August 2008 - Freeradius-Devel - lists.freeradius.org

GIT Log for 2008-08-26 23:33 GMT
by aland＠deployingradius.com 26 Aug '08

26 Aug '08

commit e15f3b33c2b4fae4abed0eac80fe94eb82e795de Author: Stephen Gran <steve(a)lobefin.net> Date: Mon Aug 25 14:18:19 2008 +0100 Fix unsafe use of tmpfile. Signed-off-by: Stephen Gran <steve(a)lobefin.net> Files changed: dialup_admin/bin/backup_radacct | 16 ++++++++-------- 1 files changed, 8 insertions(+), 8 deletions(-) ====================================================================== commit d21c7dc8da9c638377d6095cc499c3285c5fdd64 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Aug 26 15:27:23 2008 +0200 Check for __thread For thread-local storage. Files changed: aclocal.m4 | 12 -------- configure | 64 +-------------------------------------------- configure.in | 2 - src/include/autoconf.h.in | 3 -- 4 files changed, 1 insertions(+), 80 deletions(-) ====================================================================== commit 236126fdbd47de316e987b73d700208d902d5171 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Aug 26 15:15:22 2008 +0200 Use thread-local storage for log messages We try to use __thread where possible... it's better. Files changed: src/lib/log.c | 78 ++++---------------------------------------------------- 1 files changed, 6 insertions(+), 72 deletions(-) ====================================================================== commit 26d104026c948c473dbed6c2c369ab2c76db5844 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Aug 26 11:16:37 2008 +0200 fr_strerror -> fr_strerror() This is in preparation for (perhaps) making the logging functions thread-safe. Files changed: src/include/libradius.h | 2 +- src/lib/dhcp.c | 8 ++++---- src/lib/dict.c | 6 +++--- src/lib/log.c | 20 +++++++------------- src/lib/valuepair.c | 2 +- src/main/client.c | 2 +- src/main/dhcpd.c | 2 +- src/main/evaluate.c | 4 ++-- src/main/event.c | 2 +- src/main/files.c | 4 ++-- src/main/listen.c | 8 ++++---- src/main/mainconfig.c | 2 +- src/main/modcall.c | 2 +- src/main/modules.c | 2 +- src/main/radclient.c | 6 +++--- src/main/radsniff.c | 2 +- src/main/vmps.c | 4 ++-- src/modules/rlm_acct_unique/rlm_acct_unique.c | 2 +- src/modules/rlm_attr_rewrite/rlm_attr_rewrite.c | 2 +- src/modules/rlm_eap/libeap/mppe_keys.c | 2 +- .../rlm_eap/types/rlm_eap_ikev2/rlm_eap_ikev2.c | 2 +- .../rlm_eap/types/rlm_eap_sim/rlm_eap_sim.c | 2 +- src/modules/rlm_ldap/rlm_ldap.c | 2 +- src/modules/rlm_mschap/rlm_mschap.c | 4 ++-- src/modules/rlm_policy/evaluate.c | 2 +- src/modules/rlm_sql/rlm_sql.c | 4 ++-- src/modules/rlm_sql/sql.c | 2 +- src/modules/rlm_sql_log/rlm_sql_log.c | 2 +- 28 files changed, 49 insertions(+), 55 deletions(-) ====================================================================== commit d3e553987770e50807fd8d97a3f94da99903592c Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Aug 26 10:34:55 2008 +0200 Rename librad_* to fr_* perl -pi -e "s/librad_debug/fr_debug_flag/g;s/librad_log/fr_strerror_printf/g;s/librad_dodns/fr_dns_lookups/g;s/librad_perror/fr_perror/g;s/librad_max_attributes/fr_max_attributes/g;s/librad_safeprint/fr_print_string/g;s/librad_errstr/fr_strerror/g;" Files changed: src/include/libradius.h | 18 +- src/lib/dhcp.c | 28 ++-- src/lib/dict.c | 172 ++++++++++---------- src/lib/filters.c | 20 ++-- src/lib/log.c | 16 +- src/lib/misc.c | 14 +- src/lib/packet.c | 8 +- src/lib/print.c | 8 +- src/lib/radius.c | 92 ++++++------ src/lib/valuepair.c | 100 ++++++------ src/lib/vqp.c | 34 ++-- src/main/auth.c | 4 +- src/main/client.c | 2 +- src/main/conffile.c | 6 +- src/main/dhcpd.c | 2 +- src/main/evaluate.c | 4 +- src/main/event.c | 2 +- src/main/files.c | 4 +- src/main/listen.c | 8 +- src/main/mainconfig.c | 8 +- src/main/modcall.c | 2 +- src/main/modules.c | 2 +- src/main/radclient.c | 24 ++-- src/main/radsniff.c | 8 +- src/main/radwho.c | 6 +- src/main/vmps.c | 4 +- src/modules/rlm_acct_unique/rlm_acct_unique.c | 2 +- src/modules/rlm_attr_rewrite/rlm_attr_rewrite.c | 2 +- src/modules/rlm_dbm/rlm_dbm.c | 2 +- src/modules/rlm_dbm/rlm_dbm_parser.c | 12 +- src/modules/rlm_eap/libeap/mppe_keys.c | 2 +- src/modules/rlm_eap/radeapclient.c | 22 ++-- .../rlm_eap/types/rlm_eap_ikev2/rlm_eap_ikev2.c | 2 +- .../rlm_eap/types/rlm_eap_sim/rlm_eap_sim.c | 2 +- src/modules/rlm_ldap/rlm_ldap.c | 2 +- src/modules/rlm_mschap/rlm_mschap.c | 4 +- src/modules/rlm_policy/evaluate.c | 2 +- src/modules/rlm_sql/rlm_sql.c | 4 +- src/modules/rlm_sql/sql.c | 2 +- src/modules/rlm_sql_log/rlm_sql_log.c | 2 +- 40 files changed, 329 insertions(+), 329 deletions(-) ====================================================================== commit 814b3df8b3532e76246d6bef8d682d57a452e81c Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Aug 26 10:25:34 2008 +0200 Note more changes Files changed: doc/ChangeLog | 26 +++++++++----------------- 1 files changed, 9 insertions(+), 17 deletions(-) ====================================================================== commit d23959cdeef37d48803202864876fc21459faf50 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Aug 25 23:28:49 2008 +0200 Complain on references to things like "prefix =" i.e. check for cp->value == NULL, rather than core dumping Files changed: src/main/conffile.c | 5 ----- 1 files changed, 0 insertions(+), 5 deletions(-) ====================================================================== commit 386cb6348e54c40f3684f4b25d2e3bcab320d160 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Aug 25 11:26:42 2008 +0200 Left this out earlier. Files changed: raddb/modules/wimax | 4 ---- 1 files changed, 0 insertions(+), 4 deletions(-) ======================================================================

