May 2013 - Freeradius-Devel - lists.freeradius.org

rlm_sql_ocioracle driver v. 0.1
by Ge＠＠ru 14 Mar '15

14 Mar '15

Hi, in attachment patch to add rlm_sql_ocioracle driver to freeradius 2.1.x tree (it seems work yet on 3.x tree). This drivers permit to use function/procedure with CURSOR (through :Ret_Cursor string) like for example: group_membership_query = "begin :Ret_Cursor := \ pkRadius.group_membership_query('%{SQL-User-Name}'); end;" TODO for next release: - add support to oracle connection pool instead of open a new connection for every socket on startup; - enhancement on handle error (through error callback) on do query; - add documentation. Module need oracle instantclient library and ocilib library (http://orclib.sourceforge.net/) Good luck to rlm_sql_ocioracle driver!! Geaaru

2 5

Patch for updated EAP-TNC support for freeradius from tnc@fhh
by Avesh Agarwal 19 Jul '13

19 Jul '13

Hello Alan, I have created a forked version of latest freeradius v2 branch on github and merged the updated EAP-TNC support from tnch@fhh. The link is here: https://github.com/aveshagarwal/freeradius-server/commit/40104449aa7bce926a… I have tested the patch on a testbed with 802.1x managed switch and wpa_supplicant and freeradius-server with EAP-TTLS as outer tunnel and EAP-MD5 and EAP-TNC as two inner EAP methods. I would appreciate any feedback on this patch to get it merged upstream. Thanks and Regards Avesh On Fri, Feb 1, 2013 at 4:32 PM, Alan DeKok <aland(a)deployingradius.com>wrote: > Avesh Agarwal wrote: > > Thanks for your response. But if you could tell some specific reasons > > why it is not enabled by default that would really help me understand > > what is required to be done. > > Because I don't think it works. I haven't had time to look into it. > > > It is here: https://github.com/trustatfhh/tnc-fhh > > OK. > > > Yes, I agree. But some specifics would really help. > > I don't have many. Make sure it works. Make sure the code is clean, > and formatted correctly. Make sure the patches are readable. > > I know pretty much nothing about EAP-TNC. So all I can give is > general guidelines for getting code into the server. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/devel.html >

3 13

Re: Release of Version 2.2.1
by Stefan Winter 15 Jul '13

15 Jul '13

Hi, > I've added the patch to set rcode=1 on clean exit. > > The patch to remove free_mainconfig() is made unnecessary by other > cleanups. The SEGV was a result of mis-ordered free's. There was > conflict between the modules free'ing their data, and the main > configuration code free'ing its data. That was fixed. > > The code was run through valgrind repeatedly until it shows no errors > on exit. Well, this morning's GIT doesn't quite agree. Sending a TERM to the server running -X: Listening on authentication address :: port 1812 Listening on accounting address :: port 1813 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address :: port 1814 Ready to process requests. Ready to process requests. Signalled to terminate Exiting normally. Speicherzugriffsfehler Speicherzugriffsfehler is my locale for Segmentation fault. gdb during termination time shows that there's something wrong inside free'ing eap types, it seems: Listening on authentication address :: port 1812 Listening on accounting address :: port 1813 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address :: port 1814 Ready to process requests. Program received signal SIGTERM, Terminated. 0x00007ffff6608623 in select () from /lib64/libc.so.6 (gdb) bt #0 0x00007ffff6608623 in select () from /lib64/libc.so.6 #1 0x00007ffff7bca538 in fr_event_loop (el=0x889640) at event.c:391 #2 0x0000000000429f21 in radius_event_process () at event.c:3800 #3 0x0000000000409f7c in main (argc=<optimized out>, argv=<optimized out>) at radiusd.c:421 (gdb) c Continuing. Ready to process requests. Signalled to terminate Exiting normally. Program received signal SIGSEGV, Segmentation fault. 0x00007ffff65a5634 in free () from /lib64/libc.so.6 (gdb) bt #0 0x00007ffff65a5634 in free () from /lib64/libc.so.6 #1 0x000000000040e2c0 in cf_section_parse_free (cs=0x675240, base=0x8209c0) at conffile.c:344 #2 0x00007ffff56e0d31 in eaptype_free (i=0x8247f0) at mem.c:253 #3 0x00007ffff56de877 in eap_detach (instance=0x823ad0) at rlm_eap.c:69 #4 0x000000000041ad31 in module_instance_free (data=0x823990) at modules.c:385 #5 0x00007ffff7bc3dfd in FreeWalker (tree=0x7f8130, X=0x825a70) at rbtree.c:63 #6 0x00007ffff7bc3dee in FreeWalker (tree=0x7f8130, X=0x81a9c0) at rbtree.c:61 #7 0x00007ffff7bc3ddd in FreeWalker (tree=0x7f8130, X=0x7f9f50) at rbtree.c:60 #8 0x00007ffff7bc3ddd in FreeWalker (tree=0x7f8130, X=0x822d30) at rbtree.c:60 #9 0x00007ffff7bc418d in rbtree_free (tree=0x7f8130) at rbtree.c:74 #10 0x000000000041bc40 in detach_modules () at modules.c:441 #11 0x0000000000409fd4 in main (argc=<optimized out>, argv=<optimized out>) at radiusd.c:465 (gdb) Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

