January 2014 - Freeradius-Users - lists.freeradius.org

Write 3GPP attributes accounting into mysql problem
by bit1 16 Jan '14

16 Jan '14

Hi Freeradius-Users May be some of you facing with this problem, but I haven't a proper solution yet. I have a freeradius 2.2.0 and mysql 5.5.28. I would like to write (and of course aggregate) accounting records into mysql db. I 'v tried to modify the dialup.conf to extract the 3GPP radius attributes as well as the standard attributes (appended extra fields, db schema modified as well). accounting_start_query = " \ INSERT INTO ${acct_table1} \ (acctsessionid, acctuniqueid, username, \ realm, nasipaddress, nasportid, \ nasporttype, acctstarttime, acctstoptime, \ acctsessiontime, acctauthentic, connectinfo_start, \ connectinfo_stop, acctinputoctets, acctoutputoctets, \ calledstationid, callingstationid, acctterminatecause, \ servicetype, framedprotocol, framedipaddress, \ acctstartdelay, acctstopdelay, xascendsessionsvrkey, test,fullpacket) \ VALUES \ ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', \ '%{SQL-User-Name}', \ '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', \ '%{NAS-Port-Type}', '%S', NULL, \ '0', '%{Acct-Authentic}', '%{Connect-Info}', \ '', '0', '0', \ '%{Called-Station-Id}', '%{Calling-Station-Id}', '', \ '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', \ '%{%{Acct-Delay-Time}:-0}', '0', '0','%{request:3GPP-IMSI}','%Z')" But the '%{request:3GPP-IMSI}' does not work, it is empty, however the '%Z' countains the full accounting packet. It seems the 3GPP-* runtime variable does not get value or may be the format is wrong. I'v made a not so elegant solution with mysql-udf-preg and regexped the necessary attribs from full packet , but i think it could be too slow with more attribs/inserts. Do you have any idea how to solve this issue? Dohány Tibor mailto:bit1@freemail.hu

5 21

SQL schema for radcheck table
by Matt Zagrabelny 15 Jan '14

15 Jan '14

Greetings, Looking at the file raddb/mods-config/sql/main/postgresql/schema.sql in the git repo, I see: CREATE TABLE radcheck ( id serial PRIMARY KEY, UserName text NOT NULL DEFAULT '', Attribute text NOT NULL DEFAULT '', op VARCHAR(2) NOT NULL DEFAULT '==', Value text NOT NULL DEFAULT '' ); Is the "id" field used by FR? Or does it exist for administration of the table in case someone enters two records with identical (UserName, Attribute, op, Values) values? Thanks, -mz

