August 2013 - Freeradius-Devel - lists.freeradius.org

Commit report for master branch
by announce＠freeradius.org 24 Aug '13

24 Aug '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Load Python with RTLD_GLOBAL to ensure symbols are accessible by dynload libraries / C extensions (by Zach Kanzler) Arran Cudbard-Bell@2013-08-24T20:25:19Z Files modified: * src/modules/rlm_python/rlm_python.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/229cc969c899b488d5dc… ====== Move the stringify macros to build.h Arran Cudbard-Bell@2013-08-24T19:04:08Z Files modified: * src/include/build.h * src/include/conffile.h * src/main/detail.c * src/main/mainconfig.c * src/main/realms.c * src/main/xlat.c * src/modules/rlm_perl/rlm_perl.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/6ee0aee1791b6d0a821b… ====== If there's no packet, don't add module_failure_msg. Closes #407 Alan T. DeKok@2013-08-24T16:09:24Z Files modified: * src/main/valuepair.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/4b42f7e23505998c10da… ====== -- This commit summary was generated @2013-08-25T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for master branch
by announce＠freeradius.org 23 Aug '13

23 Aug '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Don't set home server to NULL. It's needed for other things Alan T. DeKok@2013-08-23T21:37:33Z Files modified: * src/main/process.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/f8bab9a741e561eedf0c… ====== Clean up "close socket" routines. We use the new rbtree DeleteOrder when walking over the packet list. When the "eol tcp/proxy listener" callback is run, it can return "please delete this node", instead of calling rbtree_delete. Doing that allows the walker to be aware of deletions, unlike before. This turned out to make the code simpler, and the whole event fd handling has become more robust. Alan T. DeKok (via Arran Cudbard-Bell)@2013-08-23T15:20:05Z Files modified: * src/include/packet.h * src/include/radiusd.h * src/lib/packet.c * src/main/command.c * src/main/listen.c * src/main/process.c * src/main/radclient.c * src/main/tls_listen.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/7801a82ecba3cecb108f… ====== Build the rbmonkey test tool Alan T. DeKok (via Arran Cudbard-Bell)@2013-08-23T15:09:33Z Files modified: * src/all.mk * src/tests/all.mk * src/tests/rbmonkey.mk Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/b4b2f82bdc6384467dc8… ====== Formatting and warning fixes Alan T. DeKok (via Arran Cudbard-Bell)@2013-08-23T15:09:33Z Files modified: * src/tests/rbmonkey.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/0054a61aafbbb6eddafb… ====== Fix a typo Alan T. DeKok@2013-08-23T15:06:46Z Files modified: * src/main/modcall.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/d10d00d252d6b09a2edf… ====== Whoops... handle MOD_CASE, too Alan T. DeKok@2013-08-23T14:46:24Z Files modified: * src/main/modcall.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/4acea73e87b945c6c8a9… ====== Rewrite the modcall MOD_* handlers. Updates #404. The old code wasn't worth debugging. With a few hours work, the new code is simpler, more understandable, and avoids the bug entirely. Alan T. DeKok@2013-08-23T14:32:15Z Files modified: * src/main/modcall.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/43389b7be6e9e5c121a1… ====== Merge pull request #413 from olivierbeytrison/rlm_cache-refresh enhancements to rlm_cache Arran Cudbard-Bell@2013-08-23T10:38:28Z Files modified: * raddb/mods-available/cache * share/dictionary.freeradius.internal * src/modules/rlm_cache/rlm_cache.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/8a38aea824e5e4766510… ====== Allow to delete and recreate a cache entry with a single call to cache Olivier Beytrison@2013-08-22T17:20:38Z Files modified: * raddb/mods-available/cache * share/dictionary.freeradius.internal * src/modules/rlm_cache/rlm_cache.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/ffa9ec8fa5cab1d4f025… ====== Typo Arran Cudbard-Bell@2013-08-23T00:51:35Z Files modified: * src/main/modcall.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/8ceed95e64be43e2441e… ====== -- This commit summary was generated @2013-08-24T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

3.0 release schedule
by John Dennis 23 Aug '13

23 Aug '13

rc0 was released on July 11th. Since then I haven't heard anything about the release schedule. Monitoring the list shows some issues were discovered in rc0 which needed attention. Will there be an rc1? If so when? Is there an anticipated release date for 3.0 gold? I ask because RHEL-7 is moving along and I think everyone would like to see FreeRADIUS 3.0 be in RHEL-7 instead of 2.2.0. But the window of opportunity is rapidly closing. I cannot give you internal milestone dates, but I can say that an exception is being made for FreeRADIUS and management is quite concerned about a major new version landing in RHEL-7 without adequate preparation and a significant discussion is occurring on this topic and it would help if I could provide some clarifying information for our planning purposes. -- John

