- Freeradius-Devel - lists.freeradius.org

Proxy feature enhancement
by Geoffroy Arnoud 22 Sep '06

22 Sep '06

Hello, We are developping a RADIUS platform for our customer based on FreeRADIUS 1.1.3. We plan to patch the kernel code to implement a timeout/reries configuration per realm, for the RADIUS proxy feature. I saw in the archive that some time ago, someone planned to perform this modification (http://lists.freeradius.org/mailman/htdig/freeradius-devel/2004-October/007…) I am wondering if such a patch is available? If not, we will develop it and provide it to the community. For this purpose, we may need some tips on how proxy is implemented, in terms of configuration and behaviour (for example, How is managed timeout detection for a given request?). Furthermore, are there tests suite available on the server kernel so we can perform/enhance them to check non-regression? Any information will be welcome. Best regards, Geoff.

2 3

RE: rfc4590
by Alexander Schrab 22 Sep '06

22 Sep '06

BTW, would it be possible to add the behavior described in rfc4590 so freeradius can create a nonce. I am not sure if the structure of freeradius supports this since the rlm_digest only returns OK if the user is authenticated. Is it possible to define the returned package in more detail? "B sends an Access-Request packet with the newly defined Digest-Method and Digest-URI attributes but without a Digest-Nonce attribute to the RADIUS server, C (step 2). C chooses a nonce and responds with an Access-Challenge (step 3)." (B=http server, C=radius server) (RFC4590 1.3) /Alex > -----Original Message----- > From: > freeradius-devel-bounces+alexander.schrab=axis.com(a)lists.freer > adius.org > [mailto:freeradius-devel-bounces+alexander.schrab=axis.com@lis > ts.freeradius.org] On Behalf Of Alan DeKok > Sent: den 18 september 2006 18:35 > To: FreeRadius developers mailing list > Subject: Re: rfc4590 > > > "Alexander Schrab" <Alexander.Schrab(a)axis.com> wrote: > > I think I have a working version. But I can't test it with the old > > version of digest (I had a test program, but it expired). > How do you > > usually test freeradius? > > src/tests. It includes a number of digest tests. > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/devel.html >

3 10

Automatic report from sources (radiusd) between 21.09.2006 - 22.09.2006 GMT
by Automatic cvs log generator 22 Sep '06

22 Sep '06

CVS log entries from 21.09.2006 (Thu) 08:00:01 - 22.09.2006 (Fri) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/doc/rfc/Makefile; Revisions: 1.11 File: radiusd/doc/rfc/attributes.html; Revisions: 1.3 File: radiusd/doc/rfc/rfc4590.txt; Revisions: 1.1 File: radiusd/doc/rfc/rewrite.pl; Revisions: 1.4, 1.3 Author: pnixon File: radiusd/src/modules/rlm_sqlippool/rlm_sqlippool.c; Revisions: 1.7 File: radiusd/raddb/sqlippool.conf; Revisions: 1.4 ===================================================== Combined list of identical log entries ===================================================== Description: Added rfc4590 to the the list Modified files: File: radiusd/doc/rfc/Makefile; Revision: 1.11; Date: 2006/09/21 23:17:42; Author: aland; Lines: (+3 -2) File: radiusd/doc/rfc/attributes.html; Revision: 1.3; Date: 2006/09/21 23:17:41; Author: aland; Lines: (+26 -1) ===================================================== Log entries ===================================================== Description: Fix it more Modified files: File: radiusd/doc/rfc/rewrite.pl; Revision: 1.4; Date: 2006/09/21 23:29:41; Author: aland; Lines: (+6 -4) ------------------------------- Description: Be a little politer about what we print Modified files: File: radiusd/doc/rfc/rewrite.pl; Revision: 1.3; Date: 2006/09/21 23:16:48; Author: aland; Lines: (+3 -5) ------------------------------- Description: Added for Digest authentication Modified files: File: radiusd/doc/rfc/rfc4590.txt; Revision: 1.1; Date: 2006/09/21 23:17:02; Author: aland; ------------------------------- Description: Change %{P} to %{check:Pool-Name} to improve query readability Modified files: File: radiusd/raddb/sqlippool.conf; Revision: 1.4; Date: 2006/09/21 10:55:31; Author: pnixon; Lines: (+2 -2) ------------------------------- Description: Remove mutexes and log Called/Calling-Station-Id when handing out IPs Modified files: File: radiusd/src/modules/rlm_sqlippool/rlm_sqlippool.c; Revision: 1.7; Date: 2006/09/21 09:21:55; Author: pnixon; Lines: (+26 -28) ===================================================== Summary of modified files ===================================================== File: radiusd/doc/rfc/Makefile Revisions: 1.11 Authors: aland (+3 -2) ------------------------------- File: radiusd/doc/rfc/attributes.html Revisions: 1.3 Authors: aland (+26 -1) ------------------------------- File: radiusd/doc/rfc/rewrite.pl Revisions: 1.4, 1.3 Authors: aland (+6 -4), aland (+3 -5) ------------------------------- File: radiusd/doc/rfc/rfc4590.txt Revisions: 1.1 Authors: aland ------------------------------- File: radiusd/raddb/sqlippool.conf Revisions: 1.4 Authors: pnixon (+2 -2) ------------------------------- File: radiusd/src/modules/rlm_sqlippool/rlm_sqlippool.c Revisions: 1.7 Authors: pnixon (+26 -28) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Re: [Bug 345] rlm_syslog.c (syslog support for auth and accounting logging)
by Alan DeKok 21 Sep '06

