- Freeradius-Devel - lists.freeradius.org

[PATCH] fix lower->tolower typo in policy.conf
by Alexander Clouter 09 May '11

09 May '11

git commit abc96955 contains a typo that this patch fixes. As the module 'lower' does not exist calling this policy always results in a reject. Signed-off-by: Alexander Clouter <alex(a)digriz.org.uk> --- freeradius/policy.conf.orig 2011-05-09 10:44:57.000000000 +0100 +++ freeradius/policy.conf 2011-05-09 11:06:03.000000000 +0100 @@ -81,7 +81,7 @@ } # Mixed case: reject - if (User-Name != "%{lower:%{User-Name}}") { + if (User-Name != "%{tolower:%{User-Name}}") { reject } }

2 1

GIT Log for 2011-05-06 23:33 GMT
by aland＠deployingradius.com 06 May '11

06 May '11

commit aa203fccadbe1c9fff9332e3231d5788233d65ce Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri May 6 16:49:32 2011 +0200 Define _GNU_SOURCE before checking for structures On Linux, useful features that are industry standard are "protected" by requiring -D_GNU_SOURCE. Why would you want your users to *use* the features of libc? Files changed: configure | 8 ++++---- configure.in | 14 +++++++------- 2 files changed, 11 insertions(+), 11 deletions(-) ====================================================================== commit 1d61ba34bc7919357c3b9d7d34ad4a20f75ae4ea Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri May 6 14:32:12 2011 +0200 Add EAP tests to automated test suite Files changed: src/tests/Makefile | 17 +++++++++++++---- src/tests/eap-mschapv2.conf | 2 +- src/tests/eap-ttls-pap.conf | 1 - src/tests/mschapv1 | 2 ++ src/tests/peap-mschapv2.conf | 1 + src/tests/runtests.sh | 3 ++- 6 files changed, 19 insertions(+), 7 deletions(-) ====================================================================== commit eb5cf1389e252ac15a1fac6d549a4984a32b9fb1 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed May 4 13:42:25 2011 +0200 Change assert to run-time check Files changed: src/main/xlat.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 9035d82dd3390234acbf94d049c6c78181dca651 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri May 6 12:08:48 2011 +0200 Allow DHCP to work again. There is no "flags.encoded", as the RADIUS API has been changed to take 'const VALUE_PAIR *'. Rather than fixing the DHCP code, we just re-use the "extended" flag for the same purpose, since it isn't used for anything in the DHCP code Files changed: src/lib/dhcp.c | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-) ====================================================================== commit 810cf3365a35f2076e2fb82300b235f493fc0ec1 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri May 6 10:00:09 2011 +0200 Fix typo in function name Files changed: src/main/listen.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 7058ba4c9a3f71df47e89988e628da9babf5ef8c Merge: 011f6ad... b06c7fc... Author: alandekok <aland(a)freeradius.org> Date: Fri May 6 00:42:32 2011 -0700 Merge pull request #9 from rssh/master trivial: fixed compilation of dict.c with dhcp enabled. Files changed: ====================================================================== commit b06c7fc24f935d66bb0019a41ee79384cdffa92b Author: Ruslan Shevchenko <ruslan(a)shevchenko.kiev.ua> Date: Thu May 5 16:24:55 2011 +0300 fixed compilation fo dict.c with dhcp enabled Files changed: src/lib/dict.c | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) ======================================================================

