok@2013-03-29T23:12:28Z Files modified: * src/modules/rlm_eap/libeap/eapcommon.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/8edcdee59cc879c0941e… ====== Simplify debug output Alan T. DeKok@2013-03-29T22:41:51Z Files modified: * src/main/threads.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/80ffaa05f402a60be1d3… ====== More error messages Alan T. DeKok@2013-03-29T22:25:40Z Files modified: * src/lib/packet.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/7cba8c441674bfa1d024… ====== Call event_new_fd() before searching for a new ID otherwise it will search for an ID, fail, allocate a socket, NOT insert it, try to allocate, fail, and then never insert the new socket Alan T. DeKok@2013-03-29T22:24:42Z Files modified: * src/main/process.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/3515e001bac0a2483ec6… ====== Fix TLS example So that it sets "virtual_server=default" by default and so that it sets fragment_size=8192 otherwise, EAP uses >1K of data, which makes it barf Alan T. DeKok@2013-03-29T22:23:24Z Files modified: * raddb/sites-available/tls Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/c7c7371c7259613d6575… ====== When creating an empty subcs, add it to the parent cf_section_alloc() just does the allocation, not the add. Alan T. DeKok@2013-03-29T22:02:11Z Files modified: * src/main/conffile.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/b6613247064762c345e5… ====== More debugging for proxying requests Alan T. DeKok@2013-03-29T21:48:12Z Files modified: * src/main/process.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/711c67b1e4a00b9bca4a… ====== Run Emacs indent Alan T. DeKok@2013-03-29T21:31:50Z Files modified: * src/modules/rlm_passwd/rlm_passwd.c * src/modules/rlm_perl/rlm_perl.c * src/modules/rlm_python/rlm_python.c * src/modules/rlm_ruby/rlm_ruby.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/31ad1ca8968685284ac7… ====== foo == NULL to !foo perl -p -i -e 's/([^ ()|=]+) == NULL/!$1/g' $(find src/modules/ -name "*.c" -print) Alan T. DeKok@2013-03-29T21:29:10Z Files modified: * src/modules/rlm_attr_filter/rlm_attr_filter.c * src/modules/rlm_attr_rewrite/rlm_attr_rewrite.c * src/modules/rlm_counter/rlm_counter.c * src/modules/rlm_detail/rlm_detail.c * src/modules/rlm_dhcp/rlm_dhcp.c * src/modules/rlm_digest/rlm_digest.c * src/modules/rlm_eap/eap.c * src/modules/rlm_eap/libeap/eap_tls.c * src/modules/rlm_eap/libeap/eapcommon.c * src/modules/rlm_eap/libeap/eapsimlib.c * src/modules/rlm_eap/radeapclient.c * src/modules/rlm_eap/rlm_eap.c * src/modules/rlm_eap/types/rlm_eap_gtc/rlm_eap_gtc.c * src/modules/rlm_eap/types/rlm_eap_ikev2/rlm_eap_ikev2.c * src/modules/rlm_eap/types/rlm_eap_leap/eap_leap.c * src/modules/rlm_eap/types/rlm_eap_leap/rlm_eap_leap.c * src/modules/rlm_eap/types/rlm_eap_md5/eap_md5.c * src/modules/rlm_eap/types/rlm_eap_md5/rlm_eap_md5.c * src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c * src/modules/rlm_eap/types/rlm_eap_peap/peap.c * src/modules/rlm_eap/types/rlm_eap_pwd/rlm_eap_pwd.c * src/modules/rlm_eap/types/rlm_eap_sim/rlm_eap_sim.c * src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c * src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c * src/modules/rlm_eap2/rlm_eap2.c * src/modules/rlm_ippool/rlm_ippool.c * src/modules/rlm_ippool/rlm_ippool_tool.c * src/modules/rlm_linelog/rlm_linelog.c * src/modules/rlm_mschap/opendir.c * src/modules/rlm_opendirectory/rlm_opendirectory.c * src/modules/rlm_pap/rlm_pap.c * src/modules/rlm_passwd/rlm_passwd.c * src/modules/rlm_perl/rlm_perl.c * src/modules/rlm_preprocess/rlm_preprocess.c * src/modules/rlm_python/rlm_python.c * src/modules/rlm_realm/rlm_realm.c * src/modules/rlm_redis/rlm_redis.c * src/modules/rlm_rest/rest.c * src/modules/rlm_rest/rlm_rest.c * src/modules/rlm_ruby/rlm_ruby.c * src/modules/rlm_securid/rlm_securid.c * src/modules/rlm_sql/drivers/rlm_sql_freetds/rlm_sql_freetds.c * src/modules/rlm_sql/drivers/rlm_sql_iodbc/rlm_sql_iodbc.c * src/modules/rlm_sql/drivers/rlm_sql_mysql/rlm_sql_mysql.c * src/modules/rlm_sql/drivers/rlm_sql_postgresql/rlm_sql_postgresql.c * src/modules/rlm_sql/drivers/rlm_sql_sybase/rlm_sql_sybase.c * src/modules/rlm_sql/rlm_sql.c * src/modules/rlm_sql/sql.c * src/modules/rlm_unix/rlm_unix.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/5e03e5a1dd987b02b9bd… ====== Conver L_ERR to cf_log_err Alan T. DeKok@2013-03-29T21:23:10Z Files modified: * src/modules/rlm_expr/rlm_expr.c * src/modules/rlm_files/rlm_files.c * src/modules/rlm_radutmp/rlm_radutmp.c * src/modules/rlm_ruby/rlm_ruby.c * src/modules/rlm_sometimes/rlm_sometimes.