March 2010 - Freeradius-Devel - lists.freeradius.org

Missing TLS Change Cipher Spec and TLS Finished in EAP-TLS exchanges
by arno＠natisbad.org 09 Jul '11

09 Jul '11

Hi, I upgraded an internal freeradius server (Linux, Debian unstable, libssl 0.9.8) used for EAP-TLS (802.11 WPA2 access) from 2.0.5 to 2.1.3. With 2.1.3, client authentication fails in the following way (wpasupplicant on Debian unstable, working with 2.0.5): - the TLS exchange is completed from freeradius point of view. It even sends the Access-Accept message to the NAS. - from the clients point of view, the TLS exchange is not over, it expects some more data from the server which are never sent. I took two pcap traces (sent to you privately, Alan), one with 2.0.5, one with 2.1.3. It looks like the TLS Change Cipher and TLS Tinished elements of the TLS exchange are not in the EAP encapsulated TLS packets sent by the server. Compare packet #23 of 2.1.3 trace with packet #27 of 2.0.5 trace. If you use wireshark, you will notice that the SSL layer is dissected; this is because #27 has a small brother: #29. It is not sent by 2.1.3. Alan, if you have an idea or a patch, I can test it on monday. Cheers, a+

5 15

eap2 in freeradius
by Chanthearith HUON 04 Apr '11

04 Apr '11

Hi everyone, I am testing eap2 in freeradius. I run "radiusd -X", I got following error message " radiusd: symbol lookup error: /usr/lib/rlm_eap2-2.1.0.so: undefined symbol: eap_server_register_methods " Anyone, have any idea what might be wrong with the configuration? Thank in advance, Thierry

5 10

GIT Log for 2010-03-31 23:33 GMT
by aland＠deployingradius.com 31 Mar '10

31 Mar '10

commit 3a8838362791f2e88bc1dd5b30b83bb7cc721079 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Mar 31 16:19:28 2010 +0200 Catch corner case of update disconnect in post-auth If we proxy packets, we don't want to send disconnect, too Files changed: src/main/event.c | 22 +++++++++++++++++++--- 1 files changed, 19 insertions(+), 3 deletions(-) ====================================================================== commit a273da9e8673ba8a8527551435b89b0c53c4f2a8 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Mar 31 15:33:19 2010 +0200 Fixed typo Files changed: src/modules/rlm_eap/types/Makefile | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 5db4baf9eaf747de083835839ff6e53af830bc34 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Mar 31 15:06:52 2010 +0200 Correct realm regex examples, and creation of REALM for them The old examples were wrong. The old code created the Realm attribute with value of the regex... rather than the actual realm name. Closes bug #40 Files changed: raddb/proxy.conf | 18 ++++++++---------- src/modules/rlm_realm/rlm_realm.c | 10 ++++++++-- 2 files changed, 16 insertions(+), 12 deletions(-) ====================================================================== commit 151377eadebf9d7cae8055a87d96a50323d4c1df Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Mar 31 11:32:38 2010 +0200 Allow the "server" field to be blank People run into "" != NULL Files changed: src/modules/rlm_sql/rlm_sql.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 34dfa5058917816110a510927dbceca1619358fa Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Mar 31 11:25:08 2010 +0200 Made 'reconfig' target use PHONY subdirectories, too And added reconfig targets all over the place. This means that we can do "make reconfig" from (almost) anywhere, and have it work. Files changed: src/include/Makefile | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) ====================================================================== commit ddc27ce6718618c7ffc6f2dab053cef6b72432c7 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Mar 31 11:25:08 2010 +0200 Made 'reconfig' target use PHONY subdirectories, too And added reconfig targets all over the place. This means that we can do "make reconfig" from (almost) anywhere, and have it work. Files changed: Makefile | 5 ++- src/Makefile | 6 +++- src/include/Makefile | 2 + src/lib/Makefile | 3 ++ src/main/Makefile.in | 3 ++ src/modules/Makefile | 51 +++++++++++++++++++------------ src/modules/rlm_eap/Makefile.in | 4 +- src/modules/rlm_eap/types/Makefile | 4 +- src/modules/rlm_sql/Makefile.in | 4 +- src/modules/rlm_sql/drivers/Makefile.in | 4 +- 10 files changed, 55 insertions(+), 31 deletions(-) ====================================================================== commit 9958c3f6e053f64eda6902390c654ff5ee457314 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Mar 31 10:55:39 2010 +0200 Move to using phony targets for subdirectories Files changed: src/modules/rlm_sql/Makefile.in | 12 +++++++----- src/modules/rlm_sql/drivers/Makefile.in | 15 +++++++++------ 2 files changed, 16 insertions(+), 11 deletions(-) ======================================================================

