January 2010 - Freeradius-Devel - lists.freeradius.org

Missing TLS Change Cipher Spec and TLS Finished in EAP-TLS exchanges
by arno＠natisbad.org 09 Jul '11

09 Jul '11

Hi, I upgraded an internal freeradius server (Linux, Debian unstable, libssl 0.9.8) used for EAP-TLS (802.11 WPA2 access) from 2.0.5 to 2.1.3. With 2.1.3, client authentication fails in the following way (wpasupplicant on Debian unstable, working with 2.0.5): - the TLS exchange is completed from freeradius point of view. It even sends the Access-Accept message to the NAS. - from the clients point of view, the TLS exchange is not over, it expects some more data from the server which are never sent. I took two pcap traces (sent to you privately, Alan), one with 2.0.5, one with 2.1.3. It looks like the TLS Change Cipher and TLS Tinished elements of the TLS exchange are not in the EAP encapsulated TLS packets sent by the server. Compare packet #23 of 2.1.3 trace with packet #27 of 2.0.5 trace. If you use wireshark, you will notice that the SSL layer is dissected; this is because #27 has a small brother: #29. It is not sent by 2.1.3. Alan, if you have an idea or a patch, I can test it on monday. Cheers, a+

5 15

eap2 in freeradius
by Chanthearith HUON 04 Apr '11

04 Apr '11

Hi everyone, I am testing eap2 in freeradius. I run "radiusd -X", I got following error message " radiusd: symbol lookup error: /usr/lib/rlm_eap2-2.1.0.so: undefined symbol: eap_server_register_methods " Anyone, have any idea what might be wrong with the configuration? Thank in advance, Thierry

5 10

make_passwd(), rlm_perl and double quotes in the password
by Niko Tyni 28 Jan '10

28 Jan '10

Hi, we're seeing failed logins when proxying authentication requests through to another RADIUS server if the password contains a double quote ("). I've debugged the issue a bit, and what happens is that when the password does a roundtrip through the rlm_perl module, the value pair structure ends up with extra bytes at the end so that strlen(vp->data.strvalue) > vp->length. These extra bytes are the result of escaping the double quote before entering the Perl code and then unescaping it afterwards. For instance, the password abcdef" is passed as abcdef\" to the Perl code, and afterwards it becomes abcdef"" with length 7 (so the extra byte is not supposed to hurt AIUI.) Unfortunately make_passwd() rounds 'inlen' up to a multiple of 16 before copying the input string, so the extra bytes end up in the message authenticator of the proxied request. It seems to me that the escaping and unescaping done in rlm_perl via perl_store_vps() -> vp_prints_value() -> librad_safeprint() and get_hv_content() -> pairadd_sv() -> pairmake() -> pairparsevalue() is a bit unnecessary, and that the unescaping could zero out the extra bytes, but the main bug is in make_passwd() IMO. I have reproduced this with a Debian 2.0.4 freeradius package, a Fedora 2.1.3 package, and a current git.freeradius.org checkout (commit ef2a7db5e). I'm attaching a proposed patch to make_passwd(). Please let me know if you need more information, I can easily produce stack traces and the like. Thanks for your work on FreeRADIUS, -- Niko Tyni ntyni(a)cc.helsinki.fi

3 5

[patch] pairmake_any() segfaults at conffile parse time if attr not in dictionary
by John Morrissey 23 Jan '10

23 Jan '10

When referencing non-dictionary attrs in FreeRADIUS' config ("Vendor-6969-Attr-69", for example), pairmake() calls pairmake_any(). FreeRADIUS 2.1.8's pairmake_any() assumes a non-NULL value argument, causing this segfault: #0 0x00007f2ec4c99010 in strlen () from /lib/libc.so.6 #1 0x00007f2ec5ffa495 in pairmake (attribute=<value optimized out>, value=0x0, operator=9) at valuepair.c:1358 #2 0x000000000040c8ba in cf_pairtovp (pair=0xe7d430) at conffile.c:1860 #3 0x000000000041abda in do_compile_modsingle (parent=0x0, component=2, ci=<value optimized out>, grouptype=0, modname=0x7ffff741e128) at modcall.c:1351 #4 0x0000000000418273 in load_component_section (cs=0xe7d0f0, components=0x11a5580, comp=2) at modules.c:873 #5 0x0000000000418828 in load_byserver (cs=0xe7cbd0) at modules.c:1072 #6 0x0000000000418b57 in virtual_servers_load (config=0xc71030) at modules.c:1200 #7 0x0000000000419518 in setup_modules (reload=<value optimized out>, config=0xc71030) at modules.c:1467 #8 0x0000000000417926 in read_mainconfig (reload=<value optimized out>) at mainconfig.c:914 #9 0x000000000041c1d8 in main (argc=2, argv=<value optimized out>) at radiusd.c:257 This patch modifies pairmake_any() to short-circuit in the case of a NULL value, allowing cf_pairtovp() to continue as normal, updating the type and value fields. --- src/lib/valuepair.c~ 2010-01-21 15:54:56.681161000 +0000 +++ src/lib/valuepair.c 2010-01-21 15:55:06.687350000 +0000 @@ -1355,6 +1355,12 @@ return NULL; } + vp->operator = (operator == 0) ? T_OP_EQ : operator; + + if (!value) { + return vp; + } + size = strlen(value + 2); /* @@ -1397,8 +1402,6 @@ break; } - vp->operator = (operator == 0) ? T_OP_EQ : operator; - return vp; } john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

