- Freeradius-Devel - lists.freeradius.org

Automatic report from sources (radiusd) between 29.07.2006 - 30.07.2006 GMT
by Automatic cvs log generator 30 Jul '06

30 Jul '06

CVS log entries from 29.07.2006 (Sat) 08:00:01 - 30.07.2006 (Sun) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: nbk File: radiusd/doc/rlm_sqlcounter; Revisions: 1.4, 1.3.6.1 File: radiusd/raddb/radiusd.conf.in; Revisions: 1.233, 1.188.2.4.2.12 ===================================================== Combined list of identical log entries ===================================================== Description: Document the setup of sqlcounter against a PostgreSQL database. Patch from Stephen Gran <sgran(a)debian.org> Modified files: File: radiusd/doc/rlm_sqlcounter; Revision: 1.4; Date: 2006/07/29 19:39:23; Author: nbk; Lines: (+34 -1) File: radiusd/doc/rlm_sqlcounter; Revision: 1.3.6.1; Date: 2006/07/29 19:43:30; Author: nbk; Lines: (+34 -1) File: radiusd/raddb/radiusd.conf.in; Revision: 1.233; Date: 2006/07/29 19:39:23; Author: nbk; Lines: (+21 -1) File: radiusd/raddb/radiusd.conf.in; Revision: 1.188.2.4.2.12; Date: 2006/07/29 19:43:30; Author: nbk; Lines: (+21 -1) ===================================================== Log entries ===================================================== ===================================================== Summary of modified files ===================================================== File: radiusd/doc/rlm_sqlcounter Revisions: 1.4, 1.3.6.1 Authors: nbk (+34 -1), nbk (+34 -1) ------------------------------- File: radiusd/raddb/radiusd.conf.in Revisions: 1.233, 1.188.2.4.2.12 Authors: nbk (+21 -1), nbk (+21 -1) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Documentation updates (sql_counter with postgresql)
by Stephen Gran 29 Jul '06

29 Jul '06

Hello all, After making this work for myself, I thought I would send the documentation on so that others could do it more easily. There are some duplicates that could be cut, but I leave that to you to decide. I have tried to be clear without being completely repetitive. Hopefully others will find it useful. There are 3 long lines in doc/rlm_sqlcounter that I see wrap badly - sorry about that. I was just trying to stay with the style of the file. Thanks, Index: doc/rlm_sqlcounter =================================================================== --- doc/rlm_sqlcounter (revision 939) +++ doc/rlm_sqlcounter (working copy) @@ -19,7 +19,7 @@ [1] Create a text file called sqlcounter.conf in the same directory where radiusd.conf resides (usually /usr/local/etc/raddb) -with the following content: +with the following content (for mysql): #-----# sqlcounter noresetcounter { @@ -59,6 +59,39 @@ #-----# +The respective lines for postgresql are: + +query = "SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{%k}'" +query = "SELECT SUM(AcctSessionTime - GREATER((%b - AcctStartTime::ABSTIME::INT4), 0)) FROM radacct WHERE UserName='%{%k}' AND AcctStartTime::ABSTIME::INT4 + AcctSessionTime > '%b'" +query = "SELECT SUM(AcctSessionTime - GREATER((%b - AcctStartTime::ABSTIME::INT4), 0)) FROM radacct WHERE UserName='%{%k}' AND AcctStartTime::ABSTIME::INT4 + AcctSessionTime > '%b'" + +If you are running postgres 7.x, you may not have a GREATER function. + +An example of one is: + +CREATE OR REPLACE FUNCTION "greater"(integer, integer) RETURNS integer AS ' +DECLARE + res INTEGER; + one INTEGER := 0; + two INTEGER := 0; +BEGIN + one = $1; + two = $2; + IF one IS NULL THEN + one = 0; + END IF; + IF two IS NULL THEN + two = 0; + END IF; + IF one > two THEN + res := one; + ELSE + res := two; + END IF; + RETURN res; +END; +' LANGUAGE 'plpgsql'; + [2] Include the above file to radiusd.conf by adding a line in modules{ } section Index: raddb/radiusd.conf.in =================================================================== --- raddb/radiusd.conf.in (revision 939) +++ raddb/radiusd.conf.in (working copy) @@ -1454,24 +1454,42 @@ # This query properly handles calls that span from the # previous reset period into the current period but # involves more work for the SQL server than those - # below + # below. For mysql: query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" + # For postgresql: + # Note - if you are running 7.x, you may not have a GREATER + # function. Please see doc/sql_counter for an example. + # query = "SELECT SUM(AcctSessionTime - \ + # GREATER((%b - AcctStartTime::ABSTIME::INT4), 0)) \ + # FROM radacct WHERE UserName='%{%k}' AND \ + # AcctStartTime::ABSTIME::INT4 + AcctSessionTime > '%b'" + # This query ignores calls that started in a previous # reset period and continue into into this one. But it - # is a little easier on the SQL server + # is a little easier on the SQL server. For mysql: # query = "SELECT SUM(AcctSessionTime) FROM radacct WHERE \ # UserName='%{%k}' AND AcctStartTime > FROM_UNIXTIME('%b')" + # For postgresql: + # query = "SELECT SUM(AcctSessionTime) FROM radacct WHERE \ + # UserName='%{%k}' AND AcctStartTime::ABSTIME::INT4 > '%b'" + # This query is the same as above, but demonstrates an # additional counter parameter '%e' which is the # timestamp for the end of the period + # For mysql: # query = "SELECT SUM(AcctSessionTime) FROM radacct \ # WHERE UserName='%{%k}' AND AcctStartTime BETWEEN \ # FROM_UNIXTIME('%b') AND FROM_UNIXTIME('%e')" +# + # For postgresql: + # query = "SELECT SUM(AcctSessionTime) FROM radacct \ + # WHERE UserName='%{%k}' AND AcctStartTime::ABSTIME::INT4 \ + # BETWEEN '%b' AND '%e'" } sqlcounter monthlycounter { @@ -1484,7 +1502,9 @@ # This query properly handles calls that span from the # previous reset period into the current period but # involves more work for the SQL server than those - # below + # below. + # The same notes above about the differences between mysql + # versus postgres queries apply here. query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ -- -------------------------------------------------------------------------- | Stephen Gran | What nonsense people talk about happy | | steve(a)lobefin.net | marriages! A man can be happy with any | | http://www.lobefin.net/~steve | woman so long as he doesn't love her. | | | -- Oscar Wilde | --------------------------------------------------------------------------

