- Freeradius-Devel - lists.freeradius.org

Avoid restart freeradius on config update to modules
by Suriya Shankar 14 Jan '25

14 Jan '25

Hi Alan, I am working with the freeradius branch 3.0.27 and freeradius service constantly restarts when a module is updated with new config as per design. I went through previous questionnaires on the same and understood it works as expected. I made a few changes in the code and tested, I am able to successfully reload the configuration instead of restarting the freeradius server. Added the diff for your reference. If this is good, can I create a PR diff --git a/src/include/modules.h b/src/include/modules.h > index 9ba81b3bc1..bd9c9a0e0b 100644 > --- a/src/include/modules.h > +++ b/src/include/modules.h > @@ -144,6 +144,7 @@ typedef struct module_t { > int modules_init(CONF_SECTION *); > int modules_free(void); > int modules_hup(CONF_SECTION *modules); > +int my_server_define_types(CONF_SECTION *config); > rlm_rcode_t process_authorize(int type, REQUEST *request); > rlm_rcode_t process_authenticate(int type, REQUEST *request); > rlm_rcode_t module_preacct(REQUEST *request); > diff --git a/src/main/mainconfig.c b/src/main/mainconfig.c > index 09799da0e2..a61762f4be 100644 > --- a/src/main/mainconfig.c > +++ b/src/main/mainconfig.c > @@ -1317,10 +1317,10 @@ void main_config_hup(void) > @@ -50,4 +49,137 @@ index 09799da0e2..38628c7eea 100644 > > cs = cf_section_alloc(NULL, "main", NULL); > if (!cs) return; > @@ -1381,6 +1381,7 @@ void main_config_hup(void) > > INFO("HUP - loading modules"); > > + my_server_define_types(cs); > /* > * Prefer the new module configuration. > */ > diff --git a/src/main/modules.c b/src/main/modules.c > index 9919482c86..ac0d3b019d 100644 > --- a/src/main/modules.c > +++ b/src/main/modules.c > @@ -29,7 +29,7 @@ RCSID("$Id$") > #include <freeradius-devel/modcall.h> > #include <freeradius-devel/parser.h> > #include <freeradius-devel/rad_assert.h> > - > +#include <string.h> > /** Path to search for modules in > * > */ > @@ -1621,6 +1621,18 @@ int virtual_servers_load(CONF_SECTION *config) > return 0; > } > > +int my_module_hup_module(CONF_SECTION *modules, CONF_SECTION *cs, > module_instance_t *node, time_t when, char *name) { > + > + if (!node && > + strstr(name, "eap") != NULL) { > + node = module_bootstrap(cs); > + module_instantiate(modules, node->name); > + > + } > + return module_hup_module(cs, node, when); > + > + > +} > int module_hup_module(CONF_SECTION *cs, module_instance_t *node, time_t > when) > { > void *insthandle; > @@ -1716,11 +1728,10 @@ int modules_hup(CONF_SECTION *modules) > cs = cf_item_to_section(ci); > instname = cf_section_name2(cs); > if (!instname) instname = cf_section_name1(cs); > - > strlcpy(myNode.name, instname, sizeof(myNode.name)); > node = rbtree_finddata(instance_tree, &myNode); > > - module_hup_module(cs, node, when); > + my_module_hup_module(modules, cs, node, when, instname); > } > > return 1; > @@ -1880,6 +1891,20 @@ static bool server_define_types(CONF_SECTION *cs) > return true; > } > > +int my_server_define_types(CONF_SECTION *config) { > + /* > + * Load dictionaries. > + * > + */ > + CONF_SECTION *cs; > + for (cs = cf_subsection_find_next(config, NULL, "server"); > + cs != NULL; > + cs = cf_subsection_find_next(config, cs, "server")) { > + if (!server_define_types(cs)) return -1; > + } > + return 1; > +} > + > extern char const *unlang_keyword[]; > > static bool is_reserved_word(const char *name) > @@ -1904,7 +1929,6 @@ int modules_init(CONF_SECTION *config) > { > CONF_ITEM *ci, *next; > CONF_SECTION *cs, *modules; > - > /* > * Set up the internal module struct. > */ > diff --git a/src/main/process.c b/src/main/process.c > index 98e3633906..31bf5a7655 100644 > --- a/src/main/process.c > +++ b/src/main/process.c > @@ -6020,7 +6020,6 @@ int radius_event_start(CONF_SECTION *cs, bool > have_children) > if (fr_start_time != (time_t)-1) return 0; > > time(&fr_start_time); > - > if (!check_config) { > /* > * radius_event_init() must be called first > diff --git a/src/main/radiusd.c b/src/main/radiusd.c > index 06b566d073..6d0aaa85d1 100644 > --- a/src/main/radiusd.c > +++ b/src/main/radiusd.c > @@ -111,7 +111,6 @@ int main(int argc, char *argv[]) > * free that before any leak reports. > */ > TALLOC_CTX *autofree = talloc_init("main"); > - > #ifdef OSFC2 > set_auth_parameters(argc, argv); > #endif > @@ -642,6 +641,7 @@ int main(int argc, char *argv[]) > #ifdef WITH_STATS > radius_stats_init(1); > #endif > + if (main_config_init() < 0) exit(EXIT_FAILURE); > main_config_hup(); > } > if (status < 0) { > diff --git a/src/modules/rlm_eap/rlm_eap.c b/src/modules/rlm_eap/rlm_eap.c > index 24b8c5ee2d..73f0851414 100644 > --- a/src/modules/rlm_eap/rlm_eap.c > +++ b/src/modules/rlm_eap/rlm_eap.c > @@ -27,7 +27,6 @@ RCSID("$Id$") > > #include <freeradius-devel/radiusd.h> > #include <freeradius-devel/modules.h> > - > #include "rlm_eap.h" > > #include <sys/stat.h> > @@ -799,6 +798,7 @@ extern module_t rlm_eap; > module_t rlm_eap = { > .magic = RLM_MODULE_INIT, > .name = "eap", > + .type = RLM_TYPE_HUP_SAFE, > .inst_size = sizeof(rlm_eap_t), > .config = module_config, > .instantiate = mod_instantiate, Thanks, Suriya

