February 2010 - Freeradius-Devel - lists.freeradius.org

Missing TLS Change Cipher Spec and TLS Finished in EAP-TLS exchanges
by arno＠natisbad.org 09 Jul '11

09 Jul '11

Hi, I upgraded an internal freeradius server (Linux, Debian unstable, libssl 0.9.8) used for EAP-TLS (802.11 WPA2 access) from 2.0.5 to 2.1.3. With 2.1.3, client authentication fails in the following way (wpasupplicant on Debian unstable, working with 2.0.5): - the TLS exchange is completed from freeradius point of view. It even sends the Access-Accept message to the NAS. - from the clients point of view, the TLS exchange is not over, it expects some more data from the server which are never sent. I took two pcap traces (sent to you privately, Alan), one with 2.0.5, one with 2.1.3. It looks like the TLS Change Cipher and TLS Tinished elements of the TLS exchange are not in the EAP encapsulated TLS packets sent by the server. Compare packet #23 of 2.1.3 trace with packet #27 of 2.0.5 trace. If you use wireshark, you will notice that the SSL layer is dissected; this is because #27 has a small brother: #29. It is not sent by 2.1.3. Alan, if you have an idea or a patch, I can test it on monday. Cheers, a+

5 15

eap2 in freeradius
by Chanthearith HUON 04 Apr '11

04 Apr '11

Hi everyone, I am testing eap2 in freeradius. I run "radiusd -X", I got following error message " radiusd: symbol lookup error: /usr/lib/rlm_eap2-2.1.0.so: undefined symbol: eap_server_register_methods " Anyone, have any idea what might be wrong with the configuration? Thank in advance, Thierry

5 10

radiusclient thread-safety
by Alex Massover 02 Mar '10

02 Mar '10

Hello, I'm using radiusclient lib from multithreaded application, by having a "static rc_handle *rh" and calling rc_auth() from different threads. Everything works until 2 (or more) threads enter rc_auth() before the previous one finished. But 2 concurrent threads enough to corrupt everything, I'm starting to get "received invalid reply digest..." followed by "no reply from RADIUS server" for subsequent calls. I changed rc_check_reply() to return OK at the beginning, it eliminated "received invalid reply", but I still get "no reply from RADIUS server ...". In wireshark trace it looks like there's no problems with responses, every request receives response (and before timeout should happen). It looks like something logical, shared or static buffer maybe. I'm looking in the code and can't find the problem :( I changed localtime to localtime_r, gmtime to gmtime_r, rand to rand_r, but still have a problem. In the trace: ->request <-response ->request <-response Works well, but looks like enough to have: ->request ->request <-response <-response To cause most of (not every) following subsequent request to get "no reply..." although there're responses in the trace. Also my distro has old radiusclient-ng and not freeradiusclient, but as far as I understood there's no difference in this section. Can someone enlighten me on the subj please? -- BR, Alex. This mail was sent via Mail-SeCure System.

2 12

HP dictionary update (HP-Capability-Advertisement)
by Arran Cudbard-Bell 26 Feb '10

26 Feb '10

Hi All, New attribute available in K.14. and T branch switches. Please see wiki for details (http://wiki.freeradius.org/HP#Capability_advertisements) These were really designed for the ProCurve HP IDM product, but they might still be useful in some environments. The encoding scheme isn't documented in any manuals but the attributes existence is. HP ProCurve is committed to interoperability and open standards, they just aren't always terribly good at documenting the technical aspects of their features. Cheers, Arran

2 2

question about 1.1.6 client code: rc_config_init()
by Adam Lewis 18 Feb '10

18 Feb '10

Hi, I'm currently trying to use the 1.1.6 client code to create an embedded client. Doing a code inspection of rc_config_init() in lib\config.c , the following code looks suspicious: SERVER *authservers; SERVER *acctservers; ..... ..... authservers = rc_conf_srv(rh, "authserver"); acctservers = rc_conf_srv(rh, "acctserver"); authservers = malloc(sizeof(SERVER)); acctservers = malloc(sizeof(SERVER)); I think it's trying to malloc space for server options in rh but this doesn't happen. The net result is that any subsequent configuration of authservers and acctservers in this function will be lost as soon as the function is exited. Likewise the mallocs can never be freed up. Have I understood this correctly? Not sure how fixes get put back into the code for the next release. If someone can let me know if there is a formal procedure, that would be great. Cheers, Adam. -- View this message in context: http://old.nabble.com/question-about-1.1.6-client-code%3A-rc_config_init%28… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

