March 2015 - Freeradius-Devel - lists.freeradius.org

Commit report for v3.0.x branch
by announce＠freeradius.org 06 Mar '15

06 Mar '15

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== note recent changes Alan T. DeKok@2015-03-06T22:30:33Z Files modified: * doc/ChangeLog Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/c38b63bb724d7c651d44… ====== proxy_new_listener() gets a talloc_ctx so we can clean it up Alan T. DeKok@2015-03-06T22:22:56Z Files modified: * src/include/radiusd.h * src/main/listen.c * src/main/process.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/0b77259eac3dc9b9147d… ====== Use autofree context Alan T. DeKok@2015-03-06T22:22:56Z Files modified: * src/main/radiusd.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/bf3d49374338efad7e5a… ====== Remove SSL mutex memory on clean exit Alan T. DeKok@2015-03-06T22:22:56Z Files modified: * src/main/threads.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/325e9ad5d611bd1f25ed… ====== Clean up hash table on stop Alan T. DeKok@2015-03-06T22:22:56Z Files modified: * src/main/threads.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/e990c8a4bb3d611e6c14… ====== Clean up the fifos on clean exit Alan T. DeKok@2015-03-06T22:22:56Z Files modified: * src/main/threads.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/efa611f3fea4c7b2d22a… ====== fr_packet_list_id_alloc returns bool Alan T. DeKok@2015-03-06T22:21:03Z Files modified: * src/main/process.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/da98684d242fda14b401… ====== Merge pull request #920 from leprechau/small_updates small updates Alan DeKok@2015-03-06T20:38:54Z Files modified: * src/modules/rlm_couchbase/README.md * src/modules/rlm_couchbase/mod.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/accf635b43c094493d79… ====== small updates * fixed documentation typos and corrected other sections * modified client loading to respect keys returned from view payloads Aaron Hurt@2015-03-06T19:58:58Z Files modified: * src/modules/rlm_couchbase/README.md * src/modules/rlm_couchbase/mod.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/eda922b47388adfdbcf5… ====== Make print match parse Alan T. DeKok@2015-03-06T20:37:58Z Files modified: * src/main/tmpl.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/4640e6dc08225790a2d3… ====== Leave regexes unmolested. The regex compiler can do necessary de-quoting Alan T. DeKok@2015-03-06T18:40:29Z Files modified: * src/main/parser.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/7629ce4ec640c65610e0… ====== Relax restrictions on group membership query We don't need to have groupcheck / group reply attrs Alan T. DeKok@2015-03-06T18:33:38Z Files modified: * src/modules/rlm_sql/rlm_sql.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/cb307a24f9b2ac3446a8… ====== Allow "netmask" to work again Alan T. DeKok@2015-03-06T18:29:29Z Files modified: * src/main/client.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/bcd1433a38caf0232d11… ====== note recent changes Alan T. DeKok@2015-03-06T17:42:37Z Files modified: * doc/ChangeLog Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/9f02733bf070651d6e8c… ====== Put TCP listeners into a tree in their parent For various talloc issues Alan T. DeKok@2015-03-06T17:42:13Z Files modified: * src/include/radiusd.h * src/main/listen.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/119f974cec528834d8a1… ====== One more regex test Alan T. DeKok@2015-03-06T17:41:05Z Files modified: * src/tests/unit/condition.txt Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/97470a99383ffb769667… ====== note recent changes Alan T. DeKok@2015-03-06T00:07:26Z Files modified: * doc/ChangeLog Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/c0d77c62afc024fa10e2… ====== Ensure that types can't have value 0 So we don't run into the previous problem again Alan T. DeKok@2015-03-06T00:04:45Z Files modified: * src/main/modules.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/308a45f1f5b421c0d85b… ====== -- This commit summary was generated @2015-03-07T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

