- Freeradius-Devel - lists.freeradius.org

[trivial PATCH 02/22] [event.c] eliminate build warnings
by Wang Tinggong 01 Feb '10

01 Feb '10

Signed-off-by: Wang Tinggong <wangtinggong(a)gmail.com> --- src/lib/event.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/lib/event.c b/src/lib/event.c index 84a928b..6f91661 100644 --- a/src/lib/event.c +++ b/src/lib/event.c @@ -322,13 +322,13 @@ int fr_event_loop(fr_event_list_t *el) el->exit = 0; el->dispatch = 1; el->changed = 1; + maxfd = 0; while (!el->exit) { /* * Cache the list of FD's to watch. */ if (el->changed) { - maxfd = 0; FD_ZERO(&master_fds); for (i = 0; i < el->max_readers; i++) { -- 1.6.0.6

1 0

git tree build error
by WANG Tinggong 01 Feb '10

01 Feb '10

hi all, i got the latest freeRadius tree from git://git.freeradius.org/freeradius-server.git , and i try to compile it under these steps: 1. ./configure 2. make after that, i encountered an error: In file included from /home/wtg/develop/freeradius-server/src/freeradius-devel/radiusd.h:154, from frs_acct.c:30: /home/wtg/develop/freeradius-server/src/freeradius-devel/smodule.h:146: error: expected specifier-qualifier-list before ‘fr_tcp_radius_t’ git-log says after commit e04b62, fr_tcp_radius_t structure and API are deleted, but it still stay in src/main/listen.c src/include/smodule.h is it a bug?

2 2

[PATCH] radiusd.h: fix error "expected specifier-qualifier-list before 'RADCLIENT' "
by Wang Tinggong 01 Feb '10

01 Feb '10

Signed-off-by: Wang Tinggong <wangtinggong(a)gmail.com> --- src/include/radiusd.h | 4 +--- 1 files changed, 1 insertions(+), 3 deletions(-) diff --git a/src/include/radiusd.h b/src/include/radiusd.h index 8ec5bbb..486cbe0 100644 --- a/src/include/radiusd.h +++ b/src/include/radiusd.h @@ -104,9 +104,6 @@ typedef struct auth_req REQUEST; typedef struct radclient_list RADCLIENT_LIST; -#include <freeradius-devel/smodule.h> - - /* * See util.c */ @@ -153,6 +150,7 @@ typedef struct radclient { #endif } RADCLIENT; +#include <freeradius-devel/smodule.h> /* * For listening on multiple IP's and ports. -- 1.6.0.6

2 2

[PATCH] event.c: eliminate warning "‘maxfd’ may be used uninitialized"
by Wang Tinggong 01 Feb '10

01 Feb '10

Signed-off-by: Wang Tinggong <wangtinggong(a)gmail.com> --- src/lib/event.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/lib/event.c b/src/lib/event.c index 84a928b..6f91661 100644 --- a/src/lib/event.c +++ b/src/lib/event.c @@ -322,13 +322,13 @@ int fr_event_loop(fr_event_list_t *el) el->exit = 0; el->dispatch = 1; el->changed = 1; + maxfd = 0; while (!el->exit) { /* * Cache the list of FD's to watch. */ if (el->changed) { - maxfd = 0; FD_ZERO(&master_fds); for (i = 0; i < el->max_readers; i++) { -- 1.6.0.6

1 0

make_passwd(), rlm_perl and double quotes in the password
by Niko Tyni 28 Jan '10

28 Jan '10

Hi, we're seeing failed logins when proxying authentication requests through to another RADIUS server if the password contains a double quote ("). I've debugged the issue a bit, and what happens is that when the password does a roundtrip through the rlm_perl module, the value pair structure ends up with extra bytes at the end so that strlen(vp->data.strvalue) > vp->length. These extra bytes are the result of escaping the double quote before entering the Perl code and then unescaping it afterwards. For instance, the password abcdef" is passed as abcdef\" to the Perl code, and afterwards it becomes abcdef"" with length 7 (so the extra byte is not supposed to hurt AIUI.) Unfortunately make_passwd() rounds 'inlen' up to a multiple of 16 before copying the input string, so the extra bytes end up in the message authenticator of the proxied request. It seems to me that the escaping and unescaping done in rlm_perl via perl_store_vps() -> vp_prints_value() -> librad_safeprint() and get_hv_content() -> pairadd_sv() -> pairmake() -> pairparsevalue() is a bit unnecessary, and that the unescaping could zero out the extra bytes, but the main bug is in make_passwd() IMO. I have reproduced this with a Debian 2.0.4 freeradius package, a Fedora 2.1.3 package, and a current git.freeradius.org checkout (commit ef2a7db5e). I'm attaching a proposed patch to make_passwd(). Please let me know if you need more information, I can easily produce stack traces and the like. Thanks for your work on FreeRADIUS, -- Niko Tyni ntyni(a)cc.helsinki.fi

