August 2009 - Freeradius-Devel - lists.freeradius.org

Missing TLS Change Cipher Spec and TLS Finished in EAP-TLS exchanges
by arno＠natisbad.org 09 Jul '11

09 Jul '11

Hi, I upgraded an internal freeradius server (Linux, Debian unstable, libssl 0.9.8) used for EAP-TLS (802.11 WPA2 access) from 2.0.5 to 2.1.3. With 2.1.3, client authentication fails in the following way (wpasupplicant on Debian unstable, working with 2.0.5): - the TLS exchange is completed from freeradius point of view. It even sends the Access-Accept message to the NAS. - from the clients point of view, the TLS exchange is not over, it expects some more data from the server which are never sent. I took two pcap traces (sent to you privately, Alan), one with 2.0.5, one with 2.1.3. It looks like the TLS Change Cipher and TLS Tinished elements of the TLS exchange are not in the EAP encapsulated TLS packets sent by the server. Compare packet #23 of 2.1.3 trace with packet #27 of 2.0.5 trace. If you use wireshark, you will notice that the SSL layer is dissected; this is because #27 has a small brother: #29. It is not sent by 2.1.3. Alan, if you have an idea or a patch, I can test it on monday. Cheers, a+

5 15

eap2 in freeradius
by Chanthearith HUON 04 Apr '11

04 Apr '11

Hi everyone, I am testing eap2 in freeradius. I run "radiusd -X", I got following error message " radiusd: symbol lookup error: /usr/lib/rlm_eap2-2.1.0.so: undefined symbol: eap_server_register_methods " Anyone, have any idea what might be wrong with the configuration? Thank in advance, Thierry

5 10

make_passwd(), rlm_perl and double quotes in the password
by Niko Tyni 28 Jan '10

28 Jan '10

Hi, we're seeing failed logins when proxying authentication requests through to another RADIUS server if the password contains a double quote ("). I've debugged the issue a bit, and what happens is that when the password does a roundtrip through the rlm_perl module, the value pair structure ends up with extra bytes at the end so that strlen(vp->data.strvalue) > vp->length. These extra bytes are the result of escaping the double quote before entering the Perl code and then unescaping it afterwards. For instance, the password abcdef" is passed as abcdef\" to the Perl code, and afterwards it becomes abcdef"" with length 7 (so the extra byte is not supposed to hurt AIUI.) Unfortunately make_passwd() rounds 'inlen' up to a multiple of 16 before copying the input string, so the extra bytes end up in the message authenticator of the proxied request. It seems to me that the escaping and unescaping done in rlm_perl via perl_store_vps() -> vp_prints_value() -> librad_safeprint() and get_hv_content() -> pairadd_sv() -> pairmake() -> pairparsevalue() is a bit unnecessary, and that the unescaping could zero out the extra bytes, but the main bug is in make_passwd() IMO. I have reproduced this with a Debian 2.0.4 freeradius package, a Fedora 2.1.3 package, and a current git.freeradius.org checkout (commit ef2a7db5e). I'm attaching a proposed patch to make_passwd(). Please let me know if you need more information, I can easily produce stack traces and the like. Thanks for your work on FreeRADIUS, -- Niko Tyni ntyni(a)cc.helsinki.fi

3 5

Re: vmps request: long attribute VQP-Ethernet-Frame
by Hermann Lauer 05 Jan '10

05 Jan '10

Alan DeKok wrote: > > 0x0c05 is VQP-Ethernet-Frame, which can of course be longer than 253 bytes, > > so there is a design issue here. One idea would be to cut the attribute to > > 253 bytes in vqp_recv(). Could this be done there without memory issues ? > > Yes, if you're not interested in the rest of the data. appended is a patch which implemeted the cutting. Seems to work. Please tell me if anybody sees any pitfall in it. Otherwise it should be cleaned up, which I probably will do in a week or so. Thanks, Hermann -- Netzwerkadministration/Zentrale Dienste, Interdiziplinaeres Zentrum fuer wissenschaftliches Rechnen der Universitaet Heidelberg IWR; INF 368; 69120 Heidelberg; Tel: (06221)54-8236 Fax: -5224 Email: Hermann.Lauer(a)iwr.uni-heidelberg.de

