From 08f83072048f2c4c783c3216f5933f04b191847f Mon Sep 17 00:00:00 2001 From: Holger Weiss Date: Sun, 11 Apr 2010 16:33:44 +0200 Subject: Fix Debian bug #482947: No --nas-ip-address option | check_radius doesn't seem to provide any way to modify the | NAS-IP-Address attribute that it uses in the packets it sends, but it | does so for NAS-Identifier. | | Instead, it hardcodes the IP address that it gets from the | rc_own_ipaddress() library call, and that in turn translates into | calling gethostbyname() on the result of uname(). This call can easily | fail, and its result can easily be unsuitable - for example when the | Nagios instance uses its own virtual host, and you don't want the | original system hostname leaked to the RADIUS servers you monitor with | this. | | Furthermore, this behaviour is inconsistent with RFC 2865, which | defines the two attributes as analogous and never suggests hardcoding | the value of either of them in client software. Therefore, this commit adds the "-N, --nas-ip-address" option which allows for specifying the value of the NAS-IP-Address attribute. | I've also noticed that the original code for NAS-IP-Address hardcoding | is broken in its error handling - it does "return (ERROR_PC)", which | is meaningless in the context of check_radius.c. That actually seems | to be copy&waste from radiusclient-0.3.2/src/radexample.c. :) I fixed | that. | | While debugging, I also took the opportunity to decouple the | nas-identifier rc_avpair_add() instance from the initial three, | because this is just bad practice to lump a fourth optional attribute | into the same block with the required attributes, the error handling | for which is throwing the same daft message "Out of Memory?"... [ http://bugs.debian.org/482947 ] (Contributed by Josip Rodin, forwarded by Jan Wagner.) --- NEWS | 1 + 1 file changed, 1 insertion(+) (limited to 'NEWS') diff --git a/NEWS b/NEWS index 8ad698d4..99d48e90 100644 --- a/NEWS +++ b/NEWS @@ -4,6 +4,7 @@ This file documents the major additions and syntax changes between releases. ENHANCEMENTS New check_ntp_peer -m and -n options to check the number of usable time sources ("truechimers") New check_disk_smb -a option which allows for specifying the IP address of the remote server + New check_radius -N option which allows for specifying the value of the NAS-IP-Address attribute FIXES Fix check_ircd binding to wrong interface (#668778) Add proxy-authorization option to check_http (Marcel Kuiper - #1323230, Bryan Irvine - #2863925) -- cgit v1.2.3-74-g34f1