- Freeradius-Users - lists.freeradius.org

Memory big problem
by Dmitry V. Pleganoff 14 Dec '05

14 Dec '05

And to you thanks. Can i offer small patch for realization of comparison (!~) in rlm_checkval? --- rlm_checkval.c 2005-12-14 03:38:08.000000000 +1000 +++ rlm_checkval.c.patched 2005-12-14 10:15:59.000000000 +1000 @@ -208,6 +208,7 @@ VALUE_PAIR *chk_vp, *item_vp; VALUE_PAIR *tmp; char found = 0; + int opflag = T_OP_REG_EQ; /* quiet the compiler */ instance = instance; @@ -244,6 +245,9 @@ * Check if item != check */ found = 1; + + opflag = chk_vp->operator; + if (data->dat_type == PW_TYPE_STRING || data->dat_type == PW_TYPE_OCTETS) { if (item_vp->length != chk_vp->length) @@ -266,12 +270,18 @@ } #ifdef HAVE_REGEX_H if (ret == RLM_MODULE_REJECT && - chk_vp->operator == T_OP_REG_EQ) { + (chk_vp->operator == T_OP_REG_EQ || + chk_vp->operator == T_OP_REG_NE)) { regex_t reg; int err; char err_msg[MAX_STRING_LEN]; - DEBUG("rlm_checkval: Doing regex"); + if (opflag == T_OP_REG_EQ) { + DEBUG("rlm_checkval: Doing regex (=~)"); + } else { + DEBUG("rlm_checkval: Doing regex (!~)"); + } + err = regcomp(&reg, (char *)chk_vp->vp_strvalue, REG_EXTENDED|REG_NOSUB); if (err){ regerror(err, &reg,err_msg, MAX_STRING_LEN); @@ -289,6 +299,14 @@ } while (ret == RLM_MODULE_REJECT && tmp != NULL); + if (opflag == T_OP_REG_NE) { + if (ret == RLM_MODULE_OK) + ret = RLM_MODULE_REJECT; + else + if (ret == RLM_MODULE_REJECT) + ret = RLM_MODULE_OK; + } + if (ret == RLM_MODULE_REJECT) { if (!item_vp && data->notfound_reject){ char module_fmsg[MAX_STRING_LEN];

1 0

Two routers using the same Radius server?
by Mark Tunnell 14 Dec '05

14 Dec '05

Suppose I have two Cisco routers both configured to authenticate to the same radius server. How do I allow a particular user access to one router but not the other? Is there a place in the clients.conf or users file to configure this? Thanks, Mark

3 7

Framed-Route ignored
by Arthur Sigel 14 Dec '05

14 Dec '05

I have been trying to get this to work for a few days now with no success. I have set up poptop (PPTP) and it uses the /etc/ppp/options.pptp file which has a plugin for radius. plugin radius.so Radius will authenticate with my users fine, but I can't seem to get the Framed-Route option to do anything. I am trying to set a route for a mask and not just the single IP to device ppp connection. Does ppp just ignore the route and this option just doesn't work with ppp or pptp? Is there a workaround? Thank you, Arthur I am also using a SQL connection so the information will be left in that format. radius=# select * from radgroupcheck; id | groupname | attribute | op | value ----+-----------+-----------+----+--------- 1 | static | Auth-Type | := | MS-CHAP radius=# select * from radgroupreply; id | groupname | attribute | op | value ----+-----------+--------------------+----+--------------------- 1 | static | Framed-Protocol | := | PPP 2 | static | Service-Type | := | Framed-user 3 | static | Framed-Compression | := | Van-Jacobsen-TCP-IP id | username | attribute | op | value ----+----------+-------------------+----+----------------------- 1 | arthur | Framed-IP-Address | := | 10.0.0.4 3 | arthur | Framed-Routing | := | None 2 | arthur | Framed-IP-Netmask | := | 255.255.255.0 4 | arthur | Framed-Route | := | 10.0.0.0/24 0.0.0.0 1 The options file contains: plugin radius.so lock mtu 1490 mru 1490 multilink #proxyarp auth ipcp-accept-remote lcp-echo-failure 30 lcp-echo-interval 5 deflate 0 +mschap-v2 mppe required nopcomp noaccomp pptpd.conf localip 191.168.4.1 ----------------------------- VERSIONS OF THINGS pptpd-1.2.3 pppd version 2.4.3 FreeRadius 1.05 RADIUS output snippet Framed-IP-Address := 10.0.0.4 Framed-IP-Netmask := 255.255.255.0 Framed-Routing := None Framed-Route := "10.0.0.0/24 0.0.0.0 1" Framed-Protocol := PPP Service-Type := Framed-User Framed-Compression := Van-Jacobson-TCP-IP MS-CHAP2-Success = ***** MS-MPPE-Recv-Key = ***** MS-MPPE-Send-Key = ***** MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x00000004 rad_recv: Accounting-Request packet from host 127.0.0.1:32798, id=114, length=112 Acct-Session-Id = "439E72E33A2C00" User-Name = "arthur" Acct-Status-Type = Start Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "**.**.**.**" Acct-Authentic = RADIUS NAS-Port-Type = Async Framed-IP-Address = 10.0.0.4 NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Acct-Delay-Time = 0 Routing table Destination Gateway Genmask Flags Metric Ref Use Iface 10.0.0.4 * 255.255.255.255 UH 0 0 0 ppp0 192.168.3.0 * 255.255.255.0 U 0 0 0 eth2 192.168.2.0 * 255.255.255.0 U 0 0 0 eth0 192.168.1.0 * 255.255.255.0 U 0 0 0 eth1 loopback * 255.0.0.0 U 0 0 0 lo default 192.168.2.1 0.0.0.0 UG 0 0 0 eth0

