- Freeradius-Devel - lists.freeradius.org

TinyPEAP
by Frank Cusack 07 Jun '05

07 Jun '05

I was going to post the following on the linksys tinypeap forum. Comments? And/or we could submit a slashdot story. ==== Please don't use TinyPEAP. The authors have stolen code from the FreeRADIUS project (not the legal definition of "steal" since code isn't physical property, but theft all the same). TinyPEAP uses TLS (and possibly other) code from FreeRADIUS. FreeRADIUS is licensed under the GPL. That means if you take FreeRADIUS code and redistribute it, you must also distribute your modifications to the code. Or if you incorporate FreeRADIUS code into your own, you've "infected" your own code and must distribute the source. Many FreeRADIUS developers have worked hard to create the EAP functionality. Please don't step on their rights by using TinyPEAP. The TinyPEAP developers were contacted but did not respond. Next will be legal action. Frank Cusack FreeRADIUS developer ====

3 2

RE: PAP failure
by Batta, Anurag 07 Jun '05

07 Jun '05

I have been running it in debug mode. I don't think it's the module itself. Here is what I see: Ready to process requests. rad_recv: Access-Request packet from host X.Y.73.124:32769, id=77, length=56 User-Name = "test" User-Password = "test" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall: group authorize returns noop for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 -----Original Message----- From: freeradius-devel-bounces(a)lists.freeradius.org [mailto:freeradius-devel-bounces@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Tuesday, June 07, 2005 12:55 PM To: FreeRadius developers mailing list Subject: Re: PAP failure "Batta, Anurag" <Anurag_Batta(a)usr.com> wrote: > Did anyone experience this while testing? I loaded PAP module and put > a user and pwd in config file. I get access reject in reply to radtest. Run the server in debugging mode to see why. If it's a problem in the PAP module, instrument the code to see what it's doing, and why. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html This e-mail may contain confidential or privileged information. If you think you have received this e-mail in error, please advise the sender by reply e-mail and then delete this e-mail immediately. Thank you. U. S. Robotics

