June 2009 - Freeradius-Devel - lists.freeradius.org

GIT Log for 2009-06-11 23:33 GMT
by aland＠deployingradius.com 11 Jun '09

11 Jun '09

commit ed4770be765bd88c1dabcac7cdcb7c5194347b23 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Jun 11 10:38:24 2009 +0200 More debugging messages Files changed: src/modules/frs_detail/frs_detail.c | 13 ++++++++----- 1 files changed, 8 insertions(+), 5 deletions(-) ====================================================================== commit b6340d5536ca77d1169f868dd0e66c393dde2be7 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Jun 11 10:37:51 2009 +0200 More debugging messages Files changed: src/main/event.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) ====================================================================== commit 8c078deef7eee1d6e6475e77acf3535c058b68da Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Jun 11 09:55:48 2009 +0200 Include chillispot dictionary Files changed: share/dictionary | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) ======================================================================

1 0

PEAP Certificate path
by Harsha gowda 10 Jun '09

10 Jun '09

Hi, I want to know where is the private key file stored for the public key which is used to decrypt Client Key exchange, the same publick key which is Sent in Server-Hello message its private patr is stored in which location. i search in {raddb}/cers/? but could not. Thanks

2 1

GIT Log for 2009-06-09 23:33 GMT
by aland＠deployingradius.com 09 Jun '09

09 Jun '09

commit 4a5b18a653c5a35786f8a9dcfab8b4ebc0671101 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Jun 9 09:46:29 2009 +0200 Filter Access-Challenge packets, too raddb/attrs.access_challenge | 19 +++++++++++++++++++ raddb/modules/attr_filter | 10 ++++++++++ 2 files changed, 29 insertions(+), 0 deletions(-)

1 0

Bad advices in the documantation of rlm_ldap
by Németh Tamás 09 Jun '09

09 Jun '09

Sorry for sending anothe bugreport, but I found the following in the documentation of rlm_ldap (/usr/share/doc/packages/freeradius-server- doc/rlm_ldap for me): NOTE: As LDAP is case insensitive, you should probably also set "lower_user = yes" and "lower_time = before" in main section of radiusd.conf, to get limits on simultaneous logins working correctly. Otherwise, users will be able get large number of sessions, capitalizing parts of their login names. However, these options (e.g. lower_user) don't seem to exist in freeradius 2.x.x. You should replace this section with a description of how to emulate this behaviour with unlang. Regards, Németh Tamás

1 0

conditional variable syntax doesn't work in LDAP xlat strings
by Németh Tamás 09 Jun '09

09 Jun '09

Dear developers, Sorry for posting a a bugreport here, but http://bugs.freeradius.org is not working for several days (or is it intentionally and utterly down?). I wanted to evaluate this expression (in /etc/raddb/sites-enabled/default in the authorize section): if ( "%{%{Stripped-User-Name}:-%{User-Name}}" == "%{ldap:ldap:///ou=People,ou=sopron,o=nyme,dc=hu?cn?sub?(&(cn=%{%{Stripped-User-Name}:-%{User-Name}})(radiusCallingStationId=*))}" && "%{ldap:ldap:///ou=People,ou=sopron,o=nyme,dc=hu?radiusCallingStationId?sub?(&(cn=%{%{Stripped-User-Name}:-%{User-Name}})(radiusCallingStationId=%{request:Calling-Station-Id}))}" != "%{request:Calling-Station-Id}" ) { but freeradius 2.1.6 behaved like this: +++? if ("%{%{Stripped-User-Name}:-%{User-Name}}" == "%{ldap:ldap:///ou=People,ou=sopron,o=nyme,dc=hu?cn?sub?(&(cn=%{%{Stripped-User-Name}:-%{User-Name}})(radiusCallingStationId=*))}" && "%{ldap:ldap:///ou=People,ou=sopron,o=nyme,dc=hu?radiusCallingStationId?sub?(&(cn=%{%{Stripped-User-Name}:-%{User-Name}})(radiusCallingStationId=%{request:Calling-Station-Id}))}" != "%{request:Calling-Station-Id}" ) expand: %{Stripped-User-Name} -> expand: %{User-Name} -> nice expand: %{%{Stripped-User-Name}:-%{User-Name}} -> nice rlm_ldap: - ldap_xlat No trailing :- after variable at %{Stripped-User-Name} expand: ldap:///ou=People,ou=sopron,o=nyme,dc=hu?cn?sub?(&(cn=%{%{Stripped-User-Name} -> ldap:///ou=People,ou=sopron,o=nyme,dc=hu?cn?sub?(&(cn= rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=People,ou=sopron,o=nyme,dc=hu, with filter (&(cn= rlm_ldap: ldap_search() failed: Bad search filter: (&(cn= rlm_ldap: Search returned error rlm_ldap: ldap_release_conn: Release Id: 0 expand: %{ldap:ldap:///ou=People,ou=sopron,o=nyme,dc=hu?cn?sub?(&(cn=%{%{Stripped-User-Name}:-%{User-Name}})(radiusCallingStationId=*))} -> nice)(radiusCallingStationId=*)) That is, it expanded "%{ldap:ldap:///ou=People,ou=sopron,o=nyme,dc=hu?cn?sub?(&(cn=%{%{Stripped-User-Name}:-%{User-Name}})(radiusCallingStationId=*))}" as a mere "ldap:///ou=People,ou=sopron,o=nyme,dc=hu?cn?sub? (&(cn=%{%{Stripped-User-Name}" concatenated with "%{User-Name}})(radiusCallingStationId=*))", and thus it evaluated it as "nice)(radiusCallingStationId=*))" instead of "nice". However, it works if I'm using "%u" (or eventually %{control:Tmp-String-0}) instead of "%{%{Stripped-User-Name}:-%{User-Name}}" : +++? if ("%u" == "%{ldap:ldap:///ou=People,ou=sopron,o=nyme,dc=hu?cn?sub?(&(cn=%u)(radiusCallingStationId=*))}" && "%{ldap:ldap:///ou=People,ou=sopron,o=nyme,dc=hu?radiusCallingStationId?sub?(&(cn=%u) (radiusCallingStationId=%{request:Calling-Station-Id}))}" != "%{request:Calling-Station-Id}" ) expand: %u -> nice rlm_ldap: - ldap_xlat expand: ldap:///ou=People,ou=sopron,o=nyme,dc=hu?cn?sub?(&(cn=%u)(radiusCallingStationId=*)) -> ldap:///ou=People,ou=sopron,o=nyme,dc=hu?cn?sub?(&(cn=nice)(radiusCallingStationId=*)) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=People,ou=sopron,o=nyme,dc=hu, with filter (&(cn=nice)(radiusCallingStationId=*)) rlm_ldap: Adding attribute cn, value: nice rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: - ldap_xlat end expand: %{ldap:ldap:///ou=People,ou=sopron,o=nyme,dc=hu?cn?sub?(&(cn=%u)(radiusCallingStationId=*))} -> nice

