- Freeradius-Devel - lists.freeradius.org

Commit report for v3.1.x branch
by announce＠freeradius.org 03 Apr '15

03 Apr '15

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== More checks on identity Alan T. DeKok@2015-04-03T02:37:07Z Files modified: * src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/90c8471bbfc218be9606… ====== Limit identity length Alan T. DeKok@2015-04-03T02:37:06Z Files modified: * src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/69dd9582ded05bc94457… ====== Allow EAP-MSCHAPv2 to have configurable server identity. Fixes #932. We don't allow this to be dynamically expanded. It's just easier. Alan T. DeKok@2015-04-03T01:41:43Z Files modified: * raddb/mods-available/eap * src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/616f7da8c7d6121b1085… ====== -- This commit summary was generated @2015-04-04T00:00:05Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v3.1.x branch
by announce＠freeradius.org 01 Apr '15

01 Apr '15

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== added VALUEs Alan T. DeKok@2015-04-01T19:49:35Z Files modified: * share/dictionary.rfc7499 Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/dec7ff66f34d773d25de… ====== Added from RFC which has numbers assigned Alan T. DeKok@2015-04-01T19:34:36Z Files modified: * share/dictionary * share/dictionary.rfc7499 Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/634bdb7b29089ed9fd95… ====== Fix cppcheck complaint Alan T. DeKok@2015-04-01T17:14:08Z Files modified: * src/modules/rlm_eap/radeapclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/ca7e2bbfc9b84efd38e9… ====== Update proxy docs for TLS Alan T. DeKok@2015-04-01T16:37:04Z Files modified: * raddb/proxy.conf Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/ba3c4e6963e688906599… ====== Remove bad talloc_free Alan T. DeKok@2015-04-01T16:33:35Z Files modified: * src/main/realms.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/8a1876e6b70bae8e4662… ====== Loop over COUNT entries. Maybe addresses #945 Alan T. DeKok@2015-04-01T14:57:34Z Files modified: * src/main/modcall.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/76f4ac8be0cd81d70487… ====== Revert "Unlock file while waiting for the DB" This reverts commit a91017d3c391093493757cd4651a455770c4c8c1. it's better for the server to do this in exfile.c Alan T. DeKok@2015-04-01T14:30:23Z Files modified: * scripts/sql/radsqlrelay Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/6c65b52b63ef1e8974af… ====== Try 3 times to lock it. If it fails, return an error Alan T. DeKok@2015-04-01T14:28:48Z Files modified: * src/main/exfile.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/611a2f70c55285ae068e… ====== Create correctly formatted session cache entries Alan T. DeKok@2015-04-01T14:23:33Z Files modified: * src/main/tls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/0add972c42c9d1c8bd01… ====== Complain if stupid people disable all TLS versions Alan T. DeKok@2015-04-01T14:23:32Z Files modified: * src/main/tls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/b3bd45b104aaf36f6143… ====== Small elasticsearch fixups Matthew Newton (via Alan T. DeKok)@2015-04-01T14:23:30Z Files modified: * doc/schemas/logstash/README * doc/schemas/logstash/radius-mapping.sh * doc/schemas/logstash/radius.conf Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/98f442ac706bbe75f2d3… ====== Add example elasticsearch/logstash config for detail files Matthew Newton (via Arran Cudbard-Bell)@2015-04-01T00:16:30Z Files modified: * doc/schemas/logstash/README * doc/schemas/logstash/radius-mapping.sh * doc/schemas/logstash/radius.conf Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/c791069178187a192ac2… ====== -- This commit summary was generated @2015-04-02T00:00:04Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v3.0.x branch
by announce＠freeradius.org 01 Apr '15

