February 2009 - Freeradius-Devel - lists.freeradius.org

Missing TLS Change Cipher Spec and TLS Finished in EAP-TLS exchanges
by arno＠natisbad.org 09 Jul '11

09 Jul '11

Hi, I upgraded an internal freeradius server (Linux, Debian unstable, libssl 0.9.8) used for EAP-TLS (802.11 WPA2 access) from 2.0.5 to 2.1.3. With 2.1.3, client authentication fails in the following way (wpasupplicant on Debian unstable, working with 2.0.5): - the TLS exchange is completed from freeradius point of view. It even sends the Access-Accept message to the NAS. - from the clients point of view, the TLS exchange is not over, it expects some more data from the server which are never sent. I took two pcap traces (sent to you privately, Alan), one with 2.0.5, one with 2.1.3. It looks like the TLS Change Cipher and TLS Tinished elements of the TLS exchange are not in the EAP encapsulated TLS packets sent by the server. Compare packet #23 of 2.1.3 trace with packet #27 of 2.0.5 trace. If you use wireshark, you will notice that the SSL layer is dissected; this is because #27 has a small brother: #29. It is not sent by 2.1.3. Alan, if you have an idea or a patch, I can test it on monday. Cheers, a+

5 15

eap2 in freeradius
by Chanthearith HUON 04 Apr '11

04 Apr '11

Hi everyone, I am testing eap2 in freeradius. I run "radiusd -X", I got following error message " radiusd: symbol lookup error: /usr/lib/rlm_eap2-2.1.0.so: undefined symbol: eap_server_register_methods " Anyone, have any idea what might be wrong with the configuration? Thank in advance, Thierry

5 10

Re: vmps request: long attribute VQP-Ethernet-Frame
by Hermann Lauer 05 Jan '10

05 Jan '10

Alan DeKok wrote: > > 0x0c05 is VQP-Ethernet-Frame, which can of course be longer than 253 bytes, > > so there is a design issue here. One idea would be to cut the attribute to > > 253 bytes in vqp_recv(). Could this be done there without memory issues ? > > Yes, if you're not interested in the rest of the data. appended is a patch which implemeted the cutting. Seems to work. Please tell me if anybody sees any pitfall in it. Otherwise it should be cleaned up, which I probably will do in a week or so. Thanks, Hermann -- Netzwerkadministration/Zentrale Dienste, Interdiziplinaeres Zentrum fuer wissenschaftliches Rechnen der Universitaet Heidelberg IWR; INF 368; 69120 Heidelberg; Tel: (06221)54-8236 Fax: -5224 Email: Hermann.Lauer(a)iwr.uni-heidelberg.de

2 5

FreeRadius + EAP-AKA support
by Kumar, Sunil 26 Nov '09

26 Nov '09

Hi, We are trying to use FreeRadius1.1.4 as authentication server for EAP-AKA implementation with our product toolkit. As per the RFC 4187 AT_RES The value field of this attribute begins with the 2-byte RES Length, which identifies the exact length of the RES in bits. The RES length is followed by the AKA RES parameter. According to [TS33.105], the length of the AKA RES can vary between 32 and 128 bits. Because the length of the AT_RES attribute must be a multiple of 4 bytes, the sender pads the RES with zero bits where necessary. In the freeradius1.1.4 implementation, for EAP-AKA the value of RES length is always considered as constant EAPSIM_RES_SIZE (16). It doesn't take care of the values other than 16 bytes. We in our toolkit needs to support all the variable length of RES values from 32 bits (4 bytes) to 128 bits (16 bytes). So I have modified the FreeRadius implementation for the same support. The intention of writing such mail is to get the information that if somebody has already noticed and fixed this issue in the latest releases, so please share that information as well. In case it's not been fixed as yet, then may be I could contribute my patch for freeradius 1.1.4 version to support all variable length RES value varying from 32 bits to 128 bits. Thanks. Warm regards. Sunil Kumar The information contained in this electronic mail transmission may be privileged and confidential, and therefore, protected from disclosure. If you have received this communication in error, please notify us immediately by replying to this message and deleting it from your computer without copying or disclosing it.

4 5

FreeRadius +BDB
by Sourav Chakraborty 02 Mar '09

02 Mar '09

Hi, I have a Berkeley DB 4.6.18 installed,and have a small code to insert/retrieve/delete info from the database.I want to integrate that code into the FreeRadius codebase to store Radius Accounting msgs into the Berkeley DB. Can you please tell me which part of code in the FreeRadius codebase should I modify ,to insert data obtained from radius accounting msgs,into the Berkeley DB? thanks & rgds Sourav

2 1

FreeRadius 2.1.3 authentication problem with passwd module
by bastardinho69 01 Mar '09

01 Mar '09

Hi, i want to authenticate users against a file similar to /etc/passwd file with passwd module. I have been reading the forums for some time but i cannot find out how to do it properly. I think i am loading that file in a wrong place in radiusd.conf file. I saw it must be called in authorize section but i cannot find such a section in my radiusd.conf file. When i call that file in instantiate section in debugging mode server says that passwd module has loaded my file but server just doesnt check user names against my file. Any help will be appreciated!

