- Freeradius-Devel - lists.freeradius.org

[PATCH] rlm_sql_sqlite sql_select_query
by Etienne Champetier 01 Mar '11

01 Mar '11

Hello I was trying to get the sqlite module to work and i had to modify the code to get it work (else i've got rlm_sql_sqlite: sqlite3_step = 21 where 21 is misuse). I've just tested authorize and client (select only, no update, insert or delete) and it work fine (I haven't tested accounting yet). Here is my simple patch Signed-off-by: Etienne CHAMPETIER <etienne.champetier(a)free.fr> ---------------------------------------------------- diff --git a/src/modules/rlm_sql/drivers/rlm_sql_sqlite/sql_sqlite.c b/src/modules/rlm_sql/drivers/rlm_sql_sqlite/sql_sqlite.c index 14466d9..d7bd2b9 100644 --- a/src/modules/rlm_sql/drivers/rlm_sql_sqlite/sql_sqlite.c +++ b/src/modules/rlm_sql/drivers/rlm_sql_sqlite/sql_sqlite.c @@ -138,10 +138,7 @@ static int sql_query(SQLSOCK * sqlsocket, SQL_CONFIG *config, char *querystr) static int sql_select_query(SQLSOCK *sqlsocket, SQL_CONFIG *config, char *querystr) { - if (strstr(querystr, "nas") != NULL) - return sql_query(sqlsocket, config, querystr); - - return 0; + return sql_query(sqlsocket, config, querystr); }

2 1

GIT Log for 2011-03-01 00:33 GMT
by aland＠deployingradius.com 01 Mar '11

01 Mar '11

commit 08cbe29fa904234df9b49d2688e787cdbfdc2f65 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Feb 28 17:46:35 2011 +0100 API fixes for 3.0 Files changed: src/modules/rlm_eap/radeapclient.c | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) ====================================================================== commit 8ffe0ccb928720b8429db4f8e4fe35dbdc1aa989 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Feb 28 17:45:17 2011 +0100 API fxes for 3.0 Files changed: src/modules/rlm_ldap/rlm_ldap.c | 16 ++++++++-------- 1 files changed, 8 insertions(+), 8 deletions(-) ====================================================================== commit a3f5c90709f44eac0344f8e52f65aed6c4ea555e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Feb 28 17:28:14 2011 +0100 Use 2.2 API Files changed: src/modules/rlm_eap/types/rlm_eap_ikev2/ike_conf.c | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) ====================================================================== commit 9d3acd0ef6256b1f5695ff6a2ced7584a7221217 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Feb 28 15:01:15 2011 +0100 Vendors using "format=1,1" can have attributes of type "tlv" They're now encoded properly. Previously, they were decoded properly, but not encoded. Files changed: src/lib/radius.c | 23 +++++++++++++++++++++-- 1 files changed, 21 insertions(+), 2 deletions(-) ====================================================================== commit df6f4de93f2e9194d3bd9dbf42d3cfb229c024b1 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Feb 28 14:59:06 2011 +0100 Vendors can only use the TLV format if they follow the specs "format=1,1" are allowed to use TLVs. Other vendors are not. Except WiMAX, because they're special. Files changed: src/lib/dict.c | 17 ++++++++++++++++- 1 files changed, 16 insertions(+), 1 deletions(-) ====================================================================== commit 2a663ed7a52af35a13c75268ec72d8a194b8c396 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Feb 28 14:58:33 2011 +0100 Comment out DHCP dictionary by default. it should only be enabled if the server does DHCP. Files changed: share/dictionary | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 9a10ca011ce6cdec6ed2dd0c96d32db9e011ff4f Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Feb 28 11:00:14 2011 +0100 Added sample of using global / static variables Files changed: src/modules/rlm_perl/example.pl | 13 +++++++++++++ 1 files changed, 13 insertions(+), 0 deletions(-) ======================================================================