2 5

FreeRadius + EAP-AKA support
by Kumar, Sunil 26 Nov '09

26 Nov '09

Hi, We are trying to use FreeRadius1.1.4 as authentication server for EAP-AKA implementation with our product toolkit. As per the RFC 4187 AT_RES The value field of this attribute begins with the 2-byte RES Length, which identifies the exact length of the RES in bits. The RES length is followed by the AKA RES parameter. According to [TS33.105], the length of the AKA RES can vary between 32 and 128 bits. Because the length of the AT_RES attribute must be a multiple of 4 bytes, the sender pads the RES with zero bits where necessary. In the freeradius1.1.4 implementation, for EAP-AKA the value of RES length is always considered as constant EAPSIM_RES_SIZE (16). It doesn't take care of the values other than 16 bytes. We in our toolkit needs to support all the variable length of RES values from 32 bits (4 bytes) to 128 bits (16 bytes). So I have modified the FreeRadius implementation for the same support. The intention of writing such mail is to get the information that if somebody has already noticed and fixed this issue in the latest releases, so please share that information as well. In case it's not been fixed as yet, then may be I could contribute my patch for freeradius 1.1.4 version to support all variable length RES value varying from 32 bits to 128 bits. Thanks. Warm regards. Sunil Kumar The information contained in this electronic mail transmission may be privileged and confidential, and therefore, protected from disclosure. If you have received this communication in error, please notify us immediately by replying to this message and deleting it from your computer without copying or disclosing it.

4 5

GIT Log for 2009-08-20 23:33 GMT
by aland＠deployingradius.com 06 Sep '09

06 Sep '09

commit 48978c3e7f130d92c1acc52a14661354687ee05e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Aug 20 10:52:44 2009 +0200 Allow 100% to mean "read as fast as possible" Files changed: src/modules/frs_detail/frs_detail.c | 9 --------- 1 files changed, 0 insertions(+), 9 deletions(-) ====================================================================== commit fc1a8dc2665a2fdc897557f84d229b760d88d070 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Aug 12 17:14:28 2009 +0200 Fix minor issue Files changed: src/main/evaluate.c | 7 +++++-- 1 files changed, 5 insertions(+), 2 deletions(-) ====================================================================== commit 6fe921d737d167af8063e472fc438e826a3ba032 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Aug 20 09:08:32 2009 +0200 Packet may not exist, so check for that, too Files changed: src/modules/rlm_attr_filter/rlm_attr_filter.c | 19 ++++++++++++------- 1 files changed, 12 insertions(+), 7 deletions(-) ======================================================================

3 3

GIT Log for 2009-08-29 23:33 GMT
by aland＠deployingradius.com 29 Aug '09

29 Aug '09

commit 7f0f71b830a5d13bfe4c53890f1602f220c796cd Author: root <root(a)pclinux-ccalmb.lut.ac.uk> Date: Mon Aug 24 11:44:47 2009 +0100 Signed-off-by: root <root(a)pclinux-ccalmb.lut.ac.uk> fixed example ntlm_auth command so that it doesnt throw up unlang warning message Files changed: raddb/modules/mschap | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit f5ef5ed34396a45df642ffe35e2e4e1f3e811561 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Aug 29 10:44:54 2009 +0200 Added comments and simplified code Files changed: src/main/event.c | 17 ++++++++--------- 1 files changed, 8 insertions(+), 9 deletions(-) ======================================================================

1 0

git format-patch - fix the default example ntlm_auth command
by Alan Buxey 29 Aug '09

29 Aug '09

hi, attached patch is to stop the server throwing up unlang warnings about deprecated pattern matching etc when users are running the default ntlm_auth arguments as set by default....just a simple change to the expression alan

