November 2010 - Freeradius-Devel - lists.freeradius.org

Missing TLS Change Cipher Spec and TLS Finished in EAP-TLS exchanges
by arno＠natisbad.org 09 Jul '11

09 Jul '11

Hi, I upgraded an internal freeradius server (Linux, Debian unstable, libssl 0.9.8) used for EAP-TLS (802.11 WPA2 access) from 2.0.5 to 2.1.3. With 2.1.3, client authentication fails in the following way (wpasupplicant on Debian unstable, working with 2.0.5): - the TLS exchange is completed from freeradius point of view. It even sends the Access-Accept message to the NAS. - from the clients point of view, the TLS exchange is not over, it expects some more data from the server which are never sent. I took two pcap traces (sent to you privately, Alan), one with 2.0.5, one with 2.1.3. It looks like the TLS Change Cipher and TLS Tinished elements of the TLS exchange are not in the EAP encapsulated TLS packets sent by the server. Compare packet #23 of 2.1.3 trace with packet #27 of 2.0.5 trace. If you use wireshark, you will notice that the SSL layer is dissected; this is because #27 has a small brother: #29. It is not sent by 2.1.3. Alan, if you have an idea or a patch, I can test it on monday. Cheers, a+

5 15

eap2 in freeradius
by Chanthearith HUON 04 Apr '11

04 Apr '11

Hi everyone, I am testing eap2 in freeradius. I run "radiusd -X", I got following error message " radiusd: symbol lookup error: /usr/lib/rlm_eap2-2.1.0.so: undefined symbol: eap_server_register_methods " Anyone, have any idea what might be wrong with the configuration? Thank in advance, Thierry

5 10

Accounting inquiry
by Nabawia Khalil 26 Nov '10

26 Nov '10

> > I am using freeradius to authenticate my users through my LDAP. > > I'm forwarding the accounting to a central radius. > > I want to include the LDAP-Group to the accounting data. > > Do any know how to include this field in the accounting data ?? > > If any one has a similar experience to include an item (such as Class > field) > let me know, and I can try it with my LDAP-Group > > > NK >

5 12

Preferred way to submit patches
by Brian Candler 26 Nov '10

26 Nov '10

I just wanted to check, what's the preferred way to submit a patch? The only advice I could find was at http://git.freeradius.org/ where it just links to the github instructions on forking a project. So I forked it, created a branch, and created bugzilla ticket #125 with the branch in the URL field. If in future you'd rather get a pull request on github instead of a bugzilla ticket, please let me know. Thanks, Brian.

2 1

no DB handles to use
by westwood 26 Nov '10

26 Nov '10

i write a module ,but when freeradius run for a while with it enable ,"no DB handles to use" come up to me...,I don't know why and how to solve this problem (In my module ,i use the sql api in rlm_sqlippool to communicate with sql ,and release after i have use the API)

4 7

rlm_ippool slowliness
by CANTOS Sébastien 26 Nov '10

26 Nov '10

Hi All, I'm using freeradius 1.x to authenticate users using a ldap backend. I see lots of "unresponsive child" errors when getting some request load. After reading through the mailing list archive I've seen that this is typical from one module being slow. I thought it was the ldap but I've now proven that the ldap answers correctly. In fact the slowdown happens in the postauth section when rlm_ippool tries to allocate an IP. I created a /16 network pool (more than 65000 IPs) to make sure I won't miss one when I'll get lots of traffic. This is lots more than what I need. I've traced the process (truss on solaris) and noticed that the thread is spending lots of time to do something like walking over all the database. In the rlm_ippool code I can see this comment: /* * Walk through the database searching for an active=0 entry. * We search twice. Once to see if we have an active entry with the same callerid * so that MPPP can work ok and then once again to find a free entry. */ Does this means that each time we need to allocate a new IP we need to walk through the complete database 2 times ? For information, when I use rlm_ippool_tool to show active entries in the DB it takes around 12 seconds. I've also noticed that there are mutexex locking the DB each time we need to access it. Finally I conclude that each time I need to answer an auth request I'm stucked during 12 seconds. I'm missing something ? Do I need to reduce the numbers of IPs in the pool or is there some other solution ? Regards, Sebastien

