- Freeradius-Devel - lists.freeradius.org

GIT Log for 2011-04-28 23:33 GMT
by aland＠deployingradius.com 28 Apr '11

28 Apr '11

commit 1e36b19e9bcde6dbb6982b04f575ca6a739eba92 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 28 18:52:26 2011 +0200 Fixed tv_sub function Files changed: src/main/stats.c | 30 ++++++++++++++++++++---------- 1 files changed, 20 insertions(+), 10 deletions(-) ====================================================================== commit 53bb97efa4ab3e7ed9cea2fc50e4d4b58e2a046b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 28 17:59:11 2011 +0200 Set unresponsive child time correctly Files changed: src/main/process.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 7b47fc895db514213966390efbdcba57b93b1d4e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 28 17:51:37 2011 +0200 Count statistics for duplicate packets i.e. packets retransmitted by the client Files changed: src/main/process.c | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) ====================================================================== commit 05397efc6f3c3032bee48df9b270fcdae0b21205 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 28 17:14:06 2011 +0200 Track and print time-based statistics Now that we track packet->timestamp for requests and replies, it can be used to keep track of client/global/home-server auth/acct statistics for elapsed time. We track the elapsed time (reply - request) to see how long it takes for the server to respond to requests. We need to do the same thing for CoA packets, too. Right now we don't... Files changed: src/include/stats.h | 1 + src/main/command.c | 9 +++++ src/main/stats.c | 96 +++++++++++++++++++++++++++++++++++++++++++------- 3 files changed, 92 insertions(+), 14 deletions(-) ====================================================================== commit 013fe5b7da2901d4fd96522400b31d2013140e1a Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 28 15:33:02 2011 +0200 Fixed typo Files changed: src/main/stats.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 5a88ed9a06ccf64e25dee0533137032177697a2f Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 28 15:07:52 2011 +0200 Moved timestamps to RADIUS_PACKET structure Files changed: src/include/radiusd.h | 4 ---- src/main/detail.c | 4 ++-- src/main/process.c | 28 ++++++++++++++-------------- 3 files changed, 16 insertions(+), 20 deletions(-) ====================================================================== commit 15d8c035f8bc8b8bee3218a3b46ec755b3ab8ee4 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 28 14:58:06 2011 +0200 Make packet timestamp be "struct timeval" Files changed: src/include/libradius.h | 2 +- src/main/detail.c | 4 ++-- src/main/listen.c | 2 +- src/main/process.c | 3 +-- 4 files changed, 5 insertions(+), 6 deletions(-) ====================================================================== commit 083c67bba258f8251cc7c204a09310dcde655446 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 28 12:39:59 2011 +0200 Check for OpenSSL MD4/MD5/SHA functions Files changed: configure | 3 +++ configure.in | 3 +++ src/include/autoconf.h.in | 9 +++++++++ 3 files changed, 15 insertions(+), 0 deletions(-) ====================================================================== commit 3e4efb47bbac387713094685fb47408a7f4e6d3e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 28 12:24:30 2011 +0200 Fix compile warnings Files changed: src/main/radattr.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) ====================================================================== commit 35701ac789a4bbdabdce9ad3b7dddbd3e6a38c58 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 28 11:09:45 2011 +0200 pairmake may return NULL if the dictionaries are broken. The code should check for this, and behave gracefully Files changed: src/main/soh.c | 24 +++++++++++++++++++++++- 1 files changed, 23 insertions(+), 1 deletions(-) ====================================================================== commit 407f40cc9e5dccea0b5b5a66fe859d0fddd16c83 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 28 11:07:07 2011 +0200 Fix typo in attribute name Files changed: src/main/soh.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 3106f200c051871b217f84b14a32f11026dcb119 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 28 10:38:34 2011 +0200 Minor cleanups In-lined a function, and clarified the logic flow Files changed: src/main/process.c | 55 ++++++++++++++++++++++----------------------------- 1 files changed, 24 insertions(+), 31 deletions(-) ====================================================================== commit f20a7e228ff68ac9aaac7c60e27f2af61bfff0d5 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 28 09:30:06 2011 +0200 Minor changes to ifdef's to build with various flags So that we can do #undef WITH_TCP or WITH_PROXY, etc. and it will still compile and work Files changed: src/main/process.c | 8 +++++--- 1 files changed, 5 insertions(+), 3 deletions(-) ====================================================================== commit 347d26d5fc8e66864f059c857c5b7f3415c62b23 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 27 14:50:28 2011 +0200 Merged post-handler and cleanup into request_finish This also lets us run "Post-Auth-Type Reject" before sending the Access-Reject, which is probably a good idea... Files changed: src/main/process.c | 34 ++++++++++++---------------------- 1 files changed, 12 insertions(+), 22 deletions(-) ======================================================================

