- Freeradius-Devel - lists.freeradius.org

Check the subject and issuer in the EAP-TLS
by Michal Prochazka 12 May '06

12 May '06

Hello, I'm new to this list and I'm playing with freeradius for about two weeks. I have noticed that there is no possibility to check the subject and issuer of the client certificate. My idea is to use EAP-TLS authN, but allow only some of certificates issued by concrete CA. Two options which are available in EAP-TLS config are not suitable for me. I don't want to revoke the certs and the RE cannot be also used. That's why I created small patch to the freeradius 1.1.0. I've added new option check_script in config of EAP, where can be defined path to the script or application which is executed after successuf TLS authentication. The script/application will recieve in environ variables request packet with two new value pairs: X509_SUBJECT and X509_ISSUER. The EAP-TLS module decide on the returned value of the script/app if the request will be discarded or allowed. I'm open for every remark and enhancement of this patch. I will be glad if this part of code or something similar could be in some of next release of the freeradius. As I see in the user mailing list, there are other people which asking for similar functionality from the freeradius. I'm runnig patched freeradius in our organization and till now works Patch is attached. Best regards, Michal -- Michal Prochazka // michalp(a)ics.muni.cz Supercomputing Center Brno Institute of Computer Science Masaryk University Botanicka 68a, 60200 Brno, CZ CESNET z.s.p.o. Zikova 4, 16200 Praha 6, CZ

1 0

Automatic report from sources (radiusd) between 11.05.2006 - 12.05.2006 GMT
by Automatic cvs log generator 12 May '06

12 May '06

CVS log entries from 11.05.2006 (Thu) 08:00:01 - 12.05.2006 (Fri) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/lib/dict.c; Revisions: 1.86, 1.50.2.4.2.8 ===================================================== Log entries ===================================================== Description: Be a little more careful about returning DICT_VALUEs This closes bug #364 Modified files: File: radiusd/src/lib/dict.c; Revision: 1.86; Date: 2006/05/11 16:25:10; Author: aland; Lines: (+28 -13) ------------------------------- Description: Be a little more careful about returning DICT_VALUEs This closes bug #364 Modified files: File: radiusd/src/lib/dict.c; Revision: 1.50.2.4.2.8; Date: 2006/05/11 16:48:21; Author: aland; Lines: (+19 -3) ===================================================== Summary of modified files ===================================================== File: radiusd/src/lib/dict.c Revisions: 1.86, 1.50.2.4.2.8 Authors: aland (+28 -13), aland (+19 -3) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

enabling syslog service in freeradius-1.1.1
by sumi thra 11 May '06

11 May '06

Hi All, How to send the freeradius server logs to remote syslog server?? Is it a compile time option? or we need to specify in config script to build with syslog option. or starting the server with radiusd -l syslog is enough ? How do i go ahead? Please reply me if you have any idea. Thanks, Sumi

5 12

request_list.c:rl_free_entry() bad pthread_kill()?
by Frank Cusack 10 May '06

10 May '06

What is the intent of the pthread_kill() in rl_free_entry()? AFAICT, child_pid is not in fact a *child* pid, it's a thread id. And in fact, in order for pthread_kill() to work at all, this *must* be the case. So the reason for my question is that sending SIGKILL to any thread in the process does NOT terminate that thread, it terminates the entire process. The only way to force a [POSIX] thread to terminate is to use cancellation, which is complex and would require significant updates to all modules if the intent of this code is to abort any current processing "now"-ish. -frank

2 2

Re: delete_thread() no mutex?
by Frank Cusack 10 May '06

10 May '06

On May 10, 2006 12:14:24 AM -0700 Frank Cusack <fcusack(a)fcusack.com> wrote: > I was wondering why threads.c:thread_pool_clean() doesn't need a mutex > when calling delete_thread(). > > There is a comment just below that, that a mutex isn't needed to read > "the location" -- which I take to mean thread_pool.active_threads -- > as it's only needed to modify the location. > > However, just below that, spawn_thread() is called, which does modify > thread_pool.active_threads and a mutex isn't held to do that. > >> From a quick read (and late at night), ISTM that this is just an error > in documentation. > > a) Only the main thread deals with active_threads and total_threads > (this is a rough guess, not thoroughly explored) > b) There isn't even a mutex to be locked! thread_pool has 2 mutexes, > they are used for different things. > > Sound about right? Or is there indeed some missing locking. After some more study, I'm a little bit off in my explanation. This is the kind of thing that's way easier on a whiteboard, but anyway ... spawn_thread() modifies total_threads, not active_threads, so this is ok. (AFAICT total_threads is only used by the main thread.) active_threads is protected by the queue mutex (should probably be better documented), and in that case I agree with the comment in t_p_clean(). Alan or someone please confirm or argue. But I have a new question. thread_pool_addrequest() uses active_threads to determine if it should spawn, but it doesn't hold the queue mutex. So it could err either way. I'd argue that the log message can be bogus but if you're that much against the limit it doesn't matter. There should just be a comment there about possible stale value. And one last question. Why does total_active_threads walk the entire thread pool? It should just return active_threads. Either way it can return a stale value. I'd go ahead and make those changes but that's hairy part of the server so my confidence about being correct isn't super high. -frank

