- Freeradius-Devel - lists.freeradius.org

bug in token.c ?
by Oliver Schröder 26 Jul '11

26 Jul '11

Hello List, I believe I found a bug in token.c, more precisely in static FR_TOKEN getthing(...) The exact point is the part handling backslahes: --- cut --- if (quote && (*p == '\\')) { p++; switch(*p) { case 'r': *s++ = '\r'; break; case 'n': *s++ = '\n'; break; case 't': *s++ = '\t'; break; case '\0': *s++ = '\\'; p--; /* force EOS */ break; default: if (*p >= '0' && *p <= '9' && sscanf(p, "%3o", &x) == 1) { *s++ = x; p += 2; } else *s++ = *p; break; } p++; continue; } --- cut --- This piece of code removes all backslashes from the input string, which gives incorrect results when parsing strings for regular expressions with excaped characters. At a first glance, the fix is easy: --- cut --- default: if (*p >= '0' && *p <= '9' && sscanf(p, "%3o", &x) == 1) { *s++ = x; p += 2; } else { *s++ = '\\'; /* copy the '\' too */ *s++ = *p; } break; --- cut --- which solves the problem. On the other hand, I'm not sure if it breaks anything else. Is there a reason to remove backslashes on purpose? Or is this really a bug? Regards, Oliver Schröder

3 6

PCRE in 3.0?
by Phil Mayers 25 Jul '11

25 Jul '11

Do we think there's value in using a better regexp library in 3.0? The Exim guys wrote PCRE and bundled it with the Exim source until relatively recently, so if we don't want an external dependency that might be an option (having said that, they removed it about a year ago and it's a dependency now)

4 6

Document required for rlm_python
by Lingfeng Xiong 25 Jul '11

25 Jul '11

hi all, I am very sorry to bother you, but I need the documents for rlm_python. I have searched the wiki and documentation page and found nothing, The project I am working on required me to write a authentication backend for FreeRadius to authenticate with a Django website via HTTP. I wanna make this program by rlm_python to simplify the development. Thanks in advanced.

4 4

<<URGENT>> : Free Radius behavior
by kalk 21 Jul '11

21 Jul '11

Hi Experts, I have the below setup. [Agilent] ------------[Router]--------------------------------------------------- [ Free Radius Server] 50.0.0.2 50.0.0.1 172.52.1.1 eth0 eth1 eth0 The Router sends AAA Request to the Free Radius Server through the interface ( its ip 50.0.0.2) with Destination IP address as 172.52.1.1. But, when router receives response from the Radius server, the response has Source IP as as (50.0.0.1). When I looked into the radius-server, it has the below config. listen { ipaddr = * } it means, the radius can run on any IP address. My question here is, since the router sends request to Radius with the assumption of Radius server runs on (172.52.1.1.), the radius server should listen on that IP address. Is this correct ? Or can it run on any IP address. Since the radius replies with SRC_IP as 50.0.0.1, sessions are not coming up with the Router. Can some one clarify me asap. Appreciating your helps... Thanks, Kaliyaperumal K -- View this message in context: http://freeradius.1045715.n5.nabble.com/URGENT-Free-Radius-behavior-tp46192… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

2 1

Compile FreeRADIUS with Cygwin..
by jeroenvanwissen 19 Jul '11

19 Jul '11

For a project I need to have FreeRADIUS on a Windows 2008 server. I've used FreeRADIUS.net's 1.1.7 binary, but that only works in debug mode for some strange reason. I get errors that cygheap base mismatch detected. Incompatible versions of cygwin1.dll That dll comes with the installer ... strange. So .. someone here got a working config for make'ing any version of freeradius on cygwin ? -- View this message in context: http://freeradius.1045715.n5.nabble.com/Compile-FreeRADIUS-with-Cygwin-tp46… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

