December 2015 - Freeradius-Devel - lists.freeradius.org

Updates to "unlang"
by Alan DeKok 15 Dec '15

15 Dec '15

There have been some long-needed changes to the "unlang" interpreter / compiler. For people who've looked at the code, it hadn't really changed since 2000 or so. Largely because it's core to the server, and confusing as heck. Now that we have a large number of test cases, I've been going through and fixing the code. It passes all of the tests, and more have been added. The new compiler is in modcall.c. The interpreter has been moved to interpreter.c. The split means it's easier to understand each piece in isolation. One benefit is that the mess of "if / then / else" statements has been changed to be table driven. Each keyword "foo" now as a dedicated compilation function compile_foo(), and a dedicate interpreter function modcall_foo(). This makes adding new keywords almost trivial. So the question is... what else would you like to see in "unlang"? I don't want to make it a general-purpose language, but some additional features may be useful. e.g. it would be possible for modules to dynamically register new unlang keywords / syntax: if (foo) { module-thing argument { ... ??? ... } } Ideas? Comments? Alan DeKok.

5 13

Fwd: talloc plugin for gdb
by Herwin Weststrate 15 Dec '15

15 Dec '15

Just saw this at the Samba mailing list. Since FreeRADIUS uses talloc as well, it might be an interesting plugin. -------- Forwarded Message -------- Subject: talloc plugin for gdb Date: Mon, 14 Dec 2015 10:48:56 +0100 From: Ralph Boehme <rb(a)sernet.de> To: Samba Technical <samba-technical(a)lists.samba.org> Newsgroups: gmane.network.samba.internals Hi! Was this mentioned before here ? <https://github.com/nccgroup/libtalloc> A talloc plugin for gdb. In case it was mentioned and I missed it, please ignore. -Ralph -- SerNet GmbH, Bahnhofsallee 1b, 37081 Göttingen phone: +49-551-370000-0, fax: +49-551-370000-9 AG Göttingen, HRB 2816, GF: Dr. Johannes Loxen http://www.sernet.de,mailto:kontakt@sernet.de

1 0

v2.x.x - ENABLE_OPENSSL_VERSION_CHECK
by Adam Bishop 09 Dec '15

09 Dec '15

I'm aware v2.x.x is EOL, reporting this just in case you're still correcting defects. In this commit: https://github.com/FreeRADIUS/freeradius-server/commit/4f24d4cda8b43b5f7031… ENABLE_OPENSSL_VERSION_CHECK is removed from around ssl_check_version. However allow_vulnerable_openssl is still wrapped by that condition in mainconfig.c and radiusd.h, so building with --disable-openssl_version_check fails as mainconfig is checked for a non-existent member. I think simply removing the condition from mainconfig.c and radiusd.h is sufficient (or should it be protected with HAVE_OPENSSL_CRYPTO_H?) - I could create a pull doing either of those if desired. Regards, Adam Bishop gpg: 0x6609D460 jisc.ac.uk | Networkshop 44: Save the date! | 22-24 March 2016 @ University of Manchester Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.

2 1

Possibilities for using winbind libs with Samba < 4.2.1
by Herwin Weststrate 08 Dec '15

08 Dec '15

This question is mainly for Matthew, since he is the author of auth_wbclient.c. I just tried to use that on our Debian systems, but then I saw that Samba version 4.2.1 was required. It seems that this version introduced the used method wbcCtxAuthenticateUserEx. Older versions (4.1.something on the current Debian stable) do however have a wbcAuthenticateUserEx, that looks like it does about the same thing, but without the context-object that the first method uses. Is there a specific reason that you used the functionality from Samba 4.2.1, or do you think it could be possible to make it work with older versions of Samba as well? I'm more than willing to actually write the code myself, but maybe you had already concluded that it won't be possible to make it work with older versions, than it would be a waste of time to try to make it work. -- Herwin Weststrate

