- Freeradius-Devel - lists.freeradius.org

Took too long to generate dh parameters
by Brian Candler 14 Feb '13

14 Feb '13

(v2.x.x branch) Just a minor note when starting up after a fresh make install then sbin/radiusd -X Generating DH parameters, 1024 bit long safe prime, generator 2 This is going to take a long time ...................................+....................................................................................................................................................+.....................................................+............................+.................................................................................................+.................................................................................................................................................+.......................+.+................................................................................................................+..................................................+........+...........................................................................................................+................................................................................+.....................................................................................+............................................................................+............................................................................................................................+............................+.................................+.............................................................................................................................................................................+........+............................................+.......................+..................................................Child PID 24010 (/Users/brian/Build/freeradius/etc/raddb/certs/bootstrap) is taking too much time: forcing failure and killing child. rlm_eap: Failed to initialize type tls /Users/brian/Build/freeradius/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /Users/brian/Build/freeradius/etc/raddb/sites-enabled/default[310]: Failed to find "eap" in the "modules" section. /Users/brian/Build/freeradius/etc/raddb/sites-enabled/default[252]: Errors parsing authenticate section. Brians-MacBook-Air:freeradius $ ...........+..............+...............................................................+...........+.................................+........................................................................................+.....+....................................................................++*++*++* unable to write 'random state' This is on a Macbook Air i7: not a slovenly machine, but it looks like 10 seconds isn't enough. However on a second run of radiusd it starts OK.

2 1

rlm_redis in master
by Brian Candler 14 Feb '13

14 Feb '13

rlm_redis is broken in master: it segfaults unconditionally because of a consistent null pointer dereference. A fix for this, plus a bunch of other fixes (all lightly tested), at https://github.com/FreeRADIUS/freeradius-server/pull/190 Regards, Brian.

1 0

Commit report for master branch
by announce＠freeradius.org 13 Feb '13

13 Feb '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Just call the normal attr2vp function Alan T. DeKok@2013-02-13T20:24:35Z Files modified: * src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/15b4f1b4969245af0f57… ====== Added -x, like other programs Alan T. DeKok@2013-02-13T20:23:47Z Files modified: * src/main/radattr.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/2d0fd6038c272f3e644d… ====== Fix typo. Fail when NOT inserting attrs Alan T. DeKok@2013-02-13T20:17:02Z Files modified: * src/lib/dict.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/0a2d49a42372f0150c9f… ====== Quiet doxygen Arran Cudbard-Bell@2013-02-13T19:44:24Z Files modified: * src/modules/rlm_otp/otp_radstate.c * src/modules/rlm_otp/rlm_otp.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/22b3d29add56b18aa38d… ====== Use xlat for generating the OTP challenge reply-message Remove otp specific bin2hex hex2bin functions and use FR ones Fix formatting Fix warnings about signdedness of various strings. Insert Reply-Message attribute with T_OP_SET instead of T_OP_EQ Add basic code documentation for some functions Arran Cudbard-Bell@2013-02-13T19:37:31Z Files modified: * raddb/mods-available/otp * share/dictionary.freeradius.internal * src/include/libradius.h * src/include/radius.h * src/lib/misc.c * src/modules/rlm_otp/extern.h * src/modules/rlm_otp/otp.h * src/modules/rlm_otp/otp_pw_valid.c * src/modules/rlm_otp/otp_pwe.c * src/modules/rlm_otp/otp_radstate.c * src/modules/rlm_otp/otp_util.c * src/modules/rlm_otp/rlm_otp.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/397006810d88cf22f203… ====== Typo Arran Cudbard-Bell@2013-02-13T01:01:27Z Files modified: * src/lib/dict.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/db2fa1d7c4c4ce14e3b0… ====== Add CONST to functions that return DICT_ATTR Reformat documentation for some structs Change VALUE_PAIR type from int to PW_TYPE Arran Cudbard-Bell@2013-02-13T00:58:51Z Files modified: * src/include/libradius.h * src/lib/dhcp.c * src/lib/dict.c * src/lib/print.c * src/lib/radius.c * src/lib/valuepair.c * src/main/client.c * src/main/evaluate.c * src/main/modules.c * src/main/xlat.c * src/modules/rlm_attr_rewrite/rlm_attr_rewrite.c * src/modules/rlm_cache/rlm_cache.c * src/modules/rlm_checkval/rlm_checkval.c * src/modules/rlm_counter/rlm_counter.c * src/modules/rlm_detail/rlm_detail.c * src/modules/rlm_ldap/rlm_ldap.c * src/modules/rlm_otp/extern.h * src/modules/rlm_otp/otp_pwe.c * src/modules/rlm_passwd/rlm_passwd.c * src/modules/rlm_policy/parse.c * src/modules/rlm_preprocess/rlm_preprocess.c * src/modules/rlm_sometimes/rlm_sometimes.c * src/modules/rlm_sql/rlm_sql.c * src/modules/rlm_sqlcounter/rlm_sqlcounter.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/bc06a68ef97c654f54f6… ====== free_dict_attr should set pointer to NULL after freeing Arran Cudbard-Bell@2013-02-12T23:38:17Z Files modified: * src/include/libradius.h * src/lib/dict.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/ff1327631634e1e6390e… ====== -- This commit summary was generated @2013-02-14T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

