September 2013 - Freeradius-Devel - lists.freeradius.org

rlm_sql_ocioracle driver v. 0.1
by Ge＠＠ru 14 Mar '15

14 Mar '15

Hi, in attachment patch to add rlm_sql_ocioracle driver to freeradius 2.1.x tree (it seems work yet on 3.x tree). This drivers permit to use function/procedure with CURSOR (through :Ret_Cursor string) like for example: group_membership_query = "begin :Ret_Cursor := \ pkRadius.group_membership_query('%{SQL-User-Name}'); end;" TODO for next release: - add support to oracle connection pool instead of open a new connection for every socket on startup; - enhancement on handle error (through error callback) on do query; - add documentation. Module need oracle instantclient library and ocilib library (http://orclib.sourceforge.net/) Good luck to rlm_sql_ocioracle driver!! Geaaru

2 5

2.2.1: if-block leads to reject
by Jakob Hirsch 02 Oct '13

02 Oct '13

Hi, another issue in 2.2.1 (and the current v2.x.x git): if-blocks in an authenticate section cause to wrong rejects. Example with minimal config: authorize { update control { Auth-Type := 'Test' } } authenticate { if (1) { #noop #update reply { # Reply-Message := "bla" #} } ok } } debug output: > rad_recv: Access-Request packet from host 127.1.0.5 port 33185, id=115, length=55 > User-Name = "test-user" > User-Password = "test-password" > NAS-Port = 12345 > # Executing section authorize from file /etc/ui-freeradius/sites/test.conf > +group authorize { > ++update control { > ++} # update control = noop > +} # group authorize = notfound > Found Auth-Type = Test > # Executing group from file /etc/ui-freeradius/sites/test.conf > +group Test { > ++? if (1) > ? Evaluating (1) -> TRUE > ++? if (1) -> TRUE > ++if (1) { > ++} # if (1) = reject > +} # group Test = reject > Failed to authenticate the user. > Login incorrect: [test-user/test-password] (from client Arcor_test port 12345) > Sending Access-Reject of id 115 to 127.1.0.5 port 33185 > Finished request 0. So, for some reason, freeradius thinks that the if-block returns with a "reject", which is at least counterintuitive (though I just noticed that 2.2.0 behaved the same, so it's ok probably). If I activate the "noop" (corresponding instance of rlm_always, as the above "ok") in the if-block, it works: > +group Test { > ++? if (1) > ? Evaluating (1) -> TRUE > ++? if (1) -> TRUE > ++if (1) { > +++[noop] = noop > ++} # if (1) = noop > ++[ok] = ok > +} # group Test = ok The update section is not suffucient, though: > +group Test { > ++? if (1) > ? Evaluating (1) -> TRUE > ++? if (1) -> TRUE > ++if (1) { > +++update reply { > +++} # update reply = noop > ++} # if (1) = reject > +} # group Test = reject This is the actual issue I encountered. We use several if-blocks with update sections and this always worked (including 2.2.0). Running 2.2.1 with our live config, I even get a return value of "noop", which leads to a different problem: > ++? if (control:X-Attr-Id && (control:X-Attr-Down || control:X-Attr-Up)) > ? Evaluating (control:X-Attr-Id ) -> TRUE > ?? Evaluating (control:X-Attr-Down ) -> TRUE > ?? Skipping (control:X-Attr-Up) > ++? if (control:X-Attr-Id && (control:X-Attr-Down || control:X-Attr-Up)) -> TRUE > ++if (control:X-Attr-Id && (control:X-Attr-Down || control:X-Attr-Up)) { > +++update reply { > expand: %{control:X-Attr-ID} -> 1 > expand: %{control:X-Attr-Down} -> 2 > expand: %{control:X-Attr-Up} -> 3 > +++} # update reply = noop > ++} # if (control:X-Attr-Id && (control:X-Attr-Down || control:X-Attr-Up)) = noop > ++[ok] = ok > +} # group SP-Auth = noop The if block returns a noop, which the following "ok" cannot override, so the whole group returns with "noop", which make freeradius reject the request. This worked in 2.2.0 (and looked a bit different): ... > ++? if (control:X-Attr-Id && (control:X-Attr-Down || control:X-Attr-Up)) -> TRUE > ++- entering if (control:X-Attr-Id && (control:X-Attr-Down || control:X-Attr-Up)) {...} > expand: %{control:X-Attr-Id} -> 1 > expand: %{control:X-Attr-Down} -> 2 > expand: %{control:X-Attr-Up} -> 3 > +++[reply] returns noop > ++- if (control:SP-Drossel-DTAG-ID && (control:SP-Drossel-Down || control:SP-Drossel-Up)) returns noop > ++[ok] returns ok > Login OK: [xxxx-xxxx] (from client client_test port 12345) Regards Jakob

3 10

freeradius 2.2.1 release date?
by Bruce Bauman 01 Oct '13

01 Oct '13

Is 2.2.1 close to release, or is no release planned because 3.0 is so close? We are using 2.2.0 and a few of the features introduced in 2.2.1 would be really useful for us. In particular expansion of the "reference" configuration item to adjust the accounting SQL queries. -- Bruce Bruce Bauman - Systems Administrator Rutgers University Office of Information Technology Campus Computing Services - Central Systems and Services Office ~ (848) 445-6363

