- Freeradius-Devel - lists.freeradius.org

Tracking packet/s in the server
by Alan DeKok 24 Feb '12

24 Feb '12

The "listen" sections in 3.0 have a new entry: max_pps = 300 If that socket receives MORE than that many packets/s, it throws away all new packets. The packet/s counter is tracked in a sliding window over the last second. That means "the number of packets received in the second immediately before receiving the current packet". It's not tracking the number of packets in the current wall-clock second. The feature is mainly intended for accounting sockets. It is *very* expensive to process accounting packets. They can usually be discarded without a problem, as the NAS will retransmit them. The idea is to set the "max_pps" to some fairly large value. Then if the server receives a sudden influx of traffic, it won't die. Instead, it will continue to make progress at a steady rate. The feature has another configuration entry in the "thread pool" section: auto_limit_acct = yes/no If set to "yes", it auto-limits accounting packets. The server maintains a queue of packets for child threads. With auto_limit_acct=yes, it tracks the rate at which packets leave the queue, and the rate at which they enter the queue. If the queue is more than half full, AND the rate of entry is larger than the exit rate, it throws the accounting packet away. All other packet types are unaffected. The idea here is for the server to automatically adapt to overload conditions. If it's getting traffic than it can handle, it starts to throw away that traffic. Suggestions for better heuristics are welcomed. Testing is also welcomed. :) Alan DeKok.

4 7

Re: Tracking packet/s in the server
by Alan Buxey 23 Feb '12

23 Feb '12

Quoting.... control: variable to the server{} block; that way, if you wanted to, local sites could do this: preacct { if (control:FreeRADIUS-Acct-QueueLoad > 50) { ok } else { .. } } if you have this sort I'd thing exposed you could even then just decide to take the load off your server...either sending the packet to disk or off to another server.. buffered-sql or proxy-to-home... alan

2 1

Re: Tracking packet/s in the server
by Alan Buxey 23 Feb '12

23 Feb '12

I assume that these values are exposed to eg the status server so we can see them with current monitoring probes, eg monit ? ...and likewise send out an snmptrap via triggers.conf? alan

3 5

rlm_detail packet selection
by Matthew Newton 18 Feb '12

18 Feb '12

Hi, After the virtual server for eap-tls, I realised that there was no way to get rlm_detail to log the request packet in post-auth. As the TLS-* attribs are added to the request, but only available in post-auth, there's a problem if you want to use rlm_detail unless you set up the eap-tls virtual server. This patch adds a log_packet option to detail, which has the options 'request', 'reply', 'proxy-request' and 'proxy-reply', to select the packet to log. If not specified, or the requested packet has nothing in it, it falls back to the previous default. https://github.com/mcnewton/freeradius-server/commit/ad07620e9fd97c38b78527… Rather than just allow it log the request in post-auth, I thought it would be more flexible to allow the admin to set what they want to log, although I couldn't think of any other non-debug use cases myself. Cheers, Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Architect (UNIX and Networks), Network Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk>

1 1

MySQL default charset
by Stefan Winter 17 Feb '12

17 Feb '12

Hello, for the n'th time, I ran into character set problems, where our database server is well-configured for UTF-8, but the libmysqlclient on the FreeRADIUS server end is not. I kept pulling my hair out on the question why e-accent characters come in as latin1 ( 0xe9 ) instead of proper UTF-8. In the end I figured: the version of libmysqlclient that I have defaults (compile-time default of the library) to latin1. The character set is not configurable in FreeRADIUS. After some searching, I realised that I need a my.cnf with some magic words in /etc. I wonder if either FreeRADIUS should make the charset configurable in the sql/mysql/dialup.conf (my MySQL gurus say that it should better be) - or at least this caveat should be documented. Since the latter is just a config change, a diff -u to that end is below. Greetings, Stefan Winter diff -u dialup.conf dialup.conf.new --- dialup.conf 2011-09-30 16:12:07.000000000 +0200 +++ dialup.conf.new 2012-02-17 13:43:15.946237891 +0100 @@ -10,6 +10,17 @@ #safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" ####################################################################### + # Connection config + ####################################################################### + # The character set is not configurable. The default character set of + # the mysql client library is used. To control the character set, + # create/edit my.cnf (typically in /etc/mysql/my.cnf or /etc/my.cnf) + # and enter + # [client] + # default-character-set = utf8 + # + + ####################################################################### # Query config: Username ####################################################################### # This is the username that will get substituted, escaped, and added -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

2 1

FR 3 GIT segmentation fault
by Alan Buxey 16 Feb '12

16 Feb '12

hi, GIT release of FR 3 segfaults with incoming EAP authentication - have updated (as the version we were running was a week old) and still failing. looks like its related to some changes regarding EAP caching and TLS code. i think theres something just missing from the code (or an erroneous paste). another server running 3 GIT from around 3 weeks ago is unaffected. debug log attached... valuepair.c line 282 - which matches src/lib/valuepair.c not sr/main/valuepair.c is the culprit alan

