- Freeradius-Devel - lists.freeradius.org

GIT Log for 2009-12-03 00:33 GMT
by aland＠deployingradius.com 03 Dec '09

03 Dec '09

commit c9f214ce85827f112b20cfed653d4307136a706a Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Dec 2 12:16:57 2009 +0100 Use intermediate buffer for error messages. This prevents the messages from getting mangled Files changed: src/lib/dict.c | 18 +++++++++++++++--- 1 files changed, 15 insertions(+), 3 deletions(-) ====================================================================== commit 7dd6f6da22c78a0f8dffb6fcedc1aa47d7c571ae Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Dec 2 11:37:33 2009 +0100 Removed erroneous 'break' Files changed: src/main/util.c | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-) ====================================================================== commit c9d93a30f83b85746181d49a4e20b6df4d15bc6b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Dec 2 08:51:27 2009 +0100 Fixed string copying in sub variable. Apparently the only reason this worked before is that no one used it. The decode_attribute() function did the string copying itself, and therefore avoided this. Files changed: src/main/util.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) ====================================================================== commit af8e311d1c1351cf618684ac39fc798ea96f9fd5 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Dec 1 10:49:18 2009 +0100 Fixed typo Files changed: src/main/listen.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit ebeb716dbecce65e6fac7731f66257460fb57a92 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Dec 1 10:21:48 2009 +0100 Simplify use of fr_event_now Files changed: src/main/event.c | 16 +++++++++++----- 1 files changed, 11 insertions(+), 5 deletions(-) ======================================================================

1 0

Freeradius EAP authentication
by Diego Chovares Moreno 01 Dec '09

01 Dec '09

Hello everyone, I am installing a RADIUS server on a ubuntu server with freeradius. All tests are working properly except when I try to connect through an access point. This is the debug that I get: rad_recv: Access-Request packet from host 192.168.1.1 port 1084, id=1, length=206 Message-Authenticator = 0x789bf39c8f59de88701888fc6ed3a2f2 Service-Type = Framed-User User-Name = "diego\000" Framed-MTU = 1488 State = 0x734ffec0734ee45437bb08e87fc6420c Called-Station-Id = "00-15-E9-A3-01-CE:radius" Calling-Station-Id = "00-15-AF-9F-8D-E0" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020100060319 NAS-IP-Address = 192.168.1.1 NAS-Port = 1 NAS-Port-Id = "STA port # 1" +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "diego", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop expand: %{User-Name} -> diego [sql] sql_set_user escaped user --> 'diego' rlm_sql (sql): Reserving sql socket id: 3 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'diego' ORDER BY id [sql] User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'diego' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'diego' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] NAK asked for unsupported type 25 [eap] No common EAP types found. [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} expand: %{User-Name} -> diego [sql] sql_set_user escaped user --> 'diego' expand: %{User-Password} -> expand: %{Chap-Password} -> expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}[image: Silbando despreocupadamente]%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'diego', '', 'Access-Reject', '2009-11-27 17:33:06') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'diego', '', 'Access-Reject', '2009-11-27 17:33:06') rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok expand: %{User-Name} -> diego attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 1 to 192.168.1.1 port 1084 EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 0 ID 0 with timestamp +53 Waking up in 0.9 seconds. Cleaning up request 1 ID 1 with timestamp +53 Ready to process requests. I think the error occurs here: [eap] EAP NAK [eap] NAK asked for unsupported type 25 [eap] No common EAP types found. [eap] Failed in EAP select But I do not know how to fix it ... if anyone can help I would be extremely grateful, as I have tried many things, but not fix. Thanks in advance and greetings

3 2

GIT Log for 2009-12-01 00:33 GMT
by aland＠deployingradius.com 01 Dec '09

01 Dec '09

commit 31165ba2862dbc745f13e8e4359a3cf9f3e71ecd Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Nov 30 17:07:22 2009 +0100 Fix build problem Files changed: src/modules/rlm_ldap/rlm_ldap.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) ====================================================================== commit da4c7df23cc61285cca2efc3bd7922e45a2e2d32 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Nov 30 13:58:49 2009 +0100 Print out more useful debugging messages Rather than rlm_ldap: ... do [foo] ... Which prints out the instance name in a slightly better format Files changed: src/modules/rlm_ldap/rlm_ldap.c | 314 ++++++++++++++++++++------------------- 1 files changed, 164 insertions(+), 150 deletions(-) ====================================================================== commit 12db590a8c640b1aa1917560117e8adb61a9f47b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Nov 30 10:05:37 2009 +0100 Cleanups and simplifications. The FD_SET is now calculated in the event_loop() function, making it harder to get it wrong. fr_event_now() ALWAYS returns a time, calling gettimeofday() if necessary Files changed: src/lib/event.c | 47 +++++++++++++++++++++++++++++------------------ 1 files changed, 29 insertions(+), 18 deletions(-) ====================================================================== commit 73d219fa02dfd809802fd69705a239cf57993a28 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Nov 30 09:14:27 2009 +0100 Clean up "dead" child if there's no thread associated with the request Files changed: src/main/event.c | 8 +++++++- 1 files changed, 7 insertions(+), 1 deletions(-) ======================================================================

