- Freeradius-Devel - lists.freeradius.org

IPV6_PKTINFO/recvfromto
by Alexander Clouter 15 Dec '10

15 Dec '10

Hi, Whilst rolling out our new FreeRADIUS infrastructure I stumbled on a Linux bug where for IPv6 clients the reply source IP address from the server does not necessary match the request's destination address; as a result the client ignores the reply packet. I use OSPF to anycast our RADIUS servers and so have to bind to '::', the box as a result is obviously multi-homed too. I am guessing this is why I am seeing the bug whilst most other (in)?sane sysadmin's bind to the EUI64 address and so do not see this problem. Turns out 'struct in6_pktinfo' is a GNU extension[1] and so you need to define _GNU_SOURCE when ./configure is running otherwise you get HAVE_IN6_PKTINFO is undefined. I just gave it a whirl, config.cache shows 'yes' now for the presence of ipi6_pktinfo: ---- ac56@domokun:/usr/src/deb-src/freeradius/freeradius-2.1.10+dfsg$ grep pktinfo config.cache ac_cv_type_struct_in6_pktinfo_has_ipi6_addr=${ac_cv_type_struct_in6_pktinfo_has_ipi6_addr=yes} ac_cv_type_struct_in_pktinfo_has_ipi_addr=${ac_cv_type_struct_in_pktinfo_has_ipi_addr=yes} ---- Until I forced _GNU_SOURCE into CFLAGS I was seeing '${ac_cv_type_struct_in6_pktinfo_has_ipi6_addr=}', note the lack of a 'yes' on the end there, which would explain why things were not behaving. Once this was enabled, I noticed that someone thinks IPv6 addresses are integers, so I have provided a patch to fix that. I noticed someone has disabled udpfromto.c being used for IPv6 sockets altogether...this is also fixed in the patch :) I would provide a patch for the autoconf bit but I have no idea how to persuade autoconf to do what I want...from what I have heard I do not want to either :) Anyway, with the following, my IPv6 client support works once again, although someone with Clue(tm) probably should look over it to make sure all is well with it :) Cheers [1] http://linux.derkeiler.com/Mailing-Lists/Fedora/2009-02/msg00318.html --- freeradius-2.1.10+dfsg.orig/src/lib/udpfromto.c 2010-09-28 11:03:56.000000000 +0000 +++ freeradius-2.1.10+dfsg/src/lib/udpfromto.c 2010-12-13 19:12:40.000000000 +0000 @@ -87,7 +87,7 @@ * This should actually be standard IPv6 */ proto = IPPROTO_IPV6; - flag = IPV6_PKTINFO; + flag = IPV6_RECVPKTINFO; #endif #endif } else { @@ -172,7 +172,7 @@ return -1; } *tolen = sizeof(*dst); - *dst = *src; + memcpy(dst, src, sizeof(*dst)); #if !defined(HAVE_IN6_PKTINFO) /* @@ -240,7 +240,7 @@ (cmsg->cmsg_type == IPV6_PKTINFO)) { struct in6_pktinfo *i = (struct in6_pktinfo *) CMSG_DATA(cmsg); - ((struct sockaddr_in6 *)to)->sin6_addr = i->ipi6_addr; + memcpy(&((struct sockaddr_in6 *) to)->sin6_addr, &i->ipi6_addr, sizeof(struct in6_addr)); *tolen = sizeof(struct sockaddr_in6); break; } @@ -335,7 +335,7 @@ pkt = (struct in6_pktinfo *) CMSG_DATA(cmsg); memset(pkt, 0, sizeof(*pkt)); - pkt->ipi6_addr = s6->sin6_addr; + memcpy(&pkt->ipi6_addr, &s6->sin6_addr, sizeof(struct in6_addr)); #endif } #endif --- freeradius-2.1.10+dfsg.orig/src/lib/radius.c 2010-09-28 11:03:56.000000000 +0000 +++ freeradius-2.1.10+dfsg/src/lib/radius.c 2010-12-13 19:11:34.000000000 +0000 @@ -228,13 +228,11 @@ #ifdef WITH_UDPFROMTO /* - * Only IPv4 is supported for udpfromto. - * * And if they don't specify a source IP address, don't * use udpfromto. */ - if ((dst_ipaddr->af == AF_INET) && - (src_ipaddr->af != AF_UNSPEC)) { + if ((dst_ipaddr->af == AF_INET || dst_ipaddr->af == AF_INET6) + && (src_ipaddr->af != AF_UNSPEC)) { return sendfromto(sockfd, data, data_len, flags, (struct sockaddr *)&src, sizeof_src, (struct sockaddr *)&dst, sizeof_dst); @@ -244,7 +242,7 @@ #endif /* - * No udpfromto, OR an IPv6 socket, fail gracefully. + * No udpfromto so fail gracefully. */ return sendto(sockfd, data, data_len, flags, (struct sockaddr *) &dst, sizeof_dst); @@ -415,14 +413,14 @@ * packet after "len" bytes. */ #ifdef WITH_UDPFROMTO - if (dst.ss_family == AF_INET) { + if (dst.ss_family == AF_INET || dst.ss_family == AF_INET6) { data_len = recvfromto(sockfd, buf, len, flags, (struct sockaddr *)&src, &sizeof_src, (struct sockaddr *)&dst, &sizeof_dst); } else #endif /* - * No udpfromto, OR an IPv6 socket. Fail gracefully. + * No udpfromto so fail gracefully. */ data_len = recvfrom(sockfd, buf, len, flags, (struct sockaddr *)&src, &sizeof_src);