21 Sep '06

> What is holding this up from going into CVS head? I took a quick look at it, and was more than a little horrified at what it did. I looked into fixing it, but didn't get much of anywhere. That was a few months ago, so I don't recall exactly what was so bad. But any syslog module could really be a copy of rlm_linelog, with the messages going to syslog, and a few extra config options to control facility and level. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

1 0

Automatic report from sources (radiusd) between 20.09.2006 - 21.09.2006 GMT
by Automatic cvs log generator 21 Sep '06

21 Sep '06

CVS log entries from 20.09.2006 (Wed) 08:00:01 - 21.09.2006 (Thu) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: pnixon File: radiusd/doc/rlm_sqlippool; Revisions: 1.3 ===================================================== Log entries ===================================================== Description: Some additional docs Modified files: File: radiusd/doc/rlm_sqlippool; Revision: 1.3; Date: 2006/09/20 22:33:40; Author: pnixon; Lines: (+22 -10) ===================================================== Summary of modified files ===================================================== File: radiusd/doc/rlm_sqlippool Revisions: 1.3 Authors: pnixon (+22 -10) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 19.09.2006 - 20.09.2006 GMT
by Automatic cvs log generator 20 Sep '06

20 Sep '06

CVS log entries from 19.09.2006 (Tue) 08:00:01 - 20.09.2006 (Wed) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: mgriego File: radiusd/src/main/mainconfig.c; Revisions: 1.95 Author: pnixon File: radiusd/raddb/Makefile; Revisions: 1.14 ===================================================== Log entries ===================================================== Description: add sqlippool.conf Modified files: File: radiusd/raddb/Makefile; Revision: 1.14; Date: 2006/09/19 17:54:36; Author: pnixon; Lines: (+2 -2) ------------------------------- Description: If we're using syslog, we have to parse the log {} section of the config before trying to reference it for the syslog_facility. In addition, check to make sure syslog_facility isn't NULL before using it to compare to avoid a crash condition. Modified files: File: radiusd/src/main/mainconfig.c; Revision: 1.95; Date: 2006/09/20 03:09:36; Author: mgriego; Lines: (+17 -1) ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/Makefile Revisions: 1.14 Authors: pnixon (+2 -2) ------------------------------- File: radiusd/src/main/mainconfig.c Revisions: 1.95 Authors: mgriego (+17 -1) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 18.09.2006 - 19.09.2006 GMT
by Automatic cvs log generator 19 Sep '06