3 2

GIT Log for 2009-02-27 00:33 GMT
by aland＠deployingradius.com 26 Feb '09

26 Feb '09

commit a033caa7a5d138a398cf8725a6f6dafc8744942f Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 26 17:55:23 2009 +0100 Point to correct buffer Files changed: src/modules/frs_control/frs_control.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 51a9e0099a1cebb49d9d8bc5b2b75edf17f096a8 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 26 16:15:34 2009 +0100 Export packet code table Files changed: src/include/libradius.h | 2 -- src/lib/radius.c | 24 +++++++++++++----------- 2 files changed, 13 insertions(+), 13 deletions(-) ======================================================================

1 0

pam_radius_auth & IPv6
by Stefan Winter 23 Feb '09

23 Feb '09

Hi, the documentation and ChangeLog of pam_radius_auth don't seem to mention IPv6 at all. Is IPv6 supported? If not, any plans? Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

4 7

GIT Log for 2009-02-20 00:33 GMT
by aland＠deployingradius.com 19 Feb '09

19 Feb '09

commit 7297448b05c035dd56e9d6f0b0a27ca9dcedbcb5 Author: Chris Moules <chris(a)gms.lu> Date: Thu Feb 19 15:38:43 2009 +0000 Update debian patch for changes to radiusd.conf logic. Files changed: debian/patches/01-radiusd-to-freeradius.dpatch | 38 +++++++++++++++-------- 1 files changed, 25 insertions(+), 13 deletions(-) ====================================================================== commit db86d98443b17552e4345e438ab1d124de61d363 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 19 15:48:04 2009 +0100 Added constraint Noted by Sebastian Heil Files changed: raddb/sql/mssql/schema.sql | 1 - 1 files changed, 0 insertions(+), 1 deletions(-) ====================================================================== commit d32a1aa6e5eab0247e09498f76f113c54d0524d8 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 19 15:20:21 2009 +0100 Differentiate "no result" from "too many results" Files changed: src/modules/rlm_ldap/rlm_ldap.c | 9 ++------- 1 files changed, 2 insertions(+), 7 deletions(-) ====================================================================== commit 16e80e6feca34d06179cb887a322fbe8d217c1dc Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 19 10:09:13 2009 +0100 Moved debug_log_file back to log.c Files changed: src/main/log.c | 2 +- src/main/radconf2xml.c | 1 + src/main/radmin.c | 1 + src/main/radwho.c | 1 + src/modules/frs_control/frs_control.c | 2 +- 5 files changed, 5 insertions(+), 2 deletions(-) ======================================================================

1 0

Debian build fails with current GIT
by Chris Moules 19 Feb '09

19 Feb '09

Hi All, On Friday I started to look at building a Debian package for deployment on a amd64 server. I had been building some development packages on a i686 system up till now. As the git tree has some patches that I need, I grabbed the latest tree. I am having an issue trying to build a Debian package. It looks like some other changes since the 2.1.3 release have broken a few parts for the (Debian) build system. This morning pulling the latest git tree and doing a reset for good measure I (still) get: -*-*-*-*-*-*-*-*-*-*-*-*- git reset --hard Checking out files: 100% (1281/1281), done. HEAD is now at 1cbf67e Added sample commands dpkg-buildpackage -rfakeroot -us -uc dpkg-buildpackage: set CFLAGS to default value: -g -O2 dpkg-buildpackage: set CPPFLAGS to default value: dpkg-buildpackage: set LDFLAGS to default value: dpkg-buildpackage: set FFLAGS to default value: -g -O2 dpkg-buildpackage: set CXXFLAGS to default value: -g -O2 dpkg-buildpackage: source package freeradius dpkg-buildpackage: source version 2.1.1-0 dpkg-buildpackage: source changed by Alan DeKok <aland(a)freeradius.org> dpkg-buildpackage: host architecture amd64 ... ... dpatch apply-all --verbose applying patch 01-radiusd-to-freeradius to ./ ... patching file Make.inc.in Hunk #1 succeeded at 48 with fuzz 1. patching file raddb/radiusd.conf.in Hunk #1 FAILED at 33. Hunk #2 succeeded at 112 with fuzz 2 (offset 17 lines). Hunk #3 succeeded at 164 with fuzz 2 (offset 43 lines). 1 out of 3 hunks FAILED -- saving rejects to file raddb/radiusd.conf.in.rej make: *** [patch-stamp] Error 1 dpkg-buildpackage: failure: debian/rules build gave error exit status 2 -*-*-*-*-*-*-*-*-*-*-*-*- This patch, I have patched. I tried "git format-patch" this time so I hope it is in the correct format. After this, the build process ran a little further but errors in the configure at: -*-*-*-*-*-*-*-*-*-*-*-*- checking for setkey in -lcipher... no checking gethostbyaddr_r() syntax... GNU-style checking gethostbyname_r() syntax... GNU-style checking ctime_r() syntax... POSIX-style top_builddir=/home/src/git/freeradius-server2 configure: updating cache config.cache configure: error: conditional "INSTALL_LTDL" was never defined. Usually this means the macro was only invoked conditionally. make: *** [configure-stamp] Error 1 dpkg-buildpackage: failure: debian/rules build gave error exit status 2 -*-*-*-*-*-*-*-*-*-*-*-*- Looking into the 'configure' file and the change log I could see that there has been a number of modifications here. I could not see why INSTALL_LTDL_[TRUE|FALSE] was not set. Putting some debug 'echo's into the configure file showed that the "if test x"${enable_ltdl_install-no}" != xno; then" block was not even processed. Info: Debian Lenny (5.0) - Testing All default packages - All up-to-date Kernel: Linux 2.6.26-1-amd64 git version 1.5.6.5 gcc (Debian 4.3.2-1.1) 4.3.2 Regards Chris

2 3