2 1

crash of freeradius 1.0.2
by Schweizer Laurent 07 Jun '05

07 Jun '05

Hello, i use freeradius 1.0.2 with the jradius module and i have many crashes. Loaded symbols for /usr/local/lib/rlm_eap_mschapv2-1.0.2.so #0 0x40242ef1 in kill () from /lib/libc.so.6 (gdb) bt #0 0x40242ef1 in kill () from /lib/libc.so.6 #1 0x40081bb1 in pthread_kill () from /lib/libpthread.so.0 #2 0x40081f2b in raise () from /lib/libpthread.so.0 #3 0x40242b24 in raise () from /lib/libc.so.6 #4 0x402443fd in abort () from /lib/libc.so.6 #5 0x0804f5d2 in rad_assert_fail (file=0x806105f "request_list.c", line=470) at util.c:331 #6 0x08059c4f in rl_delete (request=0x815c3b8) at request_list.c:491 #7 0x0805a502 in refresh_request (request=0x815c3b8, data=0xbfffec40) at request_list.c:1048 #8 0x0805aaff in rl_clean_list (now=0) at request_list.c:1398 #9 0x0804d141 in main (argc=1, argv=0x0) at radiusd.c:1492 #0 0x40242ef1 in kill () from /lib/libc.so.6 (gdb) bt #0 0x40242ef1 in kill () from /lib/libc.so.6 #1 0x40081bb1 in pthread_kill () from /lib/libpthread.so.0 #2 0x40081f2b in raise () from /lib/libpthread.so.0 #3 0x40242b24 in raise () from /lib/libc.so.6 #4 0x402443fd in abort () from /lib/libc.so.6 #5 0x0804f5d2 in rad_assert_fail (file=0x806105f "request_list.c", line=1000) at util.c:331 #6 0x0805a489 in refresh_request (request=0x815b8a0, data=0xbfffec40) at request_list.c:1000 #7 0x0805a33e in rl_walk (walker=0x805a460 <refresh_request>, data=0xbfffec40) at request_list.c:895 #8 0x0805a96c in rl_clean_list (now=0) at request_list.c:1425 #9 0x0804d141 in main (argc=1, argv=0x0) at radiusd.c:1492 #0 0x40242ef1 in kill () from /lib/libc.so.6 (gdb) bt #0 0x40242ef1 in kill () from /lib/libc.so.6 #1 0x40081bb1 in pthread_kill () from /lib/libpthread.so.0 #2 0x40081f2b in raise () from /lib/libpthread.so.0 #3 0x40242b24 in raise () from /lib/libc.so.6 #4 0x402443fd in abort () from /lib/libc.so.6 #5 0x0804f5d2 in rad_assert_fail (file=0x806105f "request_list.c", line=1000) at util.c:331 #6 0x0805a489 in refresh_request (request=0x815a678, data=0xbfffec40) at request_list.c:1000 #7 0x0805a33e in rl_walk (walker=0x805a460 <refresh_request>, data=0xbfffec40) at request_list.c:895 #8 0x0805a96c in rl_clean_list (now=0) at request_list.c:1425 #9 0x0804d141 in main (argc=1, argv=0x0) at radiusd.c:1492 #0 0x40242ef1 in kill () from /lib/libc.so.6 #1 0x40081bb1 in pthread_kill () from /lib/libpthread.so.0 #2 0x40081f2b in raise () from /lib/libpthread.so.0 #3 0x40242b24 in raise () from /lib/libc.so.6 #4 0x402443fd in abort () from /lib/libc.so.6 #5 0x0804f5d2 in rad_assert_fail (file=0x806105f "request_list.c", line=1000) at util.c:331 #6 0x0805a489 in refresh_request (request=0x815b570, data=0xbfffec40) at request_list.c:1000 #7 0x0805a33e in rl_walk (walker=0x805a460 <refresh_request>, data=0xbfffec40) at request_list.c:895 #8 0x0805a96c in rl_clean_list (now=0) at request_list.c:1425 #9 0x0804d141 in main (argc=1, argv=0x0) at radiusd.c:1492 (gdb) #5 0x0804f5d2 in rad_assert_fail (file=0x806105f "request_list.c", line=470) at util.c:331 #6 0x08059c4f in rl_delete (request=0x815c3b8) at request_list.c:491 #7 0x0805a502 in refresh_request (request=0x815c3b8, data=0xbfffec40) at request_list.c:1048 #8 0x0805aaff in rl_clean_list (now=0) at request_list.c:1398 #9 0x0804d141 in main (argc=1, argv=0x0) at radiusd.c:1492

2 3

PAP failure
by Batta, Anurag 07 Jun '05

07 Jun '05

Did anyone experience this while testing? I loaded PAP module and put a user and pwd in config file. I get access reject in reply to radtest. Could not find any thread that explains it. Thanks, Anurag. This e-mail may contain confidential or privileged information. If you think you have received this e-mail in error, please advise the sender by reply e-mail and then delete this e-mail immediately. Thank you. U. S. Robotics