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/9616979468fbeb29373e… ====== Expose mod_rcode_table Alan T. DeKok@2013-03-29T21:14:51Z Files modified: * src/main/modcall.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/6bbea9e716e091695e7e… ====== Include rad_assert.h Alan T. DeKok@2013-03-29T21:04:10Z Files modified: * src/modules/rlm_sqlcounter/rlm_sqlcounter.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/fd6bdd38990551f8a8fa… ====== Fixes for building without threads Alan T. DeKok@2013-03-29T21:00:55Z Files modified: * src/lib/rbtree.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/0c64d83a4e31e6e938b1… ====== Fixes for mingw Alan T. DeKok@2013-03-29T21:00:55Z Files modified: * src/lib/dhcp.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/82175d119309b4111879… ====== Convert more things to RDEBUG Arran Cudbard-Bell@2013-03-29T20:57:27Z Files modified: * src/main/exec.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/ac8a50c591c9e95051a8… ====== child return code isn't an error Alan T. DeKok@2013-03-29T17:16:21Z Files modified: * src/main/exec.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/2c7e3cafa13bdc5979f5… ====== Use cf_log_err_cs/cp everywhere via a Perl script Alan T. DeKok@2013-03-29T17:08:41Z Files modified: * src/main/client.c * src/main/command.c * src/main/detail.c * src/main/listen.c * src/main/modcall.c * src/main/modules.c * src/main/realms.c * src/modules/rlm_cache/rlm_cache.c * src/modules/rlm_smsotp/rlm_smsotp.c * src/modules/rlm_sqlcounter/rlm_sqlcounter.c * src/modules/rlm_sqlippool/rlm_sqlippool.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/b4af9b5170951b0946a1… ====== Added cf_log_err_cs/cp So that the modules can log which thing went wrong where Alan T. DeKok@2013-03-29T17:08:41Z Files modified: * src/include/conffile.h * src/main/conffile.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/c3dcd9333774d269307c… ====== Rename "log" to "messages" Because it's not logging any more Alan T. DeKok@2013-03-29T17:08:41Z Files modified: * raddb/mods-available/sqlippool * src/modules/rlm_sqlippool/rlm_sqlippool.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/d9b6b43fa07e2b7b817f… ====== Fix logging levels Arran Cudbard-Bell@2013-03-29T16:45:12Z Files modified: * src/modules/rlm_yubikey/rlm_yubikey.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/fb87b890c9e35063590d… ====== We use 120 columns now... Arran Cudbard-Bell@2013-03-29T16:40:53Z Files modified: * src/modules/rlm_yubikey/rlm_yubikey.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/60aabf4e4145978e61a9… ====== Run through the format script Alan T. DeKok@2013-03-29T15:38:03Z Files modified: * share/dictionary.meru Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/b1145ea6fc5c19d21bec… ====== Fix typo and do chrgrp of radiusd (if applicable) Manual fix for pull #262 Alan T. DeKok@2013-03-29T15:38:00Z Files modified: * scripts/raddebug Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/0aee5f2643bb8e3a2f68… ====== Added "show config <path>" to radmin Alan T. DeKok@2013-03-29T15:37:58Z Files modified: * src/main/command.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/dfe1f7eab8db97c897e7… ====== Clean it up so that it makes sense. Don't call radlog(L_INFO,...) for messages. Don't repeat code ad nauseum. Use a macro. Move log message to a sane configuration name Alan T. DeKok@2013-03-29T15:37:52Z Files modified: * raddb/mods-available/sqlippool * src/modules/rlm_sqlippool/rlm_sqlippool.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/2143d1f3c143148158d0… ====== Fix radlog(L_ERR and other style violations Alan T. DeKok@2013-03-29T15:37:18Z Files modified: * src/modules/rlm_cache/rlm_cache.c * src/modules/rlm_sqlcounter/rlm_sqlcounter.c * src/modules/rlm_sqlippool/rlm_sqlippool.c * src/modules/rlm_yubikey/rlm_yubikey.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/3d997679ba3b03ce670c… ====== Unused and un-needed Alan T. DeKok@2013-03-29T15:36:46Z Files modified: * src/modules/rlm_radutmp/rlm_radutmp2.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/a9cd46d81ff8c5d1c63d… ====== Remove "out of memory" log messages. They're not needed. If we're OOM, the server core will print them, or the entire system will go down. Alan T. DeKok@2013-03-29T15:36:45Z Files modified: * src/modules/rlm_eap/eap.c * src/modules/rlm_eap/libeap/eap_tls.c * src/modules/rlm_eap/libeap/eapcommon.c * src/modules/rlm_eap/libeap/eapsimlib.c * src/modules/rlm_eap/types/rlm_eap_gtc/rlm_eap_gtc.c * src/modules/rlm_eap/types/rlm_eap_ikev2/rlm_eap_ikev2.c * src/modules/rlm_eap/types/rlm_eap_leap/eap_leap.c * src/modules/rlm_eap/types/rlm_eap_leap/rlm_eap_leap.c * src/modules/rlm_eap/types/rlm_eap_md5/eap_md5.c * src/modules/rlm_eap/types/rlm_eap_md5/rlm_eap_md5.c * src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c * src/modules/rlm_eap/types/rlm_eap_pwd/rlm_eap_pwd.c * src/modules/rlm_eap2/rlm_eap2.c * src/modules/rlm_radutmp/rlm_radutmp2.c * src/modules/rlm_replicate/rlm_replicate.