- Freeradius-Devel - lists.freeradius.org

EAP-TLS with TLS 1.3
by Stefan Winter 15 Mar '18

15 Mar '18

Hi, I'm currently looking at https://www.ietf.org/id/draft-mattsson-eap-tls13-02.txt. It states that: While Elliptic Curve Cryptography (ECC) was optional for earlier version of TLS, TLS 1.3 mandates support of ECC (see Section 9 of [I-D.ietf-tls-tls13]). To avoid fragmentation, the use of ECC in certificates, signature algorithms, and groups are RECOMMENDED when using EAP-TLS with TLS 1.3 or higher. That sounds like useful avice. I'm wondering though what to do if you have a diverse variety of client devices doing EAP; some of which only do TLS 1.2 while others do TLS 1.3. The EAP server can only present one certificate to its incoming peer connections. If it has a ECDSA certificate, there's a chance for an interop problem with TLS 1.2 clients not supporting the needed cipher suites. If it has a RSA certificate, it misses out on the small-cert benefits. I wonder if it's possible to have both certificates available to the server, with a late selection: depending on which TLS version has been negotiated, present one cert or the other. Is that kind of stuff doable? It would certainly make a transition easier... Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 2, avenue de l'Université L-4365 Esch-sur-Alzette Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

5 17

Accessing custom attributes of accounting request
by Talel Krimi 15 Mar '18

15 Mar '18

Hello I defined a custom accounting request with additional attributes but I can't manage to access them in my rlm_rediswho code is there anyway to solve it Thank you

1 0

Commit report for v4.0.x branch
by announce＠freeradius.org 15 Mar '18

15 Mar '18

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== _tls_ctx_print_cert_line not needed unless we’re building with OpenSSL >= 1.0.2 Arran Cudbard-Bell@2018-03-14T23:02:22Z Files modified: * src/lib/tls/ctx.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/f55b42ef2f95dd5debac… ====== Cert fmt table should be static too Arran Cudbard-Bell@2018-03-14T23:00:53Z Files modified: * src/lib/tls/conf.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/5fb18d505f45fa246dc5… ====== Pre-validate the certificate chains This also re-orders certs if they were listed out of order Arran Cudbard-Bell@2018-03-14T21:29:40Z Files modified: * src/lib/tls/ctx.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/15f96b4b5ef90f798401… ====== Tables should be static, and we should gracefully fallback to real names Arran Cudbard-Bell@2018-03-14T21:28:17Z Files modified: * src/modules/rlm_cipher/rlm_cipher.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/541feac18b55efe300e2… ====== Fix OCSP staple memory leak Arran Cudbard-Bell@2018-03-14T19:44:52Z Files modified: * src/lib/tls/ocsp.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/158db6969f83db8ca995… ====== Only call SSL_CTX_set_mode if there are modes to set Just in case this messes up the default mode Arran Cudbard-Bell@2018-03-14T15:30:52Z Files modified: * src/lib/tls/ctx.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/e80ba9d2354c5aa2e813… ====== Don’t set ctx options in the tls client session init function Arran Cudbard-Bell@2018-03-14T15:29:46Z Files modified: * src/lib/tls/ctx.c * src/lib/tls/session.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/b1ce64e3d722953904e7… ====== Shouldn’t be BOOL Arran Cudbard-Bell@2018-03-14T08:26:21Z Files modified: * src/lib/tls/conf.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/24b4fb1e9699dbceda83… ====== Add DER as an alias for ASN1 Arran Cudbard-Bell@2018-03-14T08:04:47Z Files modified: * raddb/mods-available/eap * src/lib/tls/conf.c * src/lib/tls/ctx.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/2c8b934d779c6a0646ce… ====== Document certificate format config item Arran Cudbard-Bell@2018-03-14T07:34:09Z Files modified: * raddb/mods-available/eap * src/include/tls-h * src/lib/tls/conf.c * src/lib/tls/ctx.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/d3b8f9ef1e1e44db2301… ====== Doxygen Arran Cudbard-Bell@2018-03-14T07:33:26Z Files modified: * src/modules/rlm_cipher/rlm_cipher.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/6477d4d5d55e2a13fef6… ====== -- This commit summary was generated @2018-03-15T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Accessing Request Packet Attributes from the rlm_rediswho modules
by Talel Krimi 14 Mar '18

14 Mar '18

Hello I need to acces the attributes passed in the accounting request in the rlm_rediswho modules I managed to access the username and the password using request->username how to access the other attributes ?

