January 2009 - Freeradius-Devel - lists.freeradius.org

Missing TLS Change Cipher Spec and TLS Finished in EAP-TLS exchanges
by arno＠natisbad.org 09 Jul '11

09 Jul '11

Hi, I upgraded an internal freeradius server (Linux, Debian unstable, libssl 0.9.8) used for EAP-TLS (802.11 WPA2 access) from 2.0.5 to 2.1.3. With 2.1.3, client authentication fails in the following way (wpasupplicant on Debian unstable, working with 2.0.5): - the TLS exchange is completed from freeradius point of view. It even sends the Access-Accept message to the NAS. - from the clients point of view, the TLS exchange is not over, it expects some more data from the server which are never sent. I took two pcap traces (sent to you privately, Alan), one with 2.0.5, one with 2.1.3. It looks like the TLS Change Cipher and TLS Tinished elements of the TLS exchange are not in the EAP encapsulated TLS packets sent by the server. Compare packet #23 of 2.1.3 trace with packet #27 of 2.0.5 trace. If you use wireshark, you will notice that the SSL layer is dissected; this is because #27 has a small brother: #29. It is not sent by 2.1.3. Alan, if you have an idea or a patch, I can test it on monday. Cheers, a+

5 15

eap2 in freeradius
by Chanthearith HUON 04 Apr '11

04 Apr '11

Hi everyone, I am testing eap2 in freeradius. I run "radiusd -X", I got following error message " radiusd: symbol lookup error: /usr/lib/rlm_eap2-2.1.0.so: undefined symbol: eap_server_register_methods " Anyone, have any idea what might be wrong with the configuration? Thank in advance, Thierry

5 10

Re: vmps request: long attribute VQP-Ethernet-Frame
by Hermann Lauer 05 Jan '10

05 Jan '10

Alan DeKok wrote: > > 0x0c05 is VQP-Ethernet-Frame, which can of course be longer than 253 bytes, > > so there is a design issue here. One idea would be to cut the attribute to > > 253 bytes in vqp_recv(). Could this be done there without memory issues ? > > Yes, if you're not interested in the rest of the data. appended is a patch which implemeted the cutting. Seems to work. Please tell me if anybody sees any pitfall in it. Otherwise it should be cleaned up, which I probably will do in a week or so. Thanks, Hermann -- Netzwerkadministration/Zentrale Dienste, Interdiziplinaeres Zentrum fuer wissenschaftliches Rechnen der Universitaet Heidelberg IWR; INF 368; 69120 Heidelberg; Tel: (06221)54-8236 Fax: -5224 Email: Hermann.Lauer(a)iwr.uni-heidelberg.de

2 5

GIT Log for 2009-01-31 00:33 GMT
by aland＠deployingradius.com 30 Jan '09

30 Jan '09

commit 0d0e1aad28d8ba78c489c6ab320bb76f949326ea Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Jan 30 11:24:11 2009 +0100 Added UNUSED Files changed: src/main/radwho.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) ====================================================================== commit f99c549ea2d2cf03847f9ba886b3943db921ab52 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Jan 30 11:23:13 2009 +0100 Save string for regexes Files changed: src/lib/valuepair.c | 2 -- 1 files changed, 0 insertions(+), 2 deletions(-) ====================================================================== commit ee118a0910318f715b630e744a70ffef9292156f Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Jan 30 11:20:32 2009 +0100 Simplified patch from b4c873 Files changed: src/modules/frs_vmps/vqp.c | 12 +++++++++--- 1 files changed, 9 insertions(+), 3 deletions(-) ====================================================================== commit 0d70d8ee883760ba91a5b0771da411a23d517984 Author: Arnaud Ebalard <arno(a)natisbad.org> Date: Fri Jan 30 11:16:37 2009 +0100 Fix broken EAP-TLS (bug introduced 2008/08/24 by b51a3a82) Thu, 29 Jan 2009 16:31:10 +0100 To: aland <aland(a)deployingradius.com> CC: Axel Tillequin <axel.tillequin(a)eads.net>, FreeRadius developers mailing list <freeradius-devel(a)lists.freeradius.org> Hi, As explained in previous mails of the thread, FreeRadius EAP-TLS support is broken (the EAP encapsulated TLS ChangeCipherSpec and TLS Finished messages are not sent). Bisecting the issue led me here: commit b51a3a82edb797f5d0a2758bd1a38359d6f66803 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Aug 24 10:04:55 2008 +0200 Clean up debug && log messages AFAICT, the test that prevented eaptls_ack_handler() to return EAPTLS_SUCCESS *before* flushing remaining local messages (i.e. returning EAPTLS_REQUEST so that they be sent to the peer to complete the TLS handshake) was removed in that commit. The patch below is against current git tree. With Axel, we tested the fix with 2.1.3: it corrects the issue. Cheers, a+ Signed-off-by: Arnaud Ebalard <arno(a)natisbad.org> Tested-by: Axel Tillequin <axel.tillequin(a)gmail.com> Files changed: src/modules/rlm_eap/libeap/eap_tls.c | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-) ====================================================================== commit 58b1b58ba6a71f5ed0c5b0d2edf054561e7e83e6 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Jan 30 11:13:48 2009 +0100 Corrected typo Files changed: src/lib/misc.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit b231705c488c4308a59b5270f21acdb6f271d486 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Jan 29 12:55:47 2009 +0100 Chop ethernet frame to 253 rather than rejecting the packet Conflicts: src/modules/frs_vmps/vqp.c Files changed: src/modules/frs_vmps/vqp.c | 31 +++++++++---------------------- 1 files changed, 9 insertions(+), 22 deletions(-) ======================================================================

