- Freeradius-Devel - lists.freeradius.org

Query on UDP proxy socket using freeradius version 3.0.16
by saurabha badhai 20 Jun '23

20 Jun '23

I see UDP socket is bind to port 0 which means kernel will allocate the ephemeral port based on the available list. I am observing that the port is still in open state even though after request is served. It's listed in netstat -anp command after 2 days. There is no message served by that port for last 2 days. *netstat -anp* output udp 0 0 0.0.0.0:*26307 *0.0.0.0:* 19293/radiusd Below is *ss -anp* output udp UNCONN 0 0 *:26307 *:* users:(("radiusd",pid=19293,fd=26)) Can anyone help to answer when this socket bind to port 26307 get closed or always in open state ? Problem here if suppose want to connect to 100 different AAAs, then all socket will be in open state which may not correct. Thanks, Saurabha

4 13

Regarding backport fix of https://github.com/FreeRADIUS/freeradius-server/issues/3501 to 3.0.x branches.
by saurabha badhai 06 Jun '23

06 Jun '23

Hi, I'm using the version 3.0.16, facing similar issue as https://github.com/FreeRADIUS/freeradius-server/issues/3501. https://github.com/FreeRADIUS/freeradius-server/issues/3501#issuecomment-15… It's difficult to upgrade to 3.2.x where these fixes are available. May I know if fix available in 3.0.x branches to use, I need it immediately. Thanks, Saurabha

4 20

Handling of bad EAP packets - EAP methods
by Jan-Frederik Rieckers 03 Jun '23

03 Jun '23

Hi, in regard to the discussions currently taking place inside eduroam and at the radext WG [1] I have a comment regarding the handling of invalid EAP packets. I personally have not yet seen an EAP packet that only had a bogous EAP method but a valid length and code. Since there may appear new EAP methods and there is a serious problem in getting people to update their RADIUS servers once the server is running (and the additional problem that this would be incredibly hard to spot), I would suggest, leaving the "max_eap_type" out or at least disabling it by default. If I'm reading the source code correctly, currently it defaults to 52, which would disable at least EAP-EKE v1, PT-EAP, EAP-TEAP and EAP-NOOB. I.e. in eduroam this could lead to a policy violation, since those may be valid EAP messages and the policy prohibits any party from modifying the contents of the EAP message (which, at least IMHO also means that those packets MUST NOT be rejected if they are formally valid. I think rejecting them based on invalid length is justifiable.). Same argumentation (although probably less likely) goes for the EAP code. There may be future additions to the EAP protocol that add new EAP codes, but here it may be acceptable to reject these EAP packets for now and release an update if there is any future ambition to add new code points. Cheers, Janfred [1]: https://mailarchive.ietf.org/arch/msg/radext/40nmkHtVkrWfEty_oAl93gQ4tY

2 2

Support to get CRL distribution points from client certificate
by Natarajan M 11 May '23