01 Apr '15

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== added VALUEs Alan T. DeKok@2015-04-01T19:49:22Z Files modified: * share/dictionary.rfc7499 Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/9f8a425d90741ca71668… ====== Added from RFC which has numbers assigned Alan T. DeKok@2015-04-01T19:34:19Z Files modified: * share/dictionary * share/dictionary.rfc7499 Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/c6601da6a145bb2e2150… ====== Warning for old config Alan T. DeKok@2015-04-01T18:08:30Z Files modified: * src/main/realms.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/088d70e8a609d31e5c64… ====== Fix cppcheck complaint Alan T. DeKok@2015-04-01T17:13:56Z Files modified: * src/modules/rlm_eap/radeapclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/fc0734c04abc4611aa6e… ====== Update proxy docs for TLS Alan T. DeKok@2015-04-01T16:36:50Z Files modified: * raddb/proxy.conf Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/b887cf76dff5f9f6246c… ====== Remove bad free Alan T. DeKok@2015-04-01T16:32:45Z Files modified: * src/main/realms.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/5e6f84d29336defecd9a… ====== Loop over COUNT entries. Maybe addresses #945 Alan T. DeKok@2015-04-01T14:57:15Z Files modified: * src/main/modcall.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/e774cb6ff53032a63295… ====== Revert "Unlock file while waiting for the DB" This reverts commit a91017d3c391093493757cd4651a455770c4c8c1. it's better for the server to do this in exfile.c Alan T. DeKok@2015-04-01T14:30:04Z Files modified: * scripts/sql/radsqlrelay Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/191d5f5b9e8c0e24aad3… ====== Try 3 times to lock it. If it fails, return an error Alan T. DeKok@2015-04-01T14:28:26Z Files modified: * src/main/exfile.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/c998e0bade1a29a49b86… ====== Create correctly formatted session cache entries Alan T. DeKok@2015-04-01T14:22:54Z Files modified: * src/main/tls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/79c1994fcdff76ba64f4… ====== Complain if stupid people disable all TLS versions Alan T. DeKok@2015-04-01T14:22:54Z Files modified: * src/main/tls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/7a593f3a7a3f1e96cdd1… ====== Merge pull request #946 from mcnewton/pr2 Small elasticsearch fixups Alan DeKok@2015-04-01T14:02:22Z Files modified: * doc/schemas/logstash/README * doc/schemas/logstash/radius-mapping.sh * doc/schemas/logstash/radius.conf Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/694d1c3e033902006580… ====== Small elasticsearch fixups Matthew Newton@2015-04-01T13:44:31Z Files modified: * doc/schemas/logstash/README * doc/schemas/logstash/radius-mapping.sh * doc/schemas/logstash/radius.conf Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/93f272105a98952dae85… ====== Merge pull request #944 from mcnewton/pr logstash/elasticsearch config for detail file analysis Arran Cudbard-Bell@2015-04-01T00:16:10Z Files modified: * doc/developer/coding-methods.rst * doc/developer/contributing.rst * doc/developer/release-method.rst * doc/schemas/logstash/README * doc/schemas/logstash/radius-mapping.sh * doc/schemas/logstash/radius.conf Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/82d6d7a7aa3befc746d4… ====== Add example elasticsearch/logstash config for detail files Matthew Newton@2015-04-01T00:02:23Z Files modified: * doc/schemas/logstash/README * doc/schemas/logstash/radius-mapping.sh * doc/schemas/logstash/radius.conf Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/95d1553bcde887ea851c… ====== Tidy documentation formatting/whitespace Matthew Newton@2015-03-31T23:45:33Z Files modified: * doc/developer/coding-methods.rst * doc/developer/contributing.rst * doc/developer/release-method.rst Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/a3bf6a16a21677946a57… ====== -- This commit summary was generated @2015-04-02T00:00:04Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Crash in FR with no secret defined for a realm
by Stefan Paetow 01 Apr '15

