- Freeradius-Devel - lists.freeradius.org

Query to know radius disconnect request and Ack is supported in free radius
by Shankar Ganesh C 17 Aug '06

17 Aug '06

Hi All, Could some body help me to know whether Radius disconnect and Ack messages are supported in free radius as defined in RFC 2822 ? The message ID are diconnet 40 adn Ack 41. Thanks and regards Shankar ganesh

1 0

Query to know radius disconnect request and Ack is supported in freeradius
by Shankar Ganesh C 17 Aug '06

17 Aug '06

Hi All, Could some body help me to know whether Radius disconnect and Ack messages are supported in free radius as defined in RFC 2822 ? The message ID are diconnet 40 adn Ack 41. Thanks and regards Shankar ganesh

1 0

logging patch
by Peter Nixon 16 Aug '06

16 Aug '06

Does anyone have anything against the attached patch? We are using it in production to also output the DID (CalledStationID) to radiusd.log alongside the CID. If there is no DID it shouldn't change the logging format at all. If noone has anything against the patch I would like to go ahead and apply it to cvs head and 1.1.3pre Cheers -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

3 5

rlm_sql: more xlat?
by Josip Almasi 16 Aug '06

16 Aug '06

Hi all, my requirements state that if home server sends policy then freeradius proxy should attach it to the string for rate limit and send RATE_POLICY back to RAS. Rates are determined by radgroupcheck and radgroupreply tables lookup. So far I hacked that in rlm_sql.c, simple strcat of Value and hardcoded attribute. Ideally, I'd be able to enter 256K_%{ERX-Ingress-Policy-Name} as Value field of radgroupreply table. This means database values should be xlat-ed too, not only parameters. So, interested in such a patch? Or, is there another way to do this? Regards...

1 0

Loging of proxied requests
by Peter Nixon 16 Aug '06

16 Aug '06

Hi Guys I am wondering why our logs for proxied packets look like the following: Mon Aug 7 20:18:40 2006 : Auth: Login incorrect (Home Server says so): [peter/peter] (from client NAS1 port 60000 cli XXXXXXXX) Wouldn't it be better for us to be a bit more concise about things? for example: Mon Aug 7 20:18:40 2006 : Auth: Login incorrect (realm: myrealm proxy: myproxy): [peter/peter] (from client NAS1 port 60000 cli XXXXXXXX) I am doing crazy thing like: DEFAULT Called-Station-Id == "YYYYYY", Proxy-To-Realm := realm1 DEFAULT Called-Station-Id == "ZZZZZZZ", Proxy-To-Realm := realm2 Therefore, I am sure that you can see why this extra logging information would be usefull. (You can't tell the realm simply by looking at the username) Cheers -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

3 5

Automatic report from sources (radiusd) between 15.08.2006 - 16.08.2006 GMT
by Automatic cvs log generator 16 Aug '06