11 May '23

Some of the CAs start adding new CRL distribution points in the client certificate (Since it is a trusted CA by configuration and client cert is signed by this trusted CA, this attribute is also a trusted source for distribution points). Added support for the same. Is it possible to merge with any of the applicable releases? diff --git a/share/dictionary.freeradius.internal b/share/dictionary.freeradius.internal index 347e3e59f3..da79a9209a 100644 --- a/share/dictionary.freeradius.internal +++ b/share/dictionary.freeradius.internal @@ -571,6 +571,7 @@ ATTRIBUTE TLS-PSK-Identity 1933 string ATTRIBUTE TLS-Client-Cert-X509v3-Extended-Key-Usage-OID 1936 string ATTRIBUTE TLS-Client-Cert-Valid-Since 1937 string ATTRIBUTE TLS-Cache-Method 1938 integer +ATTRIBUTE TLS-Cert-CRL-Distribution-Points 1939 string VALUE TLS-Cache-Method save 1 VALUE TLS-Cache-Method load 2 VALUE TLS-Cache-Method clear 3 diff --git a/src/main/tls.c b/src/main/tls.c index 4149a473a9..f858d381fe 100644 --- a/src/main/tls.c +++ b/src/main/tls.c @@ -2779,7 +2779,7 @@ ocsp_end: /* * For creating certificate attributes. */ -static char const *cert_attr_names[9][2] = { +static char const *cert_attr_names[10][2] = { { "TLS-Client-Cert-Serial", "TLS-Cert-Serial" }, { "TLS-Client-Cert-Expiration", "TLS-Cert-Expiration" }, { "TLS-Client-Cert-Subject", "TLS-Cert-Subject" }, @@ -2788,7 +2788,8 @@ static char const *cert_attr_names[9][2] = { { "TLS-Client-Cert-Subject-Alt-Name-Email", "TLS-Cert-Subject-Alt-Name-Email" }, { "TLS-Client-Cert-Subject-Alt-Name-Dns", "TLS-Cert-Subject-Alt-Name-Dns" }, { "TLS-Client-Cert-Subject-Alt-Name-Upn", "TLS-Cert-Subject-Alt-Name-Upn" }, - { "TLS-Client-Cert-Valid-Since", "TLS-Cert-Valid-Since" } + { "TLS-Client-Cert-Valid-Since", "TLS-Cert-Valid-Since" }, + { "TLS-Client-Cert-CRL-Distribution-Points", "TLS-Cert-CRL-Distribution-Points"} }; #define FR_TLS_SERIAL (0) @@ -2800,11 +2801,37 @@ static char const *cert_attr_names[9][2] = { #define FR_TLS_SAN_DNS (6) #define FR_TLS_SAN_UPN (7) #define FR_TLS_VALID_SINCE (8) +#define FR_TLS_CDP (9) static const char *cert_names[2] = { "client", "server", }; +/* + * Extract Certification Distribution point URL from the certificate + */ +const char *get_dp_url(DIST_POINT *dp) +{ + GENERAL_NAMES *gens; + GENERAL_NAME *gen; + int i, gtype; + ASN1_STRING *uri; + + if (dp == NULL || !dp->distpoint || dp->distpoint->type != 0) { + return NULL; + } + gens = dp->distpoint->name.fullname; + for (i = 0; i < sk_GENERAL_NAME_num(gens); i++) { + gen = sk_GENERAL_NAME_value(gens, i); + uri = GENERAL_NAME_get0_value(gen, &gtype); + if (gtype == GEN_URI && ASN1_STRING_length(uri) > 6) { + const char *url_ptr = (const char*) ASN1_STRING_get0_data(uri); + return url_ptr; + } + } + return NULL; +} + /* * Before trusting a certificate, you must make sure that the * certificate is 'valid'. There are several steps that your @@ -2839,6 +2866,7 @@ int cbtls_verify(int ok, X509_STORE_CTX *ctx) char common_name[1024]; char cn_str[1024]; char buf[64]; + char cdp[1024]; X509 *client_cert; #if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER) const STACK_OF(X509_EXTENSION) *ext_list; @@ -2978,6 +3006,28 @@ int cbtls_verify(int ok, X509_STORE_CTX *ctx) rdebug_pair(L_DBG_LVL_2, request, vp, NULL); } + /* + * Get the Certificate Distribution points + */ + STACK_OF(DIST_POINT) *crl_dp = X509_get_ext_d2i(client_cert, NID_crl_distribution_points, NULL, NULL); + DIST_POINT *dp; + const char *url_ptr = NULL; + if (crl_dp != NULL) { + for (int i = 0; i < sk_DIST_POINT_num(crl_dp); i++) { + dp = sk_DIST_POINT_value(crl_dp, i); + if (dp != NULL) { + cdp[0] = '\0'; + url_ptr = get_dp_url(dp); + if (url_ptr != NULL) { + strncpy(cdp, (char*) url_ptr, (int) strlen(url_ptr)); + cdp[strlen(url_ptr)] = '\0'; + vp = fr_pair_make(talloc_ctx, certs, cert_attr_names[FR_TLS_CDP][lookup], cdp, T_OP_ADD); + rdebug_pair(L_DBG_LVL_2, request, vp, NULL); + } + } + } + } + /* * Get the RFC822 Subject Alternative Name */ Thanks Natarajan