01 Apr '15

I don't think *this* is supposed to happen! :-/ Copyright (C) 1999-2015 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/abfab_psk_sql including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/cache_eap including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/abfab-tr including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/operator-name including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/abfab-tr-idp including configuration file /etc/raddb/sites-enabled/channel_bindings including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/abfab-tls main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "yes" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server main-idp65x64_localdomain { ipaddr = 192.168.213.24 port = 2083 type = "auth" proto = "tcp" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 ca_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/client.pem" certificate_file = "/etc/raddb/certs/client.pem" ca_file = "/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 8192 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" } realm main-rp65x64.localdomain { } realm LOCAL { } realm main-idp65x64.localdomain { /etc/raddb/proxy.conf[754]: No shared secret supplied for realm: main-idp65x64.localdomain } # realm main-idp65x64.localdomain *** glibc detected *** radiusd: free(): invalid pointer: 0x00000000013a70c0 *** ======= Backtrace: ========= /lib64/libc.so.6[0x3075475e66] radiusd(realms_init+0x82c)[0x437b0c] radiusd(main_config_init+0x77b)[0x41c80b] radiusd(main+0x399)[0x4253c9] /lib64/libc.so.6(__libc_start_main+0xfd)[0x307541ed5d] radiusd[0x40e0e9] ======= Memory map: ======== 00400000-0045d000 r-xp 00000000 fd:00 552232 /usr/sbin/radiusd 0065d000-00663000 rw-p 0005d000 fd:00 552232 /usr/sbin/radiusd 00663000-00664000 rw-p 00000000 00:00 0 00862000-00869000 rw-p 00062000 fd:00 552232 /usr/sbin/radiusd 01157000-013c3000 rw-p 00000000 00:00 0 [heap] 3075000000-3075020000 r-xp 00000000 fd:00 651116 /lib64/ld-2.12.so 307521f000-3075220000 r--p 0001f000 fd:00 651116 /lib64/ld-2.12.so 3075220000-3075221000 rw-p 00020000 fd:00 651116 /lib64/ld-2.12.so 3075221000-3075222000 rw-p 00000000 00:00 0 3075400000-307558a000 r-xp 00000000 fd:00 651150 /lib64/libc-2.12.so 307558a000-307578a000 ---p 0018a000 fd:00 651150 /lib64/libc-2.12.so 307578a000-307578e000 r--p 0018a000 fd:00 651150 /lib64/libc-2.12.so 307578e000-307578f000 rw-p 0018e000 fd:00 651150 /lib64/libc-2.12.so 307578f000-3075794000 rw-p 00000000 00:00 0 3075800000-3075817000 r-xp 00000000 fd:00 651155 /lib64/libpthread-2.12.so 3075817000-3075a17000 ---p 00017000 fd:00 651155 /lib64/libpthread-2.12.so 3075a17000-3075a18000 r--p 00017000 fd:00 651155 /lib64/libpthread-2.12.so 3075a18000-3075a19000 rw-p 00018000 fd:00 651155 /lib64/libpthread-2.12.so 3075a19000-3075a1d000 rw-p 00000000 00:00 0 3075c00000-3075c02000 r-xp 00000000 fd:00 651305 /lib64/libdl-2.12.so 3075c02000-3075e02000 ---p 00002000 fd:00 651305 /lib64/libdl-2.12.so 3075e02000-3075e03000 r--p 00002000 fd:00 651305 /lib64/libdl-2.12.so 3075e03000-3075e04000 rw-p 00003000 fd:00 651305 /lib64/libdl-2.12.so 3076000000-3076007000 r-xp 00000000 fd:00 651820 /lib64/librt-2.12.so 3076007000-3076206000 ---p 00007000 fd:00 651820 /lib64/librt-2.12.so 3076206000-3076207000 r--p 00006000 fd:00 651820 /lib64/librt-2.12.so 3076207000-3076208000 rw-p 00007000 fd:00 651820 /lib64/librt-2.12.so 3076400000-3076415000 r-xp 00000000 fd:00 653421 /lib64/libz.so.1.2.3 3076415000-3076614000 ---p 00015000 fd:00 653421 /lib64/libz.so.1.2.3 3076614000-3076615000 r--p 00014000 fd:00 653421 /lib64/libz.so.1.2.3 3076615000-3076616000 rw-p 00015000 fd:00 653421 /lib64/libz.so.1.2.3 3076c00000-3076c3a000 r-xp 00000000 fd:00 663661 /lib64/libreadline.so.6.0 3076c3a000-3076e3a000 ---p 0003a000 fd:00 663661 /lib64/libreadline.so.6.0 3076e3a000-3076e42000 rw-p 0003a000 fd:00 663661 /lib64/libreadline.so.6.0 3076e42000-3076e43000 rw-p 00000000 00:00 0 3077000000-307701d000 r-xp 00000000 fd:00 653423 /lib64/libselinux.so.1 307701d000-307721c000 ---p 0001d000 fd:00 653423 /lib64/libselinux.so.1 307721c000-307721d000 r--p 0001c000 fd:00 653423 /lib64/libselinux.so.1 307721d000-307721e000 rw-p 0001d000 fd:00 653423 /lib64/libselinux.so.1 307721e000-307721f000 rw-p 00000000 00:00 0 3077400000-3077416000 r-xp 00000000 fd:00 653411 /lib64/libresolv-2.12.so 3077416000-3077616000 ---p 00016000 fd:00 653411 /lib64/libresolv-2.12.so 3077616000-3077617000 r--p 00016000 fd:00 653411 /lib64/libresolv-2.12.so 3077617000-3077618000 rw-p 00017000 fd:00 653411 /lib64/libresolv-2.12.so 3077618000-307761a000 rw-p 00000000 00:00 0 3077800000-307783d000 r-xp 00000000 fd:00 538624 /usr/lib64/libpcap.so.1.4.0 307783d000-3077a3d000 ---p 0003d000 fd:00 538624 /usr/lib64/libpcap.so.1.4.0 3077a3d000-3077a3f000 rw-p 0003d000 fd:00 538624 /usr/lib64/libpcap.so.1.4.0 3077a3f000-3077a40000 rw-p 00000000 00:00 0 3077c00000-3077c2c000 r-xp 00000000 fd:00 663714 /lib64/libpcre.so.0.0.1 3077c2c000-3077e2b000 ---p 0002c000 fd:00 663714 /lib64/libpcre.so.0.0.1 3077e2b000-3077e2c000 rw-p 0002b000 fd:00 663714 /lib64/libpcre.so.0.0.1 3078c00000-3078c0a000 r-xp 00000000 fd:00 538616 /usr/lib64/libtalloc.so.2.0.7 3078c0a000-3078e09000 ---p 0000a000 fd:00 538616 /usr/lib64/libtalloc.so.2.0.7 3078e09000-3078e0a000 rw-p 00009000 fd:00 538616 /usr/lib64/libtalloc.so.2.0.7 307f000000-307f002000 r-xp 00000000 fd:00 653740 /lib64/libfreebl3.so 307f002000-307f201000 ---p 00002000 fd:00 653740 /lib64/libfreebl3.so 307f201000-307f202000 r--p 00001000 fd:00 653740 /lib64/libfreebl3.so 307f202000-307f203000 rw-p 00002000 fd:00 653740 /lib64/libfreebl3.so 3080000000-3080007000 r-xp 00000000 fd:00 659526 /lib64/libcrypt-2.12.so 3080007000-3080207000 ---p 00007000 fd:00 659526 /lib64/libcrypt-2.12.so 3080207000-3080208000 r--p 00007000 fd:00 659526 /lib64/libcrypt-2.12.so 3080208000-3080209000 rw-p 00008000 fd:00 659526 /lib64/libcrypt-2.12.so 3080209000-3080237000 rw-p 00000000 00:00 0 3080c00000-3080c1d000 r-xp 00000000 fd:00 661285 /lib64/libtinfo.so.5.7 3080c1d000-3080e1d000 ---p 0001d000 fd:00 661285 /lib64/libtinfo.so.5.7 3080e1d000-3080e21000 rw-p 0001d000 fd:00 661285 /lib64/libtinfo.so.5.7 3081000000-3081003000 r-xp 00000000 fd:00 663711 /lib64/libcom_err.so.2.1 3081003000-3081202000 ---p 00003000 fd:00 663711 /lib64/libcom_err.so.2Aborted (core dumped) Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc¹s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200.

