August 2009 - Freeradius-Devel - lists.freeradius.org

Missing TLS Change Cipher Spec and TLS Finished in EAP-TLS exchanges
by arno＠natisbad.org 09 Jul '11

09 Jul '11

Hi, I upgraded an internal freeradius server (Linux, Debian unstable, libssl 0.9.8) used for EAP-TLS (802.11 WPA2 access) from 2.0.5 to 2.1.3. With 2.1.3, client authentication fails in the following way (wpasupplicant on Debian unstable, working with 2.0.5): - the TLS exchange is completed from freeradius point of view. It even sends the Access-Accept message to the NAS. - from the clients point of view, the TLS exchange is not over, it expects some more data from the server which are never sent. I took two pcap traces (sent to you privately, Alan), one with 2.0.5, one with 2.1.3. It looks like the TLS Change Cipher and TLS Tinished elements of the TLS exchange are not in the EAP encapsulated TLS packets sent by the server. Compare packet #23 of 2.1.3 trace with packet #27 of 2.0.5 trace. If you use wireshark, you will notice that the SSL layer is dissected; this is because #27 has a small brother: #29. It is not sent by 2.1.3. Alan, if you have an idea or a patch, I can test it on monday. Cheers, a+

5 15

eap2 in freeradius
by Chanthearith HUON 04 Apr '11

04 Apr '11

Hi everyone, I am testing eap2 in freeradius. I run "radiusd -X", I got following error message " radiusd: symbol lookup error: /usr/lib/rlm_eap2-2.1.0.so: undefined symbol: eap_server_register_methods " Anyone, have any idea what might be wrong with the configuration? Thank in advance, Thierry

5 10

make_passwd(), rlm_perl and double quotes in the password
by Niko Tyni 28 Jan '10

28 Jan '10

Hi, we're seeing failed logins when proxying authentication requests through to another RADIUS server if the password contains a double quote ("). I've debugged the issue a bit, and what happens is that when the password does a roundtrip through the rlm_perl module, the value pair structure ends up with extra bytes at the end so that strlen(vp->data.strvalue) > vp->length. These extra bytes are the result of escaping the double quote before entering the Perl code and then unescaping it afterwards. For instance, the password abcdef" is passed as abcdef\" to the Perl code, and afterwards it becomes abcdef"" with length 7 (so the extra byte is not supposed to hurt AIUI.) Unfortunately make_passwd() rounds 'inlen' up to a multiple of 16 before copying the input string, so the extra bytes end up in the message authenticator of the proxied request. It seems to me that the escaping and unescaping done in rlm_perl via perl_store_vps() -> vp_prints_value() -> librad_safeprint() and get_hv_content() -> pairadd_sv() -> pairmake() -> pairparsevalue() is a bit unnecessary, and that the unescaping could zero out the extra bytes, but the main bug is in make_passwd() IMO. I have reproduced this with a Debian 2.0.4 freeradius package, a Fedora 2.1.3 package, and a current git.freeradius.org checkout (commit ef2a7db5e). I'm attaching a proposed patch to make_passwd(). Please let me know if you need more information, I can easily produce stack traces and the like. Thanks for your work on FreeRADIUS, -- Niko Tyni ntyni(a)cc.helsinki.fi

3 5

Re: vmps request: long attribute VQP-Ethernet-Frame
by Hermann Lauer 05 Jan '10

05 Jan '10

Alan DeKok wrote: > > 0x0c05 is VQP-Ethernet-Frame, which can of course be longer than 253 bytes, > > so there is a design issue here. One idea would be to cut the attribute to > > 253 bytes in vqp_recv(). Could this be done there without memory issues ? > > Yes, if you're not interested in the rest of the data. appended is a patch which implemeted the cutting. Seems to work. Please tell me if anybody sees any pitfall in it. Otherwise it should be cleaned up, which I probably will do in a week or so. Thanks, Hermann -- Netzwerkadministration/Zentrale Dienste, Interdiziplinaeres Zentrum fuer wissenschaftliches Rechnen der Universitaet Heidelberg IWR; INF 368; 69120 Heidelberg; Tel: (06221)54-8236 Fax: -5224 Email: Hermann.Lauer(a)iwr.uni-heidelberg.de