1 1

Patch for stats in TCP mode
by Natarajan M 11 May '23

11 May '23

Stats work well when NAS to freeradius connection mode is UDP, but doesnt work when connection mode is TCP mode. Fixed with following patch, is it possible to review and merge to one of the releases. diff --git a/src/include/stats.h b/src/include/stats.h index 6d62883d54..ce25c9d426 100644 --- a/src/include/stats.h +++ b/src/include/stats.h @@ -80,7 +80,8 @@ void request_stats_reply(REQUEST *request); void radius_stats_ema(fr_stats_ema_t *ema, struct timeval *start, struct timeval *end); -#define FR_STATS_INC(_x, _y) radius_ ## _x ## _stats._y++;if (listener) listener->stats._y++;if (client) client->_x._y++; +#define FR_STATS_INC(_x, _y) radius_ ## _x ## _stats._y++;if (listener) listener->stats._y++;if (client) client->_x._y++;\ + if (listener && listener->parent) listener->parent->stats._y++; #define FR_STATS_TYPE_INC(_x) _x++ #else /* WITH_STATS */ diff --git a/src/main/stats.c b/src/main/stats.c index f36d04aef8..75d558493b 100644 --- a/src/main/stats.c +++ b/src/main/stats.c @@ -109,25 +109,29 @@ void request_stats_final(REQUEST *request) return; #undef INC_AUTH -#define INC_AUTH(_x) radius_auth_stats._x++;request->listener->stats._x++;request->client->auth._x++; +#define INC_AUTH(_x) radius_auth_stats._x++;request->listener->stats._x++;request->client->auth._x++;\ +if (request->listener->parent) {request->listener->parent->stats._x++;} #undef INC_ACCT #ifdef WITH_ACCOUNTING -#define INC_ACCT(_x) radius_acct_stats._x++;request->listener->stats._x++;request->client->acct._x++ +#define INC_ACCT(_x) radius_acct_stats._x++;request->listener->stats._x++;request->client->acct._x++;\ +if (request->listener->parent) {request->listener->parent->stats._x++;} #else #define INC_ACCT(_x) #endif #undef INC_COA #ifdef WITH_COA -#define INC_COA(_x) radius_coa_stats._x++;request->listener->stats._x++;request->client->coa._x++ +#define INC_COA(_x) radius_coa_stats._x++;request->listener->stats._x++;request->client->coa._x++;\ +if (request->listener->parent) {request->listener->parent->stats._x++;} #else #define INC_COA(_x) #endif #undef INC_DSC #ifdef WITH_DSC -#define INC_DSC(_x) radius_dsc_stats._x++;request->listener->stats._x++;request->client->dsc._x++ +#define INC_DSC(_x) radius_dsc_stats._x++;request->listener->stats._x++;request->client->dsc._x++;\ +if (request->listener->parent) {request->listener->parent->stats._x++;} #else #define INC_DSC(_x) #endif @@ -745,6 +749,13 @@ void request_stats_reply(REQUEST *request) * Not found: don't do anything */ this = listener_find_byipaddr(&ipaddr, server_port->vp_integer, IPPROTO_UDP); + +#ifdef WITH_TCP + if (!this) { + this = listener_find_byipaddr(&ipaddr, server_port->vp_integer, IPPROTO_TCP); + } +#endif + if (!this) { stats_error(request, "No such listener"); return; @@ -819,6 +830,13 @@ void request_stats_reply(REQUEST *request) * Not found: don't do anything */ home = home_server_find(&ipaddr, server_port->vp_integer, IPPROTO_UDP); + +#ifdef WITH_TCP + if (!home) { + home = home_server_find(&ipaddr, server_port->vp_integer, IPPROTO_TCP); + } +#endif + if (!home) { stats_error(request, "Failed to find home server IP"); return; Thanks Natarajan

2 2

Patch for accounting in TCP mode
by Natarajan M 11 May '23

11 May '23

Accounting requests are ignored when TCP connection mode is used. Following fix fixes the issue, is it possible to take this to one of the releases? diff --git a/src/main/listen.c b/src/main/listen.c index 19d22a24fd..0bd88cdde0 100644 --- a/src/main/listen.c +++ b/src/main/listen.c @@ -575,7 +575,16 @@ static int dual_tcp_recv(rad_listen_t *listener) #ifdef WITH_ACCOUNTING case PW_CODE_ACCOUNTING_REQUEST: - if (listener->type != RAD_LISTEN_ACCT) goto bad_packet; + if (listener->type != RAD_LISTEN_ACCT) { + /* + * Allow auth + dual. Disallow + * everything else. + */ + if (!((listener->type == RAD_LISTEN_AUTH) && + (listener->dual))) { + goto bad_packet; + } + } FR_STATS_INC(acct, total_requests); fun = rad_accounting; break; Thanks Natarajan

