December 2009 - Freeradius-Devel - lists.freeradius.org

Missing TLS Change Cipher Spec and TLS Finished in EAP-TLS exchanges
by arno＠natisbad.org 09 Jul '11

09 Jul '11

Hi, I upgraded an internal freeradius server (Linux, Debian unstable, libssl 0.9.8) used for EAP-TLS (802.11 WPA2 access) from 2.0.5 to 2.1.3. With 2.1.3, client authentication fails in the following way (wpasupplicant on Debian unstable, working with 2.0.5): - the TLS exchange is completed from freeradius point of view. It even sends the Access-Accept message to the NAS. - from the clients point of view, the TLS exchange is not over, it expects some more data from the server which are never sent. I took two pcap traces (sent to you privately, Alan), one with 2.0.5, one with 2.1.3. It looks like the TLS Change Cipher and TLS Tinished elements of the TLS exchange are not in the EAP encapsulated TLS packets sent by the server. Compare packet #23 of 2.1.3 trace with packet #27 of 2.0.5 trace. If you use wireshark, you will notice that the SSL layer is dissected; this is because #27 has a small brother: #29. It is not sent by 2.1.3. Alan, if you have an idea or a patch, I can test it on monday. Cheers, a+

5 15

eap2 in freeradius
by Chanthearith HUON 04 Apr '11

04 Apr '11

Hi everyone, I am testing eap2 in freeradius. I run "radiusd -X", I got following error message " radiusd: symbol lookup error: /usr/lib/rlm_eap2-2.1.0.so: undefined symbol: eap_server_register_methods " Anyone, have any idea what might be wrong with the configuration? Thank in advance, Thierry

5 10

make_passwd(), rlm_perl and double quotes in the password
by Niko Tyni 28 Jan '10

28 Jan '10

Hi, we're seeing failed logins when proxying authentication requests through to another RADIUS server if the password contains a double quote ("). I've debugged the issue a bit, and what happens is that when the password does a roundtrip through the rlm_perl module, the value pair structure ends up with extra bytes at the end so that strlen(vp->data.strvalue) > vp->length. These extra bytes are the result of escaping the double quote before entering the Perl code and then unescaping it afterwards. For instance, the password abcdef" is passed as abcdef\" to the Perl code, and afterwards it becomes abcdef"" with length 7 (so the extra byte is not supposed to hurt AIUI.) Unfortunately make_passwd() rounds 'inlen' up to a multiple of 16 before copying the input string, so the extra bytes end up in the message authenticator of the proxied request. It seems to me that the escaping and unescaping done in rlm_perl via perl_store_vps() -> vp_prints_value() -> librad_safeprint() and get_hv_content() -> pairadd_sv() -> pairmake() -> pairparsevalue() is a bit unnecessary, and that the unescaping could zero out the extra bytes, but the main bug is in make_passwd() IMO. I have reproduced this with a Debian 2.0.4 freeradius package, a Fedora 2.1.3 package, and a current git.freeradius.org checkout (commit ef2a7db5e). I'm attaching a proposed patch to make_passwd(). Please let me know if you need more information, I can easily produce stack traces and the like. Thanks for your work on FreeRADIUS, -- Niko Tyni ntyni(a)cc.helsinki.fi

3 5

Access-Request / Mandatory Attributes
by rsg 07 Jan '10

07 Jan '10

Hi, I find that FreeRadius server allows access even without either of the mandatory attributes i.e. NAS-Identifier or NAS-IP-Address in the Access Request packet. Is this a deviation from RFC 2865 ? " .....An Access-Request SHOULD contain a User-Name attribute. It MUST contain either a NAS-IP-Address attribute or a NAS-Identifier attribute (or both)." Can someone clarify this please? Many thanks, rsg.