5 29

EAP-SIM on Radius 3.0 (devel)
by Rodney Machado 07 Jun '13

07 Jun '13

Hi All, I'm testing EAP-SIM support on the latest version of freeradius (got it via git). <command> git clone git://git.freeradius.org/freeradius-server.git </command> After I have compiled and installed it, I have modified the configuration files, as I have done on the older versions (v2.2.0). But, when I try to run the daemon i got this error: <error> /usr/local/etc/raddb/radiusd.conf[613]: Failed to link to module 'rlm_sim_file': rlm_sim_file.so: cannot open shared object file: No such file or directory </error> <modified files> in /usr/local/etc/raddb/radiusd.conf: <changes_in_radiusd.conf> sim_files { simtriplets = "/usr/local/etc/raddb/simtriplets.dat" } </changes_in_radiusd.conf> in /usr/local/etc/raddb/sites-enabled/default <changes_in_default> In authorized {} sim_files </changes_in_default> in /usr/local/etc/raddb/mods-enabled/eap <changes_in_eap> sim{ } </changes_in_eap> What have changed on the 3.0 version (devel) of the freeradius?, perhaps rlm_sim_file is not needed anymore? Or there is a new configuration structure for supporting eap-sim? Please advice. Regards, --RM

5 8

Re: segmentation fault in rlm_preprocess
by duffy 03 Jun '13

03 Jun '13

ooops, i'm sorry.. you're right, i wrote to the wrong list. btw thank you arran, you fixed it! now, this is the new issue: rad_recv: Access-Challenge packet from host 172.20.23.30 port 1812, id=159, length=85 EAP-Message = 0x01a800160410b8a13ab82ba23820a55c0440bf74467f Message-Authenticator = 0x78a5dd4358024b720b10b1bcb7b0c917 State = 0xd036ba28d09ebe94e88e461954f76013 Proxy-State = 0x323432 (0) # Executing section post-proxy from file /etc/raddb/sites-enabled/default (0) group post-proxy { (0) - entering group post-proxy {...} (0) attr_filter.access_challenge : expand: '%{User-Name}' -> 'test@fr3' (0) attr_filter.access_challenge : Matched entry DEFAULT at line 13 Program received signal SIGSEGV, Segmentation fault. 0x00007ffff0e02d63 in attr_filter_common (instance=0x8a1880, request=0x8e77b0, packet=0x942e00) at src/modules/rlm_attr_filter/rlm_attr_filter.c:269 269 if (vp->da->attr == check_item->da->attr) { Missing separate debuginfos, use: debuginfo-install freeradius-3.0.0-14.el6.x86_64 (gdb) info args instance = 0x8a1880 request = 0x8e77b0 packet = 0x942e00 (gdb) info locals fall_through = <value optimized out> relax_filter = 0 inst = 0x8a1880 cursor = {first = 0x942e70, found = 0x0, last = 0x0, current = 0x944490, next = 0x9445a0} out = {first = 0x7fffffffd198, found = 0x0, last = 0x0, current = 0x0, next = 0x0} vp = 0x8e77b0 output = 0x0 input = <value optimized out> check_item = 0x944490 pl = 0x8a2ad0 found = 1 pass = <value optimized out> fail = <value optimized out> keyname = 0x7fffffffd040 "test@fr3" buffer = "test@fr3\000\264\230\000\000\000\000\000\023\000\000\000\000\000\000\000\366\253:\367\377\177\000\000`\327\377\377\377\177\000\000P\327\377\377\377\177\000\000\f\000\000\000\00 432\000\070d09ebe94e88e461954f76013\000\064\064\060bf74467f\000\000\000\320\377\377\377\177\000\000\200n+\366\377\177\000\000\300\327\377\377\377\177\000\000\260\327\377\377\377\177\000\ 177\000\000\360\320\377\377\377\177\000\000\347\303\366\365\377\177\000\000\005\353\a\366\377\177\000\000\000\000\000\000\000\000\000\000\254\326\377\377\377\177\000\000\310\326\377\377\ \000\000\000\000\000\000n+\366\000\000\000\000 &\372\365\000\000\000\000\240\326\377\377\377\177\000\000\200\003\231\000\000\000\000" (gdb) info frame Stack level 0, frame at 0x7fffffffd1e0: rip = 0x7ffff0e02d63 in attr_filter_common (src/modules/rlm_attr_filter/rlm_attr_filter.c:269); saved rip 0x41d6f9 called by frame at 0x7fffffffda00 source language c. Arglist at 0x7fffffffcfe8, args: instance=0x8a1880, request=0x8e77b0, packet=0x942e00 Locals at 0x7fffffffcfe8, Previous frame's sp is 0x7fffffffd1e0 Saved registers: rbx at 0x7fffffffd1a8, rbp at 0x7fffffffd1b0, r12 at 0x7fffffffd1b8, r13 at 0x7fffffffd1c0, r14 at 0x7fffffffd1c8, r15 at 0x7fffffffd1d0, rip at 0x7fffffffd1d8 (gdb) ------------------------- This