2 1

ip assigning module
by Konstantin Chekushin 25 Nov '10

25 Nov '10

Good afternoon. We have developed a new module assigning IP-addresses for our users. It uses a mysql database as IP source. We cannot use default rlm_sqlippool module, because of some additional logic. Major differences between our module and rlm_sqlippool are: * available IP address space is divided into IP ranges * each user belongs to some group (data plan) * on incoming radius auth packet the module searches data plan (by username) * the module takes some IP from IP range attached to this data plan. More detailed flow diagram is attached. We are ready to adopt this module to your requirements and support it in a future. Is it possible to add it to freeradius project?

3 2

Running radiusd in background mode
by Gyanendra Kumar 23 Nov '10

23 Nov '10

Hi All: I try and run as radiusd & and it simply exits. Here is the gdb trace: root@gkumar-desktop:/home/gkumar/rp/freeradius-server-2.1.9/src/main/.libs# gdb GNU gdb (GDB) 7.1-ubuntu Copyright (C) 2010 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html > This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "i486-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>. (gdb) file radiusd Reading symbols from /home/gkumar/rp/freeradius-server-2.1.9/src/main/.libs/radiusd...done. (gdb) run Starting program: /home/gkumar/rp/freeradius-server-2.1.9/src/main/.libs/radiusd [Thread debugging using libthread_db enabled] Program exited normally. (gdb) bt No stack. (gdb) Best Regards -Gyan

2 1

freeradius-server-2.1.10 compiles on HP-UX 11.31 with errors.
by Giampiero Torrielli 23 Nov '10

23 Nov '10

Hi all, I compiled and installed freeradius (freeradius-server-2.1.10) on a HPUX 11.31 Itanium V3 system, but I had to make some little code and makefile modifications. I would like to tell you these changes In the file : freeradius-server-2.1.10/src/modules/rlm_eap/rlm_eap.c in the new function static int eap_handler_ptr_cmp, the HP CC compiler gives an error on the returning value type. diff: line 111 < return (a - b); --- > return ((int)a - (int)b); In the file : freeradius-server-2.1.10/raddb/Makefile the HP ln command, don't understand the command line format. a '.' should be add to the end of command lines diffs: 26c26 < cd sites-enabled && ln -s ../sites-available/default; \ --- > cd sites-enabled && ln -s ../sites-available/default .; \ 29c29 < cd sites-enabled && ln -s ../sites-available/inner-tunnel; \ --- > cd sites-enabled && ln -s ../sites-available/inner-tunnel .; \ 78c78 < ln -s ../sites-available/default; \ --- > ln -s ../sites-available/default .; \ 82c82 < ln -s ../sites-available/inner-tunnel; \ --- > ln -s ../sites-available/inner-tunnel .; \ 86c86 < ln -s ../sites-available/control-socket; \ --- > ln -s ../sites-available/control-socket .; \ Best regards, GIampiero.

3 4

EAP/TLS OCSP Extention
by Alex Bergmann 19 Nov '10

19 Nov '10

Hi everyone! Back in 2004 I've finished my diploma thesis covering OCSP integration in the EAP/TLS module of freeRADIUS. Unfortunately I never posted the patch. To get this burden off me, I've dug through the code again, did some final adjustment and just finished the patch for the v2.1.x branch. The functionality is quite simple. After a user certificate is validated correctly it is possible to check the current status as well against an OCSP responder. Here's the debug output. [tls] --> verify return:1 [tls] --> Starting OCSP Request [ocsp] --> Resonder URL = http://127.0.0.1:80/ocsp/ [ocsp] --> Certificate is valid! I've added a new subsection inside the eap/tls configuration that makes it able to set the following settings. (A detailed description can be found in the patch.) ocsp { check_ocsp = yes define_ocsp_responder = yes ocsp_url = "http://127.0.0.1/ocsp/" } I'm aware that the EAP/TLS module was extended with a verify section that states OCSP explicitly. Nevertheless I would like to see this functionality implemented directly into the rlm_eap_tls module. Please feel free to comment on the code and on this feature in general. I'm happy about any feedback! Best regards, Alex

2 1