2 1

Last call for 3.0.8
by Alan DeKok 01 Apr '15

01 Apr '15

Can we get that tested? Especially with the TLSv1 / TLSv1.1 / TLSv1.2 changes that went in today. I think we're otherwise good to go. Alan DeKok.

7 16

RFC 5077 ticket key derivation
by Arran Cudbard-Bell 01 Apr '15

01 Apr '15

/** Generate a new session ticket * * Signs the administrator configured key, using the private key associated with the * SSL context, then hashes the signature to get a key of an appropriate length, * which is fed to the hmac and encryption contexts for the session ticket. * * @param out Where to write the derived session ticket key. * @param pkey used to the create the signature. * @param key to be signed using the private key, then hashed. * @param keylen length of key to be signed. * @return 0 on success, -1 on failure. */ static int tls_session_ticket_key(uint8_t out[SHA256_DIGEST_LENGTH], EVP_PKEY *pkey, uint8_t const *key, size_t keylen) { int ret; const EVP_MD *md = EVP_sha256(); EVP_MD_CTX mdctx; unsigned int outlen; uint8_t *sig; EVP_MD_CTX_init(&mdctx); ret = EVP_DigestInit(&mdctx, md); if (ret != 1) { ERROR("Failed initialising digest: %s", ERR_error_string(ERR_get_error(), NULL)); return -1; } ret = EVP_SignInit(&mdctx, md); if (ret != 1) { ERROR("Failed initialising signing context: %s", ERR_error_string(ERR_get_error(), NULL)); error: EVP_MD_CTX_cleanup(&mdctx); return -1; } ret = EVP_SignUpdate(&mdctx, key, keylen); if (ret != 1) { ERROR("Failed signing key: %s", ERR_error_string(ERR_get_error(), NULL)); goto error; } ret = EVP_SignFinal(&mdctx, NULL, &outlen, pkey); if (ret != 1) { ERROR("Failed finalising digest signature: %s", ERR_error_string(ERR_get_error(), NULL)); goto error; } MEM(sig = talloc_array(NULL, uint8_t, outlen)); ret = EVP_SignFinal(&mdctx, sig, &outlen, pkey); if (ret != 1) { ERROR("Failed finalising digest signature: %s", ERR_error_string(ERR_get_error(), NULL)); goto error; } EVP_MD_CTX_cleanup(&mdctx); EVP_MD_CTX_init(&mdctx); ret = EVP_DigestInit(&mdctx, md); if (ret != 1) { ERROR("Failed initialising digest: %s", ERR_error_string(ERR_get_error(), NULL)); talloc_free(sig); goto error; } ret = EVP_DigestUpdate(&mdctx, sig, outlen); if (ret != 1) { ERROR("Failed updating digest: %s", ERR_error_string(ERR_get_error(), NULL)); talloc_free(sig); goto error; } ret = EVP_DigestFinal(&mdctx, out, NULL); talloc_free(sig); if (ret != 1) { ERROR("Failed updating digest: %s", ERR_error_string(ERR_get_error(), NULL)); goto error; } return 0; } Anyone have opinions on this? The idea is to allow multiple RADIUS servers to calculate the same key independently without a common store, and to ensure that the derived keys are sufficiently complex, regardless of what the administrator configures. There's no standard for this that i've seen, nor is there a situation that I can see where deploying heterogeneous RADIUS servers in a HA cluster is useful. RFC5077 recommends periodic key rotations, which is possible, as 'key', is the result of a template expansion, which could be an xlat, attr ref or exec. I've confirmed that if an incorrect key is provided via the SSL_CTX_set_tlsext_ticket_key_cb that auth continues normally as if no ticket had been presented, and a new ticket is generated. -Arran Tue Mar 31 05:57:15 2015 : Debug: (5) eap_peap: New session ticket: 0x6e8b68c6803654c78bf7e6db15d7ea00 Tue Mar 31 05:57:15 2015 : Debug: (5) eap_peap: Session ticket key: 0x35 Tue Mar 31 05:57:15 2015 : Debug: (5) eap_peap: Session ticket key (derived): 0x11ab45219b8ebafac633475ac0a9be597055b26a27c4d196ff542fa6834a860b Tue Mar 31 05:57:15 2015 : Debug: (5) eap_peap: TLS_accept: SSLv3 write session ticket A Tue Mar 31 05:57:15 2015 : Debug: (13) eap_peap: Got session ticket: 0x6e8b68c6803654c78bf7e6db15d7ea00 Tue Mar 31 05:57:15 2015 : Debug: (13) eap_peap: Session ticket key: 0x3133 Tue Mar 31 05:57:15 2015 : Debug: (13) eap_peap: Session ticket key (derived): 0x9a12beeaf8d3a9ed30d50e065c21e2260a62f9bbabd16616873f3923cb8e90a1 Tue Mar 31 05:57:15 2015 : Debug: (16) eap_peap: New session ticket: 0x6928501f7ea2e7cfddc26da251f6d7f2 Tue Mar 31 05:57:15 2015 : Debug: (16) eap_peap: Session ticket key: 0x3136 Tue Mar 31 05:57:15 2015 : Debug: (16) eap_peap: Session ticket key (derived): 0x5979e02312c1b500bd32f3a5ad785c19e4a9f1d0ba4b4c8083b39252ea216ce9 Tue Mar 31 05:57:15 2015 : Debug: (16) eap_peap: TLS_accept: SSLv3 write session ticket A Tue Mar 31 05:57:15 2015 : Debug: (24) eap_peap: Got session ticket: 0x6928501f7ea2e7cfddc26da251f6d7f2 Tue Mar 31 05:57:15 2015 : Debug: (24) eap_peap: Session ticket key: 0x3234 Tue Mar 31 05:57:15 2015 : Debug: (24) eap_peap: Session ticket key (derived): 0x31e2bb458f5d9ef76d0a7d63696e3b33d1f57d1e4ef5a3f2f6d880d6135b8b4a Tue Mar 31 05:57:15 2015 : Debug: (27) eap_peap: New session ticket: 0x62a418806a4c58025628864c5b3a8af0 Tue Mar 31 05:57:15 2015 : Debug: (27) eap_peap: Session ticket key: 0x3237 Tue Mar 31 05:57:15 2015 : Debug: (27) eap_peap: Session ticket key (derived): 0x6c09a944a07cece8fef510427b41041d831f2dd8d8430e9be49e9bb1233ad32f Tue Mar 31 05:57:15 2015 : Debug: (27) eap_peap: TLS_accept: SSLv3 write session ticket A Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

