- Freeradius-Devel - lists.freeradius.org

Automatic report from sources (radiusd) between 27.05.2008 - 28.05.2008 GMT
by Automatic cvs log generator 28 May '08

28 May '08

CVS log entries from 27.05.2008 (Tue) 08:00:01 - 28.05.2008 (Wed) 08:00:00 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/share/dictionary.freeradius.internal; Revisions: 1.27 ===================================================== Log entries ===================================================== Description: Added SQL-Table-Name Modified files: File: radiusd/share/dictionary.freeradius.internal; Revision: 1.27; Date: 2008/05/27 09:01:19; Author: aland; Lines: (+2 -1) ===================================================== Summary of modified files ===================================================== File: radiusd/share/dictionary.freeradius.internal Revisions: 1.27 Authors: aland (+2 -1) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 23.05.2008 - 24.05.2008 GMT
by Automatic cvs log generator 24 May '08

24 May '08

CVS log entries from 23.05.2008 (Fri) 08:00:00 - 24.05.2008 (Sat) 08:00:00 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/modules/rlm_realm/rlm_realm.c; Revisions: 1.73 ===================================================== Log entries ===================================================== Description: a LOCAL realm means we should return OK, not NOOP. Modified files: File: radiusd/src/modules/rlm_realm/rlm_realm.c; Revision: 1.73; Date: 2008/05/24 07:49:46; Author: aland; Lines: (+22 -27) ===================================================== Summary of modified files ===================================================== File: radiusd/src/modules/rlm_realm/rlm_realm.c Revisions: 1.73 Authors: aland (+22 -27) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 18.05.2008 - 19.05.2008 GMT
by Automatic cvs log generator 19 May '08

19 May '08

CVS log entries from 18.05.2008 (Sun) 08:00:00 - 19.05.2008 (Mon) 08:00:00 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/raddb/Makefile; Revisions: 1.41 ===================================================== Log entries ===================================================== Description: Delete locally changed files on "clean". From: http://git.debian.org/?p=collab-maint/freeradius.git;a=commitdiff;h=a58647f… Modified files: File: radiusd/raddb/Makefile; Revision: 1.41; Date: 2008/05/18 16:21:42; Author: aland; Lines: (+3 -1) ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/Makefile Revisions: 1.41 Authors: aland (+3 -1) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 17.05.2008 - 18.05.2008 GMT
by Automatic cvs log generator 18 May '08

18 May '08

CVS log entries from 17.05.2008 (Sat) 08:00:01 - 18.05.2008 (Sun) 08:00:00 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/main/detail.c; Revisions: 1.15 ===================================================== Log entries ===================================================== Description: Use 'detail.work" as work filename if we're globbing Modified files: File: radiusd/src/main/detail.c; Revision: 1.15; Date: 2008/05/17 08:20:51; Author: aland; Lines: (+31 -5) ===================================================== Summary of modified files ===================================================== File: radiusd/src/main/detail.c Revisions: 1.15 Authors: aland (+31 -5) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 16.05.2008 - 17.05.2008 GMT
by Automatic cvs log generator 17 May '08