19 Sep '06

CVS log entries from 18.09.2006 (Mon) 08:00:01 - 19.09.2006 (Tue) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/doc/rfc/Makefile; Revisions: 1.10 File: radiusd/src/lib/radius.c; Revisions: 1.189 File: radiusd/doc/rfc/per-rfc.pl; Revisions: 1.1 File: radiusd/doc/rfc/genref.pl; Revisions: 1.2 File: radiusd/doc/rfc/attributes.html; Revisions: 1.2 File: radiusd/doc/rfc/update.sh; Revisions: 1.1 File: radiusd/doc/rfc/rewrite.pl; Revisions: 1.2 Author: pnixon File: radiusd/doc/examples/postgresql.sql; Revisions: 1.6 File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_postgresql/sql_postgresql.c; Revisions: 1.45 File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_postgresql/sql_postgresql.h; Revisions: 1.9 ===================================================== Combined list of identical log entries ===================================================== Description: Update the list of RFC's we handle, and update the creation scripts to work a little better Modified files: File: radiusd/doc/rfc/Makefile; Revision: 1.10; Date: 2006/09/18 17:43:47; Author: aland; Lines: (+9 -3) File: radiusd/doc/rfc/attributes.html; Revision: 1.2; Date: 2006/09/18 17:43:47; Author: aland; Lines: (+32 -41) File: radiusd/doc/rfc/genref.pl; Revision: 1.2; Date: 2006/09/18 17:43:47; Author: aland; Lines: (+8 -1) File: radiusd/doc/rfc/per-rfc.pl; Revision: 1.1; Date: 2006/09/18 17:43:47; Author: aland; File: radiusd/doc/rfc/rewrite.pl; Revision: 1.2; Date: 2006/09/18 17:43:47; Author: aland; Lines: (+6 -2) File: radiusd/doc/rfc/update.sh; Revision: 1.1; Date: 2006/09/18 17:43:48; Author: aland; ------------------------------- Description: Update to check the error codes properly so we only reconnect on errors that actually require a reconnect. Modified files: File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_postgresql/sql_postgresql.c; Revision: 1.45; Date: 2006/09/18 10:30:46; Author: pnixon; Lines: (+114 -87) File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_postgresql/sql_postgresql.h; Revision: 1.9; Date: 2006/09/18 10:30:46; Author: pnixon; Lines: (+237 -38) ===================================================== Log entries ===================================================== Description: Add radippool Modified files: File: radiusd/doc/examples/postgresql.sql; Revision: 1.6; Date: 2006/09/18 10:28:49; Author: pnixon; Lines: (+17 -1) ------------------------------- Description: Calculate reply digest for Disconnect && CoA packets, too Modified files: File: radiusd/src/lib/radius.c; Revision: 1.189; Date: 2006/09/18 17:47:10; Author: aland; Lines: (+6 -2) ===================================================== Summary of modified files ===================================================== File: radiusd/doc/examples/postgresql.sql Revisions: 1.6 Authors: pnixon (+17 -1) ------------------------------- File: radiusd/doc/rfc/Makefile Revisions: 1.10 Authors: aland (+9 -3) ------------------------------- File: radiusd/doc/rfc/attributes.html Revisions: 1.2 Authors: aland (+32 -41) ------------------------------- File: radiusd/doc/rfc/genref.pl Revisions: 1.2 Authors: aland (+8 -1) ------------------------------- File: radiusd/doc/rfc/per-rfc.pl Revisions: 1.1 Authors: aland ------------------------------- File: radiusd/doc/rfc/rewrite.pl Revisions: 1.2 Authors: aland (+6 -2) ------------------------------- File: radiusd/doc/rfc/update.sh Revisions: 1.1 Authors: aland ------------------------------- File: radiusd/src/lib/radius.c Revisions: 1.189 Authors: aland (+6 -2) ------------------------------- File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_postgresql/sql_postgresql.c Revisions: 1.45 Authors: pnixon (+114 -87) ------------------------------- File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_postgresql/sql_postgresql.h Revisions: 1.9 Authors: pnixon (+237 -38) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