1 0

GIT Log for 2010-03-30 23:33 GMT
by aland＠deployingradius.com 30 Mar '10

30 Mar '10

commit 2b596fc715c0948e3cbe6642f58d9f3678f0b945 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Mar 30 16:13:03 2010 +0200 Minor change to error output for clarity Files changed: src/main/modules.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 3077b3e3a91a096fd13663780151ea349fbf2bcf Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Mar 30 16:12:06 2010 +0200 Re-open log file after HUP. This should have been committed in 6563dac620f, but was missed for some reason. Files changed: src/main/log.c | 143 +++++++++---------------------------------------------- 1 files changed, 24 insertions(+), 119 deletions(-) ====================================================================== commit 6c6e719cc247ba90a111768ef01f6b8eafa1b343 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Mar 30 16:06:15 2010 +0200 Revert "= NULL" checks. They should be "IS NULL" Files changed: raddb/sql/mysql/ippool.conf | 12 ++++++------ 1 files changed, 6 insertions(+), 6 deletions(-) ====================================================================== commit fc12c44773806dcb0640ca864f13cefe2295d391 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Mar 30 16:04:23 2010 +0200 Move to using phony targets for subdirectories. This removes the explicit shell loop over subdirs, which means that the main "make" program now tracks all dependencies. I've also updated some dependencies to be correct. Now "make -j 4" will work. Files changed: Makefile | 12 +++++++----- src/Makefile | 12 +++++++----- src/modules/Makefile | 17 ++++++++++------- src/modules/rlm_eap/Makefile.in | 19 +++++++++++-------- src/modules/rlm_eap/types/Makefile | 23 ++++++++++++++++------- 5 files changed, 51 insertions(+), 32 deletions(-) ======================================================================

1 0

Is that a bug of event?
by zhongwei feng 30 Mar '10

30 Mar '10

hi, all: Oracle database , 20000 users, and Simultaneous-Use := 1 ; but simul_verify_query is not enough fast ... (I have tow BAS, load-balance, some users fast switch between both...) [radius@RADSERVER1 radius]$ gdb radiusd -f core.27318 . . . Reading symbols from /usr/local/lib/rlm_detail-2.1.8.so...done. Loaded symbols for /usr/local/lib/rlm_detail-2.1.8.so #0 request_pre_handler (request=0x2a98f39310) at event.c:1763 /home/radius/fzw/freeradius-server-2.1.8/src/main/event.c:1763:44023:beg:0x420e66 (gdb)

2 1

freeradius-client "radius_timeout" and freeradius-client vs freeradius-server
by Stefan Karss 24 Mar '10

24 Mar '10

Hello list, during development of a radius test client using freeradius-client library I stumbled across line 317 in sendserver.c from CVS HEAD: result = poll(&pfd, 1, timeout * 1000000); This line came with revision 1.26 where select() was rewritten with poll(). The timeout value for poll however is in milliseconds not in microseconds so that timeout will be 1000 times higher than configured in the radiusclient.conf. As the bug seems to be in the code since November 2008 I wonder if freeradius-client is the right way to go for a radius client or if one should use the freeradius-server libraries to build a client? Or is the right way to go the 1.1.6 release downloadable on the homepage - unfortunately this release does not have the patches from Alex Massover regarding seqfile and thread safety. Rgds, Stefan

