May 2010 - Freeradius-Devel - lists.freeradius.org

Missing TLS Change Cipher Spec and TLS Finished in EAP-TLS exchanges
by arno＠natisbad.org 09 Jul '11

09 Jul '11

Hi, I upgraded an internal freeradius server (Linux, Debian unstable, libssl 0.9.8) used for EAP-TLS (802.11 WPA2 access) from 2.0.5 to 2.1.3. With 2.1.3, client authentication fails in the following way (wpasupplicant on Debian unstable, working with 2.0.5): - the TLS exchange is completed from freeradius point of view. It even sends the Access-Accept message to the NAS. - from the clients point of view, the TLS exchange is not over, it expects some more data from the server which are never sent. I took two pcap traces (sent to you privately, Alan), one with 2.0.5, one with 2.1.3. It looks like the TLS Change Cipher and TLS Tinished elements of the TLS exchange are not in the EAP encapsulated TLS packets sent by the server. Compare packet #23 of 2.1.3 trace with packet #27 of 2.0.5 trace. If you use wireshark, you will notice that the SSL layer is dissected; this is because #27 has a small brother: #29. It is not sent by 2.1.3. Alan, if you have an idea or a patch, I can test it on monday. Cheers, a+

5 15

eap2 in freeradius
by Chanthearith HUON 04 Apr '11

04 Apr '11

Hi everyone, I am testing eap2 in freeradius. I run "radiusd -X", I got following error message " radiusd: symbol lookup error: /usr/lib/rlm_eap2-2.1.0.so: undefined symbol: eap_server_register_methods " Anyone, have any idea what might be wrong with the configuration? Thank in advance, Thierry

5 10

Patch: avpair.c - empty reply VALUE_PAIR (0x0) for replies with unknown vendor attributes
by Stefan Karss 08 Jul '10

08 Jul '10

Hello again, when the RADIUS servers sends a reply packet with an attribute for an unknown vendor freeradius-client just skips over this when filling response VALUE_PAIR list. Unfortunately it doesn't for unknown attributes from known vendors - in that case rc_avpair_gen returns NULL in the first recursion which results in a NULL pointer for reply VALUE_PAIR. The attached patch just skips over unknown attributes for known vendors just like the lib skips over attributes from unknown vendors. Rgds, Stefan

4 13

Proposed patch for "embedded" freeradius-client library
by Scott Neugroschl 14 Jun '10

14 Jun '10

I'm working in a rather oddball environment, and have come up with a patch to allow freeradius-client 1.1.6 usage in an "embedded" environment -- without any config files at all. I started from the example radembedded.c and noted that it still needed a dictionary file. I have a patch to dict.c and freeradius-client.h to allow the dictionary data to be loaded from an in-memory table, instead of a disk file. If anyone is interested, I'll post the patch. Scott Neugroschl

2 3

EAP-AKA Question
by ziyen 31 May '10

31 May '10

Hi. FR2.1.X are support EAP-AKA? how can i get http://bugs.*freeradius*.org/show_bug.cgi?id=386'<http://bugs.freeradius.org/show_bug.cgi?id=386'><- EAP-AKA Patch(?) is't a loadmap support EAP-AKA? is't a another method support for EAP-AKA at FR2.1.9 version? Thanks..

2 1

Changes to "git"
by Alan DeKok 31 May '10

31 May '10

The code from the "master" branch is pretty much dead at this point. Therefore, I plan on: a) moving the code from "master" to an "old-dev" branch b) updating "master" to be the same as "stable" c) leaving "stable" alone, but no longer doing commits to it. The question is this: should I simply *replace* the "master" branch with "stable", or *merge* them? Merging them means that all checkouts of "master" will get the old deprecated code. Ugh. Replacing them means that everyone with a copy of the repository has to do a "force" update of their local "master" branch. This is annoying, but shouldn't be a problem because no one should be using the "master" branch. Any comments before I go poke the repository? Alan DeKok.

