- Freeradius-Devel - lists.freeradius.org

Debian Dependencies - CVS Head
by Humberto Diogenes 03 Sep '07

03 Sep '07

Hi, guys! Yesterday, I tried to compile the latest FreeRadius (cvs head) on Sarge and got this: dpkg-buildpackage: source package is freeradius dpkg-buildpackage: source version is 2.0.0-pre2 dpkg-buildpackage: source maintainer is Nicolas Baradakis <nbk(a)sitadelle.com> dpkg-buildpackage: host architecture is i386 dpkg-checkbuilddeps: Unmet build dependencies: debhelper (>= 5) dpkg- dev (>= 1.13.25) dpkg-buildpackage: Build dependencies/conflicts unsatisfied; aborting. dpkg-buildpackage: (Use -d flag to override.) I should note that 2.0pre0 worked fine, and trying with -d didn't work. I thought: OK, tomorrow I install on a new machine. Got one with Ubuntu Server LTS, and then... got the same error. This time the error was only with dpkg-dev (Ubuntu comes with 1.13.11), but anyway, does it really need those versions? What do I have to use to compile it without errors? P.S.: I ended up commenting the dependency and it (seems to have) worked. -- Humberto Diógenes http://humberto.digi.com.br

3 6

upgrade path for distributions
by Stephen Gran 03 Sep '07

03 Sep '07

Hi all, I've been looking at the freeradius 2.0pre versions, and first, I want to say nice work. The new features look wonderful. I'm a little concerned about the upgrade path for distributions, though, and I wanted to raise it as an issue for consideration. I am fully aware that it may be unfixable. It appears now that a 1.x config file will not be parsed by a 2.x server, and you'll be left with a non-functioning radius service after an upgrade. This makes me feel like the right upgrade path for distributions is to ship the new version as freeradius2 (complete with /etc/freeradius2, /usr/sbin/freeradius2, and so on). This would allow admins to coinstall the two versions, and plan an orderly migration, rather than just break the existing setup. As you can imagine, this introduces quite a bit of divergence that I really do not want to add. It also means that we will have to ship the last version of freeradius 1.x code to provide an upgrade path, which means maintaining 2 code bases instead of one for the next several years, which I also really don't want to do. (Not that freeradius is in general a difficult package to maintain - thanks to everyone for a stable and secure server). I'm just hoping to put the issue on people's radar if it is able to be worked around. If it's not, then I'll just bite the bullet and make the divergence, but I was really hoping not to. Thanks all, -- -------------------------------------------------------------------------- | Stephen Gran | All science is either physics or stamp | | steve(a)lobefin.net | collecting. -- Ernest Rutherford | | http://www.lobefin.net/~steve | | --------------------------------------------------------------------------

6 11

CVS Server
by Arran Cudbard-Bell 01 Sep '07

01 Sep '07

cvs update: Updating . cvs update: failed to create lock directory for `/source/radiusd' (/source/radiusd/#cvs.lock): No space left on device cvs update: failed to obtain dir lock in repository `/source/radiusd' cvs [update aborted]: read lock failed - giving up --- Arran

6 8

Automatic report from sources (radiusd) between 30.08.2007 - 31.08.2007 GMT
by Automatic cvs log generator 31 Aug '07