1 0

tempfile bug in dialupadmin script
by Stephen Gran 26 Aug '08

26 Aug '08

Hi all, We got a bug report in Debian about an unsafe use of a hard coded tempfile in one of the dialupadmin scripts, so I thought I'd pass on our fix. http://git.debian.org/?p=collab-maint/freeradius.git;a=commitdiff;h=e741df7… Cheers, -- -------------------------------------------------------------------------- | Stephen Gran | Death, when unnecessary, is a tragic | | steve(a)lobefin.net | thing. -- Flint, "Requiem for | | http://www.lobefin.net/~steve | Methuselah", stardate 5843.7 | --------------------------------------------------------------------------

2 3

GIT Log for 2008-08-25 23:33 GMT
by aland＠deployingradius.com 25 Aug '08

25 Aug '08

commit bb8d116da1194eeee47fd7f59065623737db4068 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Aug 25 11:19:22 2008 +0200 Cache is off by default. Document attribute Files changed: raddb/eap.conf | 12 +----------- 1 files changed, 1 insertions(+), 11 deletions(-) ====================================================================== commit 7477adf9f80e25fac260e61cdaf6d9b9b1ceb9d1 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Aug 25 11:17:10 2008 +0200 Enforce session cache enable. If the cache is disabled, then delete the current entry from the list of cached sessions. Also check for new Allow-Session-Resumption attribute. If set to zero, then disallow it for this session, too Files changed: share/dictionary.freeradius.internal | 6 --- src/modules/rlm_eap/libeap/eap_tls.c | 34 ++------------------ src/modules/rlm_eap/libeap/eap_tls.h | 1 - .../rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c | 4 -- 4 files changed, 3 insertions(+), 42 deletions(-) ====================================================================== commit 1509ddf6b4910a96a39f4df608362113ace4bad4 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Aug 25 10:34:28 2008 +0200 Finish Session Resumption patch - cache User-Name It just caches User-Name right now, and doesn't do much else. But it's slightly better than it was before. Files changed: src/modules/rlm_eap/libeap/cb.c | 7 --- src/modules/rlm_eap/libeap/eap_tls.c | 42 -------------------- src/modules/rlm_eap/libeap/eap_tls.h | 6 +-- src/modules/rlm_eap/radeapclient.c | 5 -- src/modules/rlm_eap/types/rlm_eap_peap/peap.c | 3 +- .../rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c | 17 ++++---- .../rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c | 38 +----------------- .../rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c | 5 +- src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c | 3 +- 9 files changed, 19 insertions(+), 107 deletions(-) ======================================================================

