April 2015 - Freeradius-Devel - lists.freeradius.org

Commit report for v3.0.x branch
by announce＠freeradius.org 03 Apr '15

03 Apr '15

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== More checks on identity Alan T. DeKok@2015-04-03T02:36:50Z Files modified: * src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/41a0d02566ab4025fb83… ====== Limit identity length Alan T. DeKok@2015-04-03T02:32:03Z Files modified: * src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/7285d86523ea4195facf… ====== Allow EAP-MSCHAPv2 to have configurable server identity. Fixes #932. We don't allow this to be dynamically expanded. It's just easier. Alan T. DeKok@2015-04-03T01:40:56Z Files modified: * raddb/mods-available/eap * src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/6f0f80ec2c96601924d5… ====== -- This commit summary was generated @2015-04-04T00:00:05Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v3.1.x branch
by announce＠freeradius.org 03 Apr '15

03 Apr '15

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== More checks on identity Alan T. DeKok@2015-04-03T02:37:07Z Files modified: * src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/90c8471bbfc218be9606… ====== Limit identity length Alan T. DeKok@2015-04-03T02:37:06Z Files modified: * src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/69dd9582ded05bc94457… ====== Allow EAP-MSCHAPv2 to have configurable server identity. Fixes #932. We don't allow this to be dynamically expanded. It's just easier. Alan T. DeKok@2015-04-03T01:41:43Z Files modified: * raddb/mods-available/eap * src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/616f7da8c7d6121b1085… ====== -- This commit summary was generated @2015-04-04T00:00:05Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v3.1.x branch
by announce＠freeradius.org 01 Apr '15

01 Apr '15

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== added VALUEs Alan T. DeKok@2015-04-01T19:49:35Z Files modified: * share/dictionary.rfc7499 Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/dec7ff66f34d773d25de… ====== Added from RFC which has numbers assigned Alan T. DeKok@2015-04-01T19:34:36Z Files modified: * share/dictionary * share/dictionary.rfc7499 Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/634bdb7b29089ed9fd95… ====== Fix cppcheck complaint Alan T. DeKok@2015-04-01T17:14:08Z Files modified: * src/modules/rlm_eap/radeapclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/ca7e2bbfc9b84efd38e9… ====== Update proxy docs for TLS Alan T. DeKok@2015-04-01T16:37:04Z Files modified: * raddb/proxy.conf Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/ba3c4e6963e688906599… ====== Remove bad talloc_free Alan T. DeKok@2015-04-01T16:33:35Z Files modified: * src/main/realms.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/8a1876e6b70bae8e4662… ====== Loop over COUNT entries. Maybe addresses #945 Alan T. DeKok@2015-04-01T14:57:34Z Files modified: * src/main/modcall.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/76f4ac8be0cd81d70487… ====== Revert "Unlock file while waiting for the DB" This reverts commit a91017d3c391093493757cd4651a455770c4c8c1. it's better for the server to do this in exfile.c Alan T. DeKok@2015-04-01T14:30:23Z Files modified: * scripts/sql/radsqlrelay Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/6c65b52b63ef1e8974af… ====== Try 3 times to lock it. If it fails, return an error Alan T. DeKok@2015-04-01T14:28:48Z Files modified: * src/main/exfile.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/611a2f70c55285ae068e… ====== Create correctly formatted session cache entries Alan T. DeKok@2015-04-01T14:23:33Z Files modified: * src/main/tls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/0add972c42c9d1c8bd01… ====== Complain if stupid people disable all TLS versions Alan T. DeKok@2015-04-01T14:23:32Z Files modified: * src/main/tls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/b3bd45b104aaf36f6143… ====== Small elasticsearch fixups Matthew Newton (via Alan T. DeKok)@2015-04-01T14:23:30Z Files modified: * doc/schemas/logstash/README * doc/schemas/logstash/radius-mapping.sh * doc/schemas/logstash/radius.conf Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/98f442ac706bbe75f2d3… ====== Add example elasticsearch/logstash config for detail files Matthew Newton (via Arran Cudbard-Bell)@2015-04-01T00:16:30Z Files modified: * doc/schemas/logstash/README * doc/schemas/logstash/radius-mapping.sh * doc/schemas/logstash/radius.conf Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/c791069178187a192ac2… ====== -- This commit summary was generated @2015-04-02T00:00:04Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v3.0.x branch
by announce＠freeradius.org 01 Apr '15

