July 2013 - Freeradius-Devel - lists.freeradius.org

IPv6 support
by Arran Cudbard-Bell 22 Jul '13

22 Jul '13

The server has IPv6 support in terms of it can send and receive RADIUS packets with IPv6, but lacks support in some modules which assumed NAS-IP-Address and Framed-IP-Address would always be IPv4. Do people have a preference for the default SQL schemas whether fields like NAS-IP-Address are modified to take either an IPv4 or IPv6 or whether we use distinct fields? The same goes for Framed-IP-Address and Framed-IPv6-Prefix. -Arran

4 6

2.x.x (and earier?): yet another decoding SSHA issue
by Stefan Winter 22 Jul '13

22 Jul '13

Hi, here's yet another thing which caused spurious authentication failures; luckily I was accidently in debug mode looking for something else when I found the cause for some failed auth: +++- entering policy redundant {...} [sql-imap-hash] expand: %{User-Name} -> pgloden [sql-imap-hash] sql_set_user escaped user --> 'pgloden' rlm_sql (sql-imap-hash): Reserving sql socket id: 7 [sql-imap-hash] expand: (SELECT id, username, attribute, value, op FROM check_imap_ssha1 WHERE username='%{SQL-User-Name}') -> (SELECT id, username, attribute, value, op FROM check_imap_ssha1 WHERE username='pgloden') rlm_sql_mysql: query: (SELECT id, username, attribute, value, op FROM check_imap_ssha1 WHERE username='pgloden') rlm_sql: Failed to create the pair: Non-hex characters at QX rlm_sql (sql-imap-hash): Error getting data from database [sql-imap-hash] SQL query error; rejecting user The query works just fine and returns a base64-encoded SSHA1 hash of a user's password. The base64 blob happens to start with the two characters "0X" (and then continues with QX, which is in the error message). It seems like the query response parser tries to be overly clever and thinks that anything starting with 0X is a hex number and needs decoding. This, of course, fails. Needsless to say that the schema doesn't suggest an integer at all, it's a varchar(168). The workaround right now for us is to set the hashed password, see if it happens to start with 0X, and if so, try with a different salt. That is obviously not very ideal. I would appreciate if 2.2.1 could stop hex-decoding non-hex values :-) I only saw this right now on yesterday's GIT; no idea if we've been hitting the wall with this earlier. The users in question didn't phone up our helpdesk yet, so maybe this crept in very recently? Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