1 0

GIT Log for 2011-02-24 00:33 GMT
by aland＠deployingradius.com 24 Feb '11

24 Feb '11

commit 85bd2e2289115694b45beef071293368bcbf6731 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Feb 23 11:04:31 2011 +0100 Use rad_digest_cmp() to avoid timing attacks Files changed: src/modules/rlm_pap/rlm_pap.c | 20 +++++++++++--------- 1 files changed, 11 insertions(+), 9 deletions(-) ====================================================================== commit e6297b738175ea46997d88554c1610a17ad4346d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Feb 23 11:01:17 2011 +0100 Use rad_digest_cmp() to avoid timing attacks Files changed: src/modules/rlm_mschap/rlm_mschap.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 661f851e121c5e2dc400f9718b5995dd3df2a307 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Feb 23 11:01:02 2011 +0100 Use rad_digest_cmp() to avoid timing attacks Files changed: src/modules/rlm_chap/rlm_chap.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) ====================================================================== commit f4b496363fc2349ea5ff98ad65e55dba70496beb Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Feb 23 10:59:55 2011 +0100 Expose digest_cmp function So that it can be used in other places to avoid timing attacks Files changed: src/include/libradius.h | 1 + src/lib/radius.c | 8 ++++---- 2 files changed, 5 insertions(+), 4 deletions(-) ====================================================================== commit 85dc9ebd18be09132c10fcd388222d78a857deeb Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Feb 23 09:46:30 2011 +0100 Updated license to LGPL rather than GPL The "lib" directory and everything it needs have been lgpl for a long time. Files changed: src/include/libradius.h | 18 +++++++++--------- 1 files changed, 9 insertions(+), 9 deletions(-) ====================================================================== commit faae79fb600ec084ce93a84b2d3deb3f9fb85c40 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Feb 23 09:26:03 2011 +0100 Corrected license to LGPL rather than GPL Files changed: src/lib/dhcp.c | 18 +++++++++--------- 1 files changed, 9 insertions(+), 9 deletions(-) ====================================================================== commit d534ca3dabc6f40ca99fe8dc2cf82e4f14f378cf Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Feb 20 09:39:57 2011 +0100 Print error if we can't send a packet in rad_send() Files changed: src/lib/radius.c | 18 +++++++++++++----- 1 files changed, 13 insertions(+), 5 deletions(-) ====================================================================== commit 1c58811cb09c7877390a5afa942b3edb27fc0568 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Feb 18 15:44:20 2011 +0100 Use new format for %{..:-...} Files changed: raddb/modules/mschap | 15 ++++++++++----- 1 files changed, 10 insertions(+), 5 deletions(-) ====================================================================== commit f979c182e196ed080258a26e439e429debbc9bbe Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Feb 18 10:37:17 2011 +0100 Added radtee Shamelessly taken from http://horde.net/~jwm/software/misc/comparison-tee Files changed: scripts/radtee | 563 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 563 insertions(+), 0 deletions(-) ====================================================================== commit 65a4db60d546520e70682d97f3454fec18494451 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Feb 18 10:29:24 2011 +0100 Use newer expansion Files changed: raddb/sql/mssql/dialup.conf | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 6a7c228c3aec5c8018ac518ab39af46afd2d4a14 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Feb 18 10:25:07 2011 +0100 Basic configure scripts Files changed: src/modules/rlm_caching/config.h.in | 22 +++++++++++ src/modules/rlm_caching/configure.in | 65 ++++++++++++++++++++++++++++++++++ 2 files changed, 87 insertions(+), 0 deletions(-) ====================================================================== commit 167b6e45e73975b4998552a8b5d28daee08cf609 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Feb 18 13:20:02 2011 +0100 API fixes for 3.x Files changed: src/main/listen.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) ======================================================================

1 0

GIT Log for 2011-02-19 00:33 GMT
by aland＠deployingradius.com 19 Feb '11

19 Feb '11

commit 5c2a354afd1c63e7550d9285660626fe86db12e5 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Feb 18 10:01:11 2011 +0100 Make CoA proxying work again. Only set the reply code if it isn't meant to be proxied. Files changed: src/main/listen.c | 22 ++++++++++++++++++++++ 1 files changed, 22 insertions(+), 0 deletions(-) ====================================================================== commit bd5717797956dc2d600c614c2ee34397b21a79a2 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Feb 18 09:26:31 2011 +0100 Make query lengths match rlm_sql Closes bug #139 Files changed: src/modules/rlm_sqlippool/rlm_sqlippool.c | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-) ====================================================================== commit 8cd4c8f845f771d070763819f0b16b36cc82ae7a Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 17 12:05:54 2011 +0100 Better fixes for bug #141 Files changed: src/lib/udpfromto.c | 27 +++++++++++++++++---------- 1 files changed, 17 insertions(+), 10 deletions(-) ======================================================================