31 Aug '07

CVS log entries from 30.08.2007 (Thu) 08:00:02 - 31.08.2007 (Fri) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/modules/rlm_ldap/rlm_ldap.c; Revisions: 1.186 File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_unixodbc/sql_unixodbc.c; Revisions: 1.22, 1.11.2.2.2.2 File: radiusd/src/main/event.c; Revisions: 1.48, 1.47 File: radiusd/src/main/threads.c; Revisions: 1.133 File: radiusd/src/main/mainconfig.c; Revisions: 1.120 File: radiusd/src/lib/valuepair.c; Revisions: 1.125, 1.82.2.1.2.6 ===================================================== Log entries ===================================================== Description: time_t may be 64 bits, so we can't pass &vp->vp_date directly to a function that expects (time_t *) Modified files: File: radiusd/src/lib/valuepair.c; Revision: 1.125; Date: 2007/08/30 08:53:26; Author: aland; Lines: (+24 -7) ------------------------------- Description: Pull time_t fix from CVS head Modified files: File: radiusd/src/lib/valuepair.c; Revision: 1.82.2.1.2.6; Date: 2007/08/30 08:55:06; Author: aland; Lines: (+22 -8) ------------------------------- Description: Moved more code into common section Modified files: File: radiusd/src/main/event.c; Revision: 1.48; Date: 2007/08/30 08:38:05; Author: aland; Lines: (+42 -39) ------------------------------- Description: Moved more paircreate() to radius_paircreate() Modified files: File: radiusd/src/main/event.c; Revision: 1.47; Date: 2007/08/30 08:29:44; Author: aland; Lines: (+7 -15) ------------------------------- Description: Replaced calls to exit(1) with better code Modified files: File: radiusd/src/main/mainconfig.c; Revision: 1.120; Date: 2007/08/30 08:46:02; Author: aland; Lines: (+33 -33) ------------------------------- Description: Removed one more call to exit() Modified files: File: radiusd/src/main/threads.c; Revision: 1.133; Date: 2007/08/30 08:42:52; Author: aland; Lines: (+4 -4) ------------------------------- Description: After ldap_authorize, if there's no "known good" password, COMPLAIN. This might help the people who can't be bothered to read the documentation. Modified files: File: radiusd/src/modules/rlm_ldap/rlm_ldap.c; Revision: 1.186; Date: 2007/08/30 12:15:33; Author: aland; Lines: (+12 -1) ------------------------------- Description: Port fix from 1.1.x. Modified files: File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_unixodbc/sql_unixodbc.c; Revision: 1.22; Date: 2007/08/30 09:01:16; Author: aland; Lines: (+3 -3) ------------------------------- Description: SQLNumResultCols takes a "short", not an "int". Use the correct variable type Modified files: File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_unixodbc/sql_unixodbc.c; Revision: 1.11.2.2.2.2; Date: 2007/08/30 09:00:24; Author: aland; Lines: (+2 -2) ===================================================== Summary of modified files ===================================================== File: radiusd/src/lib/valuepair.c Revisions: 1.125, 1.82.2.1.2.6 Authors: aland (+24 -7), aland (+22 -8) ------------------------------- File: radiusd/src/main/event.c Revisions: 1.48, 1.47 Authors: aland (+42 -39), aland (+7 -15) ------------------------------- File: radiusd/src/main/mainconfig.c Revisions: 1.120 Authors: aland (+33 -33) ------------------------------- File: radiusd/src/main/threads.c Revisions: 1.133 Authors: aland (+4 -4) ------------------------------- File: radiusd/src/modules/rlm_ldap/rlm_ldap.c Revisions: 1.186 Authors: aland (+12 -1) ------------------------------- File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_unixodbc/sql_unixodbc.c Revisions: 1.22, 1.11.2.2.2.2 Authors: aland (+3 -3), aland (+2 -2) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 29.08.2007 - 30.08.2007 GMT
by Automatic cvs log generator 30 Aug '07

30 Aug '07

CVS log entries from 29.08.2007 (Wed) 08:00:01 - 30.08.2007 (Thu) 08:00:02 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/main/event.c; Revisions: 1.46 File: radiusd/src/main/threads.c; Revisions: 1.132 File: radiusd/INSTALL; Revisions: 1.9 ===================================================== Combined list of identical log entries ===================================================== Description: Replaced exit(1) with return -1; Modified files: File: radiusd/src/main/event.c; Revision: 1.46; Date: 2007/08/30 04:15:35; Author: aland; Lines: (+5 -3) File: radiusd/src/main/threads.c; Revision: 1.132; Date: 2007/08/30 04:15:34; Author: aland; Lines: (+13 -13) ===================================================== Log entries ===================================================== Description: Added notes on upgrading Modified files: File: radiusd/INSTALL; Revision: 1.9; Date: 2007/08/29 08:37:45; Author: aland; Lines: (+47 -2) ===================================================== Summary of modified files ===================================================== File: radiusd/INSTALL Revisions: 1.9 Authors: aland (+47 -2) ------------------------------- File: radiusd/src/main/event.c Revisions: 1.46 Authors: aland (+5 -3) ------------------------------- File: radiusd/src/main/threads.c Revisions: 1.132 Authors: aland (+13 -13) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 28.08.2007 - 29.08.2007 GMT
by Automatic cvs log generator 29 Aug '07

