- Freeradius-Devel - lists.freeradius.org

"authorize" etc. in v3.1
by Alan DeKok 11 Mar '15

11 Mar '15

The “authorize”, etc. sections are increasingly mis-named. After some discussion with Arran, we’ve come up with what seems like a better approach. I’d like to get other peoples feedback on the suggested design. The idea is to get rid of the randomly named “authorize”, “authenticate”, etc. sections. Instead, we will have a standard set of names. These names are predictable, which is good. The new names can be mapped (hand-waving here) to the old methods, so upgrading from 3.0 to 3.1 won’t require major changes to the config. The idea is to use the following naming scheme: recv foo — run this section when receiving a packet “foo”. process foo - run this section to process a packet “foo” send foo - run this section before sending a packet “foo” The mapping between the new types and old is as follows: recv Access-Request == authorize process Access-Request == authenticate (mostly) send Access-Accept == post-auth send Access-Challenge == no matching section send Access-Reject == Post-Auth-Type Reject recv Accounting-Request == preacct process Accounting-Request == accounting send Accounting-Request == no matching section For proxying, we no longer have pre-proxy and post-proxy, instead we have: send Access-Request == pre-proxy recv Access-Accept == post-proxy recv Access-Reject == post-proxy (oops, that’s probably not a good idea) recv Access-Challenge == post-proxy (oops again) send Accounting-Request = pre-proxy recv Accounting-Reply == post-proxy This suggestion isn’t entirely perfect. The “authenticate” section is really a wrapper for each Auth-Type section. We need to find a way to address that. There’s also the Autz-Type section, which exists, but is very weird. Can it just go away? Does anyone use it? There’s also the “session” section. It doesn’t match the above naming scheme. Maybe we need something else? And what about fail and timeouts? e.g. “no reply to proxied request” should probably be: timeout Access-Request ??? Or “no live home server” could be: fail Access-Request? I’m leaning towards that method, instead of the existing Post-Proxy-Type Fail, etc. That method is confusing for end users, and hard to code. e.g. Why is “fail” inside of post-proxy? Is Post-Proxy-Type Fail run for normal proxying, because it’s inside of the post-proxy section? It not, why not? These things are hard to explain. If, instead, we had consistent names, it becomes trivial to know what to do. It becomes trivial to know what the names are, and what each section does. I *believe* we can set up aliases, etc. which will map the new method to the old one. So no one has to butcher their configuration for 3.1. BUT the benefit of using the new naming scheme is legion. The code becomes MUCH simpler, as does the configuration. Comments? Stones? Alan DeKok.

6 11

Commit report for v3.0.x branch
by announce＠freeradius.org 10 Mar '15

10 Mar '15

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Update Aruba dictionary (from ClearPass 6.5.0) Alexis La Goutte (via Arran Cudbard-Bell)@2015-03-10T21:41:43Z Files modified: * share/dictionary.aruba Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/3a94a3e5515d24cc5bd7… ====== Simplify stats counting Alan T. DeKok@2015-03-10T17:31:52Z Files modified: * src/main/process.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/eef2324c481ab3fcceec… ====== More assertions on free request Alan T. DeKok@2015-03-10T16:20:06Z Files modified: * src/main/process.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/8ed35a01b22d5b0da12b… ====== md4 == nt Alan T. DeKok@2015-03-10T14:55:15Z Files modified: * src/modules/rlm_pap/rlm_pap.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/0c9dfd26804df2ee87f1… ====== -- This commit summary was generated @2015-03-11T00:00:03Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for master branch
by announce＠freeradius.org 10 Mar '15

