- Freeradius-Devel - lists.freeradius.org

Commit report for v3.1.x branch
by announce＠freeradius.org 05 Feb '16

05 Feb '16

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Merge pull request #1526 from nchaigne/3.1.x-dhcp-hstr [3.1.x] DHCP strings decoding Alan DeKok@2016-02-05T14:28:01Z Files modified: * src/modules/proto_dhcp/dhcp.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/af9a2eca2ebf670d7ed6… ====== [3.1.x] DHCP strings decoding Header fields of type "string" are null terminated strings, decode them as such Nicolas C@2016-02-05T09:35:20Z Files modified: * src/modules/proto_dhcp/dhcp.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/a402e19c26a06f62d655… ====== Print out the server version number. When starting in debug mode Alan T. DeKok@2016-02-05T02:36:05Z Files modified: * src/main/version.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/0dad6a530e8515d06876… ====== Print out extra information only in debug3 Alan T. DeKok@2016-02-05T02:35:53Z Files modified: * src/main/version.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/af3cfa3a2cc3b24722a6… ====== -- This commit summary was generated @2016-02-06T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

DHCP decoder handling of header string fields
by Chaigneau, Nicolas 05 Feb '16

05 Feb '16

Hello, I've noticed that FreeRADIUS DHCP decoder is handling strings from the DHCP header fields a bit oddly. Basically, it allocates a value pair buffer with the maximum field length (64 or 128 octets, for DHCP-Server-Host-Name and DHCP-Boot-Filename respectively) + 1, and memcpy the data then add a '\0'. But RFC 2131 explicitly states that these DHCP fields are null terminated strings. So why not handle them as such ? Current code from "fr_dhcp_decode" function: case PW_TYPE_STRING: q = talloc_array(vp, char, dhcp_header_sizes[i] + 1); memcpy(q, p, dhcp_header_sizes[i]); q[dhcp_header_sizes[i]] = '\0'; fr_pair_value_strsteal(vp, q); if (vp->vp_length == 0) fr_pair_list_free(&vp); break; How about something like this instead ? (copy a string, but do not trust the DHCP field to be actually null terminated) case PW_TYPE_STRING: if (*p != '\0') { uint8_t *end; int len; end = memchr(p, '\0', dhcp_header_sizes[i]); len = end ? end - p : dhcp_header_sizes[i]; q = talloc_array(vp, char, len + 1); memcpy(q, p, len); q[len] = '\0'; fr_pair_value_strsteal(vp, q); } if (vp->vp_length == 0) fr_pair_list_free(&vp); break; This would avoid having things like: DHCP-Server-Host-Name = "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" DHCP-Boot-Filename = "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" (I can do a pull request for 3.1.x if you wish) Regards, Nicolas. This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

3 2

peap/eap change in 3.0.x with inner_eap_module now required
by Matthew Newton 20 Jan '16

20 Jan '16

Hi, Heads-up in case my note on github doesn't get seen before 3.0.11 arrives... Just compiled up latest 3.0.x HEAD and now get /srv/radius/mods-enabled/eap[51]: Failed to find 'Auth-Type eap' section. Cannot authenticate users. rlm_eap (outer-eap): Failed to initialise rlm_eap_peap /srv/radius/mods-enabled/eap[7]: Instantiation failed for module "outer-eap" at startup. This was working fine on a previous 3.0.10 (from around November time). EAP modules here are called "outer-eap" and "inner-eap" (for my sanity - we've got PEAP/EAP-TLS, so it's "double-stacked" :-) ) Adding in the new "inner_eap_module" option to the outer PEAP section fixes it (inner_eap_module = "outer-eap") but I'm not sure why it needs to break in 3.0.x? Cheers, Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk>