cache_eap and policy
by A.L.M.Buxey＠lboro.ac.uk 12 Feb '13

12 Feb '13

hi, just lookign at latest GIT pull onto my config.... the server fails due to a call in policy.d/eap - cache_eap module. okay. cache_eap moduel in mods-available but not live. fixed. then I get /etc/raddb/policy.d/eap[37]: "cache" modules aren't allowed in 'authenticate' sections -- they have no such method. /etc/raddb/policy.d/eap[37]: Failed to parse "cache_eap" entry. /etc/raddb/policy.d/eap[36]: Failed to parse "if" subsection. the policy has: # Populate cache with responses from the EAP module # eap.authenticate { eap { handled = 1 } if (handled) { cache_eap handled } cache_eap } so, its calling this cache method in the authenticate section. meant to? I guess so. .... for now policy removed. alan

2 7

Commit report for v2.x.x branch
by announce＠freeradius.org 12 Feb '13

12 Feb '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Note recent changes Alan T. DeKok@2013-02-12T16:17:48Z Files modified: * doc/ChangeLog Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/6134974a5e9765e59f6b… ====== Prune changelog from before 2.2.0 Alan T. DeKok@2013-02-12T16:13:49Z Files modified: * doc/ChangeLog Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/dfc17e1fbcfddd6e766f… ====== Actually print out encoded options in debug mode. Alan T. DeKok@2013-02-12T16:10:21Z Files modified: * src/lib/dhcp.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/94263b5027520da91958… ====== Added radmin command "hup main.log". Closes issue #121 Alan T. DeKok@2013-02-12T15:56:48Z Files modified: * src/include/radiusd.h * src/main/command.c * src/main/mainconfig.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/70e3f4587f7871ce7216… ====== As found on the net Alan T. DeKok@2013-02-11T14:13:41Z Files modified: * share/dictionary * share/dictionary.zeus Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/9cf5799d1558c0df5227… ====== -- This commit summary was generated @2013-02-13T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for master branch
by announce＠freeradius.org 12 Feb '13