2 1

patch about OCI binding
by zhongwei feng 27 Aug '09

27 Aug '09

--- sql_oracle.c Thu Aug 27 18:46:35 2009 +++ sql_oracle.c.new Thu Aug 27 18:38:47 2009 @@ -29,6 +29,25 @@ #include <oci.h> #include "rlm_sql.h" +#define MAXBIND 40 +/* + * SQL WITH BIND : <SQL>\P<BIND1>\P<BIND2>.....\P<BINDn> + * BIND1 : <NAME>=<VALUE> ; the <NAME> is optional, if none, bindbyindex + * + */ +typedef struct rlm_sql_oraclesockbind { + char * ptr ; + int idx ; + char * name ; + int namelen ; + char * value ; + int vallen; + + OCIBind *bindp ; +} rlm_sql_oraclesockbind; + + + typedef struct rlm_sql_oracle_sock { OCIEnv *env; OCIError *errHandle; @@ -39,10 +58,108 @@ int id; int in_use; struct timeval tv; + + rlm_sql_oraclesockbind binds[MAXBIND]; + int bindcount; } rlm_sql_oracle_sock; #define MAX_DATASTR_LEN 64 +/************************************************************************* + * + * Function: sql_bindparse + * + * Purpose: split the sql statement for pure sql , each bind item , etc . + * + * + *************************************************************************/ + +static int sql_bindparse(SQLSOCK *sqlsocket, char * query) +{ + char * p = query ; + int count = 0 , i , k; + rlm_sql_oracle_sock *oracle_sock = sqlsocket->conn ; + oracle_sock->bindcount = 0 ; + + while ( *p ) { + switch ( *p ) { + case '\\' : + if (p[1]!='P') { + break; + } + *p = '\0'; + oracle_sock->binds[count].ptr = p+2; + count ++ ; + p ++ ; + break; + //default + } /* end of switch(*p) */ + p ++ ; + if (count>=MAXBIND) + break; + } + + for(i = 0, k = 0 ; k<count; k ++){ + if (oracle_sock->binds[k].ptr==NULL) + continue; + if (oracle_sock->binds[k].ptr[0]=='\0') + continue; + if ((p = strchr(oracle_sock->binds[k].ptr, '='))==NULL) + continue; + *p = '\0'; + oracle_sock->binds[i].value = p+1; + oracle_sock->binds[i].vallen = strlen (oracle_sock->binds[i].value); + if (p==oracle_sock->binds[k].ptr){ + oracle_sock->binds[i].name = NULL; + } else { + oracle_sock->binds[i].name = oracle_sock->binds[k].ptr; + oracle_sock->binds[i].namelen = p - oracle_sock->binds[k].ptr; + } + oracle_sock->binds[i].idx = i+1 ; + radlog(L_DBG, "bind[%d] v_p is<%s>(%d)-<%s>(%d)", i, + oracle_sock->binds[i].name,oracle_sock->binds[i].namelen, + oracle_sock->binds[i].value,oracle_sock->binds[i].vallen ); + i ++ ; continue; + } + + oracle_sock->bindcount = i ; + + return 0 ; +} + + +static int sql_ocibind(SQLSOCK *sqlsocket) +{ + int i ; + rlm_sql_oracle_sock *oracle_sock = sqlsocket->conn ; + for(i = 0;i<oracle_sock->bindcount; i++){ + if (oracle_sock->binds[i].name!=NULL){ + OCIBindByName( + oracle_sock->queryHandle, + &oracle_sock->binds[i].bindp, + oracle_sock->errHandle, + oracle_sock->binds[i].name, + oracle_sock->binds[i].namelen, + (ub1 *) oracle_sock->binds[i].value, + oracle_sock->binds[i].vallen+1, + SQLT_STR, (dvoid *) 0, (ub2 *) 0, (ub2) 0, (ub4) 0, (ub4 *) 0, + OCI_DEFAULT); + } else { + OCIBindByPos( + oracle_sock->queryHandle, + &oracle_sock->binds[i].bindp, + oracle_sock->errHandle, + oracle_sock->binds[i].idx, + (ub1 *) oracle_sock->binds[i].value, + oracle_sock->binds[i].vallen+1, + SQLT_STR, (dvoid *) 0, (ub2 *) 0, (ub2) 0, (ub4) 0, (ub4 *) 0, + OCI_DEFAULT); + } + } + + return 0; +} + /************************************************************************* * @@ -248,6 +365,8 @@ return SQL_DOWN; } + sql_bindparse(sqlsocket, querystr); + if (OCIStmtPrepare (oracle_sock->queryHandle, oracle_sock->errHandle, querystr, strlen(querystr), OCI_NTV_SYNTAX, OCI_DEFAULT)) { @@ -255,6 +374,9 @@ return -1; } + if (oracle_sock->bindcount>0) + sql_ocibind(sqlsocket); + x = OCIStmtExecute(oracle_sock->conn, oracle_sock->queryHandle, oracle_sock->errHandle, @@ -306,12 +428,17 @@ return SQL_DOWN; } + sql_bindparse(sqlsocket, querystr); + if (OCIStmtPrepare (oracle_sock->queryHandle, oracle_sock->errHandle, querystr, strlen(querystr), OCI_NTV_SYNTAX, OCI_DEFAULT)) { radlog(L_ERR,"rlm_sql_oracle: prepare failed in sql_select_query: %s",sql_error(sqlsocket, config)); return -1; } + + if (oracle_sock->bindcount>0) + sql_ocibind(sqlsocket); /* Query only one row by default (for now) */ x = OCIStmtExecute(oracle_sock->conn,

