September 2010 - Freeradius-Devel - lists.freeradius.org

Missing TLS Change Cipher Spec and TLS Finished in EAP-TLS exchanges
by arno＠natisbad.org 09 Jul '11

09 Jul '11

Hi, I upgraded an internal freeradius server (Linux, Debian unstable, libssl 0.9.8) used for EAP-TLS (802.11 WPA2 access) from 2.0.5 to 2.1.3. With 2.1.3, client authentication fails in the following way (wpasupplicant on Debian unstable, working with 2.0.5): - the TLS exchange is completed from freeradius point of view. It even sends the Access-Accept message to the NAS. - from the clients point of view, the TLS exchange is not over, it expects some more data from the server which are never sent. I took two pcap traces (sent to you privately, Alan), one with 2.0.5, one with 2.1.3. It looks like the TLS Change Cipher and TLS Tinished elements of the TLS exchange are not in the EAP encapsulated TLS packets sent by the server. Compare packet #23 of 2.1.3 trace with packet #27 of 2.0.5 trace. If you use wireshark, you will notice that the SSL layer is dissected; this is because #27 has a small brother: #29. It is not sent by 2.1.3. Alan, if you have an idea or a patch, I can test it on monday. Cheers, a+

5 15

eap2 in freeradius
by Chanthearith HUON 04 Apr '11

04 Apr '11

Hi everyone, I am testing eap2 in freeradius. I run "radiusd -X", I got following error message " radiusd: symbol lookup error: /usr/lib/rlm_eap2-2.1.0.so: undefined symbol: eap_server_register_methods " Anyone, have any idea what might be wrong with the configuration? Thank in advance, Thierry

5 10

Logging pretty much all Attribute Value Pairs
by Gyanendra Kumar 30 Sep '10

30 Sep '10

Hi All: I have this requirement to log pretty much log all attribute value pairs. I put a hook in radius.c and looged few parameters that was available to me UserName, Source IP Address, Destination IP Address, NAS-IP-Address, Request-ID. I use vp_prints function to parse packet->vps, then save it and insert in DB. In normal circumstances not all attributes are used but I am going to use this list: http://www.iana.org/assignments/radius-types/radius-types.xml I will use this list to code and extract attribute value pairs and store in DB. Please let me know my assumptions are correct and also let me know if there is a better way todo things or a complete implementation is already included in FreeRadius. Thanks in advance -Gyan

2 1

xlat lower/upper
by Alexander Clouter 21 Sep '10

21 Sep '10

Hi, Another patch that Alan will no doubt neglect, others might find it useful though. This patch adds lower/uppercase xlat support so you can now do things like: ---- update request { Calling-Station-Id := "%{lower:%{Calling-Station-Id}}" } update request { Calling-Station-Id := "%{upper:%{Calling-Station-Id}}" } ---- Cheers -- Alexander Clouter .sigmonster says: Girls are better looking in snowstorms. -- Archie Goodwin --- src/main/xlat.c.orig 2010-09-20 16:10:54.000000000 +0000 +++ src/main/xlat.c 2010-09-20 16:23:41.000000000 +0000 @@ -465,6 +465,61 @@ return strlen(out); } +/* + * Lowercase a string + */ +static size_t xlat_lower(UNUSED void *instance, REQUEST *request, + char *fmt, char *out, size_t outlen, + UNUSED RADIUS_ESCAPE_STRING func) +{ + int i; + char buffer[1024]; + + if (!radius_xlat(buffer, sizeof(buffer), fmt, request, func)) { + *out = '\0'; + return 0; + } + + if (outlen < strlen(buffer)) { + snprintf(out, outlen, "lower_overflow"); + return strlen(out); + } + + for (i = 0; buffer[i] != '\0'; i++) + out[i] = tolower(buffer[i]); + + out[i] = '\0'; + + return strlen(out); +} + +/* + * Uppercase a string + */ +static size_t xlat_upper(UNUSED void *instance, REQUEST *request, + char *fmt, char *out, size_t outlen, + UNUSED RADIUS_ESCAPE_STRING func) +{ + int i; + char buffer[1024]; + + if (!radius_xlat(buffer, sizeof(buffer), fmt, request, func)) { + *out = '\0'; + return 0; + } + + if (outlen < strlen(buffer)) { + snprintf(out, outlen, "upper_overflow"); + return strlen(out); + } + + for (i = 0; buffer[i] != '\0'; i++) + out[i] = toupper(buffer[i]); + + out[i] = '\0'; + + return strlen(out); +} /* * Calculate the MD5 hash of a string. @@ -610,6 +665,16 @@ c = xlat_find("md5"); rad_assert(c != NULL); c->internal = TRUE; + + xlat_register("lower", xlat_lower, &xlat_inst[0]); + c = xlat_find("lower"); + rad_assert(c != NULL); + c->internal = TRUE; + + xlat_register("upper", xlat_upper, &xlat_inst[0]); + c = xlat_find("upper"); + rad_assert(c != NULL); + c->internal = TRUE; } /*

2 3

In Proxy Called-Station-Id based Switching to HomeServer
by Gyanendra Kumar 17 Sep '10

17 Sep '10

Hi All: I have to use FreeRadius as a proxy. This I have configured for Realm based and default switching to Radius HomeServer. Now in Wireless Access Point connectivity scenario the following implementation needs to be made. Called-Station-Id based switching to HomeServer needs to be implemented in addition to the realm based switching. I had a few questions in regards to this: 1. If the functionality can be implemented through existing functionality, please let me know ? 2. If this functionality is not there whats and easier way to go about implementing this functionality. An example of Called-Station-Id is 00-1E-4C-32-DA-2E:abssid Mac auth is a functionality which is implemented using Calling-Station-Id which is different from Called-Station-Id. Best Regards -Sunnybrad

2 1

borked rlm_mschap
by Alexander Clouter 17 Sep '10

17 Sep '10

Hi, Reverting 401dcce982f9a9972bc7bb87d5ee7e0bf3888f3a stops the following implosion: ---- libtool: compile: gcc -g -O2 -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I/usr/src/freeradius/freeradius-server/src -c rlm_mschap.c -fPIC -DPIC -o .libs/rlm_mschap.o rlm_mschap.c: In function ???mschap_detach???: rlm_mschap.c:553: warning: passing argument 1 of ???free??? discards qualifiers from pointer target type /usr/include/stdlib.h:488: note: expected ???void *??? but argument is of type ???const char *??? rlm_mschap.c: At top level: rlm_mschap.c:615: warning: no previous prototype for ???mschap_add_reply??? rlm_mschap.c: In function ???do_mschap???: rlm_mschap.c:721: error: ???REQUEST??? has no member named ???request??? make[7]: *** [rlm_mschap.lo] Error 1 ---- Cheers -- Alexander Clouter .sigmonster says: A pound of salt will not sweeten a single cup of tea.

