- Freeradius-Devel - lists.freeradius.org

GIT Log for 2011-01-31 00:33 GMT
by aland＠deployingradius.com 31 Jan '11

31 Jan '11

commit a81bbfa827a2434d13af541c018255f86803b20e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Jan 29 15:44:25 2011 +0100 Fix compile warnings and check for !vp Files changed: src/main/xlat.c | 24 +++++++++++++----------- 1 files changed, 13 insertions(+), 11 deletions(-) ====================================================================== commit b4a881ebcf207dd99a18c8ec818b730ae5986548 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Jan 28 12:14:03 2011 +0100 Check return value of lseek correctly Files changed: src/modules/rlm_detail/rlm_detail.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit f25083667af81da787ff83d20bb967ef342a3138 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Jan 27 15:33:32 2011 +0100 Add %{string:...} for printable data Files changed: src/main/xlat.c | 37 ++++++++++++++++++++++++++++++++++++- 1 files changed, 36 insertions(+), 1 deletions(-) ====================================================================== commit 501f52a2333339bfbbea9c10d3338286b0a07f74 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Jan 27 15:33:17 2011 +0100 make fr_print_string return the string length Files changed: src/include/libradius.h | 2 +- src/lib/print.c | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) ======================================================================

1 0

exec patch for clear text items
by Marc Phillips 27 Jan '11

27 Jan '11

Thought this might be useful for others. This is a first run through on an exec patch. I'm sure it can be greatly improved. I've only tested it thus far on Linux, but I don't see why it wouldn't work on other unix platforms. Adds in an exec option for any text field. This is useful for me as I have policy that states I can't have any passwords in clear text on the file system. I have an exec that calls out to an encrypted database for password retrieval: Just have to change your clear text entry to: "exec:<your callout>" Just like in Apache for SSL passwords, but is good for any text field. It also keeps the logger from logging the return value: *** freeradius-server-2.1.10/src/main/conffile.c 2010-09-28 06:03:56.000000000 -0500 --- freeradius-server-2.1.10-exec/src/main/conffile.c 2011-01-27 09:26:07.000000000 -0600 *************** *** 921,927 **** if (!value) return -1; } ! cf_log_info(cs, "\t%s = \"%s\"", name, value ? value : "(null)"); *q = value ? strdup(value) : NULL; break; --- 921,951 ---- if (!value) return -1; } ! /* Add Callout for cleartext values */ ! if (strncmp(value,"exec:",5) == 0) { ! char *token; ! FILE *fileptr; ! char exec_return[1024]; ! memset (exec_return,0x00,sizeof(exec_return)); ! token = strtok(value,":"); ! token = strtok(NULL,":"); ! fileptr = popen(token, "r"); ! if (fileptr == NULL) { ! return -1; ! } ! while (fgets(exec_return, sizeof(exec_return)-1, fileptr) != NULL) { ! } ! /* Get rid of carrage return from command output */ ! exec_return[strlen(exec_return)-1]='\0'; ! if (exec_return == NULL) { ! return -1; ! } ! pclose(fileptr); ! value = strdup(&exec_return); ! cf_log_info(cs, "\t%s = \"return from (%s)\"", name, token ? token : "(null)"); ! } else { ! cf_log_info(cs, "\t%s = \"%s\"", name, value ? value : "(null)"); ! } *q = value ? strdup(value) : NULL; break;

1 0

Detection of duplicate Acct packets
by Rajkumar R 27 Jan '11

27 Jan '11

Hi, I would like to know if freeRadius supports detection of duplicate Accounting packets upon re-transmission. Could you please confirm on the handling for such packets, as RFC5080 states handling of Access packets. Appreciate all your inputs. Thanks, Raj ________________________________ "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

2 1

GIT Log for 2011-01-27 00:33 GMT
by aland＠deployingradius.com 27 Jan '11

27 Jan '11

commit c055d2840e93ee43bd8d95d1d25a01106a5d54d0 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Jan 25 17:20:54 2011 +0100 Clarify parse error for ascend attributes Printing to the same string we're reading from is a bad idea. Files changed: src/lib/valuepair.c | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) ====================================================================== commit 0b8c3ebf417312d0969f39d7c8b44a95b4855192 Author: B. Candler <b.candler(a)pobox.com> Date: Mon Jan 24 14:18:08 2011 +0100 This patch adds a 'key' parameter to rlm_fastusers, in the same way as rlm_files has. Closes bug #126 Files changed: src/modules/rlm_fastusers/rlm_fastusers.c | 32 +++++++++++++++++++++++++--- 1 files changed, 28 insertions(+), 4 deletions(-) ====================================================================== commit b0fa79c3021d6d39922039ea8b8256b2577223ab Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Jan 24 14:03:44 2011 +0100 Fixed mismatch Files changed: share/dictionary.redback | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) ======================================================================

1 0

A question of "fr_debug_flag"
by Cai Fa 25 Jan '11

25 Jan '11

Hi All, I upgraded my freeradius from 1 to 2. When do eap-tls authenticate, the radiusd crashed in debug mode. After debug the code, I found the following code which didn't appear in version 1. *int eaplist_add(rlm_eap_t *inst, EAP_HANDLER *handler) ...... if (fr_debug_flag) { check_handler_t *check = rad_malloc(sizeof(*check)); check->inst = inst; check->handler = handler; check->trips = handler->trips; request_data_add(request, inst, 0, check, check_handler); } ...... }* In function request_free, it would call "*this->free_opaque(this->opaque);*", this is actually "*check_handler*". The process crashed in "*rbtree_finddata()*". Could anyone tell me why add these code in new version?