1 0

Condition-Based Accounting Proxy
by eitarad 06 May '11

06 May '11

Hi Guys, Sorry for double-post. Hi All. I have installed FreeRadius as Accounting Proxy server which forwards the Accounting request to a proxy server. I Would like to achieve the following: 1. Accounting request packet received by the server 2. The server checks if the User Name in the request exists in a MySQL database 3. if the User Name exists, then the server will forward the request to the proxy server If it does not, the server WONT forward the request. I have wrote a bash script that performs the username check in the database and returns "0" if the user has been found, and "1" if the user is NOT found. I have used the Radius module rlm_exec to integrate the script into the radius system, so the current status is: the server receives the accounting request, initiates the sql_check module (which is rlm_exec that calls my bash script), and returns the correct values according to the username check. Now, I would like to configure the server that it will forward the accounting packets ONLY if the sql_check module returns a value of "0" - OK. Ive looked and searched EVERYWHERE, asked who ever I know who can help but no 1 has a clue on how to do it, and I couldnt find anything that can help me with the solution. ANY help will be highly appreciated! Debug log of an accounting request: rad_recv: Accounting-Request packet from host 172.16.0.61 port 5928, id=141, length=77 Acct-Status-Type = Start Acct-Session-Id = "0" Class = 0x37303732366636363639366336353364343136653734363935363639373237353733 Framed-IP-Address = 94.18.167.200 User-Name = "test" Wed May 4 09:45:41 2011 : Info: +- entering group preacct {...} Wed May 4 09:45:41 2011 : Info: ++[preprocess] returns ok Wed May 4 09:45:41 2011 : Info: [acct_unique] WARNING: Attribute NAS-Port was not found in request, unique ID MAY be inconsistent Wed May 4 09:45:41 2011 : Info: [acct_unique] Hashing ',Client-IP-Address = 172.16.0.61,NAS-IP-Address = 172.16.0.61,Acct-Session-Id = "0",User-Name = "test"' Wed May 4 09:45:41 2011 : Info: [acct_unique] Acct-Unique-Session-ID = "63b27f8746199ef7". Wed May 4 09:45:41 2011 : Info: ++[acct_unique] returns ok Wed May 4 09:45:41 2011 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Wed May 4 09:45:41 2011 : Info: [suffix] Found realm "NULL" Wed May 4 09:45:41 2011 : Info: [suffix] Adding Stripped-User-Name = "test" Wed May 4 09:45:41 2011 : Info: [suffix] Adding Realm = "NULL" Wed May 4 09:45:41 2011 : Info: [suffix] Proxying request from user test to realm NULL Wed May 4 09:45:41 2011 : Info: [suffix] Preparing to proxy accounting request to realm "NULL" Wed May 4 09:45:41 2011 : Info: ++[suffix] returns updated Wed May 4 09:45:41 2011 : Info: +- entering group accounting {...} Wed May 4 09:45:41 2011 : Info: [detail] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/172.16.0.61/detail-20110504 Wed May 4 09:45:41 2011 : Info: [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/172.16.0.61/detail-20110504 Wed May 4 09:45:41 2011 : Info: [detail] expand: %t -> Wed May 4 09:45:41 2011 Wed May 4 09:45:41 2011 : Info: ++[detail] returns ok Wed May 4 09:45:41 2011 : Info: [sql_check] expand: %{User-Name} -> test Wed May 4 09:45:41 2011 : Debug: Exec-Program output: user test is found in DB Wed May 4 09:45:41 2011 : Debug: Exec-Program-Wait: plaintext: user test is found in DB Wed May 4 09:45:41 2011 : Debug: Exec-Program: returned: 0 Wed May 4 09:45:41 2011 : Info: ++[sql_check] returns ok Wed May 4 09:45:41 2011 : Info: WARNING: Empty section. Using default return values. Sending Accounting-Request of id 188 to 10.100.1.148 port 1813 Acct-Status-Type = Start Acct-Session-Id = "0" Class = 0x37303732366636363639366336353364343136653734363935363639373237353733 Framed-IP-Address = 94.18.167.200 User-Name = "test" NAS-IP-Address = 172.16.0.61 Proxy-State = 0x313431 Wed May 4 09:45:41 2011 : Info: Proxying request 1 to home server 10.100.1.148 port 1813 Sending Accounting-Request of id 188 to 10.100.1.148 port 1813 Acct-Status-Type = Start Acct-Session-Id = "0" Class = 0x37303732366636363639366336353364343136653734363935363639373237353733 Framed-IP-Address = 94.18.167.200 User-Name = "test" NAS-IP-Address = 172.16.0.61 Proxy-State = 0x313431 Wed May 4 09:45:41 2011 : Debug: Going to the next request Wed May 4 09:45:41 2011 : Debug: Waking up in 0.9 seconds. rad_recv: Accounting-Response packet from host 10.100.1.148 port 1813, id=188, length=20 Wed May 4 09:45:41 2011 : Info: +- entering group post-proxy {...} Wed May 4 09:45:41 2011 : Info: [eap] No pre-existing handler found Wed May 4 09:45:41 2011 : Info: ++[eap] returns noop Sending Accounting-Response of id 141 to 172.16.0.61 port 5928 Wed May 4 09:45:41 2011 : Info: Finished request 1. Wed May 4 09:45:41 2011 : Info: Cleaning up request 1 ID 141 with timestamp +495 Wed May 4 09:45:41 2011 : Debug: Going to the next request Wed May 4 09:45:41 2011 : Info: Ready to process requests. Thanks in advance!!! Eitam. eitarad(a)hotmail.com -- View this message in context: http://freeradius.1045715.n5.nabble.com/Condition-Based-Accounting-Proxy-tp… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

