- Freeradius-Devel - lists.freeradius.org

Automatic report from sources (radiusd) between 06.11.2007 - 07.11.2007 GMT
by Automatic cvs log generator 07 Nov '07

07 Nov '07

CVS log entries from 06.11.2007 (Tue) 09:00:01 - 07.11.2007 (Wed) 09:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/modules/rlm_ldap/rlm_ldap.c; Revisions: 1.188 File: radiusd/raddb/radiusd.conf.in; Revisions: 1.188.2.4.2.19 ===================================================== Log entries ===================================================== Description: Note that reject_delay = 0 is a good idea Modified files: File: radiusd/raddb/radiusd.conf.in; Revision: 1.188.2.4.2.19; Date: 2007/11/06 21:55:08; Author: aland; Lines: (+6 -3) ------------------------------- Description: If there's no User-Name, ldap is a NOOP, not a failure Modified files: File: radiusd/src/modules/rlm_ldap/rlm_ldap.c; Revision: 1.188; Date: 2007/11/06 21:55:40; Author: aland; Lines: (+3 -3) ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/radiusd.conf.in Revisions: 1.188.2.4.2.19 Authors: aland (+6 -3) ------------------------------- File: radiusd/src/modules/rlm_ldap/rlm_ldap.c Revisions: 1.188 Authors: aland (+3 -3) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

4 5

OpenLDAP 2.3 libldap upgrade howto
by Peter Nixon 07 Nov '07

07 Nov '07

Just incase someone has some free time and feels like hacking on rlm_ldap, here is some documentation thanks to the openSUSE crew (Darix in particular) who pointed out to me that "uses -DLDAP_DEPRECATED to avoid OpenLDAP crashes" was probably not the best way to solve the problem :-) http://en.opensuse.org/OpenLDAP_2.3_libldap_upgrade_howto Cheers -- Peter Nixon http://peternixon.net/

2 1

freeradius-client-1.1.5
by Eivind Naess 07 Nov '07

07 Nov '07

Hi Freeradius users, I have a question regarding the freeradius-client (1.1.5). There is an example in that archive that shows you how to embed radius into your application in 50 lines of code or so. This example does not seem to be compiling at all, and thus the API for rc_config_init() and rc_add_config() is absent from the freeradius-client.h. Studying the lib/config.c the implementation is missing too, and the only way that I can set the configuration options is by writing a temp file with the options and have the library actually read the options from there. If you are really thinking of embedding Radius into you application you really want a different way such as rc_add_config (handle, keyword, value). Would anyone be interested in a patch for this? - Eivind

