March 2015 - Freeradius-Devel - lists.freeradius.org

Commit report for v3.1.x branch
by announce＠freeradius.org 25 Mar '15

25 Mar '15

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Oops. Define this, too Alan T. DeKok@2015-03-25T23:16:28Z Files modified: * src/include/listen.h Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/6fe518eb02bca4b5bc9b… ====== Freeze proxy sockets on EOL, too. and eol requests only if listener->count > 0 Alan T. DeKok@2015-03-25T23:07:54Z Files modified: * src/main/process.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/2ebfc328692d7ad01059… ====== TCP socket timer limits mean they're marked frozen, not EOL EOL is now only for errors. a frozen socket can still have requests using it. For auth/acct, we can't close the socket until all requests using it have finished. We can't close socket while the client is still sending packets. That's rude. For proxy sockets, most of the same applies. The only difference is that the frozen socket won't be used to proxy new requests. But retransmits will still go out the proxy socket. And replies will still be received from it. Alan T. DeKok@2015-03-25T22:31:52Z Files modified: * src/main/process.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/1747b6f026cbf2806449… ====== Freeze the proxy socket on timeout But we don't want to EOL it just yet Alan T. DeKok@2015-03-25T22:31:51Z Files modified: * src/main/process.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/114cd12fa5af16fa8ac1… ====== Motorola error message Alan T. DeKok@2015-03-25T22:31:50Z Files modified: * share/dictionary.motorola.wimax Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/849336c73dda97ac2a11… ====== Add systemd unit file for systems that use systemd Arran Cudbard-Bell@2015-03-25T17:39:36Z Files modified: * redhat/freeradius.spec * redhat/radiusd.service Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/530b02a96dc9de40725b… ====== Remove unused assignement Alan T. DeKok@2015-03-25T17:21:00Z Files modified: * src/main/command.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/2ba0af5b68a21ce12014… ====== -- This commit summary was generated @2015-03-26T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

v2.x.x redundant-load-balance broken
by Brian De Wolf 24 Mar '15

24 Mar '15

Hello, I upgraded from v.2.1.x to v.2.2.6 recently and noticed (while upgrading one of the backend DBs) that redundant-load-balance sections are broken. I poked at it a little and found an off-by-one error where it would only try N-1 of the group members, instead of all of them (which is pretty crippling when N=2). Here's a quick diff that fixes it: diff --git a/src/main/modcall.c b/src/main/modcall.c index d9cebe9..32d3471 100644 --- a/src/main/modcall.c +++ b/src/main/modcall.c @@ -723,7 +723,7 @@ redo: * section. If we get FAIL, then * continue. Otherwise, stop. */ - for (i = 1; i < count; i++) { + for (i = 0; i < count; i++) { modcall_child(request, component, depth + 1, entry, found, &result); I'm still a little puzzled by the behavior of the server, though. I was testing by adding this to authorize in the src/tests config: redundant-load-balance { ok fail fail fail } This causes the other tests to randomly fail, as it sometimes load balances to the second member, which causes it to only try the three fail modules. What puzzles me is that, when I add this config instead: redundant-load-balance { fail ok fail fail } I stop getting random failures. When I add logging to record which one we picked and to identify the module before we call modcall_child, it says: ++load-balance redundant-load-balance { pick is 3 ++redundant-load-balance group redundant-load-balance { trying 0x13a7780 +++[fail] = fail +++[fail] = fail trying 0x13a77e0 +++[fail] = fail trying 0x13a7550 +++[fail] = fail +++[ok] = ok ++} # redundant-load-balance group redundant-load-balance = ok It's not clear to me why it's listing fail multiple times for some modcalls, or where that last ok comes from. Anyway, I checked v3.x.x for the off-by-one error and it looks like the loop was re-done to avoid count entirely. Maybe more of the v3.x.x code needs to be backported?