3 7

Commit report for v3.0.x branch
by announce＠freeradius.org 31 Mar '15

31 Mar '15

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Servers are freed individually on server exit, so can't be parented off of the client Arran Cudbard-Bell@2015-03-31T23:39:32Z Files modified: * src/main/client.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/a299f712c9b2d9ecdd26… ====== note recent changes Alan T. DeKok@2015-03-31T22:59:03Z Files modified: * doc/ChangeLog Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/f2b15c5866d2b92a2842… ====== Warn on use of expanded EAP types Alan T. DeKok@2015-03-31T22:57:49Z Files modified: * src/modules/rlm_eap/eap.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/370224f8024e52168c28… ====== Convert expanded EAP to normal EAP Alan T. DeKok@2015-03-31T22:45:46Z Files modified: * src/modules/rlm_eap/eap.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/bc993849f42d8f44a110… ====== First stab at supporting Expanded Type EAP packets Only for vendor 0 (IETF). And only for known EAP types. Untested, so it's ifdef'd out. Once it's tested, we can enable it. Alan T. DeKok@2015-03-31T21:58:29Z Files modified: * src/modules/rlm_eap/eap.c * src/modules/rlm_eap/libeap/eap_types.h Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/fc85cd89b3740ba4a156… ====== Only call tr_init if trust router is configured And only call "get realm" on the same conditions Alan T. DeKok@2015-03-31T21:16:33Z Files modified: * src/modules/rlm_realm/rlm_realm.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/f95d9705320fea5b84ff… ====== Fail safely if there's no trust router Alan T. DeKok@2015-03-31T19:39:20Z Files modified: * src/modules/rlm_realm/trustrouter.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/4ff00c9f20a0ab5b490e… ====== Be a bit more careful about locking files We try to lock it non-blocking. If fail, close the file, re-open it, and try to lock it again. This lets us catch the corner case of the reader re-naming the file after we opened it, locking it, and trying again. Alan T. DeKok@2015-03-31T18:38:56Z Files modified: * src/main/exfile.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/4ea91d68ac9a7f586fc6… ====== Unlock file while waiting for the DB Otherwise the server might block forever waiting for our lock to be released Alan T. DeKok@2015-03-31T18:38:56Z Files modified: * scripts/sql/radsqlrelay Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/a91017d3c39109349375… ====== Remove unnecessary comment Alan T. DeKok@2015-03-31T18:38:56Z Files modified: * src/main/tls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/1c39850f5b26ed058f99… ====== Add version strings for TLS 1.1, 1.2 and 1.3 Arran Cudbard-Bell@2015-03-31T18:25:26Z Files modified: * src/main/tls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/557ed07e0f4e4bb41005… ====== Update ChangeLog Arran Cudbard-Bell@2015-03-31T18:14:59Z Files modified: * doc/ChangeLog Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/e5b7e07d2033db04305e… ====== Re-enable TLS 1.2 by default Arran Cudbard-Bell@2015-03-31T17:25:29Z Files modified: * src/main/tls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/1b8f422cfadbdcfc5e58… ====== Typos Arran Cudbard-Bell@2015-03-31T16:50:06Z Files modified: * src/modules/rlm_eap/libeap/mppe_keys.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/ee7d8718bd973e1ffa11… ====== Use SSL_export_keying_material if available. This generates keys using the correct PRF with TLS 1.2 Arran Cudbard-Bell@2015-03-31T16:44:15Z Files modified: * src/modules/rlm_eap/libeap/mppe_keys.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/254c61cfadd20f100a7e… ====== note recent changes Alan T. DeKok@2015-03-31T15:59:22Z Files modified: * doc/ChangeLog Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/0221f099aed3b1c18aff… ====== Allow disabling of tlsv1 Alan T. DeKok@2015-03-31T15:57:41Z Files modified: * src/include/tls-h * src/main/tls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/61888b71c166b258493d… ====== Stop on no next entry Alan T. DeKok@2015-03-31T15:14:55Z Files modified: * src/modules/rlm_sql/rlm_sql.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/455cfe145183318ce47a… ====== Fix compilation errors Alan T. DeKok@2015-03-31T15:14:41Z Files modified: * src/modules/rlm_eap/radeapclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/6f7e32f21ed96612088d… ====== Update for 3.0.8 Alan T. DeKok@2015-03-31T04:46:35Z Files modified: * man/man5/users.5 Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/c5d65a962db06dc89826… ====== Comments Alan T. DeKok@2015-03-31T04:46:35Z Files modified: * src/main/process.