2 1

Re: vmps request: long attribute VQP-Ethernet-Frame
by Hermann Lauer 05 Jan '10

05 Jan '10

Alan DeKok wrote: > > 0x0c05 is VQP-Ethernet-Frame, which can of course be longer than 253 bytes, > > so there is a design issue here. One idea would be to cut the attribute to > > 253 bytes in vqp_recv(). Could this be done there without memory issues ? > > Yes, if you're not interested in the rest of the data. appended is a patch which implemeted the cutting. Seems to work. Please tell me if anybody sees any pitfall in it. Otherwise it should be cleaned up, which I probably will do in a week or so. Thanks, Hermann -- Netzwerkadministration/Zentrale Dienste, Interdiziplinaeres Zentrum fuer wissenschaftliches Rechnen der Universitaet Heidelberg IWR; INF 368; 69120 Heidelberg; Tel: (06221)54-8236 Fax: -5224 Email: Hermann.Lauer(a)iwr.uni-heidelberg.de

2 5

eap timeout
by xiningtom_1986 28 Dec '09

28 Dec '09

Hi,I am sorry to bother you!Here is my question. Which file is used to handle timeout of eap packet? Thank you!

1 0

eap timeout
by xiningtom_1986 28 Dec '09

28 Dec '09

Hi,I am sorry to bother you!Here is my question. Which file is used to handle timeout of eap packet? Thank you!

1 0

How to improve Radius Performance
by Tejesh Vijayakumar 24 Dec '09

24 Dec '09

Hi, I want to achieve around 5000 auths/sec with FreeRadius version 2.1.7. Currently I am able to achieve only 125 auths/sec with a PentiumIV 3Ghz single core 512 mb RAM machine. I am using just the users file with two users. Can I improve radius performance using same machine or What is the preferable system configuration to achieve 5000 auths/sec? Regards Tejesh ________________________________ This Email may contain confidential or privileged information for the intended recipient (s) If you are not the intended recipient, please do not use or disseminate the information, notify the sender and delete it from your system. ______________________________________________________________________

6 17

Re: How to improve Radius Performance
by zhongwei feng 24 Dec '09

24 Dec '09

Hi, all : my hardware: P4 3.0G HYPER THREAD, 1G RAM, ide HD, cent os 4.6, CHAP auth, radclient with "-p 10", running on another PC, 120k users, in users file , about 1000 auths / sec; in oracle , about 76 auths / sec; in oracle(with Binding), about 500~700 auths / sec; btw, mysql is fast than oracle, about 900 auths/sec. --------------------------------------------------

1 0

GIT Log for 2009-12-23 00:33 GMT
by aland＠deployingradius.com 23 Dec '09

23 Dec '09

commit 91a68c72cdfd2907ea3ae5513a707383fc3c7557 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Dec 22 13:01:43 2009 +0100 Prepare for 2.1.8, by re-naming version of master to 2.4.0 VERSION | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)

1 0

GIT Log for 2009-12-22 00:33 GMT
by aland＠deployingradius.com 22 Dec '09

22 Dec '09

commit 2800ea81e6c8ea0c188415483ad000ffd7d3a335 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Dec 21 12:07:08 2009 +0100 Add OpenSSL license exception Files changed: src/LICENSE.openssl | 13 +++++++++++++ 1 files changed, 13 insertions(+), 0 deletions(-) ====================================================================== commit a365b83da3bfb61e1b3270fce77de60c90ac121c Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Dec 21 10:46:20 2009 +0100 Make integers unsigned 32-bit, rather than signed Files changed: src/main/evaluate.c | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-) ======================================================================

1 0

GIT Log for 2009-12-20 00:33 GMT
by aland＠deployingradius.com 20 Dec '09

20 Dec '09

commit 08a849df9500120e72d029ca8002e03b236ce99b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Dec 19 09:33:20 2009 +0100 Move DHCP options to "octets" type share/dictionary.redback | 8 ++++++-- 1 files changed, 6 insertions(+), 2 deletions(-)

1 0

GIT Log for 2009-12-19 00:33 GMT
by aland＠deployingradius.com 19 Dec '09

19 Dec '09

commit 5588c7cec9ec38e1278949d262926b996976ffdf Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Dec 18 14:08:32 2009 +0100 Simplify stats code, and keep track of dropped versus bad authenticators Files changed: src/main/stats.c | 57 ++++++++++++++++++++++------------------------------- 1 files changed, 24 insertions(+), 33 deletions(-) ====================================================================== commit 4c90f5c19de92b7971ad35943bbc83ae7bd36a52 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Dec 18 13:52:50 2009 +0100 Make "dropped packet" message debugging This is so that we don't spam the logs wih a DoS when we get lots of packets with a bad signature Files changed: src/main/event.c | 5 ++--- 1 files changed, 2 insertions(+), 3 deletions(-) ====================================================================== commit 3498878728fa666f19f9ee7195b9328b1f8e2dee Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Dec 18 12:31:38 2009 +0100 Added notes on SQL && packets with zero session time Files changed: raddb/sites-available/default | 16 ++++++++++++++++ 1 files changed, 16 insertions(+), 0 deletions(-) ======================================================================