2 1

change prompt
by Zöld 16 Sep '10

16 Sep '10

Hi! I am using CentOS 5.5 with RADIUS authentication. When I use SSH against this machine the following prompt is shown: Using username "user". user(a)192.168.1.100's password: Is there any chance to change this password prompt with the modification of pam_radius_auth.c or where can I find this prompt? Best Regards, zgabe

1 0

unlang 'check'
by Alexander Clouter 15 Sep '10

15 Sep '10

Hi, Not a show stopper, but it seems doing a comparision on 'check:...' in unlang does not work (however using 'control:...' does): ---- ldap-lanwarden if (ok) { if (check:LanWarden-Host-State != "enable") { update reply { Reply-Message := "LW: disabled" } reject } .... } ---- The above results in: ---- [ldap_lanwarden2] No default NMAS login sequence [ldap_lanwarden2] looking for check items in directory... [ldap_lanwarden2] owner -> LanWarden-Host-Owner == "cn=ac56,ou=Staff,ou=Active,ou=Accounts,o=soas" [ldap_lanwarden2] lanwardenHostAuthenticateMethod -> LanWarden-Host-Auth-Method == "none" [ldap_lanwarden2] lanwardenHostState -> LanWarden-Host-State == "enable" [ldap_lanwarden2] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap_lanwarden2] user authorized to use remote access [ldap_lanwarden2] ldap_release_conn: Release Id: 0 ++++[ldap_lanwarden2] returns ok +++- redundant-load-balance group redundant-load-balance returns ok ++- policy ldap-lanwarden returns ok ++? if (ok) ? Evaluating (ok) -> TRUE ++? if (ok) -> TRUE ++- entering if (ok) {...} +++? if (check:LanWarden-Host-State != "enable") ? Evaluating (check:LanWarden-Host-State != "enable") -> TRUE <--- WTF? +++? if (check:LanWarden-Host-State != "enable") -> TRUE +++- entering if (check:LanWarden-Host-State != "enable") {...} ++++[reply] returns ok ++++[reject] returns reject +++- if (check:LanWarden-Host-State != "enable") returns reject ++- if (ok) returns reject } # server lanwarden ---- Turns out that it is actually doing is saying the *string* "check:LanWarden-Host-State" does not compare, rather than the *variable* 'check:LanWarden-Host-State'. Replacing it with "%{check:LanWarden-Host-State}" (or 'control:LanWarden-Host-State') works around the problem however I was say that either that phrase 'looking for check items...' needs amending, or the code to be tweaked to align the behaviour of unlang to treat control/check equally. I vaguely recall that 'check' is depreated in favour 'control' however in it's current state the logic leads to madness...as I found out this morning :-/ Cheers -- Alexander Clouter .sigmonster says: Satire does not look pretty upon a tombstone.

2 3

src_ipaddr with proxies
by Alexander Clouter 13 Sep '10

13 Sep '10

Hi, Found a bug in 2.1.9 (is is the Debian squeeze release), probably due to my mis-use of src_ipaddr in the home_server stanza. My proxy definition looks like: ---- templates { eduroam-proxy { type = auth+acct port = 1812 require_message_authenticator = yes status_check = status-server } eduroam-proxy6 { src_ipaddr = ${local.MY.addr.eduroam.v6} $template eduroam-proxy } eduroam-proxy4 { src_ipaddr = ${local.MY.addr.eduroam.v4} $template eduroam-proxy } } home_server jrs.0.v6 { ipv6addr = ${local.jrs.0.addr.v6} secret = ${local.jrs.0.secret} $template eduroam-proxy6 } home_server jrs.0.v4 { ipaddr = ${local.jrs.0.addr.v4} secret = ${local.jrs.0.secret} $template eduroam-proxy4 } [snipped] ---- This seems to cause FreeRADIUS to spin when opening the proxy sockets, the output ---- root@chlorine:/etc/freeradius# gdb /usr/sbin/freeradius GNU gdb (GDB) 7.0.1-debian Copyright (C) 2009 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "arm-linux-gnueabi". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /usr/sbin/freeradius...Reading symbols from /usr/lib/debug/usr/sbin/freeradius...done. (no debugging symbols found)...done. (gdb) run -X Starting program: /usr/sbin/freeradius -X [snipped] listen { type = "acct" ipaddr = 212.219.238.5 port = 0 clients = "eduroam" } ^C <--- hangs Program received signal SIGINT, Interrupt. 0x0000e614 in fr_ipaddr_cmp () at misc.c:543 543 misc.c: No such file or directory. in misc.c (gdb) where #0 0x0000e614 in fr_ipaddr_cmp () at misc.c:543 #1 0x00019f44 in proxy_new_listener (ipaddr=0x137430, exists=1) at listen.c:1726 #2 0x0002eb90 in home_server_create_callback (ctx=0x140a98, data=<value optimized out>) at realms.c:2214 #3 0x40035930 in WalkNodeInOrder (X=0x137228, callback=0x2eb6c <home_server_create_callback>, context=0x140a98) at rbtree.c:544 #4 0x40035918 in WalkNodeInOrder (X=0x5c838, callback=0x2eb6c <home_server_create_callback>, context=0x140a98) at rbtree.c:540 #5 0x40035918 in WalkNodeInOrder (X=0x5ca08, callback=0x2eb6c <home_server_create_callback>, context=0x140a98) at rbtree.c:540 #6 0x0002eb24 in home_server_create_listeners (ctx=<value optimized out>) at realms.c:2244 #7 0x0001a6ac in listen_init (config=0x4c020, head=0xbee39b2c) at listen.c:2194 #8 0x0002ab40 in radius_event_init (cs=0x4c020, spawn_flag=0) at event.c:3599 #9 0x000223fc in main (argc=2, argv=<value optimized out>) at radiusd.c:328 (gdb) ---- If I remove the 'src_ipaddr' entries from my templates then things run as normal; however as my RADIUS server has ten IP addresses, without this it is completely un-usabled. If I move the 'src_ipaddr' entry explicitly into my 'home_server' stanza, then I get an assert(): ---- [snipped] listen { type = "acct" ipaddr = 212.219.238.5 port = 0 clients = "eduroam" } Listening on authentication address ::1 port 1812 as server eduroam Listening on authentication address 2001:630:1b:6003:372d:f782:e3d9:ae6 port 1812 as server eduroam Listening on authentication address 212.219.238.5 port 1812 as server eduroam Listening on accounting address 2001:630:1b:6003:372d:f782:e3d9:ae6 port 1813 as server eduroam Listening on accounting address 212.219.238.5 port 1813 as server eduroam Listening on proxy address ::1 port 1814 Listening on proxy address 2001:630:1b:6003:372d:f782:e3d9:ae6 port 55212 Listening on proxy address 2001:630:1b:6003:372d:f782:e3d9:ae6 port 39406 ASSERT FAILED event.c[3639]: proxy_fds[this->fd & 0x1f] == -1 Aborted ---- Further investigation shows that if I have more than one 'src_ipaddr' entry present, I get no assert() and things spin again. So the spin bug seems unrelated to my templating, but is triggered as the template creates multiple src_ipaddr's, whilst I cannot use a single src_ipaddr as I end up with an assert(). Cheers -- Alexander Clouter .sigmonster says: Optimization hinders evolution.

2 7

Can some one explain me about PDFID and SDFID
by aleem 10 Sep '10

10 Sep '10

Hi All, I Am a newbie , dont know much about the WiMAX.Can any one explain me in detail about the packet data flow ID(PDFID) and service data flow ID(SDFID) in WiMAX. One more thing can we send multiple Service-ID attributes in a single request/response.If yes how? Any kind of help would be aprreciated.Thanks in advance. Regards, Aleem. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Can-some-one-explain-me-about-PDFID… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

