September 2010 - Freeradius-Devel - lists.freeradius.org

Missing TLS Change Cipher Spec and TLS Finished in EAP-TLS exchanges
by arno＠natisbad.org 09 Jul '11

09 Jul '11

Hi, I upgraded an internal freeradius server (Linux, Debian unstable, libssl 0.9.8) used for EAP-TLS (802.11 WPA2 access) from 2.0.5 to 2.1.3. With 2.1.3, client authentication fails in the following way (wpasupplicant on Debian unstable, working with 2.0.5): - the TLS exchange is completed from freeradius point of view. It even sends the Access-Accept message to the NAS. - from the clients point of view, the TLS exchange is not over, it expects some more data from the server which are never sent. I took two pcap traces (sent to you privately, Alan), one with 2.0.5, one with 2.1.3. It looks like the TLS Change Cipher and TLS Tinished elements of the TLS exchange are not in the EAP encapsulated TLS packets sent by the server. Compare packet #23 of 2.1.3 trace with packet #27 of 2.0.5 trace. If you use wireshark, you will notice that the SSL layer is dissected; this is because #27 has a small brother: #29. It is not sent by 2.1.3. Alan, if you have an idea or a patch, I can test it on monday. Cheers, a+

5 15

eap2 in freeradius
by Chanthearith HUON 04 Apr '11

04 Apr '11

Hi everyone, I am testing eap2 in freeradius. I run "radiusd -X", I got following error message " radiusd: symbol lookup error: /usr/lib/rlm_eap2-2.1.0.so: undefined symbol: eap_server_register_methods " Anyone, have any idea what might be wrong with the configuration? Thank in advance, Thierry

5 10

Logging pretty much all Attribute Value Pairs
by Gyanendra Kumar 30 Sep '10

30 Sep '10

Hi All: I have this requirement to log pretty much log all attribute value pairs. I put a hook in radius.c and looged few parameters that was available to me UserName, Source IP Address, Destination IP Address, NAS-IP-Address, Request-ID. I use vp_prints function to parse packet->vps, then save it and insert in DB. In normal circumstances not all attributes are used but I am going to use this list: http://www.iana.org/assignments/radius-types/radius-types.xml I will use this list to code and extract attribute value pairs and store in DB. Please let me know my assumptions are correct and also let me know if there is a better way todo things or a complete implementation is already included in FreeRadius. Thanks in advance -Gyan

2 1

xlat lower/upper
by Alexander Clouter 21 Sep '10

21 Sep '10

Hi, Another patch that Alan will no doubt neglect, others might find it useful though. This patch adds lower/uppercase xlat support so you can now do things like: ---- update request { Calling-Station-Id := "%{lower:%{Calling-Station-Id}}" } update request { Calling-Station-Id := "%{upper:%{Calling-Station-Id}}" } ---- Cheers -- Alexander Clouter .sigmonster says: Girls are better looking in snowstorms. -- Archie Goodwin --- src/main/xlat.c.orig 2010-09-20 16:10:54.000000000 +0000 +++ src/main/xlat.c 2010-09-20 16:23:41.000000000 +0000 @@ -465,6 +465,61 @@ return strlen(out); } +/* + * Lowercase a string + */ +static size_t xlat_lower(UNUSED void *instance, REQUEST *request, + char *fmt, char *out, size_t outlen, + UNUSED RADIUS_ESCAPE_STRING func) +{ + int i; + char buffer[1024]; + + if (!radius_xlat(buffer, sizeof(buffer), fmt, request, func)) { + *out = '\0'; + return 0; + } + + if (outlen < strlen(buffer)) { + snprintf(out, outlen, "lower_overflow"); + return strlen(out); + } + + for (i = 0; buffer[i] != '\0'; i++) + out[i] = tolower(buffer[i]); + + out[i] = '\0'; + + return strlen(out); +} + +/* + * Uppercase a string + */ +static size_t xlat_upper(UNUSED void *instance, REQUEST *request, + char *fmt, char *out, size_t outlen, + UNUSED RADIUS_ESCAPE_STRING func) +{ + int i; + char buffer[1024]; + + if (!radius_xlat(buffer, sizeof(buffer), fmt, request, func)) { + *out = '\0'; + return 0; + } + + if (outlen < strlen(buffer)) { + snprintf(out, outlen, "upper_overflow"); + return strlen(out); + } + + for (i = 0; buffer[i] != '\0'; i++) + out[i] = toupper(buffer[i]); + + out[i] = '\0'; + + return strlen(out); +} /* * Calculate the MD5 hash of a string. @@ -610,6 +665,16 @@ c = xlat_find("md5"); rad_assert(c != NULL); c->internal = TRUE; + + xlat_register("lower", xlat_lower, &xlat_inst[0]); + c = xlat_find("lower"); + rad_assert(c != NULL); + c->internal = TRUE; + + xlat_register("upper", xlat_upper, &xlat_inst[0]); + c = xlat_find("upper"); + rad_assert(c != NULL); + c->internal = TRUE; } /*