should be on devel, but nevermind. Should be fixed, can you check? -Arran Arran Cudbard-Bell <a.cudbardb at freeradius.org> FreeRADIUS Development Team Il 30/05/13 15.58, duffy ha scritto: > hi list! > > today we built from master and we ran into this: > > Ready to process requests. > rad_recv: Access-Request packet from host 172.20.23.31 port 1814, > id=193, length=228 > NAS-Port-Type = Wireless-802.16 > Proxy-State = 0x323231 > WiMAX-Available-In-Client = 99 > Service-Type = Framed-User > WiMAX-BS-ID = 0x303030303230303630313030 > WiMAX-Release = "1.1" > Message-Authenticator = 0x6149f02200f787d01064d0305effb1ce > WiMAX-Accounting-Capabilities = Flow-Based > NAS-IP-Address = 172.20.10.121 > WiMAX-Hotlining-Capabilities = Hotline-Profile-Id > Calling-Station-Id = "0B4E398C5FF7" > User-Name = "test@fr3" > Event-Timestamp = "May 30 2013 15:42:48 CEST" > NAS-Identifier = "A_NAS" > WiMAX-GMT-Timezone-offset = 16777216 > EAP-Message = 0x022a000d017465737440667233 > Attr-26 = 0x000060b5010301 > WiMAX-Idle-Mode-Notification-Cap = Supported > (3) # Executing section authorize from file > /etc/raddb/sites-enabled/default > (3) group authorize { > (3) - entering group authorize {...} > (3) eap : EAP packet type response id 42 length 13 > (3) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the > rest of authorize > (3) [eap] = ok > > Breakpoint 1, hints_setup (hints=0x9f9790, request=0xaf9870) at > src/modules/rlm_preprocess/rlm_preprocess.c:381 > 381 { > Missing separate debuginfos, use: debuginfo-install > freeradius-3.0.0-13.el6.x86_64 > (gdb) f > #0 hints_setup (hints=0x9f9790, request=0xaf9870) at > src/modules/rlm_preprocess/rlm_preprocess.c:381 > 381 { > (gdb) info args > hints = 0x9f9790 > request = 0xaf9870 > (gdb) info frame > Stack level 0, frame at 0x7fffffffc910: > rip = 0x7fffe7b222a0 in hints_setup > (src/modules/rlm_preprocess/rlm_preprocess.c:381); saved rip 0x7fffe7b227eb > called by frame at 0x7fffffffcd30 > source language c. > Arglist at 0x7fffffffc900, args: hints=0x9f9790, request=0xaf9870 > Locals at 0x7fffffffc900, Previous frame's sp is 0x7fffffffc910 > Saved registers: > rip at 0x7fffffffc908 > (gdb) n > 389 request_pairs = request->packet->vps; > (gdb) n > 391 if (!hints || !request_pairs) > (gdb) n > 389 request_pairs = request->packet->vps; > (gdb) n > 391 if (!hints || !request_pairs) > (gdb) n > 397 name = (tmp = pairfind(request_pairs, PW_USER_NAME, 0, > TAG_ANY)) ? > (gdb) n > 399 if (!name || name[0] == 0) { > (gdb) n > 421 pairdelete(&add, PW_STRIP_USER_NAME, 0, > TAG_ANY); > (gdb) n > 410 if (((strcmp(i->name, "DEFAULT") == 0) || > (strcmp(i->name, name) == 0)) && > (gdb) n > 411 (paircompare(request, request_pairs, > i->check, NULL) == 0)) { > (gdb) n > > Program received signal SIGSEGV, Segmentation fault. > 0x00007ffff75d4a56 in paircompare (request=0xaf9870, req_list=0xaf9ce0, > check=0x9f8fe0, rep_list=0x0) at src/main/valuepair.c:495 > 495 if (!check_item->da->vendor) switch > (check_item->da->attr) { > (gdb) info args > request = 0xaf9870 > req_list = 0xaf9ce0 > check = 0x9f8fe0 > rep_list = 0x0 > (gdb) info frame > Stack level 0, frame at 0x7fffffffc8b0: > rip = 0x7ffff75d4a56 in paircompare (src/main/valuepair.c:495); saved > rip 0x7fffe7b223bb > called by frame at 0x7fffffffc910 > source language c. > Arglist at 0x7fffffffc808, args: request=0xaf9870, req_list=0xaf9ce0, > check=0x9f8fe0, rep_list=0x0 > Locals at 0x7fffffffc808, Previous frame's sp is 0x7fffffffc8b0 > Saved registers: > rbx at 0x7fffffffc878, rbp at 0x7fffffffc880, r12 at 0x7fffffffc888, > r13 at 0x7fffffffc890, r14 at 0x7fffffffc898, r15 at 0x7fffffffc8a0, rip > at 0x7fffffffc8a8 > (gdb) print check_item->da > $1 = (const DICT_ATTR *) 0x1000003ec > (gdb) print check_item->da->vendor > Cannot access memory at address 0x1000003f4 > (gdb) print check_item->da->attr > Cannot access memory at address 0x1000003ec > > > it looks like a bug in src/modules/rlm_preprocess/rlm_preprocess.c but > we're not so sure about the resolution; has anyone encountered/solved > the same issue? > > thanks+regards, > duffy