2 5

LDAP + 802.1x + windows
by Nabawia Khalil 07 Dec '10

07 Dec '10

Dear All, I configured my freeradius to authenticate 802.1x from the ldap server. To authenticate the windows mschap2 I have to install securew2 client. It is hard to install securew2 on all university pcs because it needs a license per PC. Is it possible to modify the freeradius configuration to convert the MSCHAP2 password to PAP before sending it to the ldap server or doing conversion from PAP to MSCHAP2 thanks Nabawia

3 2

robust-proxy-accounting issue
by Paul Sherratt 06 Dec '10

06 Dec '10

I've just installed latest fr2.1.10 stable, and testing the stock robust-proxy-accounting. It looks as if when all home servers are down, the detail file is continuously replayed over itself, causing new attributes to be appended on each poll and rapidly increasing the size of the detail log, and other obscurities like Packet-Transmit-Counter being re-set as it thinks each re-play is a new proxied packet. In rlm_detail.c:479 if (request->listener->type == RAD_LISTEN_DETAIL && strcmp(((struct detail_instance *)instance)->detailfile, ((listen_detail_t *)request->listener->data)->filename) == 0) { RDEBUG("Suppressing writes to detail file as the request was just read from a detail file."); return RLM_MODULE_NOOP; } It looks like in the example config, detail-%Y%m%d:%H is used on the detail writer, and detail-*:* is used on the detail listener, which wont match above? So short-term workaround is to just use a single detail file. Rgds Paul --8<---------------- Going to the next request Detail listener /var/log/freeradius/radacct/detail.example.com/detail-*:* state replied signalled 0 waiting 0.005643 sec Detail - unlinking /var/log/freeradius/radacct/detail.example.com/detail.work Detail listener /var/log/freeradius/radacct/detail.example.com/detail-*:* state unopened signalled 0 waiting 1.035186 sec Waking up in 1.0 seconds. Polling for detail file /var/log/freeradius/radacct/detail.example.com/detail-*:* Detail - Renaming /var/log/freeradius/radacct/detail.example.com/detail-20101203:15 -> /var/log/freeradius/radacct/detail.example.com/detail.work detail_recv: Read packet from /var/log/freeradius/radacct/detail.example.com/detail.work Acct-Status-Type = Interim-Update NAS-IP-Address = 192.0.2.1 Realm = "acct_realm.example.com" FreeRADIUS-Proxied-To = 192.0.2.20 Packet-Original-Timestamp = "Dec 3 2010 15:14:32 GMT" Acct-Delay-Time = 21 Packet-Transmit-Counter = 1 Realm = "acct_realm.example.com" FreeRADIUS-Proxied-To = 192.0.2.10 Packet-Original-Timestamp = "Dec 3 2010 15:14:39 GMT" Realm = "acct_realm.example.com" FreeRADIUS-Proxied-To = 192.0.2.10 Packet-Original-Timestamp = "Dec 3 2010 15:14:46 GMT" server home.example.com { WARNING: Empty preacct section. Using default return values. # Executing section accounting from file /etc/freeradius/sites-enabled/test +- entering group accounting {...} ++[control] returns noop } # server home.example.com server home.example.com { WARNING: Empty pre-proxy section. Using default return values. } >>> Sending proxied request internally to virtual server. server acct_detail.example.com { WARNING: Empty preacct section. Using default return values. # Executing section accounting from file /etc/freeradius/sites-enabled/test +- entering group accounting {...