2 1

Commit report for v4.0.x branch
by announce＠freeradius.org 14 Mar '18

14 Mar '18

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Allow multiple keypairs to be specified for crypto agility Arran Cudbard-Bell@2018-03-13T18:17:37Z Files modified: * raddb/mods-available/eap * raddb/mods-available/eap_inner * raddb/sites-available/abfab-tls * src/include/tls-h * src/lib/tls/conf.c * src/lib/tls/ctx.c * src/lib/tls/session.c * src/tests/eapol_test/config/servers.conf Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/e8df16d097c961ee80dd… ====== Fix multi section pass2 parsing Arran Cudbard-Bell@2018-03-13T18:17:37Z Files modified: * src/main/cf_parse.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/883f0c5a2d43f3312e63… ====== -- This commit summary was generated @2018-03-14T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v4.0.x branch
by announce＠freeradius.org 13 Mar '18

13 Mar '18

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== gpgsig -----BEGIN PGP SIGNATURE----- iQI/BAABCAApBQJapmdFIhxtYXR0aGV3LWdpdEBuZXd0b25jb21wdXRpbmcuY28u dWsACgkQ2bkzwSrtdPBBjg//bR3Khff+tvoEI00Ovke8lF2QTcPgtd6FfO7IC7QL BloRTVheRaJw7NkS6zQcdqkAqsaCVuhP4MutVkCn63x8R/oii+IgRcQ/PHF3/sJr ZB/vB6InThGtGVgXXJPTHrOAlfcNLQevCJU6lz1h1fp5Qk0j54WV7ezNndrT7Un0 iQujqH6BdyyGEb3XiTad5pQNqpgR2HRqulptYejFddVOouPKMMtJWH+drC8hXpz/ NnnRDP04WyE3qvuASFz0mTWs2tRKsRisQf9omeGVE+H/47aN+6ZYB+z9R+Ifusq1 YPwTfbXA5UctPsvs9JbD5kLZ6YICxM5IVwLx3wUOecg+JMoHr0Z8BG2UAFrFh94F 0bPEqX2oYduJwCzsOfSAn5X12IejCkIRrnsymTbVPIvWNTA1/rQ135yzdicqnu0S xVF1PYouaUyxv03gGWQ4kGT7LTf1E5JFa9Yp41zWsRvK0VmSo90rR8VX6W7U9Fzh 4hvJYVsvSjb2QVW3rNveFQnyZ+vrea+Nk7Ye0asiMXW4uYqU7VBvMFzI7CBv6ZXX wphDaysrk0UYCrhFwaFNSw1J6YLQqHs/6qM1gdMH4kl4pDT+O83FGfYtA93f63GI 2pEKoGpKYq35qi0LsfJrQRdBIXTkPA+dl/NipvEhhGlaZ/HrowcaHiFNkbzbeo8b E8I= =iLRW -----END PGP SIGNATURE----- radclient "-i" didn't work, so just remove it to save confusion Matthew Newton@2018-03-12T11:40:45Z Files modified: * src/main/radclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/ea5b99abaab09645c2a6… ====== -- This commit summary was generated @2018-03-13T00:00:03Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v3.0.x branch
by announce＠freeradius.org 13 Mar '18

13 Mar '18

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== make detail writer reopen file if filename no longer exists Matthew Newton@2018-03-12T14:27:28Z Files modified: * src/main/exfile.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/80f8a270276ee7506fd9… ====== radclient "-i" didn't work, so just remove it to save confusion There's no current way to tell fr_packet_list_id_alloc to use a particular ID, and fr_packet_socket_t isn't available to us to change the ID after it's been allocated. If anyone really needs to do this for testing it can be temporarily hacked into send_one_packet(). Matthew Newton@2018-03-12T11:34:44Z Files modified: * doc/ChangeLog * src/main/radclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/dfe45c9c7fbcead1206d… ====== -- This commit summary was generated @2018-03-13T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v4.0.x branch
by announce＠freeradius.org 11 Mar '18