1 0

fr_packet_cmp again
by Josip Almasi 28 Apr '11

28 Apr '11

Hi, compiled current 2.1.11 branch on RHEL 6.0 and RHEL 5.5, hit it with about 7.5K req/s, and it dies on both, after about 1-3.5M requests. Hit it with about 1000 req/s, it still dies. It's always segfault in libfreeradius. (there's more issues on RHEL 6 but they're not critical) It's got nothing to do with max_request_time; tried changing it just in case, but I get response time in milliseconds anyway. It's not about threads; tried with -s, and it still dies. I'm reasonably sure it's not about load either, just I can't wait like 100000 secs for fail. All the time, I get decent response time (<20ms auth, <200ms acct) and no retries. Well at least there's no 'ignoring dupes' repored in radius.log. Well there's nothing except 'ready' in radius.log. In fact, it seems bug #35 is still on: ----------------- Program received signal SIGSEGV, Segmentation fault. fr_packet_cmp (a=0x11edc90, b=0xfb0b098dddf10f89) at packet.c:139 139 if (a->sockfd < b->sockfd) return -1; (gdb) bt #0 fr_packet_cmp (a=0x11edc90, b=0xfb0b098dddf10f89) at packet.c:139 #1 0x00007ffff7bc551b in list_find (ht=0x85aa80, data=0x7fffffffe1c8) at hash.c:191 #2 fr_hash_table_find (ht=0x85aa80, data=0x7fffffffe1c8) at hash.c:454 #3 0x00007ffff7bc5569 in fr_hash_table_finddata (ht=<value optimized out>, data=<value optimized out>) at hash.c:484 #4 0x00007ffff7bd30ea in fr_packet_list_find (pl=<value optimized out>, request=0x11edc90) at packet.c:583 #5 0x0000000000428569 in received_request (listener=0x8686a0, packet=0x11edc90, prequest=0x7fffffffe320, client=0x79d680) at event.c:2833 #6 0x0000000000414ee3 in auth_socket_recv (listener=0x8686a0, pfun=0x7fffffffe328, prequest=0x7fffffffe320) at listen.c:857 #7 0x00000000004291a0 in event_socket_handler (xel=<value optimized out>, fd=<value optimized out>, ctx=0x8686a0) at event.c:3423 #8 0x00007ffff7bd437b in fr_event_loop (el=0x854c50) at event.c:413 #9 0x000000000041beb4 in main (argc=<value optimized out>, argv=<value optimized out>) at radiusd.c:408 (gdb) print a=0x11edc90 $1 = (const RADIUS_PACKET *) 0x11edc90 (gdb) print $1->sockfd $2 = 10 (gdb) print b=0xfb0b098dddf10f89 $3 = (const RADIUS_PACKET *) 0xfb0b098dddf10f89 (gdb) print $3->sockfd Cannot access memory at address 0xfb0b098dddf10f89 ----------------- Did this a number of times, sometimes it's auth_socket_recv but mostly acct_socket_recv. So it seems something still frees data before yanking list...? Well, beats me. Any hints? Now, how to reproduce: - get spizd 0.5 from http://sourceforge.net/projects/spizd/files/ - unzip, have java in path - edit etc/dictionary.txt, enter at least one username:password pair - run bin/spizd-radius.sh <server>, verify you get Access-Accept - edit etc/spizd.properties: change verboseThis and verboseThat to false, change spizd.circular to true - run spizd-radius.sh again and wait, it dies about 10-15 mins later - optionally, increase maxThreads to kill it faster What this test does: Access-Request, Acct Start, (optionally a number of Interim-Update), Acct Stop - sending request imediatelly after response to previous request is received, thread per session. Regards...