4 3

Re: Testing EAP-TLS session resumption
by sujithsankar 06 Nov '07

06 Nov '07

Hi All, I successfully tested session resumption of my EAP-TLS and EAP-TTLS clients using FreeRADIUS version 1.1.0. The following files were modified to make session resumption work. freeradius-1.1.0/src/modules/rlm_eap/types/rlm_eap_tls/tls.c , freeradius-1.1.0/src/modules/rlm_eap/types/rlm_eap_tls/eap_tls.c and freeradius-1.1.0/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c. Here is the patch to be applied to freeRADIUS 1.1.0 to make fast re-authentication work. diff -Naur freeradius-1.1.0/src/modules/rlm_eap/types/rlm_eap_tls/eap_tls.c freeradius-1.1.0_reauth/src/modules/rlm_eap/types/rlm_eap_tls/eap_tls.c --- freeradius-1.1.0/src/modules/rlm_eap/types/rlm_eap_tls/eap_tls.c 2004-09-02 01:00:48.000000000 +0530 +++ freeradius-1.1.0_reauth/src/modules/rlm_eap/types/rlm_eap_tls/eap_tls.c 2007-11-01 09:49:09.000000000 +0530 @@ -609,43 +609,61 @@ static void eaptls_operation(EAPTLS_PACKET *eaptls_packet UNUSED, eaptls_status_t status, EAP_HANDLER *handler) { - tls_session_t *tls_session; + int ret = 0; + tls_session_t *tls_session; - tls_session = (tls_session_t *)handler->opaque; + tls_session = (tls_session_t *)handler->opaque; - if ((status == EAPTLS_MORE_FRAGMENTS) || - (status == EAPTLS_MORE_FRAGMENTS_WITH_LENGTH) || - (status == EAPTLS_FIRST_FRAGMENT)) { - /* - * Send the ACK. - */ - eaptls_send_ack(handler->eap_ds, tls_session->peap_flag); - } else { - /* - * We have the complete TLS-data or TLS-message. - * - * Clean the dirty message. - * - * Authenticate the user and send - * Success/Failure. - * - * If more info - * is required then send another request. */ - if (tls_handshake_recv(tls_session)) { - /* - * FIXME: return success/fail. - * - * TLS proper can decide what to do, then. - */ - eaptls_request(handler->eap_ds, tls_session); - } else { - eaptls_fail(handler->eap_ds, tls_session->peap_flag); - } - } - return; + if ((status == EAPTLS_MORE_FRAGMENTS) || + (status == EAPTLS_MORE_FRAGMENTS_WITH_LENGTH) || + (status == EAPTLS_FIRST_FRAGMENT)) + { + /* + * Send the ACK. + */ + eaptls_send_ack(handler->eap_ds, tls_session->peap_flag); + } + else + { + /* + * We have the complete TLS-data or TLS-message. + * + * Clean the dirty message. + * + * Authenticate the user and send + * Success/Failure. + * + * If more info + * is required then send another request. */ + ret = tls_handshake_recv(tls_session); + /* + * TLS returns 1 on normal case. + * 7 (it can be any value otherthan 0 and 1. TLS should know this value) + * on fast re-auth completion. + */ + if (1 == ret) + { + eaptls_request(handler->eap_ds, tls_session); + } + else if(7 == ret) + { + /* + * Success: Return MPPE keys. + */ + eaptls_success(handler->eap_ds, 0); + eaptls_gen_mppe_keys(&handler->request->reply->vps, + tls_session->ssl, + "client EAP encryption"); + + } + else + { + eaptls_fail(handler->eap_ds, tls_session->peap_flag); + } + } + return; } - /* * In the actual authentication first verify the packet and then create the data structure */ @@ -778,6 +796,7 @@ { uint8_t *ptr; + /* * Don't set eap_ds->request->type.type, as the main EAP * handler will do that for us. This allows the TLS @@ -820,6 +839,7 @@ break; case EAPTLS_SUCCESS: eap_ds->request->code = PW_EAP_SUCCESS; + break; case EAPTLS_FAIL: eap_ds->request->code = PW_EAP_FAILURE; diff -Naur freeradius-1.1.0/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c freeradius-1.1.0_reauth/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c --- freeradius-1.1.0/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c 2005-12-15 05:36:26.000000000 +0530 +++ freeradius-1.1.0_reauth/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c 2007-11-01 09:49:12.000000000 +0530 @@ -503,6 +503,7 @@ DEBUG2(" rlm_eap_tls: Authenticate"); + status = eaptls_process(handler); DEBUG2(" eaptls_process returned %d\n", status); switch (status) { @@ -546,6 +547,7 @@ } #endif + printf("CALLING FAIL in authenticate.