29 Aug '07

CVS log entries from 28.08.2007 (Tue) 08:00:00 - 29.08.2007 (Wed) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/modules/rlm_krb5/configure; Revisions: 1.14 File: radiusd/src/main/realms.c; Revisions: 1.28, 1.27 File: radiusd/raddb/proxy.conf; Revisions: 1.28 File: radiusd/src/modules/rlm_krb5/configure.in; Revisions: 1.11 File: radiusd/src/lib/print.c; Revisions: 1.51, 1.50 ===================================================== Combined list of identical log entries ===================================================== Description: Fail the build if there's no krb5.h Modified files: File: radiusd/src/modules/rlm_krb5/configure; Revision: 1.14; Date: 2007/08/28 08:03:12; Author: aland; Lines: (+3 -0) File: radiusd/src/modules/rlm_krb5/configure.in; Revision: 1.11; Date: 2007/08/28 08:03:14; Author: aland; Lines: (+4 -1) ------------------------------- Description: Removed extraneous "hostname" configuration entry from realms Modified files: File: radiusd/raddb/proxy.conf; Revision: 1.28; Date: 2007/08/28 08:23:21; Author: aland; Lines: (+14 -11) File: radiusd/src/main/realms.c; Revision: 1.27; Date: 2007/08/28 08:23:22; Author: aland; Lines: (+7 -10) ===================================================== Log entries ===================================================== Description: Add check for delimitst < 0 back in. Modified files: File: radiusd/src/lib/print.c; Revision: 1.51; Date: 2007/08/28 13:01:50; Author: aland; Lines: (+6 -2) ------------------------------- Description: Allow valid UTF-8 characters when printing things. Modified files: File: radiusd/src/lib/print.c; Revision: 1.50; Date: 2007/08/28 09:45:56; Author: aland; Lines: (+130 -29) ------------------------------- Description: Updated error message Modified files: File: radiusd/src/main/realms.c; Revision: 1.28; Date: 2007/08/28 08:24:43; Author: aland; Lines: (+3 -3) ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/proxy.conf Revisions: 1.28 Authors: aland (+14 -11) ------------------------------- File: radiusd/src/lib/print.c Revisions: 1.51, 1.50 Authors: aland (+6 -2), aland (+130 -29) ------------------------------- File: radiusd/src/main/realms.c Revisions: 1.28, 1.27 Authors: aland (+3 -3), aland (+7 -10) ------------------------------- File: radiusd/src/modules/rlm_krb5/configure Revisions: 1.14 Authors: aland (+3 -0) ------------------------------- File: radiusd/src/modules/rlm_krb5/configure.in Revisions: 1.11 Authors: aland (+4 -1) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