1 0

[PATCH] Fix phat fingering in rlm_ldap.c
by Alexander Clouter 30 Nov '09

30 Nov '09

Fix phat fingering in 3d63215138cbe66dc5e656fec00e836a3b0e3262 that prevented src/modules/rlm_ldap/rlm_ldap.c from compiling. Signed-off-by: Alexander Clouter <alex(a)digriz.org.uk> --- src/modules/rlm_ldap/rlm_ldap.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/modules/rlm_ldap/rlm_ldap.c b/src/modules/rlm_ldap/rlm_ldap.c index fa1416f..e7cd600 100644 --- a/src/modules/rlm_ldap/rlm_ldap.c +++ b/src/modules/rlm_ldap/rlm_ldap.c @@ -2322,9 +2322,9 @@ static LDAP *ldap_connect(void *instance, const char *dn, const char *password, if (ldap_int_tls_config(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, (inst->tls_require_cert)) != LDAP_OPT_SUCCESS) { ldap_get_option(ld, LDAP_OPT_ERROR_NUMBER, &ldap_errno); - radlog(L_ERR, " [%s] could not set ", inst->xlat_name + radlog(L_ERR, " [%s] could not set " "LDAP_OPT_X_TLS_REQUIRE_CERT option to %s: %s", - inst->tls_require_cert, + inst->xlat_name, inst->tls_require_cert, ldap_err2string(ldap_errno)); } #endif -- 1.5.6.5

2 1

GIT Log for 2009-11-30 00:33 GMT
by aland＠deployingradius.com 30 Nov '09

30 Nov '09

commit 139c45b4c51c945414b53ece36bbeb42edb1b2a7 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Nov 29 16:07:23 2009 +0100 Clean up state machine. This error happens when "max_request_time" is set VERY low. i.e. lower than "response_window". (12s versus 30s). The current logic for enforcing the various timers is pretty bad. There is one timer per request, and it bounces around between the different requirements. At the time it was written, it seemed simpler than trying to manage 3-4 simultaneous timers per request. When the request is proxied, the timer being applied is for "response_window". BUT by the time that expires, the "max_request_time" has expired. The code *does* notice that it has expired. BUT it doesn't notice that there's no child thread processing the request. So it waits for the child thread to exit... forever. At some point, a timer overflows, and it dies. There are a few changes to make: 1) check for "no child" in this situation, and clean up the request rather than waiting forever. 2) cap the timer to 5 minutes (this can still happen, for example, when a bad DB locks a thread for hours at a time). 3) don't overflow when adding timer values. src/main/event.c | 64 ++++++++++++++++++++++++----------------------------- 1 files changed, 29 insertions(+), 35 deletions(-)

1 0

GIT Log for 2009-11-28 00:33 GMT
by aland＠deployingradius.com 28 Nov '09

28 Nov '09

commit 7074e78ce2be752ed5e1cf6d6bf803851b9f6170 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Nov 27 15:58:58 2009 +0100 L_INFO, "PROXY:... --> L_PROXY, "... Simplifies and regularizes the log messages Files changed: src/main/event.c | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) ====================================================================== commit d9c1a2535a0226d07d19b3489b51b548b73b8121 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Nov 27 13:01:06 2009 +0100 Fix typo Files changed: raddb/proxy.conf | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 657d34ff7449d1a81bf72e4301d8a482019708eb Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Nov 27 12:07:25 2009 +0100 Initialize timers for Status-Server For some weird reason they weren't initialized in debugging mode, so we force it here. This WAS tested to work... so I have no idea why it stopped. We also ignore Status-Server packets when marking home_servers as alive. That way, the ping_check will work properly... Files changed: src/main/event.c | 6 +++++- 1 files changed, 5 insertions(+), 1 deletions(-) ====================================================================== commit aa458464b16c1f3d96b863e6bfacaf96fded7d23 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Nov 27 11:53:29 2009 +0100 Use new home_server_find API Files changed: src/main/event.c | 2 +- src/main/stats.c | 2 +- src/modules/frs_status/frs_status.c | 3 ++- 3 files changed, 4 insertions(+), 3 deletions(-) ====================================================================== commit 943007dc6f3fed810a3f0b06eb23a09a3d54f9c4 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Nov 27 11:47:56 2009 +0100 Add tcp/udp to CLI for home_servers Files changed: src/include/realms.h | 2 +- src/main/realms.c | 8 ++++- src/modules/frs_control/frs_control.c | 61 +++++++++++++++++++++++--------- 3 files changed, 52 insertions(+), 19 deletions(-) ======================================================================