16 Aug '06

CVS log entries from 15.08.2006 (Tue) 08:00:00 - 16.08.2006 (Wed) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/main/valuepair.c; Revisions: 1.77 File: radiusd/src/tests/eapmd5-01/req.txt; Revisions: 1.2 File: radiusd/src/include/radius.h; Revisions: 1.84, 1.83 File: radiusd/src/modules/rlm_eap/libeap/eap_types.h; Revisions: 1.6 File: radiusd/src/modules/rlm_mschap/rlm_mschap.c; Revisions: 1.78 File: radiusd/src/modules/rlm_eap/radeapclient.c; Revisions: 1.21, 1.20 File: radiusd/src/modules/rlm_chap/rlm_chap.c; Revisions: 1.14 File: radiusd/src/modules/rlm_attr_rewrite/rlm_attr_rewrite.c; Revisions: 1.37 File: radiusd/src/tests/eapsim-02/req.txt; Revisions: 1.2 File: radiusd/src/modules/rlm_eap/types/rlm_eap_gtc/rlm_eap_gtc.c; Revisions: 1.7 File: radiusd/doc/ChangeLog; Revisions: 1.74 File: radiusd/src/main/auth.c; Revisions: 1.157 File: radiusd/src/modules/rlm_pam/rlm_pam.c; Revisions: 1.41 File: radiusd/src/main/radclient.c; Revisions: 1.104 File: radiusd/src/modules/rlm_digest/rlm_digest.c; Revisions: 1.22 File: radiusd/src/modules/rlm_eap/types/rlm_eap_leap/rlm_eap_leap.c; Revisions: 1.13 File: radiusd/src/modules/rlm_pap/rlm_pap.c; Revisions: 1.39 File: radiusd/src/modules/rlm_ldap/rlm_ldap.c; Revisions: 1.172 File: radiusd/src/main/xlat.c; Revisions: 1.110 File: radiusd/src/modules/rlm_smb/rlm_smb.c; Revisions: 1.11 File: radiusd/src/lib/valuepair.c; Revisions: 1.111 File: radiusd/src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c; Revisions: 1.13 File: radiusd/src/modules/rlm_cram/rlm_cram.c; Revisions: 1.10 File: radiusd/src/modules/rlm_detail/rlm_detail.c; Revisions: 1.52 File: radiusd/src/tests/eapmd5-01/client.sh; Revisions: 1.3 File: radiusd/src/modules/rlm_krb5/rlm_krb5.c; Revisions: 1.26 File: radiusd/share/dictionary.freeradius.internal; Revisions: 1.13, 1.12, 1.11 File: radiusd/src/modules/rlm_eap/types/rlm_eap_md5/rlm_eap_md5.c; Revisions: 1.10 File: radiusd/src/tests/eapsim-02/client.sh; Revisions: 1.2 File: radiusd/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c; Revisions: 1.27 ===================================================== Combined list of identical log entries ===================================================== Description: Now that we have Cleartext-Password and Password-With-Header, use them. i.e. Move PW_PASSWORD to PW_USER_PASSWORD if it's looking in the request Move PW_PASSWORD to PW_CLEARTEXT_PASSWORD if it's in the config items Move PW_USER_PASSWORD to PW_CLEARTEXT_PASSWORD if in config items Update messages that complain about "known good" password from User-Password to Cleartext-Password Update auth.c to rewrite User-Password in config items to Cleartext-Password, and to print out a big warning message. Update rlm_pap to use Password-With-Header, but to still accept User-Password in config items for the same thing, and then delete User-Password if it had a header. Still