November 2009 - Freeradius-Devel - lists.freeradius.org

FreeRadius + EAP-AKA support
by Kumar, Sunil 26 Nov '09

26 Nov '09

Hi, We are trying to use FreeRadius1.1.4 as authentication server for EAP-AKA implementation with our product toolkit. As per the RFC 4187 AT_RES The value field of this attribute begins with the 2-byte RES Length, which identifies the exact length of the RES in bits. The RES length is followed by the AKA RES parameter. According to [TS33.105], the length of the AKA RES can vary between 32 and 128 bits. Because the length of the AT_RES attribute must be a multiple of 4 bytes, the sender pads the RES with zero bits where necessary. In the freeradius1.1.4 implementation, for EAP-AKA the value of RES length is always considered as constant EAPSIM_RES_SIZE (16). It doesn't take care of the values other than 16 bytes. We in our toolkit needs to support all the variable length of RES values from 32 bits (4 bytes) to 128 bits (16 bytes). So I have modified the FreeRadius implementation for the same support. The intention of writing such mail is to get the information that if somebody has already noticed and fixed this issue in the latest releases, so please share that information as well. In case it's not been fixed as yet, then may be I could contribute my patch for freeradius 1.1.4 version to support all variable length RES value varying from 32 bits to 128 bits. Thanks. Warm regards. Sunil Kumar The information contained in this electronic mail transmission may be privileged and confidential, and therefore, protected from disclosure. If you have received this communication in error, please notify us immediately by replying to this message and deleting it from your computer without copying or disclosing it.

4 5

GIT Log for 2009-11-23 00:33 GMT
by aland＠deployingradius.com 22 Nov '09

22 Nov '09

commit 9eec5347f5a20ce3e726f2eb67194987cc4e7420 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Nov 22 16:56:14 2009 +0100 Print names for unsupported eap types Files changed: src/modules/rlm_eap/eap.c | 12 ++++++++++-- 1 files changed, 10 insertions(+), 2 deletions(-) ====================================================================== commit 208edab2d078a46d9fe21c3e37072375b364d24c Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Nov 22 16:47:29 2009 +0100 More warnings Modifying the values of a virtual attribute is a bad idea. Files changed: src/main/evaluate.c | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) ====================================================================== commit 10437eefa5c77bef81ee1db043d498d2bc2c2887 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Nov 22 16:35:20 2009 +0100 Check for NULL Files changed: src/modules/rlm_expr/paircmp.c | 6 +++++- 1 files changed, 5 insertions(+), 1 deletions(-) ====================================================================== commit 58f959b0e33c91a16163df0b4a0a1b1776ff8595 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Nov 22 09:26:51 2009 +0100 Fixed typo Files changed: man/man8/raddebug.8 | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 84f8a34bef9830fcf23b975605f00b98668c56bc Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Nov 22 09:18:16 2009 +0100 As posted to the list Files changed: src/modules/rlm_jradius/rlm_jradius.c | 16 ++++++++++++++++ 1 files changed, 16 insertions(+), 0 deletions(-) ====================================================================== commit 95b21f458d12a29b0f7c4e6c1ad24e4d96ca9358 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Nov 22 09:16:22 2009 +0100 Move definition so that it doesn't cause issues Use the RFC definitions for the name Files changed: share/dictionary.ascend | 1 - share/dictionary.compat | 1 + 2 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit a021a0c6df2c9a8f80138983cab53278429f6508 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Nov 22 09:12:15 2009 +0100 Revert "errormsg may be NULL" This reverts commit 45877bf44b02d418b6fb263a39e5de07ced58b6e. It doesn't fix the problem, and it seems to cause issues for other people Files changed: .../drivers/rlm_sql_postgresql/sql_postgresql.c | 3 --- 1 files changed, 0 insertions(+), 3 deletions(-) ======================================================================