2 3

In Proxy Called-Station-Id based Switching to HomeServer
by Gyanendra Kumar 17 Sep '10

17 Sep '10

Hi All: I have to use FreeRadius as a proxy. This I have configured for Realm based and default switching to Radius HomeServer. Now in Wireless Access Point connectivity scenario the following implementation needs to be made. Called-Station-Id based switching to HomeServer needs to be implemented in addition to the realm based switching. I had a few questions in regards to this: 1. If the functionality can be implemented through existing functionality, please let me know ? 2. If this functionality is not there whats and easier way to go about implementing this functionality. An example of Called-Station-Id is 00-1E-4C-32-DA-2E:abssid Mac auth is a functionality which is implemented using Calling-Station-Id which is different from Called-Station-Id. Best Regards -Sunnybrad

2 1

borked rlm_mschap
by Alexander Clouter 17 Sep '10

17 Sep '10

Hi, Reverting 401dcce982f9a9972bc7bb87d5ee7e0bf3888f3a stops the following implosion: ---- libtool: compile: gcc -g -O2 -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I/usr/src/freeradius/freeradius-server/src -c rlm_mschap.c -fPIC -DPIC -o .libs/rlm_mschap.o rlm_mschap.c: In function ???mschap_detach???: rlm_mschap.c:553: warning: passing argument 1 of ???free??? discards qualifiers from pointer target type /usr/include/stdlib.h:488: note: expected ???void *??? but argument is of type ???const char *??? rlm_mschap.c: At top level: rlm_mschap.c:615: warning: no previous prototype for ???mschap_add_reply??? rlm_mschap.c: In function ???do_mschap???: rlm_mschap.c:721: error: ???REQUEST??? has no member named ???request??? make[7]: *** [rlm_mschap.lo] Error 1 ---- Cheers -- Alexander Clouter .sigmonster says: A pound of salt will not sweeten a single cup of tea.

2 1

change prompt
by Zöld 16 Sep '10

16 Sep '10

Hi! I am using CentOS 5.5 with RADIUS authentication. When I use SSH against this machine the following prompt is shown: Using username "user". user(a)192.168.1.100's password: Is there any chance to change this password prompt with the modification of pam_radius_auth.c or where can I find this prompt? Best Regards, zgabe

1 0

unlang 'check'
by Alexander Clouter 15 Sep '10

15 Sep '10

Hi, Not a show stopper, but it seems doing a comparision on 'check:...' in unlang does not work (however using 'control:...' does): ---- ldap-lanwarden if (ok) { if (check:LanWarden-Host-State != "enable") { update reply { Reply-Message := "LW: disabled" } reject } .... } ---- The above results in: ---- [ldap_lanwarden2] No default NMAS login sequence [ldap_lanwarden2] looking for check items in directory... [ldap_lanwarden2] owner -> LanWarden-Host-Owner == "cn=ac56,ou=Staff,ou=Active,ou=Accounts,o=soas" [ldap_lanwarden2] lanwardenHostAuthenticateMethod -> LanWarden-Host-Auth-Method == "none" [ldap_lanwarden2] lanwardenHostState -> LanWarden-Host-State == "enable" [ldap_lanwarden2] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap_lanwarden2] user authorized to use remote access [ldap_lanwarden2] ldap_release_conn: Release Id: 0 ++++[ldap_lanwarden2] returns ok +++- redundant-load-balance group redundant-load-balance returns ok ++- policy ldap-lanwarden returns ok ++? if (ok) ? Evaluating (ok) -> TRUE ++? if (ok) -> TRUE ++- entering if (ok) {...} +++? if (check:LanWarden-Host-State != "enable") ? Evaluating (check:LanWarden-Host-State != "enable") -> TRUE <--- WTF? +++? if (check:LanWarden-Host-State != "enable") -> TRUE +++- entering if (check:LanWarden-Host-State != "enable") {...} ++++[reply] returns ok ++++[reject] returns reject +++- if (check:LanWarden-Host-State != "enable") returns reject ++- if (ok) returns reject } # server lanwarden ---- Turns out that it is actually doing is saying the *string* "check:LanWarden-Host-State" does not compare, rather than the *variable* 'check:LanWarden-Host-State'. Replacing it with "%{check:LanWarden-Host-State}" (or 'control:LanWarden-Host-State') works around the problem however I was say that either that phrase 'looking for check items...' needs amending, or the code to be tweaked to align the behaviour of unlang to treat control/check equally. I vaguely recall that 'check' is depreated in favour 'control' however in it's current state the logic leads to madness...as I found out this morning :-/ Cheers -- Alexander Clouter .sigmonster says: Satire does not look pretty upon a tombstone.

