Open sirmax123 opened 1 year ago
tested on
./radiusd -v
radiusd: FreeRADIUS Version 3.2.4 (git #892334968), for host x86_64-pc-linux-gnu, built on Jul 18 2023 at 12:20:50
FreeRADIUS Version 3.2.4
Copyright (C) 1999-2022 The FreeRADIUS server project and contributors
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License
For more information about these matters, see the file named COPYRIGHT
freeradius -v
radiusd: FreeRADIUS Version 3.0.26, for host x86_64-pc-linux-gnu, built on Jan 4 2023 at 03:23:09
FreeRADIUS Version 3.0.26
Copyright (C) 1999-2021 The FreeRADIUS server project and contributors
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License
For more information about these matters, see the file named COPYRIGHT
with same result
Please submit a PR with a testcase which reproduces this and we'll try to develop a fix. I'd also be interested to see if you still get the crash with master (v4) as that code is substantially different.
do not know how to create PR, could you please provide me with an example?
Steps to reproduce:
Build:
Configure:
prefix = /usr/local/freeradius exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct name = freeradius modconfdir = ${confdir}/mods-config
run_dir = ${localstatedir}/run/${name} libdir = ${exec_prefix}/lib pidfile = ${run_dir}/${name}.pid correct_escapes = true max_request_time = 30 cleanup_delay = 5 max_requests = 16384 hostname_lookups = no
log { destination = files colourise = yes file = ${logdir}/radius.log stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes msg_denied = "You are already logged in - access denied" } checkrad = ${sbindir}/checkrad security { user = freerad group = freerad allow_core_dumps = yes } proxy_requests = no
client 100.100.100.254 { secret = radius shortname = ASR1001 nastype = other }
client localhost { ipaddr = 127.0.0.1 proto = * secret = secret require_message_authenticator = no } thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 auto_limit_acct = no }
modules { python3 python3_ipaddress_username { python_path =":${modconfdir}/${.:name}" module = ipaddress_username pass_all_vps_dict = yes mod_instantiate = ${.module} func_instantiate = instantiate mod_detach = ${.module} func_detach = detach mod_authorize = ${.module} func_authorize = authorize mod_authenticate = ${.module} func_authenticate = authenticate mod_preacct = ${.module} func_preacct = preacct mod_accounting = ${.module} func_accounting = accounting mod_checksimul = ${.module} func_checksimul = checksimul mod_pre_proxy = ${.module} func_pre_proxy = pre_proxy mod_post_proxy = ${.module} func_post_proxy = post_proxy mod_post_auth = ${.module} func_post_auth = post_auth mod_recv_coa = ${.module} func_recv_coa = recv_coa mod_send_coa = ${.module} func_send_coa = send_coa }
python3 python3_service_username {
python_path =":${modconfdir}/${.:name}"
module = service_username
pass_all_vps_dict = yes
mod_instantiate = ${.module}
func_instantiate = instantiate
mod_detach = ${.module}
func_detach = detach
mod_authorize = ${.module}
func_authorize = authorize
mod_authenticate = ${.module}
func_authenticate = authenticate
mod_preacct = ${.module}
func_preacct = preacct
mod_accounting = ${.module}
func_accounting = accounting
mod_checksimul = ${.module}
func_checksimul = checksimul
mod_pre_proxy = ${.module}
func_pre_proxy = pre_proxy
mod_post_proxy = ${.module}
func_post_proxy = post_proxy
mod_post_auth = ${.module}
func_post_auth = post_auth
mod_recv_coa = ${.module}
func_recv_coa = recv_coa
mod_send_coa = ${.module}
func_send_coa = send_coa
}
}
instantiate { }
policy { }
server default { listen { type = auth ipv4addr = * port = 1812 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } }
listen {
ipv4addr = *
port = 1813
type = acct
}
instantiate {
}
authorize {
python3_ipaddress_username
python3_service_username
}
authenticate {
Auth-Type PYTHON_IPADRESS {
python3_ipaddress_username
}
Auth-Type PYTHON_SERVICE {
python3_service_username
}
}
}
2. Fix `example.py` (from distribution): add 2 methods, just simple placeholders doing nothing:
def authenticate(p): print(" authenticate ") radiusd.radlog(radiusd.L_INFO, ' radlog call in authenticate ') print() print(p) print() print(radiusd.config) return radiusd.RLM_MODULE_OK
def checksimul(p): print(" checksimul ") radiusd.radlog(radiusd.L_INFO, ' radlog call in checksimul ') print() print(p) print() print(radiusd.config) return radiusd.RLM_MODULE_OK
3. Copy `example.py` to `/usr/local/freeradius/etc/raddb/mods-config/python3/ipaddress_username.py` and to `/usr/local/freeradius/etc/raddb/mods-config/python3/service_username.py`
(path also depends on your system!)
4. Executer radiusd with command: `cd /usr/local/freeradius/sbin && ./radiusd -XXXX`
5. Got an error:
instantiate {'request': None, 'reply': None, 'config': None, 'session-state': None, 'proxy-request': None, 'proxy-reply': None} Tue Jul 18 15:41:36 2023 : Debug: # Instantiating module "python3_service_username" from file /usr/local/freeradius/etc/raddb/radiusd.conf Fatal Python error: drop_gil: drop_gil: GIL is not locked Python runtime state: initialized
Current thread 0x00007f4164b2a740 (most recent call first):
Also I tried to build v4 but configuration is different and I still working on making simple working configuration (will update if I will be able to run rlm_python on v4)
@sirmax123 Could you please perform your tests against the branch v32/fix-5111
in https://github.com/jpereira/freeradius-server/ ?
@sirmax123 Could you please perform your tests against the branch
v32/fix-5111
in https://github.com/jpereira/freeradius-server/ ?