10 Mar '15

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Add support for custom delimiters in linelog Arran Cudbard-Bell@2015-03-10T22:27:10Z Files modified: * raddb/mods-available/linelog * src/modules/rlm_linelog/rlm_linelog.c * src/tests/modules/linelog/linelog-delim.attrs * src/tests/modules/linelog/linelog-delim.unlang * src/tests/modules/linelog/module.conf Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/16ab1f6a599e62e1af4a… ====== Merge pull request #923 from alagoutte/master Update Aruba dictionary (from ClearPass 6.5.0) Arran Cudbard-Bell@2015-03-10T21:24:27Z Files modified: * share/dictionary.aruba Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/cb6d2ac5ca8eab761152… ====== Update Aruba dictionary (from ClearPass 6.5.0) Alexis La Goutte@2015-03-10T21:16:56Z Files modified: * share/dictionary.aruba Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/629b5a5df0d9d73df497… ====== Simplify stats counting Alan T. DeKok@2015-03-10T18:47:41Z Files modified: * src/main/process.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/4927ecf732328ba4540c… ====== More assertions on free request Alan T. DeKok@2015-03-10T18:47:40Z Files modified: * src/main/process.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/dfdcd9eded4f73bd58cf… ====== md4 == nt Alan T. DeKok@2015-03-10T18:47:39Z Files modified: * src/modules/rlm_pap/rlm_pap.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/e5f95c0604df1ab207ee… ====== Fix Cisco attributes. Fixes #921 Alan T. DeKok@2015-03-10T18:47:29Z Files modified: * share/dictionary.cisco.asa Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/37620296eb862aedafe8… ====== -- This commit summary was generated @2015-03-11T00:00:03Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v2.x.x branch
by announce＠freeradius.org 10 Mar '15

10 Mar '15

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== md5 == nt Alan T. DeKok@2015-03-10T14:54:44Z Files modified: * src/modules/rlm_pap/rlm_pap.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/cafd478b805c923bd6aa… ====== -- This commit summary was generated @2015-03-11T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v3.0.x branch
by announce＠freeradius.org 09 Mar '15

09 Mar '15

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Fix Cisco attributes. Fixes #921 Alan T. DeKok@2015-03-09T21:06:50Z Files modified: * share/dictionary.cisco.asa Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/f4d1e488b182d005f9cd… ====== Re-enable "Temporarily disable failing regex tests" This reverts commit 3bfb4d220c95403764056d28588b8f7d7fca2775. Alan T. DeKok@2015-03-09T20:48:21Z Files modified: * src/tests/unit/condition.txt Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/4b091655bb4c12a5592e… ====== typo Alan T. DeKok@2015-03-09T20:13:33Z Files modified: * doc/ChangeLog Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/0e4ec0aa5df4afe56f9b… ====== note recent changes Alan T. DeKok@2015-03-09T20:00:19Z Files modified: * doc/ChangeLog Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/247601217c9646ee2040… ====== Re-run command after connection failure Alan T. DeKok@2015-03-09T17:53:49Z Files modified: * src/main/radmin.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/c75cf0a14ec0764f1ea9… ====== Clean up statistics handling Alan T. DeKok@2015-03-09T17:48:32Z Files modified: * src/main/listen.c * src/main/process.c * src/main/stats.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/5b5d4290041d79e80a88… ====== last may be NULL Alan T. DeKok@2015-03-09T17:45:20Z Files modified: * src/main/command.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/9e822eb8de25ada708e9… ====== Mark home server state unknown after "response_window" if now > last_packet + response_window, the state is unknown otherwise, we got a packet recently, so it's still alive Alan T. DeKok@2015-03-09T17:03:20Z Files modified: * src/main/process.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/7a7d7aa0b721b7371fdc… ====== Realloc string to the correct length Alan T. DeKok@2015-03-09T14:58:27Z Files modified: * src/main/parser.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/70ba651d66bfbae037ac… ====== Rename 2.x.x branch to long term support Arran Cudbard-Bell@2015-03-09T03:18:53Z Files modified: * doc/source/extra/toc.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/d909bf1064293a0a2654… ====== Merge pull request #919 from nchaigne/3.0.x-fb3 Use proper DHCP vendor Arran Cudbard-Bell@2015-03-09T00:00:48Z Files modified: * src/modules/proto_dhcp/dhcpclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/592318b95e8619d80d45… ====== Use proper DHCP vendor DHCP-Message-Type is from dhcp "vendor". And internal attributes such as Packet-Type have no vendor. Nicolas C@2015-03-04T18:42:41Z Files modified: * src/modules/proto_dhcp/dhcpclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/ee858f2a50c4c589d774… ====== -- This commit summary was generated @2015-03-10T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for master branch
by announce＠freeradius.org 09 Mar '15

