- Freeradius-Devel - lists.freeradius.org

pairmove() patch with multiple vendor-specific attributes
by Geoffrey D. Bennett 13 Jul '06

13 Jul '06

Hi there, I'm using rlm_perl to add custom reply attributes, but there's a problem when I want to return multiple instances of the same attribute, eg.: Cisco-AVPair=lcp:interface-config=service-policy output RATE-512 Cisco-AVPair=lcp:interface-config=service-policy input RATE-128 rlm_perl supports this (it looks out for arrayrefs) but rlmperl_call() calls pairmove() to put the attributes into the reply: if ((get_hv_content(rad_reply_hv, &vp)) > 0 ) { pairmove(&request->reply->vps, &vp); pairfree(&vp); } and pairmove() will "move attributes from one list to the other if not already present". Unfortunately, this means that only the first Cisco-AVPair ends up getting moved. I've attached a patch which makes pairmove() move all vendor-specific attributes. It works for me. The patch says 1.1.1, but it applies to 1.1.2 as well (untested, but I guess it should work -- lib/valuepair.c and rlm_perl.c look similar enough). Thanks, -- Geoffrey D. Bennett, RHCE, RHCX mailto:g@netcraft.com.au Senior Systems Engineer sip:g@netcraft.com.au NetCraft Australia Pty Ltd http://www.netcraft.com.au/geoffrey/

2 1

rlm_digest module - how to return rows in authenticate part
by biuro＠globeinphotos.com 12 Jul '06

12 Jul '06

Hi Because I've encountered some problems with OpenSer-Radius (described in http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg27755.… ) I've started analysis of FreeRadius sources and I've discovered very strange thing. I've compared rlm_digest.c from ver.1.0.1 with 1.1.2 and it was appeared that part descibed as "rlm_digest: Converting Digest-Attributes to something sane..." was moved from digest_authorize function to digest_authenticate . It is almost not important but how to handle such situation when I want return few attribute to client but to set values in attributes I need to know what are values in few attributes from Request eg. from Digest-Method. In current version I cannot return rows with attributes because only one SQL query can be invoked after authotize part - postauth_query (defined in postgres.conf) but this query cannot return list of row it can only return one value. Can you write how to return attributes to client in my situation? P.S As I understand the 'something sane' means that e.g we convert values from Digest-Attributes to Digest-Method. Regards Michal Szymanski

3 3

Freeradius-1.1.1 with CRL configuration
by sumi thra 12 Jul '06

12 Jul '06

Hi All, I want to configure the CRL in freeradius-1.1.1 version. Followed the procedures given in the config file, but the result is not as expected. The configuration in eap.conf are, 1) Copy CA certificates and CRLs to same directory. I appended the crl into CA file 2) Execute 'c_rehash <CA certs&CRLs Directory>'. Is it necessary? But i did this too 3) Add 'CA_path=<CA certs&CRLs directory>' 4) enable the crl check check_crl = yes 5) Restart radiusd CRL says that the client certificate is revoked. But, the user is still able to get authenticated by the radius server. Please let me know if i am missing any configuration. Thanks for your kind help in advance.

1 0

radrelay integration & other issues
by Alan DeKok 10 Jul '06

10 Jul '06

I've been looking into the issues surrounding adding radrelay to the server. While it's made some things better, it's made other things worse. In the future, I'd like to add tacacs+ to RADIUS gatewaying (bug #254), and radsec. After working on it for a while, it appears to be easier and better to do these as separate gateways, rather than integrating them into the server. So... maybe pulling radrelay out of the server isn't a bad idea, either. We could take a page from "radzap", and make radrelay into a tiny program that runs radclient, and sends the data to a server. It could even start the server itself, and monitor the server for process death. So it could still *look* like one program, even if 3-4 are running behind the scenes. That would be simpler and easier to manage. Comments? Flames? Other priorities? Alan DeKok.