2 5

FreeRadius + EAP-AKA support
by Kumar, Sunil 26 Nov '09

26 Nov '09

Hi, We are trying to use FreeRadius1.1.4 as authentication server for EAP-AKA implementation with our product toolkit. As per the RFC 4187 AT_RES The value field of this attribute begins with the 2-byte RES Length, which identifies the exact length of the RES in bits. The RES length is followed by the AKA RES parameter. According to [TS33.105], the length of the AKA RES can vary between 32 and 128 bits. Because the length of the AT_RES attribute must be a multiple of 4 bytes, the sender pads the RES with zero bits where necessary. In the freeradius1.1.4 implementation, for EAP-AKA the value of RES length is always considered as constant EAPSIM_RES_SIZE (16). It doesn't take care of the values other than 16 bytes. We in our toolkit needs to support all the variable length of RES values from 32 bits (4 bytes) to 128 bits (16 bytes). So I have modified the FreeRadius implementation for the same support. The intention of writing such mail is to get the information that if somebody has already noticed and fixed this issue in the latest releases, so please share that information as well. In case it's not been fixed as yet, then may be I could contribute my patch for freeradius 1.1.4 version to support all variable length RES value varying from 32 bits to 128 bits. Thanks. Warm regards. Sunil Kumar The information contained in this electronic mail transmission may be privileged and confidential, and therefore, protected from disclosure. If you have received this communication in error, please notify us immediately by replying to this message and deleting it from your computer without copying or disclosing it.

4 5

GIT Log for 2009-08-20 23:33 GMT
by aland＠deployingradius.com 06 Sep '09

06 Sep '09

commit 48978c3e7f130d92c1acc52a14661354687ee05e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Aug 20 10:52:44 2009 +0200 Allow 100% to mean "read as fast as possible" Files changed: src/modules/frs_detail/frs_detail.c | 9 --------- 1 files changed, 0 insertions(+), 9 deletions(-) ====================================================================== commit fc1a8dc2665a2fdc897557f84d229b760d88d070 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Aug 12 17:14:28 2009 +0200 Fix minor issue Files changed: src/main/evaluate.c | 7 +++++-- 1 files changed, 5 insertions(+), 2 deletions(-) ====================================================================== commit 6fe921d737d167af8063e472fc438e826a3ba032 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Aug 20 09:08:32 2009 +0200 Packet may not exist, so check for that, too Files changed: src/modules/rlm_attr_filter/rlm_attr_filter.c | 19 ++++++++++++------- 1 files changed, 12 insertions(+), 7 deletions(-) ======================================================================

3 3

GIT Log for 2009-08-29 23:33 GMT
by aland＠deployingradius.com 29 Aug '09

29 Aug '09

commit 7f0f71b830a5d13bfe4c53890f1602f220c796cd Author: root <root(a)pclinux-ccalmb.lut.ac.uk> Date: Mon Aug 24 11:44:47 2009 +0100 Signed-off-by: root <root(a)pclinux-ccalmb.lut.ac.uk> fixed example ntlm_auth command so that it doesnt throw up unlang warning message Files changed: raddb/modules/mschap | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit f5ef5ed34396a45df642ffe35e2e4e1f3e811561 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Aug 29 10:44:54 2009 +0200 Added comments and simplified code Files changed: src/main/event.c | 17 ++++++++--------- 1 files changed, 8 insertions(+), 9 deletions(-) ======================================================================

1 0

git format-patch - fix the default example ntlm_auth command
by Alan Buxey 29 Aug '09

29 Aug '09

hi, attached patch is to stop the server throwing up unlang warnings about deprecated pattern matching etc when users are running the default ntlm_auth arguments as set by default....just a simple change to the expression alan