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/9781b68c7b9f9e0892d0… ====== Don't use 2 names for the same thing Alan T. DeKok@2015-03-31T04:46:34Z Files modified: * raddb/mods-available/files Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/d95c034eae276137e807… ====== Merge pull request #931 from nchaigne/3.0.x-fb4-rc radeapclient - eap context struct Arran Cudbard-Bell@2015-03-31T02:25:11Z Files modified: * src/modules/rlm_eap/radeapclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/a595cd6efd7ba6228150… ====== radeapclient - fixed EAP-MD5 EAP-MD5 works again now. Nicolas C@2015-03-25T16:49:56Z Files modified: * src/modules/rlm_eap/radeapclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/628ef0b2945255dec549… ====== radeapclient - union for eap context Use an union to separate sim and md5 specific members. Nicolas C@2015-03-25T11:47:10Z Files modified: * src/modules/rlm_eap/radeapclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/7b8827318b399cbe8a96… ====== radeapclient - code clean-up Fixes, formatting, and code clean-up. Removed old (now unused) functions: - debug_packet - send_packet - sendrecv_eap Nicolas C@2015-03-25T09:09:40Z Files modified: * src/modules/rlm_eap/radeapclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/970cef796898ce6b7286… ====== radeapclient - process special attributes Last commit did not build on Travis. Fixed. Added processing of special attributes in input vps (copied from radclient). And some other minor stuff. Nicolas C@2015-03-24T18:27:04Z Files modified: * src/modules/rlm_eap/radeapclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/dffc9fc4b8d2f85aaa2a… ====== radeapclient - parallel mode (now working) This one is larger. (but this was necessary.) The new stuff is now in use, and working! The old "sendrecv_eap" sequential function is no longer called. Instead a main loop handles: starting new transactions and sending packets, receiving and handling responses, checking for timeouts and handling retransmissions. Some minor things needs to be addressed, but I feel this is very close to being mergeable. New option added: "-p <parallel>". I removed option "-i", which has been broken for ages and I think will never be fixed (since we use FreeRADIUS's packet list library, the ID is automatically allocated). Nicolas C@2015-03-24T16:54:49Z Files modified: * src/modules/rlm_eap/radeapclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/0cdbe1ee471ed595066b… ====== radeapclient - receive using packet list Added an event list (not yet used). Added new functions: - rc_finish_transaction - rc_send_transaction_packet - rc_deallocate_id - rc_recv_one_packet (not yet used) Nicolas C@2015-03-24T10:48:15Z Files modified: * src/modules/rlm_eap/radeapclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/8b224602e139d538d357… ====== radeapclient - preparing packet list use Cleaned-up main. Added a packet list (not yet used) Added new functions: - rc_add_socket - rc_resolve_hostname - rc_send_one_packet (not yet used) These I stole from radclient: - rc_request_types[] array - rc_get_port function - rc_get_code function Nicolas C@2015-03-24T09:37:03Z Files modified: * src/modules/rlm_eap/radeapclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/5b66a5612bbfaabb4d30… ====== radeapclient - now use the transactions Now load the input data and use it to properly initialize transactions. These are then used to do the EAP-SIM workflow. Nicolas C@2015-03-23T19:34:32Z Files modified: * src/modules/rlm_eap/radeapclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/f3d569bdbf0853814a96… ====== radeapclient - init transactions New functions (not yet used) to initialize transactions, and yank elements from the input list of vps. Nicolas C@2015-03-23T18:29:21Z Files modified: * src/modules/rlm_eap/radeapclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/2c07db3c97a8ff83e429… ====== radeapclient - new structures (input, transactions) New structures added to hold: - input value pairs read from file or stdin. - transactions contexts (similar to radclient's 'rc_request_t'). And new functions (not yet used) to read input vps and load them into a list. Nicolas C@2015-03-23T17:47:00Z Files modified: * src/modules/rlm_eap/radeapclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/43238920dba379c4f590… ====== radeapclient - use eap context Make use of the previously defined eap context struct. Nicolas C@2015-03-23T16:35:04Z Files modified: * src/modules/rlm_eap/radeapclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/421bc55cce3d0505a4ba… ====== radeapclient - eap context struct Definition of a structure which will hold the EAP context information. This will also make easier to merge with radclient later on. As requested, small commits on purpose. If they are too small please let me know, I will adjust :) Nicolas C@2015-03-23T09:32:03Z Files modified: * src/modules/rlm_eap/radeapclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/b575dbd81f54263dd836… ====== New travis apt plugin config structure Arran Cudbard-Bell@2015-03-31T00:01:06Z Files modified: * .travis.yml Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/deaa3b2c36f5f9a8dbf0… ====== -- This commit summary was generated @2015-04-01T00:00:03Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v3.1.x branch
by announce＠freeradius.org 31 Mar '15