2 3

src_ipaddr with proxies
by Alexander Clouter 13 Sep '10

13 Sep '10

Hi, Found a bug in 2.1.9 (is is the Debian squeeze release), probably due to my mis-use of src_ipaddr in the home_server stanza. My proxy definition looks like: ---- templates { eduroam-proxy { type = auth+acct port = 1812 require_message_authenticator = yes status_check = status-server } eduroam-proxy6 { src_ipaddr = ${local.MY.addr.eduroam.v6} $template eduroam-proxy } eduroam-proxy4 { src_ipaddr = ${local.MY.addr.eduroam.v4} $template eduroam-proxy } } home_server jrs.0.v6 { ipv6addr = ${local.jrs.0.addr.v6} secret = ${local.jrs.0.secret} $template eduroam-proxy6 } home_server jrs.0.v4 { ipaddr = ${local.jrs.0.addr.v4} secret = ${local.jrs.0.secret} $template eduroam-proxy4 } [snipped] ---- This seems to cause FreeRADIUS to spin when opening the proxy sockets, the output ---- root@chlorine:/etc/freeradius# gdb /usr/sbin/freeradius GNU gdb (GDB) 7.0.1-debian Copyright (C) 2009 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "arm-linux-gnueabi". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /usr/sbin/freeradius...Reading symbols from /usr/lib/debug/usr/sbin/freeradius...done. (no debugging symbols found)...done. (gdb) run -X Starting program: /usr/sbin/freeradius -X [snipped] listen { type = "acct" ipaddr = 212.219.238.5 port = 0 clients = "eduroam" } ^C <--- hangs Program received signal SIGINT, Interrupt. 0x0000e614 in fr_ipaddr_cmp () at misc.c:543 543 misc.c: No such file or directory. in misc.c (gdb) where #0 0x0000e614 in fr_ipaddr_cmp () at misc.c:543 #1 0x00019f44 in proxy_new_listener (ipaddr=0x137430, exists=1) at listen.c:1726 #2 0x0002eb90 in home_server_create_callback (ctx=0x140a98, data=<value optimized out>) at realms.c:2214 #3 0x40035930 in WalkNodeInOrder (X=0x137228, callback=0x2eb6c <home_server_create_callback>, context=0x140a98) at rbtree.c:544 #4 0x40035918 in WalkNodeInOrder (X=0x5c838, callback=0x2eb6c <home_server_create_callback>, context=0x140a98) at rbtree.c:540 #5 0x40035918 in WalkNodeInOrder (X=0x5ca08, callback=0x2eb6c <home_server_create_callback>, context=0x140a98) at rbtree.c:540 #6 0x0002eb24 in home_server_create_listeners (ctx=<value optimized out>) at realms.c:2244 #7 0x0001a6ac in listen_init (config=0x4c020, head=0xbee39b2c) at listen.c:2194 #8 0x0002ab40 in radius_event_init (cs=0x4c020, spawn_flag=0) at event.c:3599 #9 0x000223fc in main (argc=2, argv=<value optimized out>) at radiusd.c:328 (gdb) ---- If I remove the 'src_ipaddr' entries from my templates then things run as normal; however as my RADIUS server has ten IP addresses, without this it is completely un-usabled. If I move the 'src_ipaddr' entry explicitly into my 'home_server' stanza, then I get an assert(): ---- [snipped] listen { type = "acct" ipaddr = 212.219.238.5 port = 0 clients = "eduroam" } Listening on authentication address ::1 port 1812 as server eduroam Listening on authentication address 2001:630:1b:6003:372d:f782:e3d9:ae6 port 1812 as server eduroam Listening on authentication address 212.219.238.5 port 1812 as server eduroam Listening on accounting address 2001:630:1b:6003:372d:f782:e3d9:ae6 port 1813 as server eduroam Listening on accounting address 212.219.238.5 port 1813 as server eduroam Listening on proxy address ::1 port 1814 Listening on proxy address 2001:630:1b:6003:372d:f782:e3d9:ae6 port 55212 Listening on proxy address 2001:630:1b:6003:372d:f782:e3d9:ae6 port 39406 ASSERT FAILED event.c[3639]: proxy_fds[this->fd & 0x1f] == -1 Aborted ---- Further investigation shows that if I have more than one 'src_ipaddr' entry present, I get no assert() and things spin again. So the spin bug seems unrelated to my templating, but is triggered as the template creates multiple src_ipaddr's, whilst I cannot use a single src_ipaddr as I end up with an assert(). Cheers -- Alexander Clouter .sigmonster says: Optimization hinders evolution.

2 7

Can some one explain me about PDFID and SDFID
by aleem 10 Sep '10

10 Sep '10

Hi All, I Am a newbie , dont know much about the WiMAX.Can any one explain me in detail about the packet data flow ID(PDFID) and service data flow ID(SDFID) in WiMAX. One more thing can we send multiple Service-ID attributes in a single request/response.If yes how? Any kind of help would be aprreciated.Thanks in advance. Regards, Aleem. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Can-some-one-explain-me-about-PDFID… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

2 3