- Freeradius-Devel - lists.freeradius.org

Commit report for master branch
by announce＠freeradius.org 11 Feb '14

11 Feb '14

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Fixup logging calls in bfd.c Arran Cudbard-Bell@2014-02-11T22:07:30Z Files modified: * src/main/process.c * src/modules/proto_bfd/bfd.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/896172b6d83f9fd46187… ====== Limit "max_requests" complaint to once per second Alan T. DeKok@2014-02-11T21:33:13Z Files modified: * src/main/process.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/f1ede2e7a3a3a1472cf0… ====== Various coverity fixes Alan T. DeKok@2014-02-11T21:29:49Z Files modified: * src/main/listen.c * src/modules/proto_bfd/bfd.c * src/modules/proto_dhcp/dhcpd.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/0aeba6901678f6f65e9e… ====== Need to use errno for GNU strerror_r errors Arran Cudbard-Bell@2014-02-11T21:20:52Z Files modified: * src/lib/log.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/b98d4e33e7ef9ea6bd38… ====== radiusd is called freeradius on debian platforms Arran Cudbard-Bell@2014-02-11T21:20:52Z Files modified: * src/main/listen.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/69bb7ae8a6fd5a0dc87f… ====== Allow horrible hack again. If pair "foo" is in a template "blug", you can do: blah { $template blug $INCLUDE ${confdir}/${foo} } Which is bizarre, but I guess it works. Alan T. DeKok@2014-02-11T20:19:11Z Files modified: * src/main/conffile.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/578a4ab965b0bcfd0086… ====== Remove extraneous "," There's no need to do "%s%s", foo , "," Alan T. DeKok@2014-02-11T16:17:49Z Files modified: * src/main/tls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/75ccf994b3e7b7aeaed9… ====== Cache CUI, too Alan T. DeKok@2014-02-11T16:17:48Z Files modified: * src/main/tls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/90065f10f5078498afac… ====== Fix templating code. Instead of hacking a reference into cf_pair_find() but not cf_section_*_find(), we just copy the template recursively. When we reach the end of a section with a template, we merge a copy of the template into the current section, then we nuke the relationship between the section and the template. This uses more memory, but it means that templates now work with subsections Alan T. DeKok@2014-02-11T03:05:47Z Files modified: * src/main/conffile.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/36cc97622c3bcdf09bc2… ====== Remove templating from cf_pair_find(). This breaks the server, so the next commit will add templates back in again, in a better fashion. We also remove the ability to do cf_pair_find(cs, NULL), and have it return the first CONF_PAIR. After searching the code, no one uses this functionality. So it's best to remove it. Alan T. DeKok@2014-02-11T03:05:46Z Files modified: * src/main/conffile.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/c33babc5bc1f25a95ed5… ====== Remove cf_section_template(). No one uses it Alan T. DeKok@2014-02-11T03:05:44Z Files modified: * src/include/conffile.h * src/main/conffile.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/1915b6143f8b81921246… ====== Add additional debugging messages around strerror_r() We already checked for features.h on this branch. Arran Cudbard-Bell@2014-02-11T00:21:06Z Files modified: * src/lib/log.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/bb94f52da9ce9cda35d2… ====== -- This commit summary was generated @2014-02-12T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