2 3

GIT Log for 2011-04-27 23:33 GMT
by aland＠deployingradius.com 27 Apr '11

27 Apr '11

commit ddc48bbe675e2d2fdf17e646729569d56b2e9ab1 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 27 11:38:20 2011 +0200 Fix logic so proxying inner-tunnel requests works the "post-process" stage is really "just before we send the reply" Files changed: src/main/process.c | 35 ++++++++++++++++++----------------- 1 files changed, 18 insertions(+), 17 deletions(-) ====================================================================== commit d43c329fb7483d258a7cac8b16ac85038fb45b3b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 27 09:41:08 2011 +0200 Load the default virtual server before any others This avoids user surprise Files changed: src/main/modules.c | 40 +++++++++++++++++++++++++--------------- 1 files changed, 25 insertions(+), 15 deletions(-) ====================================================================== commit 35834589bf5918410ca17a921a387510b5ca17ee Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 21 09:00:09 2011 +0200 Mark the module as HUP-safe Files changed: src/modules/rlm_mschap/rlm_mschap.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ======================================================================

1 0

SNMP Traps
by Alan DeKok 27 Apr '11

27 Apr '11

See raddb/trigger.conf in the "master" git branch. The server can now send traps when it starts, when a home server is marked "dead", "alive", etc. The functionality is abstracted so that it doesn't *have* to be SNMP traps. Instead, a set of triggers is pre-defined in the server, and those triggers cause arbitrary scripts to be run. The scripts currently send triggers, but they can also be changed to send email, etc. Alan DeKok.