1 0

a patch for raddb/sql/oracle/schema.sql
by zhongwei feng 27 Aug '09

27 Aug '09

hi, there is a simple patch . correct index problem. --- schema.sql.orig Mon May 18 19:13:56 2009 +++ schema.sql Thu Aug 27 18:27:37 2009 @@ -39,7 +39,7 @@ XAscendSessionSvrKey VARCHAR(10) ); CREATE UNIQUE INDEX radacct_idx1 - ON radacct(acctsessionid,username,acctstarttime, + ON radacct(username,acctsessionid,acctstarttime, acctstoptime,nasipaddress,framedipaddress); CREATE SEQUENCE radacct_seq START WITH 1 INCREMENT BY 1; @@ -65,6 +65,7 @@ op VARCHAR(2) NOT NULL, value VARCHAR(40) ); +CREATE INDEX radcheck_idx1 ON radcheck(UserName); CREATE SEQUENCE radcheck_seq START WITH 1 INCREMENT BY 1; /* Trigger to emulate a serial # on the primary key */

1 0

about oracle performance improvement
by zhongwei feng 26 Aug '09

26 Aug '09

hi everyone, i use rlm_sql driver oracle , and improve that performance. my method :change the querystr schema(and also backward compatible), and use OCIBindByName/OCIBindByPos functions , about 150 lines of code /* * SQL WITH BIND : <SQL>\P<BIND1>\P<BIND2>.....\P<BINDn> * BIND1 : <NAME>=<VALUE> ; the <NAME> is optional, if none, bindbyindex * */ Comparison of dynamic sql and binding sql, performance increased by 50% or even 400% (especially in the relatively slow CPU environment) BTW:raddb/sql/oracle/schema.sql, lack an index for the RADCHECK.username anyone can contact me , get the code , and / or commit them to the FreeRadius Project?

2 1

FW: MSCHAP Authentication Issue
by Garber, Neal 26 Aug '09

26 Aug '09

I apologize for posting in the wrong list (and for posting this again - I'm doing so to allow the thread to continue on the proper list).. > I suspect that it will. The mschap module should also pass the Name > field when calling ntlm_auth, too. And maybe print a warning if the > fields are different. I constructed a test program by extracting challenge_hash from rlm_mschap.c (and all supporting functions). I then extracted the peer challenge, authenticator challenge and NT-Response from the debug output of a failed request (User-Name was all lowercase, Name field was mixed case). I called challenge_hash with the all lowercase userid (to ensure it generated the same challenge as the failed request) - the challenge was identical. I then generated another challenge with the userid from the Name field in the response. Then, I executed ntlm_auth manually with the original challenge and the new challenge. The original failed (as I expected) and, low and behold, the new challenge (created using the Name field's userid) succeeded! I will now proceed to create a patch. I was planning to do a strncasecmp to ensure the only difference between the userid part of User-Name and the userid part of the Name field is case. If there are non-case differences, do you think a RLM_REJECT is in order or do you think it should just warn and use whatever is present (I can't think of a normal case where this would occur, but if you think this is better, then I would definitely use the Name field for the username parameter too)? I was thinking of rejecting the request, in this case, so this couldn't be used to bypass authorization. Interestingly, I copied the challenge and response from a successful and failed attempt and manually called ntlm_auth varying the case of the --username parameter and it didn't affect the results. In other words, --username=MYUSER or --username=myuser or --username=MyuseR all behave the same if the --challenge and --nt-response are correct).