2 2

Commit report for master branch
by announce＠freeradius.org 22 Aug '13

22 Aug '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Merge pull request #412 from armitasp/master cui sql fixes Arran Cudbard-Bell@2013-08-22T14:39:56Z Files modified: * raddb/mods-available/cui * raddb/mods-config/sql/cui/mysql/queries.conf * raddb/mods-config/sql/cui/sqlite/queries.conf Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/d68402e8b2afb992ef6d… ====== added helpful comments to cui module GEANT GN3 JRA3 T1@2013-08-22T14:10:40Z Files modified: * raddb/mods-available/cui Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/8a8da02bc1e37c30ba08… ====== fixed cui post-auth queries for mysql GEANT GN3 JRA3 T1@2013-08-22T13:56:00Z Files modified: * raddb/mods-config/sql/cui/mysql/queries.conf Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/4286dfc461327b5032b3… ====== fixed cui post-auth queries for sqlite GEANT GN3 JRA3 T1@2013-08-22T13:54:24Z Files modified: * raddb/mods-config/sql/cui/sqlite/queries.conf Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/1d7315be59eaeed639c7… ====== -- This commit summary was generated @2013-08-23T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for master branch
by announce＠freeradius.org 21 Aug '13

21 Aug '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Merge pull request #406 from alanbuxey/master removed 2 compilation warnings in rlm_python Arran Cudbard-Bell@2013-08-21T17:25:48Z Files modified: * src/modules/rlm_python/rlm_python.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/1d444dbf6c4db4781828… ====== removed 2 compilation warnings in rlm_python warning: suggest explicit braces to avoid ambiguous ‘else’ - used braces to remove these warnings. Alan Buxey@2013-08-18T23:45:49Z Files modified: * src/modules/rlm_python/rlm_python.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/006d0db1b335eb5876cd… ====== -- This commit summary was generated @2013-08-22T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Request - Modification to Status Server to have Clients Stats in separate VSAs
by Peter Lambrechtsen 21 Aug '13

21 Aug '13

I'm currently playing around with the Status Server for stats gathering and was hoping to have a minor change in the interface to support extracting the Client information under different VSAs rather than reusing the current "FreeRADIUS-Total-*" VSAs. It's not particularly logical in my view to have the same VSA returned twice in a Access-Accept, and then needing to determine if it's the client related one or the global server related one by it's sequence in the payload. It would make more sense in my mind to have the Client stats as separate VSAs. For this new VSAs for the FreeRADIUS-Client-* or FreeRADIUS-Stats-Client-* would be required since then the Total server values vs . I'm suggesting adding add them onto the current list numbering scheme or the other option is to add 100 to the current numbers. https://github.com/FreeRADIUS/freeradius-server/blob/master/share/dictionar… # # Client authentication statistics for packets received by the server. # ATTRIBUTE FreeRADIUS-Client-Access-Requests 186 integer ... ATTRIBUTE FreeRADIUS-Client-Auth-Unknown-Types 195 integer # # Client accounting statistics for packets received by the server. # ATTRIBUTE FreeRADIUS-Client-Accounting-Requests 196 integer ... ATTRIBUTE FreeRADIUS-Client-Acct-Unknown-Types 202 integer or # # Client authentication statistics for packets received by the server. # ATTRIBUTE FreeRADIUS-Client-Access-Requests 228 integer ... ATTRIBUTE FreeRADIUS-Client-Auth-Unknown-Types 237 integer # # Client accounting statistics for packets received by the server. # ATTRIBUTE FreeRADIUS-Client-Accounting-Requests 248 integer ... ATTRIBUTE FreeRADIUS-Client-Acct-Unknown-Types 254 integer Then update the stats to use those AVPs: https://github.com/FreeRADIUS/freeradius-server/blob/master/src/main/stats.c Line 406: static fr_stats2vp client_authvp[] = { { 186, offsetof(fr_stats_t, total_requests) }, ... { 195, offsetof(fr_stats_t, total_unknown_types) }, { 0, 0 } }; #ifdef WITH_ACCOUNTING static fr_stats2vp client_acctvp[] = { { 196, offsetof(fr_stats_t, total_requests) }, ... { 202, offsetof(fr_stats_t, total_unknown_types) }, { 0, 0 } }; #endif Which ever you believe is the more appropriate range to use either adding onto the sequential numbering scheme, or adding 100 (I suspect adding onto the existing range would be better) And also change around line 624 where it does the validation to see if you want client information or not: if ((flag->vp_integer & 0x01) != 0) { request_stats_addvp(request, client_authvp, &client->auth); } #ifdef WITH_ACCOUNTING if ((flag->vp_integer & 0x01) != 0) { request_stats_addvp(request, client_acctvp, &client->acct); } #endif I would just add the client VSA attributes in no matter what since if you are requesting client information with bit 0x20 you wanted client information, no point in having a check to see if the auth bit is turned on, so I would have it: request_stats_addvp(request, client_authvp, &client->auth); #ifdef WITH_ACCOUNTING request_stats_addvp(request, client_acctvp, &client->acct); #endif Another idiosyncrasy is if you query by "FreeRADIUS-Stats-Client-IP-Address" then that vp gets copied back as per line 590: pairadd(&request->reply->vps, paircopyvp(request->reply, vp)); But you have no way to know which client number was used in that response and if that client was a static clients.conf client, a dynamic client or one defined in the status-server . Since the other interesting thing I noticed was Clients that are defined in the Status Server site also add onto the total list of clients assigned to the server. So if your clients.conf has 8 clients defined, clients 0 -> 7 are from the clients.conf, client 8 is the first client defined in the status server config. So it would be nice if the "Client-Type" or "Client belongs to server base/dynamic/status/xxx" could be returned as an extra VSA. The other thing that would be nice would be to add IPv6 support into the Stats engine too, but that would require changes to client.c as well since the "client_find" function would need to be updated to include v6 lookup as well as the current v4. I know patches are welcome and I will work on getting a patch for the client to always return the client values and to have client specific VSAs, but thought I should ask first as the status server is part of the server core before I created something. Thoughts and comments? Cheers Peter