31 Mar '15

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Servers are freed individually on server exit, so can't be parented off of the client Arran Cudbard-Bell@2015-03-31T23:39:47Z Files modified: * src/main/client.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/c51035b17083e20a5df3… ====== Allow disabling of tlsv1 Alan T. DeKok@2015-03-31T23:12:05Z Files modified: * src/include/tls-h * src/main/tls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/a9277b02d5b03e9af23b… ====== Warn on use of expanded EAP types Alan T. DeKok@2015-03-31T22:58:06Z Files modified: * src/modules/rlm_eap/eap.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/4f7bb82a4a37d5b45f6a… ====== Convert expanded EAP to normal EAP Alan T. DeKok@2015-03-31T22:46:10Z Files modified: * src/modules/rlm_eap/eap.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/c0fade2883091ada55e9… ====== First stab at supporting Expanded Type EAP packets Only for vendor 0 (IETF). And only for known EAP types. Untested, so it's ifdef'd out. Once it's tested, we can enable it. Alan T. DeKok@2015-03-31T22:46:09Z Files modified: * src/modules/rlm_eap/eap.c * src/modules/rlm_eap/libeap/eap_types.h Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/6668c0e119c7e9c5f8a9… ====== Only call tr_init if trust router is configured And only call "get realm" on the same conditions Alan T. DeKok@2015-03-31T21:17:08Z Files modified: * src/modules/rlm_realm/rlm_realm.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/01167e55b9867dee9d71… ====== Fail safely if there's no trust router Alan T. DeKok@2015-03-31T19:39:34Z Files modified: * src/modules/rlm_realm/trustrouter.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/4c809912aa3248e9af37… ====== Be a bit more careful about locking files We try to lock it non-blocking. If fail, close the file, re-open it, and try to lock it again. This lets us catch the corner case of the reader re-naming the file after we opened it, locking it, and trying again. Alan T. DeKok@2015-03-31T18:40:17Z Files modified: * src/main/exfile.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/7817327f6869c9fa586b… ====== Unlock file while waiting for the DB Otherwise the server might block forever waiting for our lock to be released Alan T. DeKok@2015-03-31T18:40:16Z Files modified: * scripts/sql/radsqlrelay Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/3f028f8e0a48bb95bf05… ====== Remove unnecessary comment Alan T. DeKok@2015-03-31T18:40:07Z Files modified: * src/main/tls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/2c55705170d5438c5a6d… ====== Add version strings for TLS 1.1, 1.2 and 1.3 Arran Cudbard-Bell@2015-03-31T18:25:00Z Files modified: * src/main/tls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/93076379bf91ba414f21… ====== Re-enable TLS 1.2 by default Arran Cudbard-Bell@2015-03-31T17:25:37Z Files modified: * src/main/tls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/6fd66f55c865ff2a9186… ====== Typos Arran Cudbard-Bell@2015-03-31T16:50:12Z Files modified: * src/modules/rlm_eap/libeap/mppe_keys.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/c5c22be8f423e53c79e6… ====== Use SSL_export_keying_material if available. This generates keys using the correct PRF with TLS 1.2 Arran Cudbard-Bell@2015-03-31T16:43:45Z Files modified: * src/modules/rlm_eap/libeap/mppe_keys.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/7b709816262a0322672b… ====== Fix for 3.1.x Alan T. DeKok@2015-03-31T15:55:45Z Files modified: * src/modules/rlm_eap/radeapclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/2e577136b77199ebb72f… ====== Stop on no next entry Alan T. DeKok@2015-03-31T15:15:22Z Files modified: * src/modules/rlm_sql/rlm_sql.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/08688632abef67e1e8b4… ====== Fix compilation errors Alan T. DeKok@2015-03-31T15:15:21Z Files modified: * src/modules/rlm_eap/radeapclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/380df4a51f798931e760… ====== Update for 3.0.8 Alan T. DeKok@2015-03-31T04:52:04Z Files modified: * man/man5/users.5 Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/fe7d87cbe31f3ac8dd9e… ====== Comments Alan T. DeKok@2015-03-31T04:52:03Z Files modified: * src/main/process.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/7f0bc9e8db614c45d96f… ====== Don't use 2 names for the same thing Alan T. DeKok@2015-03-31T04:52:01Z Files modified: * raddb/mods-available/files Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/bc31066bf7c641cbb809… ====== radeapclient - fixed EAP-MD5 EAP-MD5 works again now. Nicolas C (via Arran Cudbard-Bell)@2015-03-31T02:27:02Z Files modified: * src/modules/rlm_eap/radeapclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/295e451bcfce7331a1ae… ====== radeapclient - union for eap context Use an union to separate sim and md5 specific members. Nicolas C (via Arran Cudbard-Bell)@2015-03-31T02:26:57Z Files modified: * src/modules/rlm_eap/radeapclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/b098524176ea3727f4db… ====== radeapclient - code clean-up Fixes, formatting, and code clean-up. Removed old (now unused) functions: - debug_packet - send_packet - sendrecv_eap Nicolas C (via Arran Cudbard-Bell)@2015-03-31T02:26:51Z Files modified: * src/modules/rlm_eap/radeapclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/8a1a2c1164933eedb20f… ====== radeapclient - process special attributes Last commit did not build on Travis. Fixed. Added processing of special attributes in input vps (copied from radclient). And some other minor stuff. Nicolas C (via Arran Cudbard-Bell)@2015-03-31T02:26:46Z Files modified: * src/modules/rlm_eap/radeapclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/079698348710a6d6f1f5… ====== radeapclient - parallel mode (now working) This one is larger. (but this was necessary.) The new stuff is now in use, and working! The old "sendrecv_eap" sequential function is no longer called. Instead a main loop handles: starting new transactions and sending packets, receiving and handling responses, checking for timeouts and handling retransmissions. Some minor things needs to be addressed, but I feel this is very close to being mergeable. New option added: "-p <parallel>". I removed option "-i", which has been broken for ages and I think will never be fixed (since we use FreeRADIUS's packet list library, the ID is automatically allocated). Nicolas C (via Arran Cudbard-Bell)@2015-03-31T02:26:41Z Files modified: * src/modules/rlm_eap/radeapclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/e8dcc99feb6577cf0949… ====== radeapclient - receive using packet list Added an event list (not yet used). Added new functions: - rc_finish_transaction - rc_send_transaction_packet - rc_deallocate_id - rc_recv_one_packet (not yet used) Nicolas C (via Arran Cudbard-Bell)@2015-03-31T02:26:36Z Files modified: * src/modules/rlm_eap/radeapclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/f5ae37e44513f4ea867f… ====== radeapclient - preparing packet list use Cleaned-up main. Added a packet list (not yet used) Added new functions: - rc_add_socket - rc_resolve_hostname - rc_send_one_packet (not yet used) These I stole from radclient: - rc_request_types[] array - rc_get_port function - rc_get_code function Nicolas C (via Arran Cudbard-Bell)@2015-03-31T02:26:30Z Files modified: * src/modules/rlm_eap/radeapclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/3d0e53431206b432d393… ====== radeapclient - now use the transactions Now load the input data and use it to properly initialize transactions. These are then used to do the EAP-SIM workflow. Nicolas C (via Arran Cudbard-Bell)@2015-03-31T02:26:23Z Files modified: * src/modules/rlm_eap/radeapclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/ceb70b60046409e27cb6… ====== radeapclient - init transactions New functions (not yet used) to initialize transactions, and yank elements from the input list of vps. Nicolas C (via Arran Cudbard-Bell)@2015-03-31T02:26:18Z Files modified: * src/modules/rlm_eap/radeapclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/994f4c2bcb83430bf539… ====== radeapclient - new structures (input, transactions) New structures added to hold: - input value pairs read from file or stdin. - transactions contexts (similar to radclient's 'rc_request_t'). And new functions (not yet used) to read input vps and load them into a list. Nicolas C (via Arran Cudbard-Bell)@2015-03-31T02:26:13Z Files modified: * src/modules/rlm_eap/radeapclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/3038dbc322998a9e1fb3… ====== radeapclient - use eap context Make use of the previously defined eap context struct. Nicolas C (via Arran Cudbard-Bell)@2015-03-31T02:26:07Z Files modified: * src/modules/rlm_eap/radeapclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/d2c627ec4f472476cdce… ====== radeapclient - eap context struct Definition of a structure which will hold the EAP context information. This will also make easier to merge with radclient later on. As requested, small commits on purpose. If they are too small please let me know, I will adjust :) Nicolas C (via Arran Cudbard-Bell)@2015-03-31T02:26:01Z Files modified: * src/modules/rlm_eap/radeapclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/88c35c59542942956408… ====== New travis apt plugin config structure Arran Cudbard-Bell@2015-03-31T00:01:13Z Files modified: * .travis.yml Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/92c5685435e577041711… ====== -- This commit summary was generated @2015-04-01T00:00:03Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v2.x.x branch
by announce＠freeradius.org 31 Mar '15