17 May '08

CVS log entries from 16.05.2008 (Fri) 08:00:00 - 17.05.2008 (Sat) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/main/radiusd.c; Revisions: 1.393, 1.392 Author: dwbird File: radiusd/src/modules/rlm_jradius/rlm_jradius.c; Revisions: 1.4 File: radiusd/src/modules/rlm_jradius/Makefile; Revisions: 1.2 ===================================================== Combined list of identical log entries ===================================================== Description: - larger type and id data types to work with DHCP packets - use with jradius svn version Modified files: File: radiusd/src/modules/rlm_jradius/Makefile; Revision: 1.2; Date: 2008/05/16 09:55:29; Author: dwbird; Lines: (+1 -1) File: radiusd/src/modules/rlm_jradius/rlm_jradius.c; Revision: 1.4; Date: 2008/05/16 09:55:29; Author: dwbird; Lines: (+201 -54) ===================================================== Log entries ===================================================== Description: Note HUP Modified files: File: radiusd/src/main/radiusd.c; Revision: 1.393; Date: 2008/05/16 08:56:29; Author: aland; Lines: (+3 -2) ------------------------------- Description: Log exiting. Update a few more log messages Modified files: File: radiusd/src/main/radiusd.c; Revision: 1.392; Date: 2008/05/16 08:37:08; Author: aland; Lines: (+5 -5) ===================================================== Summary of modified files ===================================================== File: radiusd/src/main/radiusd.c Revisions: 1.393, 1.392 Authors: aland (+3 -2), aland (+5 -5) ------------------------------- File: radiusd/src/modules/rlm_jradius/Makefile Revisions: 1.2 Authors: dwbird (+1 -1) ------------------------------- File: radiusd/src/modules/rlm_jradius/rlm_jradius.c Revisions: 1.4 Authors: dwbird (+201 -54) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 15.05.2008 - 16.05.2008 GMT
by Automatic cvs log generator 16 May '08

16 May '08

CVS log entries from 15.05.2008 (Thu) 08:00:00 - 16.05.2008 (Fri) 08:00:00 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/main/mainconfig.c; Revisions: 1.151, 1.150 File: radiusd/raddb/radiusd.conf.in; Revisions: 1.274 File: radiusd/scripts/rc.radiusd.in; Revisions: 1.16 ===================================================== Log entries ===================================================== Description: Document chroot directive Modified files: File: radiusd/raddb/radiusd.conf.in; Revision: 1.274; Date: 2008/05/15 09:21:50; Author: aland; Lines: (+29 -3) ------------------------------- Description: Added examples of creating rundir && logdir, and setting correct permissions Modified files: File: radiusd/scripts/rc.radiusd.in; Revision: 1.16; Date: 2008/05/15 13:53:48; Author: aland; Lines: (+20 -0) ------------------------------- Description: Clean up log handling && chroot handling. It now uses fprintf for errors, as the log file might not exist. It also checks if the log file is writable Modified files: File: radiusd/src/main/mainconfig.c; Revision: 1.151; Date: 2008/05/15 09:07:07; Author: aland; Lines: (+69 -158) ------------------------------- Description: Moved chroot() to earlier in the configuration Modified files: File: radiusd/src/main/mainconfig.c; Revision: 1.150; Date: 2008/05/15 08:33:51; Author: aland; Lines: (+10 -8) ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/radiusd.conf.in Revisions: 1.274 Authors: aland (+29 -3) ------------------------------- File: radiusd/scripts/rc.radiusd.in Revisions: 1.16 Authors: aland (+20 -0) ------------------------------- File: radiusd/src/main/mainconfig.c Revisions: 1.151, 1.150 Authors: aland (+69 -158), aland (+10 -8) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

