January 2011 - Freeradius-Devel - lists.freeradius.org

Missing TLS Change Cipher Spec and TLS Finished in EAP-TLS exchanges
by arno＠natisbad.org 09 Jul '11

09 Jul '11

Hi, I upgraded an internal freeradius server (Linux, Debian unstable, libssl 0.9.8) used for EAP-TLS (802.11 WPA2 access) from 2.0.5 to 2.1.3. With 2.1.3, client authentication fails in the following way (wpasupplicant on Debian unstable, working with 2.0.5): - the TLS exchange is completed from freeradius point of view. It even sends the Access-Accept message to the NAS. - from the clients point of view, the TLS exchange is not over, it expects some more data from the server which are never sent. I took two pcap traces (sent to you privately, Alan), one with 2.0.5, one with 2.1.3. It looks like the TLS Change Cipher and TLS Tinished elements of the TLS exchange are not in the EAP encapsulated TLS packets sent by the server. Compare packet #23 of 2.1.3 trace with packet #27 of 2.0.5 trace. If you use wireshark, you will notice that the SSL layer is dissected; this is because #27 has a small brother: #29. It is not sent by 2.1.3. Alan, if you have an idea or a patch, I can test it on monday. Cheers, a+

5 15

eap2 in freeradius
by Chanthearith HUON 04 Apr '11

04 Apr '11

Hi everyone, I am testing eap2 in freeradius. I run "radiusd -X", I got following error message " radiusd: symbol lookup error: /usr/lib/rlm_eap2-2.1.0.so: undefined symbol: eap_server_register_methods " Anyone, have any idea what might be wrong with the configuration? Thank in advance, Thierry

5 10

GIT Log for 2011-01-31 00:33 GMT
by aland＠deployingradius.com 31 Jan '11

31 Jan '11

commit a81bbfa827a2434d13af541c018255f86803b20e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Jan 29 15:44:25 2011 +0100 Fix compile warnings and check for !vp Files changed: src/main/xlat.c | 24 +++++++++++++----------- 1 files changed, 13 insertions(+), 11 deletions(-) ====================================================================== commit b4a881ebcf207dd99a18c8ec818b730ae5986548 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Jan 28 12:14:03 2011 +0100 Check return value of lseek correctly Files changed: src/modules/rlm_detail/rlm_detail.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit f25083667af81da787ff83d20bb967ef342a3138 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Jan 27 15:33:32 2011 +0100 Add %{string:...} for printable data Files changed: src/main/xlat.c | 37 ++++++++++++++++++++++++++++++++++++- 1 files changed, 36 insertions(+), 1 deletions(-) ====================================================================== commit 501f52a2333339bfbbea9c10d3338286b0a07f74 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Jan 27 15:33:17 2011 +0100 make fr_print_string return the string length Files changed: src/include/libradius.h | 2 +- src/lib/print.c | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) ======================================================================

1 0

exec patch for clear text items
by Marc Phillips 27 Jan '11

27 Jan '11

Thought this might be useful for others. This is a first run through on an exec patch. I'm sure it can be greatly improved. I've only tested it thus far on Linux, but I don't see why it wouldn't work on other unix platforms. Adds in an exec option for any text field. This is useful for me as I have policy that states I can't have any passwords in clear text on the file system. I have an exec that calls out to an encrypted database for password retrieval: Just have to change your clear text entry to: "exec:<your callout>" Just like in Apache for SSL passwords, but is good for any text field. It also keeps the logger from logging the return value: *** freeradius-server-2.1.10/src/main/conffile.c 2010-09-28 06:03:56.000000000 -0500 --- freeradius-server-2.1.10-exec/src/main/conffile.c 2011-01-27 09:26:07.000000000 -0600 *************** *** 921,927 **** if (!value) return -1; } ! cf_log_info(cs, "\t%s = \"%s\"", name, value ? value : "(null)"); *q = value ? strdup(value) : NULL; break; --- 921,951 ---- if (!value) return -1; } ! /* Add Callout for cleartext values */ ! if (strncmp(value,"exec:",5) == 0) { ! char *token; ! FILE *fileptr; ! char exec_return[1024]; ! memset (exec_return,0x00,sizeof(exec_return)); ! token = strtok(value,":"); ! token = strtok(NULL,":"); ! fileptr = popen(token, "r"); ! if (fileptr == NULL) { ! return -1; ! } ! while (fgets(exec_return, sizeof(exec_return)-1, fileptr) != NULL) { ! } ! /* Get rid of carrage return from command output */ ! exec_return[strlen(exec_return)-1]='\0'; ! if (exec_return == NULL) { ! return -1; ! } ! pclose(fileptr); ! value = strdup(&exec_return); ! cf_log_info(cs, "\t%s = \"return from (%s)\"", name, token ? token : "(null)"); ! } else { ! cf_log_info(cs, "\t%s = \"%s\"", name, value ? value : "(null)"); ! } *q = value ? strdup(value) : NULL; break;

1 0

Detection of duplicate Acct packets
by Rajkumar R 27 Jan '11

27 Jan '11

Hi, I would like to know if freeRadius supports detection of duplicate Accounting packets upon re-transmission. Could you please confirm on the handling for such packets, as RFC5080 states handling of Access packets. Appreciate all your inputs. Thanks, Raj ________________________________ "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

