- Freeradius-Devel - lists.freeradius.org

GIT Log for 2009-09-02 23:33 GMT
by aland＠deployingradius.com 03 Sep '09

03 Sep '09

commit 0203b5e089f88ec48089ad28ba0f7a6d27514013 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Sep 2 14:00:21 2009 +0200 Remove reference to cui.conf which isn't added yet raddb/modules/cui | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)

3 4

Adding users to group
by Tejesh Vijayakumar 02 Sep '09

02 Sep '09

Hi, How to create a group add users to a group in free radius. Have referred man rlm_passwd but without much help Regards, Tejesh Vijayakumar ______________________________________________________________________

1 0

sqlcounter return noop for your request!
by Hamid Reza Hasani 02 Sep '09

02 Sep '09

Hi, I installed freeradius-1.7.1 on fedora 8 and I used pptp as nas. Everything is worked good until we decided to define daily counter for our radius server. We defined a sqlcounter for it, but when a user log into server, the session timeout is worked nice, but no one is care about daily counter. I see these lines when I run it with -X: rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: mudule "dailycounter" returns noop for request 0 I trace the source and I found that in rlm_sqlcounter.c we have null value for request->config_items so pairfind can't work. My question is where request->config_items is filled? or whereis my problem? how I can solve it? thnaks for you help Hamid Reza Hasani -------- Ya Ali

1 0

GIT Log for 2009-09-01 23:33 GMT
by aland＠deployingradius.com 01 Sep '09

01 Sep '09

commit acf14eb2c2d477c22abf87510fd9daf5773ac049 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Sep 1 14:49:39 2009 +0200 Set DF flag for packets from the server, too Files changed: src/main/listen.c | 25 +++++++++++++++++++++++++ 1 files changed, 25 insertions(+), 0 deletions(-) ====================================================================== commit 60d78d6734cb5c0be557cfd0579a0d3434a3d3ba Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Aug 29 10:54:25 2009 +0200 Return 0 if no counter exists Files changed: raddb/sql/mysql/counter.conf | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ======================================================================

1 0

GIT Log for 2009-08-29 23:33 GMT
by aland＠deployingradius.com 29 Aug '09

29 Aug '09

commit 7f0f71b830a5d13bfe4c53890f1602f220c796cd Author: root <root(a)pclinux-ccalmb.lut.ac.uk> Date: Mon Aug 24 11:44:47 2009 +0100 Signed-off-by: root <root(a)pclinux-ccalmb.lut.ac.uk> fixed example ntlm_auth command so that it doesnt throw up unlang warning message Files changed: raddb/modules/mschap | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit f5ef5ed34396a45df642ffe35e2e4e1f3e811561 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Aug 29 10:44:54 2009 +0200 Added comments and simplified code Files changed: src/main/event.c | 17 ++++++++--------- 1 files changed, 8 insertions(+), 9 deletions(-) ======================================================================

1 0

git format-patch - fix the default example ntlm_auth command
by Alan Buxey 29 Aug '09

29 Aug '09

hi, attached patch is to stop the server throwing up unlang warnings about deprecated pattern matching etc when users are running the default ntlm_auth arguments as set by default....just a simple change to the expression alan