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/eff18a4b502f7483514d… ====== Fix debugging messages Alan T. DeKok@2013-03-29T15:36:17Z Files modified: * src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/e84ae0c250090de2a1f6… ====== Initalize subsections for CONF_PARSER The CONF_PARSER may have a subsection. The config file may not supply one. When that happens, we want the defaults from the CONF_PARSER to still be applied. So, we create an empty subsection, which allows the defaults to be parsed Alan T. DeKok@2013-03-29T15:36:17Z Files modified: * src/main/conffile.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/033ae972e647fa3fbe7e… ====== Use vendor dictionary for rlm_yubikey Arran Cudbard-Bell@2013-03-29T03:05:22Z Files modified: * share/dictionary.freeradius.internal * share/dictionary.yubico * src/include/radius.h * src/lib/valuepair.c * src/modules/rlm_yubikey/rlm_yubikey.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/d50447164d65e816cd51… ====== Print out keytab name Arran Cudbard-Bell@2013-03-29T02:48:20Z Files modified: * src/modules/rlm_krb5/rlm_krb5.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/f916f643aaff3eab35ec… ====== Print out error code on kerberos error Arran Cudbard-Bell@2013-03-29T00:54:09Z Files modified: * src/modules/rlm_krb5/rlm_krb5.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/af05e1c5c899b8ab64ec… ====== -- This commit summary was generated @2013-03-30T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v2.x.x branch
by announce＠freeradius.org 28 Mar '13

28 Mar '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Updated Trapeze dictionary and added one for Meru (as submitted by John Carter) Arran Cudbard-Bell@2013-03-28T16:22:18Z Files modified: * share/dictionary * share/dictionary.meru * share/dictionary.trapeze Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/2f7ff445ca2ddc5bcbc9… ====== Merge pull request #256 from olivierbeytrison/v2.x.x fix typo Arran Cudbard-Bell@2013-03-28T13:46:35Z Files modified: * src/main/version.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/eb536d249ec84057ea12… ====== fix typo Olivier Beytrison@2013-03-28T10:54:26Z Files modified: * src/main/version.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/a8c639f088bc99596d99… ====== -- This commit summary was generated @2013-03-29T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for master branch
by announce＠freeradius.org 28 Mar '13

28 Mar '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Updated Trapeze dictionary and added one for Meru (as submitted by John Carter) Arran Cudbard-Bell@2013-03-28T16:20:29Z Files modified: * share/dictionary * share/dictionary.meru * share/dictionary.trapeze Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/f8ed811a54544f4ae07c… ====== Fix typos, update examples to use posixGroups Arran Cudbard-Bell@2013-03-28T04:55:08Z Files modified: * raddb/mods-available/ldap Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/70c08b8c86615859b200… ====== Only retrieve membership attributes if we need to process them Arran Cudbard-Bell@2013-03-28T04:43:31Z Files modified: * src/modules/rlm_ldap/rlm_ldap.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/a64422304319425f29ba… ====== Zero out EAP Fail packet Alan T. DeKok@2013-03-28T03:04:22Z Files modified: * src/modules/rlm_eap/eap.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/bb6c40b0e42624c53542… ====== -- This commit summary was generated @2013-03-29T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Changes to LDAP configuration and group processing
by Arran Cudbard-Bell 27 Mar '13

27 Mar '13

