- Freeradius-Devel - lists.freeradius.org

autoconf uses explicit path
by Scott Neugroschl 27 Aug '10

27 Aug '10

Any autoconf wizards out there? The autoconf scripts for freeradius-client 1.1.8 put the absolute path of where it was run from into the makefiles. Example: [N1:~/freeradius]> grep scottn Makefile ACLOCAL = ${SHELL} /users/scottn/freeradius/missing --run aclocal-1.9 AMTAR = ${SHELL} /users/scottn/freeradius/missing --run tar AUTOCONF = ${SHELL} /users/scottn/freeradius/missing --run autoconf AUTOHEADER = ${SHELL} /users/scottn/freeradius/missing --run autoheader AUTOMAKE = ${SHELL} /users/scottn/freeradius/missing --run automake-1.9 MAKEINFO = ${SHELL} /users/scottn/freeradius/missing --run makeinfo install_sh = /users/scottn/freeradius/install-sh If you wish to move the freeradius-client directory tree elsewhere, you have to rerun autoconf. I am afraid that I'm not familiar enough with autoconf to correct this. Alan, if you want, I can submit this as a bug. ScottN

2 1

Problems with compiling rlm_sql_oracle module
by Dan Lark 18 Aug '10

18 Aug '10

I am desperately trying to get FR compile from the 2.1.9 source tree. In looking through the configure.in file for the rlm_sql_oracle driver from src/modules/rlm_sql/drivers/rlm_sql_oracle, it would appear that it is either looking for the 8i/9i full blown client install, or a 10g/11g full install or a specific version of the InstantClient, 10.1.0.3. (This particular InstantClient release is no longer available, btw.) So now my questions: 1. What would the best way for me to make the configure script best recognize the release of the client software that I have installed? 2. The configure.in (and therefore the configure script) are hardcoded to a specific release and architecture. In my case, I am trying to do an x86_64 build. Is there a way to make this more generic? 3. I have tried doing some stuff with the configure.in file to make it work properly with my release of the InstantClient, but running autoconf against the modified configure.in file creates a configure script with syntax errors. It would appear that the original configure script is based on autoconf 2.59, whereas the installed version that I have 2.61. Would that make a difference? 4. Based on my observations, re. the InstantClient version information, it would appear that this code is probably stale. Is this currently even being worked on? Any suggestions? -dan ______________________ Dan Lark, RHCE Systems Engineer, Hargray Communications dan.lark(a)htc.hargray.com Office: 843-706-1819 | Cell: 843-227-2263 7 Arley Way, Suite 200 (2nd Floor) P.O. Box 3380 Bluffton, SC 29910

3 7

Need to Develope Radius client with All EAP Method support on windows
by Suresh kumar 16 Aug '10

16 Aug '10

Hi, All I have to develope redius client to full fill the follwing requrment. Plz which radius client lib/stack i should use for windows. simulate Radius and dot1x type of client flows The radius tool should allow us to specify authentication type and it should support all EAP methods such as MSCHAP/V2 etc. Tool should allow us to add custom attributes to authentication request and accounting request. Tool should allow end users to specify port information. It should be able to specify retries and time out. It should be able to simulate concurrent radius clients. T

1 0

Database disconnection caused server exiting abnormal
by yangj 13 Aug '10

13 Aug '10

To:freeradius developers Hello! We met a problem as the title said. The entironment is: *Solaris 10+Oracle 10g *freeradius threads number is :100 *Database connection number is :120 We use LoadRunner to deal with the transction, With 300 transactions(authorize and accounting) per secound. the server was running normal. And then we disconnected the Freeradius Server and the Database server . LoadRunner was still working. After 20 minutes later, the Freeradius Server exit . We searched with GDB.and found that: (1)the source where caused the server exit: src/lib/event.c:fr_event_loop() ---- rcode = select(el->maxfd + 1, &read_fds, NULL, NULL, wake); if ((rcode < 0) && (errno != EINTR)) { <--rcode = -1 .errno = 22 el->dispatch = 0; return 0; } ---- (2)At the same function:fr_event_loop() Variable 'when.tv_usec' value is abnormal(ex:when.tv_usec= ). And may cause the above select() exit abnormal. But I don't know why and when the when.tv_usec is set with the abnormal value. Please help me to analyse the reason and How to fix the bug? The attachment is the radius.log and the GDB log. Thanks ---------- yangj(a)ffcs.cn