need to update ldap configuration. Modified files: File: radiusd/doc/ChangeLog; Revision: 1.74; Date: 2006/08/15 20:46:48; Author: aland; Lines: (+5 -1) File: radiusd/src/lib/valuepair.c; Revision: 1.111; Date: 2006/08/15 20:46:49; Author: aland; Lines: (+4 -4) File: radiusd/src/main/auth.c; Revision: 1.157; Date: 2006/08/15 20:46:49; Author: aland; Lines: (+23 -7) File: radiusd/src/main/radclient.c; Revision: 1.104; Date: 2006/08/15 20:46:50; Author: aland; Lines: (+5 -5) File: radiusd/src/main/valuepair.c; Revision: 1.77; Date: 2006/08/15 20:46:50; Author: aland; Lines: (+4 -4) File: radiusd/src/main/xlat.c; Revision: 1.110; Date: 2006/08/15 20:46:51; Author: aland; Lines: (+3 -3) File: radiusd/src/modules/rlm_attr_rewrite/rlm_attr_rewrite.c; Revision: 1.37; Date: 2006/08/15 20:46:51; Author: aland; Lines: (+3 -3) File: radiusd/src/modules/rlm_chap/rlm_chap.c; Revision: 1.14; Date: 2006/08/15 20:46:52; Author: aland; Lines: (+4 -4) File: radiusd/src/modules/rlm_cram/rlm_cram.c; Revision: 1.10; Date: 2006/08/15 20:46:52; Author: aland; Lines: (+3 -3) File: radiusd/src/modules/rlm_detail/rlm_detail.c; Revision: 1.52; Date: 2006/08/15 20:46:52; Author: aland; Lines: (+3 -3) File: radiusd/src/modules/rlm_digest/rlm_digest.c; Revision: 1.22; Date: 2006/08/15 20:46:52; Author: aland; Lines: (+7 -7) File: radiusd/src/modules/rlm_eap/radeapclient.c; Revision: 1.21; Date: 2006/08/15 20:46:52; Author: aland; Lines: (+9 -5) File: radiusd/src/modules/rlm_eap/types/rlm_eap_gtc/rlm_eap_gtc.c; Revision: 1.7; Date: 2006/08/15 20:46:53; Author: aland; Lines: (+5 -5) File: radiusd/src/modules/rlm_eap/types/rlm_eap_leap/rlm_eap_leap.c; Revision: 1.13; Date: 2006/08/15 20:46:53; Author: aland; Lines: (+3 -3) File: radiusd/src/modules/rlm_eap/types/rlm_eap_md5/rlm_eap_md5.c; Revision: 1.10; Date: 2006/08/15 20:46:53; Author: aland; Lines: (+4 -4) File: radiusd/src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c; Revision: 1.13; Date: 2006/08/15 20:46:53; Author: aland; Lines: (+1 -4) File: radiusd/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c; Revision: 1.27; Date: 2006/08/15 20:46:54; Author: aland; Lines: (+2 -2) File: radiusd/src/modules/rlm_krb5/rlm_krb5.c; Revision: 1.26; Date: 2006/08/15 20:46:54; Author: aland; Lines: (+4 -4) File: radiusd/src/modules/rlm_ldap/rlm_ldap.c; Revision: 1.172; Date: 2006/08/15 20:46:54; Author: aland; Lines: (+8 -8) File: radiusd/src/modules/rlm_mschap/rlm_mschap.c; Revision: 1.78; Date: 2006/08/15 20:46:55; Author: aland; Lines: (+8 -8) File: radiusd/src/modules/rlm_pam/rlm_pam.c; Revision: 1.41; Date: 2006/08/15 20:46:56; Author: aland; Lines: (+2 -2) File: radiusd/src/modules/rlm_pap/rlm_pap.c; Revision: 1.39; Date: 2006/08/15 20:46:56; Author: aland; Lines: (+50 -49) File: radiusd/src/modules/rlm_smb/rlm_smb.c; Revision: 1.11; Date: 2006/08/15 20:46:57; Author: aland; Lines: (+3 -3) ------------------------------- Description: Define Cleartext-Password, for general consumption Modified files: File: radiusd/share/dictionary.freeradius.internal; Revision: 1.11; Date: 2006/08/15 18:29:25; Author: aland; Lines: (+2 -1) File: radiusd/src/include/radius.h; Revision: 1.83; Date: 2006/08/15 18:29:25; Author: aland; Lines: (+2 -1) ------------------------------- Description: Added Password-With-Header, so we don't have too many meanings for User-Password. This is mainly used by rlm_ldap, but the intent is to have this string contain "{header}stuff", and rlm_pap can turn that into a well-known password Modified files: File: radiusd/share/dictionary.freeradius.internal; Revision: 1.13; Date: 2006/08/15 18:49:25; Author: aland; Lines: (+2 -1) File: radiusd/src/include/radius.h; Revision: 1.84; Date: 2006/08/15 18:49:25; Author: aland; Lines: (+2 -1) ------------------------------- Description: Replaced EAP-MD5-Password with Cleartext-Password Modified files: File: radiusd/share/dictionary.freeradius.internal; Revision: 1.12; Date: 2006/08/15 18:40:18; Author: aland; Lines: (+3 -2) File: radiusd/src/modules/rlm_eap/radeapclient.c; Revision: 1.20; Date: 2006/08/15 18:40:19; Author: aland; Lines: (+4 -4) File: radiusd/src/modules/rlm_eap/libeap/eap_types.h; Revision: 1.6; Date: 2006/08/15 18:40:18; Author: aland; Lines: (+2 -3) File: radiusd/src/tests/eapmd5-01/client.sh; Revision: 1.3; Date: 2006/08/15 18:40:19; Author: aland; Lines: (+1 -1) File: radiusd/src/tests/eapmd5-01/req.txt; Revision: 1.2; Date: 2006/08/15 18:40:19; Author: aland; Lines: (+2 -2) File: radiusd/src/tests/eapsim-02/client.sh; Revision: 1.2; Date: 2006/08/15 18:40:19; Author: aland; Lines: (+1 -1) File: radiusd/src/tests/eapsim-02/req.txt; Revision: 1.2; Date: 2006/08/15 18:40:19; Author: aland; Lines: (+2 -2) ===================================================== Log entries ===================================================== ===================================================== Summary of modified files ===================================================== File: radiusd/doc/ChangeLog Revisions: 1.74 Authors: aland (+5 -1) ------------------------------- File: radiusd/share/dictionary.freeradius.internal Revisions: 1.13, 1.12, 1.11 Authors: aland (+2 -1), aland (+3 -2), aland (+2 -1) ------------------------------- File: radiusd/src/include/radius.h Revisions: 1.84, 1.83 Authors: aland (+2 -1), aland (+2 -1) ------------------------------- File: radiusd/src/lib/valuepair.c Revisions: 1.111 Authors: aland (+4 -4) ------------------------------- File: radiusd/src/main/auth.c Revisions: 1.157 Authors: aland (+23 -7) ------------------------------- File: radiusd/src/main/radclient.c Revisions: 1.104 Authors: aland (+5 -5) ------------------------------- File: radiusd/src/main/valuepair.c Revisions: 1.77 Authors: aland (+4 -4) ------------------------------- File: radiusd/src/main/xlat.c