March 2010 - Freeradius-Devel - lists.freeradius.org

Missing TLS Change Cipher Spec and TLS Finished in EAP-TLS exchanges
by arno＠natisbad.org 09 Jul '11

09 Jul '11

Hi, I upgraded an internal freeradius server (Linux, Debian unstable, libssl 0.9.8) used for EAP-TLS (802.11 WPA2 access) from 2.0.5 to 2.1.3. With 2.1.3, client authentication fails in the following way (wpasupplicant on Debian unstable, working with 2.0.5): - the TLS exchange is completed from freeradius point of view. It even sends the Access-Accept message to the NAS. - from the clients point of view, the TLS exchange is not over, it expects some more data from the server which are never sent. I took two pcap traces (sent to you privately, Alan), one with 2.0.5, one with 2.1.3. It looks like the TLS Change Cipher and TLS Tinished elements of the TLS exchange are not in the EAP encapsulated TLS packets sent by the server. Compare packet #23 of 2.1.3 trace with packet #27 of 2.0.5 trace. If you use wireshark, you will notice that the SSL layer is dissected; this is because #27 has a small brother: #29. It is not sent by 2.1.3. Alan, if you have an idea or a patch, I can test it on monday. Cheers, a+

5 15

eap2 in freeradius
by Chanthearith HUON 04 Apr '11

04 Apr '11

Hi everyone, I am testing eap2 in freeradius. I run "radiusd -X", I got following error message " radiusd: symbol lookup error: /usr/lib/rlm_eap2-2.1.0.so: undefined symbol: eap_server_register_methods " Anyone, have any idea what might be wrong with the configuration? Thank in advance, Thierry

5 10

GIT Log for 2010-03-31 23:33 GMT
by aland＠deployingradius.com 31 Mar '10

31 Mar '10

commit 3a8838362791f2e88bc1dd5b30b83bb7cc721079 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Mar 31 16:19:28 2010 +0200 Catch corner case of update disconnect in post-auth If we proxy packets, we don't want to send disconnect, too Files changed: src/main/event.c | 22 +++++++++++++++++++--- 1 files changed, 19 insertions(+), 3 deletions(-) ====================================================================== commit a273da9e8673ba8a8527551435b89b0c53c4f2a8 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Mar 31 15:33:19 2010 +0200 Fixed typo Files changed: src/modules/rlm_eap/types/Makefile | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 5db4baf9eaf747de083835839ff6e53af830bc34 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Mar 31 15:06:52 2010 +0200 Correct realm regex examples, and creation of REALM for them The old examples were wrong. The old code created the Realm attribute with value of the regex... rather than the actual realm name. Closes bug #40 Files changed: raddb/proxy.conf | 18 ++++++++---------- src/modules/rlm_realm/rlm_realm.c | 10 ++++++++-- 2 files changed, 16 insertions(+), 12 deletions(-) ====================================================================== commit 151377eadebf9d7cae8055a87d96a50323d4c1df Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Mar 31 11:32:38 2010 +0200 Allow the "server" field to be blank People run into "" != NULL Files changed: src/modules/rlm_sql/rlm_sql.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 34dfa5058917816110a510927dbceca1619358fa Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Mar 31 11:25:08 2010 +0200 Made 'reconfig' target use PHONY subdirectories, too And added reconfig targets all over the place. This means that we can do "make reconfig" from (almost) anywhere, and have it work. Files changed: src/include/Makefile | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) ====================================================================== commit ddc27ce6718618c7ffc6f2dab053cef6b72432c7 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Mar 31 11:25:08 2010 +0200 Made 'reconfig' target use PHONY subdirectories, too And added reconfig targets all over the place. This means that we can do "make reconfig" from (almost) anywhere, and have it work. Files changed: Makefile | 5 ++- src/Makefile | 6 +++- src/include/Makefile | 2 + src/lib/Makefile | 3 ++ src/main/Makefile.in | 3 ++ src/modules/Makefile | 51 +++++++++++++++++++------------ src/modules/rlm_eap/Makefile.in | 4 +- src/modules/rlm_eap/types/Makefile | 4 +- src/modules/rlm_sql/Makefile.in | 4 +- src/modules/rlm_sql/drivers/Makefile.in | 4 +- 10 files changed, 55 insertions(+), 31 deletions(-) ====================================================================== commit 9958c3f6e053f64eda6902390c654ff5ee457314 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Mar 31 10:55:39 2010 +0200 Move to using phony targets for subdirectories Files changed: src/modules/rlm_sql/Makefile.in | 12 +++++++----- src/modules/rlm_sql/drivers/Makefile.in | 15 +++++++++------ 2 files changed, 16 insertions(+), 11 deletions(-) ======================================================================

