March 2014 - Freeradius-Users - lists.freeradius.org

What will be new in v3.0.3
by Alan DeKok 01 Apr '14

01 Apr '14

It's been a busy week. In addition to releasing new documentation (http://networkradius.com/doc/) we've been adding more functionality to the server core. As of now, pretty much all of "unlang" is syntax checked when the server starts. This means that errors in conditional checks will be caught: if ("%{no-such-module:foo}" == "bar") { will now cause the server to print a descriptive error, and fail to start. The same applies for update statements: update reply { Filter-Id := "%{no-such-module:foo}" } And switch statements: switch "%{no-such-module:foo}" { and case statements: case "%{no-such-module:foo}" As a side note, "case" statements now support dynamic expansions, which they didn't before. Both "switch" and "case" statements support attribute references: switch &User-Name { case &Filter-Id { ... Will match if User-Name == Filter-Id. This capability gives a bit more flexibility in the use of "switch" and "case". These are small changes. But they should have a large impact on usability. When there's a typo in the configuration, the server will produce a MUCH better error message than it did for version 3.0.2. Alan DeKok.

3 3

PEAP and MAC-auth checking with SQL
by Christopher Kuhn 31 Mar '14

31 Mar '14

Hello, I'm currently running a FreeRADIUS server which is working just fine authenticating users with PEAP-MSCHAP. I now need to add some functionality which basically amounts to mac authentication. However, due to the way our switch stacks handle it, all requests still come in as some kind of EAP request which includes a username. Requests will be one of two things. Either: 1) Our current, real authentication scheme where we want to use PEAP-MSCHAP for 'DOMAIN\user' (or 'user@domain'). These users need to go through the whole AAA process.OR2) A request where User-Name = Calling-Station-Id; the switch sends an EAP request with the supplicant's MAC as the username. As long as the MAC is on my whitelist, it can be approved. In either case, I need to check the Calling-Station-Id against a whitelist. If it isn't on the list, it is rejected. If it is there, it either continues through the PEAP-MSCHAP authentication (request type 1), or is approved more-or-less immediately (request type 2). Although I realize the authed_macs function can already do this, I have been told to use SQL for both scalability and to use features like user-group mapping (so we have more information in the accounting database). Here are my problems/questions:1) Can I use the SQL module to check an attribute (e.g., Calling-Station-Id) irrespective of User-Name during Authorization and still have the User-Name logged during Accounting? If so, can you point me at any particular configuration sections, modules, or attributes I should be working with? 2) Is it appropriate to create different realms for the two different cases? If so, will a virtual server in the realm for my PEAP-MSCHAP still be able to hand off the inner PEAP processing to inner-tunnel virtual server? I only ask the second question because the proxy.conf warns that requests proxied to an internal virtual server may not then be proxied to any other internal or external server. Thank you,Chris

2 1

Re: radius_xlat chops embedded NULs in cisco-av-pair
by Kiril 31 Mar '14

31 Mar '14

> For 2.x.x I agree the best fix is just to get fr_prints_value to do the escaping. so as I thought, too. as it this was done in 1.x I can handle this issue in our current freeradius version myself and don't wait for the bug fix. while you are fixing it in the official source

2 1

Re: radius_xlat chops embedded NULs in cisco-av-pair
by Kiril 31 Mar '14

31 Mar '14

> I'll take a look and see if it's fixed in later versions. It'll almost certainly work fine in 3.0.2. I looked into the current git v3 master sources - the main thing remais the same in vp_prints_value: print.c, line 258 > /* xlat.c - need to copy raw value verbatim */ > else if (quote < 0) { > return strlcpy(out, vp->vp_strvalue, outlen); in other cases fr_print_string is used and our company is not ready to move on freeradius v3, so we need a solution on v2 branch

3 3

Valid Characters in User-Name & Password
by Ryan De Kock 31 Mar '14

31 Mar '14

Hi, Sorry if this is a dumb question but I couldn't find anything on google. Is there a list of valid characters that can be in the username & password feild of the access-request and account-start packets? for example, is a space (" ") valid in the username, #,&,^,etc. Where can I find this kind of info? Thanks!

2 1

Re: EAP session didn't finish
by Kiril 31 Mar '14

31 Mar '14

for some strange reason the topic http://freeradius.1045715.n5.nabble.com/EAP-session-didn-t-finish-td5723981… is not continued > >> ssl certs are generated during freeradius install, so the problem >> can't be in ssl >> who can tell in which case this message is shown? > > Ensure the CA for the server cert is trusted on the client. thx, but it is already trusted we have successful auths, too but sometimes it fails performing some other tests we can see that sometimes the AP is sending dissociating frame during the handshake between the device(pc, laptop, mobile, etc) and the AP. so the conversation fails

1 0

Re: EAP session didn't finish
by Kiril 31 Mar '14

31 Mar '14

> > Ensure the CA for the server cert is trusted on the client. thx, but it is already trusted we have successful auths, too but sometimes it fails performing some other tests we can see that sometimes the AP is sending dissociating frame during the handshake between the device(pc, laptop, mobile, etc) and the AP. so the conversation fails

1 0

Re: radius_xlat chops embedded NULs in cisco-av-pair
by Kiril 31 Mar '14

31 Mar '14

> No, it doesn't. > > If you look at the calls to fr_print_string, you'd see quote < 0 > is only passed in two places, valuepair.c:85 and valuepair.c:114, > both in the radius_compare_vps function, where the output is > passed to the regular expression comparison functions. > > Arguably if were doing comparisons on the raw attribute it should > be a memcpy, especially as regcomp appears to take the length > of the input string so it can probably deal with embedded NULLs > > But, this isn't related to your issue, if you read the concat > code in 3.x.x xlat.c:1911 it's calling vp_aprint, which at > the moment just does a talloc_strdup, which is as bad as > strlcpy. > > After i've fixed that, and written a regression test for 3.x.x I will > take a look at 2.x.x. thx

1 0

Re: radius_xlat chops embedded NULs in cisco-av-pair
by Kiril 31 Mar '14

31 Mar '14

> The string (RFC type 'text') should be escaped before being added to the concatenation buffer. I'll take a look and see if it's fixed in later versions. maybe the entire attribute value data is copied but when sql_escape_func from rlm_sql module is called it stops on the first NUL byte in it, so maybe the escaping fails?

2 1

radius_xlat chops embedded NULs in cisco-av-pair
by Kiril 31 Mar '14

31 Mar '14

Hi, there is a problem under freeradius 2.1.12 when incoming radius packet has embedded NUL bytes in the middle of the string attribute cisco-av-pair in debug packet output it is printed as Cisco-AVPair = "release-source=\000\000\000\002" but when we use %{Cisco-AVPair[*]} in sql accounting query it is expanded as "release-source=" in previous version 1.x the bahaviour was different - xlat-ed string in query was shown as in debug output according to RFC 2869 section 5 it is said: "Servers and servers and clients MUST be able to deal with embedded nulls. RADIUS implementers using C are cautioned not to use strcpy() when handling strings." and radius_xlat function uses strlcpy(out, vp->vp_strvalue, outlen) in vp_prints_value, so not the full string vp->vp_strvalue is copied what should be done in this case: fix the radius source, or fix the NAS?

2 2