Hello,
I have configured *EAP-AKA virtual-server in FreeRADIUS to
perform authentication. I have enabled eap cache so that fast reauth will
work and
session data will be stored in cache. However during store session i could
not restore Counter and hence reauth fails.
Logs are:
Debug : (0.0) h9-auth-server - store session {
Debug : (0.0) h9-auth-server - | debug_attr
INFO : (0.0) h9-auth-server - Attributes matching "&session-state"
INFO : (0.0) h9-auth-server - &session-State.session-State = {
INFO : (0.0) h9-auth-server - Permanent-Identity =
10026000000000(a)wlan.mnc11343.mcc0.3gppnetwork.org
INFO : (0.0) h9-auth-server - SIM-Ki =
0x465b5ce8b199b49faa5f0a2ee238a6bc
INFO : (0.0) h9-auth-server - SIM-OPc =
0xcd63cb71954a9f4e48a5994e37a02baf
INFO : (0.0) h9-auth-server - SIM-SQN = 528
INFO : (0.0) h9-auth-server - Identity =
27CL9C1yARfBU1l(a)wlan.mnc11343.mcc0.3gppnetwork.org
INFO : (0.0) h9-auth-server - Session-Data =
0xd9407284e28f09c788dd047dbd2350adcf91a5ef
INFO : (0.0) h9-auth-server - Counter = 0
>>>>>>>>>>>>>>>>> Counter is available here....>>>>>>
INFO : (0.0) h9-auth-server - }
Debug : (0.0) h9-auth-server - | eap-aka-sim.Session-ID
Debug : (0.0) h9-auth-server - | %{eap-aka-sim.Session-ID}
Debug : (0.0) h9-auth-server - | -->
0x34374631353345367a547775664157
Debug : (0.0) eap_aka_cache - No cache entry found for
"47F153E6zTwufAW"
Debug : (0.0) eap_aka_cache - Creating new cache entry
Debug : (0.0) eap_aka_cache - &session-State.Session-Data :=
&session-State.Session-Data -> 0xd9407284e28f09c788dd047dbd2350adcf91a5ef
Debug : (0.0) eap_aka_cache - EXPAND
%{session-state.Permanent-Identity}
Debug : (0.0) eap_aka_cache - | session-state.Permanent-Identity
Debug : (0.0) eap_aka_cache - |
%{session-state.Permanent-Identity}
Debug : (0.0) eap_aka_cache - | -->
10026000000000(a)wlan.mnc11343.mcc0.3gppnetwork.org
Debug : (0.0) eap_aka_cache - -->
10026000000000(a)wlan.mnc11343.mcc0.3gppnetwork.org
Debug : (0.0) eap_aka_cache - &session-State.Permanent-Identity :=
"10026000000000(a)wlan.mnc11343.mcc0.3gppnetwork.org"
Debug : (0.0) eap_aka_cache - EXPAND
%{session-state.Encr-Data.Counter}
Debug : (0.0) eap_aka_cache - | session-state.Encr-Data.Counter
Debug : (0.0) eap_aka_cache - |
%{session-state.Encr-Data.Counter}
Debug : (0.0) eap_aka_cache - (null)
Debug : (0.0) eap_aka_cache - -->
Debug : (0.0) eap_aka_cache - Skipping
%{session-state.Encr-Data.Counter}
Debug : (0.0) eap_aka_cache - Committed entry, TTL 150 seconds
Debug : (0.0) h9-auth-server - eap_aka_cache (updated)
Session is stored in eap cache however it could not store Counter as its
value is nil in Encr-Data and direct access to Counter in session-state is
failing.
During Reauth request , it could fetch the session from the cache but as
Counter is not there, fast reauth is failing...