2 3

Re:Problem of proxying Vendor Specific Attributes (VSA)!
by Laurent LOINGEVILLE 10 Jul '06

10 Jul '06

Hi everybody! My first question was the following: >I would like to know if there is an option to specify the proxy not deleting the VSA located in the access-reject response of the server >when the proxy send the access-reject to the client?(keep the VSA) >Clearer, currently, my Radius server send to the proxy an access-reject with VSA and when the proxy receive these packet, it send the >same packet to the client so an access-reject packet but with no VSA (it seem to delete them). >So currently, i have: *>Server Radius*>>>*packet access-reject with VSA*>>>>*Proxy Radius*>>>*packet access-reject without VSA>>>>>>**Client Radius * >So what i would like is: *>Server Radius*>>>*packet access-reject with VSA*>>>>*Proxy Radius*>>>*packet access-reject with VSA>>>>>>**Client Radius * ** >Thank you in advance So after that we told me to modify the function rfc_clean in the source code util.c. i've edited the function rfc_clean() in the source code (src/main/util.c) by adding the following line (in bold) but it doesn't work (the client don't receive the VSA: case PW_AUTHENTICATION_REJECT: pairmove2(&vps, &(packet->vps), PW_EAP_MESSAGE); pairmove2(&vps, &(packet->vps), PW_MESSAGE_AUTHENTICATOR); pairmove2(&vps, &(packet->vps), PW_REPLY_MESSAGE); pairmove2(&vps, &(packet->vps), PW_VENDOR_SPECIFIC); Could you please tell me what is wrong? have i to add something else in this procedure?Is there another file to modify? Thanks in advance for your answer!

1 0

Patch: support for custom simultaneous-use reply-message
by Josh Howlett 10 Jul '06