1 0

how to configure radius server for EAP-AKA authentication?
by Manojkumar Patel 18 Dec '09

18 Dec '09

Hello I would like to test EAP-AKA authentication. So, how to configure radius server for EAP-AKA authentication? Or we need to add patch from external lib. Can you guide me? Thanks Manoj ============================================================================================================================ Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/Disclaimer.html">http://tim.techmahindra.com/Disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

1 0

Usage of Stripped_User_Name in sql.conf
by Tejesh Vijayakumar 18 Dec '09

18 Dec '09

Hi,, I am trying to check authentication of a user after stripping the realm part. I am uncommenting the line "sql_user_name = "%{%{Stripped-User-Name}:-%{%{User-Name}:-none}}" in the file sql/postgresql/dialup.conf and added just the username[suffix] in database. But i am getting "user not found" since "Stripped-User-Name" is incorrect. What other changes i have to make to extract realm and the user part? I am using FreeRadius 2.1.7 version. Regards Tejesh ________________________________ This Email may contain confidential or privileged information for the intended recipient (s) If you are not the intended recipient, please do not use or disseminate the information, notify the sender and delete it from your system. ______________________________________________________________________

1 0

Usage of Stripped_User_Name in sql.conf
by Tejesh Vijayakumar 18 Dec '09

18 Dec '09

Hi,, I am trying to check authentication of a user after stripping the realm part. I have uncommented the line "sql_user_name = "%{%{Stripped-User-Name}:-%{%{User-Name}:-none}}" in the file : sql/postgresql/dialup.conf and added just the username[suffix] in database. But i am getting "user not found" since "Stripped-User-Name" is incorrect. What other changes i have to make to extract realm and the user part? I am using FreeRadius 2.1.7 version. -- Regards Tejesh ________________________________ This Email may contain confidential or privileged information for the intended recipient (s) If you are not the intended recipient, please do not use or disseminate the information, notify the sender and delete it from your system. ______________________________________________________________________

1 0

GIT Log for 2009-12-18 00:33 GMT
by aland＠deployingradius.com 18 Dec '09

18 Dec '09

commit b8770aca7c0d05dc4135dfe65d9d874fae595e0e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Dec 17 11:42:03 2009 +0100 Fix typo in c0d32bd24 Files changed: Make.inc.in | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit bf227982b9f6e1208a1c40b9aa3ba20a805c4ce7 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Dec 17 11:28:12 2009 +0100 Removed unnecessary debug message Files changed: src/main/xlat.c | 2 -- 1 files changed, 0 insertions(+), 2 deletions(-) ====================================================================== commit 26a92918f3867069302d2db1ba655ca015de07c8 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Dec 17 09:35:35 2009 +0100 Simplified use of llvm checker Files changed: Make.inc.in | 9 ++++----- src/lib/Makefile | 4 ---- src/main/Makefile.in | 4 ---- src/modules/Makefile | 4 ---- src/modules/rules.mak | 4 ---- 5 files changed, 4 insertions(+), 21 deletions(-) ======================================================================

1 0

Free Radius performance variation
by Tejesh Vijayakumar 17 Dec '09

17 Dec '09

Hi, I am testing for performance of FreeRadius Server 2.1.7 with the radclient utility. With 1000 users i am getting 125 Auths/sec and with 10000 users it is 80 Auths/sec. Why this drastic variation when the no of users is just a tenfold increase... Regards, Tejesh ________________________________ This Email may contain confidential or privileged information for the intended recipient (s) If you are not the intended recipient, please do not use or disseminate the information, notify the sender and delete it from your system. ______________________________________________________________________

