November 2009 - Freeradius-Devel - lists.freeradius.org

Missing TLS Change Cipher Spec and TLS Finished in EAP-TLS exchanges
by arno＠natisbad.org 09 Jul '11

09 Jul '11

Hi, I upgraded an internal freeradius server (Linux, Debian unstable, libssl 0.9.8) used for EAP-TLS (802.11 WPA2 access) from 2.0.5 to 2.1.3. With 2.1.3, client authentication fails in the following way (wpasupplicant on Debian unstable, working with 2.0.5): - the TLS exchange is completed from freeradius point of view. It even sends the Access-Accept message to the NAS. - from the clients point of view, the TLS exchange is not over, it expects some more data from the server which are never sent. I took two pcap traces (sent to you privately, Alan), one with 2.0.5, one with 2.1.3. It looks like the TLS Change Cipher and TLS Tinished elements of the TLS exchange are not in the EAP encapsulated TLS packets sent by the server. Compare packet #23 of 2.1.3 trace with packet #27 of 2.0.5 trace. If you use wireshark, you will notice that the SSL layer is dissected; this is because #27 has a small brother: #29. It is not sent by 2.1.3. Alan, if you have an idea or a patch, I can test it on monday. Cheers, a+

5 15

eap2 in freeradius
by Chanthearith HUON 04 Apr '11

04 Apr '11

Hi everyone, I am testing eap2 in freeradius. I run "radiusd -X", I got following error message " radiusd: symbol lookup error: /usr/lib/rlm_eap2-2.1.0.so: undefined symbol: eap_server_register_methods " Anyone, have any idea what might be wrong with the configuration? Thank in advance, Thierry

5 10

make_passwd(), rlm_perl and double quotes in the password
by Niko Tyni 28 Jan '10

28 Jan '10

Hi, we're seeing failed logins when proxying authentication requests through to another RADIUS server if the password contains a double quote ("). I've debugged the issue a bit, and what happens is that when the password does a roundtrip through the rlm_perl module, the value pair structure ends up with extra bytes at the end so that strlen(vp->data.strvalue) > vp->length. These extra bytes are the result of escaping the double quote before entering the Perl code and then unescaping it afterwards. For instance, the password abcdef" is passed as abcdef\" to the Perl code, and afterwards it becomes abcdef"" with length 7 (so the extra byte is not supposed to hurt AIUI.) Unfortunately make_passwd() rounds 'inlen' up to a multiple of 16 before copying the input string, so the extra bytes end up in the message authenticator of the proxied request. It seems to me that the escaping and unescaping done in rlm_perl via perl_store_vps() -> vp_prints_value() -> librad_safeprint() and get_hv_content() -> pairadd_sv() -> pairmake() -> pairparsevalue() is a bit unnecessary, and that the unescaping could zero out the extra bytes, but the main bug is in make_passwd() IMO. I have reproduced this with a Debian 2.0.4 freeradius package, a Fedora 2.1.3 package, and a current git.freeradius.org checkout (commit ef2a7db5e). I'm attaching a proposed patch to make_passwd(). Please let me know if you need more information, I can easily produce stack traces and the like. Thanks for your work on FreeRADIUS, -- Niko Tyni ntyni(a)cc.helsinki.fi

3 5

Re: vmps request: long attribute VQP-Ethernet-Frame
by Hermann Lauer 05 Jan '10

05 Jan '10

Alan DeKok wrote: > > 0x0c05 is VQP-Ethernet-Frame, which can of course be longer than 253 bytes, > > so there is a design issue here. One idea would be to cut the attribute to > > 253 bytes in vqp_recv(). Could this be done there without memory issues ? > > Yes, if you're not interested in the rest of the data. appended is a patch which implemeted the cutting. Seems to work. Please tell me if anybody sees any pitfall in it. Otherwise it should be cleaned up, which I probably will do in a week or so. Thanks, Hermann -- Netzwerkadministration/Zentrale Dienste, Interdiziplinaeres Zentrum fuer wissenschaftliches Rechnen der Universitaet Heidelberg IWR; INF 368; 69120 Heidelberg; Tel: (06221)54-8236 Fax: -5224 Email: Hermann.Lauer(a)iwr.uni-heidelberg.de

2 5

PATCH: allow detail listeners to write to other files
by John Morrissey 06 Dec '09

06 Dec '09

I noticed[1] that detail listeners refuse to write detail entries to files, even if the destination filename is different from the source filename. The attached patch fixes that. It also centralizes the listen_detail_t definition, removing the 'stub' definition in src/main/event.c. john [1] https://lists.freeradius.org/pipermail/freeradius-users/2009-October/msg001… -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

2 6

Setting Client-IP-Address in rlm_preprocess
by John Morrissey 04 Dec '09

04 Dec '09

Client-IP-Address is dynamically set by xlat_packet(). AFAICT, there's no way to trigger this in rlm_perl, so Client-IP-Address is never available in rlm_perl handlers. This leads to some interesting unlang to set Client-IP-Address in the request so rlm_perl can access it: authorize { update request { Client-IP-Address := "%{Client-IP-Address}" } } rlm_preprocess sets NAS-IP-Address if it's not set. Alan, would you accept a patch to add similar behavior for Client-IP-Address? john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

