February 2011 - Freeradius-Devel - lists.freeradius.org

Missing TLS Change Cipher Spec and TLS Finished in EAP-TLS exchanges
by arno＠natisbad.org 09 Jul '11

09 Jul '11

Hi, I upgraded an internal freeradius server (Linux, Debian unstable, libssl 0.9.8) used for EAP-TLS (802.11 WPA2 access) from 2.0.5 to 2.1.3. With 2.1.3, client authentication fails in the following way (wpasupplicant on Debian unstable, working with 2.0.5): - the TLS exchange is completed from freeradius point of view. It even sends the Access-Accept message to the NAS. - from the clients point of view, the TLS exchange is not over, it expects some more data from the server which are never sent. I took two pcap traces (sent to you privately, Alan), one with 2.0.5, one with 2.1.3. It looks like the TLS Change Cipher and TLS Tinished elements of the TLS exchange are not in the EAP encapsulated TLS packets sent by the server. Compare packet #23 of 2.1.3 trace with packet #27 of 2.0.5 trace. If you use wireshark, you will notice that the SSL layer is dissected; this is because #27 has a small brother: #29. It is not sent by 2.1.3. Alan, if you have an idea or a patch, I can test it on monday. Cheers, a+

5 15

eap2 in freeradius
by Chanthearith HUON 04 Apr '11

04 Apr '11

Hi everyone, I am testing eap2 in freeradius. I run "radiusd -X", I got following error message " radiusd: symbol lookup error: /usr/lib/rlm_eap2-2.1.0.so: undefined symbol: eap_server_register_methods " Anyone, have any idea what might be wrong with the configuration? Thank in advance, Thierry

5 10

Information about load a new rlm_sql module driver
by Ge＠＠ru 06 Mar '11

06 Mar '11

Hi at all, i created a new rlm_sql driver for oracle database that permit to use package/procedure that return a cursor and that doesn't use directly oci library but use ocilib (http://orclib.sourceforge.net/) For this module is there a way to load sources on freeradius repository or i must create a new project on sf.net as an indipendent project? Thanks in advance. Geaaru

2 6

[PATCH] rlm_sql_sqlite sql_select_query
by Etienne Champetier 01 Mar '11

01 Mar '11

Hello I was trying to get the sqlite module to work and i had to modify the code to get it work (else i've got rlm_sql_sqlite: sqlite3_step = 21 where 21 is misuse). I've just tested authorize and client (select only, no update, insert or delete) and it work fine (I haven't tested accounting yet). Here is my simple patch Signed-off-by: Etienne CHAMPETIER <etienne.champetier(a)free.fr> ---------------------------------------------------- diff --git a/src/modules/rlm_sql/drivers/rlm_sql_sqlite/sql_sqlite.c b/src/modules/rlm_sql/drivers/rlm_sql_sqlite/sql_sqlite.c index 14466d9..d7bd2b9 100644 --- a/src/modules/rlm_sql/drivers/rlm_sql_sqlite/sql_sqlite.c +++ b/src/modules/rlm_sql/drivers/rlm_sql_sqlite/sql_sqlite.c @@ -138,10 +138,7 @@ static int sql_query(SQLSOCK * sqlsocket, SQL_CONFIG *config, char *querystr) static int sql_select_query(SQLSOCK *sqlsocket, SQL_CONFIG *config, char *querystr) { - if (strstr(querystr, "nas") != NULL) - return sql_query(sqlsocket, config, querystr); - - return 0; + return sql_query(sqlsocket, config, querystr); }