} [detail.example.com] expand: /var/log/freeradius/radacct/detail.example.com/detail-%Y%m%d:%H -> /var/log/freeradius/radacct/detail.example.com/detail-20101203:15 [detail.example.com] /var/log/freeradius/radacct/detail.example.com/detail-%Y%m%d:%H expands to /var/log/freeradius/radacct/detail.example.com/detail-20101203:15 [detail.example.com] expand: %t -> Fri Dec 3 15:14:56 2010 ++[detail.example.com] returns ok } # server acct_detail.example.com Going to the next request <<< Received proxied response code 5 from internal virtual server. server home.example.com { WARNING: Empty post-proxy section. Using default return values. # Executing section post-proxy from file /etc/freeradius/sites-enabled/test } server home.example.com { } # server home.example.com Finished request 5. ... Cleaning up request 7 ID 25567 with timestamp +37 Going to the next request Detail listener /var/log/freeradius/radacct/detail.example.com/detail-*:* state replied signalled 0 waiting 0.002655 sec Detail - unlinking /var/log/freeradius/radacct/detail.example.com/detail.work Detail listener /var/log/freeradius/radacct/detail.example.com/detail-*:* state unopened signalled 0 waiting 1.146660 sec Waking up in 1.1 seconds. Polling for detail file /var/log/freeradius/radacct/detail.example.com/detail-*:* Detail - Renaming /var/log/freeradius/radacct/detail.example.com/detail-20101203:15 -> /var/log/freeradius/radacct/detail.example.com/detail.work detail_recv: Read packet from /var/log/freeradius/radacct/detail.example.com/detail.work Acct-Status-Type = Interim-Update NAS-IP-Address = 192.0.2.1 Realm = "acct_realm.example.com" FreeRADIUS-Proxied-To = 192.0.2.20 Packet-Original-Timestamp = "Dec 3 2010 15:14:32 GMT" Acct-Delay-Time = 25 Packet-Transmit-Counter = 1 Realm = "acct_realm.example.com" FreeRADIUS-Proxied-To = 192.0.2.10 Packet-Original-Timestamp = "Dec 3 2010 15:14:39 GMT" Realm = "acct_realm.example.com" FreeRADIUS-Proxied-To = 192.0.2.10 Packet-Original-Timestamp = "Dec 3 2010 15:14:46 GMT" Proxy-State = 0x3239373330 Packet-Original-Timestamp = "Dec 3 2010 15:14:53 GMT" Proxy-State = 0x3237313737 Packet-Original-Timestamp = "Dec 3 2010 15:14:55 GMT" Proxy-State = 0x3235353637 Packet-Original-Timestamp = "Dec 3 2010 15:14:56 GMT"

2 2

Accounting inquiry
by Nabawia Khalil 26 Nov '10

26 Nov '10

> > I am using freeradius to authenticate my users through my LDAP. > > I'm forwarding the accounting to a central radius. > > I want to include the LDAP-Group to the accounting data. > > Do any know how to include this field in the accounting data ?? > > If any one has a similar experience to include an item (such as Class > field) > let me know, and I can try it with my LDAP-Group > > > NK >

5 12

Preferred way to submit patches
by Brian Candler 26 Nov '10

26 Nov '10

I just wanted to check, what's the preferred way to submit a patch? The only advice I could find was at http://git.freeradius.org/ where it just links to the github instructions on forking a project. So I forked it, created a branch, and created bugzilla ticket #125 with the branch in the URL field. If in future you'd rather get a pull request on github instead of a bugzilla ticket, please let me know. Thanks, Brian.

