- Freeradius-Devel - lists.freeradius.org

DHCP and rlm_ippool [was: Re: MSCHAP password changes]
by Ruslan Shevchenko 13 May '11

13 May '11

btw, I implemented DHCP support in rlm_ippool (plan to start pull process next week) On Fri, May 13, 2011 at 3:42 PM, Alan DeKok <aland(a)deployingradius.com> wrote: > Garber, Neal wrote: >>> I've pushed Phil's changes for MSCHAPv2 to the git "master" branch. >> >> I assume the "master" branch is 3.0. Just curious, is there an anticipated release date for 3.0 (or is it still too far out to know)? > > Hopefully early in the summer. It's pretty close to being finalized. > > I was waiting for the RadSec stuff to go in. The rest is pretty nice, > too. SNMP triggers, better WiMAX support, new encoders. > > I hope to be able to add some more DHCP functionality, too. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html >

1 0

MSCHAP password changes
by Alan DeKok 13 May '11

13 May '11

I've pushed Phil's changes for MSCHAPv2 to the git "master" branch. Let me know if it works. :) Alan DeKok.

2 2

RadSec is now available
by Alan DeKok 13 May '11

13 May '11

I've pushed changes to the git "master" branch which enable RadSec to work. So far, all I've done is to test the server proxying to itself. i.e. opening an outgoing radsec connection, then accepting it, and doing TLS. Please download && test it. For now, it only accepts one type of packet on a RadSec socket, so doing "auth+acct" is not possible. That can be fixed later. I *believe* that the code is stable. 90% of it is the pre-existing rlm_eap_tls code, which has been moved to the server core. The rest is a bit of "glue" code to tie the TLS code into the sockets. The result is that the TLS configuration is *identical* in EAP-TLS and in RadSec. Even better, all of the features of EAP-TLS, like certificate checking, OCSP, etc. are automatically features of RadSec. Alan DeKok.

1 0

GIT Log for 2011-05-12 23:33 GMT
by aland＠deployingradius.com 12 May '11

12 May '11

commit 7923580f7a90a48c5c1d233bef0e4f12c0ae76a0 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu May 12 12:27:59 2011 +0200 Add needed variable Files changed: src/main/tls.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) ====================================================================== commit d78b82883c59e50f8448f0e2a66adf19dd662095 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu May 12 10:38:03 2011 +0200 Hack radeapclient to make it build. People should be using eapol_test instead. It's SO much better. We probably also need to make radclient handle EAP-MD5, for simplicity of testing Files changed: src/modules/rlm_eap/radeapclient.c | 8 ++++++++ 1 files changed, 8 insertions(+), 0 deletions(-) ====================================================================== commit 7f56544ba034df198ee8d7e74a1542d650a39ea0 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu May 12 10:26:05 2011 +0200 "invalid attribute" means "create raw" Files changed: src/tests/extended.txt | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) ====================================================================== commit fe37b7ec46541a641a7c9a8975befd371f7fce23 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu May 12 10:24:56 2011 +0200 CUI is allowed to have zero-length Files changed: src/lib/radius.c | 11 +++++++++-- 1 files changed, 9 insertions(+), 2 deletions(-) ======================================================================