2 2

Gradual increase in memory usage
by Бен Томпсон 15 Jan '14

15 Jan '14

Hello everyone I have an instance of FreeRADIUS which is gradually consuming memory. The version is as follows: radiusd: FreeRADIUS Version 2.2.4 (git #b15a660), for host x86_64-unknown-linux-gnu, built on Dec 27 2013 at 12:46:27 I ran it in valgrind but I am not sure how to interprete the output: ==00:00:00:55.539 15239== 4 bytes in 1 blocks are definitely lost in loss record 1 of 547 ==00:00:00:55.539 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.540 15239== by 0x422CB8: rad_malloc (util.c:347) ==00:00:00:55.540 15239== by 0x746050C: ??? ==00:00:00:55.540 15239== by 0x41A832: find_module_instance (modules.c:620) ==00:00:00:55.540 15239== by 0x41C6B2: do_compile_modsingle (modcall.c:1963) ==00:00:00:55.540 15239== by 0x41C298: do_compile_modgroup (modcall.c:2184) ==00:00:00:55.540 15239== by 0x41AB1C: T.125 (modules.c:785) ==00:00:00:55.540 15239== by 0x41AEE9: load_component_section (modules.c:887) ==00:00:00:55.540 15239== by 0x41B1DB: load_byserver (modules.c:1109) ==00:00:00:55.540 15239== by 0x41B6F4: virtual_servers_load (modules.c:1244) ==00:00:00:55.540 15239== by 0x41B93F: setup_modules (modules.c:1568) ==00:00:00:55.540 15239== by 0x419405: read_mainconfig (mainconfig.c:973) ==00:00:00:55.540 15239== ==00:00:00:55.541 15239== 32 bytes in 1 blocks are definitely lost in loss record 426 of 547 ==00:00:00:55.541 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.541 15239== by 0x422CB8: rad_malloc (util.c:347) ==00:00:00:55.541 15239== by 0x746049C: ??? ==00:00:00:55.541 15239== by 0x41A832: find_module_instance (modules.c:620) ==00:00:00:55.541 15239== by 0x41C6B2: do_compile_modsingle (modcall.c:1963) ==00:00:00:55.541 15239== by 0x41C298: do_compile_modgroup (modcall.c:2184) ==00:00:00:55.541 15239== by 0x41AB1C: T.125 (modules.c:785) ==00:00:00:55.541 15239== by 0x41AEE9: load_component_section (modules.c:887) ==00:00:00:55.541 15239== by 0x41B1DB: load_byserver (modules.c:1109) ==00:00:00:55.541 15239== by 0x41B6F4: virtual_servers_load (modules.c:1244) ==00:00:00:55.541 15239== by 0x41B93F: setup_modules (modules.c:1568) ==00:00:00:55.541 15239== by 0x419405: read_mainconfig (mainconfig.c:973) ==00:00:00:55.541 15239== ==00:00:00:55.541 15239== 128 bytes in 1 blocks are definitely lost in loss record 454 of 547 ==00:00:00:55.541 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.541 15239== by 0x76F6C45: Perl_safesysmalloc (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x76FB783: Perl_my_cxt_init (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x77988CE: boot_DynaLoader (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x770E704: Perl_pp_entersub (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x770CC45: Perl_runops_standard (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x76B0D0E: Perl_call_sv (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x76B124C: Perl_call_list (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x769D348: ??? (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x76AAE91: Perl_newATTRSUB (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x76A9E12: Perl_utilize (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x76D8D85: Perl_yyparse (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== ==00:00:00:55.541 15239== 144 bytes in 18 blocks are definitely lost in loss record 458 of 547 ==00:00:00:55.541 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.541 15239== by 0x76F6C45: Perl_safesysmalloc (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x76F6D06: Perl_savepvn (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x771857C: Perl_rvpv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7717627: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x77179F3: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x77179F3: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7717E00: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7718A30: Perl_gp_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7717F89: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7709E79: Perl_he_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7709E3A: Perl_he_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== ==00:00:00:55.541 15239== 144 bytes in 18 blocks are definitely lost in loss record 459 of 547 ==00:00:00:55.541 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.541 15239== by 0x76F6C45: Perl_safesysmalloc (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x76F6D06: Perl_savepvn (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x771857C: Perl_rvpv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7717627: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x76DC3F9: Perl_re_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x77187F6: Perl_mg_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7717C72: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x771852F: Perl_rvpv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x77176C9: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7718960: Perl_gp_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7717F89: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== ==00:00:00:55.541 15239== 184 (136 direct, 48 indirect) bytes in 1 blocks are definitely lost in loss record 469 of 547 ==00:00:00:55.541 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.541 15239== by 0x422CB8: rad_malloc (util.c:347) ==00:00:00:55.541 15239== by 0x410F71: listen_alloc (listen.c:1735) ==00:00:00:55.541 15239== by 0x415A8B: proxy_new_listener (listen.c:1838) ==00:00:00:55.541 15239== by 0x42C988: home_server_create_callback (realms.c:2256) ==00:00:00:55.541 15239== by 0x4E3C3D1: WalkNodeInOrder (rbtree.c:551) ==00:00:00:55.541 15239== by 0x42C952: home_server_create_listeners (realms.c:2282) ==00:00:00:55.541 15239== by 0x415FEB: listen_init (listen.c:2323) ==00:00:00:55.541 15239== by 0x428C81: radius_event_init (event.c:3701) ==00:00:00:55.541 15239== by 0x41E941: main (radiusd.c:346) ==00:00:00:55.541 15239== ==00:00:00:55.541 15239== 384 bytes in 3 blocks are definitely lost in loss record 486 of 547 ==00:00:00:55.541 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.541 15239== by 0x76F6C45: Perl_safesysmalloc (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x77287C2: perl_clone (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x745E959: ??? ==00:00:00:55.541 15239== by 0x745EF78: ??? ==00:00:00:55.541 15239== by 0x41D9B5: modcall_recurse (modcall.c:305) ==00:00:00:55.541 15239== by 0x41D499: modcall_child (modcall.c:423) ==00:00:00:55.541 15239== by 0x41D65F: modcall_recurse (modcall.c:628) ==00:00:00:55.541 15239== by 0x41E36B: modcall (modcall.c:877) ==00:00:00:55.541 15239== by 0x41A342: indexed_modcall (modules.c:750) ==00:00:00:55.541 15239== by 0x409927: rad_authenticate (auth.c:580) ==00:00:00:55.541 15239== by 0x42B27D: radius_handle_request (event.c:3838) ==00:00:00:55.541 15239== ==00:00:00:55.541 15239== 528 bytes in 2 blocks are possibly lost in loss record 497 of 547 ==00:00:00:55.541 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.541 15239== by 0x76F6C45: Perl_safesysmalloc (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x76F6D06: Perl_savepvn (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x771857C: Perl_rvpv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7717627: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x76DC3A5: Perl_re_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7727047: perl_clone (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x745E959: ??? ==00:00:00:55.541 15239== by 0x745EF78: ??? ==00:00:00:55.541 15239== by 0x41D9B5: modcall_recurse (modcall.c:305) ==00:00:00:55.541 15239== by 0x41D499: modcall_child (modcall.c:423) ==00:00:00:55.541 15239== by 0x41D65F: modcall_recurse (modcall.c:628) ==00:00:00:55.541 15239== ==00:00:00:55.541 15239== 1,056 bytes in 4 blocks are possibly lost in loss record 520 of 547 ==00:00:00:55.541 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.541 15239== by 0x76F6C45: Perl_safesysmalloc (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x76F6D06: Perl_savepvn (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x771857C: Perl_rvpv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7717627: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x76DC3F9: Perl_re_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7727047: perl_clone (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x745E959: ??? ==00:00:00:55.541 15239== by 0x745EF78: ??? ==00:00:00:55.541 15239== by 0x41D9B5: modcall_recurse (modcall.c:305) ==00:00:00:55.541 15239== by 0x41D499: modcall_child (modcall.c:423) ==00:00:00:55.541 15239== by 0x41D65F: modcall_recurse (modcall.c:628) ==00:00:00:55.541 15239== ==00:00:00:55.541 15239== 1,440 bytes in 180 blocks are definitely lost in loss record 524 of 547 ==00:00:00:55.541 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.541 15239== by 0x76F6C45: Perl_safesysmalloc (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x76F6D06: Perl_savepvn (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x771857C: Perl_rvpv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7717627: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x77179F3: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x77179F3: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7717E00: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7718A30: Perl_gp_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7717F89: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7709E79: Perl_he_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7717AE3: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== ==00:00:00:55.541 