3 2

xlat UTF-8 stuff for 1.1.x backport
by Enrik Berkhan 28 Aug '07

28 Aug '07

Hi, using the attached patch my LDAP-requests returning UTF-8 and embedded commas work now using 1.1.7. This should fix bug #411, too. Enrik Index: src/lib/print.c =================================================================== RCS file: /source/radiusd/src/lib/print.c,v retrieving revision 1.26.2.1.2.2 diff -u -b -r1.26.2.1.2.2 print.c --- src/lib/print.c 15 Mar 2006 15:37:56 -0000 1.26.2.1.2.2 +++ src/lib/print.c 28 Aug 2007 14:26:07 -0000 @@ -33,28 +33,123 @@ #include "libradius.h" /* - * Convert a string to something printable. - * The output string has to be _at least_ 4x the size - * of the input string! + * Checks for utf-8, taken from: + * + * http://www.w3.org/International/questions/qa-forms-utf-8 + * + * Note that we don't care about the length of the input string, + * because '\0' is an invalid UTF-8 character. + */ +static int utf8_char(uint8_t *str) +{ + if (*str < 0x20) return 0; + + if (*str <= 0x7e) return 1; /* 1 */ + + if (*str <= 0xc1) return 0; + + if ((str[0] >= 0xc2) && /* 2 */ + (str[0] <= 0xdf) && + (str[1] >= 0x80) && + (str[1] <= 0xbf)) { + return 2; + } + + if ((str[0] == 0xe0) && /* 3 */ + (str[1] >= 0xa0) && + (str[1] <= 0xbf) && + (str[2] >= 0x80) && + (str[2] <= 0xbf)) { + return 3; + } + + if ((str[0] >= 0xe1) && /* 4a */ + (str[0] <= 0xec) && + (str[1] >= 0x80) && + (str[1] <= 0xbf) && + (str[2] >= 0x80) && + (str[2] <= 0xbf)) { + return 3; + } + + if ((str[0] >= 0xee) && /* 4b */ + (str[0] <= 0xef) && + (str[1] >= 0x80) && + (str[1] <= 0xbf) && + (str[2] >= 0x80) && + (str[2] <= 0xbf)) { + return 3; + } + + if ((str[0] == 0xed) && /* 5 */ + (str[1] >= 0x80) && + (str[1] <= 0x9f) && + (str[2] >= 0x80) && + (str[2] <= 0xbf)) { + return 3; + } + + if ((str[0] == 0xf0) && /* 6 */ + (str[1] >= 0x90) && + (str[1] <= 0xbf) && + (str[2] >= 0x80) && + (str[2] <= 0xbf) && + (str[3] >= 0x80) && + (str[3] <= 0xbf)) { + return 4; + } + + if ((str[0] >= 0xf1) && /* 6 */ + (str[1] <= 0xf3) && + (str[1] >= 0x80) && + (str[1] <= 0xbf) && + (str[2] >= 0x80) && + (str[2] <= 0xbf) && + (str[3] >= 0x80) && + (str[3] <= 0xbf)) { + return 4; + } + + + if ((str[0] == 0xf4) && /* 7 */ + (str[1] >= 0x80) && + (str[1] <= 0x8f) && + (str[2] >= 0x80) && + (str[2] <= 0xbf) && + (str[3] >= 0x80) && + (str[3] <= 0xbf)) { + return 4; + } + + /* + * Invalid UTF-8 Character + */ + return 0; +} + +/* + * Convert a string to something printable. The output string + * has to be larger than the input string by at least 5 bytes. + * If not, the output is silently truncated... */ void librad_safeprint(char *in, int inlen, char *out, int outlen) { unsigned char *str = (unsigned char *)in; - int done = 0; int sp = 0; + int utf8 = 0; if (inlen < 0) inlen = strlen(in); - while (inlen-- > 0 && (done + 3) < outlen) { + /* + * + */ + while ((inlen > 0) && (outlen > 4)) { /* * Hack: never print trailing zero. * Some clients send strings with an off-by-one * length (confused with strings in C). */ - if (inlen == 0 && *str == 0) - break; - - sp = 0; + if ((inlen == 0) && (*str == 0)) break; switch (*str) { case '\\': @@ -69,25 +164,38 @@ case '\t': sp = 't'; break; + case '"': + sp = '"'; + break; default: - if (*str < 32 || (*str >= 128)){ - snprintf(out, outlen, "\\%03o", *str); - done += 4; - out += 4; - outlen -= 4; - } else { - *out++ = *str; - outlen--; - done++; - } + sp = 0; + break; } + if (sp) { *out++ = '\\'; *out++ = sp; outlen -= 2; - done += 2; + str++; + inlen--; + continue; } + + utf8 = utf8_char((uint8_t *)str); + if (!utf8) { + snprintf(out, outlen, "\\%03o", *str); + out += 4; + outlen -= 4; str++; + inlen--; + continue; + } + + do { + *out++ = *str++; + outlen--; + inlen--; + } while (--utf8 > 0); } *out = 0; } @@ -117,18 +225,23 @@ if (vp->attribute == PW_NAS_PORT) a = (char *)vp->strvalue; else { - if (delimitst && vp->flags.has_tag) { + if (delimitst == 1 && vp->flags.has_tag) { /* Tagged attribute: print delimter and ignore tag */ buf[0] = '"'; librad_safeprint((char *)(vp->strvalue), vp->length, buf + 1, sizeof(buf) - 2); strcat(buf, "\""); - } else if (delimitst) { + } else if (delimitst == 1) { /* Non-tagged attribute: print delimter */ buf[0] = '"'; librad_safeprint((char *)vp->strvalue, vp->length, buf + 1, sizeof(buf) - 2); strcat(buf, "\""); + + } else if (delimitst < 0) { /* xlat.c */ + strlcpy(out, vp->strvalue, outlen); + return strlen(out); + } else { /* Non-tagged attribute: no delimiter */ librad_safeprint((char *)vp->strvalue, Index: src/main/xlat.c =================================================================== RCS file: /source/radiusd/src/main/xlat.c,v retrieving revision 1.72.2.7.2.5 diff -u -b -r1.72.2.7.2.5 xlat.c --- src/main/xlat.c 14 Jul 2007 11:07:54 -0000 1.72.2.7.2.5 +++ src/main/xlat.c 28 Aug 2007 14:26:08 -0000 @@ -72,7 +72,7 @@ char buffer[MAX_STRING_LEN * 4]; if (pair != NULL) { - vp_prints_value(buffer, sizeof(buffer), pair, 0); + vp_prints_value(buffer, sizeof(buffer), pair, -1); return func(out, outlen, buffer); }