3.0.x: Session resumption and CUI calculation
by Stefan Winter 11 Feb '14

11 Feb '14

Hello, so, now that session resumption works, there seems to be an error in the calculation of Chargeable-User-Identity in the *reauth* of tunneled methods (tried PEAP). Here is a full -Xxx debug log to show the xlat parser sequence: http://pastebin.com/4N5zYJXw The input in both the auth and re-auth is an Access-Request with Operator-Name = "1restena.lu" Chargeable-User-Identity=\0 User-Name (outer) = "availability-test(a)education.lu" In phase 2 during auth, the actual inner User-Name is then "test.eduroam(a)education.lu". This is correctly memorised by the session cache logic. At first auth: The (default) salt "changeme", the inner User-Name and the Operator-Name value trigger the calculation and returning of CUI. The calculated value is Chargeable-User-Identity = '5a91e08fc9760dca96a311ccb333e2b8737ad600' which I think is correct. During re-auth, I see the line: eap_peap : Adding cached attributes for session 8443da65e46717de420e76b52167eced7712da034f9cee7bef1cffb899a7209d: User-Name = 'test.eduroam(a)education.lu' so during reauth time, the username to be used is known prior to the calculation of the reauth CUI. And yet: expand: "%{sha1:changeme%{tolower:%{User-Name}}%{%{Operator-Name}:-}}" -> 'ad40aca101096cde0ce27b387939e4c76d8234ca' This is not what one needs. I suspect that this construct uses the request:User-Name (availability-test(a)education.lu) instead of the retrieved session's (test.eduroam(a)education.lu) I wonder how to correctly reference the "inner" User-Name. Since there is no phase 2 (but a fake attribute list for that phase 2) would inner.User-Name work? Or use reply:User-Name explicitly? One of those two should fix the situation if writing "%{sha1:changeme%{tolower:%{%{reply:User-Name}:-%{User-Name}}}%{%{Operator-Name}:-}}" The reply (or maybe inner) part of it would work for the retrieved fake phase2 id, and for methods with no tunnel at all (say EAP-TLS) it would get expanded to the normal User-Name as before. Is my argumentation sound? And the fix reasonable? Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

4 4

Commit report for master branch
by announce＠freeradius.org 10 Feb '14

10 Feb '14

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== fixes to cf_section_sub_find_name2 Short-circuit the answer where we can. Expand the code to make it clearer what's going on. So that more cases can be short-circuited Alan T. DeKok@2014-02-10T18:45:14Z Files modified: * src/main/conffile.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/e37223337150343773b6… ====== Use /dev/urandom for randomness, if it exists Alan T. DeKok@2014-02-10T18:45:13Z Files modified: * raddb/certs/Makefile * raddb/certs/bootstrap Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/8b6d6426338007937df2… ====== Load 10K of randomness, rather than 1M. Alan T. DeKok@2014-02-10T18:45:12Z Files modified: * src/main/tls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/f9de769097950437fce9… ====== TLS clients and non-TLS listeners are forbidden Alan T. DeKok@2014-02-10T14:57:54Z Files modified: * src/main/client.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/a050c372cc610ef7e106… ====== WARN for old-style client configuration so we don't have surprises Alan T. DeKok@2014-02-10T14:57:53Z Files modified: * src/main/client.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/6339fbbf6739d8b979bf… ====== Re-arrangement for ifdef WITH_TLS Alan T. DeKok@2014-02-10T14:57:52Z Files modified: * src/main/realms.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/b9c01e09270c0d857eff… ====== Proper encapsulation of information the function to load dh params should check for a NULL filename. The callers shouldn't care Alan T. DeKok@2014-02-10T14:57:51Z Files modified: * src/main/tls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/1cc1373ccf847200791b… ====== Merge pull request #519 from matsimon/equallogic-dict Add Equallogic dictionary Arran Cudbard-Bell@2014-02-10T10:41:49Z Files modified: * share/dictionary.equallogic Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/90f95e3dfde8380e2fc9… ====== Add Equallogic dictionary Add a dictionary for Equallogic devices. Although part of Dell since 2008 the vendor ID still points to Equallogic. The values were obtained from publicly available "Dell Equallogic Group Manager Online Help, PS Series Firmware Version 6.0 / FS Series Firmware Version 2.0" Mathieu Simon@2014-02-09T20:44:14Z Files modified: * share/dictionary.equallogic Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/b29728b4f70db0f36909… ====== If inst->output is NULL, don't request output pairs from radius_exec_program Arran Cudbard-Bell@2014-02-10T10:36:36Z Files modified: * src/modules/rlm_exec/rlm_exec.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/c19a337205c218555c5c… ====== Merge pull request #520 from matsimon/altiga-dict-new Update the Altiga dictionary with new values Arran Cudbard-Bell@2014-02-10T10:22:08Z Files modified: * share/dictionary.altiga Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/5fccecca60811210542c… ====== Update the Altiga dictionary with new values Add new attributes and values to the Altiga networks dictionary as found in the Cisco Prime 6.0 Access Registrar User Guide. Add historical note about Altiga's aquisition in case someone is (still) looking for Altiga-related documentation. Mathieu Simon@2014-02-10T10:15:33Z Files modified: * share/dictionary.altiga Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/09cece1cc6a42a85226d… ====== Output why we couldn't open the file 'does not exist' is not the reason in all cases Arran Cudbard-Bell@2014-02-10T08:30:01Z Files modified: * src/main/conffile.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/6fb025849d35e18c7904… ====== Don't try and load dh_params if no dh file provided Arran Cudbard-Bell@2014-02-10T08:29:49Z Files modified: * src/main/tls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/9bab2963da0051cf683d… ====== Set secret to radsec for tcp+tls home servers Arran Cudbard-Bell@2014-02-10T08:29:43Z Files modified: * src/main/realms.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/718541fc80bb73b41870… ====== Formatting Arran Cudbard-Bell@2014-02-10T08:29:36Z Files modified: * src/include/realms.h Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/1c3d99f209818dc90540… ====== Fix double free on error in home_server_add Fix potential issue with wrong free function being used in home_server_add Arran Cudbard-Bell@2014-02-10T08:29:29Z Files modified: * src/main/realms.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/9e8cd7653f3bf1c94fab… ====== Don't segfault in rlm_unix if attributes are missing from the main dictionary Arran Cudbard-Bell@2014-02-10T08:29:20Z Files modified: * src/modules/rlm_unix/rlm_unix.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/590468799e04030fbcd7… ====== -- This commit summary was generated @2014-02-11T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v3.0.x branch
by announce＠freeradius.org 10 Feb '14