1 0

GIT Log for 2011-05-11 23:33 GMT
by aland＠deployingradius.com 11 May '11

11 May '11

commit a7b8359b623180c23c8537403128499ec699ce36 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed May 11 21:07:34 2011 +0200 Now that log_packet_header is documented, make sure it works Files changed: src/modules/rlm_detail/rlm_detail.c | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) ====================================================================== commit 46f64f9ab07e48c7f64ec76cd12b1e23663ee24d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed May 11 17:41:29 2011 +0200 Updated documentation and samples Handle IPv6 in detail filename. Document "log_packet_header" Files changed: raddb/modules/detail | 10 +++++++--- 1 files changed, 7 insertions(+), 3 deletions(-) ====================================================================== commit 453bf6f68445e0eceddd31a41ccc26cf82addc71 Author: Dante <dante(a)dante.org.uk> Date: Wed May 11 17:30:11 2011 +0200 Add preliminary support for TLS socket send/receive The code is not yet integrated into listen.c. That will be another step Files changed: src/include/radiusd.h | 11 + src/main/listen.c | 2 +- src/main/tls.c | 564 ++++++++++++++++++++++++++++++++++++++++++++++++- 3 files changed, 575 insertions(+), 2 deletions(-) ====================================================================== commit ece3a9c13925fb7e5ad7f998205b3a110db92294 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed May 11 17:28:28 2011 +0200 Move more code into server core Files changed: src/include/tls.h | 3 +- src/main/tls.c | 63 ++++++++++++++++++- .../rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c | 18 +----- 3 files changed, 62 insertions(+), 22 deletions(-) ====================================================================== commit 36bfb9aea6ff6b396747168a7dfe21c3ed527612 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed May 11 17:23:38 2011 +0200 Include version number in configuration file Files changed: raddb/radiusd.conf.in | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit a3f08dcb15462f089ee6d3331f9875bd4c58bdf7 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed May 11 14:25:16 2011 +0200 Move more functions to global namespace Files changed: src/include/tls.h | 13 ++- src/main/tls.c | 234 +++++++++++++++++++++++++++++++++- src/modules/rlm_eap/libeap/eap_tls.c | 202 +----------------------------- src/modules/rlm_eap/libeap/eap_tls.h | 1 + 4 files changed, 248 insertions(+), 202 deletions(-) ====================================================================== commit 175283f4d7b0d8549890cac410bf1ef296a222a5 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed May 11 14:25:03 2011 +0200 Return errors if something went wrong Files changed: src/lib/packet.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) ====================================================================== commit 9ac146cf08961e0fe3e918fcab3d919977079925 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed May 11 14:24:25 2011 +0200 Set client=NULL so we don't de-reference garbage for the statistics code Files changed: src/main/listen.c | 10 +++++----- 1 files changed, 5 insertions(+), 5 deletions(-) ====================================================================== commit 1a566c1b446256bc5f307a5e172047f2a529a733 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed May 11 10:55:56 2011 +0200 Handle node deletions when walking over the tree. The current node may be deleted, so we cache the left/right pointers where necessary, and use the cached versions instead of de-referencing the current node again. Files changed: src/lib/rbtree.c | 19 +++++++++++++------ 1 files changed, 13 insertions(+), 6 deletions(-) ====================================================================== commit ab3927991e942dfe4a247bd508eb7f799233087d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed May 11 10:39:31 2011 +0200 Fix build errors Files changed: src/include/radiusd.h | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) ====================================================================== commit 1b1656cd09feae4469cadd77282064bed724eda9 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed May 11 10:38:23 2011 +0200 Print more/better messages for TLS sockets and proxies Files changed: src/main/listen.c | 24 +++++++++++++++++------- 1 files changed, 17 insertions(+), 7 deletions(-) ====================================================================== commit 5d4876c021700864d30bd4d019c032d10e4eea3a Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed May 11 10:38:05 2011 +0200 Move include <tls.h> to after checks for WITH_TLS Files changed: src/include/radiusd.h | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-) ====================================================================== commit 6047e599759c7aa5679e59725f5f9bc86635e23e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue May 10 17:16:23 2011 +0200 Build when there are no detail files Files changed: src/modules/rlm_realm/rlm_realm.c | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-) ====================================================================== commit da968f38955c6f3de97921550bc22de4225dd0a8 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue May 10 17:02:38 2011 +0200 Tighten checks on ping for TCP sockets Files changed: src/main/realms.c | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-) ======================================================================

1 0

RadSec Support is going in!
by Alan DeKok 11 May '11

11 May '11

The current "master" branch includes limited support for radsec. You will have to do a "./configure" after doing a "git pull", otherwise the build will break. What works? Adding a "tls" subsection to "listen" and "home_server" configurations. See raddb/sites-available/tls. That's it for now. Note it does *not* support sending or receiving RADIUS over TLS. That will wait for another day. The current functionality involves little more than pulling the TLS code out of the EAP-TLS module, and adding it to the server core. The next steps will add significant amounts of new code to send and receive RADIUS over TLS. Alan DeKok.