PATCH: expiration -> support for schacExpiryDate format
by Rok Papež 15 May '08

15 May '08

Hello! First of all I must admit that Freeradius 2.0 looks fantastic. The proxying configuration is excellent: failover/balancers, regexps, pools.... Not to mention other numerous improvements. Congratulations to developers for the excellent work :))). Back to the topic: Some of the customers in eduroam.si federation are using the schacExpiryDate LDAP field to set account expiration date. Since this date format isn't support I've added support for it. I would appreciate any comments about the patch. Details follow: ========================================================== Data specification from European SCHAC - SChema Harmonisation Committee: http://www.terena.org/activities/tf-emc2/schacreleases.html Short description of format: Values MUST be expressed Greenwich Mean Time (Zulu) and MUST include seconds (i.e., times are YYYYMMDDhhmmssZ) ========================================================== Patch for version 2.0.4 follows here: ############################### --- freeradius-server-2.0.4/src/lib/valuepair.c.schac 2008-05-15 12:56:05.000000000 +0200 +++ freeradius-server-2.0.4/src/lib/valuepair.c 2008-05-15 12:56:14.000000000 +0200 @@ -658,12 +658,33 @@ } /* + * We need mktime that can handle UTC time. + * See "man timegm" for details. + */ +static time_t mkgmtime(struct tm *tm) { + time_t ret; + char *tz; + + tz = getenv("TZ"); + setenv("TZ","",1); + tzset(); + ret = mktime(tm); + if (tz) { + setenv("TZ",tz,1); + } else { + unsetenv("TZ"); + } + tzset(); + return ret; +} + +/* * Turn printable string into time_t * Returns -1 on error, 0 on OK. */ static int gettime(const char *valstr, time_t *date) { - int i; + int i,len; time_t t; struct tm *tm, s_tm; char buf[64]; @@ -678,11 +699,37 @@ if (*tail == '\0') { return 0; } - + tm = &s_tm; memset(tm, 0, sizeof(*tm)); tm->tm_isdst = -1; /* don't know, and don't care about DST */ + /* + * Test for SCHAC date: RFC3339 Par 5.6 'full-date' with no dashes + */ + len = strlen(valstr); + if (sizeof("YYYYMMDDhhmmssZ") == len+1) { + i = sscanf(valstr, "%4d%2d%2d%2d%2d%2d%*1[zZ]", + &s_tm.tm_year, &s_tm.tm_mon, &s_tm.tm_mday, + &s_tm.tm_hour, &s_tm.tm_min, &s_tm.tm_sec); + if (6 == i) { /* all 6 elements returned or no cigar */ + /* fix to mt interpretation */ + s_tm.tm_mon -= 1; + s_tm.tm_year -= 1900; + t = mkgmtime(tm); + if (t == (time_t) -1) return -1; + *date = t; + DEBUG("Expiry date set to local time: %s", ctime(date)); + return 0; + } + } + + /* + * Let's try to parse it as a string: + * Month must be a string, year must be a 4 digit value, + * day/year/hour position is auto-detected + */ + strlcpy(buf, valstr, sizeof(buf)); p = buf; ############################### I've added to the configuration file /etc/raddb/ldap.attrmap the following: checkItem Expiration schacExpiryDate Also the rlm_expiration is being used in authorize section right after the ldap query. ========================================================== Logfile before patch: Wed May 14 15:16:01 2008 : Debug: rlm_ldap: - authorize Wed May 14 15:16:01 2008 : Debug: rlm_ldap: performing user authorization for uporabnik1 [... user found ...] Wed May 14 15:16:01 2008 : Debug: rlm_ldap: looking for check items in directory... Wed May 14 15:16:01 2008 : Error: rlm_ldap: Failed to create the pair: failed to parse time string "20080501235959Z" Wed May 14 15:16:01 2008 : Debug: rlm_ldap: looking for reply items in directory... Wed May 14 15:16:01 2008 : Debug: rlm_ldap: user uporabnik1 authorized to use remote access Wed May 14 15:16:01 2008 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 ========================================================== 1. Logfile with patch (user acc expired): Thu May 15 13:40:03 2008 : Debug: rlm_ldap: looking for check items in directory... Expiry date set to local time: Fri May 2 01:59:59 2008 Thu May 15 13:40:03 2008 : Debug: rlm_ldap: LDAP attribute schacExpiryDate as RADIUS attribute Expiration == "May 2 2008 01:59:59 CEST" Thu May 15 13:40:03 2008 : Debug: rlm_ldap: looking for reply items in directory... [...] Thu May 15 13:40:03 2008 : Debug: modsingle[authorize]: calling expiration (rlm_expiration) for request 5 Thu May 15 13:40:03 2008 : Debug: rlm_expiration: Checking Expiration time: '20080501235959Z' Thu May 15 13:40:03 2008 : Debug: rlm_expiration: Account has expired Thu May 15 13:40:03 2008 : Debug: expand: Authorization failed: Account Has Expired -> Authorization failed: Account Has Expired Thu May 15 13:40:03 2008 : Debug: modsingle[authorize]: returned from expiration (rlm_expiration) for request 5 Thu May 15 13:40:03 2008 : Debug: ++[expiration] returns userlock Thu May 15 13:40:03 2008 : Auth: Invalid user (Account has expired [Expiration 20080501235959Z]): [uporabnik1(a)domena.si/geslo1] ========================================================== 2. Logfile with patch (user acc is valid): Thu May 15 13:40:37 2008 : Debug: rlm_ldap: looking for check items in directory... Expiry date set to local time: Tue Sep 2 01:59:59 2008 Thu May 15 13:40:37 2008 : Debug: rlm_ldap: LDAP attribute schacExpiryDate as RADIUS attribute Expiration == "Sep 2 2008 01:59:59 CEST" Thu May 15 13:40:37 2008 : Debug: rlm_ldap: looking for reply items in directory... Thu May 15 13:40:37 2008 : Debug: rlm_ldap: user uporabnik1 authorized to use remote access Thu May 15 13:40:37 2008 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 [...] Thu May 15 13:40:37 2008 : Debug: modsingle[authorize]: calling expiration (rlm_expiration) for request 10 Thu May 15 13:40:37 2008 : Debug: rlm_expiration: Checking Expiration time: '20080901235959Z' Thu May 15 13:40:37 2008 : Debug: modsingle[authorize]: returned from expiration (rlm_expiration) for request 10 Thu May 15 13:40:37 2008 : Debug: ++[expiration] returns ok [...] Thu May 15 13:40:37 2008 : Debug: modsingle[post-auth]: returned from exec (rlm_exec) for request 10 Thu May 15 13:40:37 2008 : Debug: ++[exec] returns noop } # server (null) TTLS: Got tunneled reply RADIUS code 2 User-Name = "uporabnik1(a)domena.si" Session-Timeout = 9461962 Thu May 15 13:40:37 2008 : Debug: TTLS: Got tunneled Access-Accept -- Best regards, Rok Papež.

