- Freeradius-Users - lists.freeradius.org

Debian 12 Bookworm packages available
by Matthew Newton 16 Jun '23

16 Jun '23

We've added Debian 12 Bookworm to the Network RADIUS package builds. Both FreeRADIUS 3.2.3 and 3.0.26 are now available. Instructions are on the packages site as usual: https://packages.networkradius.com/ -- Matthew

2 1

Automated XIoT device management GoldenPath
by Michael Maymann 16 Jun '23

16 Jun '23

Hi list, first Q, so please be nice ;) If I am in the wrong list, please just let me know where to ask :) I am in the process of figuring out the architecture of how to automate XIoT device management best possible, and thought the following functionality in Radius would be a good approach. Are these something that is already supported in FreeRadius? Suggestions for better alternatives or guides/links on how to best achieve this are much appreciated :) "ZeroConf" XIoT info: - [MUD](https://datatracker.ietf.org/doc/rfc8520) retrieval (-> asset management system -> XIoTType ACL creation/approval -> provisioning) - [SBOM](https://cyclonedx.org/specification/overview) retrieval (-> asset management system -> continuous lightweight vulnerability scanning -> proactive compromisation actions) ZeroTrust XIoT PNAC 802.1x EAP-TLS authentication: - [FDO](https://github.com/fido-device-onboard) - [KeyLime](https://github.com/keylime) - [Akri](https://github.com/project-akri/akri) ZeroTouch XIoT provisioning: - [AWS IoT Greengrass](https://github.com/aws-greengrass) - [Tinkerbell](https://github.com/tinkerbell/proposals/issues/66) Thanks in advance :) Br. Michael

2 2

Fwd: compilation problem deprecated: Since OpenSSL 3.0
by Joost Ringoot 15 Jun '23