2 5

my struggle with the build system
by David Huss 14 Jan '25

14 Jan '25

Hi, I am trying to add argon2-support to the rlm_pap module in v3.0 of freeradius. argon2 is a modern password hashing algorithm that our (art university) LDAP uses. Now we were under the (obviously wrong) assumption that any program would send the cleartext password to our LDAP and ask it for a thumbs-up/down. Hence the need to add the hashing function. I think I am fine in terms of the code, but am fighting a bit with the build system. Does anybody have pointers where I would add the dependencies? I didn't find any documentation on that and my learnings from looking at other modules was somewhat limited. My first hunch was to add them to src/includes and to src/includes/all.mk but then I realized all the implementation C-files are located at src/lib So I tried the following: - adding argon.h to src/includes/argon.h - adding argon.h to src/includes/all.mk - adding all of the argon.h dependencies to src/includes as well - adding argon.c to src/lib/argon.c - adding argon.c to src/lib.all.mk - adding all of the argon.c dependencies (.c-files) to src/lib This does not work as the linker fails to find some functions from the argon.c dependencies: /usr/bin/ld: build/lib/local/.libs/libfreeradius-radius.so: undefined reference to `fill_memory_blocks' /usr/bin/ld: build/lib/local/.libs/libfreeradius-radius.so: undefined reference to `finalize' /usr/bin/ld: build/lib/local/.libs/libfreeradius-radius.so: undefined reference to `clear_internal_memory' /usr/bin/ld: build/lib/local/.libs/libfreeradius-radius.so: undefined reference to `numlen' /usr/bin/ld: build/lib/local/.libs/libfreeradius-radius.so: undefined reference to `validate_inputs' /usr/bin/ld: build/lib/local/.libs/libfreeradius-radius.so: undefined reference to `initialize' /usr/bin/ld: build/lib/local/.libs/libfreeradius-radius.so: undefined reference to `decode_string' /usr/bin/ld: build/lib/local/.libs/libfreeradius-radius.so: undefined reference to `b64len' /usr/bin/ld: build/lib/local/.libs/libfreeradius-radius.so: undefined reference to `encode_string' Is there a correct way of adding those dependencies? Forgive my C-noob-question.. All the best from Hamburg, David Huss

2 1

Computing MS-MPPE-Recv-Key and MS-MPPE-Send-Key in MS-CHAPv2 auth
by Hadi Rezaee 08 Jan '25