3 7

[PATCH] Fix phat fingering in rlm_ldap.c
by Alexander Clouter 30 Nov '09

30 Nov '09

Fix phat fingering in 3d63215138cbe66dc5e656fec00e836a3b0e3262 that prevented src/modules/rlm_ldap/rlm_ldap.c from compiling. Signed-off-by: Alexander Clouter <alex(a)digriz.org.uk> --- src/modules/rlm_ldap/rlm_ldap.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/modules/rlm_ldap/rlm_ldap.c b/src/modules/rlm_ldap/rlm_ldap.c index fa1416f..e7cd600 100644 --- a/src/modules/rlm_ldap/rlm_ldap.c +++ b/src/modules/rlm_ldap/rlm_ldap.c @@ -2322,9 +2322,9 @@ static LDAP *ldap_connect(void *instance, const char *dn, const char *password, if (ldap_int_tls_config(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, (inst->tls_require_cert)) != LDAP_OPT_SUCCESS) { ldap_get_option(ld, LDAP_OPT_ERROR_NUMBER, &ldap_errno); - radlog(L_ERR, " [%s] could not set ", inst->xlat_name + radlog(L_ERR, " [%s] could not set " "LDAP_OPT_X_TLS_REQUIRE_CERT option to %s: %s", - inst->tls_require_cert, + inst->xlat_name, inst->tls_require_cert, ldap_err2string(ldap_errno)); } #endif -- 1.5.6.5

2 1

GIT Log for 2009-11-30 00:33 GMT
by aland＠deployingradius.com 30 Nov '09

30 Nov '09

commit 139c45b4c51c945414b53ece36bbeb42edb1b2a7 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Nov 29 16:07:23 2009 +0100 Clean up state machine. This error happens when "max_request_time" is set VERY low. i.e. lower than "response_window". (12s versus 30s). The current logic for enforcing the various timers is pretty bad. There is one timer per request, and it bounces around between the different requirements. At the time it was written, it seemed simpler than trying to manage 3-4 simultaneous timers per request. When the request is proxied, the timer being applied is for "response_window". BUT by the time that expires, the "max_request_time" has expired. The code *does* notice that it has expired. BUT it doesn't notice that there's no child thread processing the request. So it waits for the child thread to exit... forever. At some point, a timer overflows, and it dies. There are a few changes to make: 1) check for "no child" in this situation, and clean up the request rather than waiting forever. 2) cap the timer to 5 minutes (this can still happen, for example, when a bad DB locks a thread for hours at a time). 3) don't overflow when adding timer values. src/main/event.c | 64 ++++++++++++++++++++++++----------------------------- 1 files changed, 29 insertions(+), 35 deletions(-)

1 0

GIT Log for 2009-11-28 00:33 GMT
by aland＠deployingradius.com 28 Nov '09

28 Nov '09

commit 7074e78ce2be752ed5e1cf6d6bf803851b9f6170 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Nov 27 15:58:58 2009 +0100 L_INFO, "PROXY:... --> L_PROXY, "... Simplifies and regularizes the log messages Files changed: src/main/event.c | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) ====================================================================== commit d9c1a2535a0226d07d19b3489b51b548b73b8121 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Nov 27 13:01:06 2009 +0100 Fix typo Files changed: raddb/proxy.conf | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 657d34ff7449d1a81bf72e4301d8a482019708eb Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Nov 27 12:07:25 2009 +0100 Initialize timers for Status-Server For some weird reason they weren't initialized in debugging mode, so we force it here. This WAS tested to work... so I have no idea why it stopped. We also ignore Status-Server packets when marking home_servers as alive. That way, the ping_check will work properly... Files changed: src/main/event.c | 6 +++++- 1 files changed, 5 insertions(+), 1 deletions(-) ====================================================================== commit aa458464b16c1f3d96b863e6bfacaf96fded7d23 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Nov 27 11:53:29 2009 +0100 Use new home_server_find API Files changed: src/main/event.c | 2 +- src/main/stats.c | 2 +- src/modules/frs_status/frs_status.c | 3 ++- 3 files changed, 4 insertions(+), 3 deletions(-) ====================================================================== commit 943007dc6f3fed810a3f0b06eb23a09a3d54f9c4 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Nov 27 11:47:56 2009 +0100 Add tcp/udp to CLI for home_servers Files changed: src/include/realms.h | 2 +- src/main/realms.c | 8 ++++- src/modules/frs_control/frs_control.c | 61 +++++++++++++++++++++++--------- 3 files changed, 52 insertions(+), 19 deletions(-) ======================================================================

1 0

GIT Log for 2009-11-27 00:33 GMT
by aland＠deployingradius.com 27 Nov '09

27 Nov '09

commit 208ec58bcf9f2e7969d26275bcdc6e3d366ff2ca Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Nov 26 19:10:44 2009 +0100 Remove erroneous handling of option 82 Files changed: src/modules/frs_dhcp/dhcp.c | 6 ------ 1 files changed, 0 insertions(+), 6 deletions(-) ====================================================================== commit f2323bf8826454b0fb1b433efa2353c21074b6c4 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Nov 26 18:16:00 2009 +0100 Change some DEBUG to radlog So that interesting state changes / internal events will get logged Files changed: src/main/event.c | 16 ++++++++-------- 1 files changed, 8 insertions(+), 8 deletions(-) ====================================================================== commit 103d7fb2e4c381421b22abea934776538937ccdc Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Nov 26 14:24:30 2009 +0100 Log more messages, rather than just doing debug with them Files changed: src/main/event.c | 13 +++++++------ 1 files changed, 7 insertions(+), 6 deletions(-) ======================================================================

1 0