2 1

More debian voodoo for libfreeradius3.
by Stephen R. van den Berg 10 Jul '11

10 Jul '11

--- It compiles and spits out .deb files (finally). Debian packaging is not my strong suite, so if anyone actually knows what all these install-files do, please verify my changes/additions. I'm just guessing at what seems sane(r). debian/libfreeradius2.install | 2 +- debian/libfreeradius3.install | 1 + debian/libfreeradius3.lintian-overrides | 1 + 3 files changed, 3 insertions(+), 1 deletions(-) create mode 100644 debian/libfreeradius3.install create mode 100644 debian/libfreeradius3.lintian-overrides diff --git a/debian/libfreeradius2.install b/debian/libfreeradius2.install index 0019b93..0dc4405 100644 --- a/debian/libfreeradius2.install +++ b/debian/libfreeradius2.install @@ -1 +1 @@ -usr/lib/freeradius/libfreeradius*2*.so +usr/lib/freeradius/libfreeradius*-2.*.so diff --git a/debian/libfreeradius3.install b/debian/libfreeradius3.install new file mode 100644 index 0000000..7d27cc7 --- /dev/null +++ b/debian/libfreeradius3.install @@ -0,0 +1 @@ +usr/lib/freeradius/libfreeradius*-3.*.so diff --git a/debian/libfreeradius3.lintian-overrides b/debian/libfreeradius3.lintian-overrides new file mode 100644 index 0000000..835bea5 --- /dev/null +++ b/debian/libfreeradius3.lintian-overrides @@ -0,0 +1 @@ +libfreeradius3: binary-or-shlib-defines-rpath -- 1.7.5.4 -- Stephen. "Having a non-smoking section in a restaurant is like having a non-peeing section in a pool."

2 1

Maintenance of the current radiusclient codebase
by freeradius developer/user identity 10 Jul '11

10 Jul '11

Alan, Thank you for the patches, but I'm confused. If the plan is to replace radiusclient completely within a few months with code that is currently being developed, why patch the current code with patches more than a year old? When you announced that you would be replacing radiusclient, I assumed that a separate maintainer for the old codebase would not be needed. Thank you again - Larry On Sat, Jul 09, 2011 at 11:34:47PM +0200, Alan DeKok wrote: > > More patches.. > From: Alex Massover <alex(a)jajah.com> > To: FreeRadius developers mailing list <freeradius-devel(a)lists.freeradius.org> > Date: Tue, 2 Mar 2010 17:39:15 +0200 > Subject: RE: radiusclient thread-safety > ....

2 1

Get rid of some absurd warnings
by Stephen R. van den Berg 09 Jul '11

09 Jul '11

--- During compilation I find numerous warnings. Some rather absurd, so it might make more sense to turn off the warnings instead; but just in case someone feels strongly about the warnings, here are some offered remedies. I'm using gcc 4.6. src/modules/rlm_ippool/rlm_ippool.c | 5 +++-- src/modules/rlm_ldap/rlm_ldap.c | 14 +++++++++----- 2 files changed, 12 insertions(+), 7 deletions(-) diff --git a/src/modules/rlm_ippool/rlm_ippool.c b/src/modules/rlm_ippool/rlm_ippool.c index bdb8e35..6478e0c 100644 --- a/src/modules/rlm_ippool/rlm_ippool.c +++ b/src/modules/rlm_ippool/rlm_ippool.c @@ -342,7 +342,8 @@ static int ippool_accounting(void *instance, REQUEST *request) return RLM_MODULE_NOOP; } fr_MD5Init(&md5_context); - fr_MD5Update(&md5_context, xlat_str, strlen(xlat_str)); + fr_MD5Update(&md5_context, (unsigned char*)xlat_str, + strlen(xlat_str)); fr_MD5Final(key_str, &md5_context); key_str[16] = '\0'; fr_bin2hex(key_str,hex_str,16); @@ -499,7 +500,7 @@ static int ippool_postauth(void *instance, REQUEST *request) return RLM_MODULE_NOOP; } fr_MD5Init(&md5_context); - fr_MD5Update(&md5_context, xlat_str, strlen(xlat_str)); + fr_MD5Update(&md5_context, (unsigned char*)xlat_str, strlen(xlat_str)); fr_MD5Final(key_str, &md5_context); key_str[16] = '\0'; fr_bin2hex(key_str,hex_str,16); diff --git a/src/modules/rlm_ldap/rlm_ldap.c b/src/modules/rlm_ldap/rlm_ldap.c index 129e5ea..c53293d 100644 --- a/src/modules/rlm_ldap/rlm_ldap.c +++ b/src/modules/rlm_ldap/rlm_ldap.c @@ -677,7 +677,10 @@ ldap_instantiate(CONF_SECTION * conf, void **instance) } } #ifdef NOVELL - inst->atts[atts_num - 1] = "sasdefaultloginsequence"; + { + static char ts[] = "sasdefaultloginsequence"; + inst->atts[atts_num - 1] = ts; + } #endif inst->atts[atts_num] = NULL; @@ -765,7 +768,7 @@ read_mappings(ldap_instance* inst) operator = T_OP_INVALID; /* use defaults */ } else { ptr = opstring; - operator = gettoken(&ptr, buf, sizeof(buf)); + operator = gettoken((void*)&ptr, buf, sizeof(buf)); if ((operator < T_OP_ADD) || (operator > T_OP_CMP_EQ)) { radlog(L_ERR, "rlm_ldap: file %s: skipping line %i: unknown or invalid operator %s", filename, linenumber, opstring); @@ -989,7 +992,8 @@ static int ldap_groupcmp(void *instance, REQUEST *req, LDAPMessage *result = NULL; LDAPMessage *msg = NULL; char basedn[MAX_FILTER_STR_LEN]; - char *attrs[] = {"dn",NULL}; + static char firstattr[] = "dn"; + char *attrs[] = {firstattr,NULL}; char **vals; ldap_instance *inst = instance; char *group_attrs[] = {inst->groupmemb_attr,NULL}; @@ -1541,7 +1545,6 @@ static int ldap_authorize(void *instance, REQUEST * request) value = passwd_vals[i]; if (!value) continue; - create_attr: passwd_item = radius_paircreate(request, &request->config_items, attr, 0, @@ -1761,7 +1764,8 @@ static int ldap_authenticate(void *instance, REQUEST * request) LDAP *ld_user; LDAPMessage *result, *msg; ldap_instance *inst = instance; - char *user_dn, *attrs[] = {"uid", NULL}; + static char firstattr[] = "uid"; + char *user_dn, *attrs[] = {firstattr, NULL}; char filter[MAX_FILTER_STR_LEN]; char basedn[MAX_FILTER_STR_LEN]; int res; -- 1.7.5.4 -- Stephen.