01 Apr '15

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== added VALUEs Alan T. DeKok@2015-04-01T19:49:22Z Files modified: * share/dictionary.rfc7499 Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/9f8a425d90741ca71668… ====== Added from RFC which has numbers assigned Alan T. DeKok@2015-04-01T19:34:19Z Files modified: * share/dictionary * share/dictionary.rfc7499 Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/c6601da6a145bb2e2150… ====== Warning for old config Alan T. DeKok@2015-04-01T18:08:30Z Files modified: * src/main/realms.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/088d70e8a609d31e5c64… ====== Fix cppcheck complaint Alan T. DeKok@2015-04-01T17:13:56Z Files modified: * src/modules/rlm_eap/radeapclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/fc0734c04abc4611aa6e… ====== Update proxy docs for TLS Alan T. DeKok@2015-04-01T16:36:50Z Files modified: * raddb/proxy.conf Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/b887cf76dff5f9f6246c… ====== Remove bad free Alan T. DeKok@2015-04-01T16:32:45Z Files modified: * src/main/realms.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/5e6f84d29336defecd9a… ====== Loop over COUNT entries. Maybe addresses #945 Alan T. DeKok@2015-04-01T14:57:15Z Files modified: * src/main/modcall.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/e774cb6ff53032a63295… ====== Revert "Unlock file while waiting for the DB" This reverts commit a91017d3c391093493757cd4651a455770c4c8c1. it's better for the server to do this in exfile.c Alan T. DeKok@2015-04-01T14:30:04Z Files modified: * scripts/sql/radsqlrelay Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/191d5f5b9e8c0e24aad3… ====== Try 3 times to lock it. If it fails, return an error Alan T. DeKok@2015-04-01T14:28:26Z Files modified: * src/main/exfile.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/c998e0bade1a29a49b86… ====== Create correctly formatted session cache entries Alan T. DeKok@2015-04-01T14:22:54Z Files modified: * src/main/tls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/79c1994fcdff76ba64f4… ====== Complain if stupid people disable all TLS versions Alan T. DeKok@2015-04-01T14:22:54Z Files modified: * src/main/tls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/7a593f3a7a3f1e96cdd1… ====== Merge pull request #946 from mcnewton/pr2 Small elasticsearch fixups Alan DeKok@2015-04-01T14:02:22Z Files modified: * doc/schemas/logstash/README * doc/schemas/logstash/radius-mapping.sh * doc/schemas/logstash/radius.conf Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/694d1c3e033902006580… ====== Small elasticsearch fixups Matthew Newton@2015-04-01T13:44:31Z Files modified: * doc/schemas/logstash/README * doc/schemas/logstash/radius-mapping.sh * doc/schemas/logstash/radius.conf Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/93f272105a98952dae85… ====== Merge pull request #944 from mcnewton/pr logstash/elasticsearch config for detail file analysis Arran Cudbard-Bell@2015-04-01T00:16:10Z Files modified: * doc/developer/coding-methods.rst * doc/developer/contributing.rst * doc/developer/release-method.rst * doc/schemas/logstash/README * doc/schemas/logstash/radius-mapping.sh * doc/schemas/logstash/radius.conf Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/82d6d7a7aa3befc746d4… ====== Add example elasticsearch/logstash config for detail files Matthew Newton@2015-04-01T00:02:23Z Files modified: * doc/schemas/logstash/README * doc/schemas/logstash/radius-mapping.sh * doc/schemas/logstash/radius.conf Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/95d1553bcde887ea851c… ====== Tidy documentation formatting/whitespace Matthew Newton@2015-03-31T23:45:33Z Files modified: * doc/developer/coding-methods.rst * doc/developer/contributing.rst * doc/developer/release-method.rst Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/a3bf6a16a21677946a57… ====== -- This commit summary was generated @2015-04-02T00:00:04Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Crash in FR with no secret defined for a realm
by Stefan Paetow 01 Apr '15