3 4

authserver round robin and multiple NAS-IP-Address avpairs
by Stefan Karss 24 Mar '10

24 Mar '10

Hello, when configuring round-robin authservers in sendserver.c function "rc_send_server" the NAS-IP-Address gets added for each fail-overed server resulting in the NAS-IP-Address avpair being sent multiple times. I fixed it by checking for presence of NAS-IP-Address avpair (see patch). Rgds, Stefan

2 1

radiusclient minor memleak
by Alex Massover 21 Mar '10

21 Mar '10

Hi, If secret string is defined in radiusclient.conf like following: acctserver localhost:1646:mysecret (and not in 'servers' file - which btw is better way because 'servers' file is rereaded for every request), it leaks, because serv->secret is never freed. -- Best Regards, Alex Massover VoIP R&D TL Jajah Inc. This mail was sent via Mail-SeCure System.

1 0

freeradius-client wrapping gethostby*
by Alex Massover 17 Mar '10

17 Mar '10

Hi, In freeradius-client gethostby* is wrapped in order to be thread-safe. But imho it's done in wrong way causing gethostby* to malfunction. In lib/ip_util.c: _______________________________________________ size_t hostbuflen; char *tmphostbuf; int res; int herr; hostbuflen = 1024; tmphostbuf = malloc(hostbuflen); #endif #endif #ifdef GETHOSTBYNAME_R #if defined (GETHOSTBYNAMERSTYLE_GNU) while ((res = gethostbyname_r(hostname, &hostbuf, tmphostbuf, hostbuflen, &hp, &herr)) == ERANGE) { /* Enlarge the buffer */ hostbuflen *= 2; tmphostbuf = realloc(tmphostbuf, hostbuflen); } free(tmphostbuf); _______________________________________________ Afaik if tmphostbuf is freed the data is gone. The easiest way to fix it which I can think of is thread local storage (TLS), please see the patch. -- Best Regards, Alex Massover VoIP R&D TL Jajah Inc. This mail was sent via Mail-SeCure System.

2 2

radiusd died with an ASSERT in thread.c
by Hermann Lauer 17 Mar '10

17 Mar '10

Hello all, after running for a month or so one of my freeradius (2.1.8 with my latest vmps patch on debian lenny sparc) server died with an ASSERT in threads.c after logging a bunch of the appended messages. Is this somehow known or should I provide the complete config or something else ? For the moment I reduced the load of vqp queries to this server. Thanks for any help, Hermann ...about 40 of those omitted... Feb 3 17:30:27 femto freeradius[13978]: Discarding duplicate request from client sp4 port 55770 - ID: 91766 due to unfinished request 13802 Feb 3 17:30:27 femto freeradius[13978]: Discarding duplicate request from client sp4 port 55770 - ID: 91767 due to unfinished request 13803 Feb 3 17:30:27 femto freeradius[13978]: Discarding duplicate request from client sp4 port 55770 - ID: 91768 due to unfinished request 13804 Feb 3 17:30:27 femto freeradius[13978]: Discarding duplicate request from client sp4 port 55770 - ID: 91769 due to unfinished request 13805 Feb 3 17:30:27 femto freeradius[13978]: Discarding duplicate request from client sp4 port 55770 - ID: 91770 due to unfinished request 13806 Feb 3 17:30:27 femto freeradius[13978]: Discarding duplicate request from client sp4 port 55770 - ID: 91771 due to unfinished request 13807 Feb 3 17:30:27 femto freeradius[13978]: Discarding duplicate request from client sp4 port 55770 - ID: 91772 due to unfinished request 13808 Feb 3 17:33:38 femto freeradius[13978]: Discarding duplicate request from client sp4 port 52864 - ID: 26294 due to unfinished request 13809 Feb 3 17:33:39 femto freeradius[13978]: Discarding duplicate request from client sp4 port 52864 - ID: 26294 due to unfinished request 13809 Feb 3 17:33:40 femto freeradius[13978]: Discarding duplicate request from client sp4 port 52864 - ID: 26294 due to unfinished request 13809 Feb 3 17:35:28 femto freeradius[13978]: ASSERT FAILED threads.c[406]: (*request)->magic == REQUEST_MAGIC P.S.: Posted this accindentely 2 times to the users list where it's probably still waiting for approval, those can be deleted -- Netzwerkadministration/Zentrale Dienste, Interdiziplinaeres Zentrum fuer wissenschaftliches Rechnen der Universitaet Heidelberg IWR; INF 368; 69120 Heidelberg; Tel: (06221)54-8236 Fax: -5224 Email: Hermann.Lauer(a)iwr.uni-heidelberg.de

