- Freeradius-Devel - lists.freeradius.org

Framed-IP-Address - Framed-Route filter
by Gabriel Blanchard 21 Jul '09

21 Jul '09

I'm fairly sure this functionality currently doesn't exist so I'll ask. I checked the code already for rlm_attribute_filter and it definitely doesn't do it. I'm trying to setup radius so that I can filter proxy responses with subnets that don't belong to them, right now the module only appears to support direct matches. I can't specify something like "anything within this /24 is allowed". It would probably be easier to simply code a module but that would mean repeating configuration regarding realms so it would probably make more sense if it would be part of proxy.conf. I'm thinking a configuration like below would make sense. filter filter1 { subnet "10.10.10.0/24" accept } filter filter1 { subnet "10.10.10.0/24" deny } filter_list filter_foo { filter filter1 filter filter2 } realm test.com { pool = foo filter_list = filter_foo }

1 0

GIT Log for 2009-07-17 23:33 GMT
by aland＠deployingradius.com 17 Jul '09

17 Jul '09

commit de3071dc86cf5a3957116a8eacbb7f4106c47146 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Jul 17 16:07:33 2009 +0200 suid down earlier, ensure log files have correct ownership Files changed: src/main/mainconfig.c | 95 +++++++++++++++++++++++++------------------------ 1 files changed, 48 insertions(+), 47 deletions(-) ====================================================================== commit b08e96509725a992e114e4a5f6bd6ad58733598a Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Jul 17 14:45:15 2009 +0200 Move zombie checks to later so other rules apply, too Files changed: src/main/realms.c | 23 ++++++++++++----------- 1 files changed, 12 insertions(+), 11 deletions(-) ====================================================================== commit d5e5d7c11d45e9eb663d0cad60cd49548c8a5f5d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Jul 17 14:33:23 2009 +0200 Allow requests to fail over to live servers earlier Files changed: raddb/proxy.conf | 38 +++++++++++++++++++++++++++++--------- src/include/realms.h | 1 + src/main/event.c | 24 ++++++++++++++++-------- src/main/realms.c | 21 +++++++++++++++++++++ 4 files changed, 67 insertions(+), 17 deletions(-) ======================================================================

1 0

lowercase User-Name
by Gabriel Blanchard 16 Jul '09

16 Jul '09

We just upgraded all 3 of our radius servers from 1.x to 2.x and noticed that freeradius 2.x is case sensitive for the User-Name attribute. I've searched the mailing list and found that the only "hack" available is to run a perl script as a module that lowercases the username. Yes I understand that I really shouldn't be doing this in the first place but this caught me off guard so I had to get it going with the perl script. Anyways, is there any better option? Should I just submit a patch that would allow to give the option to lowercase it like 1.x used to do? (As far as I can tell anyway). -Gabe

1 0

GIT Log for 2009-07-15 23:33 GMT
by aland＠deployingradius.com 15 Jul '09

15 Jul '09

commit 2b532cf476389348426c0c2654c3ea601b1a69db Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Jul 15 15:37:54 2009 +0200 Added wildcard to sub-dirs So that you can delete directories you don't need after configure Files changed: Makefile | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 8083ba93f4df140c492fd3759cb1e0b1c2d981a8 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Jul 15 12:04:54 2009 +0200 Fix typo Files changed: src/modules/frs_dhcp/frs_dhcp.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 23ebb8eecb275baf7f5301ce20d5d5e14c5cc2d0 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Jul 15 11:04:47 2009 +0200 Better handle variable that isn't in the module instance This kind of thing should be discouraged... Files changed: src/modules/rlm_sql/rlm_sql.c | 7 ++++++- 1 files changed, 6 insertions(+), 1 deletions(-) ======================================================================

1 0

rlm_sqlite
by Gabriel Blanchard 15 Jul '09

15 Jul '09

Just submitted bug #3 ...Did you guys have a problem with bugzilla? Anyway, added a couple little things. The db name is no longer static, can be defined using sql { sql_file = "foo123" } Code checks if the file actually exists instead of dumbly touch'ing one without any content. And added a few more error checks. Anyway. A few questions. I plan on adding a few more features in the module such as supporting the "v2" functions of sqlite. Would that be welcome? Also, how to I make radiusd fail to launch if it's unable to open the database? I'm returning -1 but it still goes ahead and launches. Gabriel Blanchard Network Administrator/Development TekSavvy Solutions Inc. 330 Richmond Street, Suite 205 Chatham, ON, N7M 1P7 T: 519-360-4705 C: 519-437-0564

3 7

sql.c
by Gabriel Blanchard 15 Jul '09

15 Jul '09

While coding the rlm_sql_sqlite module I found that even though it fails to "connect" to the database it doesn't stop Freeradius from launching. While I understand that once it's started it may need to reconnect, would it not be a good behavior to stop execution under sql_init_socketpool() ? if (!success) { radlog(L_DBG, "rlm_sql (%s): Failed to connect to any SQL server.", inst->config->xlat_name); } Why not return -1 here within this block?