31 Mar '15

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Fix for v2 Alan T. DeKok@2015-03-31T18:07:29Z Files modified: * src/modules/rlm_eap/libeap/mppe_keys.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/ef0dd4cea3f2b83d5ebb… ====== Note recent changes Alan T. DeKok@2015-03-31T17:34:50Z Files modified: * doc/ChangeLog Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/7ea41d85d40627da81db… ====== Revert "Disable TLS 1.2 by default. Causes MPPE key mismatches with eapol_test." This reverts commit d541351bba3f874bcb9d51483679970981892c49. No longer necessary after previous commit Alan T. DeKok@2015-03-31T17:34:23Z Files modified: * src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/48d2fdf6d9d5af8f6afd… ====== Use SSL_export_keying_material for TLSv1.2 PRF derivation Alan T. DeKok@2015-03-31T17:33:12Z Files modified: * src/modules/rlm_eap/libeap/mppe_keys.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/bdff82cdc5bbd6e9079b… ====== Disable TLS 1.2 by default. Causes MPPE key mismatches with eapol_test. Manual port of commit 8ac08a4 to v2. Alan T. DeKok@2015-03-31T04:51:09Z Files modified: * src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/d541351bba3f874bcb9d… ====== -- This commit summary was generated @2015-04-01T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for master branch
by announce＠freeradius.org 30 Mar '15

30 Mar '15

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Print the attributes EAP-TLS extension attribute we're not going to add Arran Cudbard-Bell@2015-03-30T18:40:35Z Files modified: * src/main/tls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/89ae815aa9ce9943101f… ====== -- This commit summary was generated @2015-03-31T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0