- Freeradius-Users - lists.freeradius.org

DHCP server crashed when receiving unknown option in Request
by Chinnapaiyan, Nagamani 02 Jul '20

02 Jul '20

Hi, We encountered a radiusd crash, when it received unknown option-145 in the Request packet(which is not defined in dictionary). Expected behavior is to ignore any unknown options and continue processing the packet. Also please ensure(from code) radiusd is not crashing if the some known options are malformed in an incoming packet. Expected behavior is to ignore the packet and continue running. Debug output: (seems crash is related to perl module) (1470) Tue Jun 30 06:21:11 2020 : Debug : DHCP-Opcode = Client-Message (1470) Tue Jun 30 06:21:11 2020 : Debug : DHCP-Hardware-Type = Ethernet (1470) Tue Jun 30 06:21:11 2020 : Debug : DHCP-Hardware-Address-Length = 6 (1470) Tue Jun 30 06:21:11 2020 : Debug : DHCP-Hop-Count = 0 (1470) Tue Jun 30 06:21:11 2020 : Debug : DHCP-Transaction-Id = 376356509 (1470) Tue Jun 30 06:21:11 2020 : Debug : DHCP-Number-of-Seconds = 65535 (1470) Tue Jun 30 06:21:11 2020 : Debug : DHCP-Flags = 0 ... ... (1470) Tue Jun 30 06:21:11 2020 : Debug : DHCP-Hostname = "HP26D9AC" (1470) Tue Jun 30 06:21:11 2020 : Debug : Attr-145 = 0x01 (1470) Tue Jun 30 06:21:11 2020 : Debug : DHCP-V-I-Vendor-Class = 0x0000000b024850 (1470) Tue Jun 30 06:21:11 2020 : Debug : DHCP-Parameter-Request-List = DHCP-Subnet-Mask (1470) Tue Jun 30 06:21:11 2020 : Debug : DHCP-Parameter-Request-List = DHCP-Classless-Static-Route (1470) Tue Jun 30 06:21:11 2020 : Debug : DHCP-Parameter-Request-List = DHCP-Static-Routes ... ... ... (1470) Tue Jun 30 06:21:11 2020 : Debug : perl - &request:DHCP-Parameter-Request-List += $RAD_REQUEST{'DHCP-Parameter-Requ est-List'} -> 'DHCP-Domain-Search' (1470) Tue Jun 30 06:21:11 2020 : Debug : perl - &request:DHCP-Parameter-Request-List += $RAD_REQUEST{'DHCP-Parameter-Requ est-List'} -> 'DHCP-Site-specific-28' (1470) Tue Jun 30 06:21:11 2020 : Debug : perl - &request:DHCP-DHCP-Maximum-Msg-Size = $RAD_REQUEST{'DHCP-DHCP-Maximum-Msg -Size'} -> '1500' (1470) Tue Jun 30 06:21:11 2020 : Debug : perl - &request:DHCP-Server-IP-Address = $RAD_REQUEST{'DHCP-Server-IP-Address'} -> '0.0.0.0' (1470) Tue Jun 30 06:21:11 2020 : Debug : perl - &request:DHCP-V-I-Vendor-Class = $RAD_REQUEST{'DHCP-V-I-Vendor-Class'} -> '' CONSISTENCY CHECK FAILED src/lib/util/pair.c[883]: VALUE_PAIR (raw/unknown) attribute 0x314a3a0 "Attr-145" data type incorrect. Expected octets, got <INVALID> ASSERT FAILED src/lib/util/pair.c[3050]: 0 CAUGHT SIGNAL: Aborted Backtrace of last 18 frames: /usr/lib64/freeradius/libfreeradius-util.so(fr_fault+0x1ae)[0x7f0aed10562e] /usr/lib64/freeradius/libfreeradius-util.so(+0x148f9)[0x7f0aed1058f9] /usr/lib64/freeradius/libfreeradius-util.so(fr_pair_verify+0x72d)[0x7f0aed11d60d] /usr/lib64/freeradius/libfreeradius-util.so(fr_pair_add+0x27)[0x7f0aed11daf7] /usr/lib64/freeradius/libfreeradius-util.so(fr_pair_make+0x148)[0x7f0aed11ea18] /usr/lib64/freeradius/rlm_perl.so(+0x3169)[0x7f0ae3cb8169] /usr/lib64/freeradius/rlm_perl.so(+0x33ec)[0x7f0ae3cb83ec] /usr/lib64/freeradius/rlm_perl.so(+0x56f4)[0x7f0ae3cba6f4] /usr/lib64/freeradius/libfreeradius-unlang.so(+0x118bc)[0x7f0aed58f8bc] /usr/lib64/freeradius/libfreeradius-unlang.so(unlang_interpret+0x378)[0x7f0aed58c508] /usr/lib64/freeradius/proto_dhcpv4_process.so(+0x156d)[0x7f0ae700e56d] /usr/lib64/freeradius/libfreeradius-io.so(+0x14a83)[0x7f0aed36da83] /usr/lib64/freeradius/libfreeradius-util.so(fr_event_service+0x23b)[0x7f0aed112bdb] /usr/lib64/freeradius/libfreeradius-util.so(fr_event_loop+0x20)[0x7f0aed112fa0] /usr/lib64/freeradius/libfreeradius-server.so(main_loop_start+0x4e)[0x7f0aed7e466e] /usr/sbin/radiusd(main+0xe14)[0x404b64] /lib64/libc.so.6(__libc_start_main+0xf5)[0x7f0aeb123555] /usr/sbin/radiusd[0x405021] No panic action set After we added 145 in the dictionary, it started processing the request packet successfully. Regards, Nagamani Chinnapaiyan