1 0

documentation
by Terdik Sándor 25 Aug '08

25 Aug '08

Hi! My name is Sandor Terdik. I'm a university student in Hungary. We have to do a project which contain some Radius exercises. One part of project is a new Radius mechanism. I would like to ask you if we'll develope in the Freeradius source is there any detailed documentation that describe the content of source file and the connection between them? Yours sincerely, Sandor Terdik! ______________________________________________________________________ Digitális fényképezőgépek akár 5000 Ft ajándék fotókidolgozással a FotoMarket Online Fotóáruházban! - www.fotomarket.hu VÁSÁROLNA? SEGÍTÜNK! Igényeljen hitelkártyát online és élvezze Ön is a vásárlás szabadságát!

2 1

GIT Log for 2008-08-24 23:33 GMT
by aland＠deployingradius.com 25 Aug '08

25 Aug '08

commit 6bf68d4707c84ea82c8f30e34cd54f2dcf28fa0b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Aug 24 10:35:30 2008 +0200 PEAP & TTLS support for session resumption. It works (sort of). it doesn't cache the original inner username, so the user name in the reply is wrong (i.e. anonymous). It SHOULD cache a lot more things, like CUI. This list could also be configurable. It also needs to run the resumption stuff through a virtual server again, to see if the user is still authorized. OR, have an attribute that's added to the request to mark it as session resumption, and then any post-auth policy can key off of that, and do more stuff Files changed: src/modules/rlm_eap/types/rlm_eap_peap/eap_peap.h | 5 -- src/modules/rlm_eap/types/rlm_eap_peap/peap.c | 37 +---------------- .../rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c | 44 ++----------------- .../rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c | 6 --- 4 files changed, 7 insertions(+), 85 deletions(-) ====================================================================== commit a20963fdc84a9cce7ce2d8498324cc7cb4ffa055 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Aug 23 17:10:23 2008 +0200 Document TLS session cache Files changed: raddb/eap.conf | 29 ----------------------------- 1 files changed, 0 insertions(+), 29 deletions(-) ====================================================================== commit bd1fba803e3403bebf495f7c040eb6e60753152c Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Aug 24 10:07:28 2008 +0200 First draft of session resumption. It doesn't work, as TLS/PEAP/TTLS have to updated to handle session resumption. But the basics are there. Files changed: src/modules/rlm_eap/libeap/tls.c | 5 +- .../rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c | 185 +------------------- .../rlm_eap/types/rlm_eap_tls/rlm_eap_tls.h | 7 - 3 files changed, 2 insertions(+), 195 deletions(-) ====================================================================== commit b51a3a82edb797f5d0a2758bd1a38359d6f66803 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Aug 24 10:04:55 2008 +0200 Clean up debug && log messages Files changed: src/modules/rlm_eap/libeap/eap_tls.c | 52 +++++++++++++--------------------- src/modules/rlm_eap/libeap/tls.c | 12 ++++---- 2 files changed, 26 insertions(+), 38 deletions(-) ====================================================================== commit dbf718e04d044832c1a1c97ba57b3a0b075eef2e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Aug 23 21:56:16 2008 +0200 Added VALUEs taken from the PDF Files changed: share/dictionary.microsoft | 32 +------------------------------- 1 files changed, 1 insertions(+), 31 deletions(-) ====================================================================== commit 2ece1177e972162e38cd62e46c936998726046de Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Aug 24 09:02:41 2008 +0200 Automatically calculate MPPE keys This involves adding prf_label to tls_session_t setting it in eaptls_initiate (depending on EAP type) deleting references to gen_mppe_keys() from individual methods making eaptls_success take HANDLER passing HANDLER