May 2010 - Freeradius-Devel - lists.freeradius.org

Missing TLS Change Cipher Spec and TLS Finished in EAP-TLS exchanges
by arno＠natisbad.org 09 Jul '11

09 Jul '11

Hi, I upgraded an internal freeradius server (Linux, Debian unstable, libssl 0.9.8) used for EAP-TLS (802.11 WPA2 access) from 2.0.5 to 2.1.3. With 2.1.3, client authentication fails in the following way (wpasupplicant on Debian unstable, working with 2.0.5): - the TLS exchange is completed from freeradius point of view. It even sends the Access-Accept message to the NAS. - from the clients point of view, the TLS exchange is not over, it expects some more data from the server which are never sent. I took two pcap traces (sent to you privately, Alan), one with 2.0.5, one with 2.1.3. It looks like the TLS Change Cipher and TLS Tinished elements of the TLS exchange are not in the EAP encapsulated TLS packets sent by the server. Compare packet #23 of 2.1.3 trace with packet #27 of 2.0.5 trace. If you use wireshark, you will notice that the SSL layer is dissected; this is because #27 has a small brother: #29. It is not sent by 2.1.3. Alan, if you have an idea or a patch, I can test it on monday. Cheers, a+

5 15

eap2 in freeradius
by Chanthearith HUON 04 Apr '11

04 Apr '11

Hi everyone, I am testing eap2 in freeradius. I run "radiusd -X", I got following error message " radiusd: symbol lookup error: /usr/lib/rlm_eap2-2.1.0.so: undefined symbol: eap_server_register_methods " Anyone, have any idea what might be wrong with the configuration? Thank in advance, Thierry

5 10

Patch: avpair.c - empty reply VALUE_PAIR (0x0) for replies with unknown vendor attributes
by Stefan Karss 08 Jul '10

08 Jul '10

Hello again, when the RADIUS servers sends a reply packet with an attribute for an unknown vendor freeradius-client just skips over this when filling response VALUE_PAIR list. Unfortunately it doesn't for unknown attributes from known vendors - in that case rc_avpair_gen returns NULL in the first recursion which results in a NULL pointer for reply VALUE_PAIR. The attached patch just skips over unknown attributes for known vendors just like the lib skips over attributes from unknown vendors. Rgds, Stefan

4 13

Proposed patch for "embedded" freeradius-client library
by Scott Neugroschl 14 Jun '10

14 Jun '10

I'm working in a rather oddball environment, and have come up with a patch to allow freeradius-client 1.1.6 usage in an "embedded" environment -- without any config files at all. I started from the example radembedded.c and noted that it still needed a dictionary file. I have a patch to dict.c and freeradius-client.h to allow the dictionary data to be loaded from an in-memory table, instead of a disk file. If anyone is interested, I'll post the patch. Scott Neugroschl

2 3

EAP-AKA Question
by ziyen 31 May '10

31 May '10

Hi. FR2.1.X are support EAP-AKA? how can i get http://bugs.*freeradius*.org/show_bug.cgi?id=386'<http://bugs.freeradius.org/show_bug.cgi?id=386'><- EAP-AKA Patch(?) is't a loadmap support EAP-AKA? is't a another method support for EAP-AKA at FR2.1.9 version? Thanks..

2 1

Changes to "git"
by Alan DeKok 31 May '10

31 May '10

The code from the "master" branch is pretty much dead at this point. Therefore, I plan on: a) moving the code from "master" to an "old-dev" branch b) updating "master" to be the same as "stable" c) leaving "stable" alone, but no longer doing commits to it. The question is this: should I simply *replace* the "master" branch with "stable", or *merge* them? Merging them means that all checkouts of "master" will get the old deprecated code. Ugh. Replacing them means that everyone with a copy of the repository has to do a "force" update of their local "master" branch. This is annoying, but shouldn't be a problem because no one should be using the "master" branch. Any comments before I go poke the repository? Alan DeKok.

1 0

GIT Log for 2010-05-29 23:33 GMT
by aland＠deployingradius.com 29 May '10

29 May '10

commit ed4f13943644604343a6f5cc7737ca6e2fe2ecbf Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat May 29 11:34:57 2010 +0200 Print out DHCP attributes sent / received Files changed: src/modules/frs_dhcp/dhcp.c | 25 ++++++++++++------------- 1 files changed, 12 insertions(+), 13 deletions(-) ====================================================================== commit 880ddec8a950efb5452b1d88a7ffe78b2c53b2cb Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat May 29 11:26:56 2010 +0200 Fix endless loop when there are multiple DHCP options Files changed: src/modules/frs_dhcp/dhcp.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit b20e8fee17d2b7ce52ad0338c2d18faa06f9ef34 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon May 24 20:20:06 2010 +0200 Set line buf on stdout/err when logs go there This makes log messages appear more quickly. Files changed: src/main/radiusd.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) ======================================================================

1 0

freeradius-client-1.1.6 status
by Steve Dispensa 29 May '10

29 May '10

I see on freeradius.org that freeradius-client-1.1.6 seems to the current version, and it looks like the project is actively maintained. I ran into a few problems using it and fixed several bugs, so if indeed it's still your maintained and recommended solution for integrating radius client functionality into a third-party app, well, I have a patch for you if you're interested. Where should I send it? Thanks. -Steve

2 1

GIT Log for 2010-05-24 23:33 GMT
by aland＠deployingradius.com 24 May '10

24 May '10

commit 6c1cca16343afc516ec3ac8376e89035e906b48d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon May 24 07:35:31 2010 +0200 If an integer is surrounded by whitespace, it's still an integer Files changed: src/lib/valuepair.c | 16 +++++++++++++++- 1 files changed, 15 insertions(+), 1 deletions(-) ====================================================================== commit 318a040a491b1d9fd7122016b1c0d38fa8d371db Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu May 20 17:40:32 2010 +0200 Fix template documentation Files changed: raddb/templates.conf | 8 ++++++-- 1 files changed, 6 insertions(+), 2 deletions(-) ====================================================================== commit acd2bbd8b397426841d608b9f16699523abe52de Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu May 20 15:25:51 2010 +0200 No longer needed Files changed: redhat/rc.radiusd-redhat | 80 ---------------------------------------------- 1 files changed, 0 insertions(+), 80 deletions(-) ====================================================================== commit c30242f1c5343c80c69d2b9d32a5fb7caa567f46 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu May 20 15:25:22 2010 +0200 Do cert configuration stuff Taken from Redhat Files changed: redhat/freeradius-cert-config.patch | 68 +++++++++++++++++++++++++++++++++++ 1 files changed, 68 insertions(+), 0 deletions(-) ======================================================================

1 0

Proposed patch for "embedded" use.
by Scott Neugroschl 20 May '10

20 May '10

I'm working in a rather oddball environment, and have come up with a patch to allow freeradius-client 1.1.6 usage in an "embedded" environment -- without any config files at all. I started from the example radembedded.c and noted that it still needed a dictionary file. I have a patch to dict.c and freeradius-client.h to allow the dictionary data to be loaded from an in-memory table, instead of a disk file. If anyone is interested, I'll post the patch.

1 0