6 9

GIT Log for 2009-12-16 00:33 GMT
by aland＠deployingradius.com 16 Dec '09

16 Dec '09

commit b4e55d83418ec08d36f586c43455745bf7875258 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Dec 15 16:01:20 2009 +0100 Ensure that len > 0 Files changed: src/lib/valuepair.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 94cb56facdbae4fa07a3499c1e1ffcea9ba9f637 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Dec 15 14:23:47 2009 +0100 Catch possible NULL pointer on editing attribute list Files changed: src/main/evaluate.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit e18c80dde608ca2150ce6c6c14ea6b42a5a3370c Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Dec 15 14:17:52 2009 +0100 Catch situations where COA may be NULL Files changed: src/main/event.c | 14 +++++++++++--- 1 files changed, 11 insertions(+), 3 deletions(-) ====================================================================== commit 0bf84a54e751fa4e1e5828b37fb697e7ddafe318 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Dec 15 11:52:03 2009 +0100 If we have "user=foo", and we're ALREADY running as that user, ignore it. This prevents us from complaining when "initgroups" is run as non-root Files changed: src/main/mainconfig.c | 18 ++++++++++++------ 1 files changed, 12 insertions(+), 6 deletions(-) ======================================================================

1 0

Access-Request Identifier field
by Peter Molnar 12 Dec '09

12 Dec '09

Hello! First of all, sorry for posting to the devel list, but my question is quite technical, I think this list suits better than "freeradius-users". I'm developing a limited, minimalistic "implementation" of a RADIUS client for an embedded system. (Basically it's just sending an Access-Request, receiving a reply, and acting upon it) I have a question about the Identifier field of the Access-Request packet. According to RFC 2865: "The Identifier field MUST be changed whenever the content of the Attributes field changes, and whenever a valid reply has been received for a previous request. For retransmissions, the Identifier MUST remain unchanged." OK, that means I have to generate a random octet for this field, that is different from the Identifier of the previous request. But, do I have to preserve the value of the last Identifier between client reboots? What happens, if the server receives a packet, with the same Identifier, as the previous, but with different authentication data (the random number generator gives the same value as the previous Identifier)? It gets treated as a retransmission, without actually processing the new data? Does the official freeradius client preserve the previous Identifier value between server restarts? I'm using freeradius version 2.0.4. regards, Peter

2 1

GIT Log for 2009-12-11 00:33 GMT
by aland＠deployingradius.com 11 Dec '09

11 Dec '09

commit 7e62aad062c862031343f64a57d0c01ce7941bcd Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Dec 10 11:41:55 2009 +0100 Fix CVE-2009-3736 libltdl/ltdl.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)

1 0

GIT Log for 2009-12-10 00:33 GMT
by aland＠deployingradius.com 10 Dec '09

10 Dec '09

commit 6da2a01b44f62c22fabb6e4f44d2f92c0cfb6563 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Dec 9 15:48:30 2009 +0100 Template code to use lt_dladvise() The libtool people have discovered that it's useful to allow *additional* features from linking. Like allowing libraries to link to libraries. Using this magic API allows FreeRADIUS to load the Perl module, which in turn loads other modules, which in turn load dynamic libraries. Right now, it complains because of limitations in libltdl. We COULD do these checks in 2.1.8, but that involves either adding configure checks, OR upgrading our version of libltdl. We don't want to do either. src/main/modules.c | 27 ++++++++++++++++++++++++++- 1 files changed, 26 insertions(+), 1 deletions(-)

1 0

GIT Log for 2009-12-09 00:33 GMT
by aland＠deployingradius.com 09 Dec '09

09 Dec '09

commit e3833c6fa089a30eedf26155669b13d04b86d69a Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Dec 8 16:31:02 2009 +0100 Add datarootdir from bug #51 Files changed: Make.inc.in | 1 + src/include/build-radpaths-h.in | 1 + 2 files changed, 2 insertions(+), 0 deletions(-) ====================================================================== commit 2732981cbcdbe2c7d5b112fa3c420e16da6f59a1 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Dec 8 14:00:53 2009 +0100 Handle case where Acct-Session-Time might not exist Files changed: raddb/sql/postgresql/dialup.conf | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) ======================================================================