regular expression error in 3.0.x not present in 3.0.6
by Aaron Hurt 06 Mar '15

06 Mar '15

I have a policy.d file containing a regular expression that works in 3.0.6 that I’ve tried with two different flavors. Both flavors load and work in 3.0.6 but error in the latest 3.0.x branch. Flavor1: simple_nt_regexp = "^([^\\\\]*)(\\\\(.*))$" Flavor2: simple_nt_regexp = "^([^\\\\]*)\\\\(.*)$” In 3.0.x from today: /opt/local/etc/raddb/policy.d/strip-user-domain[9]: Invalid regular expression: /opt/local/etc/raddb/policy.d/strip-user-domain[9]: ^([^\\]*)\\(.*)$ /opt/local/etc/raddb/policy.d/strip-user-domain[9]: ^ Pattern study failed: unknown or incorrect option bit(s) set /opt/local/etc/raddb/policy.d/strip-user-domain[10]: Invalid regular expression: /opt/local/etc/raddb/policy.d/strip-user-domain[10]: ^([^\\]*)(\\(.*))$ /opt/local/etc/raddb/policy.d/strip-user-domain[10]: ^ Pattern study failed: unknown or incorrect option bit(s) set Is there something obvious that I am missing? — Aaron

5 13

Commit report for master branch
by announce＠freeradius.org 05 Mar '15

05 Mar '15

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Make tls_new_client_session set a destructor, too. So that ssn->ssl gets freed Alan T. DeKok@2015-03-05T18:27:51Z Files modified: * src/main/tls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/8859800057bc4efbda29… ====== No need for these functions to be exported Alan T. DeKok@2015-03-05T18:27:50Z Files modified: * src/include/tls-h * src/main/tls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/333d513a9c91856a49bb… ====== More doc fixes Arran Cudbard-Bell@2015-03-05T18:07:46Z Files modified: * src/main/tmpl.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/dc5bc238cbfc13ceea8d… ====== Don't use 0 for any value. It's reserved for the default section Alan T. DeKok@2015-03-05T17:36:36Z Files modified: * share/dictionary.freeradius.internal Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/a0e25556df90adfe18fc… ====== Limit talloc report depth So that we don't blow up on talloc loops. Which shouldn't happen. Alan T. DeKok@2015-03-05T15:08:30Z Files modified: * src/lib/debug.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/68b0559e7f09e991d381… ====== use separate definitions and declarations for mod_* functions in rlm_sql Arran Cudbard-Bell@2015-03-05T05:56:22Z Files modified: * src/modules/rlm_sql/rlm_sql.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/25bb029aeb444410f73d… ====== rlm_sql should return noop if we can't find a matching query section Arran Cudbard-Bell@2015-03-05T05:45:58Z Files modified: * src/main/conffile.c * src/modules/rlm_sql/rlm_sql.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/d165e7e966009a37be9c… ====== Only print cleanup messages if a message about the request was logged Arran Cudbard-Bell@2015-03-05T04:45:53Z Files modified: * src/include/radsniff.h * src/main/radsniff.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/6cd1ad3ced56a76d29f7… ====== Fix @return in tmpl_*expand Arran Cudbard-Bell@2015-03-05T04:36:07Z Files modified: * src/main/tmpl.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/6d5cf233573addca49f1… ====== Return int not bool for all tmpl functions Arran Cudbard-Bell@2015-03-05T02:35:48Z Files modified: * src/include/tmpl.h * src/main/map.c * src/main/modcall.c * src/main/parser.c * src/main/tmpl.c * src/modules/rlm_cache/serialize.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/4fe59c14764dccbb7d40… ====== Complete documentation for templates Arran Cudbard-Bell@2015-03-05T01:42:46Z Files modified: * src/include/tmpl.h * src/main/tmpl.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/7fc9b7a664e67b4ae333… ====== tmpl_free function is no longer needed, as value_pair_tmpl_t have an internal buffer for storing unknown attributes. Arran Cudbard-Bell@2015-03-05T01:14:48Z Files modified: * src/include/tmpl.h * src/main/modcall.c * src/main/tmpl.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/841444db010aac694789… ====== -- This commit summary was generated @2015-03-06T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v3.0.x branch
by announce＠freeradius.org 05 Mar '15