2 6

Help Unlang Freeradius 2.x to 3.x
by Olivier CALVANO 02 Jul '20

02 Jul '20

Hello, I get stuck a little to find the solution in unlang; =) I admit that I don't master at all. I have this condition which works under Freeradius 2.x: if ((Tunnel-Server-Endpoint: 0 [0]! = '192.168.1.1') && (User-Name = ~ /\\.local/) && (User-Name! ~ /network\\.local/) && ("% {Packet-Src-IP-Address}" == "172.16.100.100")) { I can't find the equivalent in Freeradius 3.0.17 I tried in particular if ((& Tunnel-Server-Endpoint! = '192.168.1.1') && (User-Name = ~ /\\.local/) && (User-Name! ~ /network\\.local/) && ("% { Packet-Src-IP-Address} "==" 172.16.100.100 ")) { but that blocks, it is always at the level of the first condition that there is the problem. What I would like is: Yes Tunnel-Server-Endpoint * (0 1 or other) is not equal to 192.168.1.1 Or Tunnel-Server-Endpoint * (0 1 or other) is not equal to 192.168.1.2 so he looks at the other conditions including User-Name and Packet-Src Otherwise, would I have to do several if ? sample: if ("%{Packet-Src-IP-Address}" == "172.16.100.100") { if ((User-Name =~ /\\.local/) && (User-Name !~ /network\\.local/)) { if (&Tunnel-Server-Endpoint* != '192.168.1.1') { xxxx } } } thank you for your help Olivier

2 3

Memory leak in FR 3.0.19 ?
by Arnaud LAURIOU 30 Jun '20

30 Jun '20

Hi, We are suspecting memory leak in FR 3.0.19 : process memory status show VmData always keep increasing leading to VmSwap use after a few days which also keep increasing. I have 2 questions : - What are the compile options to use valgrind ? only flag --enable-developper ?|| - In the changelog for version 3.0.20 : some memories problems seems to be solved, do you know when this version will be released ? (if the release date is close, we can wait to test this release rather than 3.0.19) Regards, Arnaud Lauriou

3 5

Plan assignment based on nas and ugroups
by Ganga R. Dhungyel 30 Jun '20

30 Jun '20

Hello Community I am running freeradius-3.0.13-10 with sql backend on centos to authenticate and authorize users based on group membership. Now a new requirement to assign vlan based on group AND nas has come up and I am not sure what is the best way to accomplish this. Need something like: If nas is xyz and user belong to group A, then reply with vlan id 10, else if nas is abc and user belongs to group A, reply with vlan 100, else reply with vlan 200. Is using huntgroup and groupcheck the best way to accomplish this? If so, what all need modifications. Example would be great. If not, what would be a better solution considering that I am using realm sql. My apologies if this has been answered before..browsed the list and really could not find the use case described. Thank you. -- Dhungyel