1 0

GIT Log for 2009-12-08 00:33 GMT
by aland＠deployingradius.com 08 Dec '09

08 Dec '09

commit 8e202406d8a78d87951eaa3ac63f6e85cf9f34a7 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Dec 7 13:53:14 2009 +0100 Add %{Attribute-Name#} This prints the numerical value, rather than the decoded time/VALUE Files changed: man/man5/unlang.5 | 9 +++++++++ src/main/xlat.c | 37 +++++++++++++++++++++++++++++++++---- 2 files changed, 42 insertions(+), 4 deletions(-) ====================================================================== commit 1601cc94cdf25b2ed17b084d2c916bc4f141c09e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Dec 7 13:24:14 2009 +0100 Added notes on use of FreeRADIUS-Acct-Session-Start-Time Files changed: raddb/sites-available/default | 16 ++++++++++++++++ 1 files changed, 16 insertions(+), 0 deletions(-) ====================================================================== commit 0c406f238deb74e42efb64b50ade6ec759c1ec6b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Dec 7 13:20:12 2009 +0100 Added synthetic session start time attribute Files changed: share/dictionary.freeradius | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) ====================================================================== commit 88637a75188e593696429d6da0c545903a102550 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Dec 7 10:38:51 2009 +0100 Make more errors non-fatal Files changed: src/main/event.c | 23 ++++++++++++++++++----- 1 files changed, 18 insertions(+), 5 deletions(-) ======================================================================

1 0

GIT Log for 2009-12-07 00:33 GMT
by aland＠deployingradius.com 07 Dec '09

07 Dec '09

commit a660c5fc4f758b0594dd00d86e56878977725342 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Dec 6 17:02:08 2009 +0100 Added sample ntlm_auth module Files changed: raddb/modules/ntlm_auth | 12 ++++++++++++ 1 files changed, 12 insertions(+), 0 deletions(-) ====================================================================== commit b693342ff902b3c29683c8d4fbe043afcc824e0a Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Dec 6 13:54:14 2009 +0100 Use case insensitive comparison. Closes #36 Files changed: src/modules/rlm_ldap/rlm_ldap.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 9cf4a047ce57722f5b1a64a5f379e66c61f7b274 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Dec 6 13:51:01 2009 +0100 Portability fixes, as noted by bug #33 Files changed: raddb/certs/Makefile | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 610ef72016c441f136c75e9cddcc2d252fe7636b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Dec 6 13:48:14 2009 +0100 IP pools require a transactional back-end So we used InnoDB Files changed: raddb/sql/mysql/ippool.sql | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 2e7f4b4792ddd0b31549df6c06d9475f9c476dcf Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Dec 6 13:43:59 2009 +0100 Remove notes on unsupported configuration items Files changed: doc/rlm_ldap | 5 ----- 1 files changed, 0 insertions(+), 5 deletions(-) ====================================================================== commit 110b39598e5842dec6f20f80433fb50806f23bfe Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Dec 6 13:39:00 2009 +0100 Be more specific about which detail files we suppress Don't write packets back to the same detail file, but allow them to be written to different detail files Files changed: src/modules/rlm_detail/rlm_detail.c | 5 ++++- 1 files changed, 4 insertions(+), 1 deletions(-) ====================================================================== commit e46965240d38d3222219f080d139e7dec5ba211c Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Dec 6 13:37:13 2009 +0100 Removed re-definition of detail structure Files changed: src/main/event.c | 3 --- 1 files changed, 0 insertions(+), 3 deletions(-) ====================================================================== commit 1821dcca208ee5f5d742477cdd0fd26c3e101df9 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Dec 6 13:36:28 2009 +0100 Moved detail structure defs to a public header file Files changed: src/include/detail.h | 34 ++++++++++++++++++++++++++++++++++ src/modules/frs_detail/frs_detail.c | 35 ----------------------------------- 2 files changed, 34 insertions(+), 35 deletions(-) ====================================================================== commit 558c51a711d7a326604eda0fc51040cbda2b77a8 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Dec 5 15:58:19 2009 +0100 Fix code so that corner cases of %{%{foo}:-%{bar}} work The previous code was odd... this code is simpler, and works. Files changed: src/main/xlat.c | 364 ++++++++++++++++++++----------------------------------- 1 files changed, 131 insertions(+), 233 deletions(-) ======================================================================

1 0