- Freeradius-Devel - lists.freeradius.org

RADSEC cert validation doesnt seem to work...
by Alan Buxey 10 Jun '11

10 Jun '11

hi, # If check_cert_issuer is set, the value will # be checked against the DN of the issuer in # the client certificate. If the values do not # match, the cerficate verification will fail, # rejecting the user. okay.. check_cert_issuer = "/DC=com/DC=edupki/CN=eduPKJ" <snip> (0) <<< TLS 1.0 Handshake [length 08b8], Certificate (0) chain-depth=1, (0) error=0 (0) --> BUF-Name = eduPKI CA G 01 (0) --> subject = /DC=org/DC=edupki/CN=eduPKI CA G 01 (0) --> issuer = /DC=org/DC=edupki/CN=eduPKI CA G 01 (0) --> verify return:1 <snip> (0) (other): SSL negotiation finished successfully SSL Connection Established ooops. something isnt quite right in the validation arena.. alan

3 9

RADSEC validation/verification
by Alan Buxey 10 Jun '11

10 Jun '11

hi, I note that the certificate being used in RADSEC can be validated by the certificate issuer - but this doesnt work if there are more than 1 certificate issuer, can RADSEC be validated by for example, an OID in the certificate? I've noted and tried the 'verify' section - which looks rather funky and useful...but my openssl doesnt seem to have any of the useful arguments (-policy) - 0.9.8e-fips-rhel5 I had: client = "/usr/bin/openssl verify -policy .1.3.6.1.4.1.25178.3.1.2 %{TLS-Client-Cert-Filename}" but no joy :-( alan

2 3

Crash of server with RADSEC
by Alan Buxey 09 Jun '11

09 Jun '11

hi, had a nasty Abort of the server when RADSEC configured: Opening new proxy (0.0.0.0, 0) -> home_server (192.168.100.2, 2083) Trying SSL to port 2083 Requiring Server certificate Waking up in 0.1 seconds. Listening on proxy (172.16.1.2, 42575) -> home_server (192.168.100.2, 2083) (1) Proxying request to home server 192.168.100.2 port 2083 Thread 53 waiting to be assigned a request Marking home server 192.168.100.2 port 2083 as zombie (it looks like it is dead). ASSERT FAILED process.c[2374]: home->proto != IPPROTO_TCP Aborted the remote server was up but just not responding at that time - the same test worked as expected when the remote end was answering a few minute later (have done about 100 auths through a RADSEC link now) PS the default config has the password 'testing123' for RADSEC - there is a proposed standard (think its waiting for ratification) - 'radsec' - though I believe that both RADIATOR and radsecproxy use 'mysecret' as the default - worth aligning? alan

3 4

GIT Log for 2011-06-08 23:33 GMT
by aland＠deployingradius.com 08 Jun '11

08 Jun '11

commit 040de881719d1490523c3200ba52cf8fadb6cafe Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Jun 8 18:07:35 2011 +0200 Remove unnecessary assertion src/main/process.c | 4 ---- 1 files changed, 0 insertions(+), 4 deletions(-)

1 0

RadSec ... anyone?
by Alan DeKok 08 Jun '11

08 Jun '11

Has anyone managed to test the radsec work in the "master" branch? After all of the requests for it, there has been a surprising lack of response to it's public release. Alan DeKok.

6 12

regex matching can be convinced to be TRUE if you're insistive enough?
by Stefan Winter 08 Jun '11