2 3

TLS 1.3
by Vieri 29 Jun '20

29 Jun '20

Unfortunately, I can't grab a packet trace just yet until I locate one of those devices (custom external firmware). I'll have a look at it asap. In the meantime, maybe setting cipher_list = "ALL" can be more permissive than "DEFAULT", but I'm guessing I won't have much luck because the most reasonable set that might be excluded is LOW, but "As of OpenSSL 1.0.2g, these are disabled in default builds". On the freeradius server I have: # openssl ciphers -s -tls1 ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:AES256-SHA:AES128-SHA # openssl ciphers -s -tls1_1 ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:AES256-SHA:AES128-SHA # openssl ciphers -s -tls1_2 ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA # openssl ciphers -s -tls1_3 TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256 These devices have started to fail when I upgraded my FreeRADIUS server (openssl, etc.). So I'm guessing I'm missing some old insecure ciphers in openssl. Now convince the vendor to upgrade their client systems... Thanks, Vieri

2 1

TLS 1.3
by Vieri 29 Jun '20

29 Jun '20

So, I gather that "recv TLS 1.3" does not necessarily mean that the client *requires* TLS 1.3. Then,"send TLS 1.0" might mean that we offered TLS 1.0 but a cipher the client refused. There's no way to tell which is the culprit (TLS or cipher suite)? In freeradius eap I have: cipher_list = "DEFAULT" cipher_server_preference = no So I guess I'm not being very picky, am I? Maybe I can be more permissive by changing "DEFAULT" to an explicit list? Vieri

2 1

TLS 1.3
by Vieri 29 Jun '20

29 Jun '20

Hi, What does this log snippet mean? (2) eap_peap: Continuing EAP-TLS (2) eap_peap: Peer indicated complete TLS record size will be 71 bytes (2) eap_peap: Got complete TLS record (71 bytes) (2) eap_peap: [eaptls verify] = length included (2) eap_peap: (other): before SSL initialization (2) eap_peap: TLS_accept: before SSL initialization (2) eap_peap: TLS_accept: before SSL initialization (2) eap_peap: <<< recv TLS 1.3 [length 0042] (2) eap_peap: >>> send TLS 1.0 Alert [length 0002], fatal handshake_failure (2) eap_peap: ERROR: TLS Alert write:fatal:handshake failure tls: TLS_accept: Error in error (2) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read): error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (2) eap_peap: ERROR: System call (I/O) error (-1) (2) eap_peap: ERROR: TLS receive handshake failed during operation (2) eap_peap: ERROR: [eaptls process] = fail (2) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed (2) eap: Sending EAP Failure (code 4) ID 101 length 4 (2) eap: Failed in EAP select Does it mean that the wifi client asked for TLS 1.3, but we replied with TLS 1.0? I have this in freeradius: tls_min_version = "1.0" tls_max_version = "1.2" and I'm using openssl-1.1.1g. Regards, Vieri

2 1

EAP-TEAP support on the radar?
by Graham Clinch 29 Jun '20

29 Jun '20

Hi, I've stumbled across a few slightly obscured mentions of EAP-TEAP support coming in the latest Windows 10 release - eg "EAP-TEAP is supported on Windows 10 v2004 operating system and later" from: https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-gpwl/6694fb… I think this is first time a widely deployed supplicant (with apologies to wpa_supplicant) will have TEAP support. We would be absolutely ecstatic if we were able to use both computer and user credentials as part of the network placement decision (in particular for VPN sessions). Is TEAP support on a future-plans-list for FreeRADIUS? Graham