2 1

GIT Log for 2011-02-24 00:33 GMT
by aland＠deployingradius.com 23 Feb '11

23 Feb '11

commit 85bd2e2289115694b45beef071293368bcbf6731 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Feb 23 11:04:31 2011 +0100 Use rad_digest_cmp() to avoid timing attacks Files changed: src/modules/rlm_pap/rlm_pap.c | 20 +++++++++++--------- 1 files changed, 11 insertions(+), 9 deletions(-) ====================================================================== commit e6297b738175ea46997d88554c1610a17ad4346d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Feb 23 11:01:17 2011 +0100 Use rad_digest_cmp() to avoid timing attacks Files changed: src/modules/rlm_mschap/rlm_mschap.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 661f851e121c5e2dc400f9718b5995dd3df2a307 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Feb 23 11:01:02 2011 +0100 Use rad_digest_cmp() to avoid timing attacks Files changed: src/modules/rlm_chap/rlm_chap.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) ====================================================================== commit f4b496363fc2349ea5ff98ad65e55dba70496beb Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Feb 23 10:59:55 2011 +0100 Expose digest_cmp function So that it can be used in other places to avoid timing attacks Files changed: src/include/libradius.h | 1 + src/lib/radius.c | 8 ++++---- 2 files changed, 5 insertions(+), 4 deletions(-) ====================================================================== commit 85dc9ebd18be09132c10fcd388222d78a857deeb Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Feb 23 09:46:30 2011 +0100 Updated license to LGPL rather than GPL The "lib" directory and everything it needs have been lgpl for a long time. Files changed: src/include/libradius.h | 18 +++++++++--------- 1 files changed, 9 insertions(+), 9 deletions(-) ====================================================================== commit faae79fb600ec084ce93a84b2d3deb3f9fb85c40 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Feb 23 09:26:03 2011 +0100 Corrected license to LGPL rather than GPL Files changed: src/lib/dhcp.c | 18 +++++++++--------- 1 files changed, 9 insertions(+), 9 deletions(-) ====================================================================== commit d534ca3dabc6f40ca99fe8dc2cf82e4f14f378cf Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Feb 20 09:39:57 2011 +0100 Print error if we can't send a packet in rad_send() Files changed: src/lib/radius.c | 18 +++++++++++++----- 1 files changed, 13 insertions(+), 5 deletions(-) ====================================================================== commit 1c58811cb09c7877390a5afa942b3edb27fc0568 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Feb 18 15:44:20 2011 +0100 Use new format for %{..:-...} Files changed: raddb/modules/mschap | 15 ++++++++++----- 1 files changed, 10 insertions(+), 5 deletions(-) ====================================================================== commit f979c182e196ed080258a26e439e429debbc9bbe Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Feb 18 10:37:17 2011 +0100 Added radtee Shamelessly taken from http://horde.net/~jwm/software/misc/comparison-tee Files changed: scripts/radtee | 563 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 563 insertions(+), 0 deletions(-) ====================================================================== commit 65a4db60d546520e70682d97f3454fec18494451 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Feb 18 10:29:24 2011 +0100 Use newer expansion Files changed: raddb/sql/mssql/dialup.conf | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 6a7c228c3aec5c8018ac518ab39af46afd2d4a14 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Feb 18 10:25:07 2011 +0100 Basic configure scripts Files changed: src/modules/rlm_caching/config.h.in | 22 +++++++++++ src/modules/rlm_caching/configure.in | 65 ++++++++++++++++++++++++++++++++++ 2 files changed, 87 insertions(+), 0 deletions(-) ====================================================================== commit 167b6e45e73975b4998552a8b5d28daee08cf609 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Feb 18 13:20:02 2011 +0100 API fixes for 3.x Files changed: src/main/listen.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) ======================================================================

1 0

GIT Log for 2011-02-19 00:33 GMT
by aland＠deployingradius.com 18 Feb '11

18 Feb '11

commit 5c2a354afd1c63e7550d9285660626fe86db12e5 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Feb 18 10:01:11 2011 +0100 Make CoA proxying work again. Only set the reply code if it isn't meant to be proxied. Files changed: src/main/listen.c | 22 ++++++++++++++++++++++ 1 files changed, 22 insertions(+), 0 deletions(-) ====================================================================== commit bd5717797956dc2d600c614c2ee34397b21a79a2 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Feb 18 09:26:31 2011 +0100 Make query lengths match rlm_sql Closes bug #139 Files changed: src/modules/rlm_sqlippool/rlm_sqlippool.c | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-) ====================================================================== commit 8cd4c8f845f771d070763819f0b16b36cc82ae7a Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 17 12:05:54 2011 +0100 Better fixes for bug #141 Files changed: src/lib/udpfromto.c | 27 +++++++++++++++++---------- 1 files changed, 17 insertions(+), 10 deletions(-) ======================================================================