1 0

GIT Log for 2010-05-29 23:33 GMT
by aland＠deployingradius.com 29 May '10

29 May '10

commit ed4f13943644604343a6f5cc7737ca6e2fe2ecbf Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat May 29 11:34:57 2010 +0200 Print out DHCP attributes sent / received Files changed: src/modules/frs_dhcp/dhcp.c | 25 ++++++++++++------------- 1 files changed, 12 insertions(+), 13 deletions(-) ====================================================================== commit 880ddec8a950efb5452b1d88a7ffe78b2c53b2cb Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat May 29 11:26:56 2010 +0200 Fix endless loop when there are multiple DHCP options Files changed: src/modules/frs_dhcp/dhcp.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit b20e8fee17d2b7ce52ad0338c2d18faa06f9ef34 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon May 24 20:20:06 2010 +0200 Set line buf on stdout/err when logs go there This makes log messages appear more quickly. Files changed: src/main/radiusd.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) ======================================================================

1 0

freeradius-client-1.1.6 status
by Steve Dispensa 29 May '10

29 May '10

I see on freeradius.org that freeradius-client-1.1.6 seems to the current version, and it looks like the project is actively maintained. I ran into a few problems using it and fixed several bugs, so if indeed it's still your maintained and recommended solution for integrating radius client functionality into a third-party app, well, I have a patch for you if you're interested. Where should I send it? Thanks. -Steve

2 1

GIT Log for 2010-05-24 23:33 GMT
by aland＠deployingradius.com 24 May '10

24 May '10

commit 6c1cca16343afc516ec3ac8376e89035e906b48d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon May 24 07:35:31 2010 +0200 If an integer is surrounded by whitespace, it's still an integer Files changed: src/lib/valuepair.c | 16 +++++++++++++++- 1 files changed, 15 insertions(+), 1 deletions(-) ====================================================================== commit 318a040a491b1d9fd7122016b1c0d38fa8d371db Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu May 20 17:40:32 2010 +0200 Fix template documentation Files changed: raddb/templates.conf | 8 ++++++-- 1 files changed, 6 insertions(+), 2 deletions(-) ====================================================================== commit acd2bbd8b397426841d608b9f16699523abe52de Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu May 20 15:25:51 2010 +0200 No longer needed Files changed: redhat/rc.radiusd-redhat | 80 ---------------------------------------------- 1 files changed, 0 insertions(+), 80 deletions(-) ====================================================================== commit c30242f1c5343c80c69d2b9d32a5fb7caa567f46 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu May 20 15:25:22 2010 +0200 Do cert configuration stuff Taken from Redhat Files changed: redhat/freeradius-cert-config.patch | 68 +++++++++++++++++++++++++++++++++++ 1 files changed, 68 insertions(+), 0 deletions(-) ======================================================================

1 0

Proposed patch for "embedded" use.
by Scott Neugroschl 20 May '10

20 May '10

I'm working in a rather oddball environment, and have come up with a patch to allow freeradius-client 1.1.6 usage in an "embedded" environment -- without any config files at all. I started from the example radembedded.c and noted that it still needed a dictionary file. I have a patch to dict.c and freeradius-client.h to allow the dictionary data to be loaded from an in-memory table, instead of a disk file. If anyone is interested, I'll post the patch.

1 0

retry mechanism for radius client 1.1.6
by Lewis Adam-VNQM87 20 May '10

20 May '10

Looking at the retry handling in rc_send_server() in sendserver.c, it appears that "retries" actually means "tries". Lines 325 to 330: /* * Timed out waiting for response. Retry "retry_max" times * before giving up. If retry_max = 0, don't retry at all. */ if (++retries >= retry_max) { ... return TIMEOUT_RC; } After the first time out, retries is pre-incremented to 1 thus being greater than or equal to 0 or 1 (so setting retry_max to 0 or 1 has the same effect). I think the fix is simply to change the line to: if (retries++ >= retry_max)