Debug : (2.0) h9-auth-server - New EAP-AKA session
Debug : (2.0) h9-auth-server - Changed state INIT -> REAUTHENTICATION
Debug : (2.0) h9-auth-server - load session {
Debug : (2.0) h9-auth-server - | eap-aka-sim.Session-ID
Debug : (2.0) h9-auth-server - | %{eap-aka-sim.Session-ID}
Debug : (2.0) h9-auth-server - | -->
0x34374631353345367a547775664157
Debug : (2.0) eap_aka_cache - Found entry for "47F153E6zTwufAW"
Debug : (2.0) eap_aka_cache - Merging cache entry into request
Debug : (2.0) eap_aka_cache - &session-State.Session-Data :=
0xd9407284e28f09c788dd047dbd2350adcf91a5ef
Debug : (2.0) eap_aka_cache - &session-State.Permanent-Identity :=
'10026000000000(a)wlan.mnc11343.mcc0.3gppnetwork.org'
Debug : (2.0) h9-auth-server - eap_aka_cache (updated)
Debug : (2.0) h9-auth-server - ok (ok)
Debug : (2.0) h9-auth-server - | debug_attr
INFO : (2.0) h9-auth-server - Attributes matching "&session-state"
INFO : (2.0) h9-auth-server - &session-State.session-State = {
INFO : (2.0) h9-auth-server - Session-Data =
0xd9407284e28f09c788dd047dbd2350adcf91a5ef
INFO : (2.0) h9-auth-server - Permanent-Identity =
10026000000000(a)wlan.mnc11343.mcc0.3gppnetwork.org
INFO : (2.0) h9-auth-server - }
Debug : (2.0) h9-auth-server - | %debug_attr({&session-state})
Debug : (2.0) h9-auth-server - } # send Reauthentication-Request (ok)
Debug : (2.0) h9-auth-server - Generating new session keys
Debug : (2.0) h9-auth-server - No &session-state.Counter attribute
found, can't calculate re-auth keys
Debug : (2.0) h9-auth-server - Composing EAP-Request/Reauthentication
failed. Clearing reply attributes and requesting additional Identity
Debug : (2.0) h9-auth-server - Changed state REAUTHENTICATION ->
AKA-IDENTITY
Debug : (2.0) h9-auth-server - send Identity-Request {
Store session setting in virtual server:
store session {
"%(debug_attr:&session-state)"
eap_aka_cache
"%(debug_attr:&session-state)"
ok
}
Currently my eap_cache is
cache eap_aka_cache {
#
# key:: Cache key.
#
key = "%{eap-aka-sim.Session-ID}"
#
# ttl:: TTL for cache entries.
#
ttl = 150
#
# update <section> { ... }::
#
update session-state {
&session-state.Session-Data :=
&session-state.Session-Data
&Permanent-Identity := "%{session-state.Permanent-Identity}"
&Encr-Data.Counter :=
"%{session-state.Encr-Data.Counter}"
}
}
If i add accessing Counter, it fails as follows:
&session-state.Counter := &session-state.Counter
Debug : Compiling policies in - store session {...}
Error : /usr/local/etc/raddb/mods-enabled/eap-cache[22]: Failed parsing
attribute reference &session-state.Counter - Unresolved attributes are not
allowed here
Error : /usr/local/etc/raddb/mods-enabled/eap-cache[22]:
&session-state.Counter
Error : /usr/local/etc/raddb/mods-enabled/eap-cache[22]: ^
Error : /usr/local/etc/raddb/mods-enabled/eap-cache[22]: Failed creating
map from '&session-state.Counter = &session-state.Counter'
Error : /usr/local/etc/raddb/mods-enabled/eap-cache[1]: Failed parsing
configuration section update
Error : /usr/local/etc/raddb/sites-enabled/h9-auth-server[1006]: Invalid
keyword "eap_aka_cache".
Am i missing any configuration? Can anyone help?
Summary of my setup:
* FreeRadius version4 - Configured, compiled and installed from
master Branch synced on 10th May 2024.
* wpa_supplicant version 2.10
* Ubuntu 20.04 LTS
Thanks,
Deepika