2 2

GIT Log for 2011-05-10 23:33 GMT
by aland＠deployingradius.com 10 May '11

10 May '11

commit 2905a0382df9a864a164ad51feca1f2ddddf086c Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue May 10 14:55:32 2011 +0200 Parse TLS configuration for home servers Files changed: src/include/realms.h | 3 +++ src/main/realms.c | 44 +++++++++++++++++++++++++++++++++++++++++++- 2 files changed, 46 insertions(+), 1 deletions(-) ====================================================================== commit 2d157daa5bae0d25a880c51905caf67842c96c44 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue May 10 14:54:36 2011 +0200 Added code for tls client configuration i.e. we are the client. Files changed: src/include/tls.h | 13 +++-- src/main/tls.c | 131 ++++++++++++++++++++++++++++++++++++++++++++++++++++- 2 files changed, 138 insertions(+), 6 deletions(-) ====================================================================== commit b51cebcc94131ea1a1b980a4bbd376c5aa657af3 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue May 10 14:32:49 2011 +0200 Parse "tls" configuration section for sockets Files changed: src/include/radiusd.h | 20 ++++++++++- src/include/tls.h | 3 +- src/main/cb.c | 3 +- src/main/listen.c | 96 ++++++++++++++++++++++++++++++++++++++++++++++-- src/main/process.c | 4 +- src/main/tls.c | 1 - 6 files changed, 117 insertions(+), 10 deletions(-) ====================================================================== commit ddaa27d2949ad31c2ad805aceeaa0b3a4cfad973 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue May 10 14:03:44 2011 +0200 Removed EAP names from global TLS definitions and structures replace EAPTLS_ FR_TLS_ `find src/include src/main src/modules/rlm_eap -name "*.[ch]" -print` replace eaptls_status_t fr_tls_status_t `find src/include src/main src/modules/rlm_eap -name "*.[ch]" -print` And then to fix up EAP-specific names again: replace FR_TLS_PACKET EAPTLS_PACKET `find src/include src/main src/modules/rlm_eap -name "*.[ch]" -print` replace FR_TLS_MPPE_KEY_LEN EAPTLS_MPPE_KEY_LEN `find src/include src/main src/modules/rlm_eap -name "*.[ch]" -print` Files changed: src/include/tls.h | 32 +++--- src/main/tls.c | 20 ++-- src/modules/rlm_eap/libeap/eap_tls.c | 128 ++++++++++---------- src/modules/rlm_eap/libeap/eap_tls.h | 2 +- src/modules/rlm_eap/libeap/mppe_keys.c | 10 +- .../rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c | 16 ++-- .../rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c | 8 +- .../rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c | 8 +- 8 files changed, 112 insertions(+), 112 deletions(-) ====================================================================== commit 1e9ea9419fae964408465c310ea6ae2d9f641ff8 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue May 10 13:51:08 2011 +0200 Fix build errors Files changed: src/include/radiusd.h | 10 ++++++++++ src/main/tls.c | 2 ++ 2 files changed, 12 insertions(+), 0 deletions(-) ====================================================================== commit face8f6b3127676720c43ab0032f9e54c75c7b98 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Apr 2 21:41:12 2011 +0200 Move more TLS functions into the server core. There is now a tls server configuration structure, which should make it easier to deal with many TLS data exchanges Files changed: src/include/tls.h | 64 ++- src/main/tls.c | 1098 +++++++++++++++++++ .../rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c | 1101 +------------------- .../rlm_eap/types/rlm_eap_tls/rlm_eap_tls.h | 62 +-- 4 files changed, 1182 insertions(+), 1143 deletions(-) ====================================================================== commit ea0da816772820ba09a4fbf9475cf584921ebc6e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Apr 2 20:55:30 2011 +0200 Removed references to EAP from code now in server core. Files changed: src/include/tls.h | 2 +- src/main/tls.c | 10 +++++----- .../rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c | 2 +- 3 files changed, 7 insertions(+), 7 deletions(-) ====================================================================== commit 4bc09338a0028c7fee5d7180184f0b2be6562100 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Apr 2 18:11:41 2011 +0200 Moved TLS functions to a common area. In preparation for doing RadSec Files changed: src/main/Makefile.in | 3 + src/main/cb.c | 131 ++++++++ src/main/tls.c | 595 +++++++++++++++++++++++++++++++++++ src/modules/rlm_eap/libeap/Makefile | 2 +- src/modules/rlm_eap/libeap/cb.c | 131 -------- src/modules/rlm_eap/libeap/tls.c | 595 ----------------------------------- 6 files changed, 730 insertions(+), 727 deletions(-) ====================================================================== commit 2c77bf1de02c1d72f05757f1d215c17e012f6de9 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Apr 2 17:55:57 2011 +0200 Move TLS functions to new header file Files changed: src/include/tls.h | 315 ++++++++++++++++++++++++++++++++++ src/modules/rlm_eap/libeap/cb.c | 7 +- src/modules/rlm_eap/libeap/eap_tls.c | 34 +++-- src/modules/rlm_eap/libeap/eap_tls.h | 275 +----------------------------- src/modules/rlm_eap/libeap/tls.c | 10 +- 5 files changed, 343 insertions(+), 298 deletions(-) ====================================================================== commit 03558520df03b1c766dd2aa0f16f1ed4bb1e8b86 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Apr 2 13:47:16 2011 +0200 Clean up SSL set/get ex data handlers. No need for global variables, we can use fixed indices. Files changed: src/modules/rlm_eap/libeap/cb.c | 10 +-- src/modules/rlm_eap/libeap/eap_tls.c | 5 +- src/modules/rlm_eap/libeap/eap_tls.h | 12 ++- src/modules/rlm_eap/libeap/tls.c | 10 ++- .../rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c | 85 ++------------------ 5 files changed, 25 insertions(+), 97 deletions(-) ====================================================================== commit 58480647a10f11944df5ac366c5f14d8b385f6f7 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Apr 2 10:17:11 2011 +0200 Added socket thaw API Files changed: src/include/packet.h | 1 + src/lib/packet.c | 13 +++++++++++++ 2 files changed, 14 insertions(+), 0 deletions(-) ====================================================================== commit 31822cf5a4293ba470e5c3a8ac0bc61247d2cbbe Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Apr 2 10:15:08 2011 +0200 Sample TLS configuration for RadSec This documents RADIUS over TLS over TCP. Files changed: raddb/Makefile | 14 ++- raddb/sites-available/tls | 403 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 416 insertions(+), 1 deletions(-) ====================================================================== commit a3e378257dc82e5882e5a011a7bb318185d5d291 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Apr 2 10:13:35 2011 +0200 RFC 3539 This documents the retrransmission timers implemented as part of doing Status-Server over TCP Files changed: doc/rfc/rfc3539.txt | 2299 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 2299 insertions(+), 0 deletions(-) ====================================================================== commit 73c5e103dce22c9e747443450d483a6615121360 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue May 10 10:45:54 2011 +0200 If accounting start/interim/stop doesn't do anything, return NOOP If num_affected_rows == 0, return NOOP Files changed: src/modules/rlm_sql/rlm_sql.c | 22 +++++++++++++++++++--- 1 files changed, 19 insertions(+), 3 deletions(-) ====================================================================== commit 00af351dbfb796a78b9d1a4af6591b7bcdd7c4d7 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue May 10 10:28:03 2011 +0200 Clean up statistics gathering Files changed: src/include/stats.h | 28 ++------------- src/main/listen.c | 93 ++++++++++++++++++++++++-------------------------- src/main/process.c | 29 ++++++++++++++-- 3 files changed, 74 insertions(+), 76 deletions(-) ====================================================================== commit d41cecbdfae6b2a9330337e91732370310fabc06 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue May 10 09:34:56 2011 +0200 Track global coa/disconnect stats Files changed: src/include/stats.h | 12 ++++++++++++ src/main/command.c | 4 ++++ src/main/stats.c | 27 +++++++++++++++++---------- 3 files changed, 33 insertions(+), 10 deletions(-) ====================================================================== commit 1a48e2cc07056aa0bd3d8742c212fc8cffe138ed Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon May 9 20:42:31 2011 +0200 Show stats for CoA home servers, too Files changed: src/main/command.c | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) ======================================================================