Revisions: 1.110 Authors: aland (+3 -3) ------------------------------- File: radiusd/src/modules/rlm_attr_rewrite/rlm_attr_rewrite.c Revisions: 1.37 Authors: aland (+3 -3) ------------------------------- File: radiusd/src/modules/rlm_chap/rlm_chap.c Revisions: 1.14 Authors: aland (+4 -4) ------------------------------- File: radiusd/src/modules/rlm_cram/rlm_cram.c Revisions: 1.10 Authors: aland (+3 -3) ------------------------------- File: radiusd/src/modules/rlm_detail/rlm_detail.c Revisions: 1.52 Authors: aland (+3 -3) ------------------------------- File: radiusd/src/modules/rlm_digest/rlm_digest.c Revisions: 1.22 Authors: aland (+7 -7) ------------------------------- File: radiusd/src/modules/rlm_eap/libeap/eap_types.h Revisions: 1.6 Authors: aland (+2 -3) ------------------------------- File: radiusd/src/modules/rlm_eap/radeapclient.c Revisions: 1.21, 1.20 Authors: aland (+9 -5), aland (+4 -4) ------------------------------- File: radiusd/src/modules/rlm_eap/types/rlm_eap_gtc/rlm_eap_gtc.c Revisions: 1.7 Authors: aland (+5 -5) ------------------------------- File: radiusd/src/modules/rlm_eap/types/rlm_eap_leap/rlm_eap_leap.c Revisions: 1.13 Authors: aland (+3 -3) ------------------------------- File: radiusd/src/modules/rlm_eap/types/rlm_eap_md5/rlm_eap_md5.c Revisions: 1.10 Authors: aland (+4 -4) ------------------------------- File: radiusd/src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c Revisions: 1.13 Authors: aland (+1 -4) ------------------------------- File: radiusd/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c Revisions: 1.27 Authors: aland (+2 -2) ------------------------------- File: radiusd/src/modules/rlm_krb5/rlm_krb5.c Revisions: 1.26 Authors: aland (+4 -4) ------------------------------- File: radiusd/src/modules/rlm_ldap/rlm_ldap.c Revisions: 1.172 Authors: aland (+8 -8) ------------------------------- File: radiusd/src/modules/rlm_mschap/rlm_mschap.c Revisions: 1.78 Authors: aland (+8 -8) ------------------------------- File: radiusd/src/modules/rlm_pam/rlm_pam.c Revisions: 1.41 Authors: aland (+2 -2) ------------------------------- File: radiusd/src/modules/rlm_pap/rlm_pap.c Revisions: 1.39 Authors: aland (+50 -49) ------------------------------- File: radiusd/src/modules/rlm_smb/rlm_smb.c Revisions: 1.11 Authors: aland (+3 -3) ------------------------------- File: radiusd/src/tests/eapmd5-01/client.sh Revisions: 1.3 Authors: aland (+1 -1) ------------------------------- File: radiusd/src/tests/eapmd5-01/req.txt Revisions: 1.2 Authors: aland (+2 -2) ------------------------------- File: radiusd/src/tests/eapsim-02/client.sh Revisions: 1.2 Authors: aland (+1 -1) ------------------------------- File: radiusd/src/tests/eapsim-02/req.txt Revisions: 1.2 Authors: aland (+2 -2) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 14.08.2006 - 15.08.2006 GMT
by Automatic cvs log generator 15 Aug '06