1 0

GIT Log for 2011-04-22 23:33 GMT
by aland＠deployingradius.com 22 Apr '11

22 Apr '11

commit a45e659257933f0e26c3dff4542545d494e46cb1 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Apr 22 15:26:52 2011 +0200 Added SQL triggers Files changed: src/modules/rlm_sql/rlm_sql.c | 1 + src/modules/rlm_sql/rlm_sql.h | 1 + src/modules/rlm_sql/sql.c | 3 +++ 3 files changed, 5 insertions(+), 0 deletions(-) ====================================================================== commit 65788dc8173ac683d2adebac640704687d897535 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Apr 22 14:01:23 2011 +0200 Added triggers for HUP, TERM, home server alive/zombie/dead Files changed: src/include/realms.h | 2 ++ src/main/exec.c | 11 ++++++++--- src/main/process.c | 39 ++++++++++++++++++++++++++++++++++++++- src/main/realms.c | 18 ++++++++++++++++++ 4 files changed, 66 insertions(+), 4 deletions(-) ====================================================================== commit 8b52274e38a1856d7b4433dd0600d7a5deea2602 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Oct 11 12:01:10 2010 +0200 Install docs Files changed: README.snmp | 58 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 58 insertions(+), 0 deletions(-) ====================================================================== commit 5d1c7fd235f22bb2c47e112efaa02f8ae1e17b74 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Oct 9 18:09:43 2010 +0200 Triggers for thread start/stop Files changed: src/main/threads.c | 9 ++++++--- 1 files changed, 6 insertions(+), 3 deletions(-) ====================================================================== commit 9728d6a679bb80d4c37bd58068e400b49be9edaf Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Oct 9 18:09:25 2010 +0200 Trigger when adding a new dynamic client. There is currently no trigger for when one expires. Files changed: src/main/listen.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) ====================================================================== commit 09dc46b8e30949749d88f3effcc415ba074c2bd7 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Nov 30 09:26:15 2010 +0100 Added client mibs Files changed: mibs/RADIUS-ACC-CLIENT-MIB.txt | 647 +++++++++++++++++++++++++++++++++++ mibs/RADIUS-AUTH-CLIENT-MIB.txt | 708 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 1355 insertions(+), 0 deletions(-) ====================================================================== commit e52360ed45fdd54cf322e28fdfa70a31aaceb836 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Oct 9 18:08:14 2010 +0200 Added start / stop server triggers Files changed: src/main/radiusd.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) ====================================================================== commit ceac49be917bb332b066882927543c1635f83cb9 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Oct 9 18:05:22 2010 +0200 Added function to run SNMP triggers Files changed: src/include/radiusd.h | 1 + src/main/exec.c | 68 +++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 69 insertions(+), 0 deletions(-) ====================================================================== commit 1b05e83d623e5445cda097dcd8400ac0c3c46de5 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Apr 22 13:39:27 2011 +0200 Added sample trigger.conf Files changed: raddb/Makefile | 5 +- raddb/radiusd.conf.in | 8 ++ raddb/trigger.conf | 218 +++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 230 insertions(+), 1 deletions(-) ====================================================================== commit 6a4612f208801e5ed0b11cc6745fec7915f4bb32 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Oct 9 18:04:14 2010 +0200 New / updated notification MIBs Files changed: mibs/FREERADIUS-MGMT-MIB.txt | 34 ++++++++ mibs/FREERADIUS-NOTIFICATION-MIB.txt | 135 +++++++++++++++++++++++++++++++ mibs/FREERADIUS-PRODUCT-RADIUSD-MIB.txt | 38 +++++++++ mibs/FREERADIUS-SMI.txt | 2 + 4 files changed, 209 insertions(+), 0 deletions(-) ====================================================================== commit 58508e9e9179f4da10aaac1e9de9c7cf16352b15 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 13 15:11:00 2011 +0200 Move state machine checks to a macro Files changed: src/main/process.c | 46 ++++++++++++---------------------------------- 1 files changed, 12 insertions(+), 34 deletions(-) ======================================================================

1 0

compiling freeradius source code
by ashwini b 22 Apr '11

22 Apr '11

Hi, I'm giving a detailed description of my problem here Im setting up 802.1x port based authentication using wire1x as supplicant and freeradius as the server.I have configured switch for 802.1x and using eap-tls as authentication protocol.freeradius is configured to authenticate the client with username and password. My problem is i want to sent a bit(P bit) along with this username which will be taken into account for the authentication.for this i planned to send the username as P<specialcharacter>UserName.and wire1x will send the username as usual. Now at the freeradius side i have to seperate this new user name to P and UserName.and and make the authentication as(hypothetically): if(recieved (username,password)=(username,password)in clients.conf)&&bit P==1) { authenticate(return 0) } I found that the username,password checking is done in auth.c file.i have to add 1 more condition to that. Hope i have explained my problem well.and hope u will give enough suggestions. thank you On Thu, Apr 21, 2011 at 4:22 PM, Brian Candler <B.Candler(a)pobox.com> wrote: > On Wed, Apr 20, 2011 at 08:30:28PM +0530, ashwini b wrote: > > thank you for the suggestion.but as i mentioned earlier i'm really a > > newcomer in this field.. > > > > where should i make these changes?and i hav to authenticate the user > > based on username ,password and the checkbit(as mentioned earlier).Can > > u suggest how i could accomplish this.a detailed explanation will be a > > great help... > > You will make the change in sites-available/default in the "authorize" > section. "man unlang" will tell you more about the language you can use in > here. > > I can't give you any more detailled description of the solution, because > you > haven't given a detailled description of the problem. All you've said is > you're "sending a bit along with the username". Maybe you could give an > example of what the modified username looks like, and how you want the > username to look after restoring it? >