2 2

Re:about oracle performance improvement
by zhongwei feng 26 Aug '09

26 Aug '09

--- org/sql_oracle.c +++ new/sql_oracle.c @@ -29,6 +29,25 @@ #include <oci.h> #include "rlm_sql.h" +#define MAXBIND 40 +/* + * SQL WITH BIND = <SQL>\P<BIND1>\P<BIND2>.....\P<BINDn> + * BIND1 = <NAME>=<VALUE> ; the <NAME> is optional, if none, bindbyindex + * + */ +typedef struct rlm_sql_oraclesockbind { + char * ptr ; + int idx ; + char * name ; + int namelen ; + char * value ; + int vallen; + + OCIBind *bindp ; +} rlm_sql_oraclesockbind; + + + typedef struct rlm_sql_oracle_sock { OCIEnv *env; OCIError *errHandle; @@ -39,11 +58,110 @@ int id; int in_use; struct timeval tv; + + rlm_sql_oraclesockbind binds[MAXBIND]; + int bindcount; } rlm_sql_oracle_sock; #define MAX_DATASTR_LEN 64 +/************************************************************************* + * + * Function: sql_bindparse + * + * Purpose: split the sql statement for pure sql , each bind item , etc . + * + * + *************************************************************************/ +static int sql_bindparse(SQLSOCK *sqlsocket, char * query) +{ + char * p = query ; + int count = 0 , i , k; + rlm_sql_oracle_sock *oracle_sock = sqlsocket->conn ; + oracle_sock->bindcount = 0 ; + + while (*p) { + printf("DEBUG:%s\n",p); + switch (*p) { + case '\\' : + if (p[1]!='P') { + break; + } + *p = '\0'; + oracle_sock->binds[count].ptr = p+2; + count ++ ; + p ++ ; + break; + //default + } /* end of switch(*p) */ + p ++ ; + if (count>=MAXBIND) + break; + } + + for(i=0, k = 0 ; k<count; k++){ + if (oracle_sock->binds[k].ptr==NULL) + continue; + if (oracle_sock->binds[k].ptr[0]=='\0') + continue; + if ((p=strchr(oracle_sock->binds[k].ptr, '='))==NULL) + continue; + *p = '\0'; + oracle_sock->binds[i].value = p+1; + oracle_sock->binds[i].vallen = strlen (oracle_sock->binds[i].value); + if (p==oracle_sock->binds[k].ptr){ + oracle_sock->binds[i].name = NULL; + } else { + oracle_sock->binds[i].name = oracle_sock->binds[k].ptr; + oracle_sock->binds[i].namelen = p - oracle_sock->binds[k].ptr; + } + oracle_sock->binds[i].idx = i+1 ; + radlog(L_DBG, "bind[%d] v_p is<%s>(%d)-<%s>(%d)", i, + oracle_sock->binds[i].name,oracle_sock->binds[i].namelen, + oracle_sock->binds[i].value,oracle_sock->binds[i].vallen ); + i ++ ; continue; + } + + oracle_sock->bindcount = i ; + + return 0 ; +} + + +static int sql_ocibind(SQLSOCK *sqlsocket) +{ + int i ; + rlm_sql_oracle_sock *oracle_sock = sqlsocket->conn ; + for(i=0;i<oracle_sock->bindcount; i++){ + if (oracle_sock->binds[i].name!=NULL){ + OCIBindByName( + oracle_sock->queryHandle, + &oracle_sock->binds[i].bindp, + oracle_sock->errHandle, + oracle_sock->binds[i].name, + oracle_sock->binds[i].namelen, + (ub1 *) oracle_sock->binds[i].value, + oracle_sock->binds[i].vallen+1, + SQLT_STR, (dvoid *) 0, (ub2 *) 0, (ub2) 0, (ub4) 0, (ub4 *) 0, + OCI_DEFAULT); + } else { + OCIBindByPos( + oracle_sock->queryHandle, + &oracle_sock->binds[i].bindp, + oracle_sock->errHandle, + oracle_sock->binds[i].idx, + (ub1 *) oracle_sock->binds[i].value, + oracle_sock->binds[i].vallen+1, + SQLT_STR, (dvoid *) 0, (ub2 *) 0, (ub2) 0, (ub4) 0, (ub4 *) 0, + OCI_DEFAULT); + } + } + + return 0; +} + + /************************************************************************* * * Function: sql_error @@ -248,6 +366,8 @@ return SQL_DOWN; } + sql_bindparse(sqlsocket, querystr); + if (OCIStmtPrepare (oracle_sock->queryHandle, oracle_sock->errHandle, querystr, strlen(querystr), OCI_NTV_SYNTAX, OCI_DEFAULT)) { @@ -255,6 +375,9 @@ return -1; } + if (oracle_sock->bindcount>0) + sql_ocibind(sqlsocket); + x = OCIStmtExecute(oracle_sock->conn, oracle_sock->queryHandle, oracle_sock->errHandle, @@ -306,6 +429,8 @@ return SQL_DOWN; } + sql_bindparse(sqlsocket, querystr); + if (OCIStmtPrepare (oracle_sock->queryHandle, oracle_sock->errHandle, querystr, strlen(querystr), OCI_NTV_SYNTAX, OCI_DEFAULT)) { @@ -313,6 +438,9 @@ return -1; } + if (oracle_sock->bindcount>0) + sql_ocibind(sqlsocket); + /* Query only one row by default (for now) */ x = OCIStmtExecute(oracle_sock->conn, oracle_sock->queryHandle, ============================================ diaup.conf authorize_check_query = "SELECT id,UserName,Attribute,Value,op FROM ${authcheck_table} WHERE Username = :uname ORDER BY id\\P:uname=%{SQL-User-Name}" accounting_update_query = "UPDATE ${acct_table1} \ SET FramedIPAddress = :framedip, \ AcctSessionTime = TO_NUMBER(:acctsesstime), \ AcctInputOctets = TO_NUMBER(:acct_in_oct) + TO_NUMBER(:acct_in_octG) * 4294967296, \ AcctOutputOctets = TO_NUMBER(:acct_out_oct) + TO_NUMBER(:acct_out_octG) * 4294967296 \ WHERE \ AcctSessionId = :acctsessid AND \ UserName = :uname AND \ NASIPAddress= :nasip AND \ AcctStopTime IS NULL\ \\P:framedip=%{Framed-IP-Address}\ \\P:acctsesstime=%{Acct-Session-Time}\ \\P:acct_in_oct=%{Acct-Input-Octets}\\P:acct_in_octG=%{Acct-Input-Gigawords}\ \\P:acct_out_oct=%{Acct-Input-Octets}\\P:acct_out_octG=%{Acct-Input-Gigawords}\ \\P:acctsessid=%{Acct-Session-Id}\ \\P:uname=%{SQL-User-Name}\ \\P:nasip=%{NAS-IP-Address}"