15239== 1,764 (656 direct, 1,108 indirect) bytes in 2 blocks are definitely lost in loss record 528 of 547 ==00:00:00:55.541 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.541 15239== by 0x422CB8: rad_malloc (util.c:347) ==00:00:00:55.541 15239== by 0x422CEA: request_alloc (util.c:377) ==00:00:00:55.541 15239== by 0x42BD76: received_request (event.c:2980) ==00:00:00:55.541 15239== by 0x417394: auth_socket_recv (listen.c:859) ==00:00:00:55.542 15239== by 0x42C8AD: event_socket_handler (event.c:3483) ==00:00:00:55.542 15239== by 0x4E4293A: fr_event_loop (event.c:415) ==00:00:00:55.542 15239== by 0x41EA09: main (radiusd.c:422) ==00:00:00:55.542 15239== ==00:00:00:55.542 15239== 1,920 bytes in 15 blocks are definitely lost in loss record 529 of 547 ==00:00:00:55.542 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.542 15239== by 0x76F6C45: Perl_safesysmalloc (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x77287C2: perl_clone (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x745E959: ??? ==00:00:00:55.542 15239== by 0x745EF78: ??? ==00:00:00:55.542 15239== by 0x41D9B5: modcall_recurse (modcall.c:305) ==00:00:00:55.542 15239== by 0x41D499: modcall_child (modcall.c:423) ==00:00:00:55.542 15239== by 0x41D65F: modcall_recurse (modcall.c:628) ==00:00:00:55.542 15239== by 0x41E36B: modcall (modcall.c:877) ==00:00:00:55.542 15239== by 0x41A342: indexed_modcall (modules.c:750) ==00:00:00:55.542 15239== by 0x4091D7: rad_accounting (acct.c:94) ==00:00:00:55.542 15239== by 0x42B27D: radius_handle_request (event.c:3838) ==00:00:00:55.542 15239== ==00:00:00:55.542 15239== 1,998 bytes in 54 blocks are definitely lost in loss record 530 of 547 ==00:00:00:55.542 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.542 15239== by 0x76F6C45: Perl_safesysmalloc (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76F6D79: Perl_savepv (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76B872C: Perl_gv_init (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76B9543: Perl_gv_fetchpvn_flags (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76D5F10: Perl_yylex (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76D6DC5: Perl_yyparse (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x77417D9: ??? (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x7743284: Perl_pp_require (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x770CC45: Perl_runops_standard (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76B0D0E: Perl_call_sv (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x745F240: ??? ==00:00:00:55.542 15239== ==00:00:00:55.542 15239== 4,752 bytes in 18 blocks are definitely lost in loss record 538 of 547 ==00:00:00:55.542 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.542 15239== by 0x76F6C45: Perl_safesysmalloc (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76F6D06: Perl_savepvn (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x771857C: Perl_rvpv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x7717627: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76DC3CF: Perl_re_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x7727047: perl_clone (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x745E959: ??? ==00:00:00:55.542 15239== by 0x745EF78: ??? ==00:00:00:55.542 15239== by 0x41D9B5: modcall_recurse (modcall.c:305) ==00:00:00:55.542 15239== by 0x41D499: modcall_child (modcall.c:423) ==00:00:00:55.542 15239== by 0x41D65F: modcall_recurse (modcall.c:628) ==00:00:00:55.542 15239== ==00:00:00:55.542 15239== 6,402 (2,296 direct, 4,106 indirect) bytes in 7 blocks are definitely lost in loss record 540 of 547 ==00:00:00:55.542 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.542 15239== by 0x422CB8: rad_malloc (util.c:347) ==00:00:00:55.542 15239== by 0x422CEA: request_alloc (util.c:377) ==00:00:00:55.542 15239== by 0x42BD76: received_request (event.c:2980) ==00:00:00:55.542 15239== by 0x416F91: acct_socket_recv (listen.c:947) ==00:00:00:55.542 15239== by 0x42C8AD: event_socket_handler (event.c:3483) ==00:00:00:55.542 15239== by 0x4E4293A: fr_event_loop (event.c:415) ==00:00:00:55.542 15239== by 0x41EA09: main (radiusd.c:422) ==00:00:00:55.542 15239== ==00:00:00:55.542 15239== 15,360 bytes in 15 blocks are definitely lost in loss record 543 of 547 ==00:00:00:55.542 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.542 15239== by 0x4E34B69: fr_strerror_printf (log.c:93) ==00:00:00:55.542 15239== by 0x4E3ABF2: rad_verify (radius.c:2185) ==00:00:00:55.542 15239== by 0x414896: client_socket_decode (listen.c:1336) ==00:00:00:55.542 15239== by 0x426EA3: request_pre_handler (event.c:1859) ==00:00:00:55.542 15239== by 0x42B23A: radius_handle_request (event.c:3831) ==00:00:00:55.542 15239== by 0x4221AB: request_handler_thread (threads.c:556) ==00:00:00:55.542 15239== by 0x5A7F8C9: start_thread (pthread_create.c:300) ==00:00:00:55.542 15239== ==00:00:00:55.542 15239== 51,084 bytes in 1,548 blocks are definitely lost in loss record 544 of 547 ==00:00:00:55.542 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.542 15239== by 0x76F6C45: Perl_safesysmalloc (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76F6D79: Perl_savepv (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76B872C: Perl_gv_init (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76B9543: Perl_gv_fetchpvn_flags (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76BAA87: Perl_gv_fetchsv (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x7716349: Perl_pp_sassign (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x770CC45: Perl_runops_standard (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76B0D0E: Perl_call_sv (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76B124C: Perl_call_list (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x769D348: ??? (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76AAE91: Perl_newATTRSUB (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== ==00:00:00:55.542 15239== 131,904 bytes in 180 blocks are definitely lost in loss record 545 of 547 ==00:00:00:55.542 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.542 15239== by 0x76F6C45: Perl_safesysmalloc (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76F6D06: Perl_savepvn (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x771857C: Perl_rvpv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x7717627: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x77179F3: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x77179F3: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x7717E00: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x7718A30: Perl_gp_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x7717F89: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x77179F3: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x77179F3: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== ==00:00:00:55.542 15239== 146,544 bytes in 2,246 blocks are definitely lost in loss record 546 of 547 ==00:00:00:55.542 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.542 15239== by 0x76F6C45: Perl_safesysmalloc (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76F6D06: Perl_savepvn (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x771857C: Perl_rvpv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x7717627: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76DC3F9: Perl_re_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x7727047: perl_clone (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x745E959: ??? ==00:00:00:55.542 15239== by 0x745EF78: ??? ==00:00:00:55.542 15239== by 0x41D9B5: modcall_recurse (modcall.c:305) ==00:00:00:55.542 15239== by 0x41D499: modcall_child (modcall.c:423) ==00:00:00:55.542 15239== by 0x41D65F: modcall_recurse (modcall.c:628) ==00:00:00:55.542 15239== ==00:00:00:55.542 15239== 277,664 bytes in 3,218 blocks are definitely lost in loss record 547 of 547 ==00:00:00:55.542 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.542 15239== by 0x76F6C45: Perl_safesysmalloc (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76F6D06: Perl_savepvn (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x771857C: Perl_rvpv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x7717627: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76DC3A5: Perl_re_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x7727047: perl_clone (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x745E959: ??? ==00:00:00:55.542 15239== by 0x745EF78: ??? ==00:00:00:55.542 15239== by 0x41D9B5: modcall_recurse (modcall.c:305) ==00:00:00:55.542 15239== by 0x41D499: modcall_child (modcall.c:423) ==00:00:00:55.542 15239== by 0x41D65F: modcall_recurse (modcall.c:628) ==00:00:00:55.542 15239== ==00:00:00:55.542 15239== LEAK SUMMARY: ==00:00:00:55.542 15239== definitely lost: 636,590 bytes in 7,526 blocks ==00:00:00:55.542 15239== indirectly lost: 5,262 bytes in 35 blocks ==00:00:00:55.542 15239== possibly lost: 1,584 bytes in 6 blocks ==00:00:00:55.542 15239== still reachable: 85,822 bytes in 2,529 blocks ==00:00:00:55.542 15239== suppressed: 0 bytes in 0 blocks ==00:00:00:55.542 15239== Reachable blocks (those to which a pointer was found) are not shown. ==00:00:00:55.542 15239== To see them, rerun with: --leak-check=full --show-reachable=yes ==00:00:00:55.542 15239== ==00:00:00:55.542 15239== For counts of detected and suppressed errors, rerun with: -v ==00:00:00:55.542 15239== Use --track-origins=yes to see where uninitialised values come from ==00:00:00:55.542 15239== ERROR SUMMARY: 804 errors from 25 contexts (suppressed: 4 from 4) I would be grateful if anyone could take a quick glance at this output and let me know if it shows anything untoward. Ben Thompson