15 Jun '23

I am crossposting this, first on hostap, but some of you may have encountered/resolved this as well. I will crosspost the solution as well, when I have it. I forgot to mention, I tried the wpa_supplicant-2.10 as found on https://w1.fi/wpa_supplicant/ ----- Forwarded Message ----- > To: "hostap" <hostap(a)lists.infradead.org> > Sent: Thursday, 15 June, 2023 12:30:47 > Subject: compilation problem deprecated: Since OpenSSL 3.0 > Hello all, > > I am trying to compile eampol_test > > "make eapol_test" > > (Following "THE FREERADIUS IMPLEMENTATION GUIDE" (2014 network radius sarl) > chapter 6 -EAP authentication, Pg 46,47) > > I've set > > "CONFIG_EAPOL_TEST=y" > > in the .config > > I get plenty of "deprecated: Since OpenSSL 3.0" errors. (on Ubuntu 22.04.2 LTS) > The full output is below. > > Thanks in advance for your advice, > > Joost > > =======Start compilation > output========================================================================================================= > > CC config.c > CC notify.c > CC bss.c > CC eap_register.c > CC ../src/utils/common.c > CC ../src/utils/config.c > CC ../src/utils/wpa_debug.c > CC ../src/utils/wpabuf.c > CC ../src/utils/bitfield.c > CC ../src/utils/ip_addr.c > CC ../src/utils/crc32.c > CC op_classes.c > CC rrm.c > CC twt.c > CC robust_av.c > CC wmm_ac.c > CC ../src/utils/os_unix.c > CC ../src/utils/eloop.c > CC config_file.c > CC ../src/rsn_supp/wpa_ft.c > CC ../src/common/sae.c > CC ../src/common/dpp.c > CC ../src/common/dpp_auth.c > CC ../src/common/dpp_backup.c > CC ../src/common/dpp_crypto.c > CC ../src/common/dpp_pkex.c > CC ../src/common/dpp_reconfig.c > CC ../src/common/dpp_tcp.c > CC dpp_supplicant.c > CC ../src/rsn_supp/tdls.c > CC ../src/rsn_supp/wpa.c > CC ../src/rsn_supp/preauth.c > CC ../src/rsn_supp/pmksa_cache.c > CC ../src/rsn_supp/wpa_ie.c > CC ../src/common/wpa_common.c > CC ibss_rsn.c > CC p2p_supplicant.c > CC p2p_supplicant_sd.c > CC ../src/p2p/p2p.c > CC ../src/p2p/p2p_utils.c > CC ../src/p2p/p2p_parse.c > CC ../src/p2p/p2p_build.c > CC ../src/p2p/p2p_go_neg.c > CC ../src/p2p/p2p_sd.c > CC ../src/p2p/p2p_pd.c > CC ../src/p2p/p2p_invitation.c > CC ../src/p2p/p2p_dev_disc.c > CC ../src/p2p/p2p_group.c > CC ../src/ap/p2p_hostapd.c > CC wifi_display.c > CC hs20_supplicant.c > CC interworking.c > CC ../src/eap_peer/eap_tls.c > CC ../src/eap_peer/eap_peap.c > CC ../src/eap_common/eap_peap_common.c > CC ../src/eap_peer/eap_ttls.c > CC ../src/eap_peer/eap_md5.c > CC ../src/eap_peer/eap_mschapv2.c > CC ../src/eap_peer/mschapv2.c > CC ../src/eap_peer/eap_gtc.c > CC ../src/eap_peer/eap_otp.c > CC ../src/eap_peer/eap_leap.c > CC ../src/eap_peer/eap_fast.c > CC ../src/eap_peer/eap_fast_pac.c > CC ../src/eap_common/eap_fast_common.c > CC ../src/eap_peer/eap_pax.c > CC ../src/eap_common/eap_pax_common.c > CC ../src/eap_peer/eap_sake.c > CC ../src/eap_common/eap_sake_common.c > CC ../src/eap_peer/eap_gpsk.c > CC ../src/eap_common/eap_gpsk_common.c > CC ../src/eap_peer/eap_pwd.c > CC ../src/eap_common/eap_pwd_common.c > CC wps_supplicant.c > CC ../src/utils/uuid.c > CC ../src/eap_peer/eap_wsc.c > CC ../src/eap_common/eap_wsc_common.c > CC ../src/wps/wps.c > CC ../src/wps/wps_common.c > CC ../src/wps/wps_attr_parse.c > CC ../src/wps/wps_attr_build.c > CC ../src/wps/wps_attr_process.c > CC ../src/wps/wps_dev_attr.c > CC ../src/wps/wps_enrollee.c > CC ../src/wps/wps_registrar.c > CC ../src/eap_peer/eap_ikev2.c > CC ../src/eap_peer/ikev2.c > CC ../src/eap_common/eap_ikev2_common.c > CC ../src/eap_common/ikev2_common.c > CC ../src/eap_peer/eap_tnc.c > CC ../src/eap_peer/tncc.c > CC wpas_kay.c > CC ../src/pae/ieee802_1x_cp.c > CC ../src/pae/ieee802_1x_kay.c > CC ../src/pae/ieee802_1x_key.c > CC ../src/pae/ieee802_1x_secy_ops.c > CC ../src/ap/wpa_auth_kay.c > CC ../src/eapol_supp/eapol_supp_sm.c > CC ../src/eap_peer/eap.c > CC ../src/eap_peer/eap_methods.c > CC ap.c > CC ../src/ap/hostapd.c > CC ../src/ap/wpa_auth_glue.c > CC ../src/ap/utils.c > CC ../src/ap/authsrv.c > CC ../src/ap/ap_config.c > CC ../src/ap/sta_info.c > CC ../src/ap/tkip_countermeasures.c > CC ../src/ap/ap_mlme.c > CC ../src/ap/ieee802_1x.c > CC ../src/eapol_auth/eapol_auth_sm.c > CC ../src/ap/ieee802_11_auth.c > CC ../src/ap/ieee802_11_shared.c > CC ../src/ap/drv_callbacks.c > CC ../src/ap/ap_drv_ops.c > CC ../src/ap/beacon.c > CC ../src/ap/bss_load.c > CC ../src/ap/eap_user_db.c > CC ../src/ap/neighbor_db.c > CC ../src/ap/rrm.c > CC ../src/ap/ieee802_11_ht.c > CC ../src/ap/ieee802_11_vht.c > CC ../src/ap/ctrl_iface_ap.c > CC ../src/eap_server/eap_server.c > CC ../src/eap_server/eap_server_identity.c > CC ../src/eap_server/eap_server_methods.c > CC ../src/ap/wmm.c > CC ../src/ap/ap_list.c > CC ../src/ap/ieee802_11.c > CC ../src/ap/hw_features.c > CC ../src/ap/dfs.c > CC ../src/ap/wps_hostapd.c > CC ../src/eap_server/eap_server_wsc.c > CC ../src/ap/dpp_hostapd.c > CC ../src/ap/gas_query_ap.c > CC ../src/ap/gas_serv.c > CC ../src/ap/hs20.c > CC ../src/ap/wpa_auth.c > CC ../src/ap/wpa_auth_ie.c > CC ../src/ap/pmksa_cache_auth.c > CC ../src/common/dragonfly.c > CC ../src/crypto/ms_funcs.c > CC ../src/eap_common/chap.c > CC ../src/eap_peer/eap_tls_common.c > ../src/crypto/tls_openssl.c: In function ‘tls_engine_load_dynamic_generic’: > ../src/crypto/tls_openssl.c:799:9: error: ‘ENGINE_by_id’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 799 | engine = ENGINE_by_id(id); > | ^~~~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:336:31: note: declared here > 336 | OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_by_id(const char *id); > | ^~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:814:9: error: ‘ENGINE_by_id’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 814 | engine = ENGINE_by_id(dynamic_id); > | ^~~~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:336:31: note: declared here > 336 | OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_by_id(const char *id); > | ^~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:825:17: error: ‘ENGINE_ctrl_cmd_string’ is > deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations] > 825 | if (ENGINE_ctrl_cmd_string(engine, pre[0], pre[1], 0) == > 0) { > | ^~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:479:5: note: declared here > 479 | int ENGINE_ctrl_cmd_string(ENGINE *e, const char *cmd_name, const char > *arg, > | ^~~~~~~~~~~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:829:25: error: ‘ENGINE_free’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 829 | ENGINE_free(engine); > | ^~~~~~~~~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:493:27: note: declared here > 493 | OSSL_DEPRECATEDIN_3_0 int ENGINE_free(ENGINE *e); > | ^~~~~~~~~~~ > ../src/crypto/tls_openssl.c:839:9: error: ‘ENGINE_free’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 839 | ENGINE_free(engine); > | ^~~~~~~~~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:493:27: note: declared here > 493 | OSSL_DEPRECATEDIN_3_0 int ENGINE_free(ENGINE *e); > | ^~~~~~~~~~~ > ../src/crypto/tls_openssl.c:841:9: error: ‘ENGINE_by_id’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 841 | engine = ENGINE_by_id(id); > | ^~~~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:336:31: note: declared here > 336 | OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_by_id(const char *id); > | ^~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:850:17: error: ‘ENGINE_ctrl_cmd_string’ is > deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations] > 850 | if (ENGINE_ctrl_cmd_string(engine, post[0], post[1], 0) == > 0) { > | ^~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:479:5: note: declared here > 479 | int ENGINE_ctrl_cmd_string(ENGINE *e, const char *cmd_name, const char > *arg, > | ^~~~~~~~~~~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:854:25: error: ‘ENGINE_remove’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 854 | ENGINE_remove(engine); > | ^~~~~~~~~~~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:332:27: note: declared here > 332 | OSSL_DEPRECATEDIN_3_0 int ENGINE_remove(ENGINE *e); > | ^~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:855:25: error: ‘ENGINE_free’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 855 | ENGINE_free(engine); > | ^~~~~~~~~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:493:27: note: declared here > 493 | OSSL_DEPRECATEDIN_3_0 int ENGINE_free(ENGINE *e); > | ^~~~~~~~~~~ > ../src/crypto/tls_openssl.c:860:9: error: ‘ENGINE_free’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 860 | ENGINE_free(engine); > | ^~~~~~~~~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:493:27: note: declared here > 493 | OSSL_DEPRECATEDIN_3_0 int ENGINE_free(ENGINE *e); > | ^~~~~~~~~~~ > ../src/crypto/tls_openssl.c: In function ‘tls_init’: > ../src/crypto/tls_openssl.c:1089:9: error: ‘ENGINE_load_builtin_engines’ is > deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations] > 1089 | ENGINE_load_builtin_engines(); > | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:358:28: note: declared here > 358 | OSSL_DEPRECATEDIN_3_0 void ENGINE_load_builtin_engines(void); > | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c: In function ‘tls_engine_init’: > ../src/crypto/tls_openssl.c:1213:9: error: ‘ENGINE_by_id’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 1213 | conn->engine = ENGINE_by_id(engine_id); > | ^~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:336:31: note: declared here > 336 | OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_by_id(const char *id); > | ^~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:1219:9: error: ‘ENGINE_init’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 1219 | if (ENGINE_init(conn->engine) != 1) { > | ^~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:620:27: note: declared here > 620 | OSSL_DEPRECATEDIN_3_0 int ENGINE_init(ENGINE *e); > | ^~~~~~~~~~~ > ../src/crypto/tls_openssl.c:1228:9: error: ‘ENGINE_ctrl_cmd_string’ is > deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations] > 1228 | if (pin && ENGINE_ctrl_cmd_string(conn->engine, "PIN", pin, 0) == > 0) { > | ^~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:479:5: note: declared here > 479 | int ENGINE_ctrl_cmd_string(ENGINE *e, const char *cmd_name, const char > *arg, > | ^~~~~~~~~~~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:1245:17: error: ‘ENGINE_load_private_key’ is > deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations] > 1245 | conn->private_key = ENGINE_load_private_key(conn->engine, > | ^~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:638:11: note: declared here > 638 | EVP_PKEY *ENGINE_load_private_key(ENGINE *e, const char *key_id, > | ^~~~~~~~~~~~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:1268:17: error: ‘ENGINE_ctrl’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 1268 | if (!ENGINE_ctrl(conn->engine, > ENGINE_CTRL_GET_CMD_FROM_NAME, > | ^~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:429:27: note: declared here > 429 | OSSL_DEPRECATEDIN_3_0 int ENGINE_ctrl(ENGINE *e, int cmd, long i, void *p, > | ^~~~~~~~~~~ > ../src/crypto/tls_openssl.c:1281:17: error: ‘ENGINE_free’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 1281 | ENGINE_free(conn->engine); > | ^~~~~~~~~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:493:27: note: declared here > 493 | OSSL_DEPRECATEDIN_3_0 int ENGINE_free(ENGINE *e); > | ^~~~~~~~~~~ > ../src/crypto/tls_openssl.c: In function ‘tls_engine_deinit’: > ../src/crypto/tls_openssl