- Freeradius-Devel - lists.freeradius.org

radclient CoA and salt-encrypted attributes
by John Cahill 30 Sep '08

30 Sep '08

2 1

GIT Log for 2008-09-26 23:33 GMT
by aland＠deployingradius.com 26 Sep '08

26 Sep '08

commit a3d5dbf18bc09f053ffa8fff36d878c4ef88874e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Sep 26 14:11:23 2008 +0200 fake->server may be NULL Files changed: src/modules/rlm_eap/types/rlm_eap_peap/peap.c | 11 ++++------- src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c | 12 ++++-------- 2 files changed, 8 insertions(+), 15 deletions(-) ====================================================================== commit 41423c6907b0b317dfe794c513e67c620df57929 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Sep 26 10:40:49 2008 +0200 Fix for ${name} Files changed: debian/patches/01-radiusd-to-freeradius.dpatch | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 86edfe5a331329278fec9920ba1f2c60bff628eb Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Sep 25 15:04:56 2008 +0200 Build dictionary header files. Files changed: src/include/Makefile | 13 ------------- 1 files changed, 0 insertions(+), 13 deletions(-) ====================================================================== commit b8acc93790e9072c56181d628f38a85918b3480c Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Sep 25 15:04:39 2008 +0200 Program to convert dictionaries to header files Files changed: share/header.pl | 142 ------------------------------------------------------- 1 files changed, 0 insertions(+), 142 deletions(-) ======================================================================

1 0

GIT Log for 2008-09-25 23:33 GMT
by aland＠deployingradius.com 25 Sep '08

25 Sep '08

commit 1c8d4d4cad8a07e96c0898fcf1cda8d2f3982495 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Sep 25 10:41:26 2008 +0200 Note more changes Files changed: debian/changelog | 8 ++------ 1 files changed, 2 insertions(+), 6 deletions(-) ====================================================================== commit 913012496879fd6e98961ec310ee75ef3b8268b2 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Sep 25 10:41:13 2008 +0200 Note more changes Files changed: doc/ChangeLog | 6 +----- 1 files changed, 1 insertions(+), 5 deletions(-) ======================================================================

1 0

GIT Log for 2008-09-24 23:33 GMT
by aland＠deployingradius.com 24 Sep '08

24 Sep '08

commit c6786c12927384ead69afaa38e590aaca0300a9b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Sep 24 17:12:23 2008 +0200 Get session resumption working for EAP-TLS, too Files changed: src/modules/rlm_eap/libeap/eap_tls.c | 20 ++++++++++++-------- 1 files changed, 12 insertions(+), 8 deletions(-) ====================================================================== commit 1193e18b931d764c533bc5f5b6c5fafdf6f88fd6 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Sep 24 14:30:56 2008 +0200 Renumber MSK and EMSK to match the rest of the code Files changed: src/modules/rlm_wimax/rlm_wimax.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) ====================================================================== commit 0174889e3a03ce0336980c8c9bb63759a2f5457f Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Sep 24 14:05:54 2008 +0200 Move "unknown" client code to common area This simplifies the code (less is better), and enables us to add a central DoS method. From a quick inspection of the code, there appears to be more that can be done. Many of the receive functions have duplicate code, which should be abstracted. Files changed: src/include/radiusd.h | 2 +- src/main/dhcpd.c | 9 +++- src/main/listen.c | 122 +++++++++++++++++++++++++++++-------------------- src/main/vmps.c | 9 +++- 4 files changed, 87 insertions(+), 55 deletions(-) ====================================================================== commit 1724873150ac7f8ce662b1608fba3a03d76f2bf6 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Sep 23 16:53:24 2008 +0200 Added comments describing what to do Files changed: raddb/modules/wimax | 86 +-------------------------------------------------- 1 files changed, 1 insertions(+), 85 deletions(-) ======================================================================

1 0

Building FreeRADIUS on Debian and the RTDL_GLOBAL issue.
by Chris Moules 24 Sep '08