2 1

Automatic report from sources (radiusd) between 09.05.2006 - 10.05.2006 GMT
by Automatic cvs log generator 10 May '06

10 May '06

CVS log entries from 09.05.2006 (Tue) 08:00:01 - 10.05.2006 (Wed) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/doc/ChangeLog; Revisions: 1.57.2.31.2.18 File: radiusd/src/modules/rlm_eap/mem.c; Revisions: 1.18, 1.14.4.2 Author: fcusack File: radiusd/src/modules/rlm_otp/cardops/cryptocard.h; Revisions: 1.40, 1.37.2.3 File: radiusd/src/modules/rlm_otp/otp_cardops.h; Revisions: 1.44, 1.41.2.3 File: radiusd/src/main/threads.c; Revisions: 1.106 File: radiusd/src/modules/rlm_otp/cardops/cryptocard.c; Revisions: 1.42, 1.39.2.3 File: radiusd/src/modules/rlm_otp/otp_cardops.c; Revisions: 1.65, 1.62.2.3 Author: pnixon File: radiusd/doc/examples/postgresql.sql; Revisions: 1.5 ===================================================== Combined list of identical log entries ===================================================== Description: import from HEAD: update cardops keystring2keyblock method to take a card_info_t * instead of some of its fields Modified files: File: radiusd/src/modules/rlm_otp/otp_cardops.c; Revision: 1.62.2.3; Date: 2006/05/09 08:13:03; Author: fcusack; Lines: (+4 -5) File: radiusd/src/modules/rlm_otp/otp_cardops.h; Revision: 1.41.2.3; Date: 2006/05/09 08:13:04; Author: fcusack; Lines: (+3 -3) File: radiusd/src/modules/rlm_otp/cardops/cryptocard.c; Revision: 1.39.2.3; Date: 2006/05/09 08:13:04; Author: fcusack; Lines: (+5 -6) File: radiusd/src/modules/rlm_otp/cardops/cryptocard.h; Revision: 1.37.2.3; Date: 2006/05/09 08:13:05; Author: fcusack; Lines: (+3 -4) ------------------------------- Description: update cardops keystring2keyblock method to take a card_info_t * instead of some of its fields Modified files: File: radiusd/src/modules/rlm_otp/otp_cardops.c; Revision: 1.65; Date: 2006/05/09 08:08:23; Author: fcusack; Lines: (+3 -4) File: radiusd/src/modules/rlm_otp/otp_cardops.h; Revision: 1.44; Date: 2006/05/09 08:08:23; Author: fcusack; Lines: (+2 -2) File: radiusd/src/modules/rlm_otp/cardops/cryptocard.c; Revision: 1.42; Date: 2006/05/09 08:08:23; Author: fcusack; Lines: (+4 -5) File: radiusd/src/modules/rlm_otp/cardops/cryptocard.h; Revision: 1.40; Date: 2006/05/09 08:08:23; Author: fcusack; Lines: (+2 -3) ------------------------------- Description: Fix linked list code for EAP handlers. Modified files: File: radiusd/src/modules/rlm_eap/mem.c; Revision: 1.18; Date: 2006/05/09 20:59:55; Author: aland; Lines: (+7 -4) File: radiusd/src/modules/rlm_eap/mem.c; Revision: 1.14.4.2; Date: 2006/05/09 20:59:23; Author: aland; Lines: (+7 -4) ===================================================== Log entries ===================================================== Description: Updates Modified files: File: radiusd/doc/ChangeLog; Revision: 1.57.2.31.2.18; Date: 2006/05/09 23:14:33; Author: aland; Lines: (+9 -6) ------------------------------- Description: Add Called/Calling StationId Modified files: File: radiusd/doc/examples/postgresql.sql; Revision: 1.5; Date: 2006/05/09 11:47:10; Author: pnixon; Lines: (+9 -7) ------------------------------- Description: delete_thread(): clarify thread exit comments Modified files: File: radiusd/src/main/threads.c; Revision: 1.106; Date: 2006/05/10 06:40:54; Author: fcusack; Lines: (+9 -13) ===================================================== Summary of modified files ===================================================== File: radiusd/doc/ChangeLog Revisions: 1.57.2.31.2.18 Authors: aland (+9 -6) ------------------------------- File: radiusd/doc/examples/postgresql.sql Revisions: 1.5 Authors: pnixon (+9 -7) ------------------------------- File: radiusd/src/main/threads.c Revisions: 1.106 Authors: fcusack (+9 -13) ------------------------------- File: radiusd/src/modules/rlm_eap/mem.c Revisions: 1.18, 1.14.4.2 Authors: aland (+7 -4), aland (+7 -4) ------------------------------- File: radiusd/src/modules/rlm_otp/cardops/cryptocard.c Revisions: 1.42, 1.39.2.3 Authors: fcusack (+4 -5), fcusack (+5 -6) ------------------------------- File: radiusd/src/modules/rlm_otp/cardops/cryptocard.h Revisions: 1.40, 1.37.2.3 Authors: fcusack (+2 -3), fcusack (+3 -4) ------------------------------- File: radiusd/src/modules/rlm_otp/otp_cardops.c Revisions: 1.65, 1.62.2.3 Authors: fcusack (+3 -4), fcusack (+4 -5) ------------------------------- File: radiusd/src/modules/rlm_otp/otp_cardops.h Revisions: 1.44, 1.41.2.3 Authors: fcusack (+2 -2), fcusack (+3 -3) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