6 27

Commit report for master branch
by announce＠freeradius.org 21 Jul '13

21 Jul '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Always pass -export-dynamic as a direct linker argument GCC accepts the -export-dynamic argument, and will make decisions about whether to include it in the linker options. On OSX it does not include it in the linker options. clang ignores -export-dynamic even when linking, and newer versions when passed -rdynamic, will always pass -export-dynamic in the linker options, which causes linking to fail on OSX. The solution seems to be to pass -export-dynamic directly to the linker for LINUX/FreeBSD/NetBSD i.e. -Wl,-export-dynamic. Arran Cudbard-Bell@2013-07-21T23:54:10Z Files modified: * scripts/jlibtool.c * src/main/auth.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/f104b4fc1950f4004d99… ====== Remove -rdynamic again It's now become more urgent we have a proper fix for this as clang 3.4 accepts the -rdynamic flag. Unfortunately, unlike gcc, it just blindly emits -export-dynamic in the list of arguments to the linker which causes the ld to emit and error and the build fails. Arran Cudbard-Bell@2013-07-21T19:07:25Z Files modified: * scripts/libtool.mk Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/97be6fec10ede2b78eaf… ====== Ignore cui.sqlite generated on make test Arran Cudbard-Bell@2013-07-21T19:04:50Z Files modified: * src/tests/.gitignore Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/a299cee514bd1f0b8d09… ====== Use numbered macros for RDEBUG_ENABLED Arran Cudbard-Bell@2013-07-21T18:27:42Z Files modified: * src/include/log.h * src/main/xlat.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/166e9ff90be0d0865705… ====== Better debugging for dlopen Arran Cudbard-Bell@2013-07-21T18:22:39Z Files modified: * src/main/modules.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/43b1b27875d2ae452656… ====== Do RTLD_NOW if built with NDEBUG Arran Cudbard-Bell@2013-07-21T18:22:39Z Files modified: * src/main/modules.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/93cba2d660b0218502c2… ====== Add the DEBUG_ENABLED macro Arran Cudbard-Bell@2013-07-21T18:22:39Z Files modified: * src/include/log.h * src/main/log.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/fbc95b8a883633356ea6… ====== Do config check with maximum verbosity Arran Cudbard-Bell@2013-07-21T18:22:39Z Files modified: * Makefile Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/a051573dbdcf2df9b995… ====== Add function for creating IP address pairs from value of unknown type Arran Cudbard-Bell@2013-07-21T18:22:39Z Files modified: * src/include/libradius.h * src/lib/valuepair.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/2fc39aa6419c98ba185f… ====== Log fix Arran Cudbard-Bell@2013-07-21T18:22:39Z Files modified: * src/include/libradius.h * src/include/radius.h * src/lib/log.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/53e55afcc739637441f7… ====== Add fr_assert (soft asset which produces error messages) Arran Cudbard-Bell@2013-07-21T18:22:39Z Files modified: * src/include/libradius.h * src/lib/log.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/818cb62deaee3e71d3df… ====== Fix some more spelling mistakes Arran Cudbard-Bell@2013-07-21T00:11:35Z Files modified: * raddb/certs/README * raddb/certs/xpextensions * raddb/clients.conf * raddb/experimental.conf * raddb/mods-available/cache_eap * raddb/mods-available/counter * raddb/mods-available/cui * raddb/mods-available/detail * raddb/mods-available/idn * raddb/mods-available/inner-eap * raddb/mods-available/ldap * raddb/mods-available/logintime * raddb/mods-available/otp * raddb/mods-available/preprocess * raddb/mods-available/redis * raddb/mods-available/sql * raddb/mods-available/yubikey * raddb/mods-config/attr_filter/access_challenge * raddb/mods-config/attr_filter/access_reject Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/adfdfe73232081f24f05… ====== -- This commit summary was generated @2013-07-22T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for master branch
by announce＠freeradius.org 20 Jul '13

20 Jul '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Merge pull request #384 from alanbuxey/master myriad of spelling mistakes and corrected some documentation. Arran Cudbard-Bell@2013-07-20T21:37:57Z Files modified: * raddb/README.rst * raddb/experimental.conf * raddb/mods-available/cache_eap * raddb/mods-available/cui * raddb/mods-available/dynamic_clients * raddb/mods-available/eap * raddb/mods-available/ippool * raddb/mods-available/ldap * raddb/mods-available/logintime * raddb/mods-available/passwd * raddb/mods-available/preprocess * raddb/mods-available/realm * raddb/mods-available/wimax * raddb/mods-available/yubikey * raddb/mods-config/preprocess/huntgroups * raddb/mods-config/sql/counter/mysql/queries.conf * raddb/mods-config/sql/counter/postgresql/queries.conf * raddb/policy.d/filter * raddb/proxy.conf * raddb/radiusd.conf.in * raddb/sites-available/buffered-sql * raddb/sites-available/control-socket * raddb/sites-available/default * raddb/sites-available/example * raddb/sites-available/tls * raddb/vmpsd.conf.in * scripts/min-includes.pl * src/modules/rlm_detail/rlm_detail.c * src/modules/rlm_eap/rlm_eap.c * src/tests/eapsim-03/radiusd-example.txt Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/e5aefe007dbf8c7c884b… ====== myriad of spelling mistakes and corrected some documentation. also removed the part saying control-socket was highly experiment. Alan Buxey@2013-07-20T21:26:38Z Files modified: * raddb/README.rst * raddb/experimental.conf * raddb/mods-available/cache_eap * raddb/mods-available/cui * raddb/mods-available/dynamic_clients * raddb/mods-available/eap * raddb/mods-available/ippool * raddb/mods-available/ldap * raddb/mods-available/logintime * raddb/mods-available/passwd * raddb/mods-available/preprocess * raddb/mods-available/realm * raddb/mods-available/wimax * raddb/mods-available/yubikey * raddb/mods-config/preprocess/huntgroups * raddb/mods-config/sql/counter/mysql/queries.conf * raddb/mods-config/sql/counter/postgresql/queries.conf * raddb/policy.d/filter * raddb/proxy.conf * raddb/radiusd.conf.in * raddb/sites-available/buffered-sql * raddb/sites-available/control-socket * raddb/sites-available/default * raddb/sites-available/example * raddb/sites-available/tls * raddb/vmpsd.conf.in * scripts/min-includes.pl * src/modules/rlm_detail/rlm_detail.c * src/modules/rlm_eap/rlm_eap.c * src/tests/eapsim-03/radiusd-example.txt Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/47f03af2b9e82336fb4c… ====== RH requires that header files are not arch specific The main issue with the FR headers is that rpaths.h contains a macro 'LIBDIR' which changes depending on the arch. The fix is to not install rpaths.h, and instead build it's values libfreeradius-server. Arran Cudbard-Bell@2013-07-20T09:37:23Z Files modified: * Make.inc.in * src/include/all.mk * src/include/radiusd.h * src/main/radattr.c * src/main/radclient.c * src/main/radconf2xml.c * src/main/radmin.c * src/main/radsniff.c * src/main/util.c * src/modules/proto_dhcp/dhcpclient.c * src/modules/rlm_eap/radeapclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/0e03de383e6840307387… ====== -- This commit summary was generated @2013-07-21T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for master branch
by announce＠freeradius.org 19 Jul '13