1 0

RADIUS/UDP and the DF bit
by Stefan Winter 25 Aug '09

25 Aug '09

Hello, now this is unpleasant: Apparently, many OSes set the DF bit on every datagram they send, if Path MTU discovery is turned on. Even on UDP packets. This breaks your RADIUS communication if datagram > MTU. I have reason to believe that this has led to numerous problems with EAP-TLS in eduroam, for example. It is of course not in principle a FreeRADIUS problem, but an OS one (speaking here of Linux in particular), but other software like BIND takes precautions against that and I think it might be good to do the same in FreeRADIUS as well (i.e. explicitly disable IP_DONTFRAG socket option). To illustrate the problem (FR 2.1.6 on a host called radius-1): 09:54:55.234018 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 291) tld1.eduroam.lu.56581 > radius-1.restena.lu.radius: [udp sum ok] RADIUS, length: 263 09:54:55.234315 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 314) radius-1.restena.lu.tdp-suite > eomund.restena.lu.radius: [udp sum ok] RADIUS, length: 286 09:54:55.241858 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto UDP (17), length 1123) eomund.restena.lu.radius > radius-1.restena.lu.tdp-suite: [udp sum ok] RADIUS, length: 1095 09:54:55.242170 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 1118) radius-1.restena.lu.radius > tld1.eduroam.lu.56581: [udp sum ok] RADIUS, length: 1090 "Flags [DF]" means pain. One workaround is to disable Path MTU discovery on the IP layer of the host (/proc/sys/net/ipv4/ip_no_pmtu_disc), but obviously, that's a bad workaround since it will ruin Path MTU discovery for every TCP service on the same host. Luckily, IPv6 doesn't seem to be affected since MTU discovery works differently there (AFAIK). The BIND sources have a small workaround in their socket code to get around that: #if defined(IP_MTU_DISCOVER) && defined(IP_PMTUDISC_DONT) /* * Turn off Path MTU discovery on IPv4/UDP sockets. */ if (sock->pf == AF_INET) { int action = IP_PMTUDISC_DONT; (void)setsockopt(sock->fd, IPPROTO_IP, IP_MTU_DISCOVER, &action, sizeof(action)); } #endif #if defined(IP_DONTFRAG) /* * Turn off Path MTU discovery on IPv4/UDP sockets. */ if (sock->pf == AF_INET) { int off = 0; (void)setsockopt(sock->fd, IPPROTO_IP, IP_DONTFRAG, &off, sizeof(off)); } #endif May I suggest to do a similar thing in FreeRADIUS? The same happens on Radiator BTW, and I will post a similar message to these guys as well. Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

3 7

Patch Format
by Garber, Neal 25 Aug '09

25 Aug '09

I have a patch that I would like to submit, but I'd like to format it in a way that is easiest to integrate. Other messages I've read indicate that this is git format. Can someone confirm that the instructions for doing this are here: http://git.freeradius.org/howto.html? If not, can you point me to a document that will show me how to provide the patches in the desired format? Thanks..