01 Apr '15

I don't think *this* is supposed to happen! :-/ Copyright (C) 1999-2015 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/abfab_psk_sql including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/cache_eap including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/abfab-tr including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/operator-name including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/abfab-tr-idp including configuration file /etc/raddb/sites-enabled/channel_bindings including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/abfab-tls main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "yes" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server main-idp65x64_localdomain { ipaddr = 192.168.213.24 port = 2083 type = "auth" proto = "tcp" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 ca_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/client.pem" certificate_file = "/etc/raddb/certs/client.pem" ca_file = "/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 8192 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" } realm main-rp65x64.localdomain { } realm LOCAL { } realm main-idp65x64.localdomain { /etc/raddb/proxy.conf[754]: No shared secret supplied for realm: main-idp65x64.localdomain } # realm main-idp65x64.localdomain *** glibc detected *** radiusd: free(): invalid pointer: 0x00000000013a70c0 *** ======= Backtrace: ========= /lib64/libc.so.6[0x3075475e66] radiusd(realms_init+0x82c)[0x437b0c] radiusd(main_config_init+0x77b)[0x41c80b] radiusd(main+0x399)[0x4253c9] /lib64/libc.so.6(__libc_start_main+0xfd)[0x307541ed5d] radiusd[0x40e0e9] ======= Memory map: ======== 00400000-0045d000 r-xp 00000000 fd:00 552232 /usr/sbin/radiusd 0065d000-00663000 rw-p 0005d000 fd:00 552232 /usr/sbin/radiusd 00663000-00664000 rw-p 00000000 00:00 0 00862000-00869000 rw-p 00062000 fd:00 552232 /usr/sbin/radiusd 01157000-013c3000 rw-p 00000000 00:00 0 [heap] 3075000000-3075020000 r-xp 00000000 fd:00 651116 /lib64/ld-2.12.so 307521f000-3075220000 r--p 0001f000 fd:00 651116 /lib64/ld-2.12.so 3075220000-3075221000 rw-p 00020000 fd:00 651116 /lib64/ld-2.12.so 3075221000-3075222000 rw-p 00000000 00:00 0 3075400000-307558a000 r-xp 00000000 fd:00 651150 /lib64/libc-2.12.so 307558a000-307578a000 ---p 0018a000 fd:00 651150 /lib64/libc-2.12.so 307578a000-307578e000 r--p 0018a000 fd:00 651150 /lib64/libc-2.12.so 307578e000-307578f000 rw-p 0018e000 fd:00 651150 /lib64/libc-2.12.so 307578f000-3075794000 rw-p 00000000 00:00 0 3075800000-3075817000 r-xp 00000000 fd:00 651155 /lib64/libpthread-2.12.so 3075817000-3075a17000 ---p 00017000 fd:00 651155 /lib64/libpthread-2.12.so 3075a17000-3075a18000 r--p 00017000 fd:00 651155 /lib64/libpthread-2.12.so 3075a18000-3075a19000 rw-p 00018000 fd:00 651155 /lib64/libpthread-2.12.so 3075a19000-3075a1d000 rw-p 00000000 00:00 0 3075c00000-3075c02000 r-xp 00000000 fd:00 651305 /lib64/libdl-2.12.so 3075c02000-3075e02000 ---p 00002000 fd:00 651305 /lib64/libdl-2.12.so 3075e02000-3075e03000 r--p 00002000 fd:00 651305 /lib64/libdl-2.12.so 3075e03000-3075e04000 rw-p 00003000 fd:00 651305 /lib64/libdl-2.12.so 3076000000-3076007000 r-xp 00000000 fd:00 651820 /lib64/librt-2.12.so 3076007000-3076206000 ---p 00007000 