3 11

Re: Radius hangs on startup
by Siddharth Katragadda 13 Jan '16

13 Jan '16

Hi, Any advice on this? Thanks SId On Thu, Jan 7, 2016 at 5:11 PM, Siddharth Katragadda <siddharthk(a)google.com> wrote: > Hi, > > When I try to start freeradius (using sudo radiusd -X), I see that it > hangs after processing the TLS module and does not go to the "Waiting for > radius clients". > > Please see the radius output and also the eap.conf. > > This is on version 2.1.12 (we need to use this version for SIM testing as > moving to > the latest version was not working for SIM tests). This was working before > until I > updated the following packages: > > > sudo apt-get install libssl0.9.8 > > sudo apt-get install libssl-dev > Not sure if the hanging issue is relate to these libraries. > > Thanks in advance > Sid > >

4 6

Re: Radius hangs on startup
by Siddharth Katragadda 08 Jan '16

08 Jan '16

> Hi, > > When I try to start freeradius (using sudo radiusd -X), I see that it > hangs after processing the TLS module and does not go to the "Waiting for > radius clients". > > Please see the radius output and also the eap.conf. > > This is on version 2.1.12 (we need to use this version for SIM testing as > moving to > the latest version was not working for SIM tests). This was working before > until I > updated the following packages: > > > sudo apt-get install libssl0.9.8 > > sudo apt-get install libssl-dev > Not sure if the hanging issue is relate to these libraries. > > Thanks in advance > Sid > >

1 0

Updates to "unlang"
by Alan DeKok 15 Dec '15

15 Dec '15

There have been some long-needed changes to the "unlang" interpreter / compiler. For people who've looked at the code, it hadn't really changed since 2000 or so. Largely because it's core to the server, and confusing as heck. Now that we have a large number of test cases, I've been going through and fixing the code. It passes all of the tests, and more have been added. The new compiler is in modcall.c. The interpreter has been moved to interpreter.c. The split means it's easier to understand each piece in isolation. One benefit is that the mess of "if / then / else" statements has been changed to be table driven. Each keyword "foo" now as a dedicated compilation function compile_foo(), and a dedicate interpreter function modcall_foo(). This makes adding new keywords almost trivial. So the question is... what else would you like to see in "unlang"? I don't want to make it a general-purpose language, but some additional features may be useful. e.g. it would be possible for modules to dynamically register new unlang keywords / syntax: if (foo) { module-thing argument { ... ??? ... } } Ideas? Comments? Alan DeKok.

5 13

Fwd: talloc plugin for gdb
by Herwin Weststrate 15 Dec '15

15 Dec '15

Just saw this at the Samba mailing list. Since FreeRADIUS uses talloc as well, it might be an interesting plugin. -------- Forwarded Message -------- Subject: talloc plugin for gdb Date: Mon, 14 Dec 2015 10:48:56 +0100 From: Ralph Boehme <rb(a)sernet.de> To: Samba Technical <samba-technical(a)lists.samba.org> Newsgroups: gmane.network.samba.internals Hi! Was this mentioned before here ? <https://github.com/nccgroup/libtalloc> A talloc plugin for gdb. In case it was mentioned and I missed it, please ignore. -Ralph -- SerNet GmbH, Bahnhofsallee 1b, 37081 Göttingen phone: +49-551-370000-0, fax: +49-551-370000-9 AG Göttingen, HRB 2816, GF: Dr. Johannes Loxen http://www.sernet.de,mailto:kontakt@sernet.de

1 0

v2.x.x - ENABLE_OPENSSL_VERSION_CHECK
by Adam Bishop 09 Dec '15

09 Dec '15

I'm aware v2.x.x is EOL, reporting this just in case you're still correcting defects. In this commit: https://github.com/FreeRADIUS/freeradius-server/commit/4f24d4cda8b43b5f7031… ENABLE_OPENSSL_VERSION_CHECK is removed from around ssl_check_version. However allow_vulnerable_openssl is still wrapped by that condition in mainconfig.c and radiusd.h, so building with --disable-openssl_version_check fails as mainconfig is checked for a non-existent member. I think simply removing the condition from mainconfig.c and radiusd.h is sufficient (or should it be protected with HAVE_OPENSSL_CRYPTO_H?) - I could create a pull doing either of those if desired. Regards, Adam Bishop gpg: 0x6609D460 jisc.ac.uk | Networkshop 44: Save the date! | 22-24 March 2016 @ University of Manchester Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.