to eaptls_success generating MPPE keys in eaptls_success Also made eaptls_fail take HANDLER and delete cached sessions (if any) on fail This means that the EAP methods don't have to delete any sessions. They just call fail, and it Does the Right Thing Files changed: src/modules/rlm_eap/libeap/eap_tls.c | 31 ++++---------------- src/modules/rlm_eap/libeap/eap_tls.h | 7 +--- src/modules/rlm_eap/libeap/tls.c | 3 +- src/modules/rlm_eap/types/rlm_eap_peap/peap.c | 15 ++++----- .../rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c | 14 +++++---- .../rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c | 29 +++++------------- .../rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c | 19 +++++++----- src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c | 13 ++++---- 8 files changed, 49 insertions(+), 82 deletions(-) ====================================================================== commit 701f5015a65986eb0d8ff346e5ad5bdf6b2f556a Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Aug 23 14:01:53 2008 +0200 DEBUG -> RDEBUG Files changed: src/modules/rlm_eap/types/rlm_eap_peap/peap.c | 31 +++++++++++++------------ 1 files changed, 16 insertions(+), 15 deletions(-) ====================================================================== commit 813dfb6ae64d013b6e6dbcff44c1a1d00726dc0d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Aug 24 08:58:20 2008 +0200 DEBUG -> RDEBUG Files changed: src/modules/rlm_eap/types/rlm_eap_peap/peap.c | 42 +++++++++---------- .../rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c | 8 ++-- 2 files changed, 24 insertions(+), 26 deletions(-) ====================================================================== commit 12b7f6efb1bbf6c70061d590a5ddfb1f71b0fefd Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Aug 23 08:15:02 2008 +0200 Generate ephemeral RSA keys Files changed: .../rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c | 24 -------------------- 1 files changed, 0 insertions(+), 24 deletions(-) ====================================================================== commit 2e58da8fd76743a27ee7d47e4f28718841e443d1 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Aug 23 07:53:11 2008 +0200 Pull SSL handshake code into libeap Files changed: src/modules/rlm_eap/libeap/eap_tls.c | 174 +++++++----------------- src/modules/rlm_eap/libeap/tls.c | 17 +++ src/modules/rlm_eap/types/rlm_eap_peap/peap.c | 12 ++ src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c | 12 ++ 4 files changed, 92 insertions(+), 123 deletions(-) ====================================================================== commit 9740e673f048d8625583b368059c3f8f656e8ec8 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Aug 23 21:42:08 2008 +0200 Close pipe FD's on failed fork Files changed: src/main/exec.c | 4 ---- 1 files changed, 0 insertions(+), 4 deletions(-) ====================================================================== commit db1b9356b9ebfd3ea0652c9ce7853d55d5da8c78 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Aug 23 22:18:04 2008 +0200 Clear OpenSSL Error queue for the current thread Files changed: src/main/threads.c | 7 ------- 1 files changed, 0 insertions(+), 7 deletions(-) ====================================================================== commit dfad9c876958406277aa80da76ad9c2d649c0839 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Aug 24 08:38:22 2008 +0200 Regular expressions are compiled at run-time, not compile time Files changed: src/lib/valuepair.c | 34 +++++++++++++++++++++++++++++++--- 1 files changed, 31 insertions(+), 3 deletions(-) ====================================================================== commit d1ea545ae78f4da963d8bc36a3f327d9bc73a49a Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Aug 24 08:21:51 2008 +0200 Print out filter, not optarg Files changed: src/main/radsniff.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) ======================================================================

