May 2013 - Freeradius-Devel - lists.freeradius.org

Commit report for master branch
by announce＠freeradius.org 15 May '13

15 May '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== A more robust way of statically removing "if (false)" sections Alan T. DeKok@2013-05-15T18:07:04Z Files modified: * src/main/modules.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/4bc3e552b5e4f6b218ec… ====== Never mind... we'll get to this later Alan T. DeKok@2013-05-15T17:25:00Z Files modified: * src/main/modules.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/4c0eba986561c0a0c972… ====== Minor fixes Alan T. DeKok@2013-05-15T16:20:05Z Files modified: * src/main/modules.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/7f01740fdc2f56ac600b… ====== Ignore subsections which statically evaluate to "false" So that large swaths of the configuration can be taken out of the configuration with zero run-time memory or CPU impact Alan T. DeKok@2013-05-15T16:13:33Z Files modified: * src/main/modules.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/11d1a7e7fce162d55e01… ====== Moved "exec_trigger" to threads.c It's a function which is useful only for the server core, and requires access to the mainconfig data structure Alan T. DeKok@2013-05-15T15:49:25Z Files modified: * src/main/exec.c * src/main/threads.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/dbbacc4449dcc7821896… ====== -- This commit summary was generated @2013-05-16T00:00:07Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

rad_unlockfd
by Brian Candler 15 May '13

15 May '13

I noticed something odd in rad_unlockfd - both 2.x.x and master. int rad_unlockfd(int fd, int lock_len) { ... fl.l_type = F_WRLCK; fl.l_whence = SEEK_CUR; return fcntl(fd, F_UNLCK, (void *)&fl); However, according to the Linux manpage for fcntl: F_SETLK (struct flock *) Acquire a lock (when l_type is F_RDLCK or F_WRLCK) or release a lock (when l_type is F_UNLCK) on the bytes specified by the l_whence, l_start, and l_len fields of lock. If a conflicting lock is held by another process, this call returns -1 and sets errno to EACCES or EAGAIN. That is: to unlock, the command should be F_SETLK(W) and the l_type should be F_UNLCK. The OSX (BSD) manpage agrees. On Linux, the constant F_UNLCK is 2, so calling fcntl(fd, F_UNLCK...) is the same as calling fcntl(fd, F_SETFD...) The other oddity is using SEEK_CUR for both lock and unlock. If you have written to the file in the mean time, then the current file offset will have changed, so you may end up unlocking a different byte range to the one you locked. I'd say SEEK_SET with offset 0 and length 0 (which locks or unlocks the entire file, including past its end) is safest - at least when unlocking. As far as I can see, only rad_utmp calls this function, so the impact is not huge. Regards, Brian.

2 1

fork() after pthread_mutex_init()
by Edgar Fuß 15 May '13

15 May '13

What's the rationale behind calling read_mainconfig() before daemonizing? There's a comment /* Read the configuration files, BEFORE doing anything else. */ suggesting this is intentional. However, during that, mutexes are created via pthread_mutex_init(). To my understanding, fork()ing while holding mutexes (and without intervening via a pthread_atfork() handler) calls for undefined behaviour. Indeed, on NetBSD, I get radiusd: Error detected by libpthread: Invalid mutex. Detected by file [...], line [...], function "pthread_mutex_lock_slow". See pthread(3) for information. unless I use one of the dont_fork options. Running radiusd -f & works as a workaround. Also, moving the configuration reading block after the daemonizing block seems to work, but I'm afraid there was a good reason for reading the configuration before doing the fork.