\n"); eaptls_fail(handler->eap_ds, 0); return 0; break; @@ -564,6 +566,7 @@ eaptls_gen_mppe_keys(&handler->request->reply->vps, tls_session->ssl, "client EAP encryption"); + return 1; } diff -Naur freeradius-1.1.0/src/modules/rlm_eap/types/rlm_eap_tls/tls.c freeradius-1.1.0_reauth/src/modules/rlm_eap/types/rlm_eap_tls/tls.c --- freeradius-1.1.0/src/modules/rlm_eap/types/rlm_eap_tls/tls.c 2004-02-27 00:34:31.000000000 +0530 +++ freeradius-1.1.0_reauth/src/modules/rlm_eap/types/rlm_eap_tls/tls.c 2007-11-01 09:49:10.000000000 +0530 @@ -22,11 +22,24 @@ */ #include "eap_tls.h" +static long ctx_num = 0; + tls_session_t *eaptls_new_session(SSL_CTX *ssl_ctx, int client_cert) { tls_session_t *state = NULL; SSL *new_tls = NULL; int verify_mode = SSL_VERIFY_NONE; + int ret = 0; + + if(0 == ctx_num++) + { + ret = SSL_CTX_set_session_id_context(ssl_ctx, + (const unsigned char *)&ctx_num, sizeof(long)); + if(!ret) + { + printf("FR : pblm in set session id context\n"); + } + } if ((new_tls = SSL_new(ssl_ctx)) == NULL) { radlog(L_ERR, "rlm_eap_tls: Error creating new SSL"); @@ -39,9 +52,14 @@ state = (tls_session_t *)malloc(sizeof(*state)); memset(state, 0, sizeof(*state)); + + SSL_CTX_set_session_cache_mode(ssl_ctx, SSL_SESS_CACHE_NO_AUTO_CLEAR|SSL_SESS_CACHE_SERVER); + session_init(state); state->ssl = new_tls; + state->ssl->new_session = 1; + /* * Create & hook the BIOs to handle the dirty side of the * SSL. This is *very important* as we want to handle @@ -83,6 +101,8 @@ return state; } + + /* * Print out some text describing the error. */ @@ -169,7 +189,8 @@ } /* Some Extra STATE information for easy debugging */ - if (SSL_is_init_finished(ssn->ssl)) { + if (SSL_is_init_finished(ssn->ssl)) + { DEBUG2("SSL Connection Established\n"); } if (SSL_in_init(ssn->ssl)) { @@ -185,6 +206,18 @@ DEBUG2("In SSL Connect mode \n"); } + if (SSL_is_init_finished(ssn->ssl) && 1 == ssn->ssl->hit) + { + /* Session Resumption : CCS and Finish received, parsed + * and validated successfully. Time to wind up handshake. */ + record_init(&ssn->dirty_in); + + /* This can return any value otherthan 0 and 1. Check for + * this ret value in the lower layer for reauth completion */ + return 7; + + } + if (ssn->info.content_type != application_data) { err = BIO_read(ssn->from_ssl, ssn->dirty_out.data, sizeof(ssn->dirty_out.data)); @@ -260,8 +293,19 @@ void session_close(tls_session_t *ssn) { + int index = 0; + static int flag = 0; + int ret = 0; + SSL *ssl_bk = ssn->ssl; + SSL_SESSION *pSession; + pSession = malloc(sizeof(SSL_SESSION)); + + if(ssn->ssl) + { + SSL_shutdown(ssn->ssl); SSL_free(ssn->ssl); + } #if 0 /* * WARNING: SSL_free seems to decrement the reference counts already, @@ -271,11 +315,11 @@ BIO_free(ssn->into_ssl); if(ssn->from_ssl) BIO_free(ssn->from_ssl); -#endif record_close(&ssn->clean_in); record_close(&ssn->clean_out); record_close(&ssn->dirty_in); record_close(&ssn->dirty_out); +#endif session_init(ssn); } Thanks and Regards, -Sujith ----- Original Message ----- From: "Alan DeKok" <aland(a)deployingradius.com> To: "FreeRadius developers mailing list" <freeradius-devel(a)lists.freeradius.org> Sent: Wednesday, October 17, 2007 7:27 PM Subject: Re: Testing EAP-TLS session resumption > sujithsankar wrote: >> I am working on EAP-TLS client. >> The normal functionality testing was done by interoperating with >> FreeRADIUS. >> >> Now, I would like to test fast re-authentication feature of my EAP-TLS >> client. >> It is learnt that FreeRADIUS does not support this feature. >> >> Has anyone of you tried to test such a feature? > > I haven't tested it. > >> Does anyone know about any patch for FreeRADIUS to support session >> resumption? > > Nope. Feel free to send a patch, if you figure out how to get it to > work. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/devel.html The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments contained in it. Contact your Administrator for further information.