24 Sep '08

Hi All, I have been reading lots into this, and related libltdl issues on Debian, and trying to solve this myself. The problem is that I am not a great developer / debugger, just a Sys Admin. I know that there is 'issues' with FreeRADIUS (and other software) on Debian. However I need a working system with a number of features (SQL, SQL IP Pool and Perl). I am willing to forgo some niceties to have a working system, but I want this to be contained. I was reading through the thread "RTLD_GLOBAL and sql_ippool" from the list. I understand the issues at hand and that there is no 'current' solution to this issue. There are some work-arounds however. I opted to try and build the FreeRADIUS package with it's own libltdl library and install this as a package local library. This is, in my view, the cleanest current solution. I have modified the debian/rules file: +++ debian/rules 2008-09-24 14:21:49.000000000 +0200 @@ -68,7 +68,7 @@ --localstatedir=/var \ --with-raddbdir=$(raddbdir) \ --with-logdir=/var/log/$(package) \ - --with-system-libtool --disable-ltdl-install \ + --with-included-ltdl --enable-ltdl-install \ --with-large-files --with-udpfromto --with-edir \ --enable-developer \ --with-rlm-sql-postgresql-lib-dir=`pg_config --libdir` \ This makes the build system build and (try to) install a local libltdl. The local version has the RTDL_GLOBAL in the dlopen() call. My problem is that the build system still links all the libraries to the system libltdl.so in /usr/lib/ and not to the 'new' version in /usr/lib/freeradius For testing, I modified the sym-link /usr/lib/libltdl.so.3 (the debian linked library) to point to the new version. Doing this, FreeRADIUS would run. It is not, however, the contained solution that I wanted. I am unsure how to tell the build system to use this new library. I have done some small experiments, with no success. Here is a small extract from the build log, regarding the rlm_sql module: gcc -Wall -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I/home/src/FreeRADIUS/testing/freeradius-server-2.1.0/src -I/home/src/FreeRADIUS/testing/freeradius-server-2.1.0/libltdl -I/home/src/FreeRADIUS/testing/freeradius-server-2.1.0/libltdl -I/home/src/FreeRADIUS/testing/freeradius-server-2.1.0/src/modules/rlm_sql -c rlm_sql.c -fPIC -DPIC -o .libs/rlm_sql.o -- libtool: install: warning: relinking `rlm_sql.la' (cd /home/src/FreeRADIUS/testing/freeradius-server-2.1.0/src/modules/rlm_sql; /bin/sh /home/src/FreeRADIUS/testing/freeradius-server-2.1.0/libtool --mode=relink gcc -release 2.1.0 -module -export-dynamic -o rlm_sql.la -rpath /usr/lib/freeradius rlm_sql.lo sql.lo rlm_sql.c sql.c /home/src/FreeRADIUS/testing/freeradius-server-2.1.0/src/lib/libfreeradius-radius.la /home/src/FreeRADIUS/testing/freeradius-server-2.1.0/libltdl/libltdl.la -lnsl -lresolv -lpthread -inst-prefix-dir /home/src/FreeRADIUS/testing/freeradius-server-2.1.0/debian/tmp) gcc -shared .libs/rlm_sql.o .libs/sql.o -Wl,--rpath -Wl,/usr/lib/freeradius -L/home/src/FreeRADIUS/testing/freeradius-server-2.1.0/debian/tmp/usr/lib/freeradius -L/usr/lib/freeradius -lfreeradius-radius -lltdl -lnsl -lresolv -lpthread -Wl,-soname -Wl,rlm_sql-2.1.0.so -o .libs/rlm_sql-2.1.0.so ----------------------- Here I see that in the "libtool" line, "-L/usr/lib/freeradius" is set before the "-lltdl", as is "-Wl,--rpath -Wl,/usr/lib/freeradius". Still the outcome is: ldd /usr/lib/freeradius/rlm_sql.so linux-gate.so.1 => (0xffffe000) libfreeradius-radius-2.1.0.so => /usr/lib/freeradius/libfreeradius-radius-2.1.0.so (0xb7fcf000) libltdl.so.3 => /usr/lib/libltdl.so.3 (0xb7fbf000) libnsl.so.1 => /lib/tls/i686/cmov/libnsl.so.1 (0xb7fa9000) libresolv.so.2 => /lib/tls/i686/cmov/libresolv.so.2 (0xb7f95000) libpthread.so.0 => /lib/tls/i686/cmov/libpthread.so.0 (0xb7f83000) libc.so.6 => /lib/tls/i686/cmov/libc.so.6 (0xb7e52000) /lib/ld-linux.so.2 (0x80000000) libdl.so.2 => /lib/tls/i686/cmov/libdl.so.2 (0xb7e4e000) ----------------------- Can anyone tell me how I can get this to build against the included libltdl? If so, this could be worthy of a patch to the debian system for people who need this to work before the whole this is "fixed properly" in the words of Alan DeKok ;) Thanks Chris

2 2

change of debug/info behaviour
by A.L.M.Buxey＠lboro.ac.uk 24 Sep '08

24 Sep '08

hi, whilst playing with the dynamic-clients feature (very neat by the way -cool staff) I noted a feature of FreeRADIUS which has changed in version 2.0.x wince 2.0.0 in the old days, you'd get an error in the normal log when you had an unknown client: radlog(L_ERR, "Ignoring request from unknown client %s port %d", yada yada...; this error is STILL printed out in vmps.c and dhcpd.c but it is no longer printed out in listen.c - missing clients/erroneous clients is a top problem in the radiusd world... the error message IS printed in full debug mode - can we get it back for normal operational mode? thanks alan