1 0

GIT Log for 2009-06-06 23:33 GMT
by aland＠deployingradius.com 06 Jun '09

06 Jun '09

commit 632daac8d9969a5c32242db08123190adb58d043 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Jun 6 09:42:40 2009 +0200 Some clients end option 53 buried inside of the packet. Pointed out on the list by Martin Lorentz src/modules/frs_dhcp/dhcp.c | 59 ++++++++++++++++++++++++++++++++++++++---- 1 files changed, 53 insertions(+), 6 deletions(-)

1 0

GIT Log for 2009-06-02 23:33 GMT
by aland＠deployingradius.com 02 Jun '09

02 Jun '09

commit c9d65dc24fcb353f5300299aa71de846dc0a5d71 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Jun 2 10:35:38 2009 +0200 Mark the proxy mutex as being recursive Some systems needs this to avoid deadlocks. Others (Linux) don't src/main/event.c | 14 ++++++++++++++ 1 files changed, 14 insertions(+), 0 deletions(-)

1 0

Urgent!!!! Help Required in decrypting 802.1x PEAP traffic
by Harsha gowda 02 Jun '09

02 Jun '09

Hi, I am trying to decrypt the 802.11 traffic, To decrypt the data i have to derive "Pairwise Master Key " can any one help me derive PMK for attached *Cap file* * http://www.sendspace.com/file/ztuulp* And *PrivateKey* file is *http://www.sendspace.com/file/w8bd9t* I am not clear when is EAP-TLS is started and how to decrypt the text inside tunnel. Please help me derivePK what i have read is PMK=TLS-PRF (Master Key, ”Client EAP encryption “ I clientHello.random I serverHello.random) can any one explain with example for the above PrivateKey and the cap file. what will be my PMK ?. Are client random and server random encrypted or they are in plane text And how to extract Master Key from .pem file Thanks a lot Regards Harsha

3 4

GIT Log for 2009-06-01 23:33 GMT
by aland＠deployingradius.com 01 Jun '09

01 Jun '09

commit 24ff8ec1cb2e81190dd9ae175e1faecc583a648c Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Jun 2 00:07:01 2009 +0200 Copy the User-Name by value The previous method treated the User-Name as a string, and parsed it to create the User-Name for the reply. However... if that happens, it SHOULD print the User-Name to a string, and then parse that. That way things like 'FOO\tbar' will get escaped to 'FOO\\tbar', and therefore parsed properly. Or, we could just copy the contents verbatim, which is what we did src/modules/rlm_eap/rlm_eap.c | 5 ++++- 1 files changed, 4 insertions(+), 1 deletions(-)

1 0

Building a radius test tool
by Vinit Karandikar 01 Jun '09

01 Jun '09

Hello folks, I'm new to Free Radius and would like to use it to build a test tool for testing a AAA server. I'd like the test tool to simulate (say) 10 network elements that talk to a AAA server - using threads on different ports that are controlled by the main thread. Some of these will initiate traffic to the AAA server (like the one simulating the PDSN). Others will receive traffic and talk back to the AAA server (like the one simulating the Pre-paid Server). I'm sure I'm not going to find something like this in the wild. So I'm planning to write code to do the above. I was wondering if there are bits of code that I can shamelessly pilfer from or use as a starting point. Any tips are plenty welcome... Thanks in advance to all, -Vinit

1 0