3 4

Commit report for master branch
by announce＠freeradius.org 31 May '13

31 May '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Revert "Remove -rdynamic" This reverts commit 516a781627ebb0c063f11ec0636249f76a41b8c7. Arran Cudbard-Bell@2013-05-31T20:46:40Z Files modified: * scripts/libtool.mk Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/042611b15624b9ae3ec6… ====== We don't need to export CFLAGS Arran Cudbard-Bell@2013-05-31T20:32:49Z Files modified: * Makefile * configure * m4/ax_cc.m4 Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/98e36f90d4976895ed3a… ====== Remove -rdynamic It may be needed in older systems. It breaks newer ones. Backwards compatibiliy? Who needs that... Alan T. DeKok@2013-05-31T18:49:08Z Files modified: * scripts/libtool.mk Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/516a781627ebb0c063f1… ====== Better fix for GCC stupidity Arran Cudbard-Bell@2013-05-31T18:41:17Z Files modified: * configure * m4/ax_cc.m4 Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/b4ce9d7722090036f99c… ====== Check for -Wdocumentation and -Qunused-arguments ONLY for clang Alan T. DeKok@2013-05-31T15:34:07Z Files modified: * configure * m4/ax_cc.m4 Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/f027a2e76e807f025a87… ====== Use correct dependencies when re-building "configure" Alan T. DeKok@2013-05-31T15:33:57Z Files modified: * Makefile Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/30dbdb7909f92a4065f5… ====== Add "skip_duplicate_checks" for detail && tcp listeners Alan T. DeKok@2013-05-31T15:00:08Z Files modified: * src/include/process.h * src/include/radiusd.h * src/main/detail.c * src/main/listen.c * src/main/process.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/dd756720ebadb5b301b2… ====== Document the "limit" section, and move max_pps there Alan T. DeKok@2013-05-31T15:00:08Z Files modified: * raddb/sites-available/default * src/main/listen.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/72ed1b7d26042d93d77e… ====== Remove extraneous brackets Alan T. DeKok@2013-05-31T15:00:08Z Files modified: * raddb/policy.d/eap Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/23beb53417ce5314005c… ====== -- This commit summary was generated @2013-06-01T00:00:08Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