1 0

GIT Log for 2009-11-27 00:33 GMT
by aland＠deployingradius.com 27 Nov '09

27 Nov '09

commit 208ec58bcf9f2e7969d26275bcdc6e3d366ff2ca Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Nov 26 19:10:44 2009 +0100 Remove erroneous handling of option 82 Files changed: src/modules/frs_dhcp/dhcp.c | 6 ------ 1 files changed, 0 insertions(+), 6 deletions(-) ====================================================================== commit f2323bf8826454b0fb1b433efa2353c21074b6c4 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Nov 26 18:16:00 2009 +0100 Change some DEBUG to radlog So that interesting state changes / internal events will get logged Files changed: src/main/event.c | 16 ++++++++-------- 1 files changed, 8 insertions(+), 8 deletions(-) ====================================================================== commit 103d7fb2e4c381421b22abea934776538937ccdc Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Nov 26 14:24:30 2009 +0100 Log more messages, rather than just doing debug with them Files changed: src/main/event.c | 13 +++++++------ 1 files changed, 7 insertions(+), 6 deletions(-) ======================================================================

1 0

FreeRadius + EAP-AKA support
by Kumar, Sunil 26 Nov '09

26 Nov '09

Hi, We are trying to use FreeRadius1.1.4 as authentication server for EAP-AKA implementation with our product toolkit. As per the RFC 4187 AT_RES The value field of this attribute begins with the 2-byte RES Length, which identifies the exact length of the RES in bits. The RES length is followed by the AKA RES parameter. According to [TS33.105], the length of the AKA RES can vary between 32 and 128 bits. Because the length of the AT_RES attribute must be a multiple of 4 bytes, the sender pads the RES with zero bits where necessary. In the freeradius1.1.4 implementation, for EAP-AKA the value of RES length is always considered as constant EAPSIM_RES_SIZE (16). It doesn't take care of the values other than 16 bytes. We in our toolkit needs to support all the variable length of RES values from 32 bits (4 bytes) to 128 bits (16 bytes). So I have modified the FreeRadius implementation for the same support. The intention of writing such mail is to get the information that if somebody has already noticed and fixed this issue in the latest releases, so please share that information as well. In case it's not been fixed as yet, then may be I could contribute my patch for freeradius 1.1.4 version to support all variable length RES value varying from 32 bits to 128 bits. Thanks. Warm regards. Sunil Kumar The information contained in this electronic mail transmission may be privileged and confidential, and therefore, protected from disclosure. If you have received this communication in error, please notify us immediately by replying to this message and deleting it from your computer without copying or disclosing it.

4 5

GIT Log for 2009-11-23 00:33 GMT
by aland＠deployingradius.com 23 Nov '09

23 Nov '09

commit 9eec5347f5a20ce3e726f2eb67194987cc4e7420 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Nov 22 16:56:14 2009 +0100 Print names for unsupported eap types Files changed: src/modules/rlm_eap/eap.c | 12 ++++++++++-- 1 files changed, 10 insertions(+), 2 deletions(-) ====================================================================== commit 208edab2d078a46d9fe21c3e37072375b364d24c Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Nov 22 16:47:29 2009 +0100 More warnings Modifying the values of a virtual attribute is a bad idea. Files changed: src/main/evaluate.c | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) ====================================================================== commit 10437eefa5c77bef81ee1db043d498d2bc2c2887 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Nov 22 16:35:20 2009 +0100 Check for NULL Files changed: src/modules/rlm_expr/paircmp.c | 6 +++++- 1 files changed, 5 insertions(+), 1 deletions(-) ====================================================================== commit 58f959b0e33c91a16163df0b4a0a1b1776ff8595 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Nov 22 09:26:51 2009 +0100 Fixed typo Files changed: man/man8/raddebug.8 | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 84f8a34bef9830fcf23b975605f00b98668c56bc Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Nov 22 09:18:16 2009 +0100 As posted to the list Files changed: src/modules/rlm_jradius/rlm_jradius.c | 16 ++++++++++++++++ 1 files changed, 16 insertions(+), 0 deletions(-) ====================================================================== commit 95b21f458d12a29b0f7c4e6c1ad24e4d96ca9358 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Nov 22 09:16:22 2009 +0100 Move definition so that it doesn't cause issues Use the RFC definitions for the name Files changed: share/dictionary.ascend | 1 - share/dictionary.compat | 1 + 2 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit a021a0c6df2c9a8f80138983cab53278429f6508 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Nov 22 09:12:15 2009 +0100 Revert "errormsg may be NULL" This reverts commit 45877bf44b02d418b6fb263a39e5de07ced58b6e. It doesn't fix the problem, and it seems to cause issues for other people Files changed: .../drivers/rlm_sql_postgresql/sql_postgresql.c | 3 --- 1 files changed, 0 insertions(+), 3 deletions(-) ======================================================================