2 1

GIT Log for 2011-01-27 00:33 GMT
by aland＠deployingradius.com 27 Jan '11

27 Jan '11

commit c055d2840e93ee43bd8d95d1d25a01106a5d54d0 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Jan 25 17:20:54 2011 +0100 Clarify parse error for ascend attributes Printing to the same string we're reading from is a bad idea. Files changed: src/lib/valuepair.c | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) ====================================================================== commit 0b8c3ebf417312d0969f39d7c8b44a95b4855192 Author: B. Candler <b.candler(a)pobox.com> Date: Mon Jan 24 14:18:08 2011 +0100 This patch adds a 'key' parameter to rlm_fastusers, in the same way as rlm_files has. Closes bug #126 Files changed: src/modules/rlm_fastusers/rlm_fastusers.c | 32 +++++++++++++++++++++++++--- 1 files changed, 28 insertions(+), 4 deletions(-) ====================================================================== commit b0fa79c3021d6d39922039ea8b8256b2577223ab Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Jan 24 14:03:44 2011 +0100 Fixed mismatch Files changed: share/dictionary.redback | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) ======================================================================

1 0

A question of "fr_debug_flag"
by Cai Fa 25 Jan '11

25 Jan '11

Hi All, I upgraded my freeradius from 1 to 2. When do eap-tls authenticate, the radiusd crashed in debug mode. After debug the code, I found the following code which didn't appear in version 1. *int eaplist_add(rlm_eap_t *inst, EAP_HANDLER *handler) ...... if (fr_debug_flag) { check_handler_t *check = rad_malloc(sizeof(*check)); check->inst = inst; check->handler = handler; check->trips = handler->trips; request_data_add(request, inst, 0, check, check_handler); } ...... }* In function request_free, it would call "*this->free_opaque(this->opaque);*", this is actually "*check_handler*". The process crashed in "*rbtree_finddata()*". Could anyone tell me why add these code in new version?

2 1

GIT Log for 2011-01-21 00:33 GMT
by aland＠deployingradius.com 21 Jan '11

21 Jan '11

commit 4be493a755311607fed91ed5181628e8c2ec57a2 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Jan 20 16:01:17 2011 +0100 Add $(LIBRADIUS) to allow it to link Files changed: src/modules/rlm_eap/Makefile.in | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 2013912d296f37eec5a9677020dcfb9364a31878 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Jan 20 10:00:38 2011 +0100 Update ignore files Files changed: scripts/.gitignore | 1 + src/main/.gitignore | 1 + src/modules/rlm_opendirectory/.gitignore | 1 + src/modules/rlm_redis/.gitignore | 1 + src/tests/.gitignore | 3 +++ 5 files changed, 7 insertions(+), 0 deletions(-) ====================================================================== commit 45d230b2dd9ed3943bf5f80af353bee0dfa2eb5c Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Jan 20 09:52:20 2011 +0100 Use _sysconfdir instead of /etc It allows the config files to be placed anywhere, instead of a hard-coded path Files changed: suse/freeradius.spec | 102 +++++++++++++++++++++++++------------------------- 1 files changed, 51 insertions(+), 51 deletions(-) ====================================================================== commit b4b068abbe178aa1676e6c23b4d79894e1f068d4 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Jan 19 17:25:10 2011 +0100 Call write() rather than fwrite() It returns real errors... Files changed: src/modules/rlm_detail/rlm_detail.c | 62 ++++++++++++----------------------- 1 files changed, 21 insertions(+), 41 deletions(-) ====================================================================== commit 2ab2930c96c01f25354d209aee1d5c43e6fac183 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Jan 20 10:26:03 2011 +0100 Updated as per recent WiMAX specs Files changed: share/dictionary.wimax | 48 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 48 insertions(+), 0 deletions(-) ======================================================================

1 0

Request information for EAP TTLS
by Aman Arneja 19 Jan '11

19 Jan '11

> Hi > > I am new to Free Radius and was just wondering if some1 can help me out. I > am planning to implement an EAP TTLS client and was wondering the following > about Free Radius for my testing. > > 1.) Does Free Radius Implementation of EAP TTLS Support the following > > a.) Client auth during phase 1 > b.) Id privacy can be explicitly enabled or disables > c.) Allowing tunneled methods such as FAST, PEAP as inner methods > d.) Method chaining in phase 2 > > Thanx in advance for your help guys > > Aman Arneja > >

2 4

Re: IPV6_PKTINFO/recvfromto
by Alexander Clouter 16 Jan '11

16 Jan '11

Hi, Finally found the time to look into this, a clean v2.1.10 tree with the following cherry-picks: * e5c861665f00f1213036ba412b7092aac7159ad7 (contains bug) * fa0851d9235f04ff0d4161fc6f842857ff8d52aa The bug is fixed with the attached 0003-fix-recvpktinfo.patch, and then IPv6 is actually enabled with 0004-enable-ipv6.patch. For PKTINFO to work, Linux needs IPV6_RECVPKTINFO (or the legacy IPV6_2292PKTINFO) passed to setsockopt, however when you jump into sendmsg() cmsg->cmsg_type has to be IPV6_PKTINFO (or the legacy IPV6_2292PKTINFO); this is broken in the commit do to all the define/undef magic going on. I think I have sanitised it correctly. Cheers -- Alexander Clouter .sigmonster says: Have an adequate day.

2 1