2 3

possible bug on HUP (2.1.6)
by Stefan Winter 15 Jul '09

15 Jul '09

Hi, after upgrading my FreeRADIUS installation to 2.1.6, I tried SIGHUP and got a SIGSEGV back :-/ It didn't happen immediately, but only after the next auth attempt was processed. I have attached my virtual server "Monitoring" - this is the spot in the server where I changed something; the password for this User-Name was changed. Before changing that password and HUPing, auth worked consistently. I attached with gdb to find out what's wrong, the bt is at the end: it failed while xlat'ing User-Name for an sql relay. That's really surprising because I didn't change the User-Name, only the control item Cleartext-Password. Greetings, Stefan Winter ######### virtual server config server Monitoring { authorize { update request { RESTENA-Service-Type := "Nagios-Monitoring" } if ( User-Name == "testuser.monitor(a)testrealm.lu" ) { update control { Cleartext-Password := "obfuscated" <------------ this is what I changed } } auth_log # users.Nagios pap } authenticate { pap } preacct { } accounting { } session { } post-auth { reply_log sql_relay_main Post-Auth-Type REJECT { reply_log sql_relay_main } } pre-proxy { } post-proxy { } } ########### gdb session with bt Program received signal SIGHUP, Hangup. 0xb7f9a424 in __kernel_vsyscall () (gdb) c Continuing. Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0xb79d4b90 (LWP 7097)] 0xb7c48073 in strchr () from /lib/libc.so.6 (gdb) bt #0 0xb7c48073 in strchr () from /lib/libc.so.6 #1 0xb71bae13 in sql_escape_func (out=0xb79d27d0 "", outlen=3964, in=0xb79d1d34 "testuser.monitor(a)testrealm.lu") at rlm_sql_log.c:160 #2 0x08067a42 in valuepair2str (out=0xb79d27d0 "", outlen=3964, pair=0x8d0c3b8, type=0, func=0xb71bad80 <sql_escape_func>) at xlat.c:72 #3 0x08069532 in xlat_packet (instance=0x807d9a4, request=0x8d0bcb0, fmt=0xb79d2414 "User-Name", out=0xb79d27d0 "", outlen=3964, func=0xb71bad80 <sql_escape_func>) at xlat.c:383 #4 0x08068887 in radius_xlat (out=0xb79d274c "INSERT INTO radpostauth", ' ' <repeats 37 times>, "(id, user, pass, reply, date)", ' ' <repeats 30 times>, "VALUES ('', '", outlen=4096, fmt=0x8d0d568 "INSERT INTO radpostauth", ' ' <repeats 37 times>, "(id, user, pass, reply, date)", ' ' <repeats 30 times>, "VALUES ('', '%{User-Name}', '%{RESTENA-Service-Type}', '%{reply:Packet-Type}', '%"..., request=0x8d0bcb0, func=0xb71bad80 <sql_escape_func>) at xlat.c:911 #5 0xb71bac38 in sql_xlat_query (inst=0xb79d261e, request=0x8d0bcb0, query=0x8d0d568 "INSERT INTO radpostauth", ' ' <repeats 37 times>, "(id, user, pass, reply, date)", ' ' <repeats 30 times>, "VALUES ('', '%{User-Name}', '%{RESTENA-Service-Type}', '%{reply:Packet-Type}', '%"..., xlat_query=0xb79d274c "INSERT INTO radpostauth", ' ' <repeats 37 times>, "(id, user, pass, reply, date)", ' ' <repeats 30 times>, "VALUES ('', '", len=4096) at rlm_sql_log.c:258 #6 0xb71bb187 in sql_log_postauth (instance=0x8c53a40, request=0x8d0bcb0) at rlm_sql_log.c:398 #7 0x08062bd8 in modcall (component=7, c=0x8d2af90, request=0x8d0bcb0) at modcall.c:286 #8 0x0805f782 in indexed_modcall (comp=7, idx=13835320, request=0x8d0bcb0) at modules.c:631 #9 0x0805f89c in module_post_auth (postauth_type=13835320, request=0x8d0bcb0) at modules.c:1452 #10 0x0804ee17 in rad_postauth (request=0x8d0bcb0) at auth.c:410 #11 0x0806d14d in request_post_handler (request=0x8d0bcb0) at event.c:2333 #12 0x0806d5b3 in radius_handle_request (request=0x8d0bcb0, fun=0x804ee60 <rad_authenticate>) at event.c:3652 #13 0x08065760 in request_handler_thread (arg=0x8ce21d8) at threads.c:492 #14 0xb7f2f1b5 in start_thread () from /lib/libpthread.so.0 #15 0xb7ca638e in clone () from /lib/libc.so.6 (gdb) -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