2 3

Automatic report from sources (radiusd) between 28.07.2006 - 29.07.2006 GMT
by Automatic cvs log generator 29 Jul '06

29 Jul '06

CVS log entries from 28.07.2006 (Fri) 08:00:02 - 29.07.2006 (Sat) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/lib/radius.c; Revisions: 1.186 File: radiusd/src/lib/valuepair.c; Revisions: 1.110 File: radiusd/src/include/libradius.h; Revisions: 1.123 File: radiusd/src/include/radius.h; Revisions: 1.82 File: radiusd/src/lib/dict.c; Revisions: 1.91, 1.90 File: radiusd/src/lib/print.c; Revisions: 1.43 ===================================================== Combined list of identical log entries ===================================================== Description: Added support for native "byte" and "short", which are used by some vendors. Added support for VALUE-ALIAS, to minimize the number of copies of VALUEs of the same name, for different ATTRIBUTEs Modified files: File: radiusd/src/include/libradius.h; Revision: 1.123; Date: 2006/07/28 17:34:13; Author: aland; Lines: (+4 -1) File: radiusd/src/include/radius.h; Revision: 1.82; Date: 2006/07/28 17:34:13; Author: aland; Lines: (+3 -1) File: radiusd/src/lib/dict.c; Revision: 1.90; Date: 2006/07/28 17:34:14; Author: aland; Lines: (+179 -10) File: radiusd/src/lib/print.c; Revision: 1.43; Date: 2006/07/28 17:34:14; Author: aland; Lines: (+4 -2) File: radiusd/src/lib/radius.c; Revision: 1.186; Date: 2006/07/28 17:34:14; Author: aland; Lines: (+31 -2) File: radiusd/src/lib/valuepair.c; Revision: 1.110; Date: 2006/07/28 17:34:14; Author: aland; Lines: (+69 -2) ===================================================== Log entries ===================================================== Description: Be smarter and faster about aliases. Don't allow aliases between attributes of differing types. Note that enforcing that the target of the alias has values means that the aliased attribute is of the correct type: integer, etc. Modified files: File: radiusd/src/lib/dict.c; Revision: 1.91; Date: 2006/07/28 21:46:11; Author: aland; Lines: (+44 -38) ===================================================== Summary of modified files ===================================================== File: radiusd/src/include/libradius.h Revisions: 1.123 Authors: aland (+4 -1) ------------------------------- File: radiusd/src/include/radius.h Revisions: 1.82 Authors: aland (+3 -1) ------------------------------- File: radiusd/src/lib/dict.c Revisions: 1.91, 1.90 Authors: aland (+44 -38), aland (+179 -10) ------------------------------- File: radiusd/src/lib/print.c Revisions: 1.43 Authors: aland (+4 -2) ------------------------------- File: radiusd/src/lib/radius.c Revisions: 1.186 Authors: aland (+31 -2) ------------------------------- File: radiusd/src/lib/valuepair.c Revisions: 1.110 Authors: aland (+69 -2) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Passing NAS-Identifier for radius generated stop packets.
by Matthew Schumacher 28 Jul '06