2 1

Possibilities for using winbind libs with Samba < 4.2.1
by Herwin Weststrate 08 Dec '15

08 Dec '15

This question is mainly for Matthew, since he is the author of auth_wbclient.c. I just tried to use that on our Debian systems, but then I saw that Samba version 4.2.1 was required. It seems that this version introduced the used method wbcCtxAuthenticateUserEx. Older versions (4.1.something on the current Debian stable) do however have a wbcAuthenticateUserEx, that looks like it does about the same thing, but without the context-object that the first method uses. Is there a specific reason that you used the functionality from Samba 4.2.1, or do you think it could be possible to make it work with older versions of Samba as well? I'm more than willing to actually write the code myself, but maybe you had already concluded that it won't be possible to make it work with older versions, than it would be a waste of time to try to make it work. -- Herwin Weststrate

4 6

3.1.x consistency check
by Matthew Newton 03 Dec '15

03 Dec '15

Hi, So trying 3.1.x to see if it fixes the 3.0.x error.... :) Packaged build (so disable-developer) segfaults in rlm_ldap (ldap.c:1431). Trying to debug that I built a new version which has enable-developer set. That bombs out in a consistency check in SoH, as below. Looks like it doesn't like that pair_make_request is called with a NULL value? But can't imagine that is right as that's normally what happens to create an attribute? About to go home now so thought I'd shoot out a quick e-mail in case someone else knows the immediate answer without me having to stare at code for a while :) (Update on the original issue; I'm going to build against latest talloc and see if that fixes it - may be just a bug in the older talloc version in Debian wheezy. That will have to wait until next week now.) Cheers, Matthew (14) # Executing group from file /srv/radius/sites-enabled/default (14) authenticate { (14) outer-eap: Peer sent packet with method EAP PEAP (25) (14) outer-eap: Calling submodule eap_peap to process data (14) eap_peap: Continuing EAP-TLS (14) eap_peap: Got complete TLS record (661 bytes) (14) eap_peap: [eap-tls verify] = ok (14) eap_peap: [eap-tls process] = ok (14) eap_peap: Session established. Decoding tunneled attributes (14) eap_peap: PEAP state WAITING FOR SOH RESPONSE (14) eap_peap: EAP method unknown (254) (14) eap_peap: SoH System-Health-ID vendor 00000137 component=0 (14) eap_peap: SoH MS type-value payload CONSISTENCY CHECK FAILED src/lib/pair.c[674]: VALUE_PAIR "SoH-MS-Machine-Name" char buffer not \0 terminated SOFT ASSERT FAILED src/lib/pair.c[2531]: 0 RAISING SIGNAL: Aborted Program received signal SIGABRT, Aborted. 0x00007ffff627f79b in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/pt-raise.c:37 37 ../nptl/sysdeps/unix/sysv/linux/pt-raise.c: No such file or directory. (gdb) (gdb) bt #0 0x00007ffff627f79b in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/pt-raise.c:37 #1 0x00007ffff79504ce in fr_fault (sig=6) at src/lib/debug.c:648 #2 0x00007ffff7950fdb in fr_assert_cond (file=0x7ffff798205b "src/lib/pair.c", line=2531, expr=0x7ffff79824e6 "0", cond=false) at src/lib/debug.c:1090 #3 0x00007ffff7963154 in fr_pair_verify (file=0x7ffff798205b "src/lib/pair.c", line=674, vp=0xafe780) at src/lib/pair.c:2531 #4 0x00007ffff795ff49 