Just built and tested, looks good to me:
git clone https://github.com/jpereira/freeradius-server.git
git switch v32/fix-5111
./configure --prefix=/usr/local/freeradius
make
make install
/usr/local/freeradius/sbin/radiusd -v
radiusd: FreeRADIUS Version 3.2.4 (git #d5b1f3644), for host x86_64-pc-linux-gnu, built on Jul 25 2023 at 15:00:40
FreeRADIUS Version 3.2.4
Copyright (C) 1999-2022 The FreeRADIUS server project and contributors
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License
For more information about these matters, see the file named COPYRIGHT
Tue Jul 25 15:24:22 2023 : Debug: (0) python3_ipaddress_username: Initialised new thread state 0x561d2b669a30
Tue Jul 25 15:24:22 2023 : Debug: (0) python3_ipaddress_username: Using thread state 0x561d2b669a30
*** authorize ***
Tue Jul 25 15:24:22 2023 : Info: *** radlog call in authorize ***
{'request': (('User-Name', 'SERVICE_IN_4120_OUT_4120'), ('User-Password', 'hello'), ('NAS-IP-Address', '10.90.1.213'), ('NAS-Port', '0'), ('Message-Authenticator', '0x44e06cbda100b814fca8f03a653870ff')), 'reply': None, 'config': None, 'session-state': None, 'proxy-request': None, 'proxy-reply': None}
{}
Tue Jul 25 15:24:22 2023 : Debug: (0) modsingle[authorize]: returned from python3_ipaddress_username (rlm_python3)
Tue Jul 25 15:24:22 2023 : Debug: (0) [python3_ipaddress_username] = ok
Tue Jul 25 15:24:22 2023 : Debug: (0) modsingle[authorize]: calling python3_service_username (rlm_python3)
Tue Jul 25 15:24:22 2023 : Debug: (0) python3_service_username: Initialised new thread state 0x561d2b669c60
Tue Jul 25 15:24:22 2023 : Debug: (0) python3_service_username: Using thread state 0x561d2b669c60
*** authorize ***
Tue Jul 25 15:24:22 2023 : Info: *** radlog call in authorize ***
{'request': (('User-Name', 'SERVICE_IN_4120_OUT_4120'), ('User-Password', 'hello'), ('NAS-IP-Address', '10.90.1.213'), ('NAS-Port', '0'), ('Message-Authenticator', '0x44e06cbda100b814fca8f03a653870ff')), 'reply': None, 'config': None, 'session-state': None, 'proxy-request': None, 'proxy-reply': None}
{}
Tue Jul 25 15:24:22 2023 : Debug: (0) modsingle[authorize]: returned from python3_service_username (rlm_python3)
Tue Jul 25 15:24:22 2023 : Debug: (0) [python3_service_username] = ok
Tue Jul 25 15:24:22 2023 : Debug: (0) } # authorize = ok
Tue Jul 25 15:24:22 2023 : ERROR: (0) No Auth-Type found: rejecting the user via Post-Auth-Type = Reject
Tue Jul 25 15:24:22 2023 : Debug: (0) Failed to authenticate the user
Tue Jul 25 15:24:22 2023 : Debug: (0) Using Post-Auth-Type Reject
Tue Jul 25 15:24:22 2023 : Debug: (0) Post-Auth-Type sub-section not found. Ignoring.
(tested with radtest SERVICE_IN_4120_OUT_4120 hello localhost 0 secret
command)
So, I think this issue can be marked as fixed when your patch is merged.
Thank you!
Thank you @sirmax123 for the feedback.
@sirmax123 Could you please perform your tests against the branch
v32/fix-5111
in https://github.com/jpereira/freeradius-server/ ?Just built and tested, looks good to me:
Any chance that this fix will come to the upcoming release? We are also waiting for it.
---EDIT---
We are running a simple python script in docker based on freeradius/freeradius-server:3.2.6, and everything seems works fine except the radius shutdown process. When we stop it it complains about:
`Fatal Python error: drop_gil: drop_gil: GIL is not locked Python runtime state: initialized
Current thread 0x00007f13307c5080 (most recent call first): File "/lib/python3.10/socket.py", line 496 in _real_close File "/lib/python3.10/ssl.py", line 1362 in _real_close File "/lib/python3.10/socket.py", line 502 in close File "/lib/python3.10/http/client.py", line 961 in close File "/usr/local/lib/python3.10/dist-packages/urllib3/connection.py", line 318 in close File "/usr/local/lib/python3.10/dist-packages/botocore/awsrequest.py", line 80 in close File "/usr/local/lib/python3.10/dist-packages/urllib3/connectionpool.py", line 1180 in _close_pool_connections File "/lib/python3.10/weakref.py", line 591 in call File "/lib/python3.10/weakref.py", line 667 in _exitfunc
Extension modules: radiusd (total: 1) `
I presume it is related to the issue mentioned above.
What type of defect/bug is this?
Crash or memory corruption (segv, abort, etc...)
How can the issue be reproduced?
I'd like to have 2 instances of Python code (using rlm_python) in order to split my code into 2 scripts
e.g smx like this
ipaddr.py
:service.py
: and the second script returns something likeThe idia is to handle in different scripts for different
kinds
of usernames, I need it for Cisco ISG, where I haveusers
withUser-Name
= IP ADDRESS andService
whereUser-Name
is name of serviceSo I'm trying to do it in the following way:
There is no real code in scripts, just 2 copies of example.py from distribution.
And I got:
One script works OK, so as workaround I can put all code into one file, it possible.
Log output from the FreeRADIUS daemon
Relevant log output from client utilities
rlm_python
Backtrace from LLDB or GDB