05 Mar '15

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Make tls_new_client_session set a destructor, too. So that ssn->ssl gets freed Alan T. DeKok@2015-03-05T18:27:15Z Files modified: * src/main/tls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/e4dcf8c962e0f2e6ff8d… ====== No need for these functions to be exported Alan T. DeKok@2015-03-05T18:23:59Z Files modified: * src/include/tls-h * src/main/tls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/1727234870e4a5c545fe… ====== Don't use 0 for any value. It's reserved for the default section Alan T. DeKok@2015-03-05T17:36:29Z Files modified: * share/dictionary.freeradius.internal Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/d9a9d594e666d70b9762… ====== More doc fixes Arran Cudbard-Bell@2015-03-05T17:22:41Z Files modified: * src/main/tmpl.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/71c4361b6acc316c5d32… ====== Limit talloc report depth So that we don't blow up on talloc loops. Which shouldn't happen. Alan T. DeKok@2015-03-05T15:07:46Z Files modified: * src/lib/debug.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/c00210cb32efa1e59018… ====== use separate definitions and declarations for mod_* functions in rlm_sql Arran Cudbard-Bell@2015-03-05T05:56:14Z Files modified: * src/modules/rlm_sql/rlm_sql.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/cf1529ec894cecee0a35… ====== rlm_sql should return noop if we can't find a matching query section Arran Cudbard-Bell@2015-03-05T05:45:51Z Files modified: * src/main/conffile.c * src/modules/rlm_sql/rlm_sql.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/fc294bc82c908290cf8f… ====== Only print cleanup messages if a message about the request was logged Arran Cudbard-Bell@2015-03-05T04:44:37Z Files modified: * src/include/radsniff.h * src/main/radsniff.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/0fc782a609681ec300cf… ====== Fix @return in tmpl_*expand Arran Cudbard-Bell@2015-03-05T04:33:48Z Files modified: * src/main/tmpl.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/b09b10b1819b43d474c8… ====== Return int not bool for all tmpl functions Arran Cudbard-Bell@2015-03-05T02:35:24Z Files modified: * src/include/tmpl.h * src/main/map.c * src/main/modcall.c * src/main/parser.c * src/main/tmpl.c * src/modules/rlm_cache/serialize.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/d60a54f16b69bd278510… ====== Minor corrections Arran Cudbard-Bell@2015-03-05T01:43:04Z Files modified: * src/main/tmpl.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/2e3188751bfed12d29ed… ====== Complete documentation for templates Arran Cudbard-Bell@2015-03-05T01:13:29Z Files modified: * src/include/tmpl.h * src/main/tmpl.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/422c3b4744e3ee28f4d8… ====== tmpl_free function is no longer needed, as value_pair_tmpl_t have an internal buffer for storing unknown attributes. Arran Cudbard-Bell@2015-03-05T01:11:31Z Files modified: * src/include/tmpl.h * src/main/modcall.c * src/main/tmpl.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/626114ab37064ee6d55c… ====== -- This commit summary was generated @2015-03-06T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

filter_username and regexps broken
by Sam Hartman 05 Mar '15

05 Mar '15

I'm getting a request denied because the username matches \.\., but I don't see why that should be true Thread 3 handling request 0, (1 handled so far) (0) Received Access-Request Id 0 from 127.0.0.1:53392 to 0.0.0.0:2083 length 130 (0) User-Name = '@apc.painless-security.com' (0) GSS-Acceptor-Service-Name = 'trustidentity' (0) GSS-Acceptor-Host-Name = 'hartmans.local' (0) EAP-Message = 0x0200001f01406170632e7061696e6c6573732d73656375726974792e636f6d (0) Message-Authenticator = 0xc977441e8dda36e128cbd617a7f16ed1 (0) # Executing section authorize from file /etc/freeradius/sites-enabled/abfab-tr-idp (0) authorize { (0) policy psk_authorize { (0) if (tls-psk-identity =* ANY) { (0) if (tls-psk-identity =* ANY) -> FALSE (0) } # policy psk_authorize = notfound (0) policy filter_username { (0) if (!&User-Name) { (0) if (!&User-Name) -> FALSE (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@.*@/ ) { (0) if (&User-Name =~ /@.*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> TRUE (0) if (&User-Name =~ /\.\./ ) { (0) update reply { (0) &Reply-Message += 'Rejected: Username contains ..s' (0) } # update reply = noop (0) [reject] = reject (0) } # if (&User-Name =~ /\.\./ ) = reject (0) } # policy filter_username = reject (0) } # authorize = reject (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/sites-enabled/abfab-tr-idp (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> @apc.painless-security.com (0) attr_filter.access_reject: Matched entry DEFAULT at line 18 (0) [attr_filter.access_reject] = updated (0) if &reply:Eap-Message { (0) if &reply:Eap-Message -> FALSE (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Thread 3 waiting to be assigned a request Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 0 from 0.0.0.0:2083 to 127.0.0.1:53392 length 53 (0) Reply-Message += 'Rejected: Username contains ..s' Waking up in 3.9 seconds. Closing TLS socket from client port 53392 (0) >>> TLS 1.0 Alert [length 0002], warning close_notify Client has closed connection Waking up in 3.9 seconds.