2 1

Re: rlm_python bug
by Valts Mazurs 07 Jun '05

07 Jun '05

Vladimir Yu. Stepanov wrote: > Can you try setup from ports collection of libltdl15 > (/usr/ports/devel/libltdl15) and add some options in configure script > for freeradius: > --with-ltdl-include="/usr/local/include" \ > --with-ltdl-lib="/usr/local/lib" \ It was not helpful. Crashed with core dump when I called "killall radiusd". gdb bt output: (gdb) bt #0 0x280f6b0b in PyType_IsSubtype () from /usr/local/lib/libpython2.4.so #1 0x2812d800 in PyImport_Cleanup () from /usr/local/lib/libpython2.4.so #2 0x2813651c in Py_Finalize () from /usr/local/lib/libpython2.4.so #3 0x0805b160 in free_mainconfig () #4 0x08054968 in detach_modules () #5 0x0804e135 in main () > --with-threads \ enabled by default imho. > --with-experimental-modules \ It is not neccessary. I use --with-static-modules=python > --enable-developer With --enable-developer freeradius server crashes with core dump when received first request. gdb bt output: (gdb) bt #0 0x28668e2c in rad_mangle (data=0x816aec0, request=0x8091f00) at rlm_preprocess.c:186 #1 0x2866922f in preprocess_authorize (instance=0x816aec0, request=0x8091f00) at rlm_preprocess.c:497 #2 0x08055ac2 in modcall (component=1, c=0x816ae00, request=0x8091f00) at modcall.c:219 #3 0x08055cbf in modcall (component=1, c=0x816af80, request=0x8091f00) at modcall.c:252 #4 0x080550fc in indexed_modcall (comp=1, idx=134815488, request=0x8091f00) at modules.c:469 #5 0x080527c7 in rad_authenticate (request=0x8091f00) at auth.c:578 #6 0x0804ca26 in rad_respond (request=0x8091f00, fun=0x8052738 <rad_authenticate>) at radiusd.c:1672 #7 0x0804e0b4 in main (argc=2, argv=0xbfbfe828) at radiusd.c:1457 NOTE that all these bugs appear only if python module is enabled in configuration files. > > First two options may be help to fix this bug :) > >> >> My environment: >> FreeBSD 5.3-RELEASE >> freeradius-1.0.2 >> ./configure --with-static-modules=python && make && make install >> gcc version 3.4.2 [FreeBSD] 20040728 >> Python 2.4.1 >> GNU gdb 6.1.1 [FreeBSD] >> >> Valts.

2 2

crash of freeradius 1.0.2
by Schweizer Laurent 06 Jun '05

06 Jun '05

Hello, i use freeradius with the jradius module and i have many crashes. Loaded symbols for /usr/local/lib/rlm_eap_mschapv2-1.0.2.so #0 0x40242ef1 in kill () from /lib/libc.so.6 (gdb) bt #0 0x40242ef1 in kill () from /lib/libc.so.6 #1 0x40081bb1 in pthread_kill () from /lib/libpthread.so.0 #2 0x40081f2b in raise () from /lib/libpthread.so.0 #3 0x40242b24 in raise () from /lib/libc.so.6 #4 0x402443fd in abort () from /lib/libc.so.6 #5 0x0804f5d2 in rad_assert_fail (file=0x806105f "request_list.c", line=470) at util.c:331 #6 0x08059c4f in rl_delete (request=0x815c3b8) at request_list.c:491 #7 0x0805a502 in refresh_request (request=0x815c3b8, data=0xbfffec40) at request_list.c:1048 #8 0x0805aaff in rl_clean_list (now=0) at request_list.c:1398 #9 0x0804d141 in main (argc=1, argv=0x0) at radiusd.c:1492 #0 0x40242ef1 in kill () from /lib/libc.so.6 (gdb) bt #0 0x40242ef1 in kill () from /lib/libc.so.6 #1 0x40081bb1 in pthread_kill () from /lib/libpthread.so.0 #2 0x40081f2b in raise () from /lib/libpthread.so.0 #3 0x40242b24 in raise () from /lib/libc.so.6 #4 0x402443fd in abort () from /lib/libc.so.6 #5 0x0804f5d2 in rad_assert_fail (file=0x806105f "request_list.c", line=1000) at util.c:331 #6 0x0805a489 in refresh_request (request=0x815b8a0, data=0xbfffec40) at request_list.c:1000 #7 0x0805a33e in rl_walk (walker=0x805a460 <refresh_request>, data=0xbfffec40) at request_list.c:895 #8 0x0805a96c in rl_clean_list (now=0) at request_list.c:1425 #9 0x0804d141 in main (argc=1, argv=0x0) at radiusd.c:1492 #0 0x40242ef1 in kill () from /lib/libc.so.6 (gdb) bt #0 0x40242ef1 in kill () from /lib/libc.so.6 #1 0x40081bb1 in pthread_kill () from /lib/libpthread.so.0 #2 0x40081f2b in raise () from /lib/libpthread.so.0 #3 0x40242b24 in raise () from /lib/libc.so.6 #4 0x402443fd in abort () from /lib/libc.so.6 #5 0x0804f5d2 in rad_assert_fail (file=0x806105f "request_list.c", line=1000) at util.c:331 #6 0x0805a489 in refresh_request (request=0x815a678, data=0xbfffec40) at request_list.c:1000 #7 0x0805a33e in rl_walk (walker=0x805a460 <refresh_request>, data=0xbfffec40) at request_list.c:895 #8 0x0805a96c in rl_clean_list (now=0) at request_list.c:1425 #9 0x0804d141 in main (argc=1, argv=0x0) at radiusd.c:1492 #0 0x40242ef1 in kill () from /lib/libc.so.6 #1 0x40081bb1 in pthread_kill () from /lib/libpthread.so.0 #2 0x40081f2b in raise () from /lib/libpthread.so.0 #3 0x40242b24 in raise () from /lib/libc.so.6 #4 0x402443fd in abort () from /lib/libc.so.6 #5 0x0804f5d2 in rad_assert_fail (file=0x806105f "request_list.c", line=1000) at util.c:331 #6 0x0805a489 in refresh_request (request=0x815b570, data=0xbfffec40) at request_list.c:1000 #7 0x0805a33e in rl_walk (walker=0x805a460 <refresh_request>, data=0xbfffec40) at request_list.c:895 #8 0x0805a96c in rl_clean_list (now=0) at request_list.c:1425 #9 0x0804d141 in main (argc=1, argv=0x0) at radiusd.c:1492 (gdb) #5 0x0804f5d2 in rad_assert_fail (file=0x806105f "request_list.c", line=470) at util.c:331 #6 0x08059c4f in rl_delete (request=0x815c3b8) at request_list.c:491 #7 0x0805a502 in refresh_request (request=0x815c3b8, data=0xbfffec40) at request_list.c:1048 #8 0x0805aaff in rl_clean_list (now=0) at request_list.c:1398 #9 0x0804d141 in main (argc=1, argv=0x0) at radiusd.c:1492