free radius configure error: talloc.h
by Kavitha Kamarthy 30 May '13

30 May '13

Hi All, I read the previous posts and installed the talloclib and I do see the talloc.h under /usr/include. I see that the library is correctly installed. I set the PATH to reflect that in .bashrc. I also copied the talloc.h file under/usr/local/include too but it is unable to find the talloc.h file. When I execute /freeradius-server$ sudo ./configure --with-talloc-include-dir="/usr/include" I get the error : configure: Setting additional developer CFLAGS checking for the compiler flag "-Wdocumentation"... no configure: Developer CFLAGS are " -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -Wformat-y2k -Wno-format-extra-args -Wno-format-zero-length -Wno-cast-align -Wformat-nonliteral -Wformat-security -Wformat=2 -DWITH_VERIFY_PTR=1" configure: is developer build, enabling experimental modules implicitly, disable with --without-experimental-modules checking for TLS... no checking for talloc.h in /usr/include... no checking for talloc.h... no checking for talloc.h in /usr/local/include... no checking for talloc.h in /opt/include... no configure: WARNING: talloc headers not found. Use --with-talloc-include-dir=<path>. configure: error: FreeRADIUS requires libtalloc Any suggestions how to fix this ? Thx KCK

1 0

Commit report for master branch
by announce＠freeradius.org 30 May '13

30 May '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== and just use cflags Arran Cudbard-Bell@2013-05-30T22:06:49Z Files modified: * m4/ax_cc.m4 Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/4adf179e9e91f2582059… ====== Probably need to pass -Werror for compiler argument checks Arran Cudbard-Bell@2013-05-30T22:05:36Z Files modified: * configure * m4/ax_cc.m4 Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/0373d39af8821576eeb0… ====== -Wdocumentation doesn't warn about unrecognised tags Arran Cudbard-Bell@2013-05-30T21:31:11Z Files modified: * src/main/valuepair.c * src/modules/proto_dhcp/dhcp.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/f0af8f9c57923053941e… ====== Fixup doxygen comments to pass new check Arran Cudbard-Bell@2013-05-30T21:21:00Z Files modified: * src/lib/valuepair.c * src/main/connection.c * src/main/exec.c * src/main/valuepair.c * src/main/xlat.c * src/modules/rlm_expr/rlm_expr.c * src/modules/rlm_yubikey/decrypt.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/f0399000f7ef167c69bf… ====== Update main autoconf Better check for -Qunused-arguments Pass -Wdocumentation if supported by the compiler, this allows clang >= 3.2 to parse the doxygen documentation and emit warnings if it doesn't match the code. Arran Cudbard-Bell@2013-05-30T21:04:16Z Files modified: * configure * configure.in * m4/ax_cc.m4 Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/4cbe9552c17e06898176… ====== Need more cursors Arran Cudbard-Bell@2013-05-30T19:21:34Z Files modified: * src/modules/rlm_attr_filter/rlm_attr_filter.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/f4f29d2861f0371a045f… ====== And one more... Arran Cudbard-Bell@2013-05-30T16:55:24Z Files modified: * src/main/process.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/b54d7b63e55b4e8f79bc… ====== Fix reference issues hidden by cast Arran Cudbard-Bell@2013-05-30T16:29:27Z Files modified: * src/main/command.c * src/main/tls.c * src/main/valuepair.c * src/modules/proto_dhcp/dhcp.c * src/modules/rlm_preprocess/rlm_preprocess.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/e7acd1cfa84be41a38b2… ====== Macro Arran Cudbard-Bell@2013-05-30T00:44:37Z Files modified: * src/lib/valuepair.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/3960ee099892c24f1682… ====== -- This commit summary was generated @2013-05-31T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for master branch
by announce＠freeradius.org 29 May '13