2 1

Reply-Message and Eap
by Sam Hartman 05 Mar '15

05 Mar '15

so, I understand why it would be confusing to have both a Reply-Message and an Eap-Message in the same packet. I'm a bit confused why it's desirable to insert an EAP failure into a packet in an access reject case. We'd like to do a better job of error reporting back to ABFAB clients than "Uh, it failed." for some things we can use Error-Cause as we discussed previously. However it would be really nice to get a text string back too. What I'd like to do is send back a packet with no EAP message and a Reply-Message. Will that break things? would it be reasonable to update policy to prefer keeping Reply-Message over replacing Reply-Message with an EAP failure in the case where we're handling a reject that currently has no EAP message at all? I.E. we rejected before eap got called in authorize/authenticate, or unlang removed Eap-Message. --Sam

3 7

Commit report for v3.0.x branch
by announce＠freeradius.org 04 Mar '15

04 Mar '15

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Example virtual server which does challenge / response Alan T. DeKok@2015-03-04T23:08:32Z Files modified: * raddb/sites-available/challenge Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/b0f2052bf89461f40ecd… ====== Don't put state vps until we're in post-auth Alan T. DeKok@2015-03-04T23:05:52Z Files modified: * src/main/auth.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/1acaca563f79ba0899a3… ====== Clean up proxy state machine Encode the proxied packet && debug print it before changing request->process or request->child_state. set request->process = proxy_wait_for_reply just prior to proxying the packet. Clean up the timer code to not muck with request->process in PROXIED state. It MUST be already set to a useful value. When we get PROXY_REPLY in wait_for_reply, we queue up the "running" function. Alan T. DeKok@2015-03-04T19:23:29Z Files modified: * src/main/process.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/f9c26518946d1dd030a7… ====== TYPDEF_HIDES_STRUCT breaks the doc build on Linux Arran Cudbard-Bell@2015-03-04T16:29:44Z Files modified: * doc/source/Doxyfile Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/26de79ba79e75ff8902c… ====== note recent changes Alan T. DeKok@2015-03-04T16:29:31Z Files modified: * doc/ChangeLog Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/810f4650416b6d4b9ea9… ====== Update assertions Alan T. DeKok@2015-03-04T16:07:33Z Files modified: * src/main/listen.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/b9efc48dea858a686108… ====== Merge pull request #918 from nchaigne/3.0.x-fb2 Allow to set DHCP packet code from input VPs Alan DeKok@2015-03-04T16:02:30Z Files modified: * src/modules/proto_dhcp/dhcpclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/ca24201660f5e4e3c523… ====== Allow to set DHCP packet code from input VPs The command argument is now optional, and can also be 'auto'. In this case, the packet code must be specified in the value pairs provided as input (either from DHCP-Message-Type, or Packet-Code). (This also fixes the segfault that occured if command was ommited) Nicolas C@2015-03-04T11:30:07Z Files modified: * src/modules/proto_dhcp/dhcpclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/5225e55171af044c0116… ====== Convert explicit frees to asserts that the parents are correct Because the talloc hierarchy should be correct, which means that talloc should clean everything up Alan T. DeKok@2015-03-04T15:51:57Z Files modified: * src/main/listen.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/0b5ea1fa1863f35b2340… ====== Make tls_new_client_session() take talloc_ctx and pass in correct ctx so we don't leak memory Alan T. DeKok@2015-03-04T15:47:06Z Files modified: * src/include/tls-h * src/main/listen.c * src/main/tls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/fe52c3c1b13061b13042… ====== Pass "sock" as talloc ctx instead of stealing to sock Alan T. DeKok@2015-03-04T15:46:36Z Files modified: * src/main/tls_listen.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/7ce23530ddafc1ee26ab… ====== -- This commit summary was generated @2015-03-05T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v2.x.x branch
by announce＠freeradius.org 04 Mar '15