5 6

MODULE DEV: Problem adding an attribute to access-accept message
by Ivan Ostres 15 May '13

15 May '13

Hi List! I am learning how to write a custom module (in my case for authorization in prepaid billing) and I need to add some custom attributes (both standard and VSA) to access-accept message. I am trying to do this in mod_authorize: service = pairfind(request->packet->vps, CISCO_SSG_SERVICE_INFO, VENDOR_CISCO, TAG_ANY); if (service != NULL) { RDEBUG("Found CISCO_SSG_SERVICE_INFO -> Prepaid billing request"); pairmake_reply("Idle-Timeout",10, T_OP_ADD); request->reply->code = PW_AUTHENTICATION_ACK; return RLM_MODULE_OK; } I can see in a log that this part of code is used: (0) prepaid : Found CISCO_SSG_SERVICE_INFO -> Prepaid billing request (0) [prepaid] = handled (0) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default (0) group post-auth { (0) - entering group post-auth {...} (0) [exec] = noop Sending Access-Accept of id 12 from 0.0.0.0 port 1812 to 192.168.123.196 port 49444 (0) Finished request 0. but there is no "Idle-Timeout" in outgoing Access-Accept. I cannot figure out what am I doing wrong... Please help! BR, iostres

3 4

Commit report for master branch
by announce＠freeradius.org 14 May '13

14 May '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== More doxygen warnings Arran Cudbard-Bell@2013-04-09T22:18:10Z Files modified: * src/main/xlat.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/48d46e233fa9dfa23522… ====== Fix doxygen documentation Arran Cudbard-Bell@2013-04-09T21:19:23Z Files modified: * src/main/xlat.c * src/modules/rlm_rest/rest.c * src/modules/rlm_yubikey/rlm_yubikey.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/a0015b19255051a851c0… ====== doxygen updates Alan T. DeKok@2013-04-09T21:01:40Z Files modified: * src/main/xlat.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/26ec9984f97d4846715b… ====== Fix typo Alan T. DeKok@2013-04-09T21:00:56Z Files modified: * src/main/modcall.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/97002a4776741ed0d4af… ====== Brand new xlat functions. All xlat's are now run through the new routines. The old (i.e. horrific) routines are gone. The result is more functionality, simpler debugging, better errors, and ~400 lines fewer code. The downside is that (for the next day or so), calling a module xlat routine MAY mean that it gets expanded twice. i.e. the old code would do %{mod: foo} and pass "foo" to module "mod". The new code (for reasons of simplicity) xlat's "foo" before passing it to module "mod". Some modules (i.e. expr) call radius_xlat again. This is now wrong. The fix is to update the signature of the xlat functions so that "fmt" is no longer a "const char*", as it is now a talloc'd string. Once that's done, all of the modules will need a visual pass-through to remove the extra recursive calls to xlat. We've also deleted xlat registration for %{1} and %[request:..} The regex and attribute parsing is now done by the xlat core. In the future, it should be passed to a module-specific "parse" or "validate" routine. That routine would ensure that the RHS of an xlat expansion is valid Alan T. DeKok@2013-04-09T21:00:56Z Files modified: * src/main/xlat.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/5deec98232056e3fdff9… ====== Fix network / host byte order issue Alan T. DeKok@2013-04-09T21:00:56Z Files modified: * src/lib/print.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/b2a2fb7e465f597fa3e0… ====== Remove radiusd.pid on failed kill Alan T. DeKok@2013-04-09T20:39:10Z Files modified: * src/tests/Makefile Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/8aace8a6e3f19f73e503… ====== Clean radius.log and gdb.log only when re-starting the server Alan T. DeKok@2013-04-09T20:31:50Z Files modified: * src/tests/Makefile Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/6a14f05101eb318bc87e… ====== Do a better job of cleanin up before running the tests Alan T. DeKok@2013-04-09T20:22:33Z Files modified: * src/tests/Makefile Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/ab919e91228c273ad188… ====== Don't shadow globals Alan T. DeKok@2013-04-09T18:10:00Z Files modified: * src/main/radwho.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/d4f7aed442584fe58e82… ====== Added vp_asprintf() for VPs prints the string value of a VP to a talloc'd buffer, and returns the buffer Alan T. DeKok@2013-04-09T14:43:32Z Files modified: * src/include/libradius.h * src/lib/print.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/22628b7ebbbe440b1188… ====== -- This commit summary was generated @2013-04-10T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