1 0

GIT Log for 2010-03-30 23:33 GMT
by aland＠deployingradius.com 30 Mar '10

30 Mar '10

commit 2b596fc715c0948e3cbe6642f58d9f3678f0b945 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Mar 30 16:13:03 2010 +0200 Minor change to error output for clarity Files changed: src/main/modules.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 3077b3e3a91a096fd13663780151ea349fbf2bcf Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Mar 30 16:12:06 2010 +0200 Re-open log file after HUP. This should have been committed in 6563dac620f, but was missed for some reason. Files changed: src/main/log.c | 143 +++++++++---------------------------------------------- 1 files changed, 24 insertions(+), 119 deletions(-) ====================================================================== commit 6c6e719cc247ba90a111768ef01f6b8eafa1b343 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Mar 30 16:06:15 2010 +0200 Revert "= NULL" checks. They should be "IS NULL" Files changed: raddb/sql/mysql/ippool.conf | 12 ++++++------ 1 files changed, 6 insertions(+), 6 deletions(-) ====================================================================== commit fc12c44773806dcb0640ca864f13cefe2295d391 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Mar 30 16:04:23 2010 +0200 Move to using phony targets for subdirectories. This removes the explicit shell loop over subdirs, which means that the main "make" program now tracks all dependencies. I've also updated some dependencies to be correct. Now "make -j 4" will work. Files changed: Makefile | 12 +++++++----- src/Makefile | 12 +++++++----- src/modules/Makefile | 17 ++++++++++------- src/modules/rlm_eap/Makefile.in | 19 +++++++++++-------- src/modules/rlm_eap/types/Makefile | 23 ++++++++++++++++------- 5 files changed, 51 insertions(+), 32 deletions(-) ======================================================================

1 0

Is that a bug of event?
by zhongwei feng 30 Mar '10

30 Mar '10

hi, all: Oracle database , 20000 users, and Simultaneous-Use := 1 ; but simul_verify_query is not enough fast ... (I have tow BAS, load-balance, some users fast switch between both...) [radius@RADSERVER1 radius]$ gdb radiusd -f core.27318 . . . Reading symbols from /usr/local/lib/rlm_detail-2.1.8.so...done. Loaded symbols for /usr/local/lib/rlm_detail-2.1.8.so #0 request_pre_handler (request=0x2a98f39310) at event.c:1763 /home/radius/fzw/freeradius-server-2.1.8/src/main/event.c:1763:44023:beg:0x420e66 (gdb)

2 1

freeradius-client "radius_timeout" and freeradius-client vs freeradius-server
by Stefan Karss 24 Mar '10

24 Mar '10

Hello list, during development of a radius test client using freeradius-client library I stumbled across line 317 in sendserver.c from CVS HEAD: result = poll(&pfd, 1, timeout * 1000000); This line came with revision 1.26 where select() was rewritten with poll(). The timeout value for poll however is in milliseconds not in microseconds so that timeout will be 1000 times higher than configured in the radiusclient.conf. As the bug seems to be in the code since November 2008 I wonder if freeradius-client is the right way to go for a radius client or if one should use the freeradius-server libraries to build a client? Or is the right way to go the 1.1.6 release downloadable on the homepage - unfortunately this release does not have the patches from Alex Massover regarding seqfile and thread safety. Rgds, Stefan

3 4

authserver round robin and multiple NAS-IP-Address avpairs
by Stefan Karss 24 Mar '10

24 Mar '10

Hello, when configuring round-robin authservers in sendserver.c function "rc_send_server" the NAS-IP-Address gets added for each fail-overed server resulting in the NAS-IP-Address avpair being sent multiple times. I fixed it by checking for presence of NAS-IP-Address avpair (see patch). Rgds, Stefan

2 1

radiusclient minor memleak
by Alex Massover 21 Mar '10

21 Mar '10

Hi, If secret string is defined in radiusclient.conf like following: acctserver localhost:1646:mysecret (and not in 'servers' file - which btw is better way because 'servers' file is rereaded for every request), it leaks, because serv->secret is never freed. -- Best Regards, Alex Massover VoIP R&D TL Jajah Inc. This mail was sent via Mail-SeCure System.