1 0

Problem with expansion of %{Ldap-UserDn} containing UTF-8 (cf. Bug #411)
by Enrik Berkhan 28 Aug '07

28 Aug '07

Hi, there is a problem at least with LDAP group compares when Ldap-UserDn contains UTF-8 which seems not to be uncommon nowadays :) (see Bug #411) I have a setup where I use Active Directory for authorization via groupmembership_filter. Assume the following: basedn = "dc=example,dc=com" filter = "(userPrincipalName=%{Stripped-User-Name})" base_filter = "(objectclass=user)" groupmembership_filter = "(&(objectClass=group)(member=%{Ldap-UserDn}))" users file: DEFAULT ldap-group == "CN=allow-members-of-this-group,OU=Groups,DC=example,DC=com" The entry in the users file triggers the LDAP group compare function, which in turn first searches for the user (assume Ldap-UserDn has not been set before) and then does a second search using the group DN as base DN and groupmembership_filter as filter. Assume now the first search returns a user_dn containing UTF-8. The %{Ldap-UserDn} in the groupmembership_filter will then be expanded by xlat.c using \ooo (octal) for the 8bit characters. Then, the second search can not match, because the member attribute of the group contains member DNs in UTF-8, but the value to compare has been 'destroyed' by xlat. 1. How can this issue be solved for Ldap-UserDn? Or does a solution already exists that I have overlooked? 2. Is this a general issue for variable expansions handling _all_ 8bit characters as kind of 'non-printable', may be 'unsafe' characters? Remember that most query expansions like in rlm_ldap and rlm_sql have their own notion of unsafe characters and escape again ... Thanks for any ideas. Enrik

2 20

problem with proxy and 2.0pre2
by A.L.M.Buxey＠lboro.ac.uk 28 Aug '07

28 Aug '07

hi, I've been upgrading a few 1.1.7 boxes to 2.0pre2 due to now requiring the extensive new features and fixes ;-) anyway, i am facing an issue with proxying.... leaving the config pretty much as was the default I see the following with rlm_realm in the radiusd -X logging ++[auth_log] returns ok ++[mschap] returns noop rlm_realm: Looking up realm "example.co.uk" for User-Name = "testuser(a)example.co.uk" rlm_realm: No such realm "example.co.uk" ...i have a DEFAULT entry realm in the proxy.conf - as before - but it is not being used or, it seems, detected. a NULL entry is happily used and my locally defined realms and LOCAL realm are also being used. I'll carry on digging to see if theres an assumption or peculiarity being made here. alan