4 6

3.1.x consistency check
by Matthew Newton 03 Dec '15

03 Dec '15

Hi, So trying 3.1.x to see if it fixes the 3.0.x error.... :) Packaged build (so disable-developer) segfaults in rlm_ldap (ldap.c:1431). Trying to debug that I built a new version which has enable-developer set. That bombs out in a consistency check in SoH, as below. Looks like it doesn't like that pair_make_request is called with a NULL value? But can't imagine that is right as that's normally what happens to create an attribute? About to go home now so thought I'd shoot out a quick e-mail in case someone else knows the immediate answer without me having to stare at code for a while :) (Update on the original issue; I'm going to build against latest talloc and see if that fixes it - may be just a bug in the older talloc version in Debian wheezy. That will have to wait until next week now.) Cheers, Matthew (14) # Executing group from file /srv/radius/sites-enabled/default (14) authenticate { (14) outer-eap: Peer sent packet with method EAP PEAP (25) (14) outer-eap: Calling submodule eap_peap to process data (14) eap_peap: Continuing EAP-TLS (14) eap_peap: Got complete TLS record (661 bytes) (14) eap_peap: [eap-tls verify] = ok (14) eap_peap: [eap-tls process] = ok (14) eap_peap: Session established. Decoding tunneled attributes (14) eap_peap: PEAP state WAITING FOR SOH RESPONSE (14) eap_peap: EAP method unknown (254) (14) eap_peap: SoH System-Health-ID vendor 00000137 component=0 (14) eap_peap: SoH MS type-value payload CONSISTENCY CHECK FAILED src/lib/pair.c[674]: VALUE_PAIR "SoH-MS-Machine-Name" char buffer not \0 terminated SOFT ASSERT FAILED src/lib/pair.c[2531]: 0 RAISING SIGNAL: Aborted Program received signal SIGABRT, Aborted. 0x00007ffff627f79b in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/pt-raise.c:37 37 ../nptl/sysdeps/unix/sysv/linux/pt-raise.c: No such file or directory. (gdb) (gdb) bt #0 0x00007ffff627f79b in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/pt-raise.c:37 #1 0x00007ffff79504ce in fr_fault (sig=6) at src/lib/debug.c:648 #2 0x00007ffff7950fdb in fr_assert_cond (file=0x7ffff798205b "src/lib/pair.c", line=2531, expr=0x7ffff79824e6 "0", cond=false) at src/lib/debug.c:1090 #3 0x00007ffff7963154 in fr_pair_verify (file=0x7ffff798205b "src/lib/pair.c", line=674, vp=0xafe780) at src/lib/pair.c:2531 #4 0x00007ffff795ff49 in fr_pair_add (head=0xb11d10, add=0xafea10) at src/lib/pair.c:674 #5 0x00007ffff795fc5f in fr_pair_make (ctx=0xb11c90, vps=0xb11d10, attribute=0x464afc "SoH-MS-Machine-Role", value=0x0, op=T_OP_SET) at src/lib/pair.c:536 #6 0x00000000004357fe in eap_peap_soh_mstlv (request=0xb121f0, p=0xae054f "\001", data_len=5) at src/main/soh.c:299 #7 0x000000000043603b in soh_verify (request=0xb121f0, data=0xae04ee "", data_len=543) at src/main/soh.c:502 #8 0x00007ffff1553779 in eap_peap_soh_verify (request=0xb121f0, packet=0xafe020, data=0xae04a8 "", data_len=621) at src/modules/rlm_eap/types/rlm_eap_peap/peap.c:198 #9 0x00007ffff15550a6 in eap_peap_process (eap_session=0xadafa0, tls_session=0xadc350) at src/modules/rlm_eap/types/rlm_eap_peap/peap.c:814 #10 0x00007ffff1552ff5 in mod_process (arg=0xaa3820, eap_session=0xadafa0) at src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c:293 #11 0x00007ffff1b6361f in eap_module_call (module=0xaa3590, eap_session=0xadafa0) at src/modules/rlm_eap/eap.c:189 #12 0x00007ffff1b63ea8 in eap_method_select (inst=0xa3d570, eap_session=0xadafa0) at src/modules/rlm_eap/eap.c:425 #13 0x00007ffff1b622fb in mod_authenticate (instance=0xa3d570, request=0xb121f0) at src/modules/rlm_eap/rlm_eap.c:202 #14 0x0000000000429051 in call_modsingle (component=MOD_AUTHENTICATE, sp=0xaba740, request=0xb121f0) at src/main/modcall.c:327 #15 0x0000000000429749 in modcall_recurse (request=0xb121f0, component=MOD_AUTHENTICATE, depth=1, entry=0x7fffffffd818, do_next_sibling=true) at src/main/modcall.c:610 #16 0x0000000000429221 in modcall_child (request=0xb121f0, component=MOD_AUTHENTICATE, depth=1, entry=0x7fffffffd800, c=0xaba740, result=0x7fffffffd6ec, do_next_sibling=true) at src/main/modcall.c:434 #17 0x000000000042a2ea in modcall_recurse (request=0xb121f0, component=MOD_AUTHENTICATE, depth=0, entry=0x7fffffffd800, do_next_sibling=true) at src/main/modcall.c:834 #18 0x000000000042b00a in modcall (component=MOD_AUTHENTICATE, c=0xaba640, request=0xb121f0) at src/main/modcall.c:1179 #19 0x00000000004266a8 in indexed_modcall (comp=MOD_AUTHENTICATE, idx=1368977, request=0xb121f0) at src/main/modules.c:956 #20 0x000000000042895f in process_authenticate (auth_type=1368977, request=0xb121f0) at src/main/modules.c:2099 #21 0x000000000040f32b in rad_check_password (request=0xb121f0) at src/main/auth.c:251 #22 0x000000000040fa25 in rad_authenticate (request=0xb121f0) at src/main/auth.c:516 #23 0x000000000043a089 in request_running (request=0xb121f0, action=1) at src/main/process.c:1482 #24 0x0000000000438d97 in request_queue_or_run (request=0xb121f0, process=0x439f27 <request_running>) at src/main/process.c:953 #25 0x000000000043a98c in request_receive (ctx=0xb11c30, listener=0xa09090, packet=0xb11c90, client=0x9905e0, fun=0x40f4d0 <rad_authenticate>) at src/main/process.c:1740 #26 0x00000000004189cb in auth_socket_recv (listener=0xa09090) at src/main/listen.c:1903 #27 0x00000000004415a1 in event_socket_handler (xel=0xac79d0, fd=15, ctx=0xa09090) at src/main/process.c:4544 #28 0x00007ffff797aa53 in fr_event_loop (el=0xac79d0) at src/lib/event.c:637 #29 0x00000000004432e6 in radius_event_process () at src/main/process.c:5587 #30 0x0000000000431cdd in main (argc=4, argv=0x7fffffffe6e8) at src/main/radiusd.c:578 (gdb) -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk>