3 4

Automatic report from sources (radiusd) between 05.11.2007 - 06.11.2007 GMT
by Automatic cvs log generator 06 Nov '07

06 Nov '07

CVS log entries from 05.11.2007 (Mon) 09:00:00 - 06.11.2007 (Tue) 09:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/main/event.c; Revisions: 1.69 File: radiusd/src/lib/event.c; Revisions: 1.14, 1.13 ===================================================== Log entries ===================================================== Description: Clarify code Modified files: File: radiusd/src/lib/event.c; Revision: 1.14; Date: 2007/11/05 23:24:48; Author: aland; Lines: (+6 -8) ------------------------------- Description: Set el->now Modified files: File: radiusd/src/lib/event.c; Revision: 1.13; Date: 2007/11/05 22:54:05; Author: aland; Lines: (+13 -9) ------------------------------- Description: Catch some corner cases in wait_a_bit Modified files: File: radiusd/src/main/event.c; Revision: 1.69; Date: 2007/11/05 23:26:26; Author: aland; Lines: (+26 -6) ===================================================== Summary of modified files ===================================================== File: radiusd/src/lib/event.c Revisions: 1.14, 1.13 Authors: aland (+6 -8), aland (+13 -9) ------------------------------- File: radiusd/src/main/event.c Revisions: 1.69 Authors: aland (+26 -6) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 04.11.2007 - 05.11.2007 GMT
by Automatic cvs log generator 05 Nov '07

05 Nov '07

CVS log entries from 04.11.2007 (Sun) 09:00:01 - 05.11.2007 (Mon) 09:00:00 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/raddb/sql/mysql/schema.sql; Revisions: 1.7 File: radiusd/raddb/sql/mysql/ippool.conf; Revisions: 1.4 File: radiusd/raddb/sql/mysql/ippool.sql; Revisions: 1.4 File: radiusd/raddb/sql/mysql/dialup.conf; Revisions: 1.5 ===================================================== Combined list of identical log entries ===================================================== Description: Updated Schema Modified files: File: radiusd/raddb/sql/mysql/dialup.conf; Revision: 1.5; Date: 2007/11/05 08:59:00; Author: aland; Lines: (+5 -5) File: radiusd/raddb/sql/mysql/ippool.conf; Revision: 1.4; Date: 2007/11/05 08:59:00; Author: aland; Lines: (+7 -7) File: radiusd/raddb/sql/mysql/ippool.sql; Revision: 1.4; Date: 2007/11/05 08:59:00; Author: aland; Lines: (+1 -1) File: radiusd/raddb/sql/mysql/schema.sql; Revision: 1.7; Date: 2007/11/05 08:59:00; Author: aland; Lines: (+3 -3) ===================================================== Log entries ===================================================== ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/sql/mysql/dialup.conf Revisions: 1.5 Authors: aland (+5 -5) ------------------------------- File: radiusd/raddb/sql/mysql/ippool.conf Revisions: 1.4 Authors: aland (+7 -7) ------------------------------- File: radiusd/raddb/sql/mysql/ippool.sql Revisions: 1.4 Authors: aland (+1 -1) ------------------------------- File: radiusd/raddb/sql/mysql/schema.sql Revisions: 1.7 Authors: aland (+3 -3) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Please look at my nas_ident passthough patch.
by Matthew Schumacher 05 Nov '07