10 Feb '14

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== fixes to cf_section_sub_find_name2 Short-circuit the answer where we can. Expand the code to make it clearer what's going on. So that more cases can be short-circuited Alan T. DeKok@2014-02-10T18:44:15Z Files modified: * src/main/conffile.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/cd0d008e8f12e8dc46e9… ====== Use /dev/urandom for randomness, if it exists Alan T. DeKok@2014-02-10T18:43:49Z Files modified: * raddb/certs/Makefile * raddb/certs/bootstrap Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/53f527be190ea3d153e0… ====== Load 10K of randomness, rather than 1M. Alan T. DeKok@2014-02-10T18:43:45Z Files modified: * src/main/tls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/4d23366f24e6594e6c75… ====== TLS clients and non-TLS listeners are forbidden Alan T. DeKok@2014-02-10T14:53:37Z Files modified: * src/main/client.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/87005de620fc14e42ba3… ====== WARN for old-style client configuration so we don't have surprises Alan T. DeKok@2014-02-10T14:53:23Z Files modified: * src/main/client.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/d0e90fd0eabb38f144a1… ====== Re-arrangement for ifdef WITH_TLS Alan T. DeKok@2014-02-10T14:38:35Z Files modified: * src/main/realms.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/4a1f54d67bdba7a52f26… ====== Proper encapsulation of information the function to load dh params should check for a NULL filename. The callers shouldn't care Alan T. DeKok@2014-02-10T14:33:14Z Files modified: * src/main/tls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/781d51ad862a65153017… ====== If inst->output is NULL, don't request output pairs from radius_exec_program Arran Cudbard-Bell@2014-02-10T10:37:03Z Files modified: * src/modules/rlm_exec/rlm_exec.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/306969033a42bf03f4d2… ====== Update the Altiga dictionary with new values Add new attributes and values to the Altiga networks dictionary as found in the Cisco Prime 6.0 Access Registrar User Guide. Add historical note about Altiga's aquisition in case someone is (still) looking for Altiga-related documentation. Mathieu Simon (via Arran Cudbard-Bell)@2014-02-10T10:36:48Z Files modified: * share/dictionary.altiga Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/5a29e527a6088c339b32… ====== -- This commit summary was generated @2014-02-11T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v3.0.x branch
by announce＠freeradius.org 09 Feb '14

