- Freeradius-Devel - lists.freeradius.org

Re: Patch: eaptls packets too large, clash MTU
by Michael Joosten 10 Aug '06

10 Aug '06

Quoting sumi <sumi.rs(a)gmail.com>: > hi, > > attachment is missing...? > > thanks > sumi > Should not the case, but I'm currently forced to use a braindamaged "webmailer"... So, both inline and als attachment. diff -ru ../orig/freeradius-1.1.1/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c ./src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c --- ../orig/freeradius-1.1.1/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c 2006-02-06 10:37:03.000000000 -0500 +++ ./src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c 2006-04-21 19:45:47.000000000 -0400 @@ -443,11 +459,25 @@ * tells us it's too big. */ ssn->offset = inst->conf->fragment_size; + + /* + * Framed-MTU is the whole packet, so we cut off the + * EAPOW header (4 bytes) to be prepended by the NAS. + * NOTE: This does not account for other protocols and + * purposes like wired PPP, which has 8 bytes overhead. + */ vp = pairfind(handler->request->packet->vps, PW_FRAMED_MTU); if (vp && ((vp->lvalue - 4) < ssn->offset)) { ssn->offset = vp->lvalue - 4; } + /* + * And even more for the EAP TLS header: + * code + id + length + type + flags + TLS len + * 1 + 1 + 2 + 1 + 1 + 4 = 10 + */ + ssn->offset -= 10; + handler->opaque = ((void *)ssn); handler->free_opaque = session_free; > > On 8/11/06, Michael Joosten <michael.joosten(a)c-lab.de> wrote: > > > > Hello, > > > > while using EAPTLS via RADIUS for authentication of a PPP/L2TP/IPSec VPN > > (Microsoft style), I discovered that the generated EAPTLS packets are a > > little > > bit to large. If you take Framed-MTU serious, most of the EAPTLS header is > > not > > accounted for. Result: PPP communication with max. possible IPSec MTU > > fails > > silently, because the EAPTLS packets (esp. those with long certificates) > > are > > silently discarded. > > > > Patch attached. Should I also submit this to the bug database? > > > > Regards, Michael Joosten > > > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/devel.html > > > > > > -- > "If u look at what u dont have in life, u dont have anything > > But if u look at what u have in life, u have everything.....!!" >

1 0

Patch: eaptls packets too large, clash MTU
by Michael Joosten 10 Aug '06

10 Aug '06

Hello, while using EAPTLS via RADIUS for authentication of a PPP/L2TP/IPSec VPN (Microsoft style), I discovered that the generated EAPTLS packets are a little bit to large. If you take Framed-MTU serious, most of the EAPTLS header is not accounted for. Result: PPP communication with max. possible IPSec MTU fails silently, because the EAPTLS packets (esp. those with long certificates) are silently discarded. Patch attached. Should I also submit this to the bug database? Regards, Michael Joosten

3 4

RE: sample users file
by Mitchell, Michael J 08 Aug '06

08 Aug '06

Hi Peter, Framed-IP-Address = 255.255.255.254 typically instructs the NAS to assign an IP address from its default pool, so this is quite a valid DEFAULT entry.. cheers, Mike > -----Original Message----- > From: > freeradius-devel-bounces+mitchell.michael=bigpond.com(a)lists.fr > eeradius.org > [mailto:freeradius-devel-bounces+mitchell.michael=bigpond.com@ > lists.freeradius.org] On Behalf Of Peter Nixon > Sent: Tuesday, 8 August 2006 9:17 AM > To: freeradius-devel > Subject: sample users file > > Is it just me or does the following sample from "users" not > make sense? > > # Sample defaults for all framed connections. > # > #DEFAULT Service-Type == Framed-User > # Framed-IP-Address = 255.255.255.254, > # Framed-MTU = 576, > # Service-Type = Framed-User, > # Fall-Through = Yes > > Why would we want someone to set a Framed-IP-Address for > DEFAULT? Thats just > bound to end in tears! > >

2 1

sample users file
by Peter Nixon 07 Aug '06

07 Aug '06

Is it just me or does the following sample from "users" not make sense? # Sample defaults for all framed connections. # #DEFAULT Service-Type == Framed-User # Framed-IP-Address = 255.255.255.254, # Framed-MTU = 576, # Service-Type = Framed-User, # Fall-Through = Yes Why would we want someone to set a Framed-IP-Address for DEFAULT? Thats just bound to end in tears! -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