10 Jul '06

I'm re-sending this patch, because I attached the patch previously rather than sending in-line. This patch allows sending a custom reply-message in the event of simultaneous-use. It defines a two new internal attributes (SIMULTANEOUS_REPLY_MESSAGE_ONCE and SIMULTANEOUS_REPLY_MESSAGE_MULTIPLE) which hold the Reply-Message values and two new global config options to define the default values of these attributes. These attributes can be defined as configuration items in the user database to allow per-user messages. best regards, josh. --- freeradius-1.1.2/src/main/auth.c 2005-10-31 17:59:21.000000000 +0000 +++ freeradius-1.1.2-sim-use-reply/src/main/auth.c 2006-07-07 10:39:18.000000000 +0100 @@ -733,12 +733,25 @@ } if (!mpp_ok){ if (check_item->lvalue > 1) { - snprintf(umsg, sizeof(umsg), - "\r\nYou are already logged in %d times - access denied\r\n\n", - (int)check_item->lvalue); - user_msg = umsg; + /* + * Use a Reply-Message appropriate for reporting single session concurrency + */ + tmp = pairfind(request->reply->vps, PW_SIMULTANEOUS_REPLY_MESSAGE_MULTIPLE); + if ( tmp != NULL ){ + user_msg = strdup((char *)tmp->strvalue); + } else { + user_msg = mainconfig.simul_reply_message_multiple; + } } else { - user_msg = "\r\nYou are already logged in - access denied\r\n\n"; + /* + * Use a Reply-Message appropriate for reporting multiple session concurrency + */ + tmp = pairfind(request->reply->vps, PW_SIMULTANEOUS_REPLY_MESSAGE_ONCE); + if ( tmp != NULL ){ + user_msg = strdup((char *)tmp->strvalue); + } else { + user_msg = mainconfig.simul_reply_message_once; + } } request->reply->code = PW_AUTHENTICATION_REJECT; @@ -751,6 +764,20 @@ tmp = pairmake("Reply-Message", user_msg, T_OP_SET); request->reply->vps = tmp; + /* + * Xlat the Reply-Message. + * This is also done for Access-Accepts at line 1000, + * perhaps the code should be refactored to avoid + * this special case? + */ + + reply_item = pairfind(request->reply->vps, PW_REPLY_MESSAGE); + radius_xlat(buf, sizeof(reply_item->strvalue), + (char *)reply_item->strvalue, request, NULL); + strNcpy((char *)reply_item->strvalue, buf, + sizeof(reply_item->strvalue)); + reply_item->length = strlen((char *)reply_item->strvalue); + snprintf(logstr, sizeof(logstr), "Multiple logins (max %d) %s", check_item->lvalue, r == 2 ? "[MPP attempt]" : ""); --- freeradius-1.1.2/src/main/mainconfig.c 2006-04-18 18:26:26.000000000 +0100 +++ freeradius-1.1.2-sim-use-reply/src/main/mainconfig.c 2006-07-07 13:35:07.000000000 +0100 @@ -138,6 +138,8 @@ { "nospace_user", PW_TYPE_STRING_PTR, 0, &mainconfig.do_nospace_user, "no" }, { "nospace_pass", PW_TYPE_STRING_PTR, 0, &mainconfig.do_nospace_pass, "no" }, { "checkrad", PW_TYPE_STRING_PTR, 0, &mainconfig.checkrad, "${sbindir}/checkrad" }, + { "simul_reply_message_once", PW_TYPE_STRING_PTR, 0, &mainconfig.simul_reply_message_once, "\r\nDear %{User-Name}, you are already logged in - access denied\r\n\n" }, + { "simul_reply_message_multiple", PW_TYPE_STRING_PTR, 0, &mainconfig.simul_reply_message_multiple, "\r\nDear %{User-Name}, you are already logged in %{check:Simultaneous-Use} times - access denied\r\n\n" }, { "proxy_requests", PW_TYPE_BOOLEAN, 0, &mainconfig.proxy_requests, "yes" }, { "proxy", PW_TYPE_SUBSECTION, 0, proxy_config, NULL }, { "security", PW_TYPE_SUBSECTION, 0, security_config, NULL }, --- freeradius-1.1.2/share/dictionary.freeradius.internal 2006-03-07 18:10:09.000000000 +0000 +++ freeradius-1.1.2-sim-use-reply/share/dictionary.freeradius.internal 2006-07-05 14:54:07.000000000 +0100 @@ -66,6 +66,8 @@ ATTRIBUTE User-Category 1029 string ATTRIBUTE Group-Name 1030 string ATTRIBUTE Huntgroup-Name 1031 string +ATTRIBUTE Simultaneous-Reply-Message-Once 1032 string +ATTRIBUTE Simultaneous-Reply-Message-Multiple 1033 string ATTRIBUTE Simultaneous-Use 1034 integer ATTRIBUTE Strip-User-Name 1035 integer ATTRIBUTE Hint 1040 string --- freeradius-1.1.2/src/include/radius.h 2006-03-07 18:10:08.000000000 +0000 +++ freeradius-1.1.2-sim-use-reply/src/include/radius.h 2006-07-05 14:21:03.000000000 +0100 @@ -143,6 +143,8 @@ #define PW_USER_CATEGORY 1029 #define PW_GROUP_NAME 1030 #define PW_HUNTGROUP_NAME 1031 +#define PW_SIMULTANEOUS_REPLY_MESSAGE_ONCE 1032 +#define PW_SIMULTANEOUS_REPLY_MESSAGE_MULTIPLE 1033 #define PW_SIMULTANEOUS_USE 1034 #define PW_STRIP_USER_NAME 1035 #define PW_HINT 1040 --- freeradius-1.1.2/raddb/radiusd.conf.in 2006-04-20 19:40:29.000000000 +0100 +++ freeradius-1.1.2-sim-use-reply/raddb/radiusd.conf.in 2006-07-07 11:52:46.000000000 +0100 @@ -352,6 +352,18 @@ nospace_user = no nospace_pass = no +# simul_reply_message_once / simul_reply_message_multiple: +# +# The default values to use for the Reply-Message attribute +# returned if session concurrency is detected. These can be +# over-ridden with the Simultaneous-Reply-Use-Once and +# Simultaneous-Reply-Message-Multiple reply attributes. +# +# The message to return if only a single session is permitted. +simul_reply_message_once = "\r\nDear %{User-Name}, you are already logged in - access denied\r\n\n" +# The message to return is more than one sessions are permitted. +simul_reply_message_multiple = "\r\nDear %{User-Name}, you are already logged in %{check:Simultaneous-Use} times - access denied\r\n\n" + # The program to execute to do concurrency checks. checkrad = ${sbindir}/checkrad --- freeradius-1.1.2/src/include/radiusd.h 2005-04-12 00:45:21.000000000 +0100 +++ freeradius-1.1.2-sim-use-reply/src/include/radiusd.h 2006-07-05 12:50:57.000000000 +0100 @@ -209,6 +209,8 @@ char *nospace_time; char *log_file; char *checkrad; + char *simul_reply_message_once; + char *simul_reply_message_multiple; const char *pid_file; const char *uid_name; const char *gid_name;