2 1

DHCP compile fixes
by Stephen R. van den Berg 09 Jul '11

09 Jul '11

--- Trying to compile and use the DHCP server, I find these things that need to be fixed (code untested as yet, I intend to use the DHCP server in a production environment later this weekend). src/include/dhcp.h | 2 +- src/lib/dhcp.c | 4 ++-- src/lib/radius.c | 2 +- src/main/dhcpd.c | 8 ++++---- src/modules/rlm_ldap/rlm_ldap.c | 10 +++++----- 5 files changed, 13 insertions(+), 13 deletions(-) diff --git a/src/include/dhcp.h b/src/include/dhcp.h index 63ab5e9..4305c0d 100644 --- a/src/include/dhcp.h +++ b/src/include/dhcp.h @@ -62,7 +62,7 @@ int fr_dhcp_decode(RADIUS_PACKET *packet); #define DHCP_UNPACK_OPTION1(x) (((x) & 0xff00) >> 8) #define PW_DHCP_MESSAGE_TYPE (53) -#define PW_DHCP_YOU_IP_ADDRESS (264) +#define PW_DHCP_YOUR_IP_ADDRESS (264) #define PW_DHCP_SUBNET_MASK (1) #define PW_DHCP_IP_ADDRESS_LEASE_TIME (51) diff --git a/src/lib/dhcp.c b/src/lib/dhcp.c index d234d60..5879135 100644 --- a/src/lib/dhcp.c +++ b/src/lib/dhcp.c @@ -1141,7 +1141,7 @@ int fr_dhcp_encode(RADIUS_PACKET *packet, RADIUS_PACKET *original) } } - vp = pairfind(packet->vps, DHCP2ATTR(256)); + vp = pairfind(packet->vps, 256, DHCP_MAGIC_VENDOR); if (vp) { *p++ = vp->vp_integer & 0xff; } else { @@ -1154,7 +1154,7 @@ int fr_dhcp_encode(RADIUS_PACKET *packet, RADIUS_PACKET *original) *p++ = 1; /* hardware type = ethernet */ *p++ = 6; /* 6 bytes of ethernet */ - vp = pairfind(packet->vps, DHCP2ATTR(259)); + vp = pairfind(packet->vps, 259, DHCP_MAGIC_VENDOR); if (vp) { *p++ = vp->vp_integer & 0xff; } else { diff --git a/src/lib/radius.c b/src/lib/radius.c index 5eb3ae3..6c09b4f 100644 --- a/src/lib/radius.c +++ b/src/lib/radius.c @@ -278,7 +278,7 @@ static int rad_sendto(int sockfd, void *data, size_t data_len, int flags, */ rcode = sendto(sockfd, data, data_len, flags, (struct sockaddr *) &dst, sizeof_dst); - if (rcode < 0) { +done: if (rcode < 0) { DEBUG("rad_send() failed: %s\n", strerror(errno)); } diff --git a/src/main/dhcpd.c b/src/main/dhcpd.c index c216bcf..5af566d 100644 --- a/src/main/dhcpd.c +++ b/src/main/dhcpd.c @@ -107,7 +107,7 @@ static int dhcp_process(REQUEST *request) /* * Hop count goes up. */ - vp = pairfind(request->reply->vps, DHCP2ATTR(259)); + vp = pairfind(request->reply->vps, 259, DHCP_MAGIC_VENDOR); if (vp) vp->vp_integer++; return 1; @@ -123,7 +123,7 @@ static int dhcp_process(REQUEST *request) * server. So we must be the destination of the * giaddr field. */ - pairdelete(&request->packet->vps, DHCP2ATTR(266)); + pairdelete(&request->packet->vps, 266, DHCP_MAGIC_VENDOR); rad_free(&request->reply); request->reply = request->packet; @@ -132,7 +132,7 @@ static int dhcp_process(REQUEST *request) /* * Search for client IP address. */ - vp = pairfind(request->packet->vps, DHCP2ATTR(264)); + vp = pairfind(request->packet->vps, 264, DHCP_MAGIC_VENDOR); if (!vp) { request->reply->code = 0; RDEBUG("DHCP: No YIAddr in the reply. Discarding packet"); @@ -151,7 +151,7 @@ static int dhcp_process(REQUEST *request) /* * Hop count goes down. */ - vp = pairfind(request->reply->vps, DHCP2ATTR(259)); + vp = pairfind(request->reply->vps, 259, DHCP_MAGIC_VENDOR); if (vp && (vp->vp_integer > 0)) vp->vp_integer--; /* diff --git a/src/modules/rlm_ldap/rlm_ldap.c b/src/modules/rlm_ldap/rlm_ldap.c index 8b08f6a..129e5ea 100644 --- a/src/modules/rlm_ldap/rlm_ldap.c +++ b/src/modules/rlm_ldap/rlm_ldap.c @@ -1580,7 +1580,7 @@ static int ldap_authorize(void *instance, REQUEST * request) if (res == 0){ passwd_val = universal_password; if (passwd_val){ - passwd_item = radius_paircreate(request, &request->config_items, PW_CLEARTEXT_PASSWORD, PW_TYPE_STRING); + passwd_item = radius_paircreate(request, &request->config_items, PW_CLEARTEXT_PASSWORD, 0, PW_TYPE_STRING); strlcpy(passwd_item->vp_strvalue,passwd_val,sizeof(passwd_item->vp_strvalue)); passwd_item->length = strlen(passwd_item->vp_strvalue); added_known_password = 1; @@ -1602,7 +1602,7 @@ static int ldap_authorize(void *instance, REQUEST * request) * The authorize method of no other LDAP module instance has * processed this request. */ - vp_inst = radius_paircreate(request, &request->config_items, inst_attr, PW_TYPE_STRING); + vp_inst = radius_paircreate(request, &request->config_items, inst_attr, 0, PW_TYPE_STRING); strlcpy(vp_inst->vp_strvalue, inst->xlat_name, sizeof(vp_inst->vp_strvalue)); vp_inst->length = strlen(vp_inst->vp_strvalue); @@ -1611,7 +1611,7 @@ static int ldap_authorize(void *instance, REQUEST * request) * of UP in the config items list and whether eDirectory account * policy check is to be performed or not. */ - vp_apc = radius_paircreate(request, &request->config_items, apc_attr, PW_TYPE_STRING); + vp_apc = radius_paircreate(request, &request->config_items, apc_attr, 0, PW_TYPE_STRING); if(!inst->edir_account_policy_check){ /* Do nothing */ strcpy(vp_apc->vp_strvalue, "1"); @@ -1649,7 +1649,7 @@ static int ldap_authorize(void *instance, REQUEST * request) auth_opt_attr = dattr->attr; if(pairfind(*check_pairs, auth_opt_attr, 0) == NULL){ if ((auth_option = ldap_get_values(conn->ld, msg, "sasDefaultLoginSequence")) != NULL) { - if ((vp_auth_opt = paircreate(auth_opt_attr, PW_TYPE_STRING)) == NULL){ + if ((vp_auth_opt = paircreate(auth_opt_attr, 0, PW_TYPE_STRING)) == NULL){ radlog(L_ERR, " [%s] Could not allocate memory. Aborting.", inst->xlat_name); ldap_msgfree(result); ldap_release_conn(conn_id, inst); @@ -1979,7 +1979,7 @@ retry: /* Generate state attribute */ state = rad_malloc(MAX_CHALLENGE_LEN); (void) sprintf(state, "%s%s", challenge, challenge); - vp_state = paircreate(PW_STATE, PW_TYPE_OCTETS); + vp_state = paircreate(PW_STATE, 0, PW_TYPE_OCTETS); memcpy(vp_state->vp_strvalue, state, strlen(state)); vp_state->length = strlen(state); pairadd(&request->reply->vps, vp_state); -- 1.7.5.4 -- Stephen.

