- Freeradius-Devel - lists.freeradius.org

Upgrading Free Radius Proxy functionality
by Gyanendra Kumar 14 Oct '10

14 Oct '10

Hi All: I have to enhance free-radius for Wireless domain. For this purpose I need to include SSIS (Wireless domain)..... based proxying. This functionality is to be included in Free Radius used as proxy. SSID based forwarding takes precedence over realm and default forwarding. Please give comments or pointers about how to include this functionality to enhance forwarding and to change order. Best Regards -Gyanendra

2 1

Logging Access-Request and Access-Accept Pairs
by Gyanendra Kumar 07 Oct '10

07 Oct '10

Hi List: I need to log successful access-request and access-accept radius pairs. This is 2.1.9 version of free radius. This is working as proxy and here I am logging. I have all the logging code and everything the only thing is when there is access-challenge there are multiple access-request which I want to avoid logging. Is there way using functions in packet.c or radius.c to log things only once for successfull access-request and access-accept pairs. Thanks in advance. -Gyanendra

1 0

rlm_sql/drivers/rlm_sql_mysql/sql_mysql.c
by Konstantin Chekushin 06 Oct '10

06 Oct '10

function: static int sql_check_error(int error) Why radlog uses "L_DBG", instead of "L_ERR"? For this moment, radiusd doesn't show any usefull information, if some sql_query fails, but server was started without "-x". I think, it would be better to use L_ERR in this function. Isn't it?

2 1

module-dev proglem
by westwood 04 Oct '10

04 Oct '10

I am developping a module for freeradius. but i don't know how to get VPs from radcheck or radgroupcheck Later i maybe found one in rlm_checkval.c : checkval_instantiate (...){ ............ memset(&flags, 0, sizeof(flags)); dict_addattr(data->check_name, 0, PW_TYPE_STRING, -1,flags); dattr = dict_attrbyname(data->check_name); if (!dattr){ radlog(L_ERR, "rlm_checkval: No such attribute %s", data->check_name); checkval_detach(data); return -1; } data->chk_attr = dattr->attr; DEBUG2("rlm_checkval: Registered name %s for attribute %d", dattr->name,dattr->attr); } do_checkval(...) { tmp = request->config_items; do{ if (!(chk_vp = pairfind(tmp, data->chk_attr))){ if (!found){ DEBUG2("rlm_checkval: Could not find attribute named %s in check pairs",data->check_name); ret = RLM_MODULE_NOTFOUND; } break; } } This still doesn't work when i put my-defined Attribute in radcheck for one user : No XXX defined Is there any other API for this? Thank you!

2 2

Logging pretty much all Attribute Value Pairs
by Gyanendra Kumar 30 Sep '10

30 Sep '10

Hi All: I have this requirement to log pretty much log all attribute value pairs. I put a hook in radius.c and looged few parameters that was available to me UserName, Source IP Address, Destination IP Address, NAS-IP-Address, Request-ID. I use vp_prints function to parse packet->vps, then save it and insert in DB. In normal circumstances not all attributes are used but I am going to use this list: http://www.iana.org/assignments/radius-types/radius-types.xml I will use this list to code and extract attribute value pairs and store in DB. Please let me know my assumptions are correct and also let me know if there is a better way todo things or a complete implementation is already included in FreeRadius. Thanks in advance -Gyan

2 1

xlat lower/upper
by Alexander Clouter 21 Sep '10

21 Sep '10

Hi, Another patch that Alan will no doubt neglect, others might find it useful though. This patch adds lower/uppercase xlat support so you can now do things like: ---- update request { Calling-Station-Id := "%{lower:%{Calling-Station-Id}}" } update request { Calling-Station-Id := "%{upper:%{Calling-Station-Id}}" } ---- Cheers -- Alexander Clouter .sigmonster says: Girls are better looking in snowstorms. -- Archie Goodwin --- src/main/xlat.c.orig 2010-09-20 16:10:54.000000000 +0000 +++ src/main/xlat.c 2010-09-20 16:23:41.000000000 +0000 @@ -465,6 +465,61 @@ return strlen(out); } +/* + * Lowercase a string + */ +static size_t xlat_lower(UNUSED void *instance, REQUEST *request, + char *fmt, char *out, size_t outlen, + UNUSED RADIUS_ESCAPE_STRING func) +{ + int i; + char buffer[1024]; + + if (!radius_xlat(buffer, sizeof(buffer), fmt, request, func)) { + *out = '\0'; + return 0; + } + + if (outlen < strlen(buffer)) { + snprintf(out, outlen, "lower_overflow"); + return strlen(out); + } + + for (i = 0; buffer[i] != '\0'; i++) + out[i] = tolower(buffer[i]); + + out[i] = '\0'; + + return strlen(out); +} + +/* + * Uppercase a string + */ +static size_t xlat_upper(UNUSED void *instance, REQUEST *request, + char *fmt, char *out, size_t outlen, + UNUSED RADIUS_ESCAPE_STRING func) +{ + int i; + char buffer[1024]; + + if (!radius_xlat(buffer, sizeof(buffer), fmt, request, func)) { + *out = '\0'; + return 0; + } + + if (outlen < strlen(buffer)) { + snprintf(out, outlen, "upper_overflow"); + return strlen(out); + } + + for (i = 0; buffer[i] != '\0'; i++) + out[i] = toupper(buffer[i]); + + out[i] = '\0'; + + return strlen(out); +} /* * Calculate the MD5 hash of a string. @@ -610,6 +665,16 @@ c = xlat_find("md5"); rad_assert(c != NULL); c->internal = TRUE; + + xlat_register("lower", xlat_lower, &xlat_inst[0]); + c = xlat_find("lower"); + rad_assert(c != NULL); + c->internal = TRUE; + + xlat_register("upper", xlat_upper, &xlat_inst[0]); + c = xlat_find("upper"); + rad_assert(c != NULL); + c->internal = TRUE; } /*