1 0

Automatic report from sources (radiusd) between 14.05.2008 - 15.05.2008 GMT
by Automatic cvs log generator 15 May '08

15 May '08

CVS log entries from 14.05.2008 (Wed) 08:00:01 - 15.05.2008 (Thu) 08:00:00 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/main/mainconfig.c; Revisions: 1.149 File: radiusd/src/include/Makefile; Revisions: 1.8 File: radiusd/raddb/Makefile; Revisions: 1.40 ===================================================== Log entries ===================================================== Description: Don't try to install sites-available/CVS/* or sites-available/*~ Modified files: File: radiusd/raddb/Makefile; Revision: 1.40; Date: 2008/05/14 14:59:35; Author: aland; Lines: (+2 -2) ------------------------------- Description: Use "install", not cp && chmod Modified files: File: radiusd/src/include/Makefile; Revision: 1.8; Date: 2008/05/14 15:26:25; Author: aland; Lines: (+4 -3) ------------------------------- Description: Do setuid/setgid earlier in the boot process. If we're debugging as a non-root user, don't do setuid/setgid Allow for chroot directive, and allow for the raddb directory to be *outside* of the chroot. Modified files: File: radiusd/src/main/mainconfig.c; Revision: 1.149; Date: 2008/05/14 13:38:12; Author: aland; Lines: (+87 -22) ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/Makefile Revisions: 1.40 Authors: aland (+2 -2) ------------------------------- File: radiusd/src/include/Makefile Revisions: 1.8 Authors: aland (+4 -3) ------------------------------- File: radiusd/src/main/mainconfig.c Revisions: 1.149 Authors: aland (+87 -22) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 13.05.2008 - 14.05.2008 GMT
by Automatic cvs log generator 14 May '08