2 1

freeradius-client thread safety & memleaks patch
by Alex Massover 26 Jul '10

26 Jul '10

Hello, I want to sync changes I did to CVS. No new functionality only fixes for thread-safety and fixing memory leaks. I use this code with static (shared among threads) rc_handle and experience no segfaults and no memory leaks :) Some parts of this patch we posted before, but this one combines them all and is prepared against current CVS. Changes: freeradius-client.h: - adding rad_hostent (will be used by ip_util.c) - changing functions signatures due to changes in ip_utils.c avpair.c: - using localtime_r() instead of non-reentrant localtime() - fixing minor memory leak posted by somebody else (not me) to this mail list, but not applied yet - inet_ntoa() is not reentrant, using inet_ntop() instead - gmtime_r() instead of gmtime() buildreq.c: - rc_get_id() is now simple, fast and reentrant. config.c: - getservbyname_r() instead of getservbyname() - using rad_hostent in rc_gethostby* - fixing minor memleak - serv->secret[j] is not freed ip_util.c: - using rad_hostent instead of thread-local buffer. Thread local storage is tricky and might leak in thread per request scenario - implementation of rc_ip_hostname() is copied from freeradius server. (something is wrong with current one) - using getservbyname_r() instead of getservbyname() sendserver.c: - using new rc_ip_hostname() - using rand_r() instead of rand() -- Best Regards, Alex Massover VoIP R&D TL Jajah Inc. This mail was sent via Mail-SeCure System.

1 2

small patch pathc postgresql trigger function
by Jasen Betts 25 Jul '10

25 Jul '10

>From jasen(a)treshna.com Thu Jul 22 13:02:19 2010 Date: Thu, 22 Jul 2010 13:02:19 +1200 From: Jasen Betts <jasen(a)treshna.com> To: freeradius-devel(a)lists.freeradius.org Subject: small patch pathc postgresql trigger function Message-ID: <20100722010219.GA7516(a)treshna.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.18 (2008-05-17) Status: RO X-Status: A here's a small patch, not sure where to submit it. This version should prove faster as it halves the number of writes, however it still does a lookup. this code replaces similar code in etc/raddb/sql/postgresql/update_radacct_group_trigger.sql ---- CREATE OR REPLACE FUNCTION upd_radgroups() RETURNS trigger AS' BEGIN IF NEW.groupname IS NULL THEN NEW.groupname = groupname FROM radusergroup WHERE calledstationid = NEW.calledstationid AND username = NEW.username; END IF; RETURN NEW; END 'LANGUAGE plpgsql; DROP TRIGGER upd_radgroups ON radacct; CREATE TRIGGER upd_radgroups BEFORE INSERT ON radacct FOR EACH ROW EXECUTE PROCEDURE upd_radgroups(); ---- -- Jasen Betts treshna Enterprises Ltd

1 1

Master key and Pairwise Master Key
by Khan Ferdous Wahid 15 Jul '10

15 Jul '10

Hi, I want to know about the Master key (MK) encapsulation and Pairwise Master key (PMK) generation during EAP-TLS or EAP-TTLS methods. When the supplicant is authenticated, the server generates a MK and sends it in encrypted format to the supplicant. How this MK (I think it is a random number) is encrypted? Which algorithm is used and which parameters are included (input) to disguise the MK? Then how the PMK is generated independently inside server and supplicant? What algorithm and parameters are used to pass the PMK to authenticator (Access point)? Please tell me clearly because I am a newbie. Which source codes include these operations, where should I look? Thank you. /Khan

2 1

reject_delay
by Ben Wiechman 13 Jul '10

13 Jul '10

When an access-reject is being delayed due to the configuration of reject_delay, is the server core in any way aware of that? Problem: misbehaving clients that are not valid making many, many repeated network entry attempts in quick succession. Receiving a repeat request from the client appears to be causing a "discarding duplicate request" entry in the logs. Is there a (simple...) way to identify if a response is being delayed and update the discarding dups log entry accordingly?