2 1

Wichorus ASN-GW dictionary
by Ben Wiechman 23 Jan '10

23 Jan '10

Attached. Ben Wiechman Wisper High Speed Internet

2 1

ttls/gtc + perl
by Alexander Clouter 09 Jan '10

09 Jan '10

Hi, I'm slapping together a OTP system to use with FreeRADIUS and for the EAP side of things I am using GTC to get the challenge to the user and the response back. I first of all implemented everything nicely with just a straight forward non-EAP Access-Challenge approach; using rlm_perl to dish out a State attribute[1], the Reply-Message and of course to check the User-Password returned. This works great for pam_radius_auth. Then I moved onto the EAP side of things. The state of play is: TTLS -> GTC -> Perl The relevant bits of my config looks like: ---- eap gtc-trial.eap { .... gtc { challenge = "%{reply:Reply-Message}" auth_type = rfc2289 } ttls { default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = yes } .... } -- authorize { .... gtc-trial.perl gtc-trial.eap } authenticate { Auth-Type gtc-trial.eap { gtc-trial.eap } Auth-Type rfc2289 { gtc-trial.perl } } -- ---- As you can see nothing exciting. Now in the authorize section of the Perl module I wrote, when I send the Reply-Message challenge I return RLM_MODULE_HANDLED as the return code. The problem is when I do this I get: ---- ++[gtc-trial.perl] returns handled } # server gtc-trial [ttls] Got tunneled reply code 0 Reply-Message = "otp-md5 489 ch4230" [ttls] No tunneled reply was found for request 6 , and the request was not proxied: rejecting the user. [gtc-trial.eap] Handler failed in EAP/ttls rlm_eap_ttls: Freeing handler for user ac56(a)soas.ac.uk [gtc-trial.eap] Failed in EAP select ++[gtc-trial.eap] returns invalid Failed to authenticate the user. } # server gtc-trial Using Post-Auth-Type Reject ---- Changing it to RLM_MODULE_OK lets it pass through and everything starts to work, but it feels wrong; also as I would have to add difficult code paths for EAP and non-EAP connections. ---- ++[gtc-trial.perl] returns ok [gtc-trial.eap] EAP packet type response id 1 length 6 [gtc-trial.eap] No EAP Start, assuming it's an on-going EAP conversation ++[gtc-trial.eap] returns updated Found Auth-Type = gtc-trial.eap +- entering group gtc-trial.eap {...} [gtc-trial.eap] Request found, released from the list [gtc-trial.eap] EAP NAK [gtc-trial.eap] EAP-NAK asked for EAP-Type/gtc [gtc-trial.eap] processing type gtc [gtc] expand: %{reply:Reply-Message} -> otp-md5 489 ch4230 ++[gtc-trial.eap] returns handled } # server gtc-trial [ttls] Got tunneled reply code 11 Reply-Message = "otp-md5 489 ch4230" EAP-Message = 0x01020017066f74702d6d64352034383920636834323330 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2ab1156b2bb3138a6ec7c66d7216040d [ttls] Got tunneled Access-Challenge ++[gtc-trial.eap] returns handled } # server gtc-trial Sending Access-Challenge of id 57 to 77.75.106.34 port 1645 EAP-Message = 0x010a003f158000000035170301003060c61e58df7bb793b8bb0ff121a83f4c2e6709089d2806be79ba5b38f1188e918e1a23a26a5361cd919357ebf957b3b6 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x799072d07e9a671e00b9e884d1d4d75c ---- It's as if the fake-request stuff does not support RLM_MODULE_HANDLED? Of course I could be mis-understanding things completely and I should just stick with RLM_MODULE_OK...even for the non-EAP requests (however that *does* feel wrong). On a separate note I found out the hard way then passing 'State' back as a Reply attribute causes the EAP state machine to find two State attributes flying around rather than just the one it generates (am I understanding this correctly?). ---- [gtc-trial.eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request EAP-Message = 0x020100060306 FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request EAP-Message = 0x020100060306 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "ac56(a)soas.ac.uk" State = 0x72666332323839 State = 0xa044d18fa045d5754a1bb165bbc5857d [snipped] [gtc-trial.eap] EAP packet type response id 1 length 6 [gtc-trial.eap] No EAP Start, assuming it's an on-going EAP conversation ++[gtc-trial.eap] returns updated Found Auth-Type = gtc-trial.eap +- entering group gtc-trial.eap {...} [gtc-trial.eap] Either EAP-request timed out OR EAP-response to an unknown EAP-request [gtc-trial.eap] Failed in handler ++[gtc-trial.eap] returns invalid Failed to authenticate the user. } # server gtc-trial [ttls] Got tunneled reply code 3 [ttls] Got tunneled Access-Reject [gtc-trial.eap] Handler failed in EAP/ttls rlm_eap_ttls: Freeing handler for user ac56(a)soas.ac.uk [gtc-trial.eap] Failed in EAP select ++[gtc-trial.eap] returns invalid Failed to authenticate the user. } # server gtc-trial Using Post-Auth-Type Reject ---- If I am having to opt for a slightly different code path for my Perl module's authorize section (OK for EAP and HANDLED for non-EAP) is it safe to assume EAP is keeping everything in order? I am just using the State attribute to indicate that the challenge has been issued to the user and to avoid validating 'trash'; for example in the case of when using the Challenge-Response functionality found in mod_auth_radius. I see in ttls.c:process_reply() there are a number of probably relevant FIXME's on something that could be applicable? If you need any more information or the actual code, then do ask. Cheers [1] similarly to how Harry J Walsh was doing things: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg47425.… -- Alexander Clouter .sigmonster says: No line available at 300 baud.