2 2

Version numbering changes
by Max Khon 23 Nov '22

23 Nov '22

Hello, I see a number of commits that fix things after recent numbering changes were committed. However there are more issues to fix: 1) Dockerfile.deps do shallow clone of freeradius git repo. So "git describe" then fails with fatal: No names found, cannot describe anything As a result docker builds have no RADIUSD_VERSION_INCRM defined. 2) .spec files expect freeradius-server-4.0.0.tar.bz2 to exist but "dist" target now creates freeradius-server-$(PKG_VERSION).tar.bz2 and $(PKG_VERSION) includes $(RADIUSD_VERSION_INCRM) Max

1 0

FreeRADIUS 3.0.25 - Unlang Config Retrieval (Load Balancers) from within Authentication Module
by Jacob Lane 21 Sep '22

21 Sep '22

Hi there! I'm currently working for a client that would like to list some servers under load-balancers in their config file and, for a somewhat convoluted reason to do with the authentication method, the IP addresses of those load balancers need to be retrieved at a later date from within an authentication module. I've pored over Doxygen to try and formulate a way of doing it myself but I'm coming up a little short - it would always be possible to manually parse the config file myself or include the IP Addresses in the individual config file for the module but the client would prefer to do it automatically and for the sake of robustness I'd like to at least attempt to pull those values from within FreeRADIUS before going for the other methods! If anyone has any guidance on this matter it would be very gratefully received :) Cheers and all the best! Jacob

2 3

dlopen issues on Almalinux9
by Bill Campbell 14 Jul '22

14 Jul '22

I'm trying to build freeradius from the git version 4.0.0 on Almalinux9, but having problems with failures building the included dlopen.c. Building under the OpenPKG package management system. # uname -a Linux almadev9.mi.celestial.com 5.14.0-70.13.1.el9_0.x86_64 #1 SMP PREEMPT Tue May 17 15:53:11 EDT 2022 x86_64 x86_64 x86_64 GNU/Linux gcc-11.2.0 binutils-2.38 automake-1.16.5 autoconf-2.71 libtool-2.4.6 The compile is failing with __GLIBC_USE and __GNUC_PREREQ errors. The configure script finds the system's -ldl, but I haven't been able to figure out how to use that instead of the included dlopen. I've had similar results trying to build on the latest versions of 64-bit Raspberry Pi Linux. Bill -- INTERNET: bill(a)celestial.com Bill Campbell; Celestial Software LLC URL: http://www2.celestial.com/ 6641 E. Mercer Way Mobile: (206) 947-5591 PO Box 820 Fax: (206) 232-9186 Mercer Island, WA 98040-0820

2 3

dynamic clients configuration may cause radiusd 3.2.0 (and earlier) to hang
by Sam Yee 12 Jul '22

12 Jul '22

Hi freeradius devs. I was able to cause radiusd to hang by configuring a dynamic client in SQL using the same shared secret of an existing static client. It causes a loop in a linked list. Here is the fix: --- cut --- --- freeradius-server-3.2.0/src/main/client.c.orig 2022-04-21 13:11:17.000000000 -0700 +++ freeradius-server-3.2.0/src/main/client.c 2022-07-12 16:05:13.900988256 -0700 @@ -1425,7 +1425,13 @@ } else { RDEBUG2("%s = %s", cf_pair_attr(cp), cf_pair_value(cp)); } - cf_pair_add(c->cs, cp); + + if (cp != NULL) + { + cf_pair_add(c->cs, cp); + } + + cp = NULL; talloc_free(vp); } --- cut --- After calling cf_pair_add(), cp is added to the list. In the next loop iteration, cp may not be re-allocated, and it is attempted to be re-added to the list. cp's next pointer points back to itself. Please let me know if the fix can make it to the next stable release. Thanks, Sam

2 1