- Freeradius-Devel - lists.freeradius.org

Authentication by validating RADIUS attribute value
by Hariharan R 08 Jul '06

08 Jul '06

1 0

Patch: custom Reply-Message for simultaneous-use
by Josh Howlett 07 Jul '06

07 Jul '06

Please find attached a patch against FR-1.1.2 to allow returning a custom (and xlat'd) Reply-Message attribute in the event of Simultaneous-Use. I've defined a couple of additional internal attributes, and a couple of new global configuration options that define the default Reply- Message values (one for the case where only a single session is permitted, and one for the case where >1 sessions are permitted). best regards, josh. Josh Howlett, Networking Specialist, University of Bristol. email: josh.howlett(a)bristol.ac.uk | phone: +44 (0)7867 907076 | internal: 7850

1 0

Issues with bug#235
by Kevin Bonner 06 Jul '06

06 Jul '06

I've been working to merge our auth and acct configs into one (previously we ran each on separate servers), and I am hitting bug#235. I snagged the rlm_sql.c changes from CVS and rebuilt 1.1.2. My sql.conf config looks like: sql sqlX { deletestalesessions = no simul_count_query = "select count(*) from radacct where ..." simul_verify_query = "select ... from radacct where ..." } Looking at rlm_sql.c (near line 1386 in the CVS head), we see: if (inst->config->deletestalesessions == FALSE || inst->config->simul_verify_query[0] == '\0') { sql_release_socket(inst, sqlsocket); return RLM_MODULE_OK; } Since the deletestalesessions check evaluates to true, the code never enters the section to verify any of the sessions found. This changes the behavior from all FreeRADIUS releases. Should this be fixed, is this the desired result, or am I forgetting something simple? Kevin Bonner

2 2

proxy deleting the attributes valu pair??
by Laurent LOINGEVILLE 30 Jun '06

30 Jun '06

Hi ! I've got the following chain: *client>>>>>proxy>>>>>>Server*. When the proxy send back the response of the server to the client, it delete the attributes value pair. What can i do to force the proxy not to delete the attributes? Thanks a lot!

2 3

deleting or xlat not configure?
by Laurent LOINGEVILLE 30 Jun '06

30 Jun '06

*Hi ! I've got the following chain: client>>>>>proxy>>>>>>Server. When the proxy send back the response of the server(reject message) to the client, it delete the attributes value pair. What can i do to force the proxy not to delete the attributes?* ** In fact, i think the radius proxy doesn't re-copy the attribute value-pair of the radius server on the interface where is connected the client. I thought that it was in the xlat section of the radiusd.conf file but it doesn't work. I have maybe make a bad manipulation? Do you have an idea? Thank you

1 0

specify an interface to proxy!
by Laurent LOINGEVILLE 28 Jun '06

28 Jun '06

Hi! Is it possible to specify on a proxy freeradius on which interface proxy the request? Thanks a lot!

3 3

Bug in libs/valuepair.c pairmake function
by Mitchell, Michael J 28 Jun '06

28 Jun '06

Hi Alan and developers, I've found a small bug in libs/valuepair.c in the pairmake() function when trying to call pairmake on an attribute with a tag (eg tunnel attributes from dictionary.tunnel). For example pairmake("Tunnel-Preference:1", "1", T_OP_EQ) The code searches for a ":" in the attribute name which has been passed in, and if it finds a valid tag, sets the position of the ":" to 0 (a null). However, the attribute name is declared as a "const char *". I resolved the issue by doing a strdup on the attribute name to a local char * variable and then using that variable in the rest of the function. Making attribute non const doesn't seem like a good idea. cheers, Mike

1 0

Pb concerning the re-sending interfaces in proxy radius configuration
by Laurent LOINGEVILLE 27 Jun '06

27 Jun '06

Hi! I'va installed freeradius on my Computer as a reverse proxy.This computer has 2 network interfaces (eth0 and eth1).The problem is this one: -the proxy receive the radius packet on the front interface (eth0) but can't re-send the packet on the eth1 interface. The configuration of the proxy seems to be good because this one display to me a message telling: "re-sending" the packet to 192.168.2.1 (radius server).Moreover, there is a rule in the routing table in order to go to the server 192.168.2.1.If i launch a tcpdump on the eth1 interface, no packet are leaving. Is there something to do in the configuration of the proxy to tell him the interface to re-send the packets? Thanks a lot in advance! Cordialy

2 1

Custom Reply-Message for Simultaneous-Use
by Josh Howlett 27 Jun '06

27 Jun '06

Hi, I need to be able to return a user-specific Reply-Message attribute in the event of simultaneous-use being detected. In auth.c, this message is currently hard-coded. I'm considering the following approach: if sim-use is detected, look for a new attribute in the reply items list whose value is the custom message. If it exists, use it for the Reply-Message; if not, use the existing hard-coded value. Is this a sensible approach? If not, what should I do? Many thanks, josh. Josh Howlett, Networking Specialist, University of Bristol. email: josh.howlett(a)bristol.ac.uk | phone: +44 (0)7867 907076 | interal: 7850

4 4

Re: lt_dllopenext() returns invalid handle (was: 1.1.2 is broken if you have closefrom() )
by Frank Cusack 26 Jun '06

26 Jun '06

On June 15, 2006 4:30:19 PM -0400 Alan DeKok <aland(a)nitros9.org> wrote: > Frank Cusack <fcusack(a)fcusack.com> wrote: >> Dunno if you didn't find time, or weren't able to reproduce it > > I couldn't bear the though of fighting with that crap again. > > Look at the code, it does the following: > > ... > strcat (tmp, archive_ext); > errors = try_dlopen (&handle, tmp); > if (errors) return 0; > > /* If we found FILENAME, stop searching -- whether we were able to > load the file as a module or not. If the file exists but loading > failed, it is better to return an error message here than to > report FILE_NOT_FOUND when the alternatives (foo.so etc) are not > in the module search path. */ > if (handle || ((errors > 0) && !file_not_found ())) > { > LT_DLFREE (tmp); > return handle; > } > ... > > Note that if (errors > 0) AND the file was found, it returns the > handle. i.e. It finds the CURRENT library, but not one that the > current library needs. > > The idea of returning the handle if (errors > 0) is something that > is mind-blowingly retarded. If the file was found, but errors > 0, handle is supposed to be NULL. I couldn't find a case (from inspection) where this isn't true. Dependencies are loaded before the library itself is loaded (if there is a .la file and dependencies are known), and if this fails handle is returned as NULL. If dependencies are not known, the system dlopen() is used which will implicitly load dependencies, and again, fail and return NULL if a dependency cannot be loaded. Apparently, it CAN happen that handle is not NULL, but I have to assume that this line of code doesn't think that can happen. (Because of course, it is a pretty bad idea to return a non-NULL handle on failure, and ltdl is obviously not written by idiots.) You can't just read this one line of code and say "handle is returned!", you have to look at what is expected from try_dlopen(). >> But anyway, it looks easy to address in freeradius (as opposed to >> ltdl.c) so I'm going to try that. > > I don't see how. The problem is that the handle is returned, but is > NOT completely populated. So ltdl_sym() de-references a NULL entry in > the handle, and dies. > > Since the handle structure is opaque, it's impossible for FreeRADIUS > to know if the returned handle is OK, is is broken. So I have no idea > how you would handle this in FreeRADIUS. Bah. I didn't realize lt_dlhandle was opaque (because how does gdb know what it looks like). phooey. OK, we'll need to patch ltdl.c, but otherwise (ie autoconf stuff) we can still get away with untouched original source. -frank

5 11