1 0

Copyright and GPL infringement in tinyPEAP
by Alan DeKok 05 Jun '05

05 Jun '05

Your web site http:/www.tinypeap.com is distributing binaries built at least in part from code that is derived from the FreeRADIUS server project (http://www.freeradius.org) I refer you to the following URL's: http://www.linksysinfo.org/modules.php?name=Forums&file=viewtopic&t=5649 This message contains text with error messages "rlm_eap_tls: SSL_read failed inside of TLS ". The "rlm_eap_tls" module is part of FreeRADIUS, and it is beyond reason to believe that you have independently chosen a name for an internal portion of the server that is identical to that used by FreeRADIUS. http://www.linksysinfo.org/modules.php?name=Forums&file=viewtopic&t=4533 This message contains text by you which claims that tinyPEAP is "closed source". http://www.tinypeap.com/bin/peapd-beta1.zip This URL points to a file which contains "peapd.exe". That file contains at least the following text strings, which are either identical to strings included with FreeRADIUS, or substantially similar: -- rlm_eap_tls: FATAL SSL error ..... %d rlm_eap_tls: %s failed inside of TLS (%d), TLS session fails. rlm_eap_tls: %s failed in a system call (%d), TLS session fails. handshake_send rlm_eap_tls: Application Data In SSL Connect mode In SSL Accept mode Before SSL Handshake Phase In SSL Handshake Phase SSL Connection Established SSL_read rlm_eap_tls: Requiring client certificate rlm_eap_tls: Error creating new SSL -- Once again, it is beyond reason that you have independently come up with an implementation that is identical to that chosen by FreeRADIUS. I will be investigating this matter further, and may contact you with additional details about this matter. Nothing under copyright law gives you permission to use our copyrighted code without our permission. The only license terms available for the code in question is the GNU GPL, which is distributed with the FreeRADIUS server source. The terms of that license require you to make the source code for derived works available under the same terms as the the original code. I refer you to section 2 (b): --- b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License. --- To that end, we offer you one of the following two choices: 1) Remove any infringing binaries from your website, until such time as you remove the infringing code from your product. This removal may be done by re-writing the code in question. A simple edit of the text strings will not suffice, as our copyright applies to the binaries produced from the C source code, in addition to the text strings. 2) Release all relevant code under the terms of the GPL license, as required by the terms of the FreeRADIUS server license. We look forward to seeing your response in this matter. Alan DeKok. Project Leader, The FreeRADIUS Server Project