3 5

[patch] pairmake_any() segfaults at conffile parse time if attr not in dictionary
by John Morrissey 23 Jan '10

23 Jan '10

When referencing non-dictionary attrs in FreeRADIUS' config ("Vendor-6969-Attr-69", for example), pairmake() calls pairmake_any(). FreeRADIUS 2.1.8's pairmake_any() assumes a non-NULL value argument, causing this segfault: #0 0x00007f2ec4c99010 in strlen () from /lib/libc.so.6 #1 0x00007f2ec5ffa495 in pairmake (attribute=<value optimized out>, value=0x0, operator=9) at valuepair.c:1358 #2 0x000000000040c8ba in cf_pairtovp (pair=0xe7d430) at conffile.c:1860 #3 0x000000000041abda in do_compile_modsingle (parent=0x0, component=2, ci=<value optimized out>, grouptype=0, modname=0x7ffff741e128) at modcall.c:1351 #4 0x0000000000418273 in load_component_section (cs=0xe7d0f0, components=0x11a5580, comp=2) at modules.c:873 #5 0x0000000000418828 in load_byserver (cs=0xe7cbd0) at modules.c:1072 #6 0x0000000000418b57 in virtual_servers_load (config=0xc71030) at modules.c:1200 #7 0x0000000000419518 in setup_modules (reload=<value optimized out>, config=0xc71030) at modules.c:1467 #8 0x0000000000417926 in read_mainconfig (reload=<value optimized out>) at mainconfig.c:914 #9 0x000000000041c1d8 in main (argc=2, argv=<value optimized out>) at radiusd.c:257 This patch modifies pairmake_any() to short-circuit in the case of a NULL value, allowing cf_pairtovp() to continue as normal, updating the type and value fields. --- src/lib/valuepair.c~ 2010-01-21 15:54:56.681161000 +0000 +++ src/lib/valuepair.c 2010-01-21 15:55:06.687350000 +0000 @@ -1355,6 +1355,12 @@ return NULL; } + vp->operator = (operator == 0) ? T_OP_EQ : operator; + + if (!value) { + return vp; + } + size = strlen(value + 2); /* @@ -1397,8 +1402,6 @@ break; } - vp->operator = (operator == 0) ? T_OP_EQ : operator; - return vp; } john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