2 3

Commit report for master branch
by announce＠freeradius.org 20 Aug '13

20 Aug '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Merge pull request #410 from theY4Kman/patch-2 PySys_SetPath must go after Py_Initialize Arran Cudbard-Bell@2013-08-20T23:14:37Z Files modified: * src/modules/rlm_python/rlm_python.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/7e69d9fd66b1f88efcd7… ====== PySys_SetPath must go after Py_Initialize I believe (but have not confirmed) it is because PySys_SetPath calls PySys_SetObject, which retrieves the sysdict from the Python thread state, which is not initialized until Py_Initialize. Cheers! Zach Kanzler@2013-08-20T23:03:48Z Files modified: * src/modules/rlm_python/rlm_python.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/625fcb5e76410c31d624… ====== Merge pull request #409 from theY4Kman/patch-1 Fix braces in rlm_python Arran Cudbard-Bell@2013-08-20T22:24:41Z Files modified: * src/modules/rlm_python/rlm_python.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/16cda528408d3158fbe3… ====== goto your corner Braces around multiple statements in an if block. Naughty, naughty! :) Zach Kanzler@2013-08-20T22:10:18Z Files modified: * src/modules/rlm_python/rlm_python.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/be189e4a8f9968242f83… ====== Fix segv in rlm_expiration vp_strvalue no longer available for none string attributes Arran Cudbard-Bell@2013-08-20T15:10:55Z Files modified: * src/modules/rlm_expiration/rlm_expiration.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/f66d41109ad4798f76f5… ====== -- This commit summary was generated @2013-08-21T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

FR3.0 and LDAP
by Maja Wolniewicz 20 Aug '13

20 Aug '13

Now I'm testing FR3.0 with LDAP. PEAP and NT-Password in a LDAP database works now well, but I have a problem with EAP-TTLS. In FR2.2 after authorizing a user in the authorize section of inner-tunnel, Auth-Type=LDAP is set and then authentication goes to the LDAP module. In FR3.0 the Auth-Type=LDAP isn't set in the rlm_ldap module, the authorize section ends with Auth-Type=PAP, so authentication goes to the PAP module. I can't find a place in the FR3.0 source, where Auth-Type=LDAP is set - in a few comments it is mentioned that such a setting happens automatically. Am I missing something? Maja -- Maja Gorecka-Wolniewiczmgw(a)umk.pl Uczelniane Centrum Information & Communication Informatyczne Technology Centre Uniwersytet Mikolaja Kopernika Nicolaus Copernicus University Coll. Maximum, pl. Rapackiego 1, 87-100 Torun, Poland tel.: +48 56-611-27-40 fax: +48 56-622-18-50 tel. kom.: +48-693032574