2 1

GIT Log for 2008-08-22 23:33 GMT
by aland＠deployingradius.com 22 Aug '08

22 Aug '08

commit 9d696c4d530b7c921314e0dc7f8d39bca39ac71b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Aug 21 10:29:27 2008 +0200 WiMAX tests Files changed: src/tests/Makefile | 3 +-- src/tests/wimax | 24 ------------------------ 2 files changed, 1 insertions(+), 26 deletions(-) ====================================================================== commit 45e7abe8e7af24eecc6927349adc96c06e521f3f Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Aug 21 10:23:47 2008 +0200 Make WiMAX dictionary "live" Files changed: share/dictionary | 1 - 1 files changed, 0 insertions(+), 1 deletions(-) ====================================================================== commit 2e80621434028fa849617afe2f530c4aeeee8deb Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Aug 21 10:23:35 2008 +0200 Pack/unpack WiMAX attributes into RADIUS packets Files changed: src/lib/radius.c | 911 +++++++++--------------------------------------------- 1 files changed, 149 insertions(+), 762 deletions(-) ====================================================================== commit d6f36ad058c8e0049352af58170ced8c2e3228dd Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Aug 21 10:22:58 2008 +0200 Read combo-ip, signed, and tlv types from dictionaries Files changed: src/lib/dict.c | 135 ++----------------------------------------------------- 1 files changed, 5 insertions(+), 130 deletions(-) ====================================================================== commit c7bf8ad1f66b9ce0dbfceb657f398f683062ac58 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Aug 21 10:22:22 2008 +0200 Parse, process, and free signed, combo-ip, and tlv types Files changed: src/lib/valuepair.c | 71 ++------------------------------------------------ 1 files changed, 3 insertions(+), 68 deletions(-) ====================================================================== commit 8d3ada1b30ad2d1a62decc42209508d04d687c25 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Aug 21 10:21:25 2008 +0200 Print signed and TLV types Files changed: src/lib/print.c | 13 ------------- 1 files changed, 0 insertions(+), 13 deletions(-) ====================================================================== commit 7c07a4bc43b6003eafdaa3bb9ac1c3fede38d2f2 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Aug 21 10:20:51 2008 +0200 Define COMBO IP, Signed, and TLV types Files changed: src/include/libradius.h | 8 -------- src/include/radius.h | 3 --- 2 files changed, 0 insertions(+), 11 deletions(-) ====================================================================== commit 56e138ba72573a36ccfc415dd7bdb5fd6e95a27a Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Aug 21 10:19:52 2008 +0200 Pretty-print VSA's a little better Files changed: src/main/radclient.c | 54 +++---------------------------------------------- 1 files changed, 4 insertions(+), 50 deletions(-) ====================================================================== commit 8b1dca09c598593784dbf46bc2822f9c0c0348a0 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Aug 21 10:19:15 2008 +0200 WiMAX dictionary. Not included because the server doesn't yet understand it Files changed: share/dictionary.wimax | 348 ------------------------------------------------ 1 files changed, 0 insertions(+), 348 deletions(-) ====================================================================== commit 8a753ee8aa87968f014d7a576d02eddaad268417 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Aug 21 10:18:37 2008 +0200 Simple module to fix WiMAX Calling-Station-Id Files changed: src/modules/rlm_wimax/Makefile | 11 ---- src/modules/rlm_wimax/rlm_wimax.c | 116 ------------------------------------- 2 files changed, 0 insertions(+), 127 deletions(-) ======================================================================

1 0

Eap support in Freeradius
by Chanthearith HUON 22 Aug '08

22 Aug '08

Hello, I read the freeradius website concerning eap support http://wiki.freeradius.org/EAP It did not specify that current freeradius supports eap-psk, eap-sake and eap-ehash. So I would like to verify if current (2.0.5) freeRADIUS support eap-psk, eap-sake and eap-ehash? Best regards, Thierry

2 1

GIT Log for 2008-08-21 23:33 GMT
by aland＠deployingradius.com 21 Aug '08

21 Aug '08

commit 7e5943a3f8758e8c992b4bb6cd68f0c2dc497685 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Aug 21 09:55:57 2008 +0200 Don't double-escape strings in pairread() If 'value' is a double-quoted string, then gettoken() already escaped \n -> 0x0a. Calling pairmake() with value does the escaping again, which is wrong. Try this with: DEFAULT Filter-Id := "foo\nbar\\n" gettoken() converts the first \n to 0x0a, and the \\ to \. pairmake() then converts the last \n to 0x0a, leaving 2 0x0a's in the string, rather than on 0x0a, and another \n. I've also added handlers in pairread() for single quoted strings, which didn't previously exist. Files changed: src/lib/valuepair.c | 8 +------- 1 files changed, 1 insertions(+), 7 deletions(-) ====================================================================== commit 635de23748e3ed512838cc5a62999852f6d5c586 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Aug 21 08:33:35 2008 +0200 Removed comments about NAS-Identifier. They're wrong Files changed: raddb/sites-available/dynamic-clients | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) ======================================================================

1 0

GIT Log for 2008-08-20 23:33 GMT
by aland＠deployingradius.com 20 Aug '08

20 Aug '08

commit 31ac502081a9049456ad29696d7867b1186180ad Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Aug 20 17:12:34 2008 +0200 Add VENDOR line, too Files changed: share/dct2fr | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-) ====================================================================== commit 15799d5c1bd4ab4c0d074984cfa36d58df9842b7 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Aug 20 17:12:21 2008 +0200 Define vendor (oops) Files changed: share/dictionary.utstarcom | 2 -- 1 files changed, 0 insertions(+), 2 deletions(-) ======================================================================