3 3

HELP unsubscribe me please
by lanquan 12 Jul '10

12 Jul '10

Thank you > From: freeradius-devel-request(a)lists.freeradius.org > Subject: Freeradius-Devel Digest, Vol 63, Issue 1 > To: freeradius-devel(a)lists.freeradius.org > Date: Fri, 9 Jul 2010 12:00:15 +0200 > > Send Freeradius-Devel mailing list submissions to > freeradius-devel(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-devel > or, via email, send a message with subject or body 'help' to > freeradius-devel-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-devel-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Devel digest..." > > > Today's Topics: > > 1. sql module and radgroup... (predrag balorda) > 2. Re: RES: Patch: avpair.c - empty reply VALUE_PAIR (0x0) for > replies withunknown vendor attributes (Adam Lewis) > 3. Re: sql module and radgroup... (Alan DeKok) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 8 Jul 2010 15:12:16 +0200 > From: predrag balorda <predrag.balorda(a)gmail.com> > Subject: sql module and radgroup... > To: freeradius-devel(a)lists.freeradius.org > Message-ID: > <AANLkTilbHng3bcXjYqFjZyoQQWAEfArp-pOvngSGHtx2(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Would it be so difficult to add a "groupinfo" table? Just like you > have /etc/passwords you have /etc/groups so should you have userinfo > and radgroup or groupinfo or somesuch. > Namely, there is an awful kludge in radgroupreply in that if a a reply > with a group name exists then the group exists, otherwise it doesn't. > Now that's funny, it's the same thing as saying if there is an entry > in radcheck then the user exists, otherwise they don't. Which is > silly. Not only in my opinion but in the the opinion of all database > people out there. Referential integrity is non-existent. So is > entity-integrity. > > A simple statement like this in your sql scripts would suffice (mysql > exaple here) > > DROP TABLE IF EXISTS `groupinfo`; > CREATE TABLE `groupinfo` ( > `id` bigint(20) NOT NULL auto_increment, > `groupname` varchar(200) default NULL, > PRIMARY KEY (`id`), > KEY name (`groupname`) > ); > > Then you can draw all sorts of relations back to this table from > radgroupcheck, radgroupreply, usergroup etc. > > Try and create a radgroupreply for group "Normal", say a bandwidth > limitation of some sort. Then add another limitation but this time > make an intentional typo and put in "nOrmal" in groupname instead. > What happens? If you had referential integrity the database wouldn't > let you make such mistaks. Just like this silly gmail webmail won't > let me make mistakes and underlines them with a red squiggly line. > > I'm saying all this because I'm writing a freeradius frontend (there, > that stupid red squiggly line again) - I'll probably call it > dialUpAdmin# as I'm using NHibernate, mono, asp.net2 and it's going > nice; I'll try and submit the initial version to the cvs (or is it > svn) repository sometime next week - and silliness like this pops up > everywhere. Some simple referential and entity integrity never hurt no > one. > > I'm probably talking crap here as I'll be switching to LDAP soon > enough for all this to go away, but still. It'd be nice. > > Best regards, > > Pele > > > ------------------------------ > > Message: 2 > Date: Thu, 8 Jul 2010 07:03:23 -0700 (PDT) > From: Adam Lewis <VNQM87(a)motorola.com> > Subject: Re: RES: Patch: avpair.c - empty reply VALUE_PAIR (0x0) for > replies withunknown vendor attributes > To: freeradius-devel(a)lists.freeradius.org > Message-ID: <29107373.post(a)talk.nabble.com> > Content-Type: text/plain; charset=us-ascii > > > Just a warning to anyone using the client on an embedded platform. The local > variable "buffer" in the function rc_avpair_gen() uses 507 bytes, so if the > function has many attributes to process, 507 bytes will be added to the > stack every time the function recurses. Perhaps another reason why this > function should be re-written. > > Regards, > Adam. > > > > Alan DeKok-2 wrote: > > > > Toledo, Luis Carlos wrote: > >> How to debug the unknown attributes? Put some prints in the code or have > >> clear way to do this? > > > > The code should print out which attributes it receives. If it > > doesn't, supply a patch to fix it. > > > > Alan DeKok. > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/devel.html > > > > > > -- > View this message in context: http://old.nabble.com/Patch%3A-avpair.c---empty-reply-VALUE_PAIR-%280x0%29-… > Sent from the FreeRadius - Dev mailing list archive at Nabble.com. > > > > ------------------------------ > > Message: 3 > Date: Thu, 08 Jul 2010 16:16:54 +0200 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: sql module and radgroup... > To: FreeRadius developers mailing list > <freeradius-devel(a)lists.freeradius.org> > Message-ID: <4C35DDD6.2090009(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > predrag balorda wrote: > > Would it be so difficult to add a "groupinfo" table? Just like you > > have /etc/passwords you have /etc/groups so should you have userinfo > > and radgroup or groupinfo or somesuch. > > Namely, there is an awful kludge in radgroupreply in that if a a reply > > with a group name exists then the group exists, otherwise it doesn't. > > ? The reply is allowed to be empty. If it is empty, it has no effect > on group membership. > > > Now that's funny, it's the same thing as saying if there is an entry > > in radcheck then the user exists, otherwise they don't. Which is > > silly. Not only in my opinion but in the the opinion of all database > > people out there. Referential integrity is non-existent. So is > > entity-integrity. > > I have no idea what that means. > > > A simple statement like this in your sql scripts would suffice (mysql > > exaple here) > > > > DROP TABLE IF EXISTS `groupinfo`; > > CREATE TABLE `groupinfo` ( > > `id` bigint(20) NOT NULL auto_increment, > > `groupname` varchar(200) default NULL, > > PRIMARY KEY (`id`), > > KEY name (`groupname`) > > ); > > > > Then you can draw all sorts of relations back to this table from > > radgroupcheck, radgroupreply, usergroup etc. > > Sure. That's useful, but not required. > > I've seen 7 figure commercial solutions with *less* referential > integrity than the default FreeRADIUS schema. > > > Try and create a radgroupreply for group "Normal", say a bandwidth > > limitation of some sort. Then add another limitation but this time > > make an intentional typo and put in "nOrmal" in groupname instead. > > What happens? If you had referential integrity the database wouldn't > > let you make such mistaks. Just like this silly gmail webmail won't > > let me make mistakes and underlines them with a red squiggly line. > > You can supply a patch to the SQL schema && statements to add this > capability. The software *is* open source. > > > I'm saying all this because I'm writing a freeradius frontend (there, > > that stupid red squiggly line again) - I'll probably call it > > dialUpAdmin# as I'm using NHibernate, mono, asp.net2 and it's going > > nice; I'll try and submit the initial version to the cvs (or is it > > svn) repository sometime next week > > 'git'. > > > - and silliness like this pops up > > everywhere. Some simple referential and entity integrity never hurt no > > one. > > Sure. But it's one more requirement before people get the server up > and running. > > > I'm probably talking crap here as I'll be switching to LDAP soon > > enough for all this to go away, but still. It'd be nice. > > As always, patches are welcome. > > Alan DeKok. > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html > > > End of Freeradius-Devel Digest, Vol 63, Issue 1 > ***********************************************