04 Mar '15

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== note recent changes Alan T. DeKok@2015-03-04T14:07:53Z Files modified: * doc/ChangeLog Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/8d6dd97ea0e86b2735c4… ====== Use the correct name if there are multiple tagged attributes Alan T. DeKok@2015-03-04T14:06:12Z Files modified: * src/modules/rlm_perl/rlm_perl.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/aa567fa3fab1ac45fdb8… ====== -- This commit summary was generated @2015-03-05T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for master branch
by announce＠freeradius.org 04 Mar '15

04 Mar '15

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Example virtual server which does challenge / response Alan T. DeKok@2015-03-04T23:08:54Z Files modified: * raddb/sites-available/challenge Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/cdc28d66687bc4eef6bf… ====== Don't put state vps until we're in post-auth Alan T. DeKok@2015-03-04T23:08:53Z Files modified: * src/main/auth.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/65dc7ac54eb23d9a4f3f… ====== Clean up proxy state machine Encode the proxied packet && debug print it before changing request->process or request->child_state. set request->process = proxy_wait_for_reply just prior to proxying the packet. Clean up the timer code to not muck with request->process in PROXIED state. It MUST be already set to a useful value. When we get PROXY_REPLY in wait_for_reply, we queue up the "running" function. Alan T. DeKok@2015-03-04T19:23:38Z Files modified: * src/main/process.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/9c3575912c491c9ffc36… ====== TYPDEF_HIDES_STRUCT breaks the doc build on Linux Arran Cudbard-Bell@2015-03-04T16:29:29Z Files modified: * doc/source/Doxyfile Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/d8cb1a7631e24dfa199a… ====== Update assertions Alan T. DeKok@2015-03-04T16:11:06Z Files modified: * src/main/listen.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/019414767c994c4dfdae… ====== Allow to set DHCP packet code from input VPs The command argument is now optional, and can also be 'auto'. In this case, the packet code must be specified in the value pairs provided as input (either from DHCP-Message-Type, or Packet-Code). (This also fixes the segfault that occured if command was ommited) Nicolas C (via Alan T. DeKok)@2015-03-04T16:02:45Z Files modified: * src/modules/proto_dhcp/dhcpclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/d60e87b2e9d9c1f025a0… ====== Convert explicit frees to asserts that the parents are correct Because the talloc hierarchy should be correct, which means that talloc should clean everything up Alan T. DeKok@2015-03-04T15:52:17Z Files modified: * src/main/listen.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/b43a4d052345e505d4b7… ====== Make tls_new_client_session() take talloc_ctx and pass in correct ctx so we don't leak memory Alan T. DeKok@2015-03-04T15:52:17Z Files modified: * src/include/tls-h * src/main/listen.c * src/main/tls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/f6f05ba6a944ceeab504… ====== Pass "sock" as talloc ctx instead of stealing to sock Alan T. DeKok@2015-03-04T15:52:16Z Files modified: * src/main/tls_listen.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/6da0ad6c6ab5328716c2… ====== -- This commit summary was generated @2015-03-05T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Memory leak in dual_tls_receive
by Sam Hartman 04 Mar '15

04 Mar '15

Hi. One of the Moonshot sites has been having trouble with a memory leak that I've been trying to track down. I've just reproduced this with 3.0.7 with a minor patch to get the trust router code compiling after a change in the home server structure between 3.0.6 and 3.0.7. I'll send along that patch shortly. I've set up Freeradius in valgrind and am getting consistent behavior with 3.0.4 and 3.0.7 (and Stefan sees a leak with 3.0.6). what I see is that sometimes the following hunks in dual_tls_receive leak: if (!sock->request) { sock->request = request = request_alloc(NULL); /* possibly leaked 379 times out of 6,951 requests*/ /* * Not sure if we should do this on every packet... */ request->reply = rad_alloc(request, false); /* definitely leaked 258 times ; possibly leaked 379out of 6,951 requests*/ In valgrind, a possible leak means that there is a live pointer to something within the structure, but not the beginning. If you're playing weird pointer games that might not be a leak. However, it seems fairly clear to me that from the indicated code a possible leak in valgrind's vocabulary is a real leak. My client will use a new TLS client socket per EAP authentication, but probably tends to keep the socket open for each request in an authentication. I think I'm seeing 6-7 messages per authentication. So, I don't think it's just that it's leaking once per socket open, although that might be it. I don't understand the memory management for the structures involved well enough to evaluate correctness. Where should those requests be being freed? what should I look into? Also, I am waiting for all the client sockets to close and be cleaned up before taking the valgrind dump.

3 4