2 2

accounting & lost trafic
by Andreas＠j8.com.ru 13 Dec '05

13 Dec '05

Hi, freeradius-users. TEll me please : when i use standart config - my accounting save ONLY AFTER SESSION CLOSE. If user have session 19 hours and server hang up or some thing else - i lost users trafic! I try use Acct-Interim-Interval like http://lists.cistron.nl/pipermail/freeradius-users/2005-April/042710.html but in to my sql table i do not see any changes. (i use freeradius-mysql) PLEASE HELP -- Best Regards, Andreas Wednesday, December 14, 2005 1:05:05 AM "Do not hesitate to ask me" ICQ UIN 177624 http://ServersLease.net - Offshore Dedicated Servers, Offshore Collocation http://HOST-LUX.RU - Offshore Virtual Hosting, Web Hosting, as low as 5$ per 1Gb HDD/month http://Reg-Master.net - Register`s Master of Domains http://Web-Media.Ru - Web Design studio. http://VEHICLE.RU - автомобили на заказ из США

2 1

Framed-Route ignored (repost in TXT)
by Arthur Sigel 13 Dec '05

13 Dec '05

I have been trying to get this to work for a few days now with no success. I have set up poptop (PPTP) and it uses the /etc/ppp/options.pptp file which has a plugin for radius. plugin radius.so Radius will authenticate with my users fine, but I can't seem to get the Framed-Route option to do anything. I am trying to set a route for a mask and not just the single IP to device ppp connection. Does ppp just ignore the route and this option just doesn't work with ppp or pptp? Is there a workaround? Thank you, Arthur I am also using a SQL connection so the information will be left in that format. radius=# select * from radgroupcheck; id | groupname | attribute | op | value ----+-----------+-----------+----+--------- 1 | static | Auth-Type | := | MS-CHAP radius=# select * from radgroupreply; id | groupname | attribute | op | value ----+-----------+--------------------+----+--------------------- 1 | static | Framed-Protocol | := | PPP 2 | static | Service-Type | := | Framed-user 3 | static | Framed-Compression | := | Van-Jacobsen-TCP-IP radius=# select * from radreply; id | username | attribute | op | value ----+----------+-------------------+----+----------------------- 1 | arthur | Framed-IP-Address | := | 10.0.0.4 3 | arthur | Framed-Routing | := | None 2 | arthur | Framed-IP-Netmask | := | 255.255.255.0 4 | arthur | Framed-Route | := | 10.0.0.0/24 0.0.0.0 1 The options file contains: plugin radius.so lock mtu 1490 mru 1490 multilink #proxyarp auth ipcp-accept-remote lcp-echo-failure 30 lcp-echo-interval 5 deflate 0 +mschap-v2 mppe required nopcomp noaccomp pptpd.conf localip 191.168.4.1 ----------------------------- VERSIONS OF THINGS pptpd-1.2.3 pppd version 2.4.3 FreeRadius 1.05 RADIUS output snippet Framed-IP-Address := 10.0.0.4 Framed-IP-Netmask := 255.255.255.0 Framed-Routing := None Framed-Route := "10.0.0.0/24 0.0.0.0 1" Framed-Protocol := PPP Service-Type := Framed-User Framed-Compression := Van-Jacobson-TCP-IP MS-CHAP2-Success = ***** MS-MPPE-Recv-Key = ***** MS-MPPE-Send-Key = ***** MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x00000004 rad_recv: Accounting-Request packet from host 127.0.0.1:32798, id=114, length=112 Acct-Session-Id = "439E72E33A2C00" User-Name = "arthur" Acct-Status-Type = Start Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "**.**.**.**" Acct-Authentic = RADIUS NAS-Port-Type = Async Framed-IP-Address = 10.0.0.4 NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Acct-Delay-Time = 0 Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 10.0.0.4 * 255.255.255.255 UH 0 0 0 ppp0 192.168.3.0 * 255.255.255.0 U 0 0 0 eth2 192.168.2.0 * 255.255.255.0 U 0 0 0 eth0 192.168.1.0 * 255.255.255.0 U 0 0 0 eth1 loopback * 255.0.0.0 U 0 0 0 lo default 192.168.2.1 0.0.0.0 UG 0 0 0 eth0