fd:00 651820 /lib64/librt-2.12.so 3076206000-3076207000 r--p 00006000 fd:00 651820 /lib64/librt-2.12.so 3076207000-3076208000 rw-p 00007000 fd:00 651820 /lib64/librt-2.12.so 3076400000-3076415000 r-xp 00000000 fd:00 653421 /lib64/libz.so.1.2.3 3076415000-3076614000 ---p 00015000 fd:00 653421 /lib64/libz.so.1.2.3 3076614000-3076615000 r--p 00014000 fd:00 653421 /lib64/libz.so.1.2.3 3076615000-3076616000 rw-p 00015000 fd:00 653421 /lib64/libz.so.1.2.3 3076c00000-3076c3a000 r-xp 00000000 fd:00 663661 /lib64/libreadline.so.6.0 3076c3a000-3076e3a000 ---p 0003a000 fd:00 663661 /lib64/libreadline.so.6.0 3076e3a000-3076e42000 rw-p 0003a000 fd:00 663661 /lib64/libreadline.so.6.0 3076e42000-3076e43000 rw-p 00000000 00:00 0 3077000000-307701d000 r-xp 00000000 fd:00 653423 /lib64/libselinux.so.1 307701d000-307721c000 ---p 0001d000 fd:00 653423 /lib64/libselinux.so.1 307721c000-307721d000 r--p 0001c000 fd:00 653423 /lib64/libselinux.so.1 307721d000-307721e000 rw-p 0001d000 fd:00 653423 /lib64/libselinux.so.1 307721e000-307721f000 rw-p 00000000 00:00 0 3077400000-3077416000 r-xp 00000000 fd:00 653411 /lib64/libresolv-2.12.so 3077416000-3077616000 ---p 00016000 fd:00 653411 /lib64/libresolv-2.12.so 3077616000-3077617000 r--p 00016000 fd:00 653411 /lib64/libresolv-2.12.so 3077617000-3077618000 rw-p 00017000 fd:00 653411 /lib64/libresolv-2.12.so 3077618000-307761a000 rw-p 00000000 00:00 0 3077800000-307783d000 r-xp 00000000 fd:00 538624 /usr/lib64/libpcap.so.1.4.0 307783d000-3077a3d000 ---p 0003d000 fd:00 538624 /usr/lib64/libpcap.so.1.4.0 3077a3d000-3077a3f000 rw-p 0003d000 fd:00 538624 /usr/lib64/libpcap.so.1.4.0 3077a3f000-3077a40000 rw-p 00000000 00:00 0 3077c00000-3077c2c000 r-xp 00000000 fd:00 663714 /lib64/libpcre.so.0.0.1 3077c2c000-3077e2b000 ---p 0002c000 fd:00 663714 /lib64/libpcre.so.0.0.1 3077e2b000-3077e2c000 rw-p 0002b000 fd:00 663714 /lib64/libpcre.so.0.0.1 3078c00000-3078c0a000 r-xp 00000000 fd:00 538616 /usr/lib64/libtalloc.so.2.0.7 3078c0a000-3078e09000 ---p 0000a000 fd:00 538616 /usr/lib64/libtalloc.so.2.0.7 3078e09000-3078e0a000 rw-p 00009000 fd:00 538616 /usr/lib64/libtalloc.so.2.0.7 307f000000-307f002000 r-xp 00000000 fd:00 653740 /lib64/libfreebl3.so 307f002000-307f201000 ---p 00002000 fd:00 653740 /lib64/libfreebl3.so 307f201000-307f202000 r--p 00001000 fd:00 653740 /lib64/libfreebl3.so 307f202000-307f203000 rw-p 00002000 fd:00 653740 /lib64/libfreebl3.so 3080000000-3080007000 r-xp 00000000 fd:00 659526 /lib64/libcrypt-2.12.so 3080007000-3080207000 ---p 00007000 fd:00 659526 /lib64/libcrypt-2.12.so 3080207000-3080208000 r--p 00007000 fd:00 659526 /lib64/libcrypt-2.12.so 3080208000-3080209000 rw-p 00008000 fd:00 659526 /lib64/libcrypt-2.12.so 3080209000-3080237000 rw-p 00000000 00:00 0 3080c00000-3080c1d000 r-xp 00000000 fd:00 661285 /lib64/libtinfo.so.5.7 3080c1d000-3080e1d000 ---p 0001d000 fd:00 661285 /lib64/libtinfo.so.5.7 3080e1d000-3080e21000 rw-p 0001d000 fd:00 661285 /lib64/libtinfo.so.5.7 3081000000-3081003000 r-xp 00000000 fd:00 663711 /lib64/libcom_err.so.2.1 3081003000-3081202000 ---p 00003000 fd:00 663711 /lib64/libcom_err.so.2Aborted (core dumped) Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc¹s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200.