09 Feb '14

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Output why we couldn't open the file 'does not exist' is not the reason in all cases Arran Cudbard-Bell@2014-02-09T22:50:34Z Files modified: * src/main/conffile.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/e5eb06255a8d73b48896… ====== Don't try and load dh_params if no dh file provided Arran Cudbard-Bell@2014-02-09T21:28:12Z Files modified: * src/main/tls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/51d43c3b5423da460e98… ====== Set secret to radsec for tcp+tls home servers Arran Cudbard-Bell@2014-02-09T21:10:15Z Files modified: * src/main/realms.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/22613ce46cf60fe6e493… ====== Formatting Arran Cudbard-Bell@2014-02-09T21:09:49Z Files modified: * src/include/realms.h Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/5af2caa61977a1a4a1a3… ====== Fix double free on error in home_server_add Fix potential issue with wrong free function being used in home_server_add Arran Cudbard-Bell@2014-02-09T20:51:50Z Files modified: * src/main/realms.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/8eba5378377bce1984d7… ====== Don't segfault in rlm_unix if attributes are missing from the main dictionary Arran Cudbard-Bell@2014-02-09T20:23:16Z Files modified: * src/modules/rlm_unix/rlm_unix.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/9ed7ab7e16ac3502852f… ====== Add temporary fix for credential accumulation in heimdal krb5 This isn't really a leak as the credentials will be removed as they expire, but the standard operation of the krb5 verification functions isn't helpful here. The proper fix is to make it optional, and add credential caching code to MIT too. Arran Cudbard-Bell@2014-02-09T11:32:53Z Files modified: * src/modules/rlm_krb5/rlm_krb5.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/60bb29f389edd04299a8… ====== -- This commit summary was generated @2014-02-10T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for master branch
by announce＠freeradius.org 09 Feb '14

09 Feb '14

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Add temporary fix for credential accumulation in heimdal krb5 This isn't really a leak as the credentials will be removed as they expire, but the standard operation of the krb5 verification functions isn't helpful here. The proper fix is to make it optional, and add credential caching code to MIT too. Arran Cudbard-Bell@2014-02-09T11:33:12Z Files modified: * src/modules/rlm_krb5/rlm_krb5.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/5d5577daf5ca212dfced… ====== -- This commit summary was generated @2014-02-10T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for master branch
by announce＠freeradius.org 08 Feb '14

08 Feb '14

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Add always instances for all rcodes Arran Cudbard-Bell@2014-02-08T19:24:40Z Files modified: * raddb/mods-available/always Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/5bd70af46db2605686f0… ====== -- This commit summary was generated @2014-02-09T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v3.0.x branch
by announce＠freeradius.org 08 Feb '14

08 Feb '14

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Add always instances for all rcodes Arran Cudbard-Bell@2014-02-08T19:26:58Z Files modified: * raddb/mods-available/always Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/92d6ed2d327827715ec3… ====== -- This commit summary was generated @2014-02-09T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v3.0.x branch
by announce＠freeradius.org 07 Feb '14

07 Feb '14

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Make error messages clearer for users Alan T. DeKok@2014-02-07T18:13:41Z Files modified: * src/lib/dict.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/c03be8d8bfcb24997b3d… ====== Suppress fast NASes when proxying If a NAS is sending the same packet many times per second, we should ignore most of them. We limit our retransmits to no more than one per second. That's still fast, but much slower than stupid NASes Alan T. DeKok@2014-02-07T18:08:20Z Files modified: * src/main/process.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/5250730f2b32dacf46ea… ====== Typo c/p error in comment Arran Cudbard-Bell@2014-02-07T12:45:38Z Files modified: * src/tests/keywords/sha2 Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/a4e4acd8cb93302fb178… ====== -- This commit summary was generated @2014-02-08T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for master branch
by announce＠freeradius.org 07 Feb '14

07 Feb '14

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Fix soft assert Arran Cudbard-Bell@2014-02-07T21:00:12Z Files modified: * src/lib/valuepair.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/abb970bfabf22a43d0c0… ====== Make error messages clearer for users Alan T. DeKok@2014-02-07T18:14:03Z Files modified: * src/lib/dict.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/b977a9479e9b62f7bcfc… ====== Suppress fast NASes when proxying If a NAS is sending the same packet many times per second, we should ignore most of them. We limit our retransmits to no more than one per second. That's still fast, but much slower than stupid NASes Alan T. DeKok@2014-02-07T18:11:04Z Files modified: * src/main/process.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/d3fd9d0b723c67c655fa… ====== Typo c/p error in comment Arran Cudbard-Bell@2014-02-07T12:45:59Z Files modified: * src/tests/keywords/sha2 Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/e6ee22b7479817ef5adb… ====== -- This commit summary was generated @2014-02-08T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0