delete_thread() no mutex?
by Frank Cusack 10 May '06

10 May '06

I was wondering why threads.c:thread_pool_clean() doesn't need a mutex when calling delete_thread(). There is a comment just below that, that a mutex isn't needed to read "the location" -- which I take to mean thread_pool.active_threads -- as it's only needed to modify the location. However, just below that, spawn_thread() is called, which does modify thread_pool.active_threads and a mutex isn't held to do that. >From a quick read (and late at night), ISTM that this is just an error in documentation. a) Only the main thread deals with active_threads and total_threads (this is a rough guess, not thoroughly explored) b) There isn't even a mutex to be locked! thread_pool has 2 mutexes, they are used for different things. Sound about right? Or is there indeed some missing locking. -frank

1 0

Automatic report from sources (radiusd) between 08.05.2006 - 09.05.2006 GMT
by Automatic cvs log generator 09 May '06

09 May '06

CVS log entries from 08.05.2006 (Mon) 08:00:01 - 09.05.2006 (Tue) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/modules/rlm_ldap/rlm_ldap.c; Revisions: 1.171, 1.122.2.8.2.7 ===================================================== Combined list of identical log entries ===================================================== Description: Initialize flags. Modified files: File: radiusd/src/modules/rlm_ldap/rlm_ldap.c; Revision: 1.171; Date: 2006/05/08 23:45:49; Author: aland; Lines: (+2 -1) File: radiusd/src/modules/rlm_ldap/rlm_ldap.c; Revision: 1.122.2.8.2.7; Date: 2006/05/08 23:45:02; Author: aland; Lines: (+2 -1) ===================================================== Log entries ===================================================== ===================================================== Summary of modified files ===================================================== File: radiusd/src/modules/rlm_ldap/rlm_ldap.c Revisions: 1.171, 1.122.2.8.2.7 Authors: aland (+2 -1), aland (+2 -1) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 07.05.2006 - 08.05.2006 GMT
by Automatic cvs log generator 08 May '06

08 May '06

CVS log entries from 07.05.2006 (Sun) 08:00:01 - 08.05.2006 (Mon) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: pnixon File: radiusd/doc/examples/postgresql.sql; Revisions: 1.4 ===================================================== Log entries ===================================================== Description: This index modification makes accounting_update_query and accounting_stop_query several orders of magnitude faster at the expense of slowing down accounting_start_query a bit which overall makes the postgresql backend 200-300 times faster when using the defaul queries and schema with a "reasonable" amount of data. Modified files: File: radiusd/doc/examples/postgresql.sql; Revision: 1.4; Date: 2006/05/07 21:37:23; Author: pnixon; Lines: (+3 -3) ===================================================== Summary of modified files ===================================================== File: radiusd/doc/examples/postgresql.sql Revisions: 1.4 Authors: pnixon (+3 -3) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 05.05.2006 - 06.05.2006 GMT
by Automatic cvs log generator 06 May '06

06 May '06

CVS log entries from 05.05.2006 (Fri) 08:00:01 - 06.05.2006 (Sat) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/modules/rlm_preprocess/rlm_preprocess.c; Revisions: 1.67, 1.52.2.1.2.1 ===================================================== Combined list of identical log entries ===================================================== Description: Don't de-reference request->username if it's NULL Modified files: File: radiusd/src/modules/rlm_preprocess/rlm_preprocess.c; Revision: 1.67; Date: 2006/05/05 17:31:28; Author: aland; Lines: (+4 -4) File: radiusd/src/modules/rlm_preprocess/rlm_preprocess.c; Revision: 1.52.2.1.2.1; Date: 2006/05/05 17:31:53; Author: aland; Lines: (+4 -4) ===================================================== Log entries ===================================================== ===================================================== Summary of modified files ===================================================== File: radiusd/src/modules/rlm_preprocess/rlm_preprocess.c Revisions: 1.67, 1.52.2.1.2.1 Authors: aland (+4 -4), aland (+4 -4) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0