FreeRADIUS Server Version 2.1.6 has been released
The following is the change log. Thanks to everyone for testing the pre releases. FreeRADIUS 2.1.6 Mon May 18 10:00:00 CEST 2009; , urgency=medium Feature improvements * radclient exits with 0 on successful (accept / ack), and 1 otherwise (no response / reject) * Added support for %{sql:UPDATE ..}, and insert/delete Patch from Arran Cudbard-Bell * Added sample "do not respond" policy. See raddb/policy.conf and raddb/sites-available/do_not_respond * Cleanups to Suse spec file from Norbert Wegener * New VSAs for Juniper from Bjorn Mork * Include more RFC dictionaries in the default install * More documentation for the WiMAX module * Added "chase_referrals" and "rebind" configuration to rlm_ldap. This helps with Active Directory. See raddb/modules/ldap * Don't load pre/post-proxy if proxying is disabled. * Added %{md5:...}, which returns MD5 hash in hex. * Added configurable "retry_interval" and "poll_interval" for "detail" listeners. * Added "delete_mppe_keys" configuration option to rlm_wimax. Apparently some WiMAX clients misbehave when they see those keys. * Added experimental rlm_ruby from http://github.com/Antti/freeradius-server/tree/master * Add Tunnel attributes to ldap.attrmap * Enable virtual servers to be reloaded on HUP. For now, only the "authorize", "authenticate", etc. processing sections are reloaded. Clients and "listen" sections are NOT reloaded. * Updated "radwatch" script to be more robust. See scripts/radwatch * Added certificate compatibility notes in raddb/certs/README, for compatibility with different operating systems. (i.e. Windows) Bug fixes * Minor changes to allow building without VQP. * Minor fixes from John Center * Fixed raddebug example * Don't crash when deleting attributes via unlang * Be friendlier to very fast clients * Updated the "detail" listener so that it only polls once, and not many times in a row, leaking memory each time... * Update comparison for Packet-Src-IP-Address (etc.) so that the operators other than '==' work. * Did autoconf magic to work around weird libtool bug * Make rlm_perl keep tags for tagged attributes in more situations * Update UID checking for radmin * Added "include_length" field for TTLS. It's needed for RFC compliance, but not (apparently) for interoperability.
Can I just check, as I can't seen anything about it in the changelog and the wiki page for it appears to be the same as before - What is the rlm_perl behaviour with the new version of FreeRADIUS? As I recall rlm_perl no longer handles its own threading. One of the issues for several people introduced with the previous version of FreeRADIUS was there only ever being a single perl thread, which was a bottleneck, where the desired functionality was 1 perl thread (or process, if compiled with multiplicity instead of threading) per radius thread. I'm also assuming multiplicity takes preference, as our system installed with 2.1.4 had perl installed with both, and our radius process starts up at 200M but doesn't grow in the way you'd expect if we had a memory leak in our perl. I can't think what's taking up all that memory if it's not multiple perl processes. The same code on a system with perl compiled without threading or multiplicity only takes 16M. Thanks for the update, the radwatch script in particular will be very useful for us :) -- Dan Meyers Network Specialist, Lancaster University E-Mail: d.meyers@lancaster.ac.uk
Meyers, Dan wrote:
Can I just check, as I can't seen anything about it in the changelog and the wiki page for it appears to be the same as before - What is the rlm_perl behaviour with the new version of FreeRADIUS?
It's the same as 2.1.4.
I'm also assuming multiplicity takes preference, as our system installed with 2.1.4 had perl installed with both, and our radius process starts up at 200M but doesn't grow in the way you'd expect if we had a memory leak in our perl. I can't think what's taking up all that memory if it's not multiple perl processes. The same code on a system with perl compiled without threading or multiplicity only takes 16M.
Yes. We'll take a look at that for 2.1.7. Barring that, grab a copy of 2.1.6, and replace src/modules/rlm_perl with a copy from a previous version. Re-build, and install. You'll get the Perl that you like, along with the rest of the fixes in 2.1.6. The fixes && features in 2.1.6 are worth taking the time to do that.
Thanks for the update, the radwatch script in particular will be very useful for us :)
And lots more. Wait for 2.1.7, there are some interesting features going in. Alan DeKok.
Alan DeKok wrote:
And lots more. Wait for 2.1.7, there are some interesting features going in.
Hi, I hope having the Nas-identifier available to "dymanic clients virtual server" is considered interesting!! :-) Thanks for a fantastic product Alan! Cheers, -- Johan Meiring Cape PC Services CC Tel: (021) 883-8271 Fax: (021) 886-7782
On Mon, May 18, 2009 at 2:59 PM, Alan DeKok<aland@deployingradius.com> wrote:
The following is the change log. Thanks to everyone for testing the pre releases.