2 1

default virtual server config
by Alan Buxey 13 Feb '12

13 Feb '12

hi, the recent dictionary fix and push to repository reminded me of a small quirk with the current sites-available/* provided virtual servers...currently both the 'local test' listener in inner-tunnel and the listener in status server are using the same port 18120 - thus, should anyone just enable these default servers at the same time, then the daemon wont start. suggest that one of these ports (status VS?) is changed to another port eg 19120 ? alan

2 1

EAP-Message incorrectly decoded as LEAP?
by Stefan Winter 13 Feb '12

13 Feb '12

Hi, I've just set up a new 2.1.12 that supports only EAP-TLS & EAP-TTLS. I ran a blind-test with radtest (EAP-MD5 requested), and got: Sending Access-Request packet to host 127.0.0.1 port 1812, id=88, length=0 User-Name = "foo(a)ltett.lu" User-Password = "bar" NAS-IP-Address = 158.64.1.155 NAS-Port = 123 Message-Authenticator = 0x00 EAP-Code = Response EAP-Type-Identity = "foo(a)ltett.lu" EAP-Message = 0x0257001101666f6f406c746574742e6c75 Received Access-Challenge packet from host 127.0.0.1 port 1812, id=88, length=64 EAP-Message = 0x015800061520 Message-Authenticator = 0x735a717844469d67a2215716e090d9e2 State = 0x02e3245002bb31c7ca78f83bc6164863 EAP-Id = 88 EAP-Code = Request EAP-Type-LEAP = 0x20 The last line speaking about LEAP, which was a surprise. Decoding the EAP-Message from the server, the request payload is EAP-Type 0x15 - EAP-TTLS, just as expected. So no real problem, just a source of confusion... why does radtest decode things as EAP-Type-LEAP here? Maybe something wrong in the dictionary.freeradius.internal: # these are PW_EAP_X + 1280 ATTRIBUTE EAP-Type-Identity 1281 string ATTRIBUTE EAP-Type-Notification 1282 string ATTRIBUTE EAP-Type-NAK 1283 string ATTRIBUTE EAP-Type-MD5 1284 octets ATTRIBUTE EAP-Type-OTP 1285 string ATTRIBUTE EAP-Type-GTC 1286 string ATTRIBUTE EAP-Type-TLS 1297 octets ATTRIBUTE EAP-Type-SIM 1298 octets ATTRIBUTE EAP-Type-LEAP 1301 octets ATTRIBUTE EAP-Type-SIM2 1302 octets ATTRIBUTE EAP-Type-TTLS 1305 octets ATTRIBUTE EAP-Type-PEAP 1309 octets This gives LEAP 21 = 0x15 (which is actually TTLS!), and TTLS 25 =0x19 (which is actually PEAP!), and PEAP 29 = 0x1D (which is actually EAP-MSCHAPv2!) Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

2 3

error loading shared libraries - BOILER=yes
by Matthew Newton 11 Feb '12

11 Feb '12

Hi, HEAD of master, building with BOILER=yes (without BOILER=yes is fine), I get: freeradius-server$ echo BOILER=yes >> Make.inc.in freeradius-server$ ./configure --prefix=/opt/fr3 freeradius-server$ make freeradius-server$ build/bin/radiusd -X FreeRADIUS Version 3.0.0, for host x86_64-unknown-linux-gnu, built on Feb 11 2012 at 02:40:47 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Errors reading /opt/fr3/etc/raddb: No such file or directory freeradius-server$ build/bin/relink/radiusd -X build/bin/relink/radiusd: error while loading shared libraries: libfreeradius-radius.so: cannot open shared object file: No such file or directory ...OK - probably looking in /opt/fr3/lib freeradius-server$ make install ... freeradius-server$ build/bin/radiusd -X ...as above, OK freeradius-server$ build/bin/relink/radiusd -X ...also OK - makes sense, now installed. freeradius-server$ /opt/fr3/sbin/radiusd -X ...also OK freeradius-server$ cd /opt/fr3/sbin sbin$ ./radiusd -X ./radiusd: error while loading shared libraries: build/lib/relink/.libs/rlm_acctlog.so: cannot open shared object file: No such file or directory ... not good. The problem seems to be in the final 'gcc -rdynamic -o build/bin/relink/radiusd' command - if you remove all the many ' -Wl,-rpath=/opt/fr3/lib build/lib/relink/.libs/rlm_acctlog.so' arguments and run manually, then copy the resulting binary to the correct location, all is fine. The dynamic libs seem to be being added to gcc by $${${1}_R_PRLIBS} in scripts/libtool.mk:106, and previously :205, but before that I get a bit lost :-) Any ideas? Thanks, Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Architect (UNIX and Networks), Network Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk>

2 2

I only see a old draft: Certificate Based Roaming.
by Brivaldo Junior 11 Feb '12

11 Feb '12

Hi, I really don't know and not find any information about certificate-based roaming (unless on draft[1]) on FreeRadius. Exist support for this kind of auth? [1] http://tools.ietf.org/html/draft-ietf-roamops-cert-01 If this is the wrong mailing lisft for this question, sorry I will try on another more appropriate. Best regards, Brivaldo Jr

2 1