08 Jan '25

Hello there, I'm trying to figure out how MS-MPPE-Send-Key and MS-MPPE-Recv-Key are getting generated by freeradius-server. Here, it is the sample captured traffic I've for a MS-CHAPv2 (Access-Accept) auth between a radius client and server: MS-MPPE-Recv-Key: a660ce53f31ef08ed6cf209ece137a1dee40aeae5d8e5b9de0f1592324bc92569fc1 MS-MPPE-Send-Key: a81579eb58f0bd25636599778c8689516129db8b25ec2d1e4c15797862efedabb3c So, the first thing I noticed here is that the length of the values for both AVPs are 34 bytes. I read rfc2548 and rfc3079 for this matter and then tried to find corresponding implementations in the code-base (src/modules/rlm_mschap/rlm_mschap.c), and found "mppe_chap2_gen_keys128" function. The function is being called by "mod_authenticate_resume" : /* now create MPPE attributes */ if (inst->use_mppe) { fr_pair_t *vp; uint8_t mppe_sendkey[34]; uint8_t mppe_recvkey[34]; switch (mschap_version) { case 1: RDEBUG2("Generating MS-CHAPv1 MPPE keys"); memset(mppe_sendkey, 0, 32); /* * According to RFC 2548 we * should send NT hash. But in * practice it doesn't work. * Instead, we should send nthashhash * * This is an error in RFC 2548. */ /* * do_mschap cares to zero nthashhash if NT hash * is not available. */ memcpy(mppe_sendkey + 8, nthashhash, NT_DIGEST_LENGTH); mppe_add_reply(inst, request, tmpl_attr_tail_da(env_data->chap_mppe_keys), mppe_sendkey, 24); //-V666 break; case 2: RDEBUG2("Generating MS-CHAPv2 MPPE keys"); mppe_chap2_gen_keys128(nthashhash, response->vp_octets + 26, mppe_sendkey, mppe_recvkey); mppe_add_reply(inst, request, tmpl_attr_tail_da(env_data->mppe_recv_key), mppe_recvkey, 16); mppe_add_reply(inst, request, tmpl_attr_tail_da(env_data->mppe_send_key), mppe_sendkey, 16); break; default: fr_assert(0); break; } MEM(pair_update_reply(&vp, tmpl_attr_tail_da(env_data->mppe_encryption_policy)) >= 0); vp->vp_uint32 = inst->require_encryption ? 2 : 1; MEM(pair_update_reply(&vp, tmpl_attr_tail_da(env_data->mppe_encryption_types)) >= 0); vp->vp_uint32 = inst->require_strong ? 4 : 6; } /* else we weren't asked to use MPPE */ Correct me if I'm wrong but here I read " mppe_sendkey" and " mppe_recvkey" variables are initialized with 34 bytes (as i expected!), but later by calling mppe_chap2_gen_keys128 only 16 bytes are copied. I was expecting other items (such as 'Salt') to be taken into account too .. Thanks.

3 5

Computing MS-MPPE-Recv-Key and MS-MPPE-Send-Key in MS-CHAPv2 auth
by Hadi Rezaee 05 Jan '25

05 Jan '25

Hello there, I'm trying to figure out how MS-MPPE-Send-Key and MS-MPPE-Recv-Key are getting generated by freeradius-server. Here, it is the sample captured traffic I've for a MS-CHAPv2 (Access-Accept) auth between a radius client and server: MS-MPPE-Recv-Key: a660ce53f31ef08ed6cf209ece137a1dee40aeae5d8e5b9de0f1592324bc92569fc1 MS-MPPE-Send-Key: a81579eb58f0bd25636599778c8689516129db8b25ec2d1e4c15797862efedabb3c So, the first thing I noticed here is that the length of the values for both AVPs are 34 bytes. I read rfc2548 and rfc3079 for this matter and then tried to find corresponding implementations in the code-base (src/modules/rlm_mschap/rlm_mschap.c), and found "mppe_chap2_gen_keys128" function. The function is being called by "mod_authenticate_resume" : /* now create MPPE attributes */ if (inst->use_mppe) { fr_pair_t *vp; uint8_t mppe_sendkey[34]; uint8_t mppe_recvkey[34]; switch (mschap_version) { case 1: RDEBUG2("Generating MS-CHAPv1 MPPE keys"); memset(mppe_sendkey, 0, 32); /* * According to RFC 2548 we * should send NT hash. But in * practice it doesn't work. * Instead, we should send nthashhash * * This is an error in RFC 2548. */ /* * do_mschap cares to zero nthashhash if NT hash * is not available. */ memcpy(mppe_sendkey + 8, nthashhash, NT_DIGEST_LENGTH); mppe_add_reply(inst, request, tmpl_attr_tail_da(env_data->chap_mppe_keys), mppe_sendkey, 24); //-V666 break; case 2: RDEBUG2("Generating MS-CHAPv2 MPPE keys"); mppe_chap2_gen_keys128(nthashhash, response->vp_octets + 26, mppe_sendkey, mppe_recvkey); mppe_add_reply(inst, request, tmpl_attr_tail_da(env_data->mppe_recv_key), mppe_recvkey, 16); mppe_add_reply(inst, request, tmpl_attr_tail_da(env_data->mppe_send_key), mppe_sendkey, 16); break; default: fr_assert(0); break; } MEM(pair_update_reply(&vp, tmpl_attr_tail_da(env_data->mppe_encryption_policy)) >= 0); vp->vp_uint32 = inst->require_encryption ? 2 : 1; MEM(pair_update_reply(&vp, tmpl_attr_tail_da(env_data->mppe_encryption_types)) >= 0); vp->vp_uint32 = inst->require_strong ? 4 : 6; } /* else we weren't asked to use MPPE */ Correct me if I'm wrong but here I read " mppe_sendkey" and " mppe_recvkey" variables are initialized with 34 bytes (as i expected!), but later by calling mppe_chap2_gen_keys128 only 16 bytes are copied. I was expecting other items (such as 'Salt') to be taken into account too .. Thanks.