28 Jul '06

List, My radius system uses the NAS-Identifer attribute to make some decisions on how to log or record utmp records. Everything works fine until I have a situation where freeradius generates a stop packet in the session_zap function. Because the stop packet doesn't have the NAS-Identifier attribute it breaks the way I log things. I started hacking together a patch that would pass the NAS-Identifier of the access-request packet, but it doesn't work. Can someone take a look at my patch, or perhaps suggest a better work around? Thanks, schu diff -ruN freeradius-1.1.2.orig/src/include/radiusd.h freeradius-1.1.2/src/include/radiusd.h --- freeradius-1.1.2.orig/src/include/radiusd.h 2005-04-11 15:45:21.000000000 -0800 +++ freeradius-1.1.2/src/include/radiusd.h 2006-07-27 15:02:45.000000000 -0800 @@ -293,7 +293,7 @@ int session_zap(REQUEST *request, uint32_t nasaddr, unsigned int port, const char *user, const char *sessionid, uint32_t cliaddr, - char proto); + char proto, char nas_ident); /* radiusd.c */ #ifndef _LIBRADIUS diff -ruN freeradius-1.1.2.orig/src/main/session.c freeradius-1.1.2/src/main/session.c --- freeradius-1.1.2.orig/src/main/session.c 2006-03-24 08:54:57.000000000 -0900 +++ freeradius-1.1.2/src/main/session.c 2006-07-27 15:02:45.000000000 -0800 @@ -46,7 +46,7 @@ /* End a session by faking a Stop packet to all accounting modules */ int session_zap(REQUEST *request, uint32_t nasaddr, unsigned int port, const char *user, - const char *sessionid, uint32_t cliaddr, char proto) + const char *sessionid, uint32_t cliaddr, char proto, char nas_ident) { REQUEST *stopreq; VALUE_PAIR *vp, *userpair; @@ -103,6 +103,8 @@ INTPAIR(PW_ACCT_INPUT_PACKETS, 0); INTPAIR(PW_ACCT_OUTPUT_PACKETS, 0); + INTPAIR(PW_NAS_IDENTIFIER, nas_ident); + stopreq->username = userpair; stopreq->password = NULL; diff -ruN freeradius-1.1.2.orig/src/modules/rlm_radutmp/rlm_radutmp.c freeradius-1.1.2/src/modules/rlm_radutmp/rlm_radutmp.c --- freeradius-1.1.2.orig/src/modules/rlm_radutmp/rlm_radutmp.c 2004-02-26 10:04:34.000000000 -0900 +++ freeradius-1.1.2/src/modules/rlm_radutmp/rlm_radutmp.c 2006-07-27 15:03:17.000000000 -0800 @@ -589,6 +589,7 @@ rlm_radutmp_t *inst = instance; char login[256]; char filename[1024]; + char nas_ident; /* * Get the filename, via xlat. @@ -656,6 +657,8 @@ ipno = vp->lvalue; if ((vp = pairfind(request->packet->vps, PW_CALLING_STATION_ID)) != NULL) call_num = vp->strvalue; + if ((vp = pairfind(request->packet->vps, PW_NAS_IDENTIFIER)) != NULL) + nas_ident = vp->strvalue; /* * lock the file while reading/writing. @@ -736,7 +739,7 @@ session_zap(request, u.nas_address, u.nas_port, login, session_id, u.framed_address, - u.proto); + u.proto, nas_ident); } } } diff -ruN freeradius-1.1.2.orig/src/modules/rlm_sql/rlm_sql.c freeradius-1.1.2/src/modules/rlm_sql/rlm_sql.c --- freeradius-1.1.2.orig/src/modules/rlm_sql/rlm_sql.c 2006-05-20 04:44:37.000000000 -0800 +++ freeradius-1.1.2/src/modules/rlm_sql/rlm_sql.c 2006-07-27 15:03:46.000000000 -0800 @@ -1132,6 +1132,7 @@ int ret; uint32_t nas_addr = 0; int nas_port = 0; + char nas_ident; /* If simul_count_query is not defined, we don't do any checking */ if (inst->config->simul_count_query[0] == 0) { @@ -1207,7 +1208,8 @@ ipno = vp->lvalue; if ((vp = pairfind(request->packet->vps, PW_CALLING_STATION_ID)) != NULL) call_num = vp->strvalue; - + if ((vp = pairfind(request->packet->vps, PW_NAS_IDENTIFIER)) != NULL) + nas_ident = vp->strvalue; while (rlm_sql_fetch_row(sqlsocket, inst) == 0) { row = sqlsocket->row; @@ -1271,7 +1273,7 @@ session_zap(request, nas_addr,nas_port,row[2],row[1], - framed_addr, proto); + framed_addr, proto, nas_ident); } }

