- Freeradius-Devel - lists.freeradius.org

Automatic report from sources (radiusd) between 31.03.2006 - 31.03.2006 GMT
by Automatic cvs log generator 31 Mar '06

31 Mar '06

CVS log entries from 31.03.2006 (Fri) 03:39:57 - 31.03.2006 (Fri) 09:00:01 GMT ===================================================== Summary by authors ===================================================== Author: mgriego File: radiusd/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c; Revisions: 1.28 File: radiusd/raddb/eap.conf; Revisions: 1.7 File: radiusd/src/modules/rlm_eap/libeap/eap_tls.h; Revisions: 1.3 ===================================================== Combined list of identical log entries ===================================================== Description: Add option to specify TLS cipher list Modified files: File: radiusd/src/modules/rlm_eap/libeap/eap_tls.h; Revision: 1.3; Date: 2006/03/31 03:54:31; Author: mgriego; Lines: (+2 -1) File: radiusd/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c; Revision: 1.28; Date: 2006/03/31 03:53:36; Author: mgriego; Lines: (+13 -1) ===================================================== Log entries ===================================================== Description: Add cipher_list option for setting the allowed TLS cipher suites. Modified files: File: radiusd/raddb/eap.conf; Revision: 1.7; Date: 2006/03/31 03:59:06; Author: mgriego; Lines: (+6 -1) ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/eap.conf Revisions: 1.7 Authors: mgriego (+6 -1) ------------------------------- File: radiusd/src/modules/rlm_eap/libeap/eap_tls.h Revisions: 1.3 Authors: mgriego (+2 -1) ------------------------------- File: radiusd/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c Revisions: 1.28 Authors: mgriego (+13 -1) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Choice of TLS ciphersuite
by Thomas Otto 31 Mar '06

31 Mar '06

Hi all! I'd like to do some EAP method performance measurements with wpa_supplicant and freeradius. In the ClientHello, the supplicant sends a list of ciphersuites, with the most preferred on top, it begins with Cipher Suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x0039) Cipher Suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA (0x0038) Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035) Cipher Suite: TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA (0x0016) Cipher Suite: TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA (0x0013) Cipher Suite: TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000a) The freeradius Server, however, always selects 0x0035. Where can I modify on freeradius side the choice? Thanks Thomas

3 4

radeapclient broken compilation
by Alin Nastac 30 Mar '06

30 Mar '06

Hi, Anyone could suggest a fix for the bug http://bugs.freeradius.org/show_bug.cgi?id=350 ? Regards, Alin