4 13

Commit report for master branch
by announce＠freeradius.org 14 May '13

14 May '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Move many common functions to a common library And add stupid wrappers for rad_fork() and rad_waitpid() We can go fix those later... Alan T. DeKok@2013-05-14T22:20:30Z Files modified: * src/main/all.mk * src/main/libfreeradius-server.mk * src/main/radattr.c * src/main/radattr.mk * src/main/radconf2xml.c * src/main/radconf2xml.mk * src/main/radiusd.mk * src/main/radmin.c * src/main/radmin.mk * src/main/radwho.c * src/main/radwho.mk Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/83181ee2ce1c70978396… ====== Remove use of global variable Alan T. DeKok@2013-05-14T22:20:05Z Files modified: * src/main/exec.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/c83dbcd187ab37d92cd0… ====== Make other programs use evaluate.c, too. We'll move these programs into a utility library soon... Alan T. DeKok@2013-05-14T20:48:54Z Files modified: * src/main/radconf2xml.mk * src/main/radmin.mk * src/main/radwho.mk Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/2facd7cc028790a752d4… ====== Evaluate some conditions at parse time. If the LHS and RHS are both DATA, then evaluate them statically, and turn them into true / false conditions Alan T. DeKok@2013-05-14T20:07:20Z Files modified: * src/main/parser.c * src/main/radattr.mk * src/tests/condition.txt Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/b154ac7f52a19414072a… ====== Added 'true' and 'false' as top-level concepts. So that "false && FOO" gets mapped to "false" Nice little optimizations... Alan T. DeKok@2013-05-14T19:45:08Z Files modified: * src/include/parser.h * src/main/evaluate.c * src/main/parser.c * src/tests/condition.txt Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/d2015e7993ccbe1e98e3… ====== Parse literals into VALUE_PAIR_DATA at compile time. So that we have better errors. However... we don't have type-specific parse errors, as the current error API in conditions doesn't allow for that. Alan T. DeKok@2013-05-14T19:12:20Z Files modified: * src/main/evaluate.c * src/main/parser.c * src/tests/condition.txt Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/e22074fec555226f5d3f… ====== Print names for enumerated types Alan T. DeKok@2013-05-14T17:27:20Z Files modified: * src/lib/print.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/ce4934170984355a0cf6… ====== Added template "data" type So that the data can be stored as pre-parsed data, instead of as strings parsed at run-time Alan T. DeKok@2013-05-14T17:27:11Z Files modified: * src/include/map.h * src/main/evaluate.c * src/main/map.c * src/main/valuepair.c * src/tests/condition.txt Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/d1ca41be0e5a6472adf9… ====== -- This commit summary was generated @2013-05-15T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

New feature in v3: cast!
by Alan DeKok 14 May '13

14 May '13

Not fishing casts, but data type casts. :) See "man unlang" for details. if (<ipaddr>127.0.0.1 < &Framed-IP-Address) { ... } It allows you to do type-specific comparisons. v2 usually did string comparisons for conditions. To get type-specific comparisons, you sometimes needed to put the data into an intermediate variable. That was ugly. The casting is nicer. That being said, the above example *did* work in v2, with some changes: if (Framed-IP-Address > 127.0.0.1) { ... } That worked by parsing the RHS into a temporary variable, and then doing type-specific comparisons. But you couldn't do: if (<date>"January 1 2014" < "%{sql: SELECT ...}") { ... } You had to put one or the other of the strings into an intermediate variable. This is another minor feature which just makes things nicer. Alan DeKok.