1 0

PR review
by George Benjin 10 Dec '24

10 Dec '24

Hi Team, Any thoughts on the PR here: https://github.com/FreeRADIUS/freeradius-server/pull/5450 If accepted, we might look at building a simple Intune module for possible inclusion as well. Cheers

3 4

Eleven dictionary
by Natarajan M 15 Nov '24

15 Nov '24

These are sub attributes and should be encoded as 3.2 to 3.5 instead of 2 to 5 (encoding their type as 2 to 5 ends up with Eleven-EAPOL-SSID having the same 3 as Eleven-Authentication-Find-Key). Assuming probably not yet widely used and noticed, will raise a PR to fix. It was working fine when I had my own dictionary file with sub dictionary in 3.0.25, after moving to 3.0.27 resulted in duplicate since 3.0.27 had this part of the base build itself but functionality broke due to this type vs subtype mismatch. Please correct if I'm overlooking. +ATTRIBUTE Eleven-EAPOL-Anonce 3. 2 octets +ATTRIBUTE Eleven-EAPOL-SSID 3.3 string +ATTRIBUTE Eleven-EAPOL-APMAC 3.4 octets +ATTRIBUTE Eleven-EAPOL-STMAC 3.5 octets+ +++ b/share/dictionary.eleven @@ -0,0 +1,52 @@ +# -*- text -*- +# Copyright (C) 2023 The FreeRADIUS Server project and contributors +# This work is licensed under CC-BY version 4.0 https://creativecommons.org/licenses/by/4.0 +# +############################################################################## +# +# Eleven Software +# +# $Id$ +# +############################################################################## + +VENDOR Eleven 52970 + +BEGIN-VENDOR Eleven + +# +# DPSK attributes +# +# The RADIUS server responds with two Cisco-AVPair attributes: +# +# Cisco-AVPair = "psk-mode=ascii" +# Cisco-AVPair = "psk=<passphrase>" +# +# +ATTRIBUTE Eleven-Authentication-Find-Key 3 tlv + +# +# The second EAPoL frame of the 4-way handshake +# +ATTRIBUTE Eleven-EAPOL-Frame-2 3.1 octets + +# +# The first EAPoL frame of the 4-way handshake. +# +ATTRIBUTE Eleven-EAPOL-Anonce 2 octets + +# +# SSID name +# +ATTRIBUTE Eleven-EAPOL-SSID 3 string + +# +# BSSID +# +ATTRIBUTE Eleven-EAPOL-APMAC 4 octets + +# +# Wireless client MAC address. +# +ATTRIBUTE Eleven-EAPOL-STMAC 5 octets + Thanks Natarajan

2 1

Message-Authenticator depending of request/response code
by Julien Rische 01 Oct '24