1 0

some documentation patches
by Michael Richardson 05 Aug '06

05 Aug '06

{I guess you know that rlm_policy doesn't compile in HEAD, due to lack of parent argument to compile_modgroup(). Also, ../../doc/README.failover, does not seem to exist.} I was looking for a module that might deal with selecting a L2/PPP termination machine from a list of machines, either randomly, or round robin. I didn't find one, but in the process, I made the following list, and decided that a file per module would make sense. Yes, there are man pages for a couple of them. I'm personally tired of nroff. git/cogito might have it right with "asciidoc", I'm not 100% convinced. I think that I can still commit this, if you approve of documentating in this way, and I haven't missed some other document. Some modules have README files, but often they don't even tell you what the purpose of the module is. (It self-evident) commit 59fa93c7b01dae302723f6ac45746ae7f96b0dfb Author: Michael Richardson <mcr(a)xelerance.com> Date: Sat Aug 5 14:30:40 2006 -0400 added list of modules and empty files for documentation of each module Signed-off-by: Michael Richardson <mcr(a)xelerance.com> diff --git a/doc/modules-description.txt b/doc/modules-description.txt new file mode 100644 index 0000000..76e0857 --- /dev/null +++ b/doc/modules-description.txt @@ -0,0 +1,48 @@ +-*- emacs-wiki -*- + +[[rlm_acct_unique]] - create a unique accounting key, adding Acct-Unique-Session-ID. +[[rlm_always]] - always return a specific result, and possibly change simulation +[[rlm_attr_filter]] - filter out A/V pairs from proxy, from an attribute file +[[rlm_attr_rewrite]] - change a particular attribute value +[[rlm_caching]] - cache the result of an authorization result, and use it again later +[[rlm_chap]] - perform CHAP-style authentication if user has a CHAP-style password +[[rlm_checkval]] - check an attribute for a particular value +[[rlm_copy_packet]] - copies all attributes from access request to access reply +[[rlm_counter]] - allow access based on accumulated usage of a resource (time, bytes) +[[rlm_cram]] - implements CRAM authentication method (for email. APOP/CRAM-MD5) +[[rlm_dbm]] - pull users data from dbm file +[[rlm_detail]] - log radius packets to a detailed file, primarily for accounting +[[rlm_digest]] - authenticated based upon (Cisco) SIP authentiation attributes +[[rlm_eap]] - implements EAP methods, and various subtypes +[[rlm_example]] - sample module (example only) +[[rlm_exec]] - implements Exec-Program && Exec-Program-Wait. +[[rlm_expiration]] - process expiration attribute, for expired logins +[[rlm_expr]] - invoked by dynamic expansion of strings %{expr:} to do calculations +[[rlm_fastusers]] - cached/hashing version of "users" file +[[rlm_files]] - read and parse the "users" file for authorization information +[[rlm_ippool]] - maintain a pool of IP addresses in a .db file +[[rlm_krb5]] - authenticate against KERBEROS v5 server +[[rlm_ldap]] - authorized and authenticate against LDAP server +[[rlm_linelog]] - log things to a file based upon radius_xlat(). +[[rlm_logintime]] - implement time of day restrictions on logins. +[[rlm_mschap]] - perform MS-CHAP/MS-CHAPv2 authentication +[[rlm_otp]] - implements various OTP mechanism via seperate daemon (XXX?) +[[rlm_pam]] - use PAM modules to authenticate users +[[rlm_pap]] - authenticate based upon User-Password attribute (PPP PAP) +[[rlm_passwd]] - authenticated based upon /etc/passwd-like method. +[[rlm_perl]] - create modules using perl +[[rlm_policy]] - implements the policy language +[[rlm_preprocess]] - deal with various NAS' notions of ports, mapping to huntgroups +[[rlm_protocol_filter]] - filter out certain value-pairs from requests +[[rlm_python]] - create modules using python +[[rlm_radutmp]] - maintain a utmp file of who is logged in, and do simultaenous checks +[[rlm_realm]] - parses the User-Name attribute into a User section and a Realm section +[[rlm_sim_files]] - loads EAP-SIM triplets from a file +[[rlm_smb]] - validate a user against an SMB/NMB server +[[rlm_sql]] - provides an interface to SQL databases for configuration files +[[rlm_sql_log]] - defers logging of accounting information, do it asynchronously +[[rlm_sqlcounter]] - limit users by resources, kept in a database +[[rlm_sqlippool]] - maintain a pool of IP addresses in a SQL database file +[[rlm_unix]] - authenticates against standard system unix crypt(3) passwords, +[[rlm_x99_token]] - X9.9 tokens (not complete) + diff --git a/doc/rlm_acct_unique b/doc/rlm_acct_unique new file mode 100644 index 0000000..8a46993 --- /dev/null +++ b/doc/rlm_acct_unique @@ -0,0 +1,2 @@ +-*- emacs-wiki -*- + diff --git a/doc/rlm_always b/doc/rlm_always new file mode 100644 index 0000000..8a46993 --- /dev/null +++ b/doc/rlm_always @@ -0,0 +1,2 @@ +-*- emacs-wiki -*- + diff --git a/doc/rlm_attr_filter b/doc/rlm_attr_filter new file mode 100644 index 0000000..8a46993 --- /dev/null +++ b/doc/rlm_attr_filter @@ -0,0 +1,2 @@ +-*- emacs-wiki -*- + diff --git a/doc/rlm_attr_rewrite b/doc/rlm_attr_rewrite new file mode 100644 index 0000000..8a46993 --- /dev/null +++ b/doc/rlm_attr_rewrite @@ -0,0 +1,2 @@ +-*- emacs-wiki -*- + diff --git a/doc/rlm_caching b/doc/rlm_caching new file mode 100644 index 0000000..0b5eb26 --- /dev/null +++ b/doc/rlm_caching @@ -0,0 +1 @@ +-*- emacs-wiki -*- diff --git a/doc/rlm_chap b/doc/rlm_chap new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_chap @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_checkval b/doc/rlm_checkval new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_checkval @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_copy_packet b/doc/rlm_copy_packet new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_copy_packet @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_counter b/doc/rlm_counter new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_counter @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_cram b/doc/rlm_cram new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_cram @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_detail b/doc/rlm_detail new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_detail @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_digest b/doc/rlm_digest new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_digest @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_example b/doc/rlm_example new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_example @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_exec b/doc/rlm_exec new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_exec @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_expr b/doc/rlm_expr new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_expr @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_files b/doc/rlm_files new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_files @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_ippool b/doc/rlm_ippool new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_ippool @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_linelog b/doc/rlm_linelog new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_linelog @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_logintime b/doc/rlm_logintime new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_logintime @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_mschap b/doc/rlm_mschap new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_mschap @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_otp b/doc/rlm_otp new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_otp @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_pap b/doc/rlm_pap new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_pap @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_perl b/doc/rlm_perl new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_perl @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_policy b/doc/rlm_policy new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_policy @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_preprocess b/doc/rlm_preprocess new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_preprocess @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_protocol_filter b/doc/rlm_protocol_filter new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_protocol_filter @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_radutmp b/doc/rlm_radutmp new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_radutmp @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_realm b/doc/rlm_realm new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_realm @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_sim_files b/doc/rlm_sim_files new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_sim_files @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_smb b/doc/rlm_smb new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_smb @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_sql_log b/doc/rlm_sql_log new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_sql_log @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_sqlippool b/doc/rlm_sqlippool new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_sqlippool @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_unix b/doc/rlm_unix new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_unix @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_x99_token b/doc/rlm_x99_token new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_x99_token @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME

1 0

Patch: UTF-8 for rlm_mschap
by Josh Howlett 02 Aug '06

02 Aug '06

Please find below a patch to enable support UTF-8 encoded passwords. It also adds a single configuration option to enable or disable this. josh. --- ../../../../freeradius-1.1.2/src/modules/rlm_mschap/rlm_mschap.c 2006-04-13 17:28:30.000000000 +0100 +++ rlm_mschap.c 2006-07-26 10:55:42.000000000 +0100 @@ -187,21 +187,80 @@ * ntpwdhash converts Unicode password to 16-byte NT hash * with MD4 */ -static void ntpwdhash (unsigned char *szHash, const char *szPassword) +static void ntpwdhash (unsigned char *szHash, const char *szPassword, int utf8_password) { char szUnicodePass[513]; int nPasswordLen; int i; + if (utf8_password) { + + /* + * We've been told to expect a UTF-8 password. + * Use iconv() to perform UTF-8 to Unicode conversion. + */ + + DEBUG2(" rlm_mschap: using UTF-8 to Unicode conversion"); + + iconv_t cd; + const char *fptr; + char *tptr; + size_t ileft,oleft; + fptr=szPassword; + tptr=szUnicodePass; + + cd=iconv_open("UCS-2LE", "UTF-8"); + + if (cd == (iconv_t)-1) { + DEBUG2(" rlm_mschap: iconv failed; trying the 7-bit conversion"); + /* + * Skip to the 7-bit password conversion + */ + goto sevenbit; + } + + ileft=strlen(szPassword); + oleft=512; + if (iconv(cd,&fptr, &ileft, &tptr, &oleft) != (size_t)-1) { + iconv_close(cd); + nPasswordLen = strlen(szUnicodePass); + nPasswordLen=512-oleft; + /* Encrypt Unicode password to a 16-byte MD4 hash */ + md4_calc(szHash, szUnicodePass, nPasswordLen ); + return; + } + + /* + * We encountered a problem. Recovery isn't possible, + * so log the problem and optimistically try the 7-bit conversion. + */ + + if (errno == EINVAL) { + DEBUG2(" rlm_mschap: An incomplete multibyte sequence has been encountered in the password"); + } else if (errno == E2BIG) { + DEBUG2(" rlm_mschap: password too big to convert"); + } else if (errno == EILSEQ) { + DEBUG2(" rlm_mschap: an invalid multibyte sequence has been encountered in the password"); + } else { + DEBUG2(" rlm_mschap: unknown iconv error"); + } + DEBUG2(" rlm_mschap: trying the 7-bit conversion instead"); + iconv_close(cd); + } + /* - * NT passwords are unicode. Convert plain text password - * to unicode by inserting a zero every other byte + * 7-bit password conversion */ + + sevenbit: + + DEBUG2(" rlm_mschap: using 7-bit to Unicode conversion"); + nPasswordLen = strlen(szPassword); for (i = 0; i < nPasswordLen; i++) { szUnicodePass[i << 1] = szPassword[i]; szUnicodePass[(i << 1) + 1] = 0; - } + } /* Encrypt Unicode password to a 16-byte MD4 hash */ md4_calc(szHash, szUnicodePass, (nPasswordLen<<1) ); @@ -290,6 +349,7 @@ char *xlat_name; char *ntlm_auth; char *auth_type; + int utf8_password; } rlm_mschap_t; @@ -602,6 +662,8 @@ offsetof(rlm_mschap_t, passwd_file), NULL, NULL }, { "ntlm_auth", PW_TYPE_STRING_PTR, offsetof(rlm_mschap_t, ntlm_auth), NULL, NULL }, + { "utf8_password", PW_TYPE_BOOLEAN, + offsetof(rlm_mschap_t,utf8_password), NULL, "yes" }, { NULL, -1, 0, NULL, NULL } /* end the list */ }; @@ -1121,7 +1183,7 @@ radlog(L_ERR, "No memory"); return RLM_MODULE_FAIL; } else { - ntpwdhash(nt_password->strvalue, password->strvalue); + ntpwdhash(nt_password->strvalue, password->strvalue, inst->utf8_password); nt_password->length = 16; pairadd(&request->config_items, nt_password); } --- ../../../../freeradius-1.1.2/raddb/radiusd.conf.in 2006-04-20 19:40:29.000000000 +0100 +++ ../../../raddb/radiusd.conf.in 2006-07-26 10:57:29.000000000 +0100 @@ -707,6 +707,10 @@ # Be VERY careful when editing the following line! # #ntlm_auth = "/path/to/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" + + # Use UTF-8 encoded passwords. + # + utf8_password = yes } # Lightweight Directory Access Protocol (LDAP)

1 0

Automatic report from sources (radiusd) between 01.08.2006 - 02.08.2006 GMT
by Automatic cvs log generator 02 Aug '06