3 2

GIT Log for 2010-05-19 23:33 GMT
by aland＠deployingradius.com 19 May '10

19 May '10

commit 163f5c108a257ea96c6d380dc8ded0ac0799736e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed May 19 16:27:04 2010 +0200 Note module return codes Files changed: man/man5/unlang.5 | 5 ++++- 1 files changed, 4 insertions(+), 1 deletions(-) ====================================================================== commit e6fc617b79b3e94547e231cb6a1c8c8c5564bca7 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed May 19 15:14:53 2010 +0200 Source files shouldn't have the executable bit set. Files changed: 0 files changed, 0 insertions(+), 0 deletions(-) ====================================================================== commit 2b03ea3ce077e97b7b4315e84f7e09013b83e3e2 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed May 19 15:08:16 2010 +0200 As supplied by RedHat. These files are direct copies of the upstream RedHat files, and should work better on most RedHat systems Files changed: redhat/freeradius-logrotate | 56 ++++++++++++++++++++ redhat/freeradius-pam-conf | 6 ++ redhat/freeradius-radiusd-init | 113 ++++++++++++++++++++++++++++++++++++++++ 3 files changed, 175 insertions(+), 0 deletions(-) ====================================================================== commit aca9de4da8b8e78840ae45f2a44cab200cafd35f Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed May 19 14:55:26 2010 +0200 Print out section name for empty sections Files changed: src/main/modules.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ======================================================================

1 0

GIT Log for 2010-05-18 23:33 GMT
by aland＠deployingradius.com 18 May '10

18 May '10

commit 5dd3673eca2f158a37faf053dd157d2b5bc4ff6d Author: Peter Nixon <listuser(a)peternixon.net> Date: Tue May 18 21:00:57 2010 +0300 Remove some warnings Files changed: doc/DIFFS.rst | 10 ++++------ 1 files changed, 4 insertions(+), 6 deletions(-) ====================================================================== commit c3908851721222099e543dd56d2d1c4a08b6cd4a Author: Peter Nixon <listuser(a)peternixon.net> Date: Tue May 18 19:55:28 2010 +0300 Convert some more docs to RST Files changed: doc/DIFFS | 203 ----------------------------------------------- doc/DIFFS.rst | 206 ++++++++++++++++++++++++++++++++++++++++++++++++ doc/aaa.rst | 15 ++-- doc/coding-methods.rst | 162 +++++++++++++++++++++++++++++++++++++ doc/coding-methods.txt | 162 ------------------------------------- doc/index.rst | 6 +- doc/ldap_howto.rst | 96 +++++++++++------------ doc/load-balance.rst | 172 ++++++++++++++++++++++++++++++++++++++++ doc/load-balance.txt | 175 ---------------------------------------- doc/release-method.rst | 7 +- 10 files changed, 600 insertions(+), 604 deletions(-) ====================================================================== commit d810a9eb1faa8c4a8792c8f6cdb97d743d19cf52 Author: Peter Nixon <listuser(a)peternixon.net> Date: Tue May 18 15:17:29 2010 +0300 Checkin some initial work on RSTifying our documentation using sphinx The Makefile needs fixing.. Files changed: doc/Makefile | 121 +++- doc/Makefile.backup | 38 + doc/aaa.rst | 100 +++ doc/aaa.txt | 102 --- doc/conf.py | 280 +++++++ doc/index.rst | 19 + doc/ldap_howto.rst | 1904 ++++++++++++++++++++++++++++++++++++++++++++++++ doc/ldap_howto.txt | 1875 ----------------------------------------------- doc/release-method.rst | 42 ++ doc/release-method.txt | 41 - 10 files changed, 2472 insertions(+), 2050 deletions(-) ======================================================================

1 0

Re: ??: Freeradius-Devel Digest, Vol 61, Issue 12
by Alan DeKok 18 May '10

18 May '10

jacky.wang(a)digimoc.com wrote: > 1 if I use eap-aka, is the dictionary needed to be modified? No. > 2 is there any patch for the aka based on the radius freeserver, instead of > the libeap.so. There's a patch for 1.1.4 floating around. I have no idea where a current copy is located, though. Alan DeKok.