01 Oct '24

Hello everyone, We are currently working on implementing RADIUS Message-Authenticator for MIT krb5[1] according to RFC2865[2] and draft-ietf-radext-deprecating-radius-03[3]. We are not sure about what packet codes we should generate and expect Message-Authenticator to verify for. In draft-ietf-radext-deprecating-radius-03 we can read: Section 5.2.1: "Clients MUST add Message-Authenticator to all Access-Request packets." Section 5.2.4: "Servers MUST add Message-Authenticator as the first attribute in all responses to Access-Request packets. That is, all Access-Accept, Access-Reject, Access-Challenge, and Protocol-Error packets." However, I see that the FreeRADIUS server seems to be generating Message-Authenticators for additional packet codes[4]. We would like to enforce the use of Message-Authenticator as much as possible, but we are not sure if it is relevant for all packet codes. Could you explain why this specific code set triggers Message-Authenticator generation in the FreeRADIUS server? And do you have any recommendations about the cases where we should generate Message-Authenticators to ensure compatibility with FreeRADIUS? Thank you in advance, Julien Rische Red Hat, Inc. [1] https://github.com/krb5/krb5/pull/1370 [2] https://datatracker.ietf.org/doc/html/rfc2869 [3] https://datatracker.ietf.org/doc/html/draft-ietf-radext-deprecating-radius-… [4] https://github.com/FreeRADIUS/freeradius-server/blob/4312a2df8e0829c87811f4…

2 1

libfreeradius usage
by Mathis Marion 12 Sep '24

12 Sep '24

Hello, I want to experiment with libfreeradius, but I am having trouble even compiling the main library header. First, the "libradius.h" header uses the "RCSIDH()" macro before including "build.h"[1]. But even with a manual inclusion of "build.h", I get a missing header dependency: $ echo '#include <freeradius/libradius.h>' | gcc -include freeradius/build.h -xc - In file included from /usr/local/include/freeradius/build.h:13, from <command-line>: /usr/local/include/freeradius/autoconf.h:749:10: fatal error: freeradius/automask.h: No such file or directory 749 | #include <freeradius/automask.h> | ^~~~~~~~~~~~~~~~~~~~~~~ compilation terminated. The "automask.h" header is present in the repo[2], but it does not seem to be installed as part of the library headers with "make install". It is also not present in by distribution's package of the library[3]. I tried with v3.2.5 packaged by Debian, and v3.2.6 compiled from source, am I doing something wrong? I have also found a similar issue[4] which states that "autoconf.h" should not be included, and that "missing.h" provides the necessary values. In any case there is a chain of header dependency which currently forces "autoconf.h" to be included so I am not sure how relevant that statement is. libradius.h > build.h > autoconf.h > automask.h I did not find much documentation or examples for this library, feel free to redirect me to the right resources in case I missed them. I am also a bit confused with the relation between libfreeradius and the freeradius-client project, the latter seems basically abandoned but it is not clear to me what the functional differences are between the 2. I hope this is the right place to discuss this. Thank you to anyone willing to help. [1]: https://github.com/FreeRADIUS/freeradius-server/blob/release_3_2_6/src/incl… [2]: https://github.com/FreeRADIUS/freeradius-server/blob/release_3_2_6/src/incl… [3]: https://packages.debian.org/trixie/amd64/libfreeradius-dev/filelist [4]: https://github.com/FreeRADIUS/freeradius-server/issues/1412 --- Mathis Marion Software Developper at Silicon Laboratories