1 0

Update debian packaging for v3
by Stephen R. van den Berg 09 Jul '11

09 Jul '11

--- In trying to compile the master branch for Debian, I find the following changes seem to be necessary (at least). Not quite sure if I covered everything, especially unclear of libfreeradius3 is necessary. Please review. debian/control | 8 ++++---- debian/freeradius-utils.install | 1 - debian/rules | 5 +++-- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/debian/control b/debian/control index 8c8ed39..dc3ccbc 100644 --- a/debian/control +++ b/debian/control @@ -28,7 +28,7 @@ Homepage: http://www.freeradius.org/ Package: freeradius Architecture: any -Depends: lsb-base (>= 3.1-23.2), ${shlibs:Depends}, freeradius-common, libfreeradius2 (= ${binary:Version}), ssl-cert, adduser +Depends: lsb-base (>= 3.1-23.2), ${shlibs:Depends}, freeradius-common, libfreeradius3 (= ${binary:Version}), ssl-cert, adduser Provides: radius-server Recommends: freeradius-utils Suggests: freeradius-ldap, freeradius-postgresql, freeradius-mysql, freeradius-krb5 @@ -54,7 +54,7 @@ Package: freeradius-utils Architecture: any Replaces: freeradius (<< 2.0) Conflicts: radiusd-livingston, yardradius -Depends: ${shlibs:Depends}, freeradius-common, libfreeradius2 (= ${binary:Version}) +Depends: ${shlibs:Depends}, freeradius-common, libfreeradius3 (= ${binary:Version}) Recommends: libdbi-perl Description: FreeRADIUS client utilities This package contains various client programs and utilities from @@ -72,7 +72,7 @@ Description: FreeRADIUS client utilities - rlm_ippool_tool - smbencrypt -Package: libfreeradius2 +Package: libfreeradius3 Architecture: any Depends: ${shlibs:Depends} Description: FreeRADIUS shared library @@ -82,7 +82,7 @@ Description: FreeRADIUS shared library Package: libfreeradius-dev Architecture: any Section: libdevel -Depends: ${shlibs:Depends}, libfreeradius2 (= ${binary:Version}) +Depends: ${shlibs:Depends}, libfreeradius3 (= ${binary:Version}) Description: FreeRADIUS shared library development files The FreeRADIUS projects' libfreeradius-radius and libfreeradius-eap, used by the FreeRADIUS server and some of the utilities. diff --git a/debian/freeradius-utils.install b/debian/freeradius-utils.install index 9bc0d62..ba91503 100644 --- a/debian/freeradius-utils.install +++ b/debian/freeradius-utils.install @@ -1,6 +1,5 @@ usr/bin/rlm_dbm_cat usr/bin/rlm_dbm_parser -usr/bin/radeapclient usr/bin/rlm_ippool_tool usr/bin/smbencrypt usr/bin/radclient diff --git a/debian/rules b/debian/rules index 10b7b75..49614ff 100755 --- a/debian/rules +++ b/debian/rules @@ -81,6 +81,7 @@ endif --enable-ltdl-install=no --enable-strict-dependencies \ --with-large-files --with-udpfromto --with-edir \ --enable-developer \ + --with-dhcp \ --config-cache \ --without-rlm_eap_tnc \ --with-rlm_sql_postgresql_lib_dir=`pg_config --libdir` \ @@ -152,14 +153,14 @@ install-arch: build-arch-stamp dh_testroot dh_installdirs -s test -d $(freeradius_dir)/usr/lib/freeradius || mkdir -p $(freeradius_dir)/usr/lib/freeradius - ln -s rlm_sql.so $(freeradius_dir)/usr/lib/freeradius/librlm_sql.so + ln -fs rlm_sql.so $(freeradius_dir)/usr/lib/freeradius/librlm_sql.so $(MAKE) install R=$(freeradius_dir) # rename radius binary to play nicely with others mv $(freeradius_dir)/usr/sbin/radiusd $(freeradius_dir)/usr/sbin/$(package) mv $(freeradius_dir)/$(mandir)/man8/radiusd.8 $(freeradius_dir)/$(mandir)/man8/$(package).8 - dh_install --sourcedir=$(freeradius_dir) -p libfreeradius2 + dh_install --sourcedir=$(freeradius_dir) -p libfreeradius3 dh_install --sourcedir=$(freeradius_dir) -p libfreeradius-dev for mod in ${modulelist}; do \ -- 1.7.5.4 -- Stephen.

1 0