19 Jul '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Add length to compliment strlen Arran Cudbard-Bell@2013-07-19T23:43:35Z Files modified: * src/main/xlat.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/67f00ee090f9776b4c2d… ====== Fix typo in TLS macros Arran Cudbard-Bell@2013-07-19T23:35:19Z Files modified: * src/include/threads.h Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/52e333d14d398b51df7a… ====== -- This commit summary was generated @2013-07-20T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v2.x.x branch
by announce＠freeradius.org 19 Jul '13

19 Jul '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Fix typo in TLS macros Arran Cudbard-Bell@2013-07-19T23:40:52Z Files modified: * src/include/threads.h Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/d239616aa365ac343b6d… ====== -- This commit summary was generated @2013-07-20T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Patch for updated EAP-TNC support for freeradius from tnc@fhh
by Avesh Agarwal 19 Jul '13

19 Jul '13

Hello Alan, I have created a forked version of latest freeradius v2 branch on github and merged the updated EAP-TNC support from tnch@fhh. The link is here: https://github.com/aveshagarwal/freeradius-server/commit/40104449aa7bce926a… I have tested the patch on a testbed with 802.1x managed switch and wpa_supplicant and freeradius-server with EAP-TTLS as outer tunnel and EAP-MD5 and EAP-TNC as two inner EAP methods. I would appreciate any feedback on this patch to get it merged upstream. Thanks and Regards Avesh On Fri, Feb 1, 2013 at 4:32 PM, Alan DeKok <aland(a)deployingradius.com>wrote: > Avesh Agarwal wrote: > > Thanks for your response. But if you could tell some specific reasons > > why it is not enabled by default that would really help me understand > > what is required to be done. > > Because I don't think it works. I haven't had time to look into it. > > > It is here: https://github.com/trustatfhh/tnc-fhh > > OK. > > > Yes, I agree. But some specifics would really help. > > I don't have many. Make sure it works. Make sure the code is clean, > and formatted correctly. Make sure the patches are readable. > > I know pretty much nothing about EAP-TNC. So all I can give is > general guidelines for getting code into the server. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/devel.html >

3 13

FreeRadius 2.2.1 + 3.0 and the updated dictionary.ukerna?
by stefan.paetow＠diamond.ac.uk 19 Jul '13

19 Jul '13

Sorry to bring this up, but it doesn't look like the JANET dictionary (dictionary.ukerna) has been updated with the updated GSS-* attribute Ids: ATTRIBUTE GSS-Acceptor-Service-Name 164 string ATTRIBUTE GSS-Acceptor-Host-Name 165 string ATTRIBUTE GSS-Acceptor-Service-Specific 166 string ATTRIBUTE GSS-Acceptor-Realm-Name 167 string Both in the master and the 2.x.x branch, the numbers are still all 128-131. AFAIK SAML-AAA-Assertion remains 132? I've cc:ed Sam Hartman in in case I'm horribly wrong. Is that intentional or... did someone just forget? :-) Just checking. Stefan Paetow Software Engineer +44 1235 778812 Diamond Light Source Ltd. Diamond House, Harwell Science and Innovation Campus Didcot, Oxfordshire, OX11 0DE -- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom

5 9

Commit report for master branch
by announce＠freeradius.org 18 Jul '13

18 Jul '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Fixup python examples Arran Cudbard-Bell@2013-07-18T19:38:41Z Files modified: * src/modules/rlm_python/all.mk.in * src/modules/rlm_python/example.py * src/modules/rlm_python/radiusd.py * src/modules/rlm_python/radiusd_test.py Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/edc6cf1da252399ea3f0… ====== No longer applicable Arran Cudbard-Bell@2013-07-18T19:22:16Z Files modified: * src/modules/rlm_python/rlm_python.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/6542d0065f214e424327… ====== Add support for setting python_path from within module config Arran Cudbard-Bell@2013-07-18T19:12:52Z Files modified: * raddb/mods-available/python * src/modules/rlm_python/rlm_python.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/50bb169ec87bccc5a73d… ====== Typo Arran Cudbard-Bell@2013-07-18T18:59:32Z Files modified: * raddb/mods-available/python Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/d720af13c29b0d999e3f… ====== Typo Arran Cudbard-Bell@2013-07-18T18:50:17Z Files modified: * raddb/README.rst Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/7c7d4e7bb24e0a0ce99f… ====== mod_error needs to be called with the GIL even though the server is running in single threaded mode, and the error is during instantiation Arran Cudbard-Bell@2013-07-18T18:31:25Z Files modified: * src/modules/rlm_python/rlm_python.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/700fdc31f99758fc1f04… ====== More python fixes... Arran Cudbard-Bell@2013-07-18T15:12:13Z Files modified: * src/modules/rlm_python/rlm_python.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/15bc47032a7a0ebe42bd… ====== Fixup radsniff logging macros Arran Cudbard-Bell@2013-07-18T14:16:45Z Files modified: * src/main/radsniff.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/fb63aa9d0b9ae3e58847… ====== Do python cleanup properly on thread exit Arran Cudbard-Bell@2013-07-18T14:16:30Z Files modified: * src/modules/rlm_python/rlm_python.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/813f37fb6d6325d13f6e… ====== Explicitly free libradius error buffer on thread exit Arran Cudbard-Bell@2013-07-18T14:16:04Z Files modified: * src/lib/log.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/0e7f5388f867be8a9e15… ====== Add support for registering destructors for TLS Arran Cudbard-Bell@2013-07-18T14:13:06Z Files modified: * src/include/threads.h Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/ad5a3dde696e1f43ef39… ====== -- This commit summary was generated @2013-07-19T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v2.x.x branch
by announce＠freeradius.org 18 Jul '13

18 Jul '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Note TLS fixes for python Arran Cudbard-Bell@2013-07-18T18:40:22Z Files modified: * doc/ChangeLog Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/e6c924479723dde30ab8… ====== mod_error needs to be called with the GIL even though the server is running in single threaded mode, and the error is during instantiation Arran Cudbard-Bell@2013-07-18T18:35:48Z Files modified: * src/modules/rlm_python/rlm_python.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/1323ca50f4fd03cc7651… ====== Trip whitespace from base64 strings Arran Cudbard-Bell@2013-07-18T18:08:41Z Files modified: * src/modules/rlm_expr/rlm_expr.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/26c392a750c4600d7edb… ====== More python fixes Arran Cudbard-Bell@2013-07-18T18:08:27Z Files modified: * src/modules/rlm_python/rlm_python.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/334bd1ee2dbc656c9f3a… ====== Do python cleanup properly on thread exit Arran Cudbard-Bell@2013-07-18T15:14:14Z Files modified: * src/modules/rlm_python/rlm_python.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/b41d2cc2b638d5a785a8… ====== Add support for registering destructors for TLS Arran Cudbard-Bell@2013-07-18T14:17:20Z Files modified: * src/include/threads.h Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/74b6d84d5a0e0e6df201… ====== -- This commit summary was generated @2013-07-19T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0