2 2

Commit report for v3.0.x branch
by announce＠freeradius.org 24 Mar '15

24 Mar '15

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Allow home server "auth+acct" Alan T. DeKok@2015-03-24T23:49:36Z Files modified: * src/main/command.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/a0b0a96ee52aeb2b0b36… ====== Better fix for dual home servers Alan T. DeKok@2015-03-24T23:48:23Z Files modified: * src/main/realms.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/d36088a121c8d4e04110… ====== note recent changes Alan T. DeKok@2015-03-24T22:16:32Z Files modified: * doc/ChangeLog Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/01daa22924d26d5d4e40… ====== Use FR_CHANNEL_FAIL / SUCCESS for radmin return codes Alan T. DeKok@2015-03-24T22:13:01Z Files modified: * src/main/radmin.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/2065ae856b50cc14c1de… ====== Use names instead of numbers for command OK / FAIL And use the same return codes as for the channels Alan T. DeKok@2015-03-24T22:13:01Z Files modified: * src/main/command.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/7c0f04a0f89667a7c84e… ====== Regularize return codes for radmin commands Alan T. DeKok@2015-03-24T22:13:01Z Files modified: * src/main/command.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/678933702cc702ad2dd5… ====== Go to status after running a command Alan T. DeKok@2015-03-24T22:13:01Z Files modified: * src/main/command.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/d9ace7f9034a754ca39d… ====== Probably need a systemd script instead *sigh* Arran Cudbard-Bell@2015-03-24T21:48:21Z Files modified: * redhat/freeradius-radiusd-init Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/6539ca663b8372e726d8… ====== Use same port for acct if using RadSec Alan T. DeKok@2015-03-24T21:46:09Z Files modified: * src/main/realms.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/9cad3756533d502112ec… ====== whitespace Alan T. DeKok@2015-03-24T21:46:09Z Files modified: * doc/ChangeLog Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/c845a3d6ca52c613c58e… ====== Add option for secret Arran Cudbard-Bell@2015-03-24T21:45:16Z Files modified: * scripts/raduat Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/71a2b61d8bb8d04dadb2… ====== Update raduat Arran Cudbard-Bell@2015-03-24T20:10:30Z Files modified: * scripts/raduat Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/799beda82cbc3fb350de… ====== Update ChangeLog Arran Cudbard-Bell@2015-03-24T17:58:51Z Files modified: * doc/ChangeLog Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/bc5d0f237baab48cba9e… ====== Rename fr_connect_pool_delete to fr_connection_pool_free Arran Cudbard-Bell@2015-03-24T17:57:03Z Files modified: * src/include/connection.h * src/main/connection.c * src/modules/rlm_cache/drivers/rlm_cache_memcached/rlm_cache_memcached.c * src/modules/rlm_couchbase/rlm_couchbase.c * src/modules/rlm_krb5/rlm_krb5.c * src/modules/rlm_ldap/rlm_ldap.c * src/modules/rlm_mschap/rlm_mschap.c * src/modules/rlm_redis/rlm_redis.c * src/modules/rlm_rest/rlm_rest.c * src/modules/rlm_sql/rlm_sql.c * src/modules/rlm_yubikey/validate.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/206f8913ad6c225f7a7a… ====== Add reference counter to connection pool to prevent double frees when referenced Arran Cudbard-Bell@2015-03-24T17:57:03Z Files modified: * src/main/connection.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/af5e9b8c3c3255362eef… ====== Cleanup some of the tls code, add doxygen headers etc... Arran Cudbard-Bell@2015-03-24T17:32:43Z Files modified: * src/main/tls.c * src/modules/rlm_eap/libeap/eap_tls.h * src/modules/rlm_eap/libeap/eap_types.h Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/7a08b7de4bfaad74d1b1… ====== Fix invalid assert in state.c If there's a previous linked state, we want to assert that the entry can't be *head* of the list not the tail Arran Cudbard-Bell@2015-03-24T17:32:07Z Files modified: * src/main/state.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/c87e9ca8393b7796a471… ====== Add connection pool to rlm_mschap for wbclient contexts Matthew Newton (via Arran Cudbard-Bell)@2015-03-24T02:21:59Z Files modified: * raddb/mods-available/mschap * src/modules/rlm_mschap/auth_wbclient.c * src/modules/rlm_mschap/rlm_mschap.c * src/modules/rlm_mschap/rlm_mschap.h Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/5f685db2f687a1cb2137… ====== Make the init script work with centos Arran Cudbard-Bell@2015-03-24T01:49:42Z Files modified: * redhat/freeradius-radiusd-init Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/aebe828011b8add9035f… ====== Print proper error for unknown attributes in rlm_ldap mapping sections Arran Cudbard-Bell@2015-03-24T00:08:59Z Files modified: * src/modules/rlm_ldap/attrmap.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/578dc9bd698322716b60… ====== Some libldap packagers define LDAP_VENDOR_VERSION_PATCH as X ... thanks for that ltb-project. Arran Cudbard-Bell@2015-03-24T00:08:54Z Files modified: * src/modules/rlm_ldap/ldap.h Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/9a99a0a56f7c4e284709… ====== -- This commit summary was generated @2015-03-25T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v2.x.x branch
by announce＠freeradius.org 24 Mar '15

24 Mar '15

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== start from 0 for failover Alan T. DeKok@2015-03-24T23:12:14Z Files modified: * src/main/modcall.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/0e5375916df9f3e7efd5… ====== -- This commit summary was generated @2015-03-25T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v3.1.x branch
by announce＠freeradius.org 24 Mar '15