2 1

Last call for 3.0.8
by Alan DeKok 01 Apr '15

01 Apr '15

Can we get that tested? Especially with the TLSv1 / TLSv1.1 / TLSv1.2 changes that went in today. I think we're otherwise good to go. Alan DeKok.

7 16

RFC 5077 ticket key derivation
by Arran Cudbard-Bell 31 Mar '15

31 Mar '15

/** Generate a new session ticket * * Signs the administrator configured key, using the private key associated with the * SSL context, then hashes the signature to get a key of an appropriate length, * which is fed to the hmac and encryption contexts for the session ticket. * * @param out Where to write the derived session ticket key. * @param pkey used to the create the signature. * @param key to be signed using the private key, then hashed. * @param keylen length of key to be signed. * @return 0 on success, -1 on failure. */ static int tls_session_ticket_key(uint8_t out[SHA256_DIGEST_LENGTH], EVP_PKEY *pkey, uint8_t const *key, size_t keylen) { int ret; const EVP_MD *md = EVP_sha256(); EVP_MD_CTX mdctx; unsigned int outlen; uint8_t *sig; EVP_MD_CTX_init(&mdctx); ret = EVP_DigestInit(&mdctx, md); if (ret != 1) { ERROR("Failed initialising digest: %s", ERR_error_string(ERR_get_error(), NULL)); return -1; } ret = EVP_SignInit(&mdctx, md); if (ret != 1) { ERROR("Failed initialising signing context: %s", ERR_error_string(ERR_get_error(), NULL)); error: EVP_MD_CTX_cleanup(&mdctx); return -1; } ret = EVP_SignUpdate(&mdctx, key, keylen); if (ret != 1) { ERROR("Failed signing key: %s", ERR_error_string(ERR_get_error(), NULL)); goto error; } ret = EVP_SignFinal(&mdctx, NULL, &outlen, pkey); if (ret != 1) { ERROR("Failed finalising digest signature: %s", ERR_error_string(ERR_get_error(), NULL)); goto error; } MEM(sig = talloc_array(NULL, uint8_t, outlen)); ret = EVP_SignFinal(&mdctx, sig, &outlen, pkey); if (ret != 1) { ERROR("Failed finalising digest signature: %s", ERR_error_string(ERR_get_error(), NULL)); goto error; } EVP_MD_CTX_cleanup(&mdctx); EVP_MD_CTX_init(&mdctx); ret = EVP_DigestInit(&mdctx, md); if (ret != 1) { ERROR("Failed initialising digest: %s", ERR_error_string(ERR_get_error(), NULL)); talloc_free(sig); goto error; } ret = EVP_DigestUpdate(&mdctx, sig, outlen); if (ret != 1) { ERROR("Failed updating digest: %s", ERR_error_string(ERR_get_error(), NULL)); talloc_free(sig); goto error; } ret = EVP_DigestFinal(&mdctx, out, NULL); talloc_free(sig); if (ret != 1) { ERROR("Failed updating digest: %s", ERR_error_string(ERR_get_error(), NULL)); goto error; } return 0; } Anyone have opinions on this? The idea is to allow multiple RADIUS servers to calculate the same key