14 May '08

CVS log entries from 13.05.2008 (Tue) 08:00:01 - 14.05.2008 (Wed) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/main/event.c; Revisions: 1.105 File: radiusd/src/main/auth.c; Revisions: 1.183, 1.182, 1.181, 1.180 File: radiusd/Makefile; Revisions: 1.60, 1.59 File: radiusd/src/main/realms.c; Revisions: 1.54, 1.53 ===================================================== Log entries ===================================================== Description: $(RUNDIR) is owned by admin/radius, too Modified files: File: radiusd/Makefile; Revision: 1.60; Date: 2008/05/13 12:39:05; Author: aland; Lines: (+3 -1) ------------------------------- Description: chmod/chown RUNDIR, too Modified files: File: radiusd/Makefile; Revision: 1.59; Date: 2008/05/13 12:31:07; Author: aland; Lines: (+7 -4) ------------------------------- Description: Initialize variable Modified files: File: radiusd/src/main/auth.c; Revision: 1.183; Date: 2008/05/14 06:52:44; Author: aland; Lines: (+3 -3) ------------------------------- Description: Removed unused code Modified files: File: radiusd/src/main/auth.c; Revision: 1.182; Date: 2008/05/14 06:39:06; Author: aland; Lines: (+2 -11) ------------------------------- Description: Don't do post-proxy-authorize Modified files: File: radiusd/src/main/auth.c; Revision: 1.181; Date: 2008/05/14 06:17:28; Author: aland; Lines: (+5 -3) ------------------------------- Description: Revert last change Modified files: File: radiusd/src/main/auth.c; Revision: 1.180; Date: 2008/05/13 12:35:03; Author: aland; Lines: (+4 -4) ------------------------------- Description: Free fake request on fallback. Move pre-proxy call to process_proxy_reply() Add proxy_fallback_handler() which handles the fallback request in a child thread. Made fail-over from one server to another check for the fallback server, and call proxy_fallback_handler() if so. Modified files: File: radiusd/src/main/event.c; Revision: 1.105; Date: 2008/05/14 06:40:46; Author: aland; Lines: (+149 -76) ------------------------------- Description: Corrected typo Modified files: File: radiusd/src/main/realms.c; Revision: 1.54; Date: 2008/05/14 03:18:25; Author: aland; Lines: (+3 -3) ------------------------------- Description: Fallback home_servers MUST be virtual_servers. Don't check home_server->state when looking for fallback servers. They're virtual, and thus always alive. Modified files: File: radiusd/src/main/realms.c; Revision: 1.53; Date: 2008/05/14 03:08:39; Author: aland; Lines: (+12 -4) ===================================================== Summary of modified files ===================================================== File: radiusd/Makefile Revisions: 1.60, 1.59 Authors: aland (+3 -1), aland (+7 -4) ------------------------------- File: radiusd/src/main/auth.c Revisions: 1.183, 1.182, 1.181, 1.180 Authors: aland (+3 -3), aland (+2 -11), aland (+5 -3), aland (+4 -4) ------------------------------- File: radiusd/src/main/event.c Revisions: 1.105 Authors: aland (+149 -76) ------------------------------- File: radiusd/src/main/realms.c Revisions: 1.54, 1.53 Authors: aland (+3 -3), aland (+12 -4) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Multiple VSA's in ldap.attrmap
by ZK Cheng 13 May '08

13 May '08

How can I implement multiple VSA's(Vender Specific Attribute) in ldap.attrmap? Basically, each Vender has their own user login privileges , but I need one ldap.attrmap to handle them all. Please provide samples. This message is confidential to Prodea Systems, Inc unless otherwise indicated or apparent from its nature. This message is directed to the intended recipient only, who may be readily determined by the sender of this message and its contents. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient:(a)any dissemination or copying of this message is strictly prohibited; and(b)immediately notify the sender by return message and destroy any copies of this message in any form(electronic, paper or otherwise) that you have.The delivery of this message and its information is neither intended to be nor constitutes a disclosure or waiver of any trade secrets, intellectual property, attorney work product, or attorney-client communications. The authority of the individual sending this message to legally bind Prodea Systems is neither apparent nor implied,and must be independently verified.

1 0