09 Mar '15

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Re-enable "Temporarily disable failing regex tests" This reverts commit 3bfb4d220c95403764056d28588b8f7d7fca2775. Alan T. DeKok@2015-03-09T20:49:15Z Files modified: * src/tests/unit/condition.txt Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/e7ac205f8aaac62d57de… ====== Leave regexes unmolested. The regex compiler can do necessary de-quoting Alan T. DeKok@2015-03-09T20:49:06Z Files modified: * src/main/parser.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/cfb3a20c8e3f8cf3bbcd… ====== Re-run command after connection failure Alan T. DeKok@2015-03-09T17:54:06Z Files modified: * src/main/radmin.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/7ae03181df247ae021aa… ====== Clean up statistics handling Alan T. DeKok@2015-03-09T17:48:54Z Files modified: * src/main/listen.c * src/main/process.c * src/main/stats.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/6ecf0aa528602bd553d2… ====== last may be NULL Alan T. DeKok@2015-03-09T17:48:53Z Files modified: * src/main/command.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/f309dad067d7c3034208… ====== Mark home server state unknown after "response_window" if now > last_packet + response_window, the state is unknown otherwise, we got a packet recently, so it's still alive Alan T. DeKok@2015-03-09T17:07:35Z Files modified: * src/main/process.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/b45ff837c596f9176fd1… ====== Die correct_escapes/cf_new_escape Arran Cudbard-Bell@2015-03-09T04:36:50Z Files modified: * raddb/proxy.conf * raddb/radiusd.conf.in * src/include/conffile.h * src/main/conffile.c * src/main/modcall.c * src/main/parser.c * src/main/radattr.c * src/main/tmpl.c * src/main/xlat.c * src/modules/rlm_realm/rlm_realm.c * src/tests/config/test.conf * src/tests/keywords/radiusd.conf * src/tests/modules/radiusd.conf * src/tests/xlat/radiusd.conf Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/e035c606ba8ea50266e9… ====== Rename 2.x.x branch to long term support Arran Cudbard-Bell@2015-03-09T03:18:33Z Files modified: * doc/source/extra/toc.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/9a8001fad8a9fbe350e6… ====== Outdent reformed code PDD (via Arran Cudbard-Bell)@2015-03-09T00:41:59Z Files modified: * src/modules/rlm_yubikey/rlm_yubikey.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/7d7030ea05d879982f89… ====== Reform if so that the error just returns, and otherwise code continues PDD (via Arran Cudbard-Bell)@2015-03-09T00:41:55Z Files modified: * src/modules/rlm_yubikey/rlm_yubikey.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/ab2ccebf03851c9816a7… ====== Timestamp typo PDD (via Arran Cudbard-Bell)@2015-03-09T00:41:51Z Files modified: * src/modules/rlm_yubikey/decrypt.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/452d390bba15030e36b6… ====== Update documentation to describe the attribute's values PDD (via Arran Cudbard-Bell)@2015-03-09T00:41:47Z Files modified: * raddb/mods-available/yubikey Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/2f666072ddbf367d1cb9… ====== Document the module's additions to the site configuration PDD (via Arran Cudbard-Bell)@2015-03-09T00:41:43Z Files modified: * raddb/mods-available/yubikey Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/c882917d97c1b0a9899c… ====== Reduce the calculation of counter and timestamp to a single instance. PDD (via Arran Cudbard-Bell)@2015-03-09T00:41:39Z Files modified: * src/modules/rlm_yubikey/decrypt.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/e67b6b991c45f2f645dd… ====== Combined equal size password length with greater than sized. This should fix both the issues: if this was not split, it would not be checked; and if equal sized and split it would not create the Yubikey-OTP attribute (although it was sufficient). PDD (via Arran Cudbard-Bell)@2015-03-09T00:41:35Z Files modified: * src/modules/rlm_yubikey/rlm_yubikey.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/8c30b21c5b3b6f20fbb6… ====== Changed Auth-Type assignment until after Public-ID possible failure PDD (via Arran Cudbard-Bell)@2015-03-09T00:41:31Z Files modified: * src/modules/rlm_yubikey/rlm_yubikey.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/857f418e23f98ae3626f… ====== Reduced extra passcode and len assignment PDD (via Arran Cudbard-Bell)@2015-03-09T00:41:26Z Files modified: * src/modules/rlm_yubikey/rlm_yubikey.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/39492a5399fdc58a210a… ====== Eliminate redundant return PDD (via Arran Cudbard-Bell)@2015-03-09T00:40:53Z Files modified: * src/modules/rlm_yubikey/rlm_yubikey.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/e7c9345aa79dadf6c1d9… ====== Merge pull request #919 from nchaigne/3.0.x-fb3 Use proper DHCP vendor Arran Cudbard-Bell@2015-03-09T00:01:27Z Files modified: * src/modules/proto_dhcp/dhcpclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/2596573be8a0b0baf070… ====== -- This commit summary was generated @2015-03-10T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