1 0

答复: Freeradius-Devel Digest, Vol 61, Issue 12
by jacky.wang＠digimoc.com 18 May '10

18 May '10

Hi Alan DeKok. And all, I have two questions, 1 if I use eap-aka, is the dictionary needed to be modified? 2 is there any patch for the aka based on the radius freeserver, instead of the libeap.so. Jacky 2010-5-18 ------------------------------ Message: 5 Date: Tue, 18 May 2010 09:30:02 +0800 From: <jacky.wang(a)digimoc.com> Subject: freeradiuis and eap-aka To: <freeradius-devel(a)lists.freeradius.org> Message-ID: <000001caf629$a34ceca0$e9e6c5e0$@wang@digimoc.com> Content-Type: text/plain; charset="us-ascii" hi all, my freeradius can not work for eap-aka. Freeradius: 2.1.8 Libeap.so : from hostapd0.6.10 Always report error as the following, WARNING: Unknown value specified for Auth-Type. Cannot perform requested action. Failed to authenticate the user. I just want to pass a simple epa-aka test, anyone can give me the configuration ? Thank you. Jacky 2010-5-18

1 0

Re: freeradiuis and eap-aka
by Alan DeKok 18 May '10

18 May '10

jacky.wang(a)digimoc.com wrote: > my freeradius can not work for eap-aka. It doesn't support EAP-AKA> > Freeradius: 2.1.8 > > Libeap.so : from hostapd0.6.10 FreeRADIUS comes with it's own EAP implementation. > I just want to pass a simple epa-aka test, anyone can give me the > configuration ? If you want to use libeap from Hostap, read raddb/experimental.conf. Alan DeKok.

1 0

freeradiuis and eap-aka
by jacky.wang＠digimoc.com 18 May '10

18 May '10

hi all, my freeradius can not work for eap-aka. Freeradius: 2.1.8 Libeap.so : from hostapd0.6.10 Always report error as the following, WARNING: Unknown value specified for Auth-Type. Cannot perform requested action. Failed to authenticate the user. I just want to pass a simple epa-aka test, anyone can give me the configuration ? Thank you. Jacky 2010-5-18

1 0

FW: EAP_TLS
by Harshil Anil Kumar Shah 17 May '10

17 May '10

Dear Friends, I wanted to modify EAP-TLS protocol available in Freeradius. I found two files in src/modules/rlm_eap/libeap directory: eap_tls.c and tls.c. Can you please guide me to understand the code and which file does which functionality? Harshil A. Shah, Systems Engineer(SE), Convergence Labs, SETLabs, Bangalore, Contact#: 09742887966.

2 5

radiusclient documentation?
by Scott Neugroschl 14 May '10

14 May '10

Are there man pages for the FreeRADIUS client library (1.1.6) available? In the tarball, the man directory is empty, and the doc directory doesn't contain anything of use either. Yes, I know, the source is authoritative, but I was hoping that there might be external documentation. Thanks Scott

2 1

FR System Memory usage question
by ziyen 13 May '10

13 May '10

Hi. Strange situation happen at all FR2.1.6,2.1.7,2.1.8, and 2.2.0(git) version the situation is radiusd are use all system available memory radiusd is using about 10 request processing 1Mb system memory "add only not returned memory space" so, at last radiusd is using all system memory..and memory fault and die radiusd. if stop radiusd then using system memory is roll back if restart radiusd then memory roll back and ... very strange, FR2.2.0(git) immediate restart radiusd but roll back is not. whats wrong?(FR 1.X version is not happen situation) My OS is CentOS 5.2, backend mysql Thanks.

2 1

git version CentOS 5.2 make error help
by ziyen 12 May '10

12 May '10

Hi Today I get git version FR but make error happen bellow... what's wrong? Making all in rlm_acctlog... /usr/bin/gmake -w -C rlm_acctlog all gmake[6]: Entering directory `/root/freeradius-server/src/modules/rlm_acctlog' /bin/sh /root/freeradius-server/libtool --mode=compile gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I/root/freeradius-server/src -I/root/freeradius-server/libltdl -c rlm_acctlog.c libtool: compile: gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I/root/freeradius-server/src -I/root/freeradius-server/libltdl -c rlm_acctlog.c -fPIC -DPIC -o .libs/rlm_acctlog.o In file included from /root/freeradius-server/src/freeradius-devel/radiusd.h:107, from rlm_acctlog.c:28: /root/freeradius-server/src/freeradius-devel/smodule.h:144: error: expected specifier-qualifier-list before â€˜RADCLIENTâ€™ gmake[6]: *** [rlm_acctlog.lo] Error 1 gmake[6]: Leaving directory `/root/freeradius-server/src/modules/rlm_acctlog' gmake[5]: *** [rlm_acctlog] Error 2 gmake[5]: Leaving directory `/root/freeradius-server/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/root/freeradius-server/src/modules' gmake[3]: *** [modules] Error 2 gmake[3]: Leaving directory `/root/freeradius-server/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/root/freeradius-server/src' gmake[1]: *** [src] Error 2 gmake[1]: Leaving directory `/root/freeradius-server' make: *** [all] Error 2