2 2

GIT Log for 2008-09-23 23:33 GMT
by aland＠deployingradius.com 23 Sep '08

23 Sep '08

commit 7fdd375f09093db356be9efcb840e9068d7db257 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Sep 23 16:51:07 2008 +0200 Create MIP4 keys. Files changed: src/modules/rlm_wimax/rlm_wimax.c | 382 +------------------------------------ 1 files changed, 3 insertions(+), 379 deletions(-) ====================================================================== commit d023f9847de5e803b18a8a6cb51a3ddb720c02e9 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Sep 23 16:49:38 2008 +0200 Expose MSK and EMSK Files changed: share/dictionary.freeradius.internal | 6 ------ src/modules/rlm_eap/libeap/mppe_keys.c | 5 +---- 2 files changed, 1 insertions(+), 10 deletions(-) ====================================================================== commit 48aae1b4f09ba245db7c798a4bc5da77726b4958 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Sep 23 15:18:25 2008 +0200 More relay oddness Files changed: src/lib/dhcp.c | 12 +++++++----- 1 files changed, 7 insertions(+), 5 deletions(-) ====================================================================== commit 175c769679d66b338d9d0d6e0157a89eb100c537 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Sep 23 15:02:34 2008 +0200 Fix handling for relays. Some relays are hard-coded to send to the server port, and expect to see replies back to their IP, server port. However, they ALSO use that server port for sending packets. i.e. relay:67 -> server:67 Relays that send FROM 68, and expect replies back TO 67 are broken. Files changed: src/lib/dhcp.c | 8 +++----- 1 files changed, 3 insertions(+), 5 deletions(-) ====================================================================== commit 5da9636f88a129e4541ffbb2a519c5b09686d7a0 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Sep 23 14:33:14 2008 +0200 Sample schema && queries for WiMAX MIP keys Files changed: raddb/sql/mysql/wimax.conf | 40 ---------------------------------------- raddb/sql/mysql/wimax.sql | 16 ---------------- 2 files changed, 0 insertions(+), 56 deletions(-) ====================================================================== commit 7a53e33771e88b515a6861600db91934ed91d5c3 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Sep 23 11:04:48 2008 +0200 define DEBUG4 Files changed: src/include/radiusd.h | 1 - 1 files changed, 0 insertions(+), 1 deletions(-) ======================================================================

1 0

Re: Issue with a new module and radiusd: symbol lookup error
by Luca Adamo 23 Sep '08

23 Sep '08

..moved from freeradius-users to freeradius-devel > > I would suggest *not* re-writing the SQL module. > > Instead, look at rlm_sqlippool in git.freeradius.org. It leverages > an > existing SQL module to do additional queries. It means that you don't > have to duplicate all of the functionality of rlm_sql. And you don't > have to duplicate all of the MySQL/PostgreSQL/Oracle/etc drivers, > either. > > Plus, rlm_sqlippool.c is a *lot* easier to understand than rlm_sql. > > Alan DeKok. Hi again, my goal is to implement a module compliant with the Wimax Forum for what concerns authentication and authorization of supplicants. For this reason I needed to access the database where I store the various root-key (I mean DHCP-RK, and MIP-RK) as well as all the other keying- related items needed by the WF St.3. My module so have to interact with MySQL, and with OpenSSL (for key-gen) and operate both in postauth and in authorize (to handle request coming from unconventional NAS such as DHCP-Servers or Home Agents asking for keys). I found it simpler at the beginning to write down a new module (please note that we started our development when the current version of FreeRADIUS was 2.0.4...i.e. no rlm_wimax module was present) instead of getting one of the other working properly. I think that youìre right when you say that the code of sql_init_socketpool is missing from my module and this can also explain why it works only in postauth. In my opinion when the sql module is called (for example during authentication) it creates the symbols it needs (among them sql_init_socketpool). But if I try to call my module before sql (i.e. at the beginning of authorize) the symbols are missing and the symbol lookup error occurs. Am i right? I'll try to follow your guideline and to look at the existent modules. My schema is the default one with a bunch of tables used for WiMAX dynamic keys. I mean that the original structure is conserved and that I'm using the header file and the conf.h file to "load" the queries. Anyway if you need the schema I'll mail to you. Luca PS Pasting the sql_init_socketpool() in my module simply shift the "symbol lookup error" on the following symbol. It seems I have to paste into my module half sql.c and I don't want to do that since you're right when u say that it is pointless to rewrite sql.c.

2 2

Re: Questions about source code
by Hao Wang 23 Sep '08

23 Sep '08

Hi, I am sorry for using wrong terms. I started the job several days ago and learn many terms from Wikipedia. Let me rephrase my problem. You mentioned that the Freeradius Server use OpenSSL for encryption. The OpenSSL implements many encryption methods including AES which is a symmetric key cryptography. So there must be a key shared by both the server and the supplicant for AES to work. I would like to know where in the source code (which variable in which file) it is. I was not able to locate it. Thanks for your tolerance and help.

2 1

GIT Log for 2008-09-22 23:33 GMT
by aland＠deployingradius.com 22 Sep '08

22 Sep '08

commit b601ce71dde4c03a9baaa5dc6de39043d0eeabd0 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Sep 22 10:45:12 2008 +0200 Don't free strings parsed by the config API src/modules/rlm_attr_rewrite/rlm_attr_rewrite.c | 1 - 1 files changed, 0 insertions(+), 1 deletions(-)

1 0