12 Feb '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Add function to create unknown attributes from text strings Arran Cudbard-Bell@2013-02-12T21:17:52Z Files modified: * src/include/libradius.h * src/lib/dict.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/6d19c4d18c28fb8c8443… ====== Fix indentation in pairparsevalue Arran Cudbard-Bell@2013-02-12T20:20:46Z Files modified: * src/lib/valuepair.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/2b9efa65fbd0de7b944f… ====== Additional dictionary functions for working with dynamic attributes Arran Cudbard-Bell@2013-02-12T20:20:46Z Files modified: * src/include/libradius.h * src/lib/dict.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/21612addf4189cfd7d1b… ====== Actually print out encoded options in debug mode. Alan T. DeKok@2013-02-12T20:18:25Z Files modified: * src/lib/dhcp.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/d1ec0730b6fc003300a5… ====== As found on the net Alan T. DeKok@2013-02-12T20:16:36Z Files modified: * share/dictionary * share/dictionary.zeus Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/9d9e96287739b31f2d5a… ====== Added radmin command "hup main.log". Closes issue #121 Alan T. DeKok@2013-02-12T20:16:19Z Files modified: * src/include/radiusd.h * src/main/command.c * src/main/mainconfig.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/928cffed328fb33f749f… ====== Clarify decoding code Alan T. DeKok@2013-02-12T19:47:06Z Files modified: * src/lib/radius.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/28ecdec08dd838431e39… ====== Added dict_attrbytype(attr, vendor, type) for dealing with combo-ip attributes Alan T. DeKok@2013-02-12T19:46:32Z Files modified: * src/include/libradius.h * src/lib/dict.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/22d0dc7cae53098300b1… ====== Use hard-coded numbers for dictionary entries. There's no reason to expect that the server binary will be incompatible with the dictionaries Alan T. DeKok@2013-02-12T16:35:00Z Files modified: * src/modules/rlm_cache/rlm_cache.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/659697aeb14b81c2184d… ====== Rename unknown_attr to is_unkown (like is_tlv) Arran Cudbard-Bell@2013-02-12T15:56:18Z Files modified: * src/include/libradius.h * src/lib/dict.c * src/lib/valuepair.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/9d4fc70c4da8357dc70b… ====== Ignore warnings.txt (output of make warnings) Arran Cudbard-Bell@2013-02-12T15:56:17Z Files modified: * .gitignore Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/14a38412233f6d4cb235… ====== Check return code of dict_addattr, and use correct argument order and print a useful error message Alan T. DeKok@2013-02-12T15:30:10Z Files modified: * src/modules/rlm_sql/rlm_sql.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/eca49611ca7b37419f9f… ====== Added "default" to switch statement Alan T. DeKok@2013-02-12T02:45:46Z Files modified: * src/lib/print.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/c779df5d7d13f5dd4f3c… ====== Add dict_attrunknown function for when we don't have dictionary entries but still need to assign a DA to a VP. Arran Cudbard-Bell@2013-02-12T02:37:17Z Files modified: * src/include/libradius.h * src/lib/dict.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/957801d9254145af6b4c… ====== Decode extended TLVs correctly. This uses the new dict_attrbyparent() API to avoid doing magic on "nest". The code becomes a bit easier to read. Alan T. DeKok@2013-02-12T01:36:39Z Files modified: * src/lib/radius.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/4d301538ffb141126001… ====== VP_TRACE using hex values for VID / attr It's easier to read Alan T. DeKok@2013-02-12T01:36:39Z Files modified: * src/lib/radius.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/1855d2e95b23e9bbe39a… ====== Look for extended attrs before RFC format ones Alan T. DeKok@2013-02-12T01:36:39Z Files modified: * src/lib/radius.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/d840147b88f619fbd553… ====== Added dict_attrbyparent() Which gets a DICT_ATTR based on a parent reference, and an attr number This is so that any magic of playing with attr/vendor is hidden inside of one function, rather than being in multiple places Alan T. DeKok@2013-02-12T01:36:39Z Files modified: * src/include/libradius.h * src/lib/dict.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/8bdf152294d5c73a6a7e… ====== Refer to cache_eap authorize method, not authenticate Alan T. DeKok@2013-02-12T01:36:39Z Files modified: * raddb/policy.d/eap Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/fb2049ecdaf2b490abaa… ====== Enable cache_eap module by default Alan T. DeKok@2013-02-12T01:36:39Z Files modified: * raddb/Makefile Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/9a08506f0bde5b2307e5… ====== Define value types as an enum Arran Cudbard-Bell@2013-02-12T01:07:07Z Files modified: * src/include/libradius.h * src/include/radius.h Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/6488df80d7bb188e7c33… ====== -- This commit summary was generated @2013-02-13T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for master branch
by announce＠freeradius.org 11 Feb '13

11 Feb '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Fix horrible code and memory leak Alan T. DeKok@2013-02-11T16:40:11Z Files modified: * src/modules/rlm_perl/rlm_perl.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/a4636a3ab20ab856c200… ====== -- This commit summary was generated @2013-02-12T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

What is CHAP-Challenge for?
by JCA 11 Feb '13

11 Feb '13

I am looking into CHAP authentication, and I am having difficulties understanding what the CHAP-Challenge attribute is exactly for. Using the radclient utility that ships with freeradius-server 2.2.0 I can do the following: echo "User-Name = MyName, CHAP-Password = MyPassword, CHAP-Challenge = 0123456789" | ./radclient 192.168.0.2 auth SharedSecret Provided that the RADIUS server at 192.168.0.2 is alive and correctly configured (i.e. username, password and shared all match the values above) everything works fine, in that the CHAP authentication succeeds, as expected. However, if I do echo "User-Name = MyName, CHAP-Password = MyPassword" | ./radclient 192.168.0.2 auth SharedSecret this also succeeds. So, what's the use of the CHAP-Challenge attribute? RFC 2865 says that if its value is 16 bytes long then this value can be that of the Request Authenticator field, thus disposing of CHAP-Challenge altogether. What does therefore CHAP-Challenge do that is not already done by the Request Authenticator field? Are there any sets of circumstances in which using the CHAP-Challenge attribute is advisable? Actually, what's the point of using CHAP-Password at all, when User-Password seems to be at least as, if not more, secure a protocol?

2 3

Commit report for master branch
by announce＠freeradius.org 10 Feb '13

10 Feb '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Remove maximum length checks in rad_packet_ok() If the network cwlayercode allows for more than 4K of data, who are we to argue? This code only checks to see if the packet is "well formed" Alan T. DeKok@2013-02-10T22:53:54Z Files modified: * src/lib/radius.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/73920de1be10d9780190… ====== -- This commit summary was generated @2013-02-11T00:00:03Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

pap challenge in radius client
by Crne We 10 Feb '13

10 Feb '13

Looks like ACCESS-CHALLENGE as part of PAP authentication is not supported in the freeradius client library. Should I contribute that feature?

2 2