2 2

Accounting in MySQL - Password
by P K 15 Jan '14

15 Jan '14

Hi, This may be a simple question but I was not able to find a setting for this. Basically, I'm using freeradius with LDAP for my user base and MySQL for accounting. I've loaded schema on MySQL, configured freeradius and my two tables get populated properly (radacct and radpostauth). My Clients are using TTLS/PAP and PEAP/MSCHAP protocols. When I look in radpostauth, the "pass" field is populated in clear text when TTLS/PAP protocol is used. Is there a way to disable this or at least encrypt the password? Password logging is only a problem when we use MySQL. Freeradius Log files do not contain passwords. Thanks.

4 10

feature request: ldap enhancements
by Hachmer, Tobias 15 Jan '14

15 Jan '14

Hello Arran, you asked if I have any feature requests. So, here are two points I want to discuss: 1. reload all RADIUS clients stored in ldap on SIGHUP (bulk load) - 'radmin -e "hup ldap"' would be sufficient here 2. enhanced ldap support for storing and managing huntgroups Our goal is to restrict several users to one or more "NAS groups". It should be possible that the same NAS can be member of multiple huntgroups as well as to assign multiple huntgroups to a user. Example: huntgroup-1 NAS-IP-Address == 192.0.2.5 huntgroup-1 NAS-IP-Address == 192.0.2.6 huntgroup-1 NAS-IP-Address == 192.0.2.7 huntgroup-2 NAS-IP-Address == 192.0.2.7 huntgroup-2 NAS-IP-Address == 192.0.2.8 huntgroup-2 NAS-IP-Address == 192.0.2.9 user1 Cleartext-Password := "password1", Huntgroup-Name == "huntgroup-1" Service-Type = Administrative-User user2 Cleartext-Password := "password2", Huntgroup-Name == "huntgroup-2" Service-Type = Administrative-User user3 Cleartext-Password := "password3", Huntgroup-Name == "huntgroup-1", Huntgroup-Name == "huntgroup-2" Service-Type = Administrative-User Please pardon if the huntgroup assignment here is incorrect, I did not use huntgroups at all for now. To do this in ldap there have to be something like: a) new object class for huntgroups to distinct these from other RADIUS related objects like RADIUS clients and RADIUS profiles. I think this approach is better than adding a multi-valued attribute to the RADIUS clients object class for better clarity. b) The existing RADIUS profile object class should be extended for a multi-valued attribute to assign multiple huntgroups to a user profile. With this assumption radiusd could read all defined huntgroups on startup (reread on SIGHUP;-) ) and do the matching in authorize section after the user profile is read from ldap. Would be glad if you can give your thoughts on this or maybe some hints if this could be achieved already different. Hope this two points are not very far-fetched ;-) Regard, Tobias

3 9

"No DB handles" workaround
by Pete Ashdown 14 Jan '14

14 Jan '14

I ran into the "rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0" error shortly after switching our authentication to newly configured freeradius servers and putting load on them. In searching for a resolution to this error, I found this thread: http://freeradius.1045715.n5.nabble.com/errors-There-are-no-DB-handles-to-u… Where Alan DeKok responds with: "Your database is broken. Fix it." "The answer is always the same: Fix the database." " What part of "fix your database" is hard to understand?" "Fix your database so that it isn't too slow." Our SQL server is a 24 core, 32GB, SSD backed server with very light loads. A slowquery log showed nothing of interest, so we started looking in other directions. What we found is that if the thread pool max_servers > sql num_sql_socks this error will occur. I haven't looked at the code, but I am guessing that it is locking one SQL socket per thread, and if you have more threads than sockets, then you will start seeing this error. We set max_servers and num_sql_socks both to 15 and we haven't seen the error since. This was with freeradius v2.2.2. I hope this helps someone.