05 Nov '07

Developers, In my freeradius installation I make some decisions based on what the NAS identifies itself as in the nas-identifier attribute. One of these decisions is which accounting database to use. This has been causing problems for me since the session_zap function is called when we get two start messages in a row. The purpose of the function makes perfect sense: to end the old session so that multiple login detection works, but the problem is that the nas-identifier attribute isn't translated though to the stop message like the username or the nas-ip-Address so it gets logged to the wrong accounting database because there isn't a nas-identifier to match on. The solution is to pass the NAS-Identifier attribute though to the session_zap function and have it output to the accounting modules instead of simply leaving it null. I the attached patch to do this and it works, except my radius server has become less than stable. It crashes here and there, but I can't figure out why. I'm not much of a C programmer so I'm hoping that someone on the list can look at my patch and point out what I did wrong. I suspect it's a typing issue or something. Also, it would be great if the developers would consider this for a production version since passing though the NAS-Identifier won't break or affect anything currently running, but offers the flexibility of changing the Session-Type based on matching something in the NAS-Identifier. Thanks to any that can help, schu diff -ruN freeradius-1.1.7.orig/src/include/radiusd.h freeradius-1.1.7/src/include/radiusd.h --- freeradius-1.1.7.orig/src/include/radiusd.h 2007-06-12 01:31:45.000000000 -0800 +++ freeradius-1.1.7/src/include/radiusd.h 2007-09-20 16:06:57.000000000 -0800 @@ -295,7 +295,7 @@ int session_zap(REQUEST *request, uint32_t nasaddr, unsigned int port, const char *user, const char *sessionid, uint32_t cliaddr, - char proto); + char proto, const char *nas_ident); /* radiusd.c */ #ifndef _LIBRADIUS diff -ruN freeradius-1.1.7.orig/src/main/session.c freeradius-1.1.7/src/main/session.c --- freeradius-1.1.7.orig/src/main/session.c 2007-05-15 01:50:51.000000000 -0800 +++ freeradius-1.1.7/src/main/session.c 2007-09-20 16:08:45.000000000 -0800 @@ -46,7 +46,7 @@ /* End a session by faking a Stop packet to all accounting modules */ int session_zap(REQUEST *request, uint32_t nasaddr, unsigned int port, const char *user, - const char *sessionid, uint32_t cliaddr, char proto) + const char *sessionid, uint32_t cliaddr, char proto, const char *nas_ident) { REQUEST *stopreq; VALUE_PAIR *vp, *userpair; @@ -85,6 +85,7 @@ IPPAIR(PW_NAS_IP_ADDRESS, nasaddr); INTPAIR(PW_ACCT_DELAY_TIME, 0); STRINGPAIR(PW_USER_NAME, user); + STRINGPAIR(PW_NAS_IDENTIFIER, nas_ident); userpair = vp; INTPAIR(PW_NAS_PORT, port); STRINGPAIR(PW_ACCT_SESSION_ID, sessionid); diff -ruN freeradius-1.1.7.orig/src/modules/rlm_radutmp/rlm_radutmp.c freeradius-1.1.7/src/modules/rlm_radutmp/rlm_radutmp.c --- freeradius-1.1.7.orig/src/modules/rlm_radutmp/rlm_radutmp.c 2007-04-07 14:40:00.000000000 -0800 +++ freeradius-1.1.7/src/modules/rlm_radutmp/rlm_radutmp.c 2007-09-20 16:15:18.000000000 -0800 @@ -589,6 +589,7 @@ rlm_radutmp_t *inst = instance; char login[256]; char filename[1024]; + char *nas_ident = NULL; ssize_t read_size; /* @@ -664,6 +665,8 @@ ipno = vp->lvalue; if ((vp = pairfind(request->packet->vps, PW_CALLING_STATION_ID)) != NULL) call_num = vp->strvalue; + if ((vp = pairfind(request->packet->vps, PW_NAS_IDENTIFIER)) != NULL) + nas_ident = vp->strvalue; /* * lock the file while reading/writing. @@ -744,7 +747,7 @@ session_zap(request, u.nas_address, u.nas_port, login, session_id, u.framed_address, - u.proto); + u.proto, nas_ident); } } } diff -ruN freeradius-1.1.7.orig/src/modules/rlm_sql/rlm_sql.c freeradius-1.1.7/src/modules/rlm_sql/rlm_sql.c --- freeradius-1.1.7.orig/src/modules/rlm_sql/rlm_sql.c 2007-07-17 04:59:08.000000000 -0800 +++ freeradius-1.1.7/src/modules/rlm_sql/rlm_sql.c 2007-09-20 16:14:24.000000000 -0800 @@ -1131,6 +1131,7 @@ int ret; uint32_t nas_addr = 0; int nas_port = 0; + char *nas_ident = NULL; /* If simul_count_query is not defined, we don't do any checking */ if (inst->config->simul_count_query[0] == 0) { @@ -1206,6 +1207,8 @@ ipno = vp->lvalue; if ((vp = pairfind(request->packet->vps, PW_CALLING_STATION_ID)) != NULL) call_num = vp->strvalue; + if ((vp = pairfind(request->packet->vps, PW_NAS_IDENTIFIER)) != NULL) + nas_ident = vp->strvalue; while (rlm_sql_fetch_row(sqlsocket, inst) == 0) { @@ -1270,7 +1273,7 @@ session_zap(request, nas_addr,nas_port,row[2],row[1], - framed_addr, proto); + framed_addr, proto, nas_ident); } }