2 1

git format-patch - add protection wrapper around detail module
by Alan Buxey 24 Aug '09

24 Aug '09

hi, attached patch means that the detail module doesnt get poisoned as much by packets that it doesnt like alan

2 1

GIT Log for 2009-08-21 23:33 GMT
by aland＠deployingradius.com 21 Aug '09

21 Aug '09

commit 34f8e2c30fd9fc84b8241da7cd1b4045747d804a Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Aug 21 11:29:21 2009 +0200 As posted to the list share/dictionary.foundry | 14 ++++++++++++++ 1 files changed, 14 insertions(+), 0 deletions(-)

1 0

Re: Buffered SQL for authentication failures?
by John Morrissey 21 Aug '09

21 Aug '09

[seems somewhat more appropriate on -devel, moving there] On Wed, Aug 05, 2009 at 01:11:33PM -0400, John Morrissey wrote: > I'm in the process of replacing OSG's Radiator with FreeRADIUS. I have our > relatively complex configuration mostly ported, but a few things have left > me stumped. > > I'd like to write authentication failures to an SQL database using a > detail listener so they're buffered, as with accounting: > > detail detail.auth { > detailfile = ${radacctdir}/detail-auth > detailperm = 0600 > header = "%t" > } > > post-auth { > Post-Auth-Type REJECT { > detail.auth > } > } > > server buffered-sql-auth { > listen { > type = detail > filename = ${radacctdir}/detail-auth > load_factor = 100 > } > post-auth { > sql > } > } > > Detail entries are picked up by the listener, but it never seems to do > anything with them: > > Going to the next request > Waking up in 0.7 seconds. > Polling for detail file /var/log/freeradius/radacct/detail-acct > Polling for detail file /var/log/freeradius/radacct/detail-auth > detail_recv: Renaming /var/log/freeradius/radacct/detail-auth -> /var/log/freeradius/radacct/detail-auth.work > detail_recv: Read packet from /var/log/freeradius/radacct/detail-auth.work > Packet-Type = Access-Reject > Framed-Protocol = PPP > Service-Type = Framed-User > Framed-IP-Address = 255.255.255.254 > Framed-Compression = Van-Jacobson-TCP-IP > Framed-MTU = 1500 > Acct-Delay-Time = 0 > server buffered-sql-auth { > } # server buffered-sql-auth > Finished request 7. > Cleaning up request 7 ID 41800 with timestamp +263 > > > It looks like detail_recv() explicitly sets its RAD_REQUEST_FUNP to > rad_accounting: > > *pfun = rad_accounting; > > I haven't looked much into the FreeRADIUS source yet; is it reasonably > easy to determine/loop through the configured handlers for the detail > listener to support a situation like this? Is there a better way of doing > this? To restate, my goal is to write failed authentication detail to a detail log that's then read by a detail listener and inserted into an SQL database. Looking at the code, I was thinking about adding an intermediate function that would call both rad_accounting() and rad_postauth(). Since default_component_results[] indicates NOOP for both of these, this should be straightforward. The problem now becomes that the post-auth rlm_detail is writing the RADIUS *response* to the detail log, since that's the packet that's being handled at that point. rlm_detail can't be listed in authenticate {}, so I can't use unlang to only call rlm_detail on Access-Reject. Modifying rlm_detail to have an authenticate handler seems... dirty. Any ideas? Is there a better way to accomplish failed auth buffered SQL insertion? john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

2 1

Year 2045 problems
by Joe Maimon 20 Aug '09

20 Aug '09

Wed Aug 19 11:34:04 2009 : Error: rlm_sql: Failed to create the pair: failed to parse time string "31 Jan 2045" Wed Aug 19 11:34:04 2009 : Error: rlm_sql (sql): Error getting data from database Wed Aug 19 11:34:04 2009 : Error: [sql] SQL query error; rejecting user The workaround is easy, stop setting Expiration, but I am curious as to where the fault is.