2 2

rlm_sqlite and sqlite3_step(), sqlite schema
by Ben West 15 Jul '09

15 Jul '09

Apologies for posting on the freeradius-user list about this. I serendipitously happened across this list's sqlite-related thread, and the related bugzilla entry, on very same day I was playing around with sqlite on v2.1.6 myself. https://bugs.freeradius.org/bugzilla/show_bug.cgi?id=3 An issue not addressed in the patch proposed in that bug entry is that the sql_sqlite.c apparently only invokes sqlite3_step() in its function sql_fetch_row(), which AFAIK is only called for SELECT queries. This has the effect of UPDATE, DELETE, INSERT queries being compiled but never executed. Below is the kludge I did to to sql_query() to get around this, but it does not account for lower case or leading spaces in querystr. Since this happened in unwitting parallel, my version of sql_query() is out of step with the patch in bugzilla. static int sql_query(SQLSOCK * sqlsocket, SQL_CONFIG *config, char *querystr) { int status; rlm_sql_sqlite_sock *sqlite_sock = sqlsocket->conn; const char *zTail; if (config->sqltrace) radlog(L_DBG,"rlm_sql_sqlite: query: %s", querystr); if (sqlite_sock->pDb == NULL) { radlog(L_ERR, "rlm_sql_sqlite: Socket not connected"); return SQL_DOWN; } status = sqlite3_prepare(sqlite_sock->pDb, querystr, strlen(querystr), &sqlite_sock->pStmt, &zTail); radlog(L_DBG, "rlm_sql_sqlite: sqlite3_prepare() = %d\n", status); sqlite_sock->columnCount = 0; if (strstr(querystr, "SELECT") == querystr) { return (status == SQLITE_OK) ? 0 : SQL_DOWN; } /* If this is not SELECT statement, must go ahead and invoke sqlite3_step() */ else if (strstr(querystr, "INSERT") == querystr || strstr(querystr, "UPDATE") == querystr || strstr(querystr, "DELETE") == querystr ) { status = sqlite3_step(sqlite_sock->pStmt); radlog(L_DBG, "rlm_sql_sqlite: sqlite3_step = %d\n", status); return (status == SQLITE_DONE) ? 0 : SQL_DOWN; } } I also have versions of the schema and conf files for sqlite (i.e. raddb/sql/sqlite/*) but I wanted to ping the list first to make sure that is not already underway with someone else. -- Ben West westbywest(a)gmail.com

3 2

GIT Log for 2009-07-13 23:33 GMT
by aland＠deployingradius.com 13 Jul '09

13 Jul '09

commit eb0a6f2d9056916837bb76df9c6ab421d43d60c8 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Jul 13 16:23:06 2009 +0200 Allow response_window && zombie_period to be smaller. Accept values outside of the recommended range. Also when proxying, skip home servers that are marked zombie. They're not responding, so for *new* requests, we treat them like they're dead src/main/realms.c | 13 ++++++++----- 1 files changed, 8 insertions(+), 5 deletions(-)

1 0

EAP-TLS rfc 5216 support
by Fernando Pereñíguez 10 Jul '09

10 Jul '09

Dear all, I'm interested in testing last version of EAP-TLS defined in RFC 5216, that optionally supports a privacy mode where the client certificate is pushed through the SSL tunnel. Does current FreeRadius version support this version? If it does not, when it's expected to support it? Regards, Fernando.

2 1