2 1

Wichorus ASN-GW dictionary
by Ben Wiechman 23 Jan '10

23 Jan '10

Attached. Ben Wiechman Wisper High Speed Internet

2 1

ttls/gtc + perl
by Alexander Clouter 09 Jan '10

09 Jan '10

Hi, I'm slapping together a OTP system to use with FreeRADIUS and for the EAP side of things I am using GTC to get the challenge to the user and the response back. I first of all implemented everything nicely with just a straight forward non-EAP Access-Challenge approach; using rlm_perl to dish out a State attribute[1], the Reply-Message and of course to check the User-Password returned. This works great for pam_radius_auth. Then I moved onto the EAP side of things. The state of play is: TTLS -> GTC -> Perl The relevant bits of my config looks like: ---- eap gtc-trial.eap { .... gtc { challenge = "%{reply:Reply-Message}" auth_type = rfc2289 } ttls { default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = yes } .... } -- authorize { .... gtc-trial.perl gtc-trial.eap } authenticate { Auth-Type gtc-trial.eap { gtc-trial.eap } Auth-Type rfc2289 { gtc-trial.perl } } -- ---- As you can see nothing exciting. Now in the authorize section of the Perl module I wrote, when I send the Reply-Message challenge I return RLM_MODULE_HANDLED as the return code. The problem is when I do this I get: ---- ++[gtc-trial.perl] returns handled } # server gtc-trial [ttls] Got tunneled reply code 0 Reply-Message = "otp-md5 489 ch4230" [ttls] No tunneled reply was found for request 6 , and the request was not proxied: rejecting the user. [gtc-trial.eap] Handler failed in EAP/ttls rlm_eap_ttls: Freeing handler for user ac56(a)soas.ac.uk [gtc-trial.eap] Failed in EAP select ++[gtc-trial.eap] returns invalid Failed to authenticate the user. } # server gtc-trial Using Post-Auth-Type Reject ---- Changing it to RLM_MODULE_OK lets it pass through and everything starts to work, but it feels wrong; also as I would have to add difficult code paths for EAP and non-EAP connections. ---- ++[gtc-trial.perl] returns ok [gtc-trial.eap] EAP packet type response id 1 length 6 [gtc-trial.eap] No EAP Start, assuming it's an on-going EAP conversation ++[gtc-trial.eap] returns updated Found Auth-Type = gtc-trial.eap +- entering group gtc-trial.eap {...} [gtc-trial.eap] Request found, released from the list [gtc-trial.eap] EAP NAK [gtc-trial.eap] EAP-NAK asked for EAP-Type/gtc [gtc-trial.eap] processing type gtc [gtc] expand: %{reply:Reply-Message} -> otp-md5 489 ch4230 ++[gtc-trial.eap] returns handled } # server gtc-trial [ttls] Got tunneled reply code 11 Reply-Message = "otp-md5 489 ch4230" EAP-Message = 0x01020017066f74702d6d64352034383920636834323330 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2ab1156b2bb3138a6ec7c66d7216040d [ttls] Got tunneled Access-Challenge ++[gtc-trial.eap] returns handled } # server gtc-trial Sending Access-Challenge of id 57 to 77.75.106.34 port 1645 EAP-Message = 0x010a003f158000000035170301003060c61e58df7bb793b8bb0ff121a83f4c2e6709089d2806be79ba5b38f1188e918e1a23a26a5361cd919357ebf957b3b6 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x799072d07e9a671e00b9e884d1d4d75c ---- It's as if the fake-request stuff does not support RLM_MODULE_HANDLED? Of course I could be mis-understanding things completely and I should just stick with RLM_MODULE_OK...even for the non-EAP requests (however that *does* feel wrong). On a separate note I found out the hard way then passing 'State' back as a Reply attribute causes the EAP state machine to find two State attributes flying around rather than just the one it generates (am I understanding this correctly?). ---- [gtc-trial.eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request EAP-Message = 0x020100060306 FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request EAP-Message = 0x020100060306 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "ac56(a)soas.ac.uk" State = 0x72666332323839 State = 0xa044d18fa045d5754a1bb165bbc5857d [snipped] [gtc-trial.eap] EAP packet type response id 1 length 6 [gtc-trial.eap] No EAP Start, assuming it's an on-going EAP conversation ++[gtc-trial.eap] returns updated Found Auth-Type = gtc-trial.eap +- entering group gtc-trial.eap {...} [gtc-trial.eap] Either EAP-request timed out OR EAP-response to an unknown EAP-request [gtc-trial.eap] Failed in handler ++[gtc-trial.eap] returns invalid Failed to authenticate the user. } # server gtc-trial [ttls] Got tunneled reply code 3 [ttls] Got tunneled Access-Reject [gtc-trial.eap] Handler failed in EAP/ttls rlm_eap_ttls: Freeing handler for user ac56(a)soas.ac.uk [gtc-trial.eap] Failed in EAP select ++[gtc-trial.eap] returns invalid Failed to authenticate the user. } # server gtc-trial Using Post-Auth-Type Reject ---- If I am having to opt for a slightly different code path for my Perl module's authorize section (OK for EAP and HANDLED for non-EAP) is it safe to assume EAP is keeping everything in order? I am just using the State attribute to indicate that the challenge has been issued to the user and to avoid validating 'trash'; for example in the case of when using the Challenge-Response functionality found in mod_auth_radius. I see in ttls.c:process_reply() there are a number of probably relevant FIXME's on something that could be applicable? If you need any more information or the actual code, then do ask. Cheers [1] similarly to how Harry J Walsh was doing things: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg47425.… -- Alexander Clouter .sigmonster says: No line available at 300 baud.

2 2

how to catch module fail
by zhongwei feng 08 Jan '10

08 Jan '10

hi, all: I wanna catch sql module fail , therefore : site-enable/default: authorize { # # ... sql if (fail) { update reply { Session-Timeout := 300 } update control { Auth-Type := "Accept" } } # # } but debug output is : ++[unix] returns notfound ++[files] returns noop [sql] expand: %{User-Name} -> yuanlin2 [sql] sql_set_user escaped user --> 'yuanlin2' rlm_sql (sql): Trying to (re)connect unconnected handle 4.. rlm_sql (sql): Attempting to connect rlm_sql_oraclet #4 rlm_sql_oraclet: Oracle logon failed: 'ORA-12541: TNS:no listener ' rlm_sql (sql): Failed to connect DB handle #4 rlm_sql (sql): Ignoring unconnected handle 4.. rlm_sql (sql): Ignoring unconnected handle 3.. rlm_sql (sql): Ignoring unconnected handle 2.. rlm_sql (sql): Ignoring unconnected handle 1.. rlm_sql (sql): Ignoring unconnected handle 0.. rlm_sql (sql): There are no DB handles to use! skipped 5, tried to connect 1 ++[sql] returns fail Invalid user: [yuanlin2/yuanlin] (from client vmhost port 123456) Using Post-Auth-Type Reject +- entering group REJECT {...} mmmmm, why ?? ================================== there is another solution below: in authorize section : redundant { sql files } in users file : DEFAULT Auth-Type := Accept Session-Timeout := 300 ================================== but , how to catch sql module fail ?

2 1

Access-Request / Mandatory Attributes
by rsg 07 Jan '10

07 Jan '10

Hi, I find that FreeRadius server allows access even without either of the mandatory attributes i.e. NAS-Identifier or NAS-IP-Address in the Access Request packet. Is this a deviation from RFC 2865 ? " .....An Access-Request SHOULD contain a User-Name attribute. It MUST contain either a NAS-IP-Address attribute or a NAS-Identifier attribute (or both)." Can someone clarify this please? Many thanks, rsg.

2 1