1 0

parsing certificate fields ?
by Riccardo Veraldi 13 Dec '05

13 Dec '05

Hello, I am using freeradius with 802.11i, everything works fine qith certificate authentication but I Can only parse the CN of the certificate I would like to parse for Locality L field. the new version 1.0.5 support this ? thanks Rick

3 4

EAP-TTLS with LDAP authentication?
by Konne 13 Dec '05

13 Dec '05

hi is it possible to do EAP-TTLS with LDAP authentication or what is the best and secure way? i have an AP cisco aironet 1242, Debian with Freeradius and a W2k3 Server with the Active Directory. what do you suggest? thx

2 1

Memory big problem
by Dmitry V. Pleganoff 13 Dec '05

13 Dec '05

By the way, rlm_checkval meets in most cases losses ==8528== 200448 bytes in 783 blocks are definitely lost in loss record 178 of 190 ... ==8528== by 0x1BB83E41: regcomp (in /lib/tls/libc-2.3.2.so) ==8528== by 0x1D310FC3: do_checkval (rlm_checkval.c:275) ... ==8528== 60416 bytes in 59 blocks are possibly lost in loss record 162 of 190 ... ==8528== by 0x1BB88BF0: regexec (in /lib/tls/libc-2.3.2.so) ==8528== by 0x1D310FF4: do_checkval (rlm_checkval.c:281) ... ==8528== 55800 bytes in 15 blocks are possibly lost in loss record 159 of 190 ... ==8528== by 0x1BB83EBF: regcomp (in /lib/tls/libc-2.3.2.so) ==8528== by 0x1D310FC3: do_checkval (rlm_checkval.c:275) ... ==8528== 22320 bytes in 6 blocks are possibly lost in loss record 151 of 190 ... ==8528== by 0x1BB83EBF: regcomp (in /lib/tls/libc-2.3.2.so) ==8528== by 0x1D310FC3: do_checkval (rlm_checkval.c:275) ... etc.

2 1

Memory big problem
by Dmitry V. Pleganoff 13 Dec '05

13 Dec '05

Thanks, I have tried Valgrind. Valgrind have given out as a result of 20 losses and possible losses of memory. Basically from several bytes up to 200 kbytes for 30 seconds of work. The largest following. ... ... ... ==8528== 11032016 (72220 direct, 10959796 indirect) bytes in 785 blocks are definitely lost in loss record 166 of 190 ==8528== at 0x1B90659D: malloc (vg_replace_malloc.c:130) ==8528== by 0x1B906FFA: realloc (vg_replace_malloc.c:188) ==8528== by 0x1BB84194: (within /lib/tls/libc-2.3.2.so) ==8528== by 0x1BB83EBF: regcomp (in /lib/tls/libc-2.3.2.so) ==8528== by 0x1D310FC3: do_checkval (rlm_checkval.c:275) ==8528== by 0x80579CF: call_modsingle (modcall.c:254) ==8528== by 0x8057F3E: modcall (modcall.c:590) ==8528== by 0x8057AB2: call_one (modcall.c:287) ==8528== by 0x8057B6D: call_modgroup (modcall.c:342) ==8528== by 0x8057FC7: modcall (modcall.c:575) ==8528== by 0x8057526: module_authorize (modules.c:936) ==8528== by 0x804D1ED: rad_authenticate (auth.c:548) ... ... ... ==8528== LEAK SUMMARY: ==8528== definitely lost: 275914 bytes in 1581 blocks. ==8528== indirectly lost: 10960904 bytes in 140534 blocks. ==8528== possibly lost: 236468 bytes in 234 blocks. ==8528== still reachable: 2190028 bytes in 32961 blocks. ==8528== suppressed: 0 bytes in 0 blocks. Also what with it is possible to do? To try me to correct rlm_checkval?

2 1

SQL authenticate & Proxying
by stu-tss1＠auxs.umn.edu 13 Dec '05

13 Dec '05

3 2