in fr_pair_add (head=0xb11d10, add=0xafea10) at src/lib/pair.c:674 #5 0x00007ffff795fc5f in fr_pair_make (ctx=0xb11c90, vps=0xb11d10, attribute=0x464afc "SoH-MS-Machine-Role", value=0x0, op=T_OP_SET) at src/lib/pair.c:536 #6 0x00000000004357fe in eap_peap_soh_mstlv (request=0xb121f0, p=0xae054f "\001", data_len=5) at src/main/soh.c:299 #7 0x000000000043603b in soh_verify (request=0xb121f0, data=0xae04ee "", data_len=543) at src/main/soh.c:502 #8 0x00007ffff1553779 in eap_peap_soh_verify (request=0xb121f0, packet=0xafe020, data=0xae04a8 "", data_len=621) at src/modules/rlm_eap/types/rlm_eap_peap/peap.c:198 #9 0x00007ffff15550a6 in eap_peap_process (eap_session=0xadafa0, tls_session=0xadc350) at src/modules/rlm_eap/types/rlm_eap_peap/peap.c:814 #10 0x00007ffff1552ff5 in mod_process (arg=0xaa3820, eap_session=0xadafa0) at src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c:293 #11 0x00007ffff1b6361f in eap_module_call (module=0xaa3590, eap_session=0xadafa0) at src/modules/rlm_eap/eap.c:189 #12 0x00007ffff1b63ea8 in eap_method_select (inst=0xa3d570, eap_session=0xadafa0) at src/modules/rlm_eap/eap.c:425 #13 0x00007ffff1b622fb in mod_authenticate (instance=0xa3d570, request=0xb121f0) at src/modules/rlm_eap/rlm_eap.c:202 #14 0x0000000000429051 in call_modsingle (component=MOD_AUTHENTICATE, sp=0xaba740, request=0xb121f0) at src/main/modcall.c:327 #15 0x0000000000429749 in modcall_recurse (request=0xb121f0, component=MOD_AUTHENTICATE, depth=1, entry=0x7fffffffd818, do_next_sibling=true) at src/main/modcall.c:610 #16 0x0000000000429221 in modcall_child (request=0xb121f0, component=MOD_AUTHENTICATE, depth=1, entry=0x7fffffffd800, c=0xaba740, result=0x7fffffffd6ec, do_next_sibling=true) at src/main/modcall.c:434 #17 0x000000000042a2ea in modcall_recurse (request=0xb121f0, component=MOD_AUTHENTICATE, depth=0, entry=0x7fffffffd800, do_next_sibling=true) at src/main/modcall.c:834 #18 0x000000000042b00a in modcall (component=MOD_AUTHENTICATE, c=0xaba640, request=0xb121f0) at src/main/modcall.c:1179 #19 0x00000000004266a8 in indexed_modcall (comp=MOD_AUTHENTICATE, idx=1368977, request=0xb121f0) at src/main/modules.c:956 #20 0x000000000042895f in process_authenticate (auth_type=1368977, request=0xb121f0) at src/main/modules.c:2099 #21 0x000000000040f32b in rad_check_password (request=0xb121f0) at src/main/auth.c:251 #22 0x000000000040fa25 in rad_authenticate (request=0xb121f0) at src/main/auth.c:516 #23 0x000000000043a089 in request_running (request=0xb121f0, action=1) at src/main/process.c:1482 #24 0x0000000000438d97 in request_queue_or_run (request=0xb121f0, process=0x439f27 <request_running>) at src/main/process.c:953 #25 0x000000000043a98c in request_receive (ctx=0xb11c30, listener=0xa09090, packet=0xb11c90, client=0x9905e0, fun=0x40f4d0 <rad_authenticate>) at src/main/process.c:1740 #26 0x00000000004189cb in auth_socket_recv (listener=0xa09090) at src/main/listen.c:1903 #27 0x00000000004415a1 in event_socket_handler (xel=0xac79d0, fd=15, ctx=0xa09090) at src/main/process.c:4544 #28 0x00007ffff797aa53 in fr_event_loop (el=0xac79d0) at src/lib/event.c:637 #29 0x00000000004432e6 in radius_event_process () at src/main/process.c:5587 #30 0x0000000000431cdd in main (argc=4, argv=0x7fffffffe6e8) at src/main/radiusd.c:578 (gdb) -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk>

2 10