2 1

GIT Log for 2010-05-11 23:33 GMT
by aland＠deployingradius.com 11 May '10

11 May '10

commit 8ed7604ac4f86f998e7e76647d9574e89739745d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri May 7 11:18:14 2010 +0200 Note example of SQL in post-auth reject, too Files changed: raddb/sites-available/default | 3 ++- raddb/sites-available/inner-tunnel | 2 ++ 2 files changed, 4 insertions(+), 1 deletions(-) ====================================================================== commit 8e5e636127064630b0987d633699427e9fab4185 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri May 7 10:07:25 2010 +0200 Added server field to NAS table, and updated docs to match Files changed: raddb/sql/mysql/dialup.conf | 3 ++- raddb/sql/mysql/nas.sql | 2 +- raddb/sql/oracle/dialup.conf | 14 ++++++++++++++ raddb/sql/oracle/nas.sql | 2 -- raddb/sql/postgresql/dialup.conf | 3 ++- raddb/sql/postgresql/nas.sql | 2 -- 6 files changed, 19 insertions(+), 7 deletions(-) ====================================================================== commit 6e4e580ef68c0ea8acbf9f7d941a6377e649bbe4 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri May 7 09:34:20 2010 +0200 Made connected / disconnected messages into informational If the module complains when it can't connect, it should also make a not when it *can* connect, too. Files changed: src/modules/rlm_sql/sql.c | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) ====================================================================== commit 10a9411f1116c7fdb47c69b155aa631467210983 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri May 7 09:18:21 2010 +0200 Change %{Acct-}*x -> %{%{Acct-}:-0}*x This allows the calculation to proceed correctly when the attribute doesn't exist. This change was made for other databases, and seems to have been missed for Oracle Files changed: raddb/sql/oracle/dialup.conf | 16 ++++++++-------- 1 files changed, 8 insertions(+), 8 deletions(-) ====================================================================== commit 616c8fa3aef6c0cccf94d52e96073538664ad345 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu May 6 14:41:51 2010 +0200 Don't use msqlippool by default Files changed: raddb/sql/oracle/ippool.conf | 16 ++++++++-------- 1 files changed, 8 insertions(+), 8 deletions(-) ======================================================================

1 0

Re: cannot get core dump of crashing freeradius
by Jakob Hirsch 07 May '10

07 May '10

Hi, follow from the users list, belongs not really there, I think. Alan DeKok, 2010-04-26 17:24: >> This will become a non-issue when the prctl() calls are moved into the >> fr_suid_* functions. :) >> Would you like me to prepare a patch for that or would you rather do >> that yourself? > Patch, please. It's just easier. Is attached. I found no way to enable the process's dumpable flag permanently, so I just re-enable it on every uid/gid change. Not really elegant... I also propose a second (one-line) patch that allows core dumps also when running in debug mode (as mentioned on the users list). Note that the patches are not really tested, will probably do that tomorrow...

2 2

2.1.9 Schedule
by John Dennis 05 May '10

05 May '10

We would like to get 2.1.9 into RHEL6 as opposed to 2.1.8. The window of opportunity is narrowing. Is there a schedule for 2.1.9? The only thing I think I recall is "in a few weeks", is there something more specific? Thanks! -- John Dennis <jdennis(a)redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/

2 1

Clark Wang has invited you to Dropbox
by Dropbox 05 May '10

05 May '10

We're excited to let you know that Clark Wang has invited you to Dropbox! Clark Wang has been using Dropbox to sync and share files online and across computers, and thought you might want it too. Visit http://www.dropbox.com/link/20.rNayyszlw4/NjE2MzQ0NTIzNw to get started. - The Dropbox Team ____________________________________________________ To stop receiving invites from Dropbox, please go to http://www.dropbox.com/bl/1eceb573ec11/freeradius-devel%40lists.freeradius.…

1 0