3 8

patch to rlm_sql
by onespell＠yandex.ru 30 Mar '06

30 Mar '06

Here is patch to rlm_sql.c and rlm_sql/conf.h which adds support of postproxy_query: *** ./conf.h Thu Apr 29 00:55:16 2004 --- ./conf.h Thu Mar 30 10:42:29 2006 *************** *** 50,55 **** --- 50,56 ---- int query_on_not_found; char *sql_postauth_table; char *postauth_query; + char *postproxy_query; char *allowed_chars; /* individual driver config */ *** ./rlm_sql.c Tue Dec 13 16:11:53 2005 --- ./rlm_sql.c Thu Mar 30 10:49:58 2006 *************** *** 131,136 **** --- 131,138 ---- offsetof(SQL_CONFIG,sql_postauth_table), NULL, "radpostauth"}, {"postauth_query", PW_TYPE_STRING_PTR, offsetof(SQL_CONFIG,postauth_query), NULL, ""}, + {"postproxy_query", PW_TYPE_STRING_PTR, + offsetof(SQL_CONFIG,postproxy_query), NULL, ""}, {"safe-characters", PW_TYPE_STRING_PTR, offsetof(SQL_CONFIG,allowed_chars), NULL, "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /"}, *************** *** 1347,1352 **** --- 1349,1400 ---- return RLM_MODULE_OK; } + /* + * Execute postproxy_query after authentication + */ + static int rlm_sql_postproxy(void *instance, REQUEST *request) { + SQLSOCK *sqlsocket = NULL; + SQL_INST *inst = instance; + char querystr[MAX_QUERY_LEN]; + char sqlusername[MAX_STRING_LEN]; + + DEBUG("rlm_sql (%s): Processing sql_postproxy", inst->config->xlat_name); + + if(sql_set_user(inst, request, sqlusername, 0) <0) + return RLM_MODULE_FAIL; + + /* If postproxy_query is not defined, we stop here */ + if (inst->config->postproxy_query[0] == '\0') + return RLM_MODULE_NOOP; + + /* Expand variables in the query */ + memset(querystr, 0, MAX_QUERY_LEN); + radius_xlat(querystr, sizeof(querystr), inst->config->postproxy_query, + request, sql_escape_func); + query_log(request, inst, querystr); + DEBUG2("rlm_sql (%s) in sql_postproxy: query is %s", + inst->config->xlat_name, querystr); + + /* Initialize the sql socket */ + sqlsocket = sql_get_socket(inst); + if (sqlsocket == NULL) + return RLM_MODULE_FAIL; + + /* Process the query */ + if (rlm_sql_query(sqlsocket, inst, querystr)) { + radlog(L_ERR, "rlm_sql (%s) in sql_postproxy: Database query error - %s", + inst->config->xlat_name, + (char *)(inst->module->sql_error)(sqlsocket, inst->config)); + sql_release_socket(inst, sqlsocket); + return RLM_MODULE_FAIL; + } + (inst->module->sql_finish_query)(sqlsocket, inst->config); + + sql_release_socket(inst, sqlsocket); + return RLM_MODULE_OK; + } + + /* globally exported name */ module_t rlm_sql = { "SQL", *************** *** 1360,1368 **** rlm_sql_accounting, /* accounting */ rlm_sql_checksimul, /* checksimul */ NULL, /* pre-proxy */ ! NULL, /* post-proxy */ rlm_sql_postauth /* post-auth */ }, rlm_sql_detach, /* detach */ rlm_sql_destroy, /* destroy */ }; --- 1408,1419 ---- rlm_sql_accounting, /* accounting */ rlm_sql_checksimul, /* checksimul */ NULL, /* pre-proxy */ ! rlm_sql_postproxy, /* post-proxy */ rlm_sql_postauth /* post-auth */ }, rlm_sql_detach, /* detach */ rlm_sql_destroy, /* destroy */ }; + + +

1 0

Re: Version 1.1.1 stops responding
by Stefan Winter 29 Mar '06

29 Mar '06

Hi Alan, (moved to -devel) thanks for the gdb refresher - I keep forgetting those args :-) I'm not sure I'm overly helpful here, but I think I _might_ have something. I set up an instance of 1.1.1 on my workstation, ran gdb radiusd set args -X run and then sent a HUP from another console. In gdb, continue Program received signal SIGHUP, Hangup. [Switching to Thread 16384 (LWP 29536)] 0xb7e0f5d2 in select () from /lib/libc.so.6 (gdb) cont Continuing. --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. Reloading configuration files. reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms Program received signal SIGINT, Interrupt. and then I experienced that during the re-reading of config files, the process just froze, but no segfault (sending garbage with nc, which should make radiusd complain, but doesn't... no trace of anything being processed). After Ctrl-C and bt, I got: (gdb) bt #0 0xb7e0f5d2 in select () from /lib/libc.so.6 #1 0xbff68d50 in ?? () #2 0x0806d310 in ?? () #3 0x0806d068 in ?? () #4 0x0805743e in main (argc=2, argv=0xbff69e34) at radiusd.c:1276 (gdb) info threads * 1 Thread 16384 (LWP 29536) 0xb7e0f5d2 in select () from /lib/libc.so.6 So for some reason it got stuck during select() - I watched this being stuck for several seconds before I killed the process. So there appears to be a deadlock in there. Not sure if it has anything to do with the TLS hang; it's just that the symptoms seem similar. The select() waiting forever would explain that the process is still there, bound to its ports, but does nothing. Greetings, Stefan Winter -- Stefan WINTER RESTENA Foundation - Réseau Téléinformatique de l'Education Nationale et de la Recherche R&D Engineer 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg email: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

2 3

Certificate based authentication in rlm_ldap
by Rahul Srinivas 29 Mar '06

29 Mar '06

Hi, The rlm_ldap module accepts the configuration parameters "tls_certfile" and "tls_keyfile" in radiusd.conf. But in the code, after setting the LDAP options LDAP_OPT_X_TLS_CERTFILE and LDAP_OPT_X_TLS_KEYFILE, 'ldap_bind' is done with a password (LDAP_AUTH_SIMPLE). Shouldn't a 'ldap_sasl_bind' be done whenever the certificate and key are specified ? Regards, -Rahul S.