5 29

bugfix
by Marek Sterzik 14 May '13

14 May '13

Hello Guys, I am trying to contribute one bugfix to the freeradius server. I have read all the stuff how to contribute and I understand, that you really like pull requests. But no, I will not create any github account at all. I am not using it and I am not going to join the freeradius developer community, since I do not have time for it. I think it is completely stupid to create an github account which I will forget next week. And therefore I will not do it. My patch solving an issue of not working of the perl function radiusd::radlog in rlm_perl is attached. Please feel free to use it however you want. And I am really sorry not providing you the expected pull request. After sending this e-mail I am going to unsubscribe from the freeradius-devel list, so if you want to tell me anything (I am not expecting so), please write on my e-mail address marek.sterzik(a)gmail.com Best regards Marek Sterzik

4 4

How to convert the Reply-Message as challenge
by Sankalp Dubey 14 May '13

14 May '13

Hi We have a radius server which does not understand EAP and we are using Free Radius as EAP-PEAP-GTC proxy-inner-tunnel. As the present code does not set User-Password in EAP-PEAP-GTC mode so we made the following code changes: 1. File: src/modules/rlm_eap/types/rlm_eap_gtc/rlm_eap_gtc.c In function gtc_initiate(void *type_data, EAP_HANDLER *handler) Added following lines with reference to the src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c file #ifdef WITH_PROXY /* * The EAP session doesn't have enough information to * proxy the "inside EAP" protocol. Disable EAP proxying. */ handler->request->options &= ~RAD_REQUEST_OPTION_PROXY_EAP; #endif 2. We also added the following functions in rlm_eap_gtc.c file static int gtc_postproxy(EAP_HANDLER *handler, void *tunnel_data) This functions doesn't seem to be called. 3. gtc_autheticate changes: #ifdef WITH_PROXY /* * If this options is set, then we do NOT authenticate the * user here. Instead, now that we've added the PAP * attributes to the request, we STOP, and let the outer * tunnel code handle it. * * This means that the outer tunnel code will DELETE the * EAP attributes, and proxy the PAP attributes to a * home server. */ if (handler->request->options & RAD_REQUEST_OPTION_PROXY_EAP) { /* * Set up the callbacks for the tunnel */ eap_tunnel_data_t *tunnel; tunnel = rad_malloc(sizeof(*tunnel)); memset(tunnel, 0, sizeof(*tunnel)); tunnel->tls_session = type_data; tunnel->callback = gtc_postproxy; /* * Associate the callback with the request. */ rcode = request_data_add(handler->request, handler->request->proxy, REQUEST_DATA_EAP_TUNNEL_CALLBACK, tunnel, free); rad_assert(rcode == 0); pairdelete(&handler->request->packet->vps, PW_STATE); return 1; } #endif The modified rlm_eap_gtc.c is attached for reference. With these code changes we are able to set the User-Password in EAP-PEAP-GTC proxy mode. Also, debug message from gtc_postproxy is not visible in the log file. However, when the proxied-to RADIUS Server throws Access-Challenge the same is not forwarded by Free RADIUS to the client i.e. Reply-Message is stripped by Free RADIUS. Please let us know how to convert the Reply-Message as challenge for the client. Thanks n regards Sankalp Dubey

1 0

Commit report for master branch
by announce＠freeradius.org 13 May '13

13 May '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Make radlog available in the "init" function of the Perl code Alan T. DeKok@2013-05-13T20:29:59Z Files modified: * src/modules/rlm_perl/rlm_perl.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/33115285b8f852c5c188… ====== Checks for empty expansions Alan T. DeKok@2013-05-13T15:06:28Z Files modified: * src/main/xlat.c * src/tests/xlat.txt Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/c4f13b3fe8560cc22f19… ====== Start of type checks on RHS of conditions Alan T. DeKok@2013-05-13T14:58:11Z Files modified: * src/main/parser.c * src/tests/condition.txt Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/91e9b9e237d9df204d4b… ====== Disallow RHS bare words for string attributes User-Name == "bob" is OK User-Name == bob is not Alan T. DeKok@2013-05-13T01:28:53Z Files modified: * src/main/parser.c * src/tests/condition.txt Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/900117a4c652b1465f3b… ====== Add single quotes around literals for attributes of type string Alan T. DeKok@2013-05-13T01:28:36Z Files modified: * src/main/map.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/a64099b8bdc2678bcb44… ====== -- This commit summary was generated @2013-05-14T00:00:09Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0