1 0

GIT Log for 2011-02-18 00:33 GMT
by aland＠deployingradius.com 18 Feb '11

18 Feb '11

commit 0478ad89036f680c247930169d5af13367a0afaf Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Feb 14 15:27:40 2011 +0100 Suppress messages if thread pool is ~full. If it's full and all threads are buys, we shouldn't try to create spare threads. Files changed: src/main/threads.c | 7 ++++++- 1 files changed, 6 insertions(+), 1 deletions(-) ====================================================================== commit ea70eb3a52a9c4577a97bc8c5cf0e6ad27cbec71 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Feb 14 15:03:48 2011 +0100 Fix typos and regenerate for 2.1.11 Files changed: configure | 200 +++++++++---------------------------------------------------- 1 files changed, 28 insertions(+), 172 deletions(-) ====================================================================== commit cd1aa6d3e3f41b14c364644ba7e8bfc9d7908e1c Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Feb 14 15:03:00 2011 +0100 Generated for 2.1.11 Files changed: src/modules/rlm_redis/configure | 4115 ++++++++++++++++++++++++++++++++++++ src/modules/rlm_rediswho/configure | 2625 +++++++++++++++++++++++ 2 files changed, 6740 insertions(+), 0 deletions(-) ====================================================================== commit 657ebf4e34f195c013caedd3e90fb92c34300770 Author: Chris Mikkelson <cmikk(a)qwest.net> Date: Tue Feb 15 15:21:28 2011 -0600 Update DHCP code to reflect valuepair API changes. Files changed: src/include/dhcp.h | 3 -- src/lib/dhcp.c | 50 ++++++++++++++++++++-------------------- src/main/dhcpd.c | 12 +++++----- src/modules/rlm_soh/rlm_soh.c | 4 +- 4 files changed, 33 insertions(+), 36 deletions(-) ====================================================================== commit b42c84d637ff4d96731ec3c6fa76384573561848 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 17 10:30:18 2011 +0100 Fix the tests Files changed: src/tests/extended.txt | 4 ++++ src/tests/wimax.txt | 6 +++--- 2 files changed, 7 insertions(+), 3 deletions(-) ====================================================================== commit 1064f4634b2bbfc73689d11b2fcc1c1764f3ed4e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 17 10:29:41 2011 +0100 Note 3.0 Files changed: VERSION | 2 +- doc/ChangeLog | 629 ++------------------------------------------------------- 2 files changed, 21 insertions(+), 610 deletions(-) ======================================================================

1 0

GIT Log for 2011-02-12 00:33 GMT
by aland＠deployingradius.com 12 Feb '11

12 Feb '11

commit 2c3235d172a95771c4fd6b1c38e8e7eeebb23a83 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Feb 11 11:12:28 2011 +0100 Ignore socket if address families don't match. Closes bug #143 Manual pull of 995b62f847b93ca217d35c1bbbbe8dcc5157635f Files changed: src/lib/packet.c | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) ====================================================================== commit 245df58b8a4728f1b28f975af71c8c1ce5750dee Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 10 16:20:39 2011 +0100 No DB handles is an error, not an informational message. Files changed: src/modules/rlm_sql/sql.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 0591d00a3d669cfa87027c4cf8f6c81a19b87ea2 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 10 16:13:59 2011 +0100 Fixed typo Files changed: src/modules/rlm_sql/rlm_sql.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 71ef09f042525be6d2544a590a5b28699c7dabc9 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 10 14:41:38 2011 +0100 Fixed onoff query Files changed: raddb/sql/oracle/dialup.conf | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ======================================================================