1 0

Having multiple authentication query in sql.conf
by vignesh 28 Mar '06

28 Mar '06

Hello all Can I have multiple authentication queries in sql.conf file. There are different ways by which we want to autheticate the users. I will let you know what I exactly want. I want to authenticate users based on the CLID and the remote ip address. The problem is that the remote address has to be searched from a set of ips. I will give you a example Suppose that we have a user 9204 and if the call for this particular user comes from a set of ips like 222.223.33.24 or 33.44.334.44( which will be present in some database tables) etc only then user will be authenticated. Vignesh

1 0

using env variables
by Pezhman Lali 25 Mar '06

25 Mar '06

hi using env. Vars to transfer radius packets to the aaa scripts (PHP), has any unknown bug? any confliction between received packets? --------------------------------- New Yahoo! Messenger with Voice. Call regular phones from your PC for low, low rates.

1 0

1.1.0: Bug in rlm_sql.c OR sql.conf templates
by Stefan Winter 21 Mar '06

21 Mar '06

Hi, this is a rather annoying bug that has create a whole lot of confusion in my accounting tables: See rlm_sql.c static CONF_PARSER module_config[] = { ... {"acct_table", PW_TYPE_STRING_PTR, offsetof(SQL_CONFIG,sql_acct_table), NULL, "radacct"}, {"acct_table2", PW_TYPE_STRING_PTR, offsetof(SQL_CONFIG,sql_acct_table2), NULL, "radacct"}, ... i.e. the configuration items for the accounting tables are called "acct_table" and "acct_table2". But the sql.conf template says: acct_table1 = "radacct" acct_table2 = "radacct" and later all the query templates refer to acct_table1. The outcome is that the server claims to write his UPDATE to the content of variable acct_table1 (even in -X debug output, because there the xlat's "expands to" is printed and that uses acct_table1 for expansion), but the sql module actually always writes to the default "radacct" (unless you are clever enough to add a configuration item "acct_table" that is in sync with "acct_table1". The bug is a little hard to spot, since it will only show if you make acct_table1 not use the default "radacct". Please fix this for 1.1.1 if it's not tagged already. My suggested fix is, naturally, a one-liner: < {"acct_table", PW_TYPE_STRING_PTR, > {"acct_table1", PW_TYPE_STRING_PTR, Greetings, Stefan Winter -- Stefan WINTER RESTENA Foundation - Réseau Téléinformatique de l'Education Nationale et de la Recherche R&D Engineer 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg email: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

3 3

Re: Config file varable substitution.
by Guy Fraser 21 Mar '06

21 Mar '06

On Mon, 2006-20-03 at 17:58 +0200, Andrey Kotrekhov wrote: > Guy Fraser wrote: > > >I am working on a program to read the config files. > > > > > > > see libConfig++ on www.sourceforge.net > It may be what you want. Thank you for the suggestion, but I am finished already. I thought I specified that I was using PHP4. I have successfully built functions to : a) Recursively read radiusd.conf and all included files and build an array containing all the variables with expanded values as well as every entry from all the files. b) Generate a formatted output that is a reasonable facsimile of the original files maintaining the correct number of lines and all comments for each file. The entire program is 562 lines including gratuitous comments debugging and a main program for testing. On the old PIII I use for RnD it takes just over a second to read the 2086 lines of data from the 4 files I am using, and print all the regenerated output including all of the comments and blank lines. The generated array is simple to use and is designed to make accessing the raw or expanded data very easy. It would be fairly simple to build an sql table from the array, if one wanted to. Using this system I should be able to easily create a management system that will allow someone to change anything in radiusd.conf or any included file and replace the line(s) with a systematically formatted replacement in the correct file. Once I get a development site up, I will make the source available, but for now, I need to build functions to access the other file formats like the users file(s) and the dictionaries, they are fairly simple so it shouldn't take long. TTFN

1 0