08 Jun '11

Hi, while working on server optimisations for one of our customers, I stumbled upon something funny (2.1.10). At one point, a huge regex needs to be executed. When the input string has a length n < ??, and the regex doesn't match, the result is FALSE - no surprise here. If I make the input string long enough to m > ?? > n, and the regex doesn't match, the result is TRUE. That is not what I'd usually expect; and it has some uneasy implications. Depending on what an incoming user manages to send, it could convince to make the server take a wrong code path; maybe sneaking in when he shouldn't. A simple test case to prove this: in authorize, add update control { Bla = "*1* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh", Bla += "*2* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh", Bla += "*3* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh", Bla += "*4* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh", Bla += "*5* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh", Bla += "*6* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh" } if ( "%{control:Bla[*]}" =~ /zzzz/ ) { update control { Bla2 := "Hit!" } } This doesn't match, and debug output tells you so: Tue May 24 16:09:56 2011 : Info: ++? if ("%{control:Bla[*]}" =~ /zzzz/ ) Tue May 24 16:09:56 2011 : Info: expand: %{control:Bla[*]} -> *1* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh *2* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh *3* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh *4* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh *5* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh *6* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh Tue May 24 16:09:56 2011 : Info: ? Evaluating ("%{control:Bla[*]}" =~ /zzzz/) -> FALSE Tue May 24 16:09:56 2011 : Info: ++? if ("%{control:Bla[*]}" =~ /zzzz/ ) -> FALSE Now, make the Bla blob larger: update control { RESTENA-Service-Type = "IMAP", Bla = "*1* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh", Bla += "*2* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh", Bla += "*3* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh", Bla += "*4* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh", Bla += "*5* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh", Bla += "*6* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh", Bla += "*7* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh", Bla += "*8* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh", Bla += "*9* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh", Bla += "*A* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh" } And you will get a TRUE: Tue May 24 16:11:42 2011 : Info: ++? if ("%{control:Bla[*]}" =~ /zzzz/ ) Tue May 24 16:11:42 2011 : Info: expand: %{control:Bla[*]} -> *1* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh *2* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh *3* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh *4* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh *5* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh *6* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh *7* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh *8* lkkgflaksdjfhklsajfdghaösfdlghaskljfdghalksdfjghaklsdfjghkdalsfjghaklsfdghaklsdfjghlaksdfghaklsdfjghsdaklfjghkladsfjgh * Tue May 24 16:11:42 2011 : Info: ? Evaluating ("%{control:Bla[*]}" =~ /zzzz/) -> TRUE Tue May 24 16:11:42 2011 : Info: ++? if ("%{control:Bla[*]}" =~ /zzzz/ ) -> TRUE Note also that the debug output stops its string content output prematurely, but that's not as bad as the string regex mis-matching. My guess is that the breakage occurs when the string is longer than what's printed out in debug mode, but I didn't really try. Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

3 14

GIT Log for 2011-06-07 23:33 GMT
by aland＠deployingradius.com 07 Jun '11

07 Jun '11

commit 654377b393b53a52e6b22601c49113e91119634f Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Jun 7 23:30:31 2011 +0200 Fix build issues Files changed: src/main/detail.c | 9 ++++----- src/main/process.c | 2 +- 2 files changed, 5 insertions(+), 6 deletions(-) ====================================================================== commit 7604f435528e7ab3c32e93bd456d8f10cca54ae3 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Jun 7 18:51:48 2011 +0200 Make the certificates on initial install So that the server doesn't block when it first starts up Files changed: raddb/Makefile | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) ====================================================================== commit 38c8d8888fe63864e0aef0f40c86708b43733676 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Jun 7 18:51:22 2011 +0200 Don't look for eap.conf, etc. they've been moved to the "modules" directory Files changed: raddb/Makefile | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) ====================================================================== commit 0868fe8d5266f06951119ac1361bb569cef15d7b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Jun 7 11:18:44 2011 +0200 Fix typo. Closes bug #150 Files changed: .../rlm_sql/drivers/rlm_sql_iodbc/sql_iodbc.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit d5cf1c1c2b46e1a5aa91a41c298f0fb2e1aa1ba5 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Jun 5 18:15:05 2011 +0200 Note existence of "inner-tunnel" So that people remember to edit it, too Files changed: raddb/sites-available/default | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-) ====================================================================== commit 88587f704b2b7020725c21b3d91a8057900a4c8d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Jun 3 10:27:11 2011 +0200 Split request_receive() into two functions. One is for sockets, and enforces limits, duplicates, etc. The other allocates the request and inserts it into the queue, independent of limits. This is called directly by the detail file reader Files changed: src/include/process.h | 4 +++- src/main/detail.c | 2 +- src/main/process.c | 36 +++++++++++++++++++++--------------- 3 files changed, 25 insertions(+), 17 deletions(-) ====================================================================== commit 02f4154b69d8add8907a77fca3c57cc99fb7f779 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Jun 3 10:23:48 2011 +0200 Make RADCLIENT always have stats structures It's simpler. Files changed: src/include/radiusd.h | 8 +++--- src/include/stats.h | 2 +- src/main/client.c | 33 -------------------------- src/main/command.c | 16 ++++++------ src/main/listen.c | 6 ++-- src/main/process.c | 4 +- src/main/stats.c | 61 +++++++++++++++++++++---------------------------- 7 files changed, 44 insertions(+), 86 deletions(-) ====================================================================== commit 4e3359596bb5851746e40cfcf4010988bb66450d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Jun 3 10:19:58 2011 +0200 Removed unused prototypes Files changed: src/include/radiusd.h | 5 ----- 1 files changed, 0 insertions(+), 5 deletions(-) ====================================================================== commit 797b398b35f76cf2a0b20b003d531744a4ea0813 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Jun 3 10:19:01 2011 +0200 Fix GCD code for new process functionality Files changed: src/main/threads.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 6f2e2d6147c934919e06a3e66102b1c83e3e7c0f Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Jun 3 10:08:58 2011 +0200 Updated year Files changed: src/main/version.c | 5 ++++- 1 files changed, 4 insertions(+), 1 deletions(-) ======================================================================