1 0

GIT Log for 2011-02-18 00:33 GMT
by aland＠deployingradius.com 17 Feb '11

17 Feb '11

commit 0478ad89036f680c247930169d5af13367a0afaf Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Feb 14 15:27:40 2011 +0100 Suppress messages if thread pool is ~full. If it's full and all threads are buys, we shouldn't try to create spare threads. Files changed: src/main/threads.c | 7 ++++++- 1 files changed, 6 insertions(+), 1 deletions(-) ====================================================================== commit ea70eb3a52a9c4577a97bc8c5cf0e6ad27cbec71 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Feb 14 15:03:48 2011 +0100 Fix typos and regenerate for 2.1.11 Files changed: configure | 200 +++++++++---------------------------------------------------- 1 files changed, 28 insertions(+), 172 deletions(-) ====================================================================== commit cd1aa6d3e3f41b14c364644ba7e8bfc9d7908e1c Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Feb 14 15:03:00 2011 +0100 Generated for 2.1.11 Files changed: src/modules/rlm_redis/configure | 4115 ++++++++++++++++++++++++++++++++++++ src/modules/rlm_rediswho/configure | 2625 +++++++++++++++++++++++ 2 files changed, 6740 insertions(+), 0 deletions(-) ====================================================================== commit 657ebf4e34f195c013caedd3e90fb92c34300770 Author: Chris Mikkelson <cmikk(a)qwest.net> Date: Tue Feb 15 15:21:28 2011 -0600 Update DHCP code to reflect valuepair API changes. Files changed: src/include/dhcp.h | 3 -- src/lib/dhcp.c | 50 ++++++++++++++++++++-------------------- src/main/dhcpd.c | 12 +++++----- src/modules/rlm_soh/rlm_soh.c | 4 +- 4 files changed, 33 insertions(+), 36 deletions(-) ====================================================================== commit b42c84d637ff4d96731ec3c6fa76384573561848 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 17 10:30:18 2011 +0100 Fix the tests Files changed: src/tests/extended.txt | 4 ++++ src/tests/wimax.txt | 6 +++--- 2 files changed, 7 insertions(+), 3 deletions(-) ====================================================================== commit 1064f4634b2bbfc73689d11b2fcc1c1764f3ed4e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 17 10:29:41 2011 +0100 Note 3.0 Files changed: VERSION | 2 +- doc/ChangeLog | 629 ++------------------------------------------------------- 2 files changed, 21 insertions(+), 610 deletions(-) ======================================================================

1 0

GIT Log for 2011-02-12 00:33 GMT
by aland＠deployingradius.com 11 Feb '11

11 Feb '11

commit 2c3235d172a95771c4fd6b1c38e8e7eeebb23a83 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Feb 11 11:12:28 2011 +0100 Ignore socket if address families don't match. Closes bug #143 Manual pull of 995b62f847b93ca217d35c1bbbbe8dcc5157635f Files changed: src/lib/packet.c | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) ====================================================================== commit 245df58b8a4728f1b28f975af71c8c1ce5750dee Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 10 16:20:39 2011 +0100 No DB handles is an error, not an informational message. Files changed: src/modules/rlm_sql/sql.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 0591d00a3d669cfa87027c4cf8f6c81a19b87ea2 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 10 16:13:59 2011 +0100 Fixed typo Files changed: src/modules/rlm_sql/rlm_sql.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 71ef09f042525be6d2544a590a5b28699c7dabc9 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 10 14:41:38 2011 +0100 Fixed onoff query Files changed: raddb/sql/oracle/dialup.conf | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ======================================================================

1 0

GIT Log for 2011-02-11 00:33 GMT
by aland＠deployingradius.com 10 Feb '11

10 Feb '11

commit 3a8266b7cfc7c139247303464d1f9f0eec91d075 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 10 13:35:52 2011 +0100 Enable udpfromto() for IPv6 On the theory that it will work, or that some magic will get it to work Files changed: src/lib/radius.c | 10 ++++------ 1 files changed, 4 insertions(+), 6 deletions(-) ====================================================================== commit aee63fee5c83875141cc016823b1fa6e564ff143 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 10 13:34:20 2011 +0100 Try to fix udpfromto for IPv6 Files changed: src/lib/udpfromto.c | 10 +++++++++- 1 files changed, 9 insertions(+), 1 deletions(-) ====================================================================== commit 6eba6adba2ce34fc5045df6f42a767ab302f72ec Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 10 10:49:03 2011 +0100 Change the rules for sending DHCP responses giaddr -> giaddr broadcast -> broadcast nak -> broadcast !ciaddr -> broadcast ciaddr -> ciaddr BUT if the request was not *from* ciaddr, we need to send a "raw" response. Many DHCP clients can handle a broadcast DHCP OFFER / ACK when first assigning an address. Some clients expect a response unicast to their MAC address. Files changed: src/lib/dhcp.c | 55 ++++++++++++++++++++++++++++++++++++------------------- 1 files changed, 36 insertions(+), 19 deletions(-) ======================================================================

1 0

GIT Log for 2011-02-10 00:33 GMT
by aland＠deployingradius.com 09 Feb '11

09 Feb '11

commit 24630899e68c8379af9e498233e5cfb077d0c9e8 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Feb 9 11:53:50 2011 +0100 Allow spaces and CRs Now that the underlying redis escape function handles spaces and control characters Files changed: src/modules/rlm_rediswho/rlm_rediswho.c | 12 +----------- 1 files changed, 1 insertions(+), 11 deletions(-) ====================================================================== commit 4ab5caf2560048fa4c6e68846a5dc84d40e155e1 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Feb 9 11:52:39 2011 +0100 Added escape function The rules for redis escaping aren't overly clear. So we escape control characters, spaces, and the backslash. Files changed: src/modules/rlm_redis/rlm_redis.c | 78 +++++++++++++++++++++++------------- 1 files changed, 50 insertions(+), 28 deletions(-) ======================================================================

1 0