1 0

Problem of proxying Vendor Specific Attributes (VSA)!
by Laurent LOINGEVILLE 10 Jul '06

10 Jul '06

Hi! When i receive an access-reject from the radius server (this packet has VSA ), the proxy send back the access-reject to the client but delete the VSA. I tried to modify the file "attrs" by specifying "Vendor-Specific == xxx (our vendor number)" but it doesn't work and i'm not sure if it is the good file to modify. What can i do to indicate the proxy not deleting the VSA when it receive an access-reject from the server? Thanks a lot! ** * *

3 3

Need help regarding date type attribute.
by Vishwanath Srikant Pattanshetti 10 Jul '06

10 Jul '06

Hello all I am using Freeradius 1.1.0 with Oracle 10g for user account management in my project. I am facing following problems. 1. My access accept contains two fields of type date. In the FreeRadius debug messages I see that some date are printed as EST and some are printed as EDT. Does it have anything to do with which month the date belongs to? 2. for a field account-expiry-date I store 'Jan 01 1970' in database table to denote "no expiry" - But in the Radius client program when we try to get the value of this field the value given is always 18000 and not 0 which is expected for date of 'Jan 01 1970' Do any one have a solution for this problem? Will this in any way affect my radius client side, if we are using an external RADIUS server(other than FreeRadius) Any quick help/pointers would be a great help. Thanks and regards. -Vishwa.

1 0

Last set of changes for 1.1.3
by Alan DeKok 10 Jul '06

10 Jul '06

OK, I've fixed rlm_detail. It builds now, sorry. Are there any other issues we need to fix before 1.1.3? RPM spec file fixes? Alan DeKok.

4 7

unsubscribe
by Assa Tal 09 Jul '06

09 Jul '06

-----Original Message----- From: freeradius-devel-bounces+tal.assa=comverse.com(a)lists.freeradius.org [mailto:freeradius-devel-bounces+tal.assa=comverse.com@lists.freeradius. org] On Behalf Of freeradius-devel-request(a)lists.freeradius.org Sent: Sunday, July 09, 2006 1:01 PM To: freeradius-devel(a)lists.freeradius.org Subject: Freeradius-Devel Digest, Vol 15, Issue 6 Send Freeradius-Devel mailing list submissions to freeradius-devel(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-devel or, via email, send a message with subject or body 'help' to freeradius-devel-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-devel-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Devel digest..." Today's Topics: 1. Re: Last set of changes for 1.1.3 (Lin Richardson) ---------------------------------------------------------------------- Message: 1 Date: Sat, 8 Jul 2006 22:53:21 -0600 From: "Lin Richardson" <lin(a)xmission.com> Subject: Re: Last set of changes for 1.1.3 To: freeradius-devel(a)lists.freeradius.org Message-ID: <79a8c65c0607082153n3679d713yb7ab1f438fc12186(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" If you would like a test compile on Solaris, let me know... and give me CVS instructions. On 7/7/06, Nicolas Baradakis <nbk(a)sitadelle.com> wrote: > > Frank Cusack wrote: > > > On July 6, 2006 2:28:27 PM +0200 Nicolas Baradakis > > <nbk(a)sitadelle.com> > > wrote: > > > > > The branch 1.1 fails to build from sources for me. There're still > > > many autoconf 2.13 scripts mixed with autoconf 2.59 scripts. > > > > Can you show a failure? The 2.59/2.13 mix works for me. > > I was seeing those errors: > configure: warning: CFLAGS=-Wall -g -O2: invalid host type > configure: error: can only configure for one host and one target at a > time > configure: error: /bin/sh './configure' failed for ./types/rlm_eap_md5 > > After Alan's fixes and a "cvs up" today, it builds normally. > > -- > Nicolas Baradakis > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/devel.html >

1 0