3 3

Rewriting contents of Accounting messages
by Pavel Uhliar 26 Jun '20

26 Jun '20

... my apologies, resending previous mail again with correct subject, sorry for posting it without ... Hello, guys. I am stuck with rewriting the contents of Accounting messages and need your advice. I need to manipulate Class attribute (I might use another one, but I guess there is no difference in handling attributes internally) according to actual state of local database running on RADIUS server. To be specific, based on data received in Access-Request packet and actual contents of RADIUS database my custom function in policy.conf decides which service name should be supplied to customer and relays this info to NAS using Class attribute. The NAS itself is not the entity that needs to receive the information. NAS copies the Class attribute into subsequent Accounting messages sent after opening the session, and those Accounting messages are proxied to another entity (let's call it "black-box", since it is beyond my control). Black-box influences traffic transferred by the session according to service template (which is my desired effect). xxx.rewrite.class { if ((Called-Station-Id) && "%{Called-Station-Id}" =~ /^IW-REG([0-9]{3})-SVC(.*)$/i) { update reply { Class := "%{tolower:IW-R%{1}-S%{2}}-%{sql: SELECT SVC FROM radcheck WHERE MAC='%{Calling-Station-Id}'}" } updated } else { noop } } I included my function into "authorize" and "preacct" sections of "default" site config and everything works fine when the session is being started. Now I need to change contents of the Class attribute DURING THE LIFETIME of the session. NAS keeps sending Accounting Interim updates. The information coming from NAS is still the same as it was in Access-Request, but setting in local database changed, so my script produces another contents for Class attribute, and I need the change to be reflected in Accounting messsage proxied to the black-box. My idea was just to keep the same rewrite function in place, and I was hoping that Class attribute will be sent back in response to Accounting same as it was in response to Access-Request, then NAS will start to include new version of my Class, that will be proxied to black-box, and black-box does its job. Unfortunately I can't get RADIUS to send the Class attribute in response to Accounting message (neither Start nor Interim), Response contains just Authenticator. So my intended solution does not work. Can you advise how to force the Class attribute to be included? 09:31:01.466731 IP (tos 0x0, ttl 56, id 65225, offset 0, flags [DF], proto UDP (17), length 217) xxxxx.59947 > yyyyy.radius-acct: RADIUS, length: 189 Accounting Request (4), id: 0x1b, Authenticator: c88c72cdfc48aa71744fbd90733a09a5 Accounting Status Attribute (40), length: 6, Value: Start NAS Port Type Attribute (61), length: 6, Value: Wireless - IEEE 802.11 Calling Station Attribute (31), length: 19, Value: 34:A8:EB:0B:4D:03 Called Station Attribute (30), length: 21, Value: IW-REG001-SVCabc NAS Port ID Attribute (87), length: 11, Value: BR-airmax Username Attribute (1), length: 19, Value: 34:A8:EB:0B:4D:03 NAS Port Attribute (5), length: 6, Value: -2141191544 Accounting Session ID Attribute (44), length: 10, Value: 80600288 Framed IP Address Attribute (8), length: 6, Value: 192.168.98.189 Vendor Specific Attribute (26), length: 12, Value: Vendor: Unknown (14988) Vendor Attribute: 10, Length: 4, Value: ..b. Class Attribute (25), length: 22, Value: iw-r001-sabc-bbbb Event Timestamp Attribute (55), length: 6, Value: Thu Jun 25 09:31:01 2020 NAS ID Attribute (32), length: 13, Value: DHR Lucerna Accounting Delay Attribute (41), length: 6, Value: 00 secs NAS IP Address Attribute (4), length: 6, Value: xxxxx 09:31:01.474679 IP (tos 0x0, ttl 64, id 8369, offset 0, flags [none], proto UDP (17), length 48) yyyyy.radius-acct > xxxxx.59947: RADIUS, length: 20 Accounting Response (5), id: 0x1b, Authenticator: 3025c6d75fd16ac5992ac3278afa5630 As I mentioned before, I do not need the NAS to receive the info, it would be sufficient for me to modify the proxied Accounting message. So, if including the Class in Accounting Response is not possible (or does not do what I need), I could solve it just between RADIUS and Accounting proxy. I was trying to achieve this by including my function into "pre-proxy" section of default site, but it does not influence the message, Class contents is copied the same as it was ingested by the RADIUS. Can you advise how to achieve this? pre-proxy { #attr_rewrite # Uncomment the following line if you want to change attributes # as defined in the preproxy_users file. #files xxx.rewrite.class # Uncomment the following line if you want to filter requests # sent to remote servers based on the rules defined in the # 'attrs.pre-proxy' file. #attr_filter.pre-proxy # If you want to have a log of packets proxied to a home # server, un-comment the following line, and the # 'detail pre_proxy_log' section, above. #pre_proxy_log } Thanks for all hints in advance, Pavel Uhliar