independently without a common store, and to ensure that the derived keys are sufficiently complex, regardless of what the administrator configures. There's no standard for this that i've seen, nor is there a situation that I can see where deploying heterogeneous RADIUS servers in a HA cluster is useful. RFC5077 recommends periodic key rotations, which is possible, as 'key', is the result of a template expansion, which could be an xlat, attr ref or exec. I've confirmed that if an incorrect key is provided via the SSL_CTX_set_tlsext_ticket_key_cb that auth continues normally as if no ticket had been presented, and a new ticket is generated. -Arran Tue Mar 31 05:57:15 2015 : Debug: (5) eap_peap: New session ticket: 0x6e8b68c6803654c78bf7e6db15d7ea00 Tue Mar 31 05:57:15 2015 : Debug: (5) eap_peap: Session ticket key: 0x35 Tue Mar 31 05:57:15 2015 : Debug: (5) eap_peap: Session ticket key (derived): 0x11ab45219b8ebafac633475ac0a9be597055b26a27c4d196ff542fa6834a860b Tue Mar 31 05:57:15 2015 : Debug: (5) eap_peap: TLS_accept: SSLv3 write session ticket A Tue Mar 31 05:57:15 2015 : Debug: (13) eap_peap: Got session ticket: 0x6e8b68c6803654c78bf7e6db15d7ea00 Tue Mar 31 05:57:15 2015 : Debug: (13) eap_peap: Session ticket key: 0x3133 Tue Mar 31 05:57:15 2015 : Debug: (13) eap_peap: Session ticket key (derived): 0x9a12beeaf8d3a9ed30d50e065c21e2260a62f9bbabd16616873f3923cb8e90a1 Tue Mar 31 05:57:15 2015 : Debug: (16) eap_peap: New session ticket: 0x6928501f7ea2e7cfddc26da251f6d7f2 Tue Mar 31 05:57:15 2015 : Debug: (16) eap_peap: Session ticket key: 0x3136 Tue Mar 31 05:57:15 2015 : Debug: (16) eap_peap: Session ticket key (derived): 0x5979e02312c1b500bd32f3a5ad785c19e4a9f1d0ba4b4c8083b39252ea216ce9 Tue Mar 31 05:57:15 2015 : Debug: (16) eap_peap: TLS_accept: SSLv3 write session ticket A Tue Mar 31 05:57:15 2015 : Debug: (24) eap_peap: Got session ticket: 0x6928501f7ea2e7cfddc26da251f6d7f2 Tue Mar 31 05:57:15 2015 : Debug: (24) eap_peap: Session ticket key: 0x3234 Tue Mar 31 05:57:15 2015 : Debug: (24) eap_peap: Session ticket key (derived): 0x31e2bb458f5d9ef76d0a7d63696e3b33d1f57d1e4ef5a3f2f6d880d6135b8b4a Tue Mar 31 05:57:15 2015 : Debug: (27) eap_peap: New session ticket: 0x62a418806a4c58025628864c5b3a8af0 Tue Mar 31 05:57:15 2015 : Debug: (27) eap_peap: Session ticket key: 0x3237 Tue Mar 31 05:57:15 2015 : Debug: (27) eap_peap: Session ticket key (derived): 0x6c09a944a07cece8fef510427b41041d831f2dd8d8430e9be49e9bb1233ad32f Tue Mar 31 05:57:15 2015 : Debug: (27) eap_peap: TLS_accept: SSLv3 write session ticket A Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

3 7