2 3

Is this your status-server glitch in v3.2.5?
by Stefan Paetow 19 Aug '24

19 Aug '24

Hi Alan, Just a quick one... is this the status-server SEGV? If so, I'm looking forward to your v3.2.6 :-) Reading symbols from /usr/sbin/radiusd... Reading symbols from /usr/lib/debug/usr/sbin/radiusd-3.2.5-1.el9.x86_64.debug... Attaching to program: /usr/sbin/radiusd, process 497516 [New LWP 497518] [New LWP 497519] [New LWP 497520] [New LWP 497521] [New LWP 497522] Missing separate debuginfo for /lib64/libcrypto.so.3 Missing separate debuginfo for /lib64/libssl.so.3 Missing separate debuginfo for /lib64/libtalloc.so.2 Missing separate debuginfo for /lib64/libatomic.so.1 Missing separate debuginfo for /lib64/libpcre.so.1 Missing separate debuginfo for /lib64/libresolv.so.2 Missing separate debuginfo for /lib64/libreadline.so.8 Missing separate debuginfo for /lib64/libsystemd.so.0 Missing separate debuginfo for /lib64/libcrypt.so.2 Missing separate debuginfo for /lib64/libc.so.6 Missing separate debuginfo for /lib64/libpcap.so.1 Missing separate debuginfo for /lib64/libz.so.1 Missing separate debuginfo for /lib64/libtinfo.so.6 Missing separate debuginfo for /lib64/libcap.so.2 Missing separate debuginfo for /lib64/libgcrypt.so.20 Missing separate debuginfo for /lib64/liblzma.so.5 Missing separate debuginfo for /lib64/libzstd.so.1 Missing separate debuginfo for /lib64/liblz4.so.1 Missing separate debuginfo for /lib64/libgcc_s.so.1 Missing separate debuginfo for /lib64/libibverbs.so.1 Missing separate debuginfo for /lib64/libgpg-error.so.0 Missing separate debuginfo for /lib64/libnl-route-3.so.200 Missing separate debuginfo for /lib64/libnl-3.so.200 Missing separate debuginfo for /usr/lib64/ossl-modules/legacy.so Missing separate debuginfo for /lib64/libwbclient.so.0 Missing separate debuginfo for /lib64/libnss_sss.so.2 [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib64/libthread_db.so.1". 0x00007f945d0d8a3f in wait4 () from /lib64/libc.so.6 No symbol table info available. No symbol table info available. Thread 6 (Thread 0x7f945882c640 (LWP 497522) "radiusd"): #0 0x00007f945d08679a in __futex_abstimed_wait_common () from /lib64/libc.so.6 No symbol table info available. #1 0x00007f945d091c48 in __new_sem_wait_slow64.constprop.0 () from /lib64/libc.so.6 No symbol table info available. #2 0x0000000000432980 in request_handler_thread (arg=0x107fb70) at src/main/threads.c:741 self = 0x107fb70 re_wait = <optimized out> #3 0x00007f945d089c02 in start_thread () from /lib64/libc.so.6 No symbol table info available. #4 0x00007f945d10ec40 in clone3 () from /lib64/libc.so.6 No symbol table info available. Thread 5 (Thread 0x7f945902d640 (LWP 497521) "radiusd"): #0 0x00007f945d08679a in __futex_abstimed_wait_common () from /lib64/libc.so.6 No symbol table info available. #1 0x00007f945d091c48 in __new_sem_wait_slow64.constprop.0 () from /lib64/libc.so.6 No symbol table info available. #2 0x0000000000432980 in request_handler_thread (arg=0x1089ae0) at src/main/threads.c:741 self = 0x1089ae0 re_wait = <optimized out> #3 0x00007f945d089c02 in start_thread () from /lib64/libc.so.6 No symbol table info available. #4 0x00007f945d10ec40 in clone3 () from /lib64/libc.so.6 No symbol table info available. Thread 4 (Thread 0x7f945982e640 (LWP 497520) "radiusd"): #0 0x00007f945d08679a in __futex_abstimed_wait_common () from /lib64/libc.so.6 No symbol table info available. #1 0x00007f945d091c48 in __new_sem_wait_slow64.constprop.0 () from /lib64/libc.so.6 No symbol table info available. #2 0x0000000000432980 in request_handler_thread (arg=0x1080100) at src/main/threads.c:741 self = 0x1080100 re_wait = <optimized out> #3 0x00007f945d089c02 in start_thread () from /lib64/libc.so.6 No symbol table info available. #4 0x00007f945d10ec40 in clone3 () from /lib64/libc.so.6 No symbol table info available. Thread 3 (Thread 0x7f945a02f640 (LWP 497519) "radiusd"): #0 0x00007f945d08679a in __futex_abstimed_wait_common () from /lib64/libc.so.6 No symbol table info available. #1 0x00007f945d091c48 in __new_sem_wait_slow64.constprop.0 () from /lib64/libc.so.6 No symbol table info available. #2 0x0000000000432980 in request_handler_thread (arg=0x1077df0) at src/main/threads.c:741 self = 0x1077df0 re_wait = <optimized out> #3 0x00007f945d089c02 in start_thread () from /lib64/libc.so.6 No symbol table info available. #4 0x00007f945d10ec40 in clone3 () from /lib64/libc.so.6 No symbol table info available. Thread 2 (Thread 0x7f945a830640 (LWP 497518) "radiusd"): #0 0x00007f945d08679a in __futex_abstimed_wait_common () from /lib64/libc.so.6 No symbol table info available. #1 0x00007f945d091c48 in __new_sem_wait_slow64.constprop.0 () from /lib64/libc.so.6 No symbol table info available. #2 