1 0

segfault in presufcmp()
by Jakob Hirsch 22 Nov '09

22 Nov '09

Hi, comparing Suffix or Prefix without it being set lets the server crash (see backtrace below). This is easily reproducable with this: authorize { # also happens with Prefix if (Suffix == "blub") { } ... This happens on x86 and x64, with 2.1.7 as well as git stable. I guess there should be a check somewhere, maybe for req==NULL in presufcmp(), but I'm not sure. The obvious work around is setting these attributes (with update request) to empty strings or checking them like "if (Prefix && Prefix == ...)". Besides that, I'm surprised that there is special handling for Prefix and Suffix. I thought they are just some attributes I can use as I wish. I parse User-Name with a regex and set them accordingly with %{1} etc. > rad_recv: Access-Request packet from host 127.0.0.1 port 54511, id=178, length=67 > User-Name = "does_not_matter" > User-Password = "b" > NAS-IP-Address = 172.17.13.190 > NAS-Port = 1 > +- entering group authorize {...} > ++? if (Suffix == "blub") > > Program received signal SIGSEGV, Segmentation fault. > 0x00000035b3c7f541 in strlen () from /lib64/libc.so.6 > (gdb) bt > #0 0x00000035b3c7f541 in strlen () from /lib64/libc.so.6 > #1 0x00007ffff750b790 in presufcmp (instance=0x0, req=0x7e5a10, request=0x0, check=0x7e6120, check_pairs=0x0, reply_pairs=0x0) at paircmp.c:134 > #2 0x00000000004273a3 in radius_callback_compare (req=0x7e5a10, request=0x0, check=0x7e6120, check_pairs=0x0, reply_pairs=0x0) at valuepair.c:270 > #3 0x0000000000438260 in radius_do_cmp (request=0x7e5a10, presult=0x7fffffffc280, lt=T_BARE_WORD, pleft=0x7fffffffbe70 "Suffix", token=T_OP_CMP_EQ, rt=T_DOUBLE_QUOTED_STRING, > pright=0x7fffffffba70 "blub", cflags=0, modreturn=6) at evaluate.c:360 > #4 0x0000000000439385 in radius_evaluate_condition (request=0x7e5a10, modreturn=6, depth=1, ptr=0x7fffffffc330, evaluate_it=1, presult=0x7fffffffd360) at evaluate.c:833 > #5 0x0000000000438c61 in radius_evaluate_condition (request=0x7e5a10, modreturn=6, depth=0, ptr=0x7fffffffd810, evaluate_it=1, presult=0x7fffffffd81c) at evaluate.c:614 > #6 0x000000000041eb9d in modcall (component=1, c=0x780500, request=0x7e5a10) at modcall.c:432 > #7 0x000000000041cb89 in indexed_modcall (comp=1, idx=0, request=0x7e5a10) at modules.c:691 > #8 0x000000000041e035 in module_authorize (autz_type=0, request=0x7e5a10) at modules.c:1453 > #9 0x0000000000409421 in rad_authenticate (request=0x7e5a10) at auth.c:565 > #10 0x000000000043327e in radius_handle_request (request=0x7e5a10, fun=0x409226 <rad_authenticate>) at event.c:3693 > #11 0x00000000004258e1 in thread_pool_addrequest (request=0x7e5a10, fun=0x409226 <rad_authenticate>) at threads.c:841 > #12 0x0000000000432850 in event_socket_handler (xel=0x7df710, fd=22, ctx=0x7e57c0) at event.c:3317 > #13 0x00007ffff7df36d3 in fr_event_loop (el=0x7df710) at event.c:400 > #14 0x0000000000433189 in radius_event_process () at event.c:3679 > #15 0x00000000004223e9 in main (argc=2, argv=0x7fffffffe588) at radiusd.c:398 Regards Jakob

2 1