1 0

GIT Log for 2011-02-11 00:33 GMT
by aland＠deployingradius.com 11 Feb '11

11 Feb '11

commit 3a8266b7cfc7c139247303464d1f9f0eec91d075 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 10 13:35:52 2011 +0100 Enable udpfromto() for IPv6 On the theory that it will work, or that some magic will get it to work Files changed: src/lib/radius.c | 10 ++++------ 1 files changed, 4 insertions(+), 6 deletions(-) ====================================================================== commit aee63fee5c83875141cc016823b1fa6e564ff143 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 10 13:34:20 2011 +0100 Try to fix udpfromto for IPv6 Files changed: src/lib/udpfromto.c | 10 +++++++++- 1 files changed, 9 insertions(+), 1 deletions(-) ====================================================================== commit 6eba6adba2ce34fc5045df6f42a767ab302f72ec Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 10 10:49:03 2011 +0100 Change the rules for sending DHCP responses giaddr -> giaddr broadcast -> broadcast nak -> broadcast !ciaddr -> broadcast ciaddr -> ciaddr BUT if the request was not *from* ciaddr, we need to send a "raw" response. Many DHCP clients can handle a broadcast DHCP OFFER / ACK when first assigning an address. Some clients expect a response unicast to their MAC address. Files changed: src/lib/dhcp.c | 55 ++++++++++++++++++++++++++++++++++++------------------- 1 files changed, 36 insertions(+), 19 deletions(-) ======================================================================

1 0

GIT Log for 2011-02-10 00:33 GMT
by aland＠deployingradius.com 10 Feb '11

10 Feb '11

commit 24630899e68c8379af9e498233e5cfb077d0c9e8 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Feb 9 11:53:50 2011 +0100 Allow spaces and CRs Now that the underlying redis escape function handles spaces and control characters Files changed: src/modules/rlm_rediswho/rlm_rediswho.c | 12 +----------- 1 files changed, 1 insertions(+), 11 deletions(-) ====================================================================== commit 4ab5caf2560048fa4c6e68846a5dc84d40e155e1 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Feb 9 11:52:39 2011 +0100 Added escape function The rules for redis escaping aren't overly clear. So we escape control characters, spaces, and the backslash. Files changed: src/modules/rlm_redis/rlm_redis.c | 78 +++++++++++++++++++++++------------- 1 files changed, 50 insertions(+), 28 deletions(-) ======================================================================

1 0

GIT Log for 2011-02-09 00:33 GMT
by aland＠deployingradius.com 09 Feb '11

09 Feb '11

commit 95ee46e169cad00de0f5a9184ae7877a54e3e90d Author: Ken-ichirou MATSUZAWA <chamas(a)h4.dion.ne.jp> Date: Tue Feb 8 21:19:10 2011 +0900 fix freeing eap_handler as opaque (and typo) Hello, I hope this would be hint for fixing segfault and better solution. Thanks. Subject: [PATCH 1/2] freeing EAP opaque with one arg Files changed: src/modules/rlm_eap/eap.h | 1 + src/modules/rlm_eap/mem.c | 8 ++++++++ src/modules/rlm_eap/rlm_eap.c | 6 ++++-- src/modules/rlm_eap/rlm_eap.h | 1 + src/modules/rlm_eap/types/rlm_eap_peap/peap.c | 4 ++-- 5 files changed, 16 insertions(+), 4 deletions(-) ====================================================================== commit 6934989ee8e35916d43c6820600c337e5ccbee80 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Feb 2 10:14:01 2011 +0100 Added sample for dynamic clients from LDAP Files changed: raddb/sites-available/dynamic-clients | 39 +++++++++++++++++++++++++++++++++ 1 files changed, 39 insertions(+), 0 deletions(-) ======================================================================

1 0

Support for other hash (like MD5, SHA1) using MSCHAPv2
by Brivaldo Junior 03 Feb '11

03 Feb '11

We use OpenLDAP here, and have many users with many fields userPassword each one with one hash like, MD5, SHA1, SSHA, SMD5 and others. Using PAP, work perfect, but, we want to use MSCHAPv2 because work with simple conf (thinking on user side) on Windows, MacOSX and sometimes Linux too. I read the rlm_mschap.c and see that code use SMB (using directly the domain or the ClearText password to generate NTLM encoding or OD of Apple, right?), but I need to auth using OpenLDAP, and using this hashes (we have a idP using shibboleth with this OpenLDAP too, but not think if it is possible to use with auth purpose on FreeRadius). Exist an explanation why this isn't exist? or only because isn't implemented yet? We think to use PAP code implementation to help our modification, of course, with that kind of modification don't represent a problem for the rlm_mschap.c module. Our idea is to get ClearText decoded on MSCHAP connection (get this information) and encode using OpenSSL (same form used on PAP) to check if hashes are the same of which were obtained from OpenLDAP. Regards, -- Brivaldo Junior/DIGR/NIN

3 5