1 0

Anyone have a Linksys WRT54G?
by Alan T. DeKok 05 Jun '05

05 Jun '05

From: http://www.linksysinfo.org/modules.php?name=Forums&file=viewtopic&t=5649 ... TLS Alert write:fatal:protocol version TLS_accept:error in SSLv3 read client certificate A rlm_eap_tls: SSL_read failed inside of TLS (-1), TLS session fails. ... Hmm... and in another post: http://www.linksysinfo.org/modules.php?name=Forums&file=viewtopic&t=4533 ... Unfortunately, tinyPEAP will remain closed source. We will making an announcement when there will be any changes in our licencing policy. I think I'll investigate this further. Alan DeKok.

3 3

1.0.3 and sasl (rlm_ldap)
by Wolfgang Rosenauer 04 Jun '05

04 Jun '05

Hi, "make install" with the released 1.0.3 doesn't work: Making install in main... gmake[4]: Entering directory `/usr/src/packages/BUILD/freeradius-1.0.3/src/main' /usr/src/packages/BUILD/freeradius-1.0.3/libtool --mode=install /usr/src/packages/BUILD/freeradius-1.0.3/install-sh -c -m 755 -s radiusd /var/tmp/freeradius-1.0.3-build/usr/sbin libtool: install: warning: `/usr/src/packages/BUILD/freeradius-1.0.3/src/lib/libradius.la' has not been installed in `/usr/lib/freeradius' /usr/src/packages/BUILD/freeradius-1.0.3/install-sh -c -m 755 -s .libs/radiusd /var/tmp/freeradius-1.0.3-build/usr/sbin/radiusd /usr/src/packages/BUILD/freeradius-1.0.3/install-sh -c -m 755 -s radwho /var/tmp/freeradius-1.0.3-build/usr/bin strip: /var/tmp/freeradius-1.0.3-build/usr/bin/#inst.1130#: File format not recognized gmake[4]: *** [install] Error 1 -> http://bugs.freeradius.org/show_bug.cgi?id=240 One other thing from the subject: Why does configure of rlm_ldap check for sasl? I see no sasl function used in the code. If it isn't needed the configure check should be removed. CU, Wolfgang -- SUSE LINUX GmbH -o) Tel: +49-(0)911-740 53 0 Maxfeldstr. 5 /\\ Fax: +49-(0)911-740 53 679 90409 Nuernberg, Germany _\_v simply change to www.suse.com

3 2

Bug in TTLS
by fabien.marotte＠freesurf.fr 03 Jun '05

03 Jun '05

Hi, I found an other minor bug in ttls implementation In configuration where Freeradius proxyies tunneled ttls message to a home server Radius, FreeRadius doesn't send good message after having received Access-Reject/EAP-Failure from radius home server. Indeed, FreeRadius sends to the NAS an Access-Reject but doesn't include EAP/Failure attribute. This is the same case if an unknown Radius message is received from the radius home server. So the peer isn't informed of this decision and retransmits his last request after its watchdog wakes up. Here are the modifications I done on my server to correct the bug. ttls.c v1.20 process_reply function : l712 : I replaced "rcode=RLM_MODULE_REJECT" by "rcode=RLM_MODULE_INVALID" --> Invalid message and Rejected Message wasn't differentiated eap_ttls_postproxy function : l819 : replace "return 0" by "break" --> So eaptls_fail of l839 can be called to add EAP/FAILURE message in case of RLM_MODULE_REJECT rlm_eap.c v1.30 eap_post_proxy function : l547 : I moved "rcode = eap_compose(handler)" to l538 and I removed "rcode =" --> With this modification eap_compose is called whatever the return code and the eap attribute can be inserted even if the message is rejected Fabien Marotte

3 6