1 0

Re: key generation issue with 3.x
by Alan Buxey 07 Jun '11

07 Jun '11

I didn't use any RPM stuff, this is just standard FR install from source, (./configure ; make ; make install).then run with radiusd -X , so its using the bootstrap thats present in eap.conf Not really an issue for me as I have real certs (and hopefully know what i'm doing ;) ) but the default install should just work (tm) for the new folk... alan ----- Reply message ----- From: "Alan DeKok" <aland(a)deployingradius.com> Date: Tue, Jun 7, 2011 17:37 Subject: key generation issue with 3.x To: "FreeRadius developers mailing list" <freeradius-devel(a)lists.freeradius.org> Alan Buxey wrote: > with FR 3.0rc1 (well, current GIT) there is an error for anyone starting > from scratch with bare config and 'radiusd -X' - the system kills the child because > its taking too long to generate the DH/cert etc Hmm... the "make install" process should probably make the fake certificates. The RPM scripts will then need to be modified to not package those files. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html

1 0

GIT Log for 2011-05-31 23:33 GMT
by aland＠deployingradius.com 31 May '11

31 May '11

commit 1daa6e3c158d131ffc8d046f66b9197a0e1d3752 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue May 31 21:21:23 2011 +0200 Added MS-CHAP-V2 Files changed: share/dictionary.freeradius.internal | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) ====================================================================== commit fe8a67731ac7024ff558c43ae5ff621050b4951b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue May 31 20:39:42 2011 +0200 Last set of vp_print fixes Files changed: src/include/libradius.h | 2 -- 1 files changed, 0 insertions(+), 2 deletions(-) ====================================================================== commit 8197decb55e6df8f7d40b5db498a46e3af27db9a Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue May 31 13:20:12 2011 +0200 Move \t into vp_print, just like the last commit Files changed: src/lib/print.c | 2 +- src/main/valuepair.c | 2 -- src/modules/rlm_digest/rlm_digest.c | 1 - 3 files changed, 1 insertions(+), 4 deletions(-) ====================================================================== commit d6ef8b75df19c3429fd6917edf7ea991b57e06fd Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue May 31 09:32:20 2011 +0200 vp_print should add a "\n" to the end All callers already do this, so it's best to move that code into vp_print Files changed: src/lib/print.c | 2 +- src/main/valuepair.c | 2 -- src/modules/rlm_digest/rlm_digest.c | 1 - 3 files changed, 1 insertions(+), 4 deletions(-) ======================================================================

1 0

detail log type wrong (SPACE)
by ziyen 31 May '11

31 May '11

Hi Quick patch Thanks. but, old version's are like below good format, Tue May 31 18:42:51 2011 *<TAB>*Packet-Type = Access-Request *<TAB>*NAS-Port-Type = Wireless-802.11 *<TAB>*User-Name = "test01" *<TAB>*NAS-IP-Address = 192.168.255.6 *<TAB>*Message-Authenticator = 0xea14bd1a18cd682bdeb15acc163762e5 Tue May 31 18:42:51 2011 *<TAB>*Packet-Type = Access-Accept *<TAB>*Cleartext-Password := "test0101" But Patches version's are like below.. Tue May 31 20:06:49 2011 *<TAB>*Packet-Type = Access-Request NAS-Port-Type = Wireless-802.11 User-Name = "test01" NAS-IP-Address = 192.168.255.6 Message-Authenticator = 0x93707c01792928c6593334475463736a Tue May 31 20:06:49 2011 *<TAB>*Packet-Type = Access-Accept Cleartext-Password := "test0101" Tue May 31 20:10:20 2011 Acct-Status-Type = Interim-Update Acct-Session-Id = "002257968FC0-34159EDCF366-116460751" NAS-IP-Address = 192.168.254.9 Acct-Input-Octets = 18836 Acct-Output-Octets = 370 Acct-Input-Packets = 139 Acct-Output-Packets = 3 User-Name = "test01" Called-Station-Id = "00-22-57-96-8F-C0" Calling-Station-Id = "34-15-9E-DC-F3-66" NAS-Identifier = "3Com Access Point 7760" Vendor-Specific = 0x564c414e2049442069733a2030 Vendor-Specific = 0x656e74726f5f39 Acct-Session-Time = 602 Acct-Unique-Session-Id = "68e23ed7c01340b3" *<TAB>*Timestamp = 1306872620 Thanks..

2 1