29 May '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== VERIFY must only be be called on non-NULL pointers pairfindnext needs its own pointer to work correctly Fix typo in evaluate.c Arran Cudbard-Bell@2013-05-29T19:08:49Z Files modified: * src/include/libradius.h * src/lib/valuepair.c * src/main/evaluate.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/bc83f82015a67599a6b2… ====== Fix use after free when iterating over pairlists to be freed Arran Cudbard-Bell@2013-05-29T18:05:32Z Files modified: * src/include/libradius.h * src/lib/valuepair.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/eb28809a263fb7f582fd… ====== Use paircursor for iteration where appropriate Arran Cudbard-Bell@2013-05-29T15:52:38Z Files modified: * src/include/libradius.h * src/lib/print.c * src/lib/valuepair.c * src/main/auth.c * src/main/command.c * src/main/detail.c * src/main/evaluate.c * src/main/exec.c * src/main/log.c * src/main/modcall.c * src/main/process.c * src/main/radattr.c * src/main/radclient.c * src/main/radsniff.c * src/main/tls.c * src/main/valuepair.c * src/modules/proto_dhcp/dhcp.c * src/modules/proto_dhcp/dhcpclient.c * src/modules/proto_dhcp/rlm_dhcp.c * src/modules/proto_vmps/vqp.c * src/modules/rlm_attr_filter/rlm_attr_filter.c * src/modules/rlm_cache/rlm_cache.c * src/modules/rlm_detail/rlm_detail.c * src/modules/rlm_digest/rlm_digest.c * src/modules/rlm_eap/eap.c * src/modules/rlm_eap/libeap/eapcommon.c * src/modules/rlm_eap/libeap/eapsimlib.c * src/modules/rlm_eap/rlm_eap.c * src/modules/rlm_eap/types/rlm_eap_peap/peap.c * src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c * src/modules/rlm_files/rlm_files.c * src/modules/rlm_ldap/attrmap.c * src/modules/rlm_ldap/groups.c * src/modules/rlm_mschap/rlm_mschap.c * src/modules/rlm_pap/rlm_pap.c * src/modules/rlm_passwd/rlm_passwd.c * src/modules/rlm_perl/rlm_perl.c * src/modules/rlm_preprocess/rlm_preprocess.c * src/modules/rlm_python/rlm_python.c * src/modules/rlm_radutmp/rlm_radutmp.c * src/modules/rlm_replicate/rlm_replicate.c * src/modules/rlm_rest/rest.c * src/modules/rlm_ruby/rlm_ruby.c * src/modules/rlm_unix/rlm_unix.c * src/modules/rlm_utf8/rlm_utf8.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/e3b4c5b2bfda8d8965f3… ====== -- This commit summary was generated @2013-05-30T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

default certificates: add a useless CRL distribution point?
by Stefan Winter 25 May '13

25 May '13

Hi, the bootstrap script adds EKU "TLS Web Server" because that makes most of the Windows editions happy. Folks in eduroam have now discovered something ... odd ... with Windows Phone 8. It requires that the *server* certificate that comes in during EAP contains the "CRL Distribution Point" extension. This is rather useless of course, because the client can't actually consult the CRL because he has no network while he's trying to authenticate. As an effect of that, it does not matter at all whether the URL in the CDP extension actually serves a CRL. It's just an extra annoyance to be aware of. I'm wondering: should the bootstrap scripts add a CDP pointing to a non-existing URL? It would improve the compatibility with these devices. It would make the certs look stranger though, as that is just added junk. Maybe a URL like "http://www.freeradius.org/silly/cert/extension/" would make that clear for anyone who cares to take a look at the generated certs. Note that I don't know if the CA and/or intermediates also need that extension present. I can find out if need be (and I'm sure Tomasz and Maja are reading this list themselves anyway :-) ). Greetings, Stefan Winter

2 1