4 3

Radius Accounting Counters
by Gilmour, Scott 14 Jan '14

14 Jan '14

Using Freeradius I would like to test Radius Accounting-Response Counters on my DUT. Specifically these counters: Radius Accounting Malformed Responses Radius Accounting Bad Authenticators Radius Accounting Unknown types Radius Accounting packets dropped Is there a tool or a way to modify what the server will send for a response in freeradius. This is specifically for testing purposes. Thanks Scott

2 1

Radius Server and Ldap Server
by 李亚坤 13 Jan '14

13 Jan '14

Hello all, I am trying to set up a radius server to perform authentication for wifi login against the user with password database in LDAP. I have no right to get the password back from LDAP, and the only reply information from LDAP server is the I login in success. However, I need to login wifi by a user name and password stored in LDAP server, without the reply password from LDAP, how can the radius server check whether the password I have provided is correct. I have tried many ways, but none of them work. I need help from you. Thanks. Best Regards Li

6 14

Freeradius DHCP problem with some vendors.
by Ricardo Oliveira 13 Jan '14

13 Jan '14

Hello, I am introducing the Freeradius as DHCP server at my ISP and am experiencing problems with some vendors specifically routers TP-Link. The FreeRadius allocates the IP Router but unable to associate the IP offered by freeradius, what intrigues me is that the problem does not occur with the ISC-DHCP. FreeRADIUS Version 2.2.4 (git #14e1ee7) Follow my configuration and Debug. server dhcp { listen { type = dhcp ipaddr = XXX.XXX.0.26 port = 67 interface = eth0 broadcast = no } dhcp DHCP-Discover { update reply { DHCP-Message-Type = DHCP-Offer } update reply { DHCP-Domain-Name-Server = XXX.XXX.0.6 DHCP-Domain-Name-Server = XXX.XXX.0.250 DHCP-IP-Address-Lease-Time = 120 DHCP-DHCP-Server-Identifier = XXX.XXX.0.26 } sql.authorize dhcp_sqlippool sql.post-auth ok } dhcp DHCP-Request { update reply { DHCP-Message-Type = DHCP-Ack } update reply { DHCP-Domain-Name-Server = XXX.XXX.0.6 DHCP-Domain-Name-Server = XXX.XXX.0.250 DHCP-IP-Address-Lease-Time = 120 DHCP-DHCP-Server-Identifier = XXX.XXX.0.26 } sql.authorize dhcp_sqlippool sql.post-auth ok } dhcp { reject } } Ready to process requests. Received DHCP-Discover of id 7f519348 from 179.127.59.1:67 to 187.85.0.26:67 DHCP-Opcode = Client-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 1 DHCP-Transaction-Id = 2136052552 DHCP-Number-of-Seconds = 4 DHCP-Flags = Broadcast DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 0.0.0.0 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = 179.127.59.1 DHCP-Client-Hardware-Address = a0:f3:c1:f3:78:6a DHCP-Message-Type += DHCP-Discover DHCP-Client-Identifier += a0:f3:c1:f3:78:6a DHCP-DHCP-Maximum-Msg-Size += 576 DHCP-Parameter-Request-List += DHCP-Subnet-Mask DHCP-Parameter-Request-List += DHCP-Router-Address DHCP-Parameter-Request-List += DHCP-Domain-Name-Server DHCP-Parameter-Request-List += DHCP-Static-Routes DHCP-Parameter-Request-List += DHCP-Vendor DHCP-Parameter-Request-List += DHCP-NETBIOS-Name-Servers DHCP-Parameter-Request-List += DHCP-NETBIOS-Node-Type DHCP-Parameter-Request-List += DHCP-NETBIOS DHCP-Parameter-Request-List += DHCP-Classless-Static-Route DHCP-Parameter-Request-List += 249 DHCP-Relay-Circuit-Id = "1/1/FHTT-0027b63b" DHCP-Relay-Remote-Id = "" server dhcp { Trying sub-section dhcp DHCP-Discover {...