2 3

Fwd: master branch: dhcp and ATTR_FLAGS.encoded: few questions.
by Ruslan Shevchenko 06 May '11

06 May '11

I try to compile freeradius trunk with WITH_DHCP flags, found few issues: 1. encoded bit-field is removed from ATTR_FLAGS. (bit it still used in dhcp.c, so compilation is broken) It's correct, that check of encoded field can be safely removed from dhcp, becouse this flag was used to reflect stage of packet processing, not stage of flag ? 2. in ATTRF_FLAGS size of do_xlat bitfueld is set to zero (at the same time we have assigments to flags.do_xlat in src/main/valuepair.c) Is it correct, that this is just typo and do_xlat must be declared with 1 bit ? 3. listener.c contains reference to undfined function fr_ipaddr_any. Is it correct, that fr_ipaddr_any must be defined as if ((sock->port == port) && ((sock->ipaddr.af == AF_INET) && (sock->ipaddr.ipaddr.ip4addr.s_addr == INADDR_ANY))) { return this; } #ifdef HAVE_STRUCT_SOCKADDR_IN6 if ((sock->port == port) && (sock->ipaddr.af == AF_INET6) && (IN6_IS_ADDR_UNSPECIFIED(&sock->ipaddr.ipaddr.ip6addr))) { return this; } #endif and it was simple forgotten to be comitted ? Regards !

2 2

[PATCH] return notfound from rlm_sql
by Dmitry Borodaenko 04 May '11

04 May '11

Greetings, The attached patch makes rlm_sql return RLM_MODULE_NOTFOUND when no rows were affected by the accounting queries, and modifies acct.c and modcall.c to recognize notfound as a valid accounting return status. As far as I can tell, this patch shouldn't affect any existing configurations which don't expect notfound for accounting packets. The scenario where this is useful is a staged migration from a legacy Radius platform to a new FreeRadius setup. During migration phase, new users are created in the new database, existing users are gradually moved from the old database to the new one. Users existing in the new database are handled locally, auth and acct packets for users that weren't migrated yet are proxied to the legacy platform. To make use of the attached patch in such scenario, accounting INSERT queries in dialup.conf are changed into: INSERT ... SELECT <same set of values> FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id LIMIT 1 In the server configuration, invocation of rlm_sql is followed by: if(notfound) { update control { Proxy-To-Realm = legacy } updated } -- Dmitry Borodaenko

2 1

GIT Log for 2011-05-03 23:33 GMT
by aland＠deployingradius.com 03 May '11

03 May '11

commit 011f6ade913284030efa607dca1e71d9a6e6cc84 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue May 3 17:39:11 2011 +0200 Added "proto" to listener_find_byipaddr This allows the control socket interface to show stats for both UDP and TCP sockets Files changed: src/include/radiusd.h | 3 ++- src/main/command.c | 2 +- src/main/listen.c | 39 ++++++++++++++++++++------------------- src/main/stats.c | 3 ++- 4 files changed, 25 insertions(+), 22 deletions(-) ====================================================================== commit dff62aa1314ed3879ceb27ebd5730f9eec6fbc22 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue May 3 16:51:18 2011 +0200 Track and show stats by socket IP/port Files changed: src/main/command.c | 109 +++++++++++++++++++++++++++++++++------------------ src/main/stats.c | 9 ++++ 2 files changed, 79 insertions(+), 39 deletions(-) ====================================================================== commit 1d5f7c5522fd6d8d6657c24a687a5ab6ee08bcec Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue May 3 16:35:03 2011 +0200 Keep stats for incoming/outgoing sockets, too Files changed: src/main/process.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) ====================================================================== commit baad4f67ea3130c6b347f3706918306e8d9ddfc6 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue May 3 15:14:25 2011 +0200 Added stats for "last packet seen from X" Files changed: src/include/stats.h | 1 + src/main/command.c | 1 + src/main/process.c | 28 +++++++++++++++++++++++++++- src/main/stats.c | 8 ++++---- 4 files changed, 33 insertions(+), 5 deletions(-) ====================================================================== commit 8ba9f00f55a992bb7fbb0a3f79281210a0ae5bab Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue May 3 09:23:41 2011 +0200 Don't decode attributes if there's no secret This is really a bug in the caller, but it's a reasonable change to make. Files changed: src/lib/radius.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ======================================================================