2 3

In Proxy Called-Station-Id based Switching to HomeServer
by Gyanendra Kumar 17 Sep '10

17 Sep '10

Hi All: I have to use FreeRadius as a proxy. This I have configured for Realm based and default switching to Radius HomeServer. Now in Wireless Access Point connectivity scenario the following implementation needs to be made. Called-Station-Id based switching to HomeServer needs to be implemented in addition to the realm based switching. I had a few questions in regards to this: 1. If the functionality can be implemented through existing functionality, please let me know ? 2. If this functionality is not there whats and easier way to go about implementing this functionality. An example of Called-Station-Id is 00-1E-4C-32-DA-2E:abssid Mac auth is a functionality which is implemented using Calling-Station-Id which is different from Called-Station-Id. Best Regards -Sunnybrad

2 1

borked rlm_mschap
by Alexander Clouter 17 Sep '10

17 Sep '10

Hi, Reverting 401dcce982f9a9972bc7bb87d5ee7e0bf3888f3a stops the following implosion: ---- libtool: compile: gcc -g -O2 -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I/usr/src/freeradius/freeradius-server/src -c rlm_mschap.c -fPIC -DPIC -o .libs/rlm_mschap.o rlm_mschap.c: In function ???mschap_detach???: rlm_mschap.c:553: warning: passing argument 1 of ???free??? discards qualifiers from pointer target type /usr/include/stdlib.h:488: note: expected ???void *??? but argument is of type ???const char *??? rlm_mschap.c: At top level: rlm_mschap.c:615: warning: no previous prototype for ???mschap_add_reply??? rlm_mschap.c: In function ???do_mschap???: rlm_mschap.c:721: error: ???REQUEST??? has no member named ???request??? make[7]: *** [rlm_mschap.lo] Error 1 ---- Cheers -- Alexander Clouter .sigmonster says: A pound of salt will not sweeten a single cup of tea.

2 1

change prompt
by Zöld 16 Sep '10

16 Sep '10

Hi! I am using CentOS 5.5 with RADIUS authentication. When I use SSH against this machine the following prompt is shown: Using username "user". user(a)192.168.1.100's password: Is there any chance to change this password prompt with the modification of pam_radius_auth.c or where can I find this prompt? Best Regards, zgabe

1 0

unlang 'check'
by Alexander Clouter 15 Sep '10

15 Sep '10

Hi, Not a show stopper, but it seems doing a comparision on 'check:...' in unlang does not work (however using 'control:...' does): ---- ldap-lanwarden if (ok) { if (check:LanWarden-Host-State != "enable") { update reply { Reply-Message := "LW: disabled" } reject } .... } ---- The above results in: ---- [ldap_lanwarden2] No default NMAS login sequence [ldap_lanwarden2] looking for check items in directory... [ldap_lanwarden2] owner -> LanWarden-Host-Owner == "cn=ac56,ou=Staff,ou=Active,ou=Accounts,o=soas" [ldap_lanwarden2] lanwardenHostAuthenticateMethod -> LanWarden-Host-Auth-Method == "none" [ldap_lanwarden2] lanwardenHostState -> LanWarden-Host-State == "enable" [ldap_lanwarden2] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap_lanwarden2] user authorized to use remote access [ldap_lanwarden2] ldap_release_conn: Release Id: 0 ++++[ldap_lanwarden2] returns ok +++- redundant-load-balance group redundant-load-balance returns ok ++- policy ldap-lanwarden returns ok ++? if (ok) ? Evaluating (ok) -> TRUE ++? if (ok) -> TRUE ++- entering if (ok) {...} +++? if (check:LanWarden-Host-State != "enable") ? Evaluating (check:LanWarden-Host-State != "enable") -> TRUE <--- WTF? +++? if (check:LanWarden-Host-State != "enable") -> TRUE +++- entering if (check:LanWarden-Host-State != "enable") {...} ++++[reply] returns ok ++++[reject] returns reject +++- if (check:LanWarden-Host-State != "enable") returns reject ++- if (ok) returns reject } # server lanwarden ---- Turns out that it is actually doing is saying the *string* "check:LanWarden-Host-State" does not compare, rather than the *variable* 'check:LanWarden-Host-State'. Replacing it with "%{check:LanWarden-Host-State}" (or 'control:LanWarden-Host-State') works around the problem however I was say that either that phrase 'looking for check items...' needs amending, or the code to be tweaked to align the behaviour of unlang to treat control/check equally. I vaguely recall that 'check' is depreated in favour 'control' however in it's current state the logic leads to madness...as I found out this morning :-/ Cheers -- Alexander Clouter .sigmonster says: Satire does not look pretty upon a tombstone.

2 3