2 1

compiling freeradius source code
by ash 21 Apr '11

21 Apr '11

I'm a beginner in freeradius and i'm not familiar with the code.i'm setting up 802.1x authentication using freeradius and it works fine.but before authenticating the user based on username and password and assigning to a vlan i have to check one more condition (whether a file is present in client or not.for this i'm sending a bit along with username.if file is present, the bit is set to 1).so to separate the bit from username at the freeradius for authentication i edited the auth.c file.now how should i compile the modified code and install it? is it enough to simple change the code...and give ./build and install thanks for ur time and consideration... -- View this message in context: http://freeradius.1045715.n5.nabble.com/compiling-freeradius-source-code-tp… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

3 3

proxy.conf: no_response_fail
by Josip Almasi 20 Apr '11

20 Apr '11

Hi, there is a scenario that might require "no_response_fail = yes". First, network breaks; power outage, spanking trees, something other but massive. Then clients start comming online, put some heavy load on backend server. Retry, retry, and - clients DoS backend. In that case I might want to send Access-Reject, to get some breathing space. I had one case much like this with a buggy BRAS a few years ago. And I was involved in another, where Access-Reject made things much worse, due to buggy IADs - once rejected, they reset to factory defaults:> So, although I can't really say I need this feature, I know of cases that make it usefull. Regards...

3 3

GIT Log for 2011-04-13 23:33 GMT
by aland＠deployingradius.com 13 Apr '11

13 Apr '11

commit c92c7685c8107e9f1a0e57b87046c3ace441ab9e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 13 09:57:18 2011 +0200 New state machine for 3.0 It's about the same amount of code as the previous one, but is much simpler. Files changed: src/include/detail.h | 3 +- src/include/process.h | 64 + src/include/radiusd.h | 21 +- src/include/realms.h | 1 + src/include/vmps.h | 3 +- src/main/command.c | 52 +- src/main/detail.c | 10 +- src/main/dhcpd.c | 7 +- src/main/listen.c | 129 +- src/main/process.c | 4847 +++++++++++++++++++++++-------------------------- src/main/threads.c | 161 +-- src/main/vmps.c | 8 +- 12 files changed, 2426 insertions(+), 2880 deletions(-) ====================================================================== commit 8ac744242692979e672d5cd64cbad0044d0276b5 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 13 09:46:23 2011 +0200 Use paged arrays rather than linked lists There's less memory allocation on every fifo insert/free Files changed: src/lib/fifo.c | 183 ++++++++++++++++++++++++++++---------------------------- 1 files changed, 91 insertions(+), 92 deletions(-) ====================================================================== commit f91aa6d78f202ac09630b30334b73b05954d8877 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 13 09:43:34 2011 +0200 Move source in preparation for new code The new event handler is simpler than the old one, and needs to be in a separate file, to make it clear that it's a major change to the server core. Files changed: src/main/Makefile.in | 2 +- src/main/event.c | 4254 -------------------------------------------------- src/main/process.c | 4254 ++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 4255 insertions(+), 4255 deletions(-) ======================================================================

1 0

New state machine in the server core.
by Alan DeKok 13 Apr '11

13 Apr '11

I've just pushed a new state machine to the server core. For people doing "git pull", this means editing src/main/Makefile, and changing "event.c" to "process.c". Or, just re-run "configure" The new state machine is about the same amount of code as the old one. The difference is that it's conceptually much simpler. It has all of the functionality of the old one, and hopefully none of the bugs. The old state machine was an inter-connected mess that was getting to be impossible to extend or debug. The new one is much, much, better. I've attached some SVG diagrams of the state machines, taken from an automated analysis of the code. "event.svg" is the old one. "process.svg" is the new one. You'll note that "process.svg" doesn't look a lot simpler... So "process-simplified.svg" removes the "book-keeping" functions, along with the proxy and CoA functions. The result is a state machine that handles authentication / accounting / coa requests, processes them, and replies. That state machine is much simpler. Please test it, and see what you think. I've done a number of tests with all packet types, proxying, etc. I think that the functionality is identical to the old one, or sometimes even better. It also has the ability to debug the internal state machine. Define a flag DEBUG_STATE_MACHINE, and it will then print out every state transition that a request goes through. It's valuable for understanding how it all works. Alan DeKok.

1 0