24 Mar '15

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Allow home server "auth+acct" Alan T. DeKok@2015-03-24T23:50:40Z Files modified: * src/main/command.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/b17cf2433b479aee3a7c… ====== Better fix for dual home servers Alan T. DeKok@2015-03-24T23:50:39Z Files modified: * src/main/realms.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/e5d32f3fbe6d4902ccb8… ====== Use FR_CHANNEL_FAIL / SUCCESS for radmin return codes Alan T. DeKok@2015-03-24T22:13:24Z Files modified: * src/main/radmin.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/ca65c5bcabd46f693d7b… ====== Use names instead of numbers for command OK / FAIL And use the same return codes as for the channels Alan T. DeKok@2015-03-24T22:13:20Z Files modified: * src/main/command.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/4babe22e51ff98108f84… ====== Regularize return codes for radmin commands Alan T. DeKok@2015-03-24T22:13:19Z Files modified: * src/main/command.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/798d9a8c4eaf0132827b… ====== Go to status after running a command Alan T. DeKok@2015-03-24T22:13:18Z Files modified: * src/main/command.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/a6629f6e90d808f7f2ae… ====== Use same port for acct if using RadSec Alan T. DeKok@2015-03-24T21:46:25Z Files modified: * src/main/realms.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/2b20849f1a85f4306964… ====== Add option for secret Arran Cudbard-Bell@2015-03-24T21:45:29Z Files modified: * scripts/raduat Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/02e1ff5bb3c229b0ddee… ====== Update raduat Arran Cudbard-Bell@2015-03-24T20:09:46Z Files modified: * scripts/raduat Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/9b1ac8a033303680959e… ====== Rename fr_connect_pool_delete to fr_connection_pool_free Arran Cudbard-Bell@2015-03-24T17:57:12Z Files modified: * src/include/connection.h * src/main/connection.c * src/modules/rlm_cache/drivers/rlm_cache_memcached/rlm_cache_memcached.c * src/modules/rlm_couchbase/rlm_couchbase.c * src/modules/rlm_krb5/rlm_krb5.c * src/modules/rlm_ldap/rlm_ldap.c * src/modules/rlm_linelog/rlm_linelog.c * src/modules/rlm_mschap/rlm_mschap.c * src/modules/rlm_redis/rlm_redis.c * src/modules/rlm_rest/rlm_rest.c * src/modules/rlm_sql/rlm_sql.c * src/modules/rlm_yubikey/validate.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/604144e28b7da6b82b2e… ====== Add reference counter to connection pool to prevent double frees when referenced Arran Cudbard-Bell@2015-03-24T17:57:12Z Files modified: * src/main/connection.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/a71e5b5ae1f648e08ae8… ====== Cleanup some of the tls code, add doxygen headers etc... Arran Cudbard-Bell@2015-03-24T17:33:12Z Files modified: * src/main/tls.c * src/modules/rlm_eap/libeap/eap_tls.h * src/modules/rlm_eap/libeap/eap_types.h Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/935bc8fe9d8d6349087e… ====== Fix invalid assert in state.c If there's a previous linked state, we want to assert that the entry can't be *head* of the list not the tail Arran Cudbard-Bell@2015-03-24T17:33:06Z Files modified: * src/main/state.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/de4dde44e5c9dea3e72f… ====== Merge pull request #935 from mcnewton/v3.1.x-wbpool Add connection pool to rlm_mschap for wbclient contexts Arran Cudbard-Bell@2015-03-24T01:26:38Z Files modified: * raddb/mods-available/mschap * src/modules/rlm_mschap/auth_wbclient.c * src/modules/rlm_mschap/rlm_mschap.c * src/modules/rlm_mschap/rlm_mschap.h Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/970d1b0bc295e51fa36d… ====== Add connection pool to rlm_mschap for wbclient contexts Matthew Newton@2015-03-24T00:13:45Z Files modified: * raddb/mods-available/mschap * src/modules/rlm_mschap/auth_wbclient.c * src/modules/rlm_mschap/rlm_mschap.c * src/modules/rlm_mschap/rlm_mschap.h Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/b24cf26da337fc234199… ====== Some libldap packagers define LDAP_VENDOR_VERSION_PATCH as X ... thanks for that ltb-project. Arran Cudbard-Bell@2015-03-24T00:08:41Z Files modified: * src/modules/rlm_ldap/ldap.h Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/73a7c7e917fa84b428a9… ====== Print proper error for unknown attributes in rlm_ldap mapping sections Arran Cudbard-Bell@2015-03-24T00:07:26Z Files modified: * src/modules/rlm_ldap/attrmap.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/a95ff7357ee3ae70340b… ====== -- This commit summary was generated @2015-03-25T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Threads and modules
by Matthew Newton 24 Mar '15