2 1

no DB handles to use
by westwood 26 Nov '10

26 Nov '10

i write a module ,but when freeradius run for a while with it enable ,"no DB handles to use" come up to me...,I don't know why and how to solve this problem (In my module ,i use the sql api in rlm_sqlippool to communicate with sql ,and release after i have use the API)

4 7

rlm_ippool slowliness
by CANTOS Sébastien 26 Nov '10

26 Nov '10

Hi All, I'm using freeradius 1.x to authenticate users using a ldap backend. I see lots of "unresponsive child" errors when getting some request load. After reading through the mailing list archive I've seen that this is typical from one module being slow. I thought it was the ldap but I've now proven that the ldap answers correctly. In fact the slowdown happens in the postauth section when rlm_ippool tries to allocate an IP. I created a /16 network pool (more than 65000 IPs) to make sure I won't miss one when I'll get lots of traffic. This is lots more than what I need. I've traced the process (truss on solaris) and noticed that the thread is spending lots of time to do something like walking over all the database. In the rlm_ippool code I can see this comment: /* * Walk through the database searching for an active=0 entry. * We search twice. Once to see if we have an active entry with the same callerid * so that MPPP can work ok and then once again to find a free entry. */ Does this means that each time we need to allocate a new IP we need to walk through the complete database 2 times ? For information, when I use rlm_ippool_tool to show active entries in the DB it takes around 12 seconds. I've also noticed that there are mutexex locking the DB each time we need to access it. Finally I conclude that each time I need to answer an auth request I'm stucked during 12 seconds. I'm missing something ? Do I need to reduce the numbers of IPs in the pool or is there some other solution ? Regards, Sebastien

2 1

ip assigning module
by Konstantin Chekushin 25 Nov '10

25 Nov '10

Good afternoon. We have developed a new module assigning IP-addresses for our users. It uses a mysql database as IP source. We cannot use default rlm_sqlippool module, because of some additional logic. Major differences between our module and rlm_sqlippool are: * available IP address space is divided into IP ranges * each user belongs to some group (data plan) * on incoming radius auth packet the module searches data plan (by username) * the module takes some IP from IP range attached to this data plan. More detailed flow diagram is attached. We are ready to adopt this module to your requirements and support it in a future. Is it possible to add it to freeradius project?

3 2

Running radiusd in background mode
by Gyanendra Kumar 23 Nov '10

23 Nov '10

Hi All: I try and run as radiusd & and it simply exits. Here is the gdb trace: root@gkumar-desktop:/home/gkumar/rp/freeradius-server-2.1.9/src/main/.libs# gdb GNU gdb (GDB) 7.1-ubuntu Copyright (C) 2010 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html > This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "i486-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>. (gdb) file radiusd Reading symbols from /home/gkumar/rp/freeradius-server-2.1.9/src/main/.libs/radiusd...done. (gdb) run Starting program: /home/gkumar/rp/freeradius-server-2.1.9/src/main/.libs/radiusd [Thread debugging using libthread_db enabled] Program exited normally. (gdb) bt No stack. (gdb) Best Regards -Gyan

2 1

freeradius-server-2.1.10 compiles on HP-UX 11.31 with errors.
by Giampiero Torrielli 23 Nov '10

23 Nov '10

Hi all, I compiled and installed freeradius (freeradius-server-2.1.10) on a HPUX 11.31 Itanium V3 system, but I had to make some little code and makefile modifications. I would like to tell you these changes In the file : freeradius-server-2.1.10/src/modules/rlm_eap/rlm_eap.c in the new function static int eap_handler_ptr_cmp, the HP CC compiler gives an error on the returning value type. diff: line 111 < return (a - b); --- > return ((int)a - (int)b); In the file : freeradius-server-2.1.10/raddb/Makefile the HP ln command, don't understand the command line format. a '.' should be add to the end of command lines diffs: 26c26 < cd sites-enabled && ln -s ../sites-available/default; \ --- > cd sites-enabled && ln -s ../sites-available/default .; \ 29c29 < cd sites-enabled && ln -s ../sites-available/inner-tunnel; \ --- > cd sites-enabled && ln -s ../sites-available/inner-tunnel .; \ 78c78 < ln -s ../sites-available/default; \ --- > ln -s ../sites-available/default .; \ 82c82 < ln -s ../sites-available/inner-tunnel; \ --- > ln -s ../sites-available/inner-tunnel .; \ 86c86 < ln -s ../sites-available/control-socket; \ --- > ln -s ../sites-available/control-socket .; \ Best regards, GIampiero.

3 4