11 Mar '18

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== gpgsig -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIzBAABCgAdFiEE6VbEmJeQrF8361hu/6TVgp+218oFAlqj/VUACgkQ/6TVgp+2 18rQohAArYXejznKDuWnmaOXzuv4kcXPGk1IkLys4sJS/tofEN/exEZ6cit4UEAf VvJpLDseLay2naEF98HdIV6f7it6LvbS5UiLF3EEBSCB2zIThkauSYz4R76T8l0M xE6X7VwqS1rC1N1Yg8reTblXJKm5YhJp6con/muUnxTLiVFHG3btSXeJiKw9zkC9 KZrIP/X1v3HhyJqCLysnhN9BynpqKkfB634e1Tdv/2ETknpHosoj8ENeiCcUdYEs Io3z93JvVWVLdFvIwn13xHlqA0klKaYeKNGNJuNcYmNtikPt9JWrlxYS8dOlxJ3Q knJPxiqZbG7WQ9BinjPc1YQgz+BLIe3HlUlgyU4A6ZxTepgQWfOny4tez2nn/2fH PqsvgXk3RAY1uVrNASVsp8Yg3b2vsCK4C3+0AuASuXi0yvEGKOZmprjxtJZ+m7j2 l7glls0eNiDXwT4XR6HlywH6BJDIY6FZJcrnUhQ2SgnoOugZfR9XbrOBUVpYBLUU pMu0LbqFsHFQxVCR2qQULWh9r4O5MP6NXEaR7dWY+mkXe78Z50sYfLIn6/kfq9wv vn52jsqAi5yaTsnC2PpWayQapXbgBQ8O9FcAS751UEtGf7fjZHLfDKxckjKBK2yr oXSqdR58EWKCOh6IkD/yv4Kdwzz2pfrbDNCkP2xUYd3Ng4N4DtY= =95Fj -----END PGP SIGNATURE----- Typo Arran Cudbard-Bell@2018-03-10T15:44:20Z Files modified: * src/main/unlang_interpret.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/ba4e909cbbe3b31c9228… ====== -- This commit summary was generated @2018-03-11T00:00:03Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v4.0.x branch
by announce＠freeradius.org 10 Mar '18

10 Mar '18

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== gpgsig -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIzBAABCgAdFiEE6VbEmJeQrF8361hu/6TVgp+218oFAlqiBMIACgkQ/6TVgp+2 18rJHw//ZEF237hdLgM0/mp0SCowFiq/HqVrIftkF3YW4wcJX9Ot7jI6cPV/LJhO YZRdCuGTw9a4v1JMMtNEk/Z04GVvEMCP66rkbDhtTjzL15JsOejFcCX/v15QN31V y75IBSS3RYIYAfvGbEDlgdgBjUbCHZodCAcDBQ7B3bb8q5YZjRMIOWhF+UlCknEY KbnziQAu/HWXt5zkFxbogUQwrEIt9yi/H5daGg3fHZ++ru7ohaGJOr48P/vjVyT1 fRSwP4omuz9pTy+R6TX1xL3hr2o+pcNkDpAh3YtIKgjA9f3YE+KqjahvJl/PuW5X e9T7B8MGuSmYa2op9nsdZ6crn24M6MBpc70+DKjQrR9Ev3lWRqPCNDDMWN+8TpHK H+2+82SFt5h9IUolpGH4+TixUGhJbDVmBPIByPiaFI/y0lpw8OB/MfBQuq31Vsac romRzMg0F//W1yaRSPxmwPAJWyOgwL2Cyvvy+6uxuc19rRFw8v+dZNedNTk0kRhL RacoKEKJfprqvKsKRPbsrpbWtu/Zy1nMf1GafHqKON1lmSyfk/2sqsLJ3dIXjhlK Kcy93VxMm/64wy3I3XdfJskaog14HeR3eSDj/k9T4ma/OS/xtd/En2T29M98CWGL 7VNc4Q9Bap50N3HuxNlpwttsUf0xJDr9FFl8Kj4QdiOgc92UWKE= =T7q8 -----END PGP SIGNATURE----- Additional check for request sanity Arran Cudbard-Bell@2018-03-09T03:51:30Z Files modified: * src/main/unlang_interpret.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/e098a3328925592cc0f3… ====== -- This commit summary was generated @2018-03-10T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v4.0.x branch
by announce＠freeradius.org 09 Mar '18

09 Mar '18

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== gpgsig -----BEGIN PGP SIGNATURE----- iQEcBAABCAAGBQJaoTw3AAoJEH0Oec13Yh7Nv4MH/1OonpcLvPF2NLRdOz0BlGeA OvEBqmJNUaKObq1vWE1aqHFDwcm6YiUbIPfJO+45f9q7m0IbRYzS+uog8/PV+toN ChpaYBsV8fHUHFpqWMSF13TYERzJfdL3MDUh+4vQ6KcEk4PJBCY48jPjGKMGMLSl OusQyir2r45CXJKrq+jkjn/dpB9EU+nj+n7pbGmpZ1nQJGAK2veqmIhqWcT9HCdJ pXo09p25623uIlgUmfXP1g+CfBjUqxDUD0f5/nwwwFAfE6uKaB8jHFnTpX1ISuSc +Tm3JRrD6MdUoli9p7r3+C56DszsUM3PVWkcuBgTnOG4z7TKxvQ8PY6H1ek5MSU= =MtBs -----END PGP SIGNATURE----- doxygen Alan T. DeKok@2018-03-08T13:35:51Z Files modified: * src/lib/util/trie.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/65db1509dc1a927ce69b… ====== -- This commit summary was generated @2018-03-09T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0