2 2

how to catch module fail
by zhongwei feng 08 Jan '10

08 Jan '10

hi, all: I wanna catch sql module fail , therefore : site-enable/default: authorize { # # ... sql if (fail) { update reply { Session-Timeout := 300 } update control { Auth-Type := "Accept" } } # # } but debug output is : ++[unix] returns notfound ++[files] returns noop [sql] expand: %{User-Name} -> yuanlin2 [sql] sql_set_user escaped user --> 'yuanlin2' rlm_sql (sql): Trying to (re)connect unconnected handle 4.. rlm_sql (sql): Attempting to connect rlm_sql_oraclet #4 rlm_sql_oraclet: Oracle logon failed: 'ORA-12541: TNS:no listener ' rlm_sql (sql): Failed to connect DB handle #4 rlm_sql (sql): Ignoring unconnected handle 4.. rlm_sql (sql): Ignoring unconnected handle 3.. rlm_sql (sql): Ignoring unconnected handle 2.. rlm_sql (sql): Ignoring unconnected handle 1.. rlm_sql (sql): Ignoring unconnected handle 0.. rlm_sql (sql): There are no DB handles to use! skipped 5, tried to connect 1 ++[sql] returns fail Invalid user: [yuanlin2/yuanlin] (from client vmhost port 123456) Using Post-Auth-Type Reject +- entering group REJECT {...} mmmmm, why ?? ================================== there is another solution below: in authorize section : redundant { sql files } in users file : DEFAULT Auth-Type := Accept Session-Timeout := 300 ================================== but , how to catch sql module fail ?

2 1

Access-Request / Mandatory Attributes
by rsg 07 Jan '10

07 Jan '10

Hi, I find that FreeRadius server allows access even without either of the mandatory attributes i.e. NAS-Identifier or NAS-IP-Address in the Access Request packet. Is this a deviation from RFC 2865 ? " .....An Access-Request SHOULD contain a User-Name attribute. It MUST contain either a NAS-IP-Address attribute or a NAS-Identifier attribute (or both)." Can someone clarify this please? Many thanks, rsg.

2 1

Re: vmps request: long attribute VQP-Ethernet-Frame
by Hermann Lauer 05 Jan '10

05 Jan '10

Alan DeKok wrote: > > 0x0c05 is VQP-Ethernet-Frame, which can of course be longer than 253 bytes, > > so there is a design issue here. One idea would be to cut the attribute to > > 253 bytes in vqp_recv(). Could this be done there without memory issues ? > > Yes, if you're not interested in the rest of the data. appended is a patch which implemeted the cutting. Seems to work. Please tell me if anybody sees any pitfall in it. Otherwise it should be cleaned up, which I probably will do in a week or so. Thanks, Hermann -- Netzwerkadministration/Zentrale Dienste, Interdiziplinaeres Zentrum fuer wissenschaftliches Rechnen der Universitaet Heidelberg IWR; INF 368; 69120 Heidelberg; Tel: (06221)54-8236 Fax: -5224 Email: Hermann.Lauer(a)iwr.uni-heidelberg.de

2 5

debian build umask depedancy
by Hermann Lauer 05 Jan '10

05 Jan '10

The appended patch fixes a umask dependency of the build, otherwise a umask of 0023 make a build with fakeroot fail on lenny: chmod -x debian/freeradius/usr/share/doc/freeradius/examples/example.pl chmod: debian/freeradius/usr/share/doc/freeradius/examples/example.pl: new permissions are rw-r--r-x, not rw-r--r-- make[1]: *** [binary-common] Error 1 make[1]: Leaving directory `/home/hlauer/debian/freeradius/freeradius-server-2.1.8' make: *** [binary-arch] Error 2 dpkg-buildpackage: failure: fakeroot debian/rules binary gave error exit status 2 Or should this solved solved somehow else ? Thanks, Hermann

1 0