2 3

Hanging Problem in 2.1.10
by David Mitchell 10 Sep '10

10 Sep '10

Alan, I had a hang pretty quickly this time. As last time, the last output was that it the 'entering group authenticate' section. I got the bt output. I'm not sure if it's helpful or not. I just re-read doc/bugs and will try it again with gdb logging enabled. I'm not sure if that will help or not. Thu Aug 26 08:33:10 2010 : Info: # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default Thu Aug 26 08:33:10 2010 : Info: +- entering group authorize {...} Thu Aug 26 08:33:10 2010 : Info: ++[preprocess] returns ok Thu Aug 26 08:33:10 2010 : Info: [suffix] No '@' in User-Name = "mark", looking up realm NULL Thu Aug 26 08:33:10 2010 : Info: [suffix] Found realm "~.+$" Thu Aug 26 08:33:10 2010 : Info: [suffix] Adding Stripped-User-Name = "mark" Thu Aug 26 08:33:10 2010 : Info: [suffix] Adding Realm = "(null)" Thu Aug 26 08:33:10 2010 : Info: [suffix] Authentication realm is LOCAL. Thu Aug 26 08:33:10 2010 : Info: ++[suffix] returns ok Thu Aug 26 08:33:10 2010 : Info: [eap] EAP packet type response id 2 length 136 Thu Aug 26 08:33:10 2010 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Thu Aug 26 08:33:10 2010 : Info: ++[eap] returns updated Thu Aug 26 08:33:10 2010 : Info: ++[files] returns noop Thu Aug 26 08:33:10 2010 : Info: Found Auth-Type = EAP Thu Aug 26 08:33:10 2010 : Info: # Executing group from file /usr/local/etc/raddb/sites-enabled/default Thu Aug 26 08:33:10 2010 : Info: +- entering group authenticate {...} ^C Program received signal SIGINT, Interrupt. [Switching to Thread 0xb75af8c0 (LWP 14706)] 0xb77b7424 in __kernel_vsyscall () (gdb) bt #0 0xb77b7424 in __kernel_vsyscall () #1 0xb7752c99 in __lll_lock_wait () from /lib/i686/cmov/libpthread.so.0 #2 0xb774e0c4 in _L_lock_89 () from /lib/i686/cmov/libpthread.so.0 #3 0xb774d9f2 in pthread_mutex_lock () from /lib/i686/cmov/libpthread.so.0 #4 0xb75ac26f in eap_handler_free (inst=0x827fd98, handler=0x82af1a8) at mem.c:137 #5 0xb75ac3d5 in eaplist_expire (inst=0x827fd98, timestamp=1282833190) at mem.c:315 #6 0xb75ac856 in eaplist_find (inst=0x827fd98, request=0x82cee78, eap_packet=0x82ccc40) at mem.c:502 #7 0xb75aa76f in eap_handler (inst=0x827fd98, eap_packet_p=0xbfffd118, request=0x82cee78) at eap.c:974 #8 0xb75a9d80 in eap_authenticate (instance=0x827fd98, request=0x82cee78) at rlm_eap.c:298 #9 0x08089bbc in modcall (component=0, c=0x8293f88, request=0x82cee78) at modcall.c:297 #10 0x0808651b in indexed_modcall (comp=0, idx=6, request=0x82cee78) at modules.c:728 #11 0x0808692c in module_authenticate (auth_type=6, request=0x82cee78) at modules.c:1502 #12 0x080753c4 in rad_authenticate (request=0x82cee78) at auth.c:371 #13 0x08095854 in radius_handle_request (request=0x82cee78, fun=0x8074a10 <rad_authenticate>) at event.c:3767 #14 0x0808c9bf in thread_pool_addrequest (request=0x82cee78, fun=0x8074a10 <rad_authenticate>) at threads.c:874 #15 0x08091f7a in event_socket_handler (xel=0x82980a8, fd=7, ctx=0x829bb40) at event.c:3412 #16 0xb77a808c in fr_event_loop (el=0x82980a8) at event.c:411 #17 0x08092df6 in radius_event_process () at event.c:3753 #18 0x0808a782 in main (argc=2, argv=0xbfffe5a4) at radiusd.c:406 (gdb) -- ----------------------------------------------------------------- | David Mitchell (mitchell(a)ucar.edu) Network Engineer IV | | Tel: (303) 497-1845 National Center for | | FAX: (303) 497-1818 Atmospheric Research | -----------------------------------------------------------------

2 4

Loggint ntlm authentication
by Garber, Neal 10 Sep '10

10 Sep '10

Thread continued from freeradius-users list.. As I mentioned previously, I have the PEAP changes completed to save/retrieve reply attributes on authentication failure. I've examined the TTLS code and I have a question. The code to retrieve the saved reply attributes is done in a different place in the authenticate function as compared to the PEAP code. I'm wondering if this was intentional? If not, do you see a problem moving this code from the switch on status == EAPTLS_SUCCESS to the switch on rcode == PW_AUTHENTICATION_ACK (which was changed from RLM_MODULE_OK in ttls.c:eapttls_process)? I would then add similar code to the rcode == PW_AUTHENTICATION_REJECT to retrieve the saved reply attributes. Alternatively, I could add EAPTLS_FAIL to the switch on status and retrieve the attributes in that block (and then return 0 as it does in the default block). I'm looking for some advice because I have no way of testing/debugging the TTLS code and I'm concerned about breaking it. I'm also concerned because the code in the switch on status "returns" on EAPTLS_SUCCESS in rlm_eap_ttls whereas it falls through in rlm_eap_peap to the switch on rcode (TTLS only falls through when status == EAPTLS_OK). Thanks..

2 3

Memory leak
by James Devine 10 Sep '10

10 Sep '10

I've noticed if I set a hint such as DEFAULT NAS-IP-Address := "%{Packet-Src-IP-Address}" I end up with a memory leak that valgrind shows as: ==14825== 429,936 bytes in 1,378 blocks are definitely lost in loss record 332 of 332 ==14825== at 0x4C284A8: malloc (vg_replace_malloc.c:236) ==14825== by 0x4E433C4: paircopyvp (valuepair.c:318) ==14825== by 0x4E43484: paircopy2 (valuepair.c:351) ==14825== by 0x88B5733: hints_setup (rlm_preprocess.c:350) ==14825== by 0x88B59F1: preprocess_authorize (rlm_preprocess.c:562) ==14825== by 0x41B824: modcall (modcall.c:297) ==14825== by 0x4182B5: indexed_modcall (modules.c:716) ==14825== by 0x4090D5: rad_authenticate (auth.c:565) ==14825== by 0x425F44: radius_handle_request (event.c:3735) ==14825== by 0x41DEB4: thread_pool_addrequest (threads.c:842) ==14825== by 0x4272FD: event_socket_handler (event.c:3384) ==14825== by 0x4E46EEA: fr_event_loop (event.c:411) I tested this on freeradius 2.1.9

2 1

[PATCH] Updating dictionary.erx based on Juniper documentation
by Bjørn Mork 09 Sep '10

09 Sep '10

Also adding a note about JUNOS (M/MX) usage of this dictionary. Signed-off-by: Bjørn Mork <bjorn(a)mork.no> --- share/dictionary.erx | 23 +++++++++++++++++++++++ 1 files changed, 23 insertions(+), 0 deletions(-) diff --git a/share/dictionary.erx b/share/dictionary.erx index a7c84de..93584d2 100644 --- a/share/dictionary.erx +++ b/share/dictionary.erx @@ -7,6 +7,15 @@ # # Version: $Id$ # + +# This dictionary applies to access services on Juniper JUNOS (M/MX) +# based platforms as well as JUNOSe, although some of the attributes +# have been given new names on JUNOS: +# http://www.juniper.net/techpubs/en_US/junos10.3/topics/reference/general/aa… +# +# In this file, we keep the ERX prefix and the JUNOSe attribute names +# for backwards compatibility +# # Juniper ERX dictionaries are available at: # http://www.juniper.net/techpubs/software/erx/junose71/unisphere7-1.dct # http://www.juniper.net/techpubs/software/erx/junose700/unisphere7-0.dct @@ -156,6 +165,10 @@ ATTRIBUTE ERX-IGMP-No-Tracking-V2-Grps 103 integer ATTRIBUTE ERX-MLD-Explicit-Tracking 104 integer ATTRIBUTE ERX-MLD-No-Tracking-V1-Grps 105 integer +ATTRIBUTE ERX-IPv6-Ingress-Policy-Name 106 string +ATTRIBUTE ERX-IPv6-Egress-Policy-Name 107 string +ATTRIBUTE ERX-CoS-Shaping-Pmt-Type 108 string + ATTRIBUTE ERX-Acc-Loop-Cir-Id 110 string ATTRIBUTE ERX-Acc-Aggr-Cir-Id-Bin 111 octets ATTRIBUTE ERX-Acc-Aggr-Cir-Id-Asc 112 string @@ -187,6 +200,16 @@ ATTRIBUTE ERX-Max-Clients-Per-Interface 143 integer ATTRIBUTE ERX-PPP-Monitor-Ingress-Only 144 integer +ATTRIBUTE ERX-CoS-Scheduler-Pmt-Type 146 string + +ATTRIBUTE ERX-IPv6-Acct-Input-Octets 151 integer +ATTRIBUTE ERX-IPv6-Acct-Output-Octets 152 integer +ATTRIBUTE ERX-IPv6-Acct-Input-Packets 153 integer +ATTRIBUTE ERX-IPv6-Acct-Output-Packets 154 integer +ATTRIBUTE ERX-IPv6-Acct-Input-Gigawords 155 integer +ATTRIBUTE ERX-IPv6-Acct-Output-Gigawords 156 integer +ATTRIBUTE ERX-IPv6-NdRa-Pool-Name 157 string + # # Values Attribute Name Number -- 1.7.1