0x0000000000432980 in request_handler_thread (arg=0x107c510) at src/main/threads.c:741 self = 0x107c510 re_wait = <optimized out> #3 0x00007f945d089c02 in start_thread () from /lib64/libc.so.6 No symbol table info available. #4 0x00007f945d10ec40 in clone3 () from /lib64/libc.so.6 No symbol table info available. Thread 1 (Thread 0x7f945d213400 (LWP 497516) "radiusd"): #0 0x00007f945d0d8a3f in wait4 () from /lib64/libc.so.6 No symbol table info available. #1 0x00007f945d04b243 in do_system () from /lib64/libc.so.6 No symbol table info available. #2 0x00007f945daafda6 in fr_fault (sig=<optimized out>) at src/lib/debug.c:793 disable = false cmd = "gdb -silent -x /etc/raddb/panic.gdb /usr/sbin/radiusd 497516 2>&1 | tee /var/log/radius/gdb-radiusd-497516.log", '\000' <repeats 421 times> out = 0x7fffe3b6808a ".log" left = 426 ret = <optimized out> p = 0x7f945dade6a2 <panic_action+98> ".log" q = 0x0 code = <optimized out> #3 <signal handler called> No symbol table info available. #4 0x000000000042ea74 in request_stats_final (request=request@entry=0x7f9450002280) at src/main/stats.c:99 listener = <optimized out> client = <optimized out> auth_stats = <optimized out> coa_stats = <optimized out> #5 0x0000000000436601 in request_stats_final (request=0x7f9450002280) at src/main/stats.c:91 listener = <optimized out> client = <optimized out> auth_stats = <optimized out> coa_stats = <optimized out> dsc_stats = <optimized out> done = <optimized out> proxy_stats = <optimized out> #6 request_done (request=request@entry=0x7f9450002280, original=original@entry=2) at src/main/process.c:921 now = {tv_sec = 17647328, tv_usec = -6848366252100330752} when = {tv_sec = 17013216, tv_usec = 1} action = <optimized out> #7 0x0000000000438abc in request_ping (request=0x7f9450002280, action=<optimized out>) at src/main/process.c:3973 home = <optimized out> buffer = "193.63.195.34\000\000\000 \220\266\343\377\177\000\000`\020\000L\224\177\000\000\000\000\000\000 \000\000\000\000\000\000\000\212\264\024\a\032\000\000\000\000\000\000\000혪]\224\177\000\000L\327\254]\224\177\000\000\f٬]\224\177\000\000\016y\375˰\365\355\277\024\326{\263\356\324D\320\340\231\003\001\000\000\000\000\000[ɋ-\267\365\240\301\276\254]\224\177\000\000\350\"\000P\224\177\000" __FUNCTION__ = "request_ping" #8 0x0000000000434241 in request_proxy_reply (packet=0x7f944c0030a0) at src/main/process.c:3013 proxy_p = 0x7f94500022e8 request = 0x7f9450002280 now = {tv_sec = 1723555202, tv_usec = 597850} buffer = "\370\231\003\001\000\000\000\000 \222\266\343\377\177\000\000\370\233\003\001\000\000\000\000`t\247]\224\177\000\000@0\000L\224\177\000\000\000[ɋ-\267\365\240\202]\273f\000\000\000\000\000[ɋ-\267\365\240\000\000\000\000\000\000\000\000\017", '\000' <repeats 15 times>, "\001\000\000\000\000\000\000\000\370\231\003\001\000\000\000\000 \222\266\343\377\177\000\000\370\233\003\001\000\000\000\000\340\a\254]\224\177\000" #9 0x000000000041fe8d in proxy_socket_recv (listener=0x10bda60) at src/main/listen.c:2639 packet = 0x7f944c0030a0 sock = <optimized out> buffer = "\337ج]\224\177\000\000\024f\247]\224\177\000\000\260F\v\001\000\000\000\000\351\016\254]\224\177\000\000\000k\r\001\000\000\000\000H\f\f\001\000\000\000\000\340\231\003\001\000\000\000\000@B\020]\224\177\000\000\260\221\266\343\377\177", '\000' <repeats 19 times>, "\063\305\023\000\000\000\000\340\231\003\001\000\000\000\000\000[ɋ-\267\365\240\370\231\003\001\000\000\000\000\340\231\003\001\000\000\000" #10 0x00007f945dac7714 in fr_event_loop (el=0x10399e0) at src/lib/event.c:713 ef = 0x1039bf8 i = 7 rcode = <optimized out> when = {tv_sec = 1723555202, tv_usec = 929484} wake = <optimized out> read_fds = {fds_bits = {32768, 0 <repeats 15 times>}} write_fds = {fds_bits = {0 <repeats 16 times>}} #11 0x00000000004135cc in main (argc=<optimized out>, argv=<optimized out>) at src/main/radiusd.c:641 rcode = 0 status = <optimized out> argval = <optimized out> spawn_flag = true display_version = false flag = 0 from_child = {-1, -1} p = <optimized out> state = 0x481840 <global_state.lto_priv> autofree = 0xc97620 A debugging session is active. Inferior 1 [process 497516] will be detached. Quit anyway? (y or n) [answered Y; input not from terminal] [Inferior 1 (process 497516) detached] Stefan Paetow Federated Roaming Technical Specialist eduroam(UK), Jisc email/teams: stefan.paetow(a)jisc.ac.uk gpg: 0x3FCE5142 For eduroam support, please contact the eduroam team via help(a)jisc.ac.uk and mark it for eduroam’s attention. On Wednesdays and Fridays, I am not available between 12:00 and 15:00 London time (UTC in winter, UTC+0100 in summer). jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: 4 Portwall Lane, Bristol, BS1 6NB Tel: 020 3697 5800.