2 1

(no subject)
by Pavel Uhliar 26 Jun '20

26 Jun '20

Hello, guys. I am stuck with rewriting the contents of Accounting messages and need your advice. I need to manipulate Class attribute (I might use another one, but I guess there is no difference in handling attributes internally) according to actual state of local database running on RADIUS server. To be specific, based on data received in Access-Request packet and actual contents of RADIUS database my custom function in policy.conf decides which service name should be supplied to customer and relays this info to NAS using Class attribute. The NAS itself is not the entity that needs to receive the information. NAS copies the Class attribute into subsequent Accounting messages sent after opening the session, and those Accounting messages are proxied to another entity (let's call it "black-box", since it is beyond my control). Black-box influences traffic transferred by the session according to service template (which is my desired effect). xxx.rewrite.class { if ((Called-Station-Id) && "%{Called-Station-Id}" =~ /^IW-REG([0-9]{3})-SVC(.*)$/i) { update reply { Class := "%{tolower:IW-R%{1}-S%{2}}-%{sql: SELECT SVC FROM radcheck WHERE MAC='%{Calling-Station-Id}'}" } updated } else { noop } } I included my function into "authorize" and "preacct" sections of "default" site config and everything works fine when the session is being started. Now I need to change contents of the Class attribute DURING THE LIFETIME of the session. NAS keeps sending Accounting Interim updates. The information coming from NAS is still the same as it was in Access-Request, but setting in local database changed, so my script produces another contents for Class attribute, and I need the change to be reflected in Accounting messsage proxied to the black-box. My idea was just to keep the same rewrite function in place, and I was hoping that Class attribute will be sent back in response to Accounting same as it was in response to Access-Request, then NAS will start to include new version of my Class, that will be proxied to black-box, and black-box does its job. Unfortunately I can't get RADIUS to send the Class attribute in response to Accounting message (neither Start nor Interim), Response contains just Authenticator. So my intended solution does not work. Can you advise how to force the Class attribute to be included? 09:31:01.466731 IP (tos 0x0, ttl 56, id 65225, offset 0, flags [DF], proto UDP (17), length 217) xxxxx.59947 > yyyyy.radius-acct: RADIUS, length: 189 Accounting Request (4), id: 0x1b, Authenticator: c88c72cdfc48aa71744fbd90733a09a5 Accounting Status Attribute (40), length: 6, Value: Start NAS Port Type Attribute (61), length: 6, Value: Wireless - IEEE 802.11 Calling Station Attribute (31), length: 19, Value: 34:A8:EB:0B:4D:03 Called Station Attribute (30), length: 21, Value: IW-REG001-SVCabc NAS Port ID Attribute (87), length: 11, Value: BR-airmax Username Attribute (1), length: 19, Value: 34:A8:EB:0B:4D:03 NAS Port Attribute (5), length: 6, Value: -2141191544 Accounting Session ID Attribute (44), length: 10, Value: 80600288 Framed IP Address Attribute (8), length: 6, Value: 192.168.98.189 Vendor Specific Attribute (26), length: 12, Value: Vendor: Unknown (14988) Vendor Attribute: 10, Length: 4, Value: ..b. Class Attribute (25), length: 22, Value: iw-r001-sabc-bbbb Event Timestamp Attribute (55), length: 6, Value: Thu Jun 25 09:31:01 2020 NAS ID Attribute (32), length: 13, Value: DHR Lucerna Accounting Delay Attribute (41), length: 6, Value: 00 secs NAS IP Address Attribute (4), length: 6, Value: xxxxx 09:31:01.474679 IP (tos 0x0, ttl 64, id 8369, offset 0, flags [none], proto UDP (17), length 48) yyyyy.radius-acct > xxxxx.59947: RADIUS, length: 20 Accounting Response (5), id: 0x1b, Authenticator: 3025c6d75fd16ac5992ac3278afa5630 As I mentioned before, I do not need the NAS to receive the info, it would be sufficient for me to modify the proxied Accounting message. So, if including the Class in Accounting Response is not possible (or does not do what I need), I could solve it just between RADIUS and Accounting proxy. I was trying to achieve this by including my function into "pre-proxy" section of default site, but it does not influence the message, Class contents is copied the same as it was ingested by the RADIUS. Can you advise how to achieve this? pre-proxy { #attr_rewrite # Uncomment the following line if you want to change attributes # as defined in the preproxy_users file. #files xxx.rewrite.class # Uncomment the following line if you want to filter requests # sent to remote servers based on the rules defined in the # 'attrs.pre-proxy' file. #attr_filter.pre-proxy # If you want to have a log of packets proxied to a home # server, un-comment the following line, and the # 'detail pre_proxy_log' section, above. #pre_proxy_log } Thanks for all hints in advance, Pavel Uhliar

1 0