02 Aug '06

CVS log entries from 01.08.2006 (Tue) 08:00:00 - 02.08.2006 (Wed) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/modules/rlm_sqlcounter/rlm_sqlcounter.c; Revisions: 1.28 ===================================================== Log entries ===================================================== Description: allow number of days, too Modified files: File: radiusd/src/modules/rlm_sqlcounter/rlm_sqlcounter.c; Revision: 1.28; Date: 2006/08/01 22:09:28; Author: aland; Lines: (+3 -3) ===================================================== Summary of modified files ===================================================== File: radiusd/src/modules/rlm_sqlcounter/rlm_sqlcounter.c Revisions: 1.28 Authors: aland (+3 -3) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

proxy_fail_type attribute
by Geoffroy Arnoud 02 Aug '06

02 Aug '06

Hi, I just get the last CVS update, and I discovered a "hidden" attribute in mainconfig.c, name "proxy_fail_type". By reading the source code, my understanding is that setting this attribute to "fail" (for example) in proxy.conf, and setting the value "fail" for Post-Proxy-Type in dictionary.freeradius.internal, will allow FreeRADIUS to execute a module when the proxy of a request failed (no response from server or other cases). My 1st question: - Am I right (or near to the truth)? I saw that this was not shipped into 1.1.2. But this feature appeared by the end of 2004. So my 2nd and 3rd questions are: - Has anyone used or is anyone using this feature on production deployement? - Is this feature planned to be shipped in 1.2.x? If I'm right about the behaviour, we may plan to deploy this feature (and therefore test it). So this leads me to another question: what is the best to do? Take last stable release and patch it to get the functionnality or take a CVS snapshot? Thank you in advance. Geof.

2 2

EAP method cleanup
by Piotr Marnik 31 Jul '06

31 Jul '06

Hello! I have a little problem with developing new EAP method. The problem is with the internal data which are used between subsequent EAP request (handler->opaque). My question is: how free session data when user breaks the session before finish? From my observation free_opaque is called only once when method finishes. But what about non finished sessions (intentionally or not) which should be, after some delay, also removed. Is there any solution for this problem? Regards Piotr Marnik -- Piotr Marnik e-mail: piotr.marnik(a)gmail.com icq: 319887763, gg: 8097221

2 2

bugzilla #380: rlm_dbm_parser refuses to create record if both check and reply items are empty
by Gabriel L. Somlo 30 Jul '06

30 Jul '06

rlm_dbm_parser refuses to create a users.dbm file where both the list of check items *and* the list of reply-items are empty (this is perfectly legal and allowed when one uses the files module). To reproduce: feed the following file to rlm_dbm_parser: #---begin users.dbm.src dummy_user ; ; #---end or #---begin users.dbm.src dummy_user ; #---end Then, attempt to create users.dbm: rlm_dbm_parser -c -i users.dbm.src -o users.dbm Notice how it says 'Records loaded: 0' Desired behavior is 'Record loaded: 1' A desired users.dbm file *can* be created by calling libdbm create/insert routines from a custom C program, by providing the username as key and the string "\n\n" as content (each '\n' denotes an empty list of check, and respectively, reply items). Once created, the users.dbm works fine with the actual freeradius server (radiusd). The problem is that, before inserting a record, rlm_dbm_parser checks the length of the content field, and skips insertion if length is less than 3 bytes. To be able to create a list of users w/o check and reply items, the minimum content length should be reduced to 2 bytes (for the two '\n' characters as described above). The following one-liner patch (against snapshot-20060730) fixes the bug (also submitted via bugzilla as #380): diff -NarU5 freeradius-snapshot-20060730.orig/src/modules/rlm_dbm/rlm_dbm_parser.c freeradius-snapshot-20060730.rlmfix/src/modules/rlm_dbm/rlm_dbm_parser.c --- freeradius-snapshot-20060730.orig/src/modules/rlm_dbm/rlm_dbm_parser.c 2006-03-16 11:47:43.000000000 -0500 +++ freeradius-snapshot-20060730.rlmfix/src/modules/rlm_dbm/rlm_dbm_parser.c 2006-07-30 17:14:00.000000000 -0400 @@ -153,11 +153,11 @@ static int storecontent (const char * username) { datum d,k; int res; - if ( pdb == NULL || concntr < 3 ) return 1; + if ( pdb == NULL || concntr < 2 ) return 1; DOUT2("store:\n%s\ncontent:\n%s",username,content); d.dptr = content; d.dsize = concntr + 1;

1 0