1 0

segfault in presufcmp()
by Jakob Hirsch 22 Nov '09

22 Nov '09

Hi, comparing Suffix or Prefix without it being set lets the server crash (see backtrace below). This is easily reproducable with this: authorize { # also happens with Prefix if (Suffix == "blub") { } ... This happens on x86 and x64, with 2.1.7 as well as git stable. I guess there should be a check somewhere, maybe for req==NULL in presufcmp(), but I'm not sure. The obvious work around is setting these attributes (with update request) to empty strings or checking them like "if (Prefix && Prefix == ...)". Besides that, I'm surprised that there is special handling for Prefix and Suffix. I thought they are just some attributes I can use as I wish. I parse User-Name with a regex and set them accordingly with %{1} etc. > rad_recv: Access-Request packet from host 127.0.0.1 port 54511, id=178, length=67 > User-Name = "does_not_matter" > User-Password = "b" > NAS-IP-Address = 172.17.13.190 > NAS-Port = 1 > +- entering group authorize {...} > ++? if (Suffix == "blub") > > Program received signal SIGSEGV, Segmentation fault. > 0x00000035b3c7f541 in strlen () from /lib64/libc.so.6 > (gdb) bt > #0 0x00000035b3c7f541 in strlen () from /lib64/libc.so.6 > #1 0x00007ffff750b790 in presufcmp (instance=0x0, req=0x7e5a10, request=0x0, check=0x7e6120, check_pairs=0x0, reply_pairs=0x0) at paircmp.c:134 > #2 0x00000000004273a3 in radius_callback_compare (req=0x7e5a10, request=0x0, check=0x7e6120, check_pairs=0x0, reply_pairs=0x0) at valuepair.c:270 > #3 0x0000000000438260 in radius_do_cmp (request=0x7e5a10, presult=0x7fffffffc280, lt=T_BARE_WORD, pleft=0x7fffffffbe70 "Suffix", token=T_OP_CMP_EQ, rt=T_DOUBLE_QUOTED_STRING, > pright=0x7fffffffba70 "blub", cflags=0, modreturn=6) at evaluate.c:360 > #4 0x0000000000439385 in radius_evaluate_condition (request=0x7e5a10, modreturn=6, depth=1, ptr=0x7fffffffc330, evaluate_it=1, presult=0x7fffffffd360) at evaluate.c:833 > #5 0x0000000000438c61 in radius_evaluate_condition (request=0x7e5a10, modreturn=6, depth=0, ptr=0x7fffffffd810, evaluate_it=1, presult=0x7fffffffd81c) at evaluate.c:614 > #6 0x000000000041eb9d in modcall (component=1, c=0x780500, request=0x7e5a10) at modcall.c:432 > #7 0x000000000041cb89 in indexed_modcall (comp=1, idx=0, request=0x7e5a10) at modules.c:691 > #8 0x000000000041e035 in module_authorize (autz_type=0, request=0x7e5a10) at modules.c:1453 > #9 0x0000000000409421 in rad_authenticate (request=0x7e5a10) at auth.c:565 > #10 0x000000000043327e in radius_handle_request (request=0x7e5a10, fun=0x409226 <rad_authenticate>) at event.c:3693 > #11 0x00000000004258e1 in thread_pool_addrequest (request=0x7e5a10, fun=0x409226 <rad_authenticate>) at threads.c:841 > #12 0x0000000000432850 in event_socket_handler (xel=0x7df710, fd=22, ctx=0x7e57c0) at event.c:3317 > #13 0x00007ffff7df36d3 in fr_event_loop (el=0x7df710) at event.c:400 > #14 0x0000000000433189 in radius_event_process () at event.c:3679 > #15 0x00000000004223e9 in main (argc=2, argv=0x7fffffffe588) at radiusd.c:398 Regards Jakob

2 1

rlm_jradius wimax support patch
by wlanmac 22 Nov '09

22 Nov '09

Hello, Please find the attached patch (given to us by a contributor) that adds a bit of WiMAX support to the rlm_jradius module. Cheers, David

2 1

GIT Log for 2009-11-19 00:33 GMT
by aland＠deployingradius.com 18 Nov '09

18 Nov '09

commit a809dea0195e11fb924b6651c29aa2546708d83a Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Nov 18 18:34:17 2009 +0100 As posted to the list share/dictionary.juniper | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-)