1 0

Regex operator not working
by Stephan Jaeger 30 Jan '09

30 Jan '09

Hello, in src/lib/valuepair.c there is a case T_OP_REG_EQ: /* =~ */ case T_OP_REG_NE: /* !~ */ return vp; around line 1540. But the value is copied into the vp just before the end of the function. This lets every AVP with a regex op have an empty value which makes the regex always match. Regards Stephan Jaeger -- Stephan Jaeger <stephan.jaeger(a)ewetel.de> EWE TEL GmbH

2 2

GIT Log for 2009-01-29 00:33 GMT
by aland＠deployingradius.com 30 Jan '09

30 Jan '09

commit cb26787cc23c47824d2f24cd3b582273806a3f9e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Jan 28 16:25:21 2009 +0100 Corrected typo Files changed: share/dictionary.cisco.vpn3000 | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 243983349ba6d831da15677c46ff1f07fe977d68 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Jan 28 14:59:42 2009 +0100 Corrected MySQL syntax to = NULL Files changed: raddb/sql/mysql/ippool.conf | 14 +++++++------- 1 files changed, 7 insertions(+), 7 deletions(-) ======================================================================

3 4

freeradius send message to hostapd
by Rodolphe Marques 29 Jan '09

29 Jan '09

hi, I'm developing a new authentication protocol and I used kernel function send, to send a message to the radius server. Hi would like to know how to send a message from the radius server to hostapd. Best Regards Rodolphe

1 0

vmps request: long attribute VQP-Ethernet-Frame
by Hermann Lauer 29 Jan '09

29 Jan '09

Dear developers, while trying to use freeradius 2.1.3 for vmps service I run into the rather hard limit of 253 bytes per attribute. Debugging with the appended patch to see which attribute is the culprit yields to: Thu Jan 29 10:37:34 2009 : Debug: Ready to process requests. Thu Jan 29 10:39:02 2009 : Error: Packet contains attribute 0x0c05 with invalid length 05 81 0x0c05 is VQP-Ethernet-Frame, which can of course be longer than 253 bytes, so there is a design issue here. One idea would be to cut the attribute to 253 bytes in vqp_recv(). Could this be done there without memory issues ? Thanks, Hermann -- Netzwerkadministration/Zentrale Dienste, Interdiziplinaeres Zentrum fuer wissenschaftliches Rechnen der Universitaet Heidelberg IWR; INF 368; 69120 Heidelberg; Tel: (06221)54-8236 Fax: -5224 Email: Hermann.Lauer(a)iwr.uni-heidelberg.de

2 1

GIT Log for 2009-01-28 00:33 GMT
by aland＠deployingradius.com 27 Jan '09

27 Jan '09

commit 5dc52e56d6b4d2aa96712edf8e73374f4be73475 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Jan 27 10:14:02 2009 +0100 Added freeswitch dictionary share/dictionary | 1 + share/dictionary.freeswitch | 112 +++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 113 insertions(+), 0 deletions(-)

1 0

..::vlan support::..
by Ing. Alfonso Reyes 26 Jan '09

26 Jan '09

Hi list I'm trying to get a configuration guide or some advices to implement the vlan support to my wireless network, could you please let me know where can I get it? I've checked the freeradius web page with no luck. Thanks in advance. Alfonso Reyes

1 0