2 1

EAP Failure Reason
by awaneesh kumar 05 Nov '07

05 Nov '07

Hi All, Currently, when the authentication using specific EAP method fails, EAP server sends the Access-Reject with EAP payload indicating result as FAILURE. Is there a way by which EAP-Server can provide the exact reason of failure in Access-Reject? I mean is there any standard or Vendor specific attribute defined to indicate the failure reason. Thanks in advance. Awaneesh __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 3

Automatic report from sources (radiusd) between 02.11.2007 - 03.11.2007 GMT
by Automatic cvs log generator 03 Nov '07

03 Nov '07

CVS log entries from 02.11.2007 (Fri) 08:00:00 - 03.11.2007 (Sat) 08:00:00 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/raddb/sites-available/proxy-inner-tunnel; Revisions: 1.1 File: radiusd/raddb/sites-available/inner-tunnel; Revisions: 1.3 File: radiusd/raddb/certs/xpextensions; Revisions: 1.2 ===================================================== Log entries ===================================================== Description: Point to MS's page Modified files: File: radiusd/raddb/certs/xpextensions; Revision: 1.2; Date: 2007/11/03 00:14:54; Author: aland; Lines: (+3 -1) ------------------------------- Description: Deleted blank line Modified files: File: radiusd/raddb/sites-available/inner-tunnel; Revision: 1.3; Date: 2007/11/02 23:57:12; Author: aland; Lines: (+1 -2) ------------------------------- Description: One more sample virtual server. At this rate, we'll have something resembling "documentation" real soon now. Modified files: File: radiusd/raddb/sites-available/proxy-inner-tunnel; Revision: 1.1; Date: 2007/11/02 23:57:40; Author: aland; ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/certs/xpextensions Revisions: 1.2 Authors: aland (+3 -1) ------------------------------- File: radiusd/raddb/sites-available/inner-tunnel Revisions: 1.3 Authors: aland (+1 -2) ------------------------------- File: radiusd/raddb/sites-available/proxy-inner-tunnel Revisions: 1.1 Authors: aland -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

CVS server broken?
by Chris Mikkelson 01 Nov '07

01 Nov '07

My cvs updates are dying with: cvs update: Updating . cvs update: failed to create lock directory for `/source/radiusd' (/source/radiusd/#cvs.lock): No space left on device cvs update: failed to obtain dir lock in repository `/source/radiusd' cvs [update aborted]: read lock failed - giving up which appears to be a server-side error. Anyone else's doing the same? Thanks, -- Chris Mikkelson | For example, I could be a sentient PERL script. That cmikk(a)qwest.net | pretty much assumes that someone brilliant enough to | write me was also stupid enough to program in PERL. | Not a likely explanation. -- Terry Lambert

2 1