December 2009 - Freeradius-Devel - lists.freeradius.org

Missing TLS Change Cipher Spec and TLS Finished in EAP-TLS exchanges
by arno＠natisbad.org 09 Jul '11

09 Jul '11

Hi, I upgraded an internal freeradius server (Linux, Debian unstable, libssl 0.9.8) used for EAP-TLS (802.11 WPA2 access) from 2.0.5 to 2.1.3. With 2.1.3, client authentication fails in the following way (wpasupplicant on Debian unstable, working with 2.0.5): - the TLS exchange is completed from freeradius point of view. It even sends the Access-Accept message to the NAS. - from the clients point of view, the TLS exchange is not over, it expects some more data from the server which are never sent. I took two pcap traces (sent to you privately, Alan), one with 2.0.5, one with 2.1.3. It looks like the TLS Change Cipher and TLS Tinished elements of the TLS exchange are not in the EAP encapsulated TLS packets sent by the server. Compare packet #23 of 2.1.3 trace with packet #27 of 2.0.5 trace. If you use wireshark, you will notice that the SSL layer is dissected; this is because #27 has a small brother: #29. It is not sent by 2.1.3. Alan, if you have an idea or a patch, I can test it on monday. Cheers, a+

5 15

eap2 in freeradius
by Chanthearith HUON 04 Apr '11

04 Apr '11

Hi everyone, I am testing eap2 in freeradius. I run "radiusd -X", I got following error message " radiusd: symbol lookup error: /usr/lib/rlm_eap2-2.1.0.so: undefined symbol: eap_server_register_methods " Anyone, have any idea what might be wrong with the configuration? Thank in advance, Thierry

5 10

make_passwd(), rlm_perl and double quotes in the password
by Niko Tyni 28 Jan '10

28 Jan '10

Hi, we're seeing failed logins when proxying authentication requests through to another RADIUS server if the password contains a double quote ("). I've debugged the issue a bit, and what happens is that when the password does a roundtrip through the rlm_perl module, the value pair structure ends up with extra bytes at the end so that strlen(vp->data.strvalue) > vp->length. These extra bytes are the result of escaping the double quote before entering the Perl code and then unescaping it afterwards. For instance, the password abcdef" is passed as abcdef\" to the Perl code, and afterwards it becomes abcdef"" with length 7 (so the extra byte is not supposed to hurt AIUI.) Unfortunately make_passwd() rounds 'inlen' up to a multiple of 16 before copying the input string, so the extra bytes end up in the message authenticator of the proxied request. It seems to me that the escaping and unescaping done in rlm_perl via perl_store_vps() -> vp_prints_value() -> librad_safeprint() and get_hv_content() -> pairadd_sv() -> pairmake() -> pairparsevalue() is a bit unnecessary, and that the unescaping could zero out the extra bytes, but the main bug is in make_passwd() IMO. I have reproduced this with a Debian 2.0.4 freeradius package, a Fedora 2.1.3 package, and a current git.freeradius.org checkout (commit ef2a7db5e). I'm attaching a proposed patch to make_passwd(). Please let me know if you need more information, I can easily produce stack traces and the like. Thanks for your work on FreeRADIUS, -- Niko Tyni ntyni(a)cc.helsinki.fi

3 5

Access-Request / Mandatory Attributes
by rsg 07 Jan '10

07 Jan '10

Hi, I find that FreeRadius server allows access even without either of the mandatory attributes i.e. NAS-Identifier or NAS-IP-Address in the Access Request packet. Is this a deviation from RFC 2865 ? " .....An Access-Request SHOULD contain a User-Name attribute. It MUST contain either a NAS-IP-Address attribute or a NAS-Identifier attribute (or both)." Can someone clarify this please? Many thanks, rsg.

2 1

Re: vmps request: long attribute VQP-Ethernet-Frame
by Hermann Lauer 05 Jan '10

05 Jan '10

Alan DeKok wrote: > > 0x0c05 is VQP-Ethernet-Frame, which can of course be longer than 253 bytes, > > so there is a design issue here. One idea would be to cut the attribute to > > 253 bytes in vqp_recv(). Could this be done there without memory issues ? > > Yes, if you're not interested in the rest of the data. appended is a patch which implemeted the cutting. Seems to work. Please tell me if anybody sees any pitfall in it. Otherwise it should be cleaned up, which I probably will do in a week or so. Thanks, Hermann -- Netzwerkadministration/Zentrale Dienste, Interdiziplinaeres Zentrum fuer wissenschaftliches Rechnen der Universitaet Heidelberg IWR; INF 368; 69120 Heidelberg; Tel: (06221)54-8236 Fax: -5224 Email: Hermann.Lauer(a)iwr.uni-heidelberg.de

2 5

eap timeout
by xiningtom_1986 28 Dec '09

28 Dec '09

Hi,I am sorry to bother you!Here is my question. Which file is used to handle timeout of eap packet? Thank you!

1 0

eap timeout
by xiningtom_1986 28 Dec '09

28 Dec '09

Hi,I am sorry to bother you!Here is my question. Which file is used to handle timeout of eap packet? Thank you!

1 0

How to improve Radius Performance
by Tejesh Vijayakumar 24 Dec '09

24 Dec '09

Hi, I want to achieve around 5000 auths/sec with FreeRadius version 2.1.7. Currently I am able to achieve only 125 auths/sec with a PentiumIV 3Ghz single core 512 mb RAM machine. I am using just the users file with two users. Can I improve radius performance using same machine or What is the preferable system configuration to achieve 5000 auths/sec? Regards Tejesh ________________________________ This Email may contain confidential or privileged information for the intended recipient (s) If you are not the intended recipient, please do not use or disseminate the information, notify the sender and delete it from your system. ______________________________________________________________________

6 17

Re: How to improve Radius Performance
by zhongwei feng 23 Dec '09

23 Dec '09

Hi, all : my hardware: P4 3.0G HYPER THREAD, 1G RAM, ide HD, cent os 4.6, CHAP auth, radclient with "-p 10", running on another PC, 120k users, in users file , about 1000 auths / sec; in oracle , about 76 auths / sec; in oracle(with Binding), about 500~700 auths / sec; btw, mysql is fast than oracle, about 900 auths/sec. --------------------------------------------------

1 0

GIT Log for 2009-12-23 00:33 GMT
by aland＠deployingradius.com 22 Dec '09

22 Dec '09

commit 91a68c72cdfd2907ea3ae5513a707383fc3c7557 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Dec 22 13:01:43 2009 +0100 Prepare for 2.1.8, by re-naming version of master to 2.4.0 VERSION | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)

1 0