2 1

patch about OCI binding
by zhongwei feng 27 Aug '09

27 Aug '09

--- sql_oracle.c Thu Aug 27 18:46:35 2009 +++ sql_oracle.c.new Thu Aug 27 18:38:47 2009 @@ -29,6 +29,25 @@ #include <oci.h> #include "rlm_sql.h" +#define MAXBIND 40 +/* + * SQL WITH BIND : <SQL>\P<BIND1>\P<BIND2>.....\P<BINDn> + * BIND1 : <NAME>=<VALUE> ; the <NAME> is optional, if none, bindbyindex + * + */ +typedef struct rlm_sql_oraclesockbind { + char * ptr ; + int idx ; + char * name ; + int namelen ; + char * value ; + int vallen; + + OCIBind *bindp ; +} rlm_sql_oraclesockbind; + + + typedef struct rlm_sql_oracle_sock { OCIEnv *env; OCIError *errHandle; @@ -39,10 +58,108 @@ int id; int in_use; struct timeval tv; + + rlm_sql_oraclesockbind binds[MAXBIND]; + int bindcount; } rlm_sql_oracle_sock; #define MAX_DATASTR_LEN 64 +/************************************************************************* + * + * Function: sql_bindparse + * + * Purpose: split the sql statement for pure sql , each bind item , etc . + * + * + *************************************************************************/ + +static int sql_bindparse(SQLSOCK *sqlsocket, char * query) +{ + char * p = query ; + int count = 0 , i , k; + rlm_sql_oracle_sock *oracle_sock = sqlsocket->conn ; + oracle_sock->bindcount = 0 ; + + while ( *p ) { + switch ( *p ) { + case '\\' : + if (p[1]!='P') { + break; + } + *p = '\0'; + oracle_sock->binds[count].ptr = p+2; + count ++ ; + p ++ ; + break; + //default + } /* end of switch(*p) */ + p ++ ; + if (count>=MAXBIND) + break; + } + + for(i = 0, k = 0 ; k<count; k ++){ + if (oracle_sock->binds[k].ptr==NULL) + continue; + if (oracle_sock->binds[k].ptr[0]=='\0') + continue; + if ((p = strchr(oracle_sock->binds[k].ptr, '='))==NULL) + continue; + *p = '\0'; + oracle_sock->binds[i].value = p+1; + oracle_sock->binds[i].vallen = strlen (oracle_sock->binds[i].value); + if (p==oracle_sock->binds[k].ptr){ + oracle_sock->binds[i].name = NULL; + } else { + oracle_sock->binds[i].name = oracle_sock->binds[k].ptr; + oracle_sock->binds[i].namelen = p - oracle_sock->binds[k].ptr; + } + oracle_sock->binds[i].idx = i+1 ; + radlog(L_DBG, "bind[%d] v_p is<%s>(%d)-<%s>(%d)", i, + oracle_sock->binds[i].name,oracle_sock->binds[i].namelen, + oracle_sock->binds[i].value,oracle_sock->binds[i].vallen ); + i ++ ; continue; + } + + oracle_sock->bindcount = i ; + + return 0 ; +} + + +static int sql_ocibind(SQLSOCK *sqlsocket) +{ + int i ; + rlm_sql_oracle_sock *oracle_sock = sqlsocket->conn ; + for(i = 0;i<oracle_sock->bindcount; i++){ + if (oracle_sock->binds[i].name!=NULL){ + OCIBindByName( + oracle_sock->queryHandle, + &oracle_sock->binds[i].bindp, + oracle_sock->errHandle, + oracle_sock->binds[i].name, + oracle_sock->binds[i].namelen, + (ub1 *) oracle_sock->binds[i].value, + oracle_sock->binds[i].vallen+1, + SQLT_STR, (dvoid *) 0, (ub2 *) 0, (ub2) 0, (ub4) 0, (ub4 *) 0, + OCI_DEFAULT); + } else { + OCIBindByPos( + oracle_sock->queryHandle, + &oracle_sock->binds[i].bindp, + oracle_sock->errHandle, + oracle_sock->binds[i].idx, + (ub1 *) oracle_sock->binds[i].value, + oracle_sock->binds[i].vallen+1, + SQLT_STR, (dvoid *) 0, (ub2 *) 0, (ub2) 0, (ub4) 0, (ub4 *) 0, + OCI_DEFAULT); + } + } + + return 0; +} + /************************************************************************* * @@ -248,6 +365,8 @@ return SQL_DOWN; } + sql_bindparse(sqlsocket, querystr); + if (OCIStmtPrepare (oracle_sock->queryHandle, oracle_sock->errHandle, querystr, strlen(querystr), OCI_NTV_SYNTAX, OCI_DEFAULT)) { @@ -255,6 +374,9 @@ return -1; } + if (oracle_sock->bindcount>0) + sql_ocibind(sqlsocket); + x = OCIStmtExecute(oracle_sock->conn, oracle_sock->queryHandle, oracle_sock->errHandle, @@ -306,12 +428,17 @@ return SQL_DOWN; } + sql_bindparse(sqlsocket, querystr); + if (OCIStmtPrepare (oracle_sock->queryHandle, oracle_sock->errHandle, querystr, strlen(querystr), OCI_NTV_SYNTAX, OCI_DEFAULT)) { radlog(L_ERR,"rlm_sql_oracle: prepare failed in sql_select_query: %s",sql_error(sqlsocket, config)); return -1; } + + if (oracle_sock->bindcount>0) + sql_ocibind(sqlsocket); /* Query only one row by default (for now) */ x = OCIStmtExecute(oracle_sock->conn,

1 0

a patch for raddb/sql/oracle/schema.sql
by zhongwei feng 27 Aug '09

27 Aug '09

hi, there is a simple patch . correct index problem. --- schema.sql.orig Mon May 18 19:13:56 2009 +++ schema.sql Thu Aug 27 18:27:37 2009 @@ -39,7 +39,7 @@ XAscendSessionSvrKey VARCHAR(10) ); CREATE UNIQUE INDEX radacct_idx1 - ON radacct(acctsessionid,username,acctstarttime, + ON radacct(username,acctsessionid,acctstarttime, acctstoptime,nasipaddress,framedipaddress); CREATE SEQUENCE radacct_seq START WITH 1 INCREMENT BY 1; @@ -65,6 +65,7 @@ op VARCHAR(2) NOT NULL, value VARCHAR(40) ); +CREATE INDEX radcheck_idx1 ON radcheck(UserName); CREATE SEQUENCE radcheck_seq START WITH 1 INCREMENT BY 1; /* Trigger to emulate a serial # on the primary key */

1 0