FreeRADIUS 2.1.6 Mon May 18 10:00:00 CEST 2009; , urgency=medium Feature improvements Bug fixes * Make rlm_perl keep tags for tagged attributes in more situations
Does not work for situation: -------- $ radiusd -v | head -1 radiusd: FreeRADIUS Version 2.1.6, for host i386-portbld-freebsd7.2, built on Aug 18 2009 at 12:31:54 $ perl -V Summary of my perl5 (revision 5 version 8 subversion 9) configuration: Platform: osname=freebsd, osvers=7.2-release-p2, archname=i386-freebsd-64int uname='freebsd mile.office.tsu 7.2-release-p2 freebsd 7.2-release-p2 #0: fri jun 26 10:01:50 eest 2009 root@mile.office.tsu:usrobjusrsrcsysmile i386 ' config_args='-sde -Dprefix=/usr/local -Darchlib=/usr/local/lib/perl5/5.8.9/mach -Dprivlib=/usr/local/lib/perl5/5.8.9 -Dman3dir=/usr/local/lib/perl5/5.8.9/perl/man/man3 -Dman1dir=/usr/local/man/man1 -Dsitearch=/usr/local/lib/perl5/site_perl/5.8.9/mach -Dsitelib=/usr/local/lib/perl5/site_perl/5.8.9 -Dscriptdir=/usr/local/bin -Dsiteman3dir=/usr/local/lib/perl5/5.8.9/man/man3 -Dsiteman1dir=/usr/local/man/man1 -Ui_malloc -Ui_iconv -Uinstallusrbinperl -Dcc=cc -Duseshrplib -Dinc_version_list=none -Dccflags=-DAPPLLIB_EXP="/usr/local/lib/perl5/5.8.9/BSDPAN" -Doptimize=-O2 -fno-strict-aliasing -pipe -march=pentium4 -Ud_dosuid -Ui_gdbm -Dusethreads=n -Dusemymalloc=y -Duse64bitint' hint=recommended, useposix=true, d_sigaction=define usethreads=undef use5005threads=undef useithreads=undef usemultiplicity=undef useperlio=define d_sfio=undef uselargefiles=define usesocks=undef use64bitint=define use64bitall=undef uselongdouble=undef usemymalloc=y, bincompat5005=undef Compiler: cc='cc', ccflags ='-DAPPLLIB_EXP="/usr/local/lib/perl5/5.8.9/BSDPAN" -DHAS_FPSETMASK -DHAS_FLOATINGPOINT_H -fno-strict-aliasing -pipe -I/usr/local/include', optimize='-O2 -fno-strict-aliasing -pipe -march=pentium4', cppflags='-DAPPLLIB_EXP="/usr/local/lib/perl5/5.8.9/BSDPAN" -DHAS_FPSETMASK -DHAS_FLOATINGPOINT_H -fno-strict-aliasing -pipe -I/usr/local/include' ccversion='', gccversion='4.2.1 20070719 [FreeBSD]', gccosandvers='' intsize=4, longsize=4, ptrsize=4, doublesize=8, byteorder=12345678 d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=12 ivtype='long long', ivsize=8, nvtype='double', nvsize=8, Off_t='off_t', lseeksize=8 alignbytes=4, prototype=define Linker and Libraries: ld='cc', ldflags =' -Wl,-E -L/usr/local/lib' libpth=/usr/lib /usr/local/lib libs=-lgdbm -lm -lcrypt -lutil perllibs=-lm -lcrypt -lutil libc=, so=so, useshrplib=true, libperl=libperl.so gnulibc_version='' Dynamic Linking: dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags=' -Wl,-R/usr/local/lib/perl5/5.8.9/mach/CORE' cccdlflags='-DPIC -fPIC', lddlflags='-shared -L/usr/local/lib' Characteristics of this binary (from libperl): Compile-time options: MYMALLOC PERL_MALLOC_WRAP USE_64_BIT_INT USE_FAST_STDIO USE_LARGE_FILES USE_PERLIO Locally applied patches: defined-or Built under freebsd Compiled at Aug 18 2009 14:56:36 @INC: /usr/local/lib/perl5/5.8.9/BSDPAN /usr/local/lib/perl5/site_perl/5.8.9/mach /usr/local/lib/perl5/site_perl/5.8.9 /usr/local/lib/perl5/5.8.9/mach /usr/local/lib/perl5/5.8.9 . -------- Following code is used in sub authorize {} in perl module I'm trying to use -------- if (($RAD_REQUEST{'User-Name'} eq 'admin') and ($RAD_REQUEST{'User-Password'} eq 'test')) { $RAD_REPLY{'ERX-Service-Activate:1'} = "telesys"; $RAD_REPLY{'ERX-Service-Statistics:1'} = "time-volume"; $RAD_REPLY{'ERX-Qos-Parameters'}[0] = "internet_tr_value 2097152"; $RAD_REPLY{'ERX-Qos-Parameters'}[1] = "internet_tr_value_in 