1 1

rlm_dbm with empty check and reply items
by Gabriel L. Somlo 28 Jul '06

28 Jul '06

Alan & all, I want to use rlm_dbm for authorization with no check or reply items. A user is authorized if he is listed in the dbm database, and not authorized if not present: modules { ... dbm { usersfile = ${confdir}/users.dbm } ... } ... authorize { ... dbm { notfound = reject } } So, what I need is a dbm file which has "empty" content associated with each username key. "Empty" actually means a "\n\n" string (first '\n' for no check items, second one for no reply items). I can create such a database by calling dbm routines from my own C code, and it works fine with the radiusd.conf excerpt above. HOWEVER, I would like to use the rlm_dbm_parser binary included with the freeradius package. The trouble is, this code checks for the length of each content record before inserting into the dbm file, and refuses to do so unless the record is more than 3 characters long (rlm_dbm_parser.c, line 158, inside function 'static int storecontent' as per freeradius-snapshot-20060728): static int storecontent (const char * username) { datum d,k; int res; if ( pdb == NULL || concntr < 3 ) return 1; /* ^^^^^^^^^^^^^^ */ DOUT2("store:\n%s\ncontent:\n%s",username,content); d.dptr = content; ... Is there a known good reason why this code wants length >=3, or why it prevents check items and reply items from being empty at the same time ? If yes, inquiring minds want to know :) If not, please apply the attached patch, which modifies the check from < 3 to < 2, allowing "empty" keys to be stored in the dbm. Thanks much, Gabriel

1 0

Firebird sql driver for rlm_sql module
by Vitaly Bodzhgua 28 Jul '06

28 Jul '06

I wrote rlm_sql_firebird driver for rlm_sql module. This driver may work only with Firebird version 1.5.0 and higher, but with small modification (using linker option -lgds instead of -lfbclient) it may be used with lower version of Firebird and Interbase as well. Driver was tested with freeradius 1.0.5 and Firebird 1.5.2 for a month. Also it appeared to work with all stable freeradius versions starting with 1.0.5. So I can contribute the source code if one , who can make such decisions, decides that it is will be not unnecessary for freeradius project.

2 1

freeradius and openssl exception
by Stephen Gran 27 Jul '06

27 Jul '06

Hello all, I'm sorry in advance if this is something that has already been discussed to death. I have been googling around, and I do see some discussion about an openssl exception that took place in 2005, but I don't see any resolution, nor do I see any actual exception in COPYING. Is this something, first of all, that people are either interested in or amenable to? If so, has any progress been made? I ask all this because I recently took over comaintenance of the package for Debian, and there are several modules that we can't ship precompiled right now, as I understand it (eap being the most common, but for some reason postgres is also currently disabled - that needs seperate investigation). If no progress has been made, I would be willing to do some of the leg work sending around a sort of form email to contributors asking for an exception, or whatever you all thought was the best way of handling this. Of course, if you're not agreeable, I guess we just stop here - no hard feelings, but it means back to the drawing board for a gnutls solution or some shim layer. Take care, -- -------------------------------------------------------------------------- | Stephen Gran | Just because you're paranoid doesn't | | steve(a)lobefin.net | mean they AREN'T after you. | | http://www.lobefin.net/~steve | | --------------------------------------------------------------------------

3 7

Automatic report from sources (radiusd) between 26.07.2006 - 27.07.2006 GMT
by Automatic cvs log generator 27 Jul '06