1 0

PEAP-MSCHAP question.
by Makarand Pradhan 03 May '11

03 May '11

Hi All, Hope all of you are having a nice day. This is my first post on this list, so kindly overlook any novice mistakes. I am facing a problem while working with freeradius. The description of the problem and a probable solution is given below: Problem Scenario: I work on a router. I am working on PEAP with default_eap_type=mschapv2. On the router, I am a tunnel exchanging packets with the port on one side and the radius server on the other. rad_decode is used to get the EAP attributes coming from the server, so that they can be sent to the port which is being authenticated. While invoking rad_decode, the secret is set to NULL. This causes a trap while trying to decode Microsoft specific attributes as dictionary.microsoft says the key should be encrypted. ATTRIBUTE MS-MPPE-Send-Key 16 octets encrypt=2 ATTRIBUTE MS-MPPE-Recv-Key 17 octets encrypt=2 Resolution: To resolve this issue, I had to add a NULL ptr check in radius.c, function data2vp. diff -Naur radius.c.orig radius.c --- radius.c.orig 2011-05-02 17:19:33.988204676 -0400 +++ radius.c 2011-05-02 17:21:29.528702423 -0400 @@ -2242,7 +2242,7 @@ /* * Decrypt the attribute. */ - switch (vp->flags.encrypt) { + switch (vp->flags.encrypt && (NULL != secret)) { /* * User-Password */ I would highly appreciate your opinions regarding the issue. If this resolution is not acceptable, then kindly let me know alternatives that would be acceptable. Warm Rgds, Makarand. -- NOTICE OF CONFIDENTIALITY: ------------------------------------------- This e-mail and any attachments may contain confidential and privileged information. If you are not the intended recipient, please notify the sender immediately by return e-mail and delete this e-mail and any copies. Any dissemination or use of this information by a person other than the intended recipient is unauthorized and may be illegal.

2 2

GIT Log for 2011-05-02 23:33 GMT
by aland＠deployingradius.com 02 May '11

02 May '11

commit b053273ae44dd9e26d355befddedf3ce64675beb Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon May 2 14:47:16 2011 +0200 Use built-in "offsetof" Look for "stddef.h", and if found, include it in the various configure checks. Also use it at run time. acinclude.m4 | 3 +++ configure | 19 +++++++++++++++++-- configure.in | 1 + src/include/autoconf.h.in | 3 +++ src/include/missing.h | 4 ++++ 5 files changed, 28 insertions(+), 2 deletions(-)