4 15

Commit report for v2.x.x branch
by announce＠freeradius.org 17 Aug '13

17 Aug '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Updates Alan T. DeKok@2013-08-17T20:10:09Z Files modified: * doc/ChangeLog Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/f36b8fdea5c0064c0b77… ====== -- This commit summary was generated @2013-08-18T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for master branch
by announce＠freeradius.org 16 Aug '13

16 Aug '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Keep track of the number of file descriptors were listening on Arran Cudbard-Bell@2013-08-16T20:28:27Z Files modified: * src/include/event.h * src/lib/event.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/9815d0466e246f1c6d98… ====== Don't segv if asked to print a null value Arran Cudbard-Bell@2013-08-16T20:28:27Z Files modified: * src/lib/print.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/edd08f0ec498a48ff60e… ====== Simplify "proxy anew" code Now that the packet list re-uses Ids less often Alan T. DeKok@2013-08-16T16:11:45Z Files modified: * src/main/process.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/5a0f95352a5cd953f2fd… ====== Simplify ID allocation so that we don't loop over all IDs Instead, we allocate a 256-entry array of random IDs (all unique) and gradually use them. When the array is empty, we re-fill it. Alan T. DeKok@2013-08-16T16:11:42Z Files modified: * src/lib/packet.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/3587f98f305cc3eef508… ====== Unify error logic Alan T. DeKok@2013-08-16T15:03:36Z Files modified: * src/main/process.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/f09bf3c3bb7f4a858d76… ====== Merge pull request #328 from skids/rbtree Fixes and enhancements for rbtree Alan DeKok@2013-08-16T04:52:28Z Files modified: * src/include/libradius.h * src/lib/rbtree.c * src/tests/rbmonkey.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/995734aec92e6c43de99… ====== A test file for libradius rbtree ops Verifies red/black counts to all child nodes after adds/deletes Tests DeleteOrder; code provided in comments for vanilla rbtree_delete. Build system magic necessary for this is beyond me. It's a start at least skids@2013-06-26T00:52:15Z Files modified: * src/tests/rbmonkey.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/2011d7689f0fb05d87f1… ====== Add a batch deletion mode to rbtree_walk Walks the tree calling callbacks as per InOrder Allows callback to ask for deletion of records after evaluating criteria All callbacks and deletions done while lock is held skids@2013-06-26T00:47:14Z Files modified: * src/include/libradius.h * src/lib/rbtree.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/c8685598bbb6c72393f4… ====== Always fixup after deleting a black child node in rbtree This prevents rbtree_delete from creating unbalanced/illegal rbtrees. skids@2013-06-25T02:40:48Z Files modified: * src/lib/rbtree.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/863a4f70d7bd876d73da… ====== Use a consistent callback return code This is the one place in the codebase where a positive return code is used in an rbtree_walk callback. Changing it negative should have no effect, and keeps options open as to whether to introduce new symbols for the next patch to follow, or to change the libfreeradius API slightly WRT rbtree callback return codes. Whether any third-party add-ons may use positive return codes is not known. skids@2013-06-20T22:54:31Z Files modified: * src/main/radclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/95949807d08e84ea4526… ====== Add rbtree_callbydata for sane threadsafe/garbage-collected operations When working with an rbtree which is exposed to multiple threads, it is not safe to do much of anything with data retrieved by functions such as rbtree_finddata, other than to feed it directly to rbtree_delete. This is because once rbtree_finddata has returned, another thread may obtain a pointer to that data (and hence may begin mangling non-key material such as container_of or any child allocs.) This is especially true for rbtrees that have a freeNode garbage collection routine defined. This function allows safe operations while the rbtree lock is still held. It also allows for a conditional delete operation based on criteria which may only be safe to ascertain while the lock is held. In addition to short operations, it could be used, with due care, to trylock a more granular lock associated with the key before deleting the key or before operating with it outside of the rbtree lock. skids@2013-06-20T22:03:20Z Files modified: * src/include/libradius.h * src/lib/rbtree.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/e1b597d1a281e20a10ff… ====== Fix obvious pasto in PostOrder walk. skids@2013-06-20T04:47:33Z Files modified: * src/lib/rbtree.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/a89132cf443a6f621374… ====== -- This commit summary was generated @2013-08-17T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0