2 2

Re: [FreeRADIUS/freeradius-server] Release release_3_2_5 - 3.2.5
by Stefan Paetow 10 Jul '24

10 Jul '24

Hi Matthew, Just FYI – on a RHEL 9 box (using the Rocky 9 repo), FR v3.2.4 appears to be the last in the metadata, although the binary is in the repo. A 'yum update' says 'Nothing to do'. I can manually install using: yum install https://packages.networkradius.com/freeradius-3.2/rocky/9/freeradius-3.2.5-… (or 9Server for that matter) Just thought I'd let you know… Kind regards Stefan Paetow Federated Roaming Technical Specialist eduroam(UK), Jisc email/teams: stefan.paetow(a)jisc.ac.uk gpg: 0x3FCE5142 For eduroam support, please contact the eduroam team via help(a)jisc.ac.uk and mark it for eduroam’s attention. On Wednesdays and Fridays, I am not available between 12:00 and 15:00 London time (UTC in winter, UTC+0100 in summer). jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: 4 Portwall Lane, Bristol, BS1 6NB Tel: 020 3697 5800. From: Matthew Newton <notifications(a)github.com> Reply to: "noreply(a)github.com" <noreply(a)github.com> Date: Tuesday 9 July 2024 at 13:35 To: FreeRADIUS/freeradius-server <freeradius-server(a)noreply.github.com> Cc: Subscribed <subscribed(a)noreply.github.com> Subject: [FreeRADIUS/freeradius-server] Release release_3_2_5 - 3.2.5 3.2.5<https://github.com/FreeRADIUS/freeradius-server/releases/tag/release_3_2_5> Repository: FreeRADIUS/freeradius-server<https://github.com/FreeRADIUS/freeradius-server> · Tag: release_3_2_5<https://github.com/FreeRADIUS/freeradius-server/tree/release_3_2_5> · Commit: a7acce8<https://github.com/FreeRADIUS/freeradius-server/commit/a7acce80f5ba2271d9ae…> · Released by: mcnewton<https://github.com/mcnewton> Configuration changes * BlastRADIUS mitigations have been added to the "security" section. See require_message_authenticator and also limit_proxy_state. * BlastRADIUS mitigations have been added to radclient. See man radclient, and the -b option. Feature improvements * TOTP now supports TOTP-Time-Offset for tokens with times that are out of sync. See mods-available/totp. * radclient now supports forcing the Request Authenticator and ID for Access-Request packets. * Update dictionary.3gpp. * Update advice on shared secrets, including suggesting a secure method for generating useful secrets. Bug fixes * Allow proxying by pool / home server name to work with auth+acct servers * Fix OpenSSL API usage which sometimes caused crash in MS-CHAP. Previously it would either always crash immediately, or never crash. * Fix packet statistics. Stop double counting some packets, and track packet statistics even if a socket is closed. * Reverted patch in TTLS which broke compatibility with some systems. * Don't crash in debug mode when multiple intermediate certs are used Patch from Alexander Chernikov. — This release has 6 assets: * freeradius-server-3.2.5.tar.bz2 * freeradius-server-3.2.5.tar.bz2.sig * freeradius-server-3.2.5.tar.gz * freeradius-server-3.2.5.tar.gz.sig * Source code (zip) * Source code (tar.gz) Visit the release page<https://github.com/FreeRADIUS/freeradius-server/releases/tag/release_3_2_5> to download them. — You are receiving this because you are watching this repository. View it on GitHub<https://github.com/FreeRADIUS/freeradius-server/releases/tag/release_3_2_5> or unsubscribe<https://github.com/FreeRADIUS/freeradius-server/unsubscribe_via_email/ABGAM…> from all notifications for this repository.

2 1