4 6

Commit report for v2.x.x branch
by announce＠freeradius.org 30 Sep '13

30 Sep '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Silently skip empty subgroups Alan T. DeKok@2013-09-30T21:57:32Z Files modified: * src/main/modcall.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/96b57aeb8bcdc895d4da… ====== Note recent changes Alan T. DeKok@2013-09-30T17:11:23Z Files modified: * doc/ChangeLog Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/43e6a171addb7efc7eb5… ====== Don't set parent priority when calling a child It's wrong. Alan T. DeKok@2013-09-30T17:02:20Z Files modified: * src/main/modcall.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/a323ecd5df4ba8207dff… ====== -- This commit summary was generated @2013-10-01T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for master branch
by announce＠freeradius.org 30 Sep '13

30 Sep '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Silently skip empty subgroups Alan T. DeKok@2013-09-30T22:00:18Z Files modified: * src/main/modcall.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/909b09c89939da585b28… ====== "case" can only occur within a "switch" Alan T. DeKok@2013-09-30T22:00:17Z Files modified: * src/main/modcall.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/e1c8a30476cf45e7249a… ====== Don't set parent priority when calling a child It's wrong. Alan T. DeKok@2013-09-30T17:07:10Z Files modified: * src/main/modcall.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/5dad8acb02a4470e74ba… ====== -- This commit summary was generated @2013-10-01T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Re: Need 2.2.2 [was: FR 2.2.1 issue]
by Alan Buxey 30 Sep '13

30 Sep '13

Found another thing. With 2.2.1 we were seeing a LOT of requests not being handled quickly. .. stuck in core messages. I say were because we've rolled back to 2.2.0 for now as we don't have time to debug this for a while. If someone else doesn't step in then can look into this in a couple of weeks (some serious developer debug left on slowing it?) alan

4 6

change of behaviour on 2.2.1
by srua1＠plus.net 30 Sep '13

30 Sep '13

Hello, We have a custom module we have been using for a while on radius 2.2.0. I yesterday compiled it against 2.2.1 and it behaved differently as it used to do with the previous version. Specifically around handling of returned from authorisation module, and I was wondering if something have changed in this version of freeradius or I made a mistake somewhere. Our module under 2.2.0 and previous versions when dealing with an authorisation request that does not require authentication it would return RLM_MODULE_HANDLED. This would result in the authentication request terminating with the reply back to the clients. Under 2.2.1 however what it has been observed is that it still drops to authentication which results in incorrect handling of the request. Is this something it has changed between versions or am I doing something which shouldn't have worked in the first place? If the latter is this the comment in the header file incorrect or misleading? RLM_MODULE_HANDLED, /* the module handled the request, so stop. */ Thank you Sergio

4 8

Commit report for master branch
by announce＠freeradius.org 29 Sep '13

29 Sep '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Port fix for update sections from v2.x.x Alan T. DeKok (via Arran Cudbard-Bell)@2013-09-29T17:17:10Z Files modified: * src/main/modcall.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/e445676c7d2de048ac76… ====== Fix priority handling Alan T. DeKok (via Arran Cudbard-Bell)@2013-09-29T17:17:03Z Files modified: * src/main/modcall.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/58cce8c52c066170b691… ====== Segfault in libperl when doing perl_xlat(). Fix by kvainkainen. Closes #436 In rlm_perl.c Perl interpreter cloning is controlled by #ifdef USE_ITHREADS. However, for some unknown reason in perl_xlat() #ifndef WITH_ITHREADS is used instead. At least my Perl does not have WITH_ITHREADS compile option, meaning all perl_xlat() calls are handled by same Perl instance. If you run Freeradius in multithread mode, this causes segfault in libperl when two threads do perl_xlat() simultaneously. Arran Cudbard-Bell@2013-09-29T17:04:49Z Files modified: * src/modules/rlm_perl/rlm_perl.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/52b39ae78d49ef7c1856… ====== -- This commit summary was generated @2013-09-30T00:00:11Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v2.x.x branch
by announce＠freeradius.org 29 Sep '13

29 Sep '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Fix crazy indentation Arran Cudbard-Bell@2013-09-29T16:41:20Z Files modified: * src/modules/rlm_perl/rlm_perl.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/b883c29f495d8cdd7dd4… ====== Segfault in libperl when doing perl_xlat(). Fix by kvainkainen. Closes #436 In rlm_perl.c Perl interpreter cloning is controlled by #ifdef USE_ITHREADS. However, for some unknown reason in perl_xlat() #ifndef WITH_ITHREADS is used instead. At least my Perl does not have WITH_ITHREADS compile option, meaning all perl_xlat() calls are handled by same Perl instance. If you run Freeradius in multithread mode, this causes segfault in libperl when two threads do perl_xlat() simultaneously. Arran Cudbard-Bell@2013-09-29T16:38:52Z Files modified: * src/modules/rlm_perl/rlm_perl.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/9ef3b496e4c2964151c5… ====== Whitespace fixes in rlm_perl.c Arran Cudbard-Bell@2013-09-29T16:35:17Z Files modified: * src/modules/rlm_perl/rlm_perl.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/fbf419a3921174ec0016… ====== Minor change to use update actions Alan T. DeKok@2013-09-29T15:07:51Z Files modified: * src/main/modcall.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/eeca81d55ce82958e848… ====== Initialize actions for UPDATE sections Alan T. DeKok@2013-09-29T15:07:40Z Files modified: * src/main/modcall.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/d6e44dc1d7b0be3ee246… ====== Add missing close brace Alan T. DeKok@2013-09-29T02:03:30Z Files modified: * src/main/modcall.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/703acb839cce6ac96b64… ====== -- This commit summary was generated @2013-09-30T00:00:06Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v2.x.x branch
by announce＠freeradius.org 28 Sep '13

28 Sep '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Fix priority handling. Alan T. DeKok@2013-09-28T16:37:54Z Files modified: * src/main/modcall.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/f1c2629e75048ffc7eee… ====== -- This commit summary was generated @2013-09-29T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0