} +group DHCP-Discover { ++update reply { ++} # update reply = noop ++update reply { ++} # update reply = noop [sql] expand: %{DHCP-Relay-Circuit-Id} -> 1/1/FHTT-0027b63b [sql] sql_set_user escaped user --> '1/1/FHTT-0027b63b' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '1/1/FHTT-0027b63b' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '1/1/FHTT-0027b63b' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '1/1/FHTT-0027b63b' ORDER BY priority rlm_sql (sql): Released sql socket id: 2 ++[sql.authorize] = ok ++policy dhcp_sqlippool.post-auth { +++update request { expand: %{DHCP-Relay-Circuit-Id} -> 1/1/FHTT-0027b63b expand: %{DHCP-Relay-Circuit-Id} -> 1/1/FHTT-0027b63b expand: %{DHCP-Gateway-IP-Address} -> 179.127.59.1 expand: %{%{DHCP-Gateway-IP-Address}:-127.0.0.1} -> 179.127.59.1 +++} # update request = noop [dhcp_sqlippool] No Pool-Name defined. [dhcp_sqlippool] expand: DHCP: No Pool-Name defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) -> DHCP: No Pool-Name defined (did cli 1/1/FHTT-0027b63b port user 1/1/FHTT-0027b63b) DHCP: No Pool-Name defined (did cli 1/1/FHTT-0027b63b port user 1/1/FHTT-0027b63b) +++[dhcp_sqlippool] = noop +++? if (ok) ? Evaluating (ok) -> FALSE +++? if (ok) -> FALSE ++} # policy dhcp_sqlippool.post-auth = noop [sql] expand: %{DHCP-Relay-Circuit-Id} -> 1/1/FHTT-0027b63b [sql] sql_set_user escaped user --> '1/1/FHTT-0027b63b' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1/1/FHTT-0027b63b', '', '0', '2014-01-12 18:02:18') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1/1/FHTT-0027b63b', '', '0', '2014-01-12 18:02:18') rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 ++[sql.post-auth] = ok ++[ok] = ok +} # group DHCP-Discover = ok DHCP: Reply will be unicast to giaddr from original packet } # server dhcp Encoding DHCP-Offer of id 7f519348 to 179.127.59.1:67 DHCP-Opcode = Server-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 1 DHCP-Transaction-Id = 2136052552 DHCP-Number-of-Seconds = 0 DHCP-Flags = Broadcast DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 179.127.59.2 DHCP-Server-IP-Address = 187.85.0.26 DHCP-Gateway-IP-Address = 179.127.59.1 DHCP-Client-Hardware-Address = a0:f3:c1:f3:78:6a DHCP-Server-Host-Name = "" DHCP-Boot-Filename = "" DHCP-Domain-Name-Server = 187.85.0.6 DHCP-Domain-Name-Server = 187.85.0.250 DHCP-IP-Address-Lease-Time = 120 DHCP-DHCP-Server-Identifier = 187.85.0.26 DHCP-DHCP-Maximum-Msg-Size = 576 Sending DHCP-Offer of id 7f519348 to 179.127.59.1:67 Finished request 1. Thanks.

2 3

FR 2.2.3 crash
by Alex Sharaz 13 Jan '14

13 Jan '14

Hi, Just been looking at my development server logs and noticed Mon Jan 13 08:38:10 2014 : Auth: Login OK: [f5healthcheck] (from client f5-man-1 port 0 cli ) Mon Jan 13 08:38:13 2014 : Info: WARNING: Child is hung for request 13100 in component <core> module . Mon Jan 13 08:38:16 2014 : Error: ASSERT FAILED event.c[543]: request->child_state == REQUEST_DONE o.k. the 1st line is our F5 load balancer performing a health check, and is normal. The other 2 aren’t. At this point FR is dead and had to be restarted. Not sure if I can reproduce the conditions but the server was last restarted on Friday. Running 2.2.3 built from git source code Rgds A

2 1