1 0

rlm_ippool and dhcp
by Ruslan Shevchenko 10 May '11

10 May '11

Good day, community. I added dhcp support to rlm_ippool (i.e. now rlm_ip_pool check, if this is dhcp request and if yes -- fill dhcp attributes, instead framed-ip-address) and want to merge this changes into master branch. (also backport to 2.1.10 branch is live in small production now) [changes against master are in: https://github.com/rssh/freeradius-server/commit/546d3e69297313252c4d4adcd3… ] So, questions - is it ok to extend rlm_ippool in such way ? if yes, than I will start pull request after fixing compilation in master branch. Regards !

1 0

GIT Log for 2011-05-09 23:33 GMT
by aland＠deployingradius.com 09 May '11

09 May '11

commit abe780f34a75af292fd501e7d9329b4403c62648 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon May 9 19:37:46 2011 +0200 Fix typo If we're making a directory, make sure it's from the '/', and not from the whole filename. Files changed: src/modules/rlm_detail/rlm_detail.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) ====================================================================== commit 7e0222fef06bba7d32cd4dab0204f820af9c8ef2 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon May 9 19:33:41 2011 +0200 Track / print CoA && Disconnect stats Files changed: src/include/radiusd.h | 4 +++ src/main/command.c | 56 +++++++++++++++++++++++++++++++++++++----------- src/main/stats.c | 50 +++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 97 insertions(+), 13 deletions(-) ====================================================================== commit bc64b2d29c27c5ef174e890acd5111aea9596701 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon May 9 13:16:04 2011 +0200 Call fnmatch only if the packet was read from the detail file. And re-arranged the logic to make sense. If the packet was read from the detail file AND will be written back to the same directory (glob match), then do NOOP. Otherwise, just go make the directory Files changed: src/modules/rlm_detail/rlm_detail.c | 67 +++++++++++++--------------------- 1 files changed, 26 insertions(+), 41 deletions(-) ====================================================================== commit 8706985ff92596c27fb411a110c9393e44309ec4 Author: Alexander Clouter <alex(a)digriz.org.uk> Date: Mon May 9 11:15:16 2011 +0100 fix lower->tolower typo in policy.conf git commit abc96955 contains a typo that this patch fixes. As the module 'lower' does not exist calling this policy always results in a reject. Signed-off-by: Alexander Clouter <alex(a)digriz.org.uk> Files changed: raddb/policy.conf | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ======================================================================

1 0

ldap + mac-radius patch
by rti 09 May '11

09 May '11

hi, I wrote patch , ldap + mac-radius for the patch to. raddb/modules/ldap Added an option to set_mac_radius_mode_without_password. enabled by set_mac_radius_mode_without_password = yes. The default is disabled in set_mac_radius_mode_without_password = no. If you enable this option you can turn off password authentication ldap on. If mac-radius, mac address authentication should be so just ignore the password. wifi device (buffalo WAPM-APG300N) use, samba4 (domain controller) on the network using the built in mac-radius ldap confirmed that it works correctly. PATCH http://rtilabs.net/files/2011_05_07/ldap_mac_radius_mode__set_mac_radius_mo… patch detail (japanese blog) http://d.hatena.ne.jp/rti7743/20110507/1304717930 http://d.hatena.ne.jp/rti7743/20110507/1304793653

2 1