2 1

sql module and radgroup...
by predrag balorda 10 Jul '10

10 Jul '10

Would it be so difficult to add a "groupinfo" table? Just like you have /etc/passwords you have /etc/groups so should you have userinfo and radgroup or groupinfo or somesuch. Namely, there is an awful kludge in radgroupreply in that if a a reply with a group name exists then the group exists, otherwise it doesn't. Now that's funny, it's the same thing as saying if there is an entry in radcheck then the user exists, otherwise they don't. Which is silly. Not only in my opinion but in the the opinion of all database people out there. Referential integrity is non-existent. So is entity-integrity. A simple statement like this in your sql scripts would suffice (mysql exaple here) DROP TABLE IF EXISTS `groupinfo`; CREATE TABLE `groupinfo` ( `id` bigint(20) NOT NULL auto_increment, `groupname` varchar(200) default NULL, PRIMARY KEY (`id`), KEY name (`groupname`) ); Then you can draw all sorts of relations back to this table from radgroupcheck, radgroupreply, usergroup etc. Try and create a radgroupreply for group "Normal", say a bandwidth limitation of some sort. Then add another limitation but this time make an intentional typo and put in "nOrmal" in groupname instead. What happens? If you had referential integrity the database wouldn't let you make such mistaks. Just like this silly gmail webmail won't let me make mistakes and underlines them with a red squiggly line. I'm saying all this because I'm writing a freeradius frontend (there, that stupid red squiggly line again) - I'll probably call it dialUpAdmin# as I'm using NHibernate, mono, asp.net2 and it's going nice; I'll try and submit the initial version to the cvs (or is it svn) repository sometime next week - and silliness like this pops up everywhere. Some simple referential and entity integrity never hurt no one. I'm probably talking crap here as I'll be switching to LDAP soon enough for all this to go away, but still. It'd be nice. Best regards, Pele

4 11