1 0

Re: fr_packet_cmp again
by Josip Almasi 02 May '11

02 May '11

Josip Almasi wrote: > Alan DeKok wrote: >> >> Grab the "master" branch. See http://git.freeradius.org for >> instructions. The internal state machine has been *completely* >> re-written so that it's sane. If the bug still exists there, I'll be >> shocked. > > Will try. Died 7 mins after with Error: ASSERT FAILED threads.c[423]: request->magic == REQUEST_MAGIC :/ Started with -s, segfault in libfreeradius-radius-3.0.0.so. Dang its still there!:)))) -------------------------- Program received signal SIGSEGV, Segmentation fault. fr_packet_cmp (a=0xda9130, b=0x6e6f6b7369050d5b) at packet.c:141 141 if (a->sockfd < b->sockfd) return -1; #0 fr_packet_cmp (a=0xda9130, b=0x6e6f6b7369050d5b) at packet.c:141 #1 0x00007ffff7bc0adb in list_find (ht=0x841840, data=0x7fffffffe158) at hash.c:191 #2 fr_hash_table_find (ht=0x841840, data=0x7fffffffe158) at hash.c:454 #3 0x00007ffff7bc0b29 in fr_hash_table_finddata (ht=<value optimized out>, data=<value optimized out>) at hash.c:484 #4 0x00007ffff7bd067a in fr_packet_list_find (pl=<value optimized out>, request=0xda9130) at packet.c:577 #5 0x0000000000428203 in request_receive (listener=0x858090, packet=0xda9130, client=0x7a3050, fun=0x407f60 <rad_accounting>) at process.c:1181 #6 0x0000000000415bb2 in acct_socket_recv (listener=0x858090) at listen.c:1382 #7 0x00000000004295ca in event_socket_handler (xel=<value optimized out>, fd=<value optimized out>, ctx=0x858090) at process.c:3125 #8 0x00007ffff7bd141b in fr_event_loop (el=0x841e00) at event.c:413 #9 0x000000000041d334 in main (argc=<value optimized out>, argv=<value optimized out>) at radiusd.c:412 (gdb) print a=0xda9130 $1 = (const RADIUS_PACKET *) 0xda9130 (gdb) print $1->sockfd $2 = 9 (gdb) print b=0x6e6f6b7369050d5b $3 = (const RADIUS_PACKET *) 0x6e6f6b7369050d5b (gdb) print $3->sockfd Cannot access memory at address 0x6e6f6b7369050d5b -------------------------- Still running another instance of 1.2.11 under valgrind memtest, some 3M packets later it's still fine. Could it be some sort of timing issue, i.e. I have faster box than you so you cant reproduce it? FTR I have 16 cores, 4 x Xeon 2.8 GHz. BTW I like what I saw in 3, response time under heavy load is way better. Regards...

4 10

GIT Log for 2011-04-29 23:33 GMT
by aland＠deployingradius.com 29 Apr '11

29 Apr '11

commit 058bc1d7898b21d06f894db23738e01e2a8e6d61 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Apr 29 13:17:24 2011 +0200 Update timers in slightly different place Files changed: src/main/process.c | 9 +++++---- 1 files changed, 5 insertions(+), 4 deletions(-) ====================================================================== commit 10307f6eb5e0f17170bd511ca3102a18b74ad0b3 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Apr 29 13:16:01 2011 +0200 Move packet IP/ID handling to rbtrees Apparently bug #35 is caused by the hash table used to track IPs and IDs. It's too difficult to figure out what the heck is wrong with the hash table. However, replacing it with a red-black tree avoids the problem entirely. Files changed: src/lib/packet.c | 39 +++++++++++++++++---------------------- 1 files changed, 17 insertions(+), 22 deletions(-) ====================================================================== commit 6554c3178485d4f416e612b6a5b113f820291567 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Apr 29 13:12:12 2011 +0200 More and better sanity checks Files changed: src/main/threads.c | 15 +++++++++++---- 1 files changed, 11 insertions(+), 4 deletions(-) ====================================================================== commit 60e6420ba180d84e89907c67a867efb446ccf394 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Apr 29 13:09:27 2011 +0200 Fix edge condition Files changed: src/lib/fifo.c | 13 +++++-------- 1 files changed, 5 insertions(+), 8 deletions(-) ====================================================================== commit 079ebb2844c2775e8e28e4fc6ca47cc3e61770b1 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Apr 29 12:17:07 2011 +0200 Be slightly more careful about conflicting packets There are race conditions where the child thread sends a reply, and the master thread receives the "next" packet before the child thread has marked the request as DONE. In that case, don't print a message about conflicting packets. Files changed: src/main/process.c | 8 ++++++++ 1 files changed, 8 insertions(+), 0 deletions(-) ====================================================================== commit 8ece9ac1d220a4216d7046b8937672d7ca17c381 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Apr 29 12:16:45 2011 +0200 Don't free a NULL pointer Files changed: src/main/command.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) ====================================================================== commit b3be5af65352acc510bf657da0e8f9240feff7cb Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Apr 29 12:11:50 2011 +0200 Simplify statistics code Files changed: src/include/stats.h | 2 +- src/main/command.c | 20 +++++++++++--------- src/main/stats.c | 42 ++++++++++++++++++++++-------------------- 3 files changed, 34 insertions(+), 30 deletions(-) ======================================================================

1 0