24 Mar '15

Hi, I've been working on the belief that each separate thread in FreeRADIUS has a separate instantiation of each module, e.g. a new thread calls mod_instantiate at startup and mod_detach at finish. Therefore an instantiation of the module is all within one thread. I'm now thinking about this further, and believe I'm wrong...? Reason - mschap code: I'm grabbing winbind context in mod_instantiate (assuming that is in one thread), using the context in mod_authenticate, then freeing it in mod_detach. That runs fine for a while (all testing was good...) then exhibits problems that I was seeing with a non-threaded library. As I know the library is now thread-safe because of the use of context, I'm guessing that the module instantiation isn't separated per thread? If two threads use the same context at the same time (e.g. are both running with the same module instantiation simultaneously) then obviously Bad Things are going to happen. If this is the case then I guess I'll need to add a connection pool to make sure the contexts aren't shared... nothing major, but will explain what I'm seeing after running under load for ~20 minutes. Cheers, Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk>

3 6

Commit report for v3.0.x branch
by announce＠freeradius.org 23 Mar '15

23 Mar '15

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Proper way of getting TCP connection errors Arran Cudbard-Bell@2015-03-23T16:16:56Z Files modified: * src/lib/socket.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/115b28af86553f1a5e8a… ====== -- This commit summary was generated @2015-03-24T00:00:03Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v3.1.x branch
by announce＠freeradius.org 23 Mar '15

23 Mar '15

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Proper way of getting TCP connection errors Arran Cudbard-Bell@2015-03-23T16:16:45Z Files modified: * src/lib/socket.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/abbe41a72cc10905767c… ====== -- This commit summary was generated @2015-03-24T00:00:03Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Adding UDP/TCP/Unix socket support to rlm_linelog
by Arran Cudbard-Bell 23 Mar '15

23 Mar '15

I've added UDP/TCP/Unix socket support to rlm_linelog in v3.1.x It's currently write only. It discards all responses. This support is intended to be used with things like carbon collector (graphite) and collectd, and is the result of the discussion on adding a rlm_graphite. The data written can be taken directly from octets type attributes, using an attribute ref as the format CONF_PAIR value. I'd appreciate comments and feedback on the socket code. It was written the code editor open in one window, and pubs.opengroup.org in the other, but that doesn't mean it will actually work the way it was intended across multiple platforms. Doing write(fd, NULL, 0); to check for socket connectedness seems like it's going to blow up somewhere at some point, so suggestions for what to do to get pending errors would be very helpful. I've merged a lot of the socket code back into v3.0.x, as the changes for TCP sockets were very minor, and it'll allow us to implement timeouts easily for RADIUS+TCP/RADSEC/Radmin connections. The main commits are: https://github.com/FreeRADIUS/freeradius-server/commit/7e850301ffd3a43a1808… https://github.com/FreeRADIUS/freeradius-server/commit/97c3e8b01339d66a84a3… I plan to fixup the config parsing a bit. Seems stupid to have to define the destination when it could be inferred from the config sections that are present, but that can't be done currently because of issues in the conf parser. There also needs to be a connect_timeout distinct from the write timeout. But that should probably be added to the connection pool section, as virtually every module that uses the connection pool supports connection timeouts, and putting in the pool section helps with consistency, even if the actual timeout is done by the library. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

2 2

Commit report for master branch
by announce＠freeradius.org 22 Mar '15

22 Mar '15

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Cleanup NONNULL According to the compiler documentation putting attributes before the name and argument list of a function definition is not officially supported. Even for static functions. The proper way is to add them add the end of the declaration. This certainly makes doxygen, and my code editor happier. Arran Cudbard-Bell@2015-03-22T05:43:27Z Files modified: * src/main/process.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/6854477a0af7656cd730… ====== Only try and build with wbclient support if we have the headers *AND* the functions (which act as a version check) Arran Cudbard-Bell@2015-03-22T03:26:56Z Files modified: * src/modules/rlm_mschap/config.h.in * src/modules/rlm_mschap/configure * src/modules/rlm_mschap/configure.ac * src/modules/rlm_mschap/rlm_mschap.h Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/7209f81078b71cf23912… ====== Doxygen Arran Cudbard-Bell@2015-03-22T02:31:46Z Files modified: * src/lib/socket.c * src/main/process.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/bd1ae1806baa8e84dca7… ====== Install libwebclient-dev in CIT Arran Cudbard-Bell@2015-03-22T00:57:47Z Files modified: * .travis.yml Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/eb04773c8ba77cfa72d9… ====== -- This commit summary was generated @2015-03-23T00:00:04Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0