2 1

how to add vendor-specific h323-conf-id
by Tihomir Culjaga 11 Mar '10

11 Mar '10

hello, maybe it is a stupid question but i cannot figure that out.... i need to add h323-conf-id and i'm doing it like this but it keeps failing. if (rc_avpair_add(rh, &send, 24, "12345678-12345678-12345678", -1, 9) == NULL){ printf("An Error occured during rc_avpair_add : VSA h323-conf-id\n"); result = ERROR_RC; break; } I've added an $INCLUDE dictionary.cisco to the end of the default freeradius dictionary so the attribute should be known .. but still .. same problem Please, can someone help ?

1 0

GIT Log for 2010-03-10 00:33 GMT
by aland＠deployingradius.com 10 Mar '10

10 Mar '10

commit fc069010ffcc189e141d70f9f3a6b62b4394bd20 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Mar 9 10:12:01 2010 +0100 Check for closed sockets. This allows the module to continue if the DB suddenly disappears src/modules/rlm_sql/sql.c | 20 +++++++++++--------- 1 files changed, 11 insertions(+), 9 deletions(-)

1 0

a patch about rlm_sql
by zhongwei feng 09 Mar '10

09 Mar '10

hi, all: When radiusd is running, shutdown the oracle server, then occur "segment fail". [root@RADSERVER1 rlm_sql]# diff -u sql.c.orig sql.c --- sql.c.orig 2010-03-09 14:49:01.000000000 +0800 +++ sql.c 2010-03-09 14:49:48.000000000 +0800 @@ -507,7 +507,7 @@ /* * If there's no query, return an error. */ - if (!query || !*query) { + if (!query || !*query || !sqlsocket || !sqlsocket->conn) { return -1; } @@ -552,7 +552,7 @@ /* * If there's no query, return an error. */ - if (!query || !*query) { + if (!query || !*query || !sqlsocket || !sqlsocket->conn) { return -1; } 　