RE: rfc4590
by Alexander Schrab 18 Sep '06

18 Sep '06

I think I have a working version. But I can't test it with the old version of digest (I had a test program, but it expired). How do you usually test freeradius? /Alex > -----Original Message----- > From: > freeradius-devel-bounces+alexander.schrab=axis.com(a)lists.freer > adius.org > [mailto:freeradius-devel-bounces+alexander.schrab=axis.com@lis > ts.freeradius.org] On Behalf Of Alan DeKok > Sent: den 15 september 2006 16:34 > To: FreeRadius developers mailing list > Subject: Re: rfc4590 > > > "Alexander Schrab" <Alexander.Schrab(a)axis.com> wrote: > > Well, the thing is that my patch only replaces the > attributes from the > > draft version. So it's an either or situation. It seems > like the draft > > version has some momentum already, but the rfc should really be the > > way to go (no strange subattributes and such). > > There's no harm in having both. > > > It's more of a political decision, should freeradius > suppotr only the > > rfc, only the draft or both? Maybe you can point me in the > direction > > of the people/person who made the digest module? > > That was me. > > I haven't looked at RFC 4590, but if the old digest > attributes can be modified to look like the new ones, that > would appear to be a solution. i.e. > > authorize: if old-style, re-format, and make check items as old > authenticate: do new-style. If check item is marked as old, > send response in old format. > > Alan DeKok. > > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/devel.html >

2 1

radclient (CVS HEAD) segfault from exec
by Peter Nixon 18 Sep '06

18 Sep '06

Hi Guys I have a program called radsqlkill.pl which I am calling from exec like the following: exec radsqlkill { wait = no program = "radsqlkill.pl %{Calling-Station-Id}" input_pairs = request shell_escape = yes output = none } I have it defined in "instantiate" and "authorize" The idea being that it searches for active sessions in the radacct table and kills them using a Disconnect-Request if the same user trys a new connection. This is different to similtaneous use as due to my network setup it is not possible for the same Calling-Station-Id to actually connect twice, which means that they have been disconnected without the NAS noticing if there is a new Auth request from the same Calling-Station-Id. When run from the command line everything works great, however when run from exec I get the following segfault in syslog: Sep 18 17:00:05 server radsqlkill.pl[12254]: Sending Disconnect-Request for 021211111111 to 1.1.1.1 Sep 18 17:00:05 server kernel: radclient[12255]: segfault at 0000000000000058 rip 00002aaaaaf0d869 rsp 00007fffffccbf90 error 4 Does anyone know why this would be a problem? -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

1 0

RE: rfc4590
by Alexander Schrab 18 Sep '06

18 Sep '06

Well, the thing is that my patch only replaces the attributes from the draft version. So it's an either or situation. It seems like the draft version has some momentum already, but the rfc should really be the way to go (no strange subattributes and such). It's more of a political decision, should freeradius suppotr only the rfc, only the draft or both? Maybe you can point me in the direction of the people/person who made the digest module? /Alex -----Original Message----- From: freeradius-devel-bounces+alexander.schrab=axis.com(a)lists.freeradius.org [mailto:freeradius-devel-bounces+alexander.schrab=axis.com@lists.freerad ius.org] On Behalf Of Alan DeKok Sent: den 14 september 2006 17:34 To: FreeRadius developers mailing list Subject: Re: rfc4590 "Alexander Schrab" <Alexander.Schrab(a)axis.com> wrote: > I have been looking at the rfc 4590 (http digest) and done some tests > with freeradius. As I userstand it implements a similar but > uncompatible draft. Is anyone looking into this issue? No. > I have done a quick-n-dirty patch against 1.1.3 to support the > attributes defined in rfc4590, but I havn't looked into it in more > detail. Sure, submit a patch on bugs.freeradius.org. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html

2 3