27 Jul '06

CVS log entries from 26.07.2006 (Wed) 08:00:01 - 27.07.2006 (Thu) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/share/dictionary.tropos; Revisions: 1.1, 1.1.2.2, 1.1.2.1 File: radiusd/share/dictionary.walabi; Revisions: 1.1.2.2 File: radiusd/share/dictionary.riverstone; Revisions: 1.1.2.2 File: radiusd/share/dictionary; Revisions: 1.132, 1.93.2.5.2.5 File: radiusd/share/dictionary.alvarion; Revisions: 1.1.2.2 ===================================================== Combined list of identical log entries ===================================================== Description: Merged from CVS head Modified files: File: radiusd/share/dictionary; Revision: 1.93.2.5.2.5; Date: 2006/07/26 23:00:19; Author: aland; Lines: (+5 -1) File: radiusd/share/dictionary.alvarion; Revision: 1.1.2.2; Date: 2006/07/26 23:00:19; Author: aland; Lines: (+310 -0) File: radiusd/share/dictionary.riverstone; Revision: 1.1.2.2; Date: 2006/07/26 23:00:20; Author: aland; Lines: (+42 -0) File: radiusd/share/dictionary.tropos; Revision: 1.1.2.2; Date: 2006/07/26 23:00:20; Author: aland; Lines: (+52 -0) File: radiusd/share/dictionary.walabi; Revision: 1.1.2.2; Date: 2006/07/26 23:00:20; Author: aland; Lines: (+28 -0) ------------------------------- Description: As posted to the list Modified files: File: radiusd/share/dictionary; Revision: 1.132; Date: 2006/07/26 22:57:30; Author: aland; Lines: (+2 -1) File: radiusd/share/dictionary.tropos; Revision: 1.1; Date: 2006/07/26 22:57:30; Author: aland; ===================================================== Log entries ===================================================== Description: file dictionary.tropos was added on branch branch_1_1 on 2006-07-26 23:00:20 +0000 Modified files: File: radiusd/share/dictionary.tropos; Revision: 1.1.2.1; Date: 2006/07/26 22:57:30; Author: aland; Lines: (+0 -52) ===================================================== Summary of modified files ===================================================== File: radiusd/share/dictionary Revisions: 1.132, 1.93.2.5.2.5 Authors: aland (+2 -1), aland (+5 -1) ------------------------------- File: radiusd/share/dictionary.alvarion Revisions: 1.1.2.2 Authors: aland (+310 -0) ------------------------------- File: radiusd/share/dictionary.riverstone Revisions: 1.1.2.2 Authors: aland (+42 -0) ------------------------------- File: radiusd/share/dictionary.tropos Revisions: 1.1, 1.1.2.2, 1.1.2.1 Authors: aland, aland (+52 -0), aland (+0 -52) ------------------------------- File: radiusd/share/dictionary.walabi Revisions: 1.1.2.2 Authors: aland (+28 -0) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

patch for Tropos dictionary
by Rick Dean 26 Jul '06

26 Jul '06

Please accept this patch for a dictionary of Tropos's VSA. -- Rick Dean Tropos Networks

2 1

RE: rlm_ippool and tcp TIME_WAIT state
by Sebastien Cantos 25 Jul '06

25 Jul '06

Hi, Ive coded a little patch for 1.1.2. If someone is interested in this and has some time to test (Ive done lots of tests using radclient) it may be interesting to include the patch in the CVS. Regards, Sebastien. _____ De : Sebastien Cantos [mailto:s.cantos@neopost.com] Envoyé : mercredi 19 juillet 2006 14:17 À : 'freeradius-devel(a)lists.freeradius.org.' Objet : rlm_ippool and tcp TIME_WAIT state Hi, Ive already posted this to the users mailing list, but I think that here is a best place for this. Ive noticed that rlm_ippool is nearly always reassigning an IP address that has just been releasing for a new connexion. This causes some TCP connexion problems because of the TIME_WAIT state. Scenario: 1/ one device connects using source port 1024 (ppp) and gets an IP address from freeradius 2/ this device disconnects, the ip is freed from the pool 3/ another devices connects using source port 1024 and gets the same ip address as before 4/ the connexion is impossible to the server because the connexion of last device is still in TIME_WAIT state How can I make sure an IP address is not assigned before some time period (240 seconds, time period of the TIME_WAIT state) after being released? I got one answer : >Interesting. >The IPs are allocated by a GDBM walk of the database, and use of the first free or expired IP. This will always tend to be the same one hence the repeat >allocations. >It would in theory be possible to save the key from the last walk, and next time we allocate an IP start from that key and wrap back around, which would >allocate IPs in a more round-robin fashion. I would appreciate if someone can help doing the hack or give me some hints to modify rlm_ippool.c to add some retention time parameter to make sure an ip is not reassigned instantly after being freed or to make things work more in a random or round robin way. Thanks in advance. Regards, Sebastien.

2 1