2 2

..::Juniper Accounting issue::..
by Alfonso Alejandro Reyes Jimenez 16 Feb '10

16 Feb '10

Hi Everyone. I'm writing to this list because I'm having issues with the accounting part on the radius server. The main idea is to log every command that we apply to the firewall. Right now we can log in to the device with different profiles but we are not logging the authentication time or the disconnection time. if we use the radius client (ntradping) we log everything. We have all the configuration setup on the firewall side but we are not sure if we are setting up everything on the radius. We are using the following values for the user: steve Cleartext-Password := "testing" NS-Admin-Privilege = 2, NAS-IP-Address = 192.168.1.1, NAS-Identifier = "Juniper" Are we missing something? Is it possible to log every command that we apply to the firewall? Any ideas? Thanks in advance for everything. Regards. Alfonso.

1 0

how to use mysql existing connection in c code
by Vijay Badola 15 Feb '10

15 Feb '10

Can I use mysql connection, created by server initially by reading sql.conf, from my own separate module to get sql query answer? pls tell me how to use it in C code from own separate module. , Regards Vijay

2 1

GIT Log for 2010-02-12 00:33 GMT
by aland＠deployingradius.com 11 Feb '10

11 Feb '10

commit 4545d8ecd41cd798efc2fd75d86826c4f0e3fd40 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 11 12:44:24 2010 +0100 Added sample CoA server Files changed: raddb/sites-available/coa | 43 +++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 43 insertions(+), 0 deletions(-) ====================================================================== commit d191c9da828bfd84660026ec38dac29d5b49ec08 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 11 10:38:20 2010 +0100 Make it consisent with the example in decoupled-accounting Files changed: raddb/sites-available/buffered-sql | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit dd81dc720694b59ac12cd5368470467df9b46f60 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 11 10:36:51 2010 +0100 As posted to the list Files changed: share/dictionary.patton | 25 +++++++++++++++++++++++++ 1 files changed, 25 insertions(+), 0 deletions(-) ====================================================================== commit 4422b0357c8e8e12a8e2e2254a279b9245ef1473 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 11 10:36:26 2010 +0100 Ran it through the formatter. Files changed: share/dictionary.patton | 196 +++++++++++++++++++++++----------------------- 1 files changed, 98 insertions(+), 98 deletions(-) ====================================================================== commit 359088a1c13a51c0f04eae63463a3f6762c8cb1d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 11 10:33:19 2010 +0100 Add more information to warning message Component && module, if a child thread is stuck for a long time. Files changed: src/main/event.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) ====================================================================== commit 11b86ed0082ea8c46c4b094cda81663e4d8d49fd Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 11 10:41:29 2010 +0100 Function returns no value Files changed: src/main/event.c | 2 -- 1 files changed, 0 insertions(+), 2 deletions(-) ====================================================================== commit 7b4b345cb246300633af3a5461478810f9affa2e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 11 10:32:20 2010 +0100 Quiet compiler warnings Files changed: src/lib/event.c | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-) ====================================================================== commit d6cc04ec5ec2eae5fcdc2f52683034b1715f2255 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 11 10:24:57 2010 +0100 Do waitpid() for ALL children, even if there are no threads waiting i.e. call radius_exec_program() 4 times for each packet, each with "nowait". The "reap_children" function is called ONCE per packet, and was calling waitpid() ONCE if there were no threads waiting for a child. This change makes it KEEP waiting until there are no more children to wait for. Files changed: src/main/threads.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) ======================================================================

1 0

buffer overflow in radiuslient
by Dmitry Goncharov 09 Feb '10

09 Feb '10

Hi, I opened two bug reports https://bugs.freeradius.org/bugzilla/show_bug.cgi?id=60 https://bugs.freeradius.org/bugzilla/show_bug.cgi?id=61 and provided patches. Please, have a look. BR, Dmitry

1 0

Wish list
by Account for FreeRadius mail list 07 Feb '10

07 Feb '10

Hello All, Well after doing a upgrade from ver 1.3 to 2.0 (Debian upgrade to Lenny) and much time spent I got this thing working as it should. In the proxy.conf file I found the thing that was causing me problems. It was a realm statement "notrealm" that caused that particular realm not to load. It would be real nice in the log file that it did not just say: "Info: Ready to process requests." but it told you that it could not load a particular realm because of an error. I know this can be kind of nit picking and don't get me wrong I very much appreciate what everyone has done for this code, but it would save a lot of time trying to figure out where "I" screwed up at. Thanks, Ken

2 1