2 1

GIT Log for 2010-03-07 00:33 GMT
by aland＠deployingradius.com 07 Mar '10

07 Mar '10

commit f26f41c0ee6c562200f4aedbe55bdf083a36bb1b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Mar 6 15:45:08 2010 +0100 Allow IPv6 to bind to interface with scope. A follow-on to the previous patch. Files changed: src/main/listen.c | 52 +++++++++++++++++++++++++++++++++++++++++++--------- 1 files changed, 43 insertions(+), 9 deletions(-) ====================================================================== commit 5b1ad1b0d1314c00499833126943f53aa36318a7 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Mar 6 14:26:27 2010 +0100 Add IPv6 "scope" for link-local addresses. Added to fr_ipaddr_t. fr_ipaddr_cmp(), fr_sockaddr2ipaddr(), fr_ipaddr2sockaddr(). Also made ip_hton() call fr_sockaddr2ipaddr() to prevent code duplication. Files changed: src/include/libradius.h | 1 + src/lib/misc.c | 59 ++++++++++++++++++++--------------------------- 2 files changed, 26 insertions(+), 34 deletions(-) ====================================================================== commit 882a4146bd8ed61b1d2044e53744678c209e7343 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Mar 6 12:40:23 2010 +0100 Check for AF_INET6, not HAVE_AF_INET6 HAVE_AF_INET6 isn't defined, AF_INET6 is. Files changed: src/lib/udpfromto.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit b3a5a8a4dcd123c5b1f926599c5a2cadb08eee11 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Mar 6 12:13:54 2010 +0100 Work around implementation-dependent shift results uint32 foo = ~0; foo <<= 32; Q: what's foo? A: undefined. Files changed: src/main/client.c | 13 +++++++++---- 1 files changed, 9 insertions(+), 4 deletions(-) ====================================================================== commit 37c5fd7964811f39ba366f80947226dadb5b5a5e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Mar 6 11:03:33 2010 +0100 Calculate IPv6 netmask correctly. Closes bug #69 Files changed: src/main/client.c | 26 ++++++++++++++++++++------ 1 files changed, 20 insertions(+), 6 deletions(-) ====================================================================== commit 4d849cc53763e28972ecddea79afed016968d6fc Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Mar 6 08:48:06 2010 +0100 Receive CoA packets when they have been separated from parents Otherwise, the code thinks that there is a proxy reply WITHOUT an original reply.. There's still likely a bug, as the CoA request->reply is built BEFORE the original->reply. The post-proxy CoA work should very likely have complete access to the original reply packet type Files changed: src/main/event.c | 12 ++++++++++++ 1 files changed, 12 insertions(+), 0 deletions(-) ====================================================================== commit c8a5624e1f5ea71b564f626337c56b8cfd86a775 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Feb 26 11:11:02 2010 +0100 Clean up log file handling. Fixes bug #63 We now open the log file from the option parsing (-l file) OR in mainconfig.c. That way, the code in log.c can assume that there is ALWAYS a log file, and it doesn't need to open one. This simplifies log.c substantially. We also moved the syslog "openlog" code from log.c to mainconfig.c This again makes it simpler. On HUP, the hup_mainconfig() function takes care of re-opening the log file. This is so that the log.c functions don't have to do it. Files changed: src/main/event.c | 12 ++----- src/main/mainconfig.c | 82 ++++++++++++++++++++++++++++++++++++++++++------ src/main/radiusd.c | 7 +++- 3 files changed, 80 insertions(+), 21 deletions(-) ====================================================================== commit 9a6edfe42404bb0532a24927cb20180444fd42d0 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Feb 26 10:31:59 2010 +0100 As posted to the list Files changed: share/dictionary.hp | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) ====================================================================== commit 243f3497ed43ba8b3a2ad340c5a3a1e25b03be9b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Feb 16 17:47:27 2010 +0100 Switch default for acct realms to "no_response_fail" Since accounting packets aren't re-tried, failing one packet over from one server to another isn't a good idea. Files changed: src/main/realms.c | 16 ++++++++++++++++ 1 files changed, 16 insertions(+), 0 deletions(-) ======================================================================

1 0

radiusclient thread-safety
by Alex Massover 02 Mar '10

02 Mar '10

Hello, I'm using radiusclient lib from multithreaded application, by having a "static rc_handle *rh" and calling rc_auth() from different threads. Everything works until 2 (or more) threads enter rc_auth() before the previous one finished. But 2 concurrent threads enough to corrupt everything, I'm starting to get "received invalid reply digest..." followed by "no reply from RADIUS server" for subsequent calls. I changed rc_check_reply() to return OK at the beginning, it eliminated "received invalid reply", but I still get "no reply from RADIUS server ...". In wireshark trace it looks like there's no problems with responses, every request receives response (and before timeout should happen). It looks like something logical, shared or static buffer maybe. I'm looking in the code and can't find the problem :( I changed localtime to localtime_r, gmtime to gmtime_r, rand to rand_r, but still have a problem. In the trace: ->request <-response ->request <-response Works well, but looks like enough to have: ->request ->request <-response <-response To cause most of (not every) following subsequent request to get "no reply..." although there're responses in the trace. Also my distro has old radiusclient-ng and not freeradiusclient, but as far as I understood there's no difference in this section. Can someone enlighten me on the subj please? -- BR, Alex. This mail was sent via Mail-SeCure System.

2 12