2 2

Additional EAP-TLS Logging Option
by Ross, Michael 08 Sep '10

08 Sep '10

Hello, I customized a freeradius installation to include an option to log information from the client certificates (subject, issuer, serial, expiration) when doing eap-tls authentication. This is done through a new option, log_certificates, in the tls section of the eap.conf file. Is there any interest in adding this capability into the baseline freeradius? I'm happy to make any changes that would be required to do that. Below are the updated rlm_eap_tls.h and rlm_eap_tls.c. Thanks, Mike Ross /* * rlm_eap_tls.h * * Version: $Id: rlm_eap_tls.h,v 1.13 2007/04/25 14:19:26 aland Exp $ * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA * * Copyright 2001 hereUare Communications, Inc. <raghud(a)hereuare.com> * Copyright 2003 Alan DeKok <aland(a)freeradius.org> * Copyright 2006 The FreeRADIUS server project * *----------------------------------------------------------------------------- * Modified by The Boeing Company, August 26, 2008 * * Added int log_certificates to the eap_tls_conf struct * * Copyright 2008 The Boeing Company <Michael.Ross2(a)boeing.com> *----------------------------------------------------------------------------- */ #ifndef _RLM_EAP_TLS_H #define _RLM_EAP_TLS_H #include <freeradius-devel/ident.h> RCSIDH(rlm_eap_tls_h, "$Id: rlm_eap_tls.h,v 1.13 2007/04/25 14:19:26 aland Exp $") #include "eap_tls.h" #include <freeradius-devel/radiusd.h> #include <freeradius-devel/modules.h> /* configured values goes right here */ typedef struct eap_tls_conf { char *private_key_password; char *private_key_file; char *certificate_file; char *random_file; char *ca_path; char *ca_file; char *dh_file; char *rsa_file; char *make_cert_command; int rsa_key; int dh_key; int rsa_key_length; int dh_key_length; int verify_depth; int file_type; int include_length; /* * Always < 4096 (due to radius limit), 0 by default = 2048 */ int fragment_size; int check_crl; char *check_cert_cn; char *cipher_list; char *check_cert_issuer; int log_certificates; /* log_certificates added by Boeing, 9/26/2008 */ } EAP_TLS_CONF; /* This structure gets stored in arg */ typedef struct _eap_tls_t { EAP_TLS_CONF *conf; SSL_CTX *ctx; } eap_tls_t; #endif /* _RLM_EAP_TLS_H */ /* * rlm_eap_tls.c contains the interfaces that are called from eap * * Version: $Id: rlm_eap_tls.c,v 1.54 2008/03/22 08:31:03 aland Exp $ * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA * * Copyright 2001 hereUare Communications, Inc. <raghud(a)hereuare.com> * Copyright 2003 Alan DeKok <aland(a)freeradius.org> * Copyright 2006 The FreeRADIUS server project * *----------------------------------------------------------------------------- * Modified by The Boeing Company, August 26, 2008 * * Added log_certificates to module_config CONF_PARSER * Added additional authentication logging into cbtls_verify * Added log_full_cert function to write certificate into log file * * Copyright 2008 The Boeing Company <Michael.Ross2(a)boeing.com> *----------------------------------------------------------------------------- */ #include <freeradius-devel/ident.h> RCSID("$Id: rlm_eap_tls.c,v 1.54 2008/03/22 08:31:03 aland Exp $") #include <freeradius-devel/autoconf.h> #ifdef HAVE_OPENSSL_RAND_H #include <openssl/rand.h> #endif #include "rlm_eap_tls.h" #ifdef HAVE_SYS_STAT_H #include <sys/stat.h> #endif static CONF_PARSER module_config[] = { { "rsa_key_exchange", PW_TYPE_BOOLEAN, offsetof(EAP_TLS_CONF, rsa_key), NULL, "no" }, { "dh_key_exchange", PW_TYPE_BOOLEAN, offsetof(EAP_TLS_CONF, dh_key), NULL, "yes" }, { "rsa_key_length", PW_TYPE_INTEGER, offsetof(EAP_TLS_CONF, rsa_key_length), NULL, "512" }, { "dh_key_length", PW_TYPE_INTEGER, offsetof(EAP_TLS_CONF, dh_key_length), NULL, "512" }, { "verify_depth", PW_TYPE_INTEGER, offsetof(EAP_TLS_CONF, verify_depth), NULL, "0" }, { "CA_path", PW_TYPE_FILENAME, offsetof(EAP_TLS_CONF, ca_path), NULL, NULL }, { "pem_file_type", PW_TYPE_BOOLEAN, offsetof(EAP_TLS_CONF, file_type), NULL, "yes" }, { "private_key_file", PW_TYPE_FILENAME, offsetof(EAP_TLS_CONF, private_key_file), NULL, NULL }, { "certificate_file", PW_TYPE_FILENAME, offsetof(EAP_TLS_CONF, certificate_file), NULL, NULL }, { "CA_file", PW_TYPE_FILENAME, offsetof(EAP_TLS_CONF, ca_file), NULL, NULL }, { "private_key_password", PW_TYPE_STRING_PTR, offsetof(EAP_TLS_CONF, private_key_password), NULL, NULL }, { "dh_file", PW_TYPE_STRING_PTR, offsetof(EAP_TLS_CONF, dh_file), NULL, NULL }, { "random_file", PW_TYPE_STRING_PTR, offsetof(EAP_TLS_CONF, random_file), NULL, NULL }, { "fragment_size", PW_TYPE_INTEGER, offsetof(EAP_TLS_CONF, fragment_size), NULL, "1024" }, { "include_length", PW_TYPE_BOOLEAN, offsetof(EAP_TLS_CONF, include_length), NULL, "yes" }, { "check_crl", PW_TYPE_BOOLEAN, offsetof(EAP_TLS_CONF, check_crl), NULL, "no"}, { "check_cert_cn", PW_TYPE_STRING_PTR, offsetof(EAP_TLS_CONF, check_cert_cn), NULL, NULL}, { "cipher_list", PW_TYPE_STRING_PTR, offsetof(EAP_TLS_CONF, cipher_list), NULL, NULL}, { "check_cert_issuer", PW_TYPE_STRING_PTR, offsetof(EAP_TLS_CONF, check_cert_issuer), NULL, NULL}, { "make_cert_command", PW_TYPE_STRING_PTR, offsetof(EAP_TLS_CONF, make_cert_command), NULL, NULL}, /* log_certificates added by Boeing, 9/26/2008 */ { "log_certificates", PW_TYPE_BOOLEAN, offsetof(EAP_TLS_CONF, log_certificates), NULL, "no" }, { NULL, -1, 0, NULL, NULL } /* end the list */ }; /* * log_full_cert added by Boeing, 9/26/2008 * * Write the certificate serial number, expiration * date, issuer, and subject to the log file */ static int log_full_cert(int ok, X509 *cert) { const int ub_serial = 20; const int ub_time = 15; char serialNumber[2*ub_serial+1]; char expiration[ub_time+1]; char issuer[ub_name+1]; char subject[ub_name+1]; char *pTemp = NULL; int local_ok = ok; int i = 0; ASN1_INTEGER *pSn = NULL; ASN1_TIME *pTime = NULL; /* * Get the Serial Number and format for display */ serialNumber[0] = '\0'; pSn = X509_get_serialNumber(cert); pTemp = serialNumber; if ( pSn == NULL || pSn->length > ub_serial ) { radlog(L_AUTH, "rlm_eap_tls: Malformed Certificate Serial Number"); local_ok = 0; } else { for (i = 0; i < pSn->length; i++) { sprintf(pTemp, "%02x", (int)pSn->data[i]); pTemp += 2; } } /* * Get the Expiration Date and format for display */ expiration[0] = '\0'; pTime = X509_get_notAfter(cert); if ( pTime == NULL || pTime->length > ub_time ) { radlog(L_AUTH, "rlm_eap_tls: Malformed Certificate Expiration"); local_ok = 0; } else { strncpy(expiration, pTime->data, pTime->length); expiration[pTime->length] = '\0'; } /* * Get the Issuer */ issuer[0] = '\0'; X509_NAME_oneline(X509_get_issuer_name(cert), issuer, ub_name); issuer[0] = ' '; issuer[ub_name] = '\0'; for (i = 0; i < ub_name; i++) { if (issuer[i] == '/') { issuer[i] = ','; } } /* * Get the Subject */ subject[0] = '\0'; X509_NAME_oneline(X509_get_subject_name(cert), subject, ub_name); subject[0] = ' '; subject[ub_name] = '\0'; for (i = 0; i < ub_name; i++) { if (subject[i] == '/') { subject[i] = ','; } } /* * Log required attributes */ radlog(L_AUTH, "Certificate: Serial=%s; Expiration=%s; Issuer:%s; Subject:%s", serialNumber, expiration, issuer, subject); return local_ok; } /* * TODO: Check for the type of key exchange * like conf->dh_key */ static int load_dh_params(SSL_CTX *ctx, char *file) { DH *dh = NULL; BIO *bio; if ((bio = BIO_new_file(file, "r")) == NULL) { radlog(L_ERR, "rlm_eap_tls: Unable to open DH file - %s", file); return -1; } dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL); BIO_free(bio); if (!dh) { DEBUG2("WARNING: rlm_eap_tls: Unable to set DH parameters. DH cipher suites may not work!"); DEBUG2("WARNING: Fix this by running the OpenSSL command listed in eap.conf"); return 0; } if (SSL_CTX_set_tmp_dh(ctx, dh) < 0) { radlog(L_ERR, "rlm_eap_tls: Unable to set DH parameters"); DH_free(dh); return -1; } DH_free(dh); return 0; } /* * Before trusting a certificate, you must make sure that the * certificate is 'valid'. There are several steps that your * application can take in determining if a certificate is * valid. Commonly used steps are: * * 1.Verifying the certificate's signature, and verifying that * the certificate has been issued by a trusted Certificate * Authority. * * 2.Verifying that the certificate is valid for the present date * (i.e. it is being presented within its validity dates). * * 3.Verifying that the certificate has not been revoked by its * issuing Certificate Authority, by checking with respect to a * Certificate Revocation List (CRL). * * 4.Verifying that the credentials presented by the certificate * fulfill additional requirements specific to the application, * such as with respect to access control lists or with respect * to OCSP (Online Certificate Status Processing). * * NOTE: This callback will be called multiple times based on the * depth of the root certificate chain */ static int cbtls_verify(int ok, X509_STORE_CTX *ctx) { char subject[1024]; /* Used for the subject name */ char issuer[1024]; /* Used for the issuer name */ char common_name[1024]; char cn_str[1024]; EAP_HANDLER *handler = NULL; X509 *client_cert; SSL *ssl; int err, depth; EAP_TLS_CONF *conf; int my_ok = ok; client_cert = X509_STORE_CTX_get_current_cert(ctx); err = X509_STORE_CTX_get_error(ctx); depth = X509_STORE_CTX_get_error_depth(ctx); /* * Moved below the conf check by Boeing, 9/26/2008 */ /* *if (!my_ok) { * radlog(L_ERR,"--> verify error:num=%d:%s\n",err, * X509_verify_cert_error_string(err)); * return my_ok; *} */ /* * Retrieve the pointer to the SSL of the connection currently treated * and the application specific data stored into the SSL object. */ ssl = X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx()); handler = (EAP_HANDLER *)SSL_get_ex_data(ssl, 0); conf = (EAP_TLS_CONF *)SSL_get_ex_data(ssl, 1); /* * Copied from above by Boeing, 9/26/2008 */ if (!my_ok) { radlog(L_ERR,"--> verify error:num=%d:%s\n",err, X509_verify_cert_error_string(err)); /* * Added by Boeing, 9/26/2008 * If the config file is set to log certificates * log the certificate if there has been an authentication * error */ if (conf->log_certificates) { log_full_cert(my_ok, client_cert); } return my_ok; } /* * Get the Subject & Issuer */ subject[0] = issuer[0] = '\0'; X509_NAME_oneline(X509_get_subject_name(client_cert), subject, sizeof(subject)); X509_NAME_oneline(X509_get_issuer_name(ctx->current_cert), issuer, sizeof(issuer)); subject[sizeof(subject) - 1] = '\0'; issuer[sizeof(issuer) - 1] = '\0'; /* * Get the Common Name */ X509_NAME_get_text_by_NID(X509_get_subject_name(client_cert), NID_commonName, common_name, sizeof(common_name)); common_name[sizeof(common_name) - 1] = '\0'; switch (ctx->error) { case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT: radlog(L_ERR, "issuer= %s\n", issuer); break; case X509_V_ERR_CERT_NOT_YET_VALID: case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD: radlog(L_ERR, "notBefore="); #if 0 ASN1_TIME_print(bio_err, X509_get_notBefore(ctx->current_cert)); #endif break; case X509_V_ERR_CERT_HAS_EXPIRED: case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD: radlog(L_ERR, "notAfter="); #if 0 ASN1_TIME_print(bio_err, X509_get_notAfter(ctx->current_cert)); #endif break; } /* * If we're at the actual client cert, apply additional * checks. */ if (depth == 0) { /* * If the conf tells us to, check cert issuer * against the specified value and fail * verification if they don't match. */ if (conf->check_cert_issuer && (strcmp(issuer, conf->check_cert_issuer) != 0)) { radlog(L_AUTH, "rlm_eap_tls: Certificate issuer (%s) does not match specified value (%s)!", issuer, conf->check_cert_issuer); my_ok = 0; } /* * If the conf tells us to, check the CN in the * cert against xlat'ed value, but only if the * previous checks passed. */ if (my_ok && conf->check_cert_cn) { if (!radius_xlat(cn_str, sizeof(cn_str), conf->check_cert_cn, handler->request, NULL)) { radlog(L_ERR, "rlm_eap_tls (%s): xlat failed.", conf->check_cert_cn); /* if this fails, fail the verification */ my_ok = 0; } else { DEBUG2(" rlm_eap_tls: checking certificate CN (%s) with xlat'ed value (%s)", common_name, cn_str); if (strcmp(cn_str, common_name) != 0) { radlog(L_AUTH, "rlm_eap_tls: Certificate CN (%s) does not match specified value (%s)!", common_name, cn_str); my_ok = 0; } } } /* check_cert_cn */ /* * Added by Boeing, 9/26/2008 * If the config file is set to log certificates * log the certificate */ if (conf->log_certificates) { my_ok = log_full_cert(my_ok, client_cert); } } /* depth == 0 */ if (debug_flag > 0) { DEBUG2("chain-depth=%d, ", depth); DEBUG2("error=%d", err); DEBUG2("--> User-Name = %s", handler->identity); DEBUG2("--> BUF-Name = %s", common_name); DEBUG2("--> subject = %s", subject); DEBUG2("--> issuer = %s", issuer); DEBUG2("--> verify return:%d", my_ok); } return my_ok; } /* * Create Global context SSL and use it in every new session * * - Load the trusted CAs * - Load the Private key & the certificate * - Set the Context options & Verify options */ static SSL_CTX *init_tls_ctx(EAP_TLS_CONF *conf) { SSL_METHOD *meth; SSL_CTX *ctx; X509_STORE *certstore; int verify_mode = SSL_VERIFY_NONE; int ctx_options = 0; int type; /* * Add all the default ciphers and message digests * Create our context. */ SSL_library_init(); SSL_load_error_strings(); meth = TLSv1_method(); ctx = SSL_CTX_new(meth); /* * Identify the type of certificates that needs to be loaded */ if (conf->file_type) { type = SSL_FILETYPE_PEM; } else { type = SSL_FILETYPE_ASN1; } /* * Set the password to load private key */ if (conf->private_key_password) { SSL_CTX_set_default_passwd_cb_userdata(ctx, conf->private_key_password); SSL_CTX_set_default_passwd_cb(ctx, cbtls_password); } /* * Load our keys and certificates * * If certificates are of type PEM then we can make use * of cert chain authentication using openssl api call * SSL_CTX_use_certificate_chain_file. Please see how * the cert chain needs to be given in PEM from * openSSL.org */ if (type == SSL_FILETYPE_PEM) { if (!(SSL_CTX_use_certificate_chain_file(ctx, conf->certificate_file))) { radlog(L_ERR, "rlm_eap: SSL error %s", ERR_error_string(ERR_get_error(), NULL)); radlog(L_ERR, "rlm_eap_tls: Error reading certificate file %s", conf->certificate_file); return NULL; } } else if (!(SSL_CTX_use_certificate_file(ctx, conf->certificate_file, type))) { radlog(L_ERR, "rlm_eap: SSL error %s", ERR_error_string(ERR_get_error(), NULL)); radlog(L_ERR, "rlm_eap_tls: Error reading certificate file %s", conf->certificate_file); return NULL; } /* Load the CAs we trust */ if (!SSL_CTX_load_verify_locations(ctx, conf->ca_file, conf->ca_path)) { radlog(L_ERR, "rlm_eap: SSL error %s", ERR_error_string(ERR_get_error(), NULL)); radlog(L_ERR, "rlm_eap_tls: Error reading Trusted root CA list %s",conf->ca_file ); return NULL; } if (conf->ca_file && *conf->ca_file) SSL_CTX_set_client_CA_list(ctx, SSL_load_client_CA_file(conf->ca_file)); if (!(SSL_CTX_use_PrivateKey_file(ctx, conf->private_key_file, type))) { radlog(L_ERR, "rlm_eap: SSL error %s", ERR_error_string(ERR_get_error(), NULL)); radlog(L_ERR, "rlm_eap_tls: Error reading private key file %s", conf->private_key_file); return NULL; } /* * Check if the loaded private key is the right one */ if (!SSL_CTX_check_private_key(ctx)) { radlog(L_ERR, "rlm_eap_tls: Private key does not match the certificate public key"); return NULL; } /* * Set ctx_options */ ctx_options |= SSL_OP_NO_SSLv2; ctx_options |= SSL_OP_NO_SSLv3; /* * SSL_OP_SINGLE_DH_USE must be used in order to prevent * small subgroup attacks and forward secrecy. Always * using * * SSL_OP_SINGLE_DH_USE has an impact on the computer * time needed during negotiation, but it is not very * large. */ ctx_options |= SSL_OP_SINGLE_DH_USE; /* * SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS to work around issues * in Windows Vista client. * http://www.openssl.org/~bodo/tls-cbc.txt * http://www.nabble.com/(RADIATOR)-Radiator-Version-3.16-released-t2600070.ht… */ ctx_options |= SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; SSL_CTX_set_options(ctx, ctx_options); /* * TODO: Set the RSA & DH * SSL_CTX_set_tmp_rsa_callback(ctx, cbtls_rsa); * SSL_CTX_set_tmp_dh_callback(ctx, cbtls_dh); */ /* * set the message callback to identify the type of * message. For every new session, there can be a * different callback argument. * * SSL_CTX_set_msg_callback(ctx, cbtls_msg); */ /* Set Info callback */ SSL_CTX_set_info_callback(ctx, cbtls_info); /* * Check the certificates for revocation. */ #ifdef X509_V_FLAG_CRL_CHECK if (conf->check_crl) { certstore = SSL_CTX_get_cert_store(ctx); if (certstore == NULL) { radlog(L_ERR, "rlm_eap: SSL error %s", ERR_error_string(ERR_get_error(), NULL)); radlog(L_ERR, "rlm_eap_tls: Error reading Certificate Store"); return NULL; } X509_STORE_set_flags(certstore, X509_V_FLAG_CRL_CHECK); } #endif /* * Set verify modes * Always verify the peer certificate */ verify_mode |= SSL_VERIFY_PEER; verify_mode |= SSL_VERIFY_FAIL_IF_NO_PEER_CERT; verify_mode |= SSL_VERIFY_CLIENT_ONCE; SSL_CTX_set_verify(ctx, verify_mode, cbtls_verify); if (conf->verify_depth) { SSL_CTX_set_verify_depth(ctx, conf->verify_depth); } /* Load randomness */ if (!(RAND_load_file(conf->random_file, 1024*1024))) { radlog(L_ERR, "rlm_eap: SSL error %s", ERR_error_string(ERR_get_error(), NULL)); radlog(L_ERR, "rlm_eap_tls: Error loading randomness"); return NULL; } /* * Set the cipher list if we were told to */ if (conf->cipher_list) { if (!SSL_CTX_set_cipher_list(ctx, conf->cipher_list)) { radlog(L_ERR, "rlm_eap_tls: Error setting cipher list"); return NULL; } } return ctx; } /* * Detach the EAP-TLS module. */ static int eaptls_detach(void *arg) { EAP_TLS_CONF *conf; eap_tls_t *inst; inst = (eap_tls_t *) arg; conf = inst->conf; if (conf) { memset(conf, 0, sizeof(*conf)); free(inst->conf); inst->conf = NULL; } if (inst->ctx) SSL_CTX_free(inst->ctx); inst->ctx = NULL; free(inst); return 0; } /* * Attach the EAP-TLS module. */ static int eaptls_attach(CONF_SECTION *cs, void **instance) { EAP_TLS_CONF *conf; eap_tls_t *inst; /* Store all these values in the data structure for later references */ inst = (eap_tls_t *)malloc(sizeof(*inst)); if (!inst) { radlog(L_ERR, "rlm_eap_tls: out of memory"); return -1; } memset(inst, 0, sizeof(*inst)); /* * Parse the config file & get all the configured values */ conf = (EAP_TLS_CONF *)malloc(sizeof(*conf)); if (conf == NULL) { free(inst); radlog(L_ERR, "rlm_eap_tls: out of memory"); return -1; } memset(conf, 0, sizeof(*conf)); inst->conf = conf; if (cf_section_parse(cs, conf, module_config) < 0) { eaptls_detach(inst); return -1; } /* * The EAP RFC's say 1020, but we're less picky. */ if (conf->fragment_size < 100) { radlog(L_ERR, "rlm_eap_tls: Fragment size is too small."); eaptls_detach(inst); return -1; } /* * The maximum size for a RADIUS packet is 4096, * minus the header (20), Message-Authenticator (18), * and State (18), etc. results in about 4000 bytes of data * that can be devoted *solely* to EAP. */ if (conf->fragment_size > 4000) { radlog(L_ERR, "rlm_eap_tls: Fragment size is too large."); eaptls_detach(inst); return -1; } /* * Account for the EAP header (4), and the EAP-TLS header * (6), as per Section 4.2 of RFC 2716. What's left is * the maximum amount of data we read from a TLS buffer. */ conf->fragment_size -= 10; /* * This magic makes the administrators life HUGELY easier * on initial deployments. * * If the server starts up in debugging mode, AND the * bootstrap command is configured, AND