5 4

GIT Log for 2009-08-19 23:33 GMT
by aland＠deployingradius.com 19 Aug '09

19 Aug '09

commit eec417078d44cd3d39f94ba6c02c8ee1d9e0fbb3 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Aug 19 08:58:47 2009 +0200 Disallow NULL for regex comparisons src/lib/valuepair.c | 10 ++++++++-- 1 files changed, 8 insertions(+), 2 deletions(-)

1 0

Addition of 3gpp vendor specific attributes
by Tejesh Vijayakumar 19 Aug '09

19 Aug '09

Hi, What are the changes to be incorporated in freeradius server to add 3gpp attributes. Where does freeradius process and send Auth Accept for 3gpp sub attributes.[Pls mention the function name if possible] Regards, Tejesh Vijayakumar Software Engineer, Product Engineering Services[PES] Group, This Document is classified as: L&T Infotech Proprietary L&T Infotech Confidential L&T Infotech Internal Use Only L&T Infotech General Business This Email may contain confidential or privileged information for the intended recipient (s) If you are not the intended recipient, please do not use or disseminate the information, notify the sender and delete it from your system. ______________________________________________________________________

2 1

To send accept for all auth request
by Toledo, Luis Carlos 19 Aug '09

19 Aug '09

Hi, I would like for lab propose to send accept for all auth requests. Is it possible? Are there some config example? Thx

2 1

CISCO_ACCOUNTING_HACK
by Gabriel Blanchard 19 Aug '09

19 Aug '09

in rlm_sql.c this portion of code is causing problems combined with the "buffered_sql/detail" server. I don't actually use Ciscos but Juniper ERXes and this still happens. nevertheless by returning RLM_MODULE_NOOP it causes the buffered sql home server to try to send the packet for ever resulting in the detail file never being processed. I'm not sure what would be appropriate fix here, the only way to disable this section is to go in src/modules/rlm_sql/conf.h and remove the define manually. Maybe a configure script option would be nice. Or maybe returning RLM_MODULE_OK, but in a sense it wouldn't be true since the module did in fact do nothing. #ifdef CISCO_ACCOUNTING_HACK /* * If stop but zero session length AND no previous * session found, drop it as in invalid packet * This is to fix CISCO's aaa from filling our * table with bogus crap */ if ((pair = pairfind(request->packet->vps, PW_ACCT_SESSION_TIME)) != NULL) acctsessiontime = pair->vp_integer; if (acctsessiontime <= 0) { radius_xlat(logstr, sizeof(logstr), "stop packet with zero session length. [user '%{User-Name}', nas '%{NAS-IP-Address}']", request, NULL); radlog_request(L_ERR, 0, request, "%s", logstr); sql_release_socket(inst, sqlsocket); ret = RLM_MODULE_NOOP; } #endif

3 9

GIT Log for 2009-08-18 23:33 GMT
by aland＠deployingradius.com 18 Aug '09

18 Aug '09

commit 05afc2988611effcd09e58ee00ffe9364ce17ec9 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Aug 18 17:23:49 2009 +0200 Fix more typos Files changed: src/lib/packet.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) ====================================================================== commit 8478f80966c3a40de116defa21ceb2ac94a9f19c Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Aug 18 12:07:40 2009 +0200 Fixed typo Files changed: src/lib/packet.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) ====================================================================== commit 967df828d27bfee045393d93120188b6f1b374bf Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Aug 18 10:31:43 2009 +0200 Turn off the DF bit. Files changed: src/lib/packet.c | 24 ++++++++++++++++++++++++ 1 files changed, 24 insertions(+), 0 deletions(-) ====================================================================== commit 3036bb7a3a8fca5ce5b9a67d41e2c31e4d0151a6 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Aug 18 09:47:19 2009 +0200 Fix args to printfy Files changed: src/main/mainconfig.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ======================================================================

1 0

ChangeLog for 2.1.6 question: Make rlm_perl keep tags for tagged attributes in more situations
by Alexandr Kovalenko 18 Aug '09

18 Aug '09

Hello, I've read ChangeLog for FreeRADIUS 2.1.6 and found there: # Make rlm_perl keep tags for tagged attributes in more situations Could anyone please point me to exact commits/diffs so I can see if this will fix my issue with tagged attributes, which I experienced - tagged attributes ERX-Service-Activate, ERX-Service-Statistics and similar were sent back to NAS without tags. I had to switch to rlm_python because of this, which is workaround for me, as long as everything here works using perl, and only this module uses python. Thanks in advance. -- Alexandr Kovalenko http://uafug.org.ua/

2 3