2097152"; $RAD_REPLY{'ERX-Service-Activate:2'} = "deny"; $RAD_REPLY{'ERX-Qos-Profile-Name'} = "SP_Tele_Internet"; $RAD_REPLY{'Framed-IP-Address'} = '10.0.112.2'; $RAD_REPLY{'Framed-IP-Netmask'}= "255.255.255.255"; $RAD_REPLY{'ERX-Primary-DNS'} = "1.2.3.4"; $RAD_REPLY{'ERX-Secondary-DNS'} = "1.2.3.5"; return RLM_MODULE_OK; }; -------- This gives following results: # radtest admin test 10.3.1.252 12 huawei Sending Access-Request of id 70 to 10.3.1.252 port 1812 User-Name = "admin" User-Password = "test" NAS-IP-Address = 10.1.2.13 NAS-Port = 12 rad_recv: Access-Accept packet from host 10.3.1.252 port 1812, id=70, length=188 ERX-Qos-Parameters = "internet_tr_value 2097152" ERX-Qos-Parameters = "internet_tr_value_in 2097152" ERX-Service-Activate:0 = "deny" ERX-Service-Activate:0 = "telesys" ERX-Qos-Profile-Name = "SP_Tele_Internet" ERX-Service-Statistics:1 = time-volume ERX-Primary-Dns = 1.2.3.4 ERX-Secondary-Dns = 1.2.3.5 Framed-IP-Address = 10.0.112.2 Framed-IP-Netmask = 255.255.255.255 -------- Output from radiusd -X: rad_recv: Access-Request packet from host 10.3.1.252 port 52845, id=70, length=57 User-Name = "admin" User-Password = "test" NAS-IP-Address = 10.1.2.13 NAS-Port = 12 server radoss { +- entering group authorize {...} ++[preprocess] returns ok ++[control] returns ok rlm_perl: $VAR1 = {}; rlm_perl: defined rlm_perl: Added pair User-Name = admin rlm_perl: Added pair User-Password = test rlm_perl: Added pair NAS-Port = 12 rlm_perl: Added pair NAS-IP-Address = 10.1.2.13 rlm_perl: Added pair ERX-Qos-Profile-Name = SP_Tele_Internet rlm_perl: Added pair ERX-Service-Activate:2 = deny rlm_perl: Added pair ERX-Qos-Parameters = internet_tr_value 2097152 rlm_perl: Added pair ERX-Qos-Parameters = internet_tr_value_in 2097152 rlm_perl: Added pair ERX-Service-Statistics:1 = time-volume rlm_perl: Added pair ERX-Secondary-DNS = 1.2.3.5 rlm_perl: Added pair Framed-IP-Address = 10.0.112.2 rlm_perl: Added pair Framed-IP-Netmask = 255.255.255.255 rlm_perl: Added pair ERX-Service-Activate:1 = telesys rlm_perl: Added pair ERX-Primary-DNS = 1.2.3.4 rlm_perl: Added pair Auth-Type = Perl ++[perl] returns ok Found Auth-Type = Perl +- entering group Perl {...} rlm_perl: Added pair User-Name = admin rlm_perl: Added pair User-Password = test rlm_perl: Added pair NAS-IP-Address = 10.1.2.13 rlm_perl: Added pair NAS-Port = 12 rlm_perl: Added pair ERX-Qos-Parameters = internet_tr_value 2097152 rlm_perl: Added pair ERX-Qos-Parameters = internet_tr_value_in 2097152 rlm_perl: Added pair ERX-Service-Activate = deny rlm_perl: Added pair ERX-Service-Activate = telesys rlm_perl: Added pair ERX-Qos-Profile-Name = SP_Tele_Internet rlm_perl: Added pair ERX-Service-Statistics:1 = time-volume rlm_perl: Added pair ERX-Primary-Dns = 1.2.3.4 rlm_perl: Added pair ERX-Secondary-Dns = 1.2.3.5 rlm_perl: Added pair Framed-IP-Address = 10.0.112.2 rlm_perl: Added pair Framed-IP-Netmask = 255.255.255.255 rlm_perl: Added pair Auth-Type = Perl ++[perl] returns ok +- entering group post-auth {...} ++[exec] returns noop } # server radoss Sending Access-Accept of id 70 to 10.3.1.252 port 52845 ERX-Qos-Parameters += "internet_tr_value 2097152" ERX-Qos-Parameters += "internet_tr_value_in 2097152" ERX-Service-Activate:0 += "deny" ERX-Service-Activate:0 += "telesys" ERX-Qos-Profile-Name = "SP_Tele_Internet" ERX-Service-Statistics:1 = time-volume ERX-Primary-Dns = 1.2.3.4 ERX-Secondary-Dns = 1.2.3.5 Framed-IP-Address = 10.0.112.2 Framed-IP-Netmask = 255.255.255.255 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 70 with timestamp +4 Ready to process requests. -- Alexandr Kovalenko http://uafug.org.ua/
participants (4)
-
Alan DeKok -
Alexandr Kovalenko -
Johan Meiring -
Meyers, Dan