15 Aug '06

CVS log entries from 14.08.2006 (Mon) 08:00:01 - 15.08.2006 (Tue) 08:00:00 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/modules/rlm_pap/rlm_pap.c; Revisions: 1.38 ===================================================== Log entries ===================================================== Description: Don't complain about Auth-Type Accept or Reject Modified files: File: radiusd/src/modules/rlm_pap/rlm_pap.c; Revision: 1.38; Date: 2006/08/14 22:36:34; Author: aland; Lines: (+11 -2) ===================================================== Summary of modified files ===================================================== File: radiusd/src/modules/rlm_pap/rlm_pap.c Revisions: 1.38 Authors: aland (+11 -2) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

proxying accounting packets without a realm
by Peter Nixon 14 Aug '06

14 Aug '06

Hi Guys I have the following in the "users" file: DEFAULT Called-Station-Id == "YYYYYY", Proxy-To-Realm := realm1 DEFAULT Called-Station-Id == "ZZZZZZZ", Proxy-To-Realm := realm2 This works great for Authentication, however I want the same rules to also apply to accounting packets. Is there any sane way to do this at present? Cheers -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

2 4

Re: Patch: eaptls packets too large, clash MTU
by Michael Joosten 12 Aug '06

12 Aug '06

> > while using EAPTLS via RADIUS for authentication of a PPP/L2TP/IPSec VPN > > (Microsoft style), I discovered that the generated EAPTLS packets are a > > little > > bit to large. If you take Framed-MTU serious, most of the EAPTLS header is > > not > > accounted for. Result: PPP communication with max. possible IPSec MTU > > fails > > silently, because the EAPTLS packets (esp. those with long certificates) > > are > > silently discarded. > > Framed-MTU works, BUT of course you need to set fragment_size in eap.conf to a value larger than possible MTUs, otherwise you just get fragment_size'd chunks of the TLS conversation in multiple EAP_MESSAGE attributes, as you can see in the code: ssn->length_flag = inst->conf->include_length; /* * We set a default fragment size, unless the Framed-MTU * tells us it's too big. */ ssn->offset = inst->conf->fragment_size; /* * Framed-MTU is the whole packet, so we cut off the * EAPOW header (4 bytes) to be prepended by the NAS. * NOTE: This does not account for other protocols and * purposes like wired PPP, which has 8 bytes overhead. */ vp = pairfind(handler->request->packet->vps, PW_FRAMED_MTU); if (vp && ((vp->lvalue - 4) < ssn->offset)) { ssn->offset = vp->lvalue - 4; } /* * And even more for the EAP TLS header: * code + id + length + type + flags + TLS len * 1 + 1 + 2 + 1 + 1 + 4 = 10 */ ssn->offset -= 10; Actually, I discussed that a little with Alan last year: =========================================================== In addition, we had a little problem with fragment_size and Framed-MTU in eap_tls.c. Somehow the EAP headers were forgotten in the calculation, such that EAP packets 10 bytes too large were furnished. We are also testing this with MS IAS, which takes the Frame-MTU very literally. In FreeRadius, fragment_size is by default set to 1024, which is nicely conservative. Setting it to higher values or using a lower MTU, though, shows that while some 4 bytes are subtracted (802.1x header ?), the actual EAP header (code, id, len, type, flags and TLS len) is not accounted for. This depends, of course, also on the meaning of fragment_size: It seems to implemented as just the TLS fragment size, such that the calculation from Framed-MTU to fragment_size (or ssn->offset) should also subtract these 10 bytes of the full EAP header. Actually, the fixed subtract of 4 bytes should also look at Framed-Protocol, since PPP uses max. 8 bytes overhead (header = 4, FCS and flag bytes = 2+1+1, sum: 8). Having looked at some definitions and implementations, I'm currently quite confused about this MTU vs MRU issue. Perhaps it would have been better to have a Framed-MRU instead of a -MTU, and have the NAS figure out how much packet space he can give to EAP-TLS/TTLS/PEAP. At some point, it's > difficult for an application to know what MTU to use, because it > doesn't now what protocol is being used to encapsulate it. > After my 'excursion' in what-the-heck-is-the-right-MTU land, I'm just more confused. After glancing through the relevant RFCs, I have the impression that Framed-MTU is not the MTU of the encaps. RADIUS reply, but the overall MTU to be used by the NAS. Which, as you agree, does not make much sense... =============================================================== ... which would mean that fragment_size needs to be adjusted depending on what Framed-Protocol is in use... (any other than EAPOW and PPP?) It's probably better to just reduce it by some "safety" value, to be on the right side, like another 10 bytes or so. Why PPP? My scenario is high-security VPN a la Microsoft, using PPP with EAPTLS over L2TP over IPSec. The intention is to have at least the server side also running free software, using RADIUS for authentication and rp-l2tpd with pppd as NAS. In the mean time, using EAPTLS patches for client PPP, we also have an experimental client using smartcard authentication for Linux. Michael PS: The next days I'm updating the X509 extensions I also created, will make an announcement for discussion to catch some ideas I've seen popping up in this list the last year. Regards, Michael

1 0

Re: Appending attributes post proxy
by Peter Nixon 12 Aug '06

12 Aug '06

On Fri 11 Aug 2006 19:41, Alan DeKok wrote: > Peter Nixon <listuser(a)peternixon.net> wrote: > > We are already using "preproxy_users" to > > modify packets before we send them to downstream servers but I don't see > > any "postproxy_users" file :-( > > It's in the CVS head, for 2.0. OK Great. > > Whats the easiest way to do this? The rewrite module? Is there any reason > > (other than inertia) why isn't there a "postproxy_users" file? > > Nope. > > The rlm_files module got massively re-written in the CVS head, so > that it can be used in any section. The code ended up being smaller > andmore flexible... Alan, can you give us an idea of you roadmap for radius releases? I get a bit confused as to what code should be going where (esp sqlippool which is not exactly documented yet :-) I assume there will be a 1.1.3 release at some point "real soon now". After that do you plan on switching work to cvs head? -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

2 3