it exists, AND * there is no server certificate */ if (conf->make_cert_command && (debug_flag >= 2)) { struct stat buf; if ((stat(conf->make_cert_command, &buf) == 0) && (stat(conf->certificate_file, &buf) < 0) && (errno == ENOENT) && (radius_exec_program(conf->make_cert_command, NULL, 1, NULL, 0, NULL, NULL, 0) != 0)) { eaptls_detach(inst); return -1; } } /* * Initialize TLS */ inst->ctx = init_tls_ctx(conf); if (inst->ctx == NULL) { eaptls_detach(inst); return -1; } if (load_dh_params(inst->ctx, conf->dh_file) < 0) { eaptls_detach(inst); return -1; } *instance = inst; return 0; } /* * Send an initial eap-tls request to the peer. * * Frame eap reply packet. * len = header + type + tls_typedata * tls_typedata = flags(Start (S) bit set, and no data) * * Once having received the peer's Identity, the EAP server MUST * respond with an EAP-TLS/Start packet, which is an * EAP-Request packet with EAP-Type=EAP-TLS, the Start (S) bit * set, and no data. The EAP-TLS conversation will then begin, * with the peer sending an EAP-Response packet with * EAP-Type = EAP-TLS. The data field of that packet will * be the TLS data. * * Fragment length is Framed-MTU - 4. * * http://mail.frascone.com/pipermail/public/eap/2003-July/001426.html */ static int eaptls_initiate(void *type_arg, EAP_HANDLER *handler) { int status; tls_session_t *ssn; eap_tls_t *inst; VALUE_PAIR *vp; int client_cert = TRUE; int verify_mode = 0; inst = (eap_tls_t *)type_arg; /* * If we're TTLS or PEAP, then do NOT require a client * certificate. * * FIXME: This should be more configurable. */ if (handler->eap_type != PW_EAP_TLS) { vp = pairfind(handler->request->config_items, PW_EAP_TLS_REQUIRE_CLIENT_CERT); if (!vp) { client_cert = FALSE; } else { client_cert = vp->vp_integer; } } /* * Every new session is started only from EAP-TLS-START. * Before Sending EAP-TLS-START, open a new SSL session. * Create all the required data structures & store them * in Opaque. So that we can use these data structures * when we get the response */ ssn = eaptls_new_session(inst->ctx, client_cert); if (!ssn) { return 0; } /* * Verify the peer certificate, if asked. */ if (client_cert) { DEBUG2(" rlm_eap_tls: Requiring client certificate"); verify_mode = SSL_VERIFY_PEER; verify_mode |= SSL_VERIFY_FAIL_IF_NO_PEER_CERT; verify_mode |= SSL_VERIFY_CLIENT_ONCE; } SSL_set_verify(ssn->ssl, verify_mode, cbtls_verify); /* * Create a structure for all the items required to be * verified for each client and set that as opaque data * structure. * * NOTE: If we want to set each item sepearately then * this index should be global. */ SSL_set_ex_data(ssn->ssl, 0, (void *)handler); SSL_set_ex_data(ssn->ssl, 1, (void *)inst->conf); ssn->length_flag = inst->conf->include_length; /* * We use default fragment size, unless the Framed-MTU * tells us it's too big. Note that we do NOT account * for the EAP-TLS headers if conf->fragment_size is * large, because that config item looks to be confusing. * * i.e. it should REALLY be called MTU, and the code here * should figure out what that means for TLS fragment size. * asking the administrator to know the internal details * of EAP-TLS in order to calculate fragment sizes is * just too much. */ ssn->offset = inst->conf->fragment_size; vp = pairfind(handler->request->packet->vps, PW_FRAMED_MTU); if (vp && ((vp->vp_integer - 14) < ssn->offset)) { /* * Discount the Framed-MTU by: * 4 : EAPOL header * 4 : EAP header (code + id + length) * 1 : EAP type == EAP-TLS * 1 : EAP-TLS Flags * 4 : EAP-TLS Message length * (even if conf->include_length == 0, * just to be lazy). * --- * 14 */ ssn->offset = vp->vp_integer - 14; } handler->opaque = ((void *)ssn); handler->free_opaque = session_free; DEBUG2(" rlm_eap_tls: Initiate"); /* * PEAP-specific breakage. */ if (handler->eap_type == PW_EAP_PEAP) { /* * As it is a poorly designed protocol, PEAP uses * bits in the TLS header to indicate PEAP * version numbers. For now, we only support * PEAP version 0, so it doesn't matter too much. * However, if we support later versions of PEAP, * we will need this flag to indicate which * version we're currently dealing with. */ ssn->peap_flag = 0x00; /* * PEAP version 0 requires 'include_length = no', * so rather than hoping the user figures it out, * we force it here. */ ssn->length_flag = 0; } /* * TLS session initialization is over. Now handle TLS * related handshaking or application data. */ status = eaptls_start(handler->eap_ds, ssn->peap_flag); DEBUG2(" rlm_eap_tls: Start returned %d", status); if (status == 0) return 0; /* * The next stage to process the packet. */ handler->stage = AUTHENTICATE; return 1; } /* * Do authentication, by letting EAP-TLS do most of the work. */ static int eaptls_authenticate(void *arg UNUSED, EAP_HANDLER *handler) { eaptls_status_t status; tls_session_t *tls_session = (tls_session_t *) handler->opaque; DEBUG2(" rlm_eap_tls: Authenticate"); status = eaptls_process(handler); DEBUG2(" eaptls_process returned %d\n", status); switch (status) { /* * EAP-TLS handshake was successful, return an * EAP-TLS-Success packet here. */ case EAPTLS_SUCCESS: break; /* * The TLS code is still working on the TLS * exchange, and it's a valid TLS request. * do nothing. */ case EAPTLS_HANDLED: return 1; /* * Handshake is done, proceed with decoding tunneled * data. */ case EAPTLS_OK: DEBUG2(" rlm_eap_tls: Received unexpected tunneled data after successful handshake."); #ifndef NDEBUG if ((debug_flag > 2) && fr_log_fp) { unsigned int i; unsigned int data_len; unsigned char buffer[1024]; data_len = (tls_session->record_minus)(&tls_session->dirty_in, buffer, sizeof(buffer)); log_debug(" Tunneled data (%u bytes)\n", data_len); for (i = 0; i < data_len; i++) { if ((i & 0x0f) == 0x00) fprintf(fr_log_fp, " %x: ", i); if ((i & 0x0f) == 0x0f) fprintf(fr_log_fp, "\n"); fprintf(fr_log_fp, "%02x ", buffer[i]); } fprintf(fr_log_fp, "\n"); } #endif eaptls_fail(handler->eap_ds, 0); return 0; break; /* * Anything else: fail. */ default: return 0; } /* * Success: Return MPPE keys. */ eaptls_success(handler->eap_ds, 0); eaptls_gen_mppe_keys(&handler->request->reply->vps, tls_session->ssl, "client EAP encryption"); return 1; } /* * The module name should be the only globally exported symbol. * That is, everything else should be 'static'. */ EAP_TYPE rlm_eap_tls = { "eap_tls", eaptls_attach, /* attach */ eaptls_initiate, /* Start the initial request */ NULL, /* authorization */ eaptls_authenticate, /* authentication */ eaptls_detach /* detach */ };