2 1

GIT Log for 2011-01-21 00:33 GMT
by aland＠deployingradius.com 21 Jan '11

21 Jan '11

commit 4be493a755311607fed91ed5181628e8c2ec57a2 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Jan 20 16:01:17 2011 +0100 Add $(LIBRADIUS) to allow it to link Files changed: src/modules/rlm_eap/Makefile.in | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 2013912d296f37eec5a9677020dcfb9364a31878 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Jan 20 10:00:38 2011 +0100 Update ignore files Files changed: scripts/.gitignore | 1 + src/main/.gitignore | 1 + src/modules/rlm_opendirectory/.gitignore | 1 + src/modules/rlm_redis/.gitignore | 1 + src/tests/.gitignore | 3 +++ 5 files changed, 7 insertions(+), 0 deletions(-) ====================================================================== commit 45d230b2dd9ed3943bf5f80af353bee0dfa2eb5c Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Jan 20 09:52:20 2011 +0100 Use _sysconfdir instead of /etc It allows the config files to be placed anywhere, instead of a hard-coded path Files changed: suse/freeradius.spec | 102 +++++++++++++++++++++++++------------------------- 1 files changed, 51 insertions(+), 51 deletions(-) ====================================================================== commit b4b068abbe178aa1676e6c23b4d79894e1f068d4 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Jan 19 17:25:10 2011 +0100 Call write() rather than fwrite() It returns real errors... Files changed: src/modules/rlm_detail/rlm_detail.c | 62 ++++++++++++----------------------- 1 files changed, 21 insertions(+), 41 deletions(-) ====================================================================== commit 2ab2930c96c01f25354d209aee1d5c43e6fac183 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Jan 20 10:26:03 2011 +0100 Updated as per recent WiMAX specs Files changed: share/dictionary.wimax | 48 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 48 insertions(+), 0 deletions(-) ======================================================================

1 0

Request information for EAP TTLS
by Aman Arneja 19 Jan '11

19 Jan '11

> Hi > > I am new to Free Radius and was just wondering if some1 can help me out. I > am planning to implement an EAP TTLS client and was wondering the following > about Free Radius for my testing. > > 1.) Does Free Radius Implementation of EAP TTLS Support the following > > a.) Client auth during phase 1 > b.) Id privacy can be explicitly enabled or disables > c.) Allowing tunneled methods such as FAST, PEAP as inner methods > d.) Method chaining in phase 2 > > Thanx in advance for your help guys > > Aman Arneja > >

2 4

Re: IPV6_PKTINFO/recvfromto
by Alexander Clouter 16 Jan '11

16 Jan '11

Hi, Finally found the time to look into this, a clean v2.1.10 tree with the following cherry-picks: * e5c861665f00f1213036ba412b7092aac7159ad7 (contains bug) * fa0851d9235f04ff0d4161fc6f842857ff8d52aa The bug is fixed with the attached 0003-fix-recvpktinfo.patch, and then IPv6 is actually enabled with 0004-enable-ipv6.patch. For PKTINFO to work, Linux needs IPV6_RECVPKTINFO (or the legacy IPV6_2292PKTINFO) passed to setsockopt, however when you jump into sendmsg() cmsg->cmsg_type has to be IPV6_PKTINFO (or the legacy IPV6_2292PKTINFO); this is broken in the commit do to all the define/undef magic going on. I think I have sanitised it correctly. Cheers -- Alexander Clouter .sigmonster says: Have an adequate day.

2 1

why the freeradius server can't support eap-aka?
by zhangyan 14 Jan '11

14 Jan '11

hello, why the freeradius server can't support eap-aka, if because of license needed? Does anyone know which server can do eap-aka authentication? Thanks very much. BR, Yan -- View this message in context: http://freeradius.1045715.n5.nabble.com/why-the-freeradius-server-can-t-sup… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

2 2

rlm_redis module "patch"
by Gabriel Blanchard 13 Jan '11

13 Jan '11

Attached is two new modules. Apologies ahead of time for submitting this as a tgz. rlm_redis allows you to connect and query a redis key-store database. Basically same idea as memcached except the keys don't expire if you allow them to. http://redis.io/ rlm_redis requires a redis server instance and the hiredis libraries to be installed https://github.com/antirez/hiredis Preferably redis should be running version 2.2 as it allows you to expire keys. rlm_rediswho is a module that is similar to rlm_radwho, it obviously uses the rlm_redis module. What it does is that it basically "dumps" all the accounting data/sessions into this key store database. Once a user has so many sessions (defined by trim-count) rlm_radwho will start trimming out old data. If there is no update for said user for expiry-time, the redis server itself will expire the key. I anticipate the rlm_redis module could be used for something else, since it is _considerably_ faster than any sql module (about 100,000 queries per second) . But I thought that this was perfect for a radwho module as it allows you to expire stale sessions automatically, therefore the db won't grow an insane amount. Obviously this is all work in progress, but it appears to run stable. It compiles clean on my Mac but may need some configure script magic to make it a little more portable.

2 7