1 0

EAP proxing with client-balance
by Alexander Clouter 18 Nov '09

18 Nov '09

Hi, Being part of the 'eduroam' clan we have a lot of EAP traffic proxying about the place, even more so being part of the 'University Triangle' in London so those peskey students and staff mooch where ever they can. My setup is generally: ---- home_server_pool eduroam { #type = fail-over <-- works #type = client-balance <-- grumbles #type = client-port-balance <-- grumbles type = keyed-balance <-- grumbles home_server = jrs.0 home_server = jrs.1 home_server = jrs.2 } ---- The proxy topology in eduroam (incase you do not know) is: [us x 2] ---------- [ .ja.net proxies x 3 ] ---------- [them x 2] <ramble> I used 'keyed-balance' as 'client-balance'/'client-port-balance' load balance terribly when your NAS's use the same source port and most of our traffic comes from the same IP (the single infernal WLC 4400 we have). This however is not important, as I only started to use 'keyed-balance' about an hour ago. I noticed after the summer FreeRADIUS overhaul I am finishing off that a number of proxied requests to particular realms failed for no reason. Speaking to my counterparts at the other universities they could see nothing wrong in their *FreeRADIUS* installations. Because I have a general knowledge of whats going on in the nearby universities I know there are some filthy MS IAS installations about and pretty quickly noticed queries to these places were working fine whilst request to my FreeRADIUS buddies did not. </ramble> Looking closer at the detail logs I saw that mid-EAP conversation the packets started to get proxied to different national proxies which resulted (expectedly) with a Access-Reject; also explaining why my counterparts never saw an inner authentication. Looks like MS IAS does not really care where the proxied packets come from, it only key's on Proxy-State (I'm guessing here); FreeRADIUS being a lot more picky...which is just what I like :) With this in mind I moved to 'fail-over' and everything started working. Alas I cannot leave it on 'fail-over' otherwise Alan Buxey gets grumbly. <ramble> I figured out how to enable super verbosity to get at those RDEBUG3's in realms.c:home_server_ldb() and saw (when using anything other than 'fail-over'): ---- [first packet] PROXY jrs 2.0 jrs 0.0 PROXY jrs 2.0 jrs 1.0 [a latter EAP packet had something like] PROXY jrs 2.0 jrs 0.0 PROXY jrs 1.0 jrs 0.0 ---- I think this was a red herring for me, but it got me to look more closer at the realms.c code. </ramble> The conclusion, we should not be paying any attention to 'currently_outstanding' or 'fr_rand()' when there is EAP traffic; I decided to add the clause !HOME_POOL_LOAD_BALANCE; things now work. What do you think of the following patch, I think there is sound reasoning behind it, however of course I am just a network monkey? Cheers -- Alexander Clouter .sigmonster says: There is no grief which time does not lessen and soften. diff --git a/src/main/realms.c b/src/main/realms.c index a0cb796..71640d0 100644 --- a/src/main/realms.c +++ b/src/main/realms.c @@ -1938,8 +1938,12 @@ home_server *home_server_ldb(const char *realmname, /* * We've found the first "live" one. Use that. + * The !HOME_POOL_LOAD_BALANCE clause is for the EAP + * case when we want to do CLIENT/KEY based balancing + * and avoid inconsistent proxying */ - if (pool->type == HOME_POOL_FAIL_OVER) { + if (pool->type == HOME_POOL_FAIL_OVER + || pool->type != HOME_POOL_LOAD_BALANCE) { found = home; break; }

4 14

GIT Log for 2009-11-18 00:33 GMT
by aland＠deployingradius.com 17 Nov '09

17 Nov '09

commit 60cd814a9a14d38eb4ee36dc86db563fc71fb7da Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Nov 17 11:19:17 2009 +0100 Move user/group/chroot/core to bootstrap config It adds some extra stuff when starting in debug mode as root, but it also means that "allow_core_dumps" works again. src/main/mainconfig.c | 30 +++++++++++++++++------------- 1 files changed, 17 insertions(+), 13 deletions(-)

1 0

GIT Log for 2009-11-15 00:33 GMT
by aland＠deployingradius.com 14 Nov '09

14 Nov '09

commit 2cface50032b72b1bf57b23b1893c72a731b39e9 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Nov 14 10:29:40 2009 +0100 Make templates work again src/main/conffile.c | 11 +++++++++-- 1 files changed, 9 insertions(+), 2 deletions(-)

1 0

GIT Log for 2009-11-14 00:33 GMT
by aland＠deployingradius.com 13 Nov '09

13 Nov '09

commit 65ef5bbc7c68a10a1050a27577fe7ae127ad8d14 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Nov 13 14:15:51 2009 +0100 Allow !* to work The code to delete all attributes (as documented in unlang) was previously added in evaluate.c. But the parser hadn't been updated, so it was impossible to actually use that functionality. src/main/conffile.c | 1 + src/main/evaluate.c | 3 +-- src/main/modcall.c | 1 + 3 files changed, 3 insertions(+), 2 deletions(-)

1 0

GIT Log for 2009-11-13 00:33 GMT
by aland＠deployingradius.com 12 Nov '09

12 Nov '09

commit bdb12579578217cf978c8f95d966932e4e3051bd Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Nov 12 16:19:25 2009 +0100 Print commands from radmin when in debug mode Files changed: src/modules/frs_control/frs_control.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) ====================================================================== commit ed993033d2f3c0efbe927161cc22b0518ccfd05e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Nov 12 12:25:03 2009 +0100 Fix WiMAX encoding bug introduced in 326a68b90a1a Files changed: src/lib/radius.c | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-) ====================================================================== commit 13c45d5fedc25fe45e74a92a1fd6603b00f36796 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Nov 6 08:16:42 2009 -0500 As posted to the list Files changed: share/dictionary.alcatel.sr | 62 +++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 62 insertions(+), 0 deletions(-) ====================================================================== commit 48f0232ec399bbd39ce66adb5957d944440d9210 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Nov 3 16:40:03 2009 -0500 From bug #45 Files changed: share/dictionary.acme | 227 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 227 insertions(+), 0 deletions(-) ======================================================================

1 0