1 0

freeradius-client wrapping gethostby*
by Alex Massover 17 Mar '10

17 Mar '10

Hi, In freeradius-client gethostby* is wrapped in order to be thread-safe. But imho it's done in wrong way causing gethostby* to malfunction. In lib/ip_util.c: _______________________________________________ size_t hostbuflen; char *tmphostbuf; int res; int herr; hostbuflen = 1024; tmphostbuf = malloc(hostbuflen); #endif #endif #ifdef GETHOSTBYNAME_R #if defined (GETHOSTBYNAMERSTYLE_GNU) while ((res = gethostbyname_r(hostname, &hostbuf, tmphostbuf, hostbuflen, &hp, &herr)) == ERANGE) { /* Enlarge the buffer */ hostbuflen *= 2; tmphostbuf = realloc(tmphostbuf, hostbuflen); } free(tmphostbuf); _______________________________________________ Afaik if tmphostbuf is freed the data is gone. The easiest way to fix it which I can think of is thread local storage (TLS), please see the patch. -- Best Regards, Alex Massover VoIP R&D TL Jajah Inc. This mail was sent via Mail-SeCure System.

2 2

radiusd died with an ASSERT in thread.c
by Hermann Lauer 17 Mar '10

17 Mar '10

Hello all, after running for a month or so one of my freeradius (2.1.8 with my latest vmps patch on debian lenny sparc) server died with an ASSERT in threads.c after logging a bunch of the appended messages. Is this somehow known or should I provide the complete config or something else ? For the moment I reduced the load of vqp queries to this server. Thanks for any help, Hermann ...about 40 of those omitted... Feb 3 17:30:27 femto freeradius[13978]: Discarding duplicate request from client sp4 port 55770 - ID: 91766 due to unfinished request 13802 Feb 3 17:30:27 femto freeradius[13978]: Discarding duplicate request from client sp4 port 55770 - ID: 91767 due to unfinished request 13803 Feb 3 17:30:27 femto freeradius[13978]: Discarding duplicate request from client sp4 port 55770 - ID: 91768 due to unfinished request 13804 Feb 3 17:30:27 femto freeradius[13978]: Discarding duplicate request from client sp4 port 55770 - ID: 91769 due to unfinished request 13805 Feb 3 17:30:27 femto freeradius[13978]: Discarding duplicate request from client sp4 port 55770 - ID: 91770 due to unfinished request 13806 Feb 3 17:30:27 femto freeradius[13978]: Discarding duplicate request from client sp4 port 55770 - ID: 91771 due to unfinished request 13807 Feb 3 17:30:27 femto freeradius[13978]: Discarding duplicate request from client sp4 port 55770 - ID: 91772 due to unfinished request 13808 Feb 3 17:33:38 femto freeradius[13978]: Discarding duplicate request from client sp4 port 52864 - ID: 26294 due to unfinished request 13809 Feb 3 17:33:39 femto freeradius[13978]: Discarding duplicate request from client sp4 port 52864 - ID: 26294 due to unfinished request 13809 Feb 3 17:33:40 femto freeradius[13978]: Discarding duplicate request from client sp4 port 52864 - ID: 26294 due to unfinished request 13809 Feb 3 17:35:28 femto freeradius[13978]: ASSERT FAILED threads.c[406]: (*request)->magic == REQUEST_MAGIC P.S.: Posted this accindentely 2 times to the users list where it's probably still waiting for approval, those can be deleted -- Netzwerkadministration/Zentrale Dienste, Interdiziplinaeres Zentrum fuer wissenschaftliches Rechnen der Universitaet Heidelberg IWR; INF 368; 69120 Heidelberg; Tel: (06221)54-8236 Fax: -5224 Email: Hermann.Lauer(a)iwr.uni-heidelberg.de

2 1