2 1

patch about OCI binding
by zhongwei feng 27 Aug '09

27 Aug '09

--- sql_oracle.c Thu Aug 27 18:46:35 2009 +++ sql_oracle.c.new Thu Aug 27 18:38:47 2009 @@ -29,6 +29,25 @@ #include <oci.h> #include "rlm_sql.h" +#define MAXBIND 40 +/* + * SQL WITH BIND : <SQL>\P<BIND1>\P<BIND2>.....\P<BINDn> + * BIND1 : <NAME>=<VALUE> ; the <NAME> is optional, if none, bindbyindex + * + */ +typedef struct rlm_sql_oraclesockbind { + char * ptr ; + int idx ; + char * name ; + int namelen ; + char * value ; + int vallen; + + OCIBind *bindp ; +} rlm_sql_oraclesockbind; + + + typedef struct rlm_sql_oracle_sock { OCIEnv *env; OCIError *errHandle; @@ -39,10 +58,108 @@ int id; int in_use; struct timeval tv; + + rlm_sql_oraclesockbind binds[MAXBIND]; + int bindcount; } rlm_sql_oracle_sock; #define MAX_DATASTR_LEN 64 +/************************************************************************* + * + * Function: sql_bindparse + * + * Purpose: split the sql statement for pure sql , each bind item , etc . + * + * + *************************************************************************/ + +static int sql_bindparse(SQLSOCK *sqlsocket, char * query) +{ + char * p = query ; + int count = 0 , i , k; + rlm_sql_oracle_sock *oracle_sock = sqlsocket->conn ; + oracle_sock->bindcount = 0 ; + + while ( *p ) { + switch ( *p ) { + case '\\' : + if (p[1]!='P') { + break; + } + *p = '\0'; + oracle_sock->binds[count].ptr = p+2; + count ++ ; + p ++ ; + break; + //default + } /* end of switch(*p) */ + p ++ ; + if (count>=MAXBIND) + break; + } + + for(i = 0, k = 0 ; k<count; k ++){ + if (oracle_sock->binds[k].ptr==NULL) + continue; + if (oracle_sock->binds[k].ptr[0]=='\0') + continue; + if ((p = strchr(oracle_sock->binds[k].ptr, '='))==NULL) + continue; + *p = '\0'; + oracle_sock->binds[i].value = p+1; + oracle_sock->binds[i].vallen = strlen (oracle_sock->binds[i].value); + if (p==oracle_sock->binds[k].ptr){ + oracle_sock->binds[i].name = NULL; + } else { + oracle_sock->binds[i].name = oracle_sock->binds[k].ptr; + oracle_sock->binds[i].namelen = p - oracle_sock->binds[k].ptr; + } + oracle_sock->binds[i].idx = i+1 ; + radlog(L_DBG, "bind[%d] v_p is<%s>(%d)-<%s>(%d)", i, + oracle_sock->binds[i].name,oracle_sock->binds[i].namelen, + oracle_sock->binds[i].value,oracle_sock->binds[i].vallen ); + i ++ ; continue; + } + + oracle_sock->bindcount = i ; + + return 0 ; +} + + +static int sql_ocibind(SQLSOCK *sqlsocket) +{ + int i ; + rlm_sql_oracle_sock *oracle_sock = sqlsocket->conn ; + for(i = 0;i<oracle_sock->bindcount; i++){ + if (oracle_sock->binds[i].name!=NULL){ + OCIBindByName( + oracle_sock->queryHandle, + &oracle_sock->binds[i].bindp, + oracle_sock->errHandle, + oracle_sock->binds[i].name, + oracle_sock->binds[i].namelen, + (ub1 *) oracle_sock->binds[i].value, + oracle_sock->binds[i].vallen+1, + SQLT_STR, (dvoid *) 0, (ub2 *) 0, (ub2) 0, (ub4) 0, (ub4 *) 0, + OCI_DEFAULT); + } else { + OCIBindByPos( + oracle_sock->queryHandle, + &oracle_sock->binds[i].bindp, + oracle_sock->errHandle, + oracle_sock->binds[i].idx, + (ub1 *) oracle_sock->binds[i].value, + oracle_sock->binds[i].vallen+1, + SQLT_STR, (dvoid *) 0, (ub2 *) 0, (ub2) 0, (ub4) 0, (ub4 *) 0, + OCI_DEFAULT); + } + } + + return 0; +} + /************************************************************************* * @@ -248,6 +365,8 @@ return SQL_DOWN; } + sql_bindparse(sqlsocket, querystr); + if (OCIStmtPrepare (oracle_sock->queryHandle, oracle_sock->errHandle, querystr, strlen(querystr), OCI_NTV_SYNTAX, OCI_DEFAULT)) { @@ -255,6 +374,9 @@ return -1; } + if (oracle_sock->bindcount>0) + sql_ocibind(sqlsocket); + x = OCIStmtExecute(oracle_sock->conn, oracle_sock->queryHandle, oracle_sock->errHandle, @@ -306,12 +428,17 @@ return SQL_DOWN; } + sql_bindparse(sqlsocket, querystr); + if (OCIStmtPrepare (oracle_sock->queryHandle, oracle_sock->errHandle, querystr, strlen(querystr), OCI_NTV_SYNTAX, OCI_DEFAULT)) { radlog(L_ERR,"rlm_sql_oracle: prepare failed in sql_select_query: %s",sql_error(sqlsocket, config)); return -1; } + + if (oracle_sock->bindcount>0) + sql_ocibind(sqlsocket); /* Query only one row by default (for now) */ x = OCIStmtExecute(oracle_sock->conn,