53f527be190 - symlinking /dev/urandom into raddb/certs
by Phil Mayers 09 Mar '15

09 Mar '15

I just got surprised by this; one possible side effect that might have been missed here, it stops you doing this: grep -r something /etc/raddb ...as it spins forever on the random device. Not sure why I've never seen it before when testing 3.0.x

4 3

Another leak: tls_new_client_session
by Sam Hartman 09 Mar '15

09 Mar '15

hi. 3.0.7 also seems to be leaking client proxy ssl state. First, where does SSL_free get called for the ssl created in tls_new_client_session? It seems that a talloc destructor is used for tls_new_session, but I don't see the logic that causes the session state to be freed for client sessions? Is there a missing set_destructor call? Secondly, I seem to be getting tls_new_client_session objects leaking some of the time. Causing errors like killing the process on the other end of the connection makes it more likely. I'm judging this because I do have a few sessions allocated on tls.c line 219 still around even after I've shut down the home server that the tls_session was for. Why is the TLS client session hanging off the configuration talloc context not a socket context of some kind?

3 30

3.1.x branch
by Arran Cudbard-Bell 09 Mar '15

09 Mar '15

From this point onwards v3.0.x no major new features will be accepted into v3.0.x. A new branch, v3.1.x, has been forked from master. All new feature development should be done on the v3.1.x branch. All new pull requests for features should be submitted against v3.1.x. Major re-architecturing will then start in master. v3.1.x will be used for development/preview releases. We'll add tags regularly but versions will not be released on the freeRADIUS website. Changes in v3.1.x will be merged to master. Bug fixes in v3.0.x will be merged into v3.1.x and master where relevant. The primary reasons for creating a new branch are: - We need to stabilise v3.0.x, but still need to add new features to the server. - Maintaining compatibility with v3.0.x is getting difficult. The new/old escapes code is particularly annoying to unpick. In v3.1.x all the code that allowed for the old escaping mode will be removed, as will support for the old client syntax, and all the config items currently marked as deprecated in v3.0.x. - There's code in the current master than should have been merged into v3.0.x a while back, but hasn't. The code concerns error handling in update sections and conditions. Restoring atomic behaviour for the update sections, and having xlats trigger abort and rollback behaviour on errors is the behaviour we should aim for. However, if we reintroduced atomic update sections in v3.0.x it might break lots of existing configs. Master will not be config compatible. Unlang, and the majority of the module syntax will be. So it won't be as painful as migrating from v2 to v3, but the authorize, authenticate, post-auth sections won't exist in their current form. We need a syntax that can describe processing flows for multiple protocols, not just RADIUS. Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

Commit report for v3.0.x branch
by announce＠freeradius.org 08 Mar '15

08 Mar '15

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Proper fix for "Disable regex \n test. Some engines can't take \n" Arran Cudbard-Bell@2015-03-08T23:55:26Z Files modified: * src/tests/keywords/if-regex-match-comp Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/a66b4bf47dce2f3b881a… ====== Add notes on 3.1.x branch Arran Cudbard-Bell@2015-03-08T23:25:32Z Files modified: * doc/source/extra/toc.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/72c19531cc1799752807… ====== Disable regex \n test. Some engines can't take \n Alan T. DeKok@2015-03-08T14:49:51Z Files modified: * src/tests/keywords/if-regex-match-comp Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/ce586358ee345841d5c3… ====== Typo Alan T. DeKok@2015-03-08T01:57:21Z Files modified: * src/modules/rlm_realm/trustrouter.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/f811874d152e647df252… ====== -- This commit summary was generated @2015-03-09T00:00:04Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0