3 16

radius -X segmentation fault
by Gyanendra Kumar 07 Sep '10

07 Sep '10

Hi All: I get segmentation fault on starting radius demon. This is with the latest 2.1.9 version of the radius. Look forward to resolution. Here is the details: root@gkumar-desktop:/home/gkumar/radiusproxy/freeradius-server-2.1.9/src/main# ./radiusd -X Tue Sep 7 09:00:49 2010 : Info: FreeRADIUS Version 2.1.9, for host i686-pc-linux-gnu, built on Sep 3 2010 at 17:05:53 Tue Sep 7 09:00:49 2010 : Info: Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. Tue Sep 7 09:00:49 2010 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Tue Sep 7 09:00:49 2010 : Info: PARTICULAR PURPOSE. Tue Sep 7 09:00:49 2010 : Info: You may redistribute copies of FreeRADIUS under the terms of the Tue Sep 7 09:00:49 2010 : Info: GNU General Public License v2. Tue Sep 7 09:00:49 2010 : Info: Starting - reading configuration files ... Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/radiusd.conf Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/proxy.conf Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/clients.conf Tue Sep 7 09:00:49 2010 : Debug: including files in directory /usr/local/etc/raddb/modules/ Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/inner-eap Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/expr Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/digest Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/etc_group Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/mac2vlan Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/attr_filter Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/exec Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/chap Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/pam Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/unix Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/files Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/krb5 Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/detail.example.com Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/mschap Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/always Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/wimax Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/perl Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/otp Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/ippool Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/ldap Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/ntlm_auth Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/mac2ip Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/sql_log Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/smbpasswd Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/acct_unique Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/preprocess Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/detail Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/counter Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/echo Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/realm Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/expiration Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/pap Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/policy Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/cui Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/linelog Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/logintime Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/radutmp Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/sradutmp Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/checkval Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/passwd Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/attr_rewrite Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/smsotp Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/detail.log Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/eap.conf Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/policy.conf Tue Sep 7 09:00:49 2010 : Debug: including files in directory /usr/local/etc/raddb/sites-enabled/ Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/control-socket Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/default Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel Tue Sep 7 09:00:49 2010 : Debug: main { Tue Sep 7 09:00:49 2010 : Debug: allow_core_dumps = no Tue Sep 7 09:00:49 2010 : Debug: } Tue Sep 7 09:00:49 2010 : Debug: including dictionary file /usr/local/etc/raddb/dictionary Tue Sep 7 09:00:49 2010 : Debug: main { Tue Sep 7 09:00:49 2010 : Debug: prefix = "/usr/local" Tue Sep 7 09:00:49 2010 : Debug: localstatedir = "/usr/local/var" Tue Sep 7 09:00:49 2010 : Debug: logdir = "/usr/local/var/log/radius" Tue Sep 7 09:00:49 2010 : Debug: libdir = "/usr/local/lib" Tue Sep 7 09:00:49 2010 : Debug: radacctdir = "/usr/local/var/log/radius/radacct" Tue Sep 7 09:00:49 2010 : Debug: hostname_lookups = no Tue Sep 7 09:00:49 2010 : Debug: max_request_time = 30 Tue Sep 7 09:00:49 2010 : Debug: cleanup_delay = 5 Tue Sep 7 09:00:49 2010 : Debug: max_requests = 1024 Tue Sep 7 09:00:49 2010 : Debug: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" Tue Sep 7 09:00:49 2010 : Debug: checkrad = "/usr/local/sbin/checkrad" Tue Sep 7 09:00:49 2010 : Debug: debug_level = 0 Tue Sep 7 09:00:49 2010 : Debug: proxy_requests = yes Tue Sep 7 09:00:49 2010 : Debug: log { Tue Sep 7 09:00:49 2010 : Debug: stripped_names = no Tue Sep 7 09:00:49 2010 : Debug: auth = no Tue Sep 7 09:00:49 2010 : Debug: auth_badpass = no Tue Sep 7 09:00:49 2010 : Debug: auth_goodpass = no Tue Sep 7 09:00:49 2010 : Debug: } Tue Sep 7 09:00:49 2010 : Debug: security { Tue Sep 7 09:00:49 2010 : Debug: max_attributes = 200 Tue Sep 7 09:00:49 2010 : Debug: reject_delay = 1 Tue Sep 7 09:00:49 2010 : Debug: status_server = yes Tue Sep 7 09:00:49 2010 : Debug: } Tue Sep 7 09:00:49 2010 : Debug: } Tue Sep 7 09:00:49 2010 : Debug: radiusd: #### Loading Realms and Home Servers #### Tue Sep 7 09:00:49 2010 : Debug: proxy server { Tue Sep 7 09:00:49 2010 : Debug: retry_delay = 5 Tue Sep 7 09:00:49 2010 : Debug: retry_count = 3 Tue Sep 7 09:00:49 2010 : Debug: default_fallback = no Tue Sep 7 09:00:49 2010 : Debug: dead_time = 120 Tue Sep 7 09:00:49 2010 : Debug: wake_all_if_all_dead = no Tue Sep 7 09:00:49 2010 : Debug: } Tue Sep 7 09:00:49 2010 : Debug: home_server localhost { Tue Sep 7 09:00:49 2010 : Debug: ipaddr = 127.0.0.1 Tue Sep 7 09:00:49 2010 : Debug: port = 1812 Tue Sep 7 09:00:49 2010 : Debug: type = "auth" Tue Sep 7 09:00:49 2010 : Debug: secret = "testing123" Tue Sep 7 09:00:49 2010 : Debug: response_window = 20 Tue Sep 7 09:00:49 2010 : Debug: max_outstanding = 65536 Tue Sep 7 09:00:49 2010 : Debug: require_message_authenticator = no Tue Sep 7 09:00:49 2010 : Debug: zombie_period = 40 Tue Sep 7 09:00:49 2010 : Debug: status_check = "status-server" Tue Sep 7 09:00:49 2010 : Debug: ping_interval = 30 Tue Sep 7 09:00:49 2010 : Debug: check_interval = 30 Tue Sep 7 09:00:49 2010 : Debug: num_answers_to_alive = 3 Tue Sep 7 09:00:49 2010 : Debug: num_pings_to_alive = 3 Tue Sep 7 09:00:49 2010 : Debug: revive_interval = 120 Tue Sep 7 09:00:49 2010 : Debug: status_check_timeout = 4 Tue Sep 7 09:00:49 2010 : Debug: irt = 2 Tue Sep 7 09:00:49 2010 : Debug: mrt = 16 Tue Sep 7 09:00:49 2010 : Debug: mrc = 5 Tue Sep 7 09:00:49 2010 : Debug: mrd = 30 Tue Sep 7 09:00:49 2010 : Debug: } Tue Sep 7 09:00:49 2010 : Debug: home_server_pool my_auth_failover { Tue Sep 7 09:00:49 2010 : Debug: type = fail-over Tue Sep 7 09:00:49 2010 : Debug: home_server = localhost Tue Sep 7 09:00:49 2010 : Debug: } Tue Sep 7 09:00:49 2010 : Debug: realm example.com { Tue Sep 7 09:00:49 2010 : Debug: auth_pool = my_auth_failover Tue Sep 7 09:00:49 2010 : Debug: } Tue Sep 7 09:00:49 2010 : Debug: realm LOCAL { Tue Sep 7 09:00:49 2010 : Debug: } Tue Sep 7 09:00:49 2010 : Debug: radiusd: #### Loading Clients #### Tue Sep 7 09:00:49 2010 : Debug: client localhost { Tue Sep 7 09:00:49 2010 : Debug: ipaddr = 127.0.0.1 Tue Sep 7 09:00:49 2010 : Debug: require_message_authenticator = no Tue Sep 7 09:00:49 2010 : Debug: secret = "testing123" Tue Sep 7 09:00:49 2010 : Debug: nastype = "other" Tue Sep 7 09:00:49 2010 : Debug: } Segmentation fault Best Regards -Sunnybrad

2 1

Sponsored development rlm_ldap and ocsp
by Stephan Jäger 02 Sep '10

02 Sep '10

Hello developers, for a projekt we need to keep the radius clients in LDAP. As this is not yet possible with rlm_ldap we would like to sponsor this development. Our requirements so far are: - created code should go in the official freeradius code base. - official invoice for our purchasing department. - LDAP schema oder schema enhancement for the clients with required attributes, ideally with oids from the freeradius projekt. Should be pretty easy as most of the needed code is already in rlm_sql and rlm_ldap. Please let me know what you think about this, and if someone is willing to do this please mail me your offer stating your timeframe and price. Additionally we might be interested to sponsor OCSP support for EAP-TLS, so i'd be happy to receive offers on this one too, though this one is not yet decided on internally. Kind regards, Stephan Jaeger EWE TEL GmbH

5 20