2 10

access to proxy packet "radius id" in case of unresponsive proxy ?
by Chaigneau, Nicolas 03 Dec '15

03 Dec '15

Hello, For logging purposes, I'm trying to get the proxy packet "radius id". In post proxy, the proxy packet id is not available anymore (it has been reset to -1 by fr_packet_list_id_free when removed from proxy hash). When we have a response from the proxy server, we still can know this id (because it's the same as the proxy reply packet id, which is available). But in case of unresponsive proxy, it seems there's no way to do so. (except by changing FreeRADIUS code). Do you confirm this is not currently doable ? And if so, would it be possible to do something about this ? :) Regards, Nicolas. This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

4 5

Compound problems with 3.0.10 build
by Sam Hartman 02 Dec '15

02 Dec '15

Hi. I've been having trouble building 3.0.10. I traced it down to a couple of badly interacting things. IN 2b77b7e830222d0192f42efe66cae38f061aa34c two all.mk files were introduced in directories that have an all.mk.in. I don't understand why that commit is a good idea as configure will generate those files. Unfortunately, if building from git, it's very easy to get into a situation where make things the files are out-of-date immediately after a fresh configure. So as part of make it will try and reconfigure those files. So because we checked in all.mk files we end up building them twice instead of 0 times. Oops. Except it's worse than that because of the logic in makefile for getting configure_args. If you run configure like so, ./configure LDFLAGS='-L/usr/local/moonshot/lib -Wl,--rpath=/usr/local/moonshot/lib' Then the logic for extracting the configure arguments misses the interior quotes. So you end up rerunning configure like ./configure LDFLAGS=-L/usr/local/moonshot/lib -Wl,--rpath=/usr/local/moonshot/lib and that second configure line doesn't work as well as you might hope. I think extracting configure_args from the AC_CS_CONFIG setting in config.status might work much better. --Sam

2 2

New feature in v3.1.x
by Alan DeKok 01 Dec '15

01 Dec '15

I've just committed a new feature to the v3.1.x branch. It's called "queue_priority" for the thread pool. The idea is to allow the administrator to control how the server behaves in overload conditions. When a back-end database goes down, or 10K users log in at once, the server can't process packets as fast as they come in. This is "overload". The usual method of dealing with overload is to put the extra packets into a queue for later processing. But the question is, how should the queue be organized? In v3.0 and earlier, the queue had fixed behaviour. In v3.1.x, it is configurable. The 3 options are: time order packets by when they are received Note that replies from a home server are ordered by when the *original* packet came in, so they are prioritized. default Order by listener type proxy > auth > acct > detail > coa Packets from the same listener are ordered by "time". eap Order by ongoing EAP sessions. EAP authentication takes multiple rounds. This priority ensures that EAP sessions which are "further along" in the authentication process are handled with a higher priority. Packets with the same eap priority are ordered by "default" The "default" order is pretty much what was in 3.0 and earlier. If anyone has suggestions for additional prioritization methods, I'd be interested in hearing them. Alan DeKok.

1 0