The configuration for rlm_ldap has changed slightly. There's now a new subsection 'user' which contains: * basedn (allows specification of a specific base dn for users) * scope (defaults to sub) * filter (moved from main configuration section) * positive_access (moved from profile) * access_attribute (moved from profile) Group has three additional config items * basedn (allows specification of a specific base dn for groups) * scope (defaults to sub) * filter (which is combined with the membership filter, and used on its own when converting group names to DNs) * cacheable_name - Retrieves all group memberships as group names * cacheable_dn - Retrieves all group memberships as group DNs basedn in the main config section has been left in, but will be overridden by basedn set in user or group. The default scope of user and group is "sub" which is the same as before, but can be set to one (or base, though i'm not sure why you'd do that). The cacheable_* items if enabled, will convert all memberships to the group attribute created when the module is instantiated (LDAP-Group if no instance name is provided). Wed Mar 27 17:59:27 2013 : Debug: (2) ldap : Waiting for bind result... Wed Mar 27 17:59:27 2013 : Debug: (2) ldap : Bind successful Wed Mar 27 17:59:27 2013 : Debug: (2) ldap : expand: '%{Stripped-User-Name}' -> '' Wed Mar 27 17:59:27 2013 : Debug: (2) ldap : ... expanding second conditional Wed Mar 27 17:59:27 2013 : Debug: (2) ldap : escape: 'arr2036' -> 'arr2036' Wed Mar 27 17:59:27 2013 : Debug: (2) ldap : expand: '%{User-Name}' -> 'arr2036' Wed Mar 27 17:59:27 2013 : Debug: (2) ldap : expand: '(uid=%{%{Stripped-User-Name}:-%{User-Name}})' -> '(uid=arr2036)' Wed Mar 27 17:59:27 2013 : Debug: (2) ldap : expand: 'dc=rm-rfi,dc=com' -> 'dc=rm-rfi,dc=com' Wed Mar 27 17:59:27 2013 : Debug: (2) ldap : Performing search in 'dc=rm-rfi,dc=com' with filter '(uid=arr2036)' Wed Mar 27 17:59:27 2013 : Debug: (2) ldap : Waiting for search result... Wed Mar 27 17:59:27 2013 : Debug: (2) ldap : User object found at DN "uid=arr2036,ou=people,dc=rm-rfi,dc=com" Wed Mar 27 17:59:27 2013 : Debug: (2) ldap : Added Ldap-Group with value "example" to control list Wed Mar 27 17:59:27 2013 : Debug: (2) ldap : Added Ldap-Group with value "nonexistant" to control list Wed Mar 27 17:59:28 2013 : Debug: (2) files : Searching for user in group "example" Wed Mar 27 17:59:28 2013 : Debug: (2) files : User found. Matched cached membership If you want to use cacheable_* the format should match the format of your check items. If you have a check item in a format thats not cached the module will fallback to querying the LDAP directory. For those using Active Directory where all the membership information is in memberOf attributes in the user object, you will see a performance increase by turning on the cacheable_* which matches the format of those attributes, and using check items of that format, even if you don't cache any of the membership attributes. The old code did the following: * query to get user DN * query to get attributes for mapping * query to get access attributes and profile attributes (then one query per profile) * query for every membership check * optional edir query to retrieve password * optional edir query to check authorisation The new code without caching does * query to get DN, mapping, access attributes, profile attributes (then one query per profile) * optional edir query to retrieve password * optional edir query to check authorisation * query for every membership check The new code with caching just does * query to get DN, mapping, access attributes, profile attributes (then one query per profile), membership attributes * optional edir query to retrieve password * optional edir query to check authorisation If you don't want to try out the new features then the only change required in your config is to create a user {} section and move the filter and access config items into it. Profiles for group objects are not supported, looking at the 2.x.x code, i'm not sure they ever were. But if someone knows differently let me know, and i'll try and hack support in for them (though it'll only be for dynamic group lookups until we have nested attributes). The module src has been split out into individual files, attrmap.c deals with mapping attributes, group.c contains the group logic, edir.c contains the edir code, ldap.c contains the main functions (rlm_ldap_bind, rlm_ldap_search, rlm_ldap_modify), and rlm_ldap.c contains the module functions. Any patches that call libldap functions to bind, search or modify attributes will not be accepted. Any code that needs to determine the user's DN must call rlm_ldap_find_user. Error handling has been improved. The module will now always print any error messages provided by the server, and where the server and library errors differ, print information for both. In the case of partial DN matches (due to misconfiguration) it should also print out a string showing where the match failed. That's about all I can think of to improve the LDAP module logic, at some point the module should be split into logic and connection pool, but that can wait a while. -Arran

1 0