1 0

eap-tls certificate in freeradius
by Chanthearith HUON 20 Aug '08

20 Aug '08

Hello, I am currently experimenting eap-tls for delay comparison. I am using wpa_supplicant radius's client and freeradius server. I am now having problem dealing with certificates. I used the script provided in the freeradius package to create those certificates successfully however, during the authentication the freeradius just denied the certificate and send "eap failure, code Failure (4)" (showed from Wireshark) to client. I am using fedora 8 (kernel 2.6.23.9-85.fc8) to host both freeradius and wpa_supplicant. Freeradius 1.1.6 (for host i686-pc-linux-gnu, built on Jun 1 2007) wpa_supplicant v0.5.7 (also tried with v0.5.8 but still same problem ) I am not sure if the configurations for creating certificates are correct. Here is the configuration scripts to create CA, server and client certificates (also attached in the mail): -------------------------- CA ------------------------------ [ ca ] default_ca = CA_default [ CA_default ] dir = ./ certs = $dir crl_dir = $dir/crl database = $dir/index.txt new_certs_dir = $dir certificate = $dir/ca.pem serial = $dir/serial crl = $dir/crl.pem private_key = $dir/ca.key RANDFILE = $dir/.rand name_opt = ca_default cert_opt = ca_default default_days = 365 default_crl_days = 30 default_md = md5 preserve = no policy = policy_match [ policy_match ] countryName = match stateOrProvinceName = match organizationName = match organizationalUnitName = optional commonName = supplied emailAddress = optional [ policy_anything ] countryName = optional stateOrProvinceName = optional localityName = optional organizationName = optional organizationalUnitName = optional commonName = supplied emailAddress = optional [ req ] prompt = no distinguished_name = certificate_authority default_bits = 2048 input_password = whatever output_password = whatever x509_extensions = v3_ca [certificate_authority] countryName = FR stateOrProvinceName = Evry localityName = Evry organizationName = Example Inc. emailAddress = admin(a)example.com commonName = "Example Certificate Authority" [v3_ca] subjectKeyIdentifier = hash authorityKeyIdentifier = keyid:always,issuer:always basicConstraints = CA:true -------------------------- end of CA ------------------------------ -------------------------- Client ------------------------------ [ ca ] default_ca = CA_default [ CA_default ] dir = ./ certs = $dir crl_dir = $dir/crl database = $dir/index.txt new_certs_dir = $dir certificate = $dir/server.pem serial = $dir/serial crl = $dir/crl.pem private_key = $dir/server.key RANDFILE = $dir/.rand name_opt = ca_default cert_opt = ca_default default_days = 365 default_crl_days = 30 default_md = md5 preserve = no policy = policy_match [ policy_match ] countryName = match stateOrProvinceName = match organizationName = match organizationalUnitName = optional commonName = supplied emailAddress = optional [ policy_anything ] countryName = optional stateOrProvinceName = optional localityName = optional organizationName = optional organizationalUnitName = optional commonName = supplied emailAddress = optional [ req ] prompt = no distinguished_name = client default_bits = 2048 input_password = whatever output_password = whatever [client] countryName = FR stateOrProvinceName = Evry localityName = Evry organizationName = Example Inc. emailAddress = user(a)example.com commonName = root@localhost -------------------------- end of Client ------------------------------ -------------------------- Server ------------------------------ [ ca ] default_ca = CA_default [ CA_default ] dir = ./ certs = $dir crl_dir = $dir/crl database = $dir/index.txt new_certs_dir = $dir certificate = $dir/server.pem serial = $dir/serial crl = $dir/crl.pem private_key = $dir/server.key RANDFILE = $dir/.rand name_opt = ca_default cert_opt = ca_default default_days = 365 default_crl_days = 30 default_md = md5 preserve = no policy = policy_match [ policy_match ] countryName = match stateOrProvinceName = match organizationName = match organizationalUnitName = optional commonName = supplied emailAddress = optional [ policy_anything ] countryName = optional stateOrProvinceName = optional localityName = optional organizationName = optional organizationalUnitName = optional commonName = supplied emailAddress = optional [ req ] prompt = no distinguished_name = server default_bits = 2048 input_password = whatever output_password = whatever [server] countryName = FR stateOrProvinceName = Evry localityName = Evry organizationName = Example Inc. emailAddress = admin(a)example.com commonName = "Example Server Certificate" -------------------------- end of Server ------------------------------ Best regards, Thierry

1 0