1 0

a patch for raddb/sql/oracle/schema.sql
by zhongwei feng 27 Aug '09

27 Aug '09

hi, there is a simple patch . correct index problem. --- schema.sql.orig Mon May 18 19:13:56 2009 +++ schema.sql Thu Aug 27 18:27:37 2009 @@ -39,7 +39,7 @@ XAscendSessionSvrKey VARCHAR(10) ); CREATE UNIQUE INDEX radacct_idx1 - ON radacct(acctsessionid,username,acctstarttime, + ON radacct(username,acctsessionid,acctstarttime, acctstoptime,nasipaddress,framedipaddress); CREATE SEQUENCE radacct_seq START WITH 1 INCREMENT BY 1; @@ -65,6 +65,7 @@ op VARCHAR(2) NOT NULL, value VARCHAR(40) ); +CREATE INDEX radcheck_idx1 ON radcheck(UserName); CREATE SEQUENCE radcheck_seq START WITH 1 INCREMENT BY 1; /* Trigger to emulate a serial # on the primary key */

1 0

about oracle performance improvement
by zhongwei feng 26 Aug '09

26 Aug '09

hi everyone, i use rlm_sql driver oracle , and improve that performance. my method :change the querystr schema(and also backward compatible), and use OCIBindByName/OCIBindByPos functions , about 150 lines of code /* * SQL WITH BIND : <SQL>\P<BIND1>\P<BIND2>.....\P<BINDn> * BIND1 : <NAME>=<VALUE> ; the <NAME> is optional, if none, bindbyindex * */ Comparison of dynamic sql and binding sql, performance increased by 50% or even 400% (especially in the relatively slow CPU environment) BTW:raddb/sql/oracle/schema.sql, lack an index for the RADCHECK.username anyone can contact me , get the code , and / or commit them to the FreeRadius Project?

2 1

FW: MSCHAP Authentication Issue
by Garber, Neal 26 Aug '09

26 Aug '09

I apologize for posting in the wrong list (and for posting this again - I'm doing so to allow the thread to continue on the proper list).. > I suspect that it will. The mschap module should also pass the Name > field when calling ntlm_auth, too. And maybe print a warning if the > fields are different. I constructed a test program by extracting challenge_hash from rlm_mschap.c (and all supporting functions). I then extracted the peer challenge, authenticator challenge and NT-Response from the debug output of a failed request (User-Name was all lowercase, Name field was mixed case). I called challenge_hash with the all lowercase userid (to ensure it generated the same challenge as the failed request) - the challenge was identical. I then generated another challenge with the userid from the Name field in the response. Then, I executed ntlm_auth manually with the original challenge and the new challenge. The original failed (as I expected) and, low and behold, the new challenge (created using the Name field's userid) succeeded! I will now proceed to create a patch. I was planning to do a strncasecmp to ensure the only difference between the userid part of User-Name and the userid part of the Name field is case. If there are non-case differences, do you think a RLM_REJECT is in order or do you think it should just warn and use whatever is present (I can't think of a normal case where this would occur, but if you think this is better, then I would definitely use the Name field for the username parameter too)? I was thinking of rejecting the request, in this case, so this couldn't be used to bypass authorization. Interestingly, I copied the challenge and response from a successful and failed attempt and manually called ntlm_auth varying the case of the --username parameter and it didn't affect the results. In other words, --username=MYUSER or --username=myuser or --username=MyuseR all behave the same if the --challenge and --nt-response are correct).

2 2