3 5

Automatic report from sources (radiusd) between 24.08.2007 - 25.08.2007 GMT
by Automatic cvs log generator 25 Aug '07

25 Aug '07

CVS log entries from 24.08.2007 (Fri) 08:00:02 - 25.08.2007 (Sat) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/include/vmps.h; Revisions: 1.1 File: radiusd/src/main/radiusd.c; Revisions: 1.371 File: radiusd/src/main/listen.c; Revisions: 1.98, 1.97 File: radiusd/README; Revisions: 1.8 File: radiusd/src/main/Makefile.in; Revisions: 1.69 File: radiusd/src/main/detail.c; Revisions: 1.1 File: radiusd/src/main/vmps.c; Revisions: 1.3 File: radiusd/src/include/detail.h; Revisions: 1.1 File: radiusd/src/main/evaluate.c; Revisions: 1.28 ===================================================== Combined list of identical log entries ===================================================== Description: Cleaned up socket print routine moved VMPS stuff from listen.c to its own file Modified files: File: radiusd/src/main/listen.c; Revision: 1.97; Date: 2007/08/25 03:56:43; Author: aland; Lines: (+37 -91) File: radiusd/src/main/radiusd.c; Revision: 1.371; Date: 2007/08/25 03:56:44; Author: aland; Lines: (+4 -21) File: radiusd/src/main/vmps.c; Revision: 1.3; Date: 2007/08/25 03:56:44; Author: aland; Lines: (+86 -2) ------------------------------- Description: Moved detail file handling to its own source file Modified files: File: radiusd/src/include/detail.h; Revision: 1.1; Date: 2007/08/25 04:06:59; Author: aland; File: radiusd/src/main/Makefile.in; Revision: 1.69; Date: 2007/08/25 04:06:59; Author: aland; Lines: (+2 -2) File: radiusd/src/main/detail.c; Revision: 1.1; Date: 2007/08/25 04:06:58; Author: aland; File: radiusd/src/main/listen.c; Revision: 1.98; Date: 2007/08/25 04:06:59; Author: aland; Lines: (+5 -690) ===================================================== Log entries ===================================================== Description: More notes on 2.0 Modified files: File: radiusd/README; Revision: 1.8; Date: 2007/08/24 12:42:03; Author: aland; Lines: (+33 -23) ------------------------------- Description: Referenced from src/main/vmps.c Modified files: File: radiusd/src/include/vmps.h; Revision: 1.1; Date: 2007/08/25 03:58:40; Author: aland; ------------------------------- Description: Expand regular expressions, too Modified files: File: radiusd/src/main/evaluate.c; Revision: 1.28; Date: 2007/08/24 12:42:55; Author: aland; Lines: (+3 -4) ===================================================== Summary of modified files ===================================================== File: radiusd/README Revisions: 1.8 Authors: aland (+33 -23) ------------------------------- File: radiusd/src/include/detail.h Revisions: 1.1 Authors: aland ------------------------------- File: radiusd/src/include/vmps.h Revisions: 1.1 Authors: aland ------------------------------- File: radiusd/src/main/Makefile.in Revisions: 1.69 Authors: aland (+2 -2) ------------------------------- File: radiusd/src/main/detail.c Revisions: 1.1 Authors: aland ------------------------------- File: radiusd/src/main/evaluate.c Revisions: 1.28 Authors: aland (+3 -4) ------------------------------- File: radiusd/src/main/listen.c Revisions: 1.98, 1.97 Authors: aland (+5 -690), aland (+37 -91) ------------------------------- File: radiusd/src/main/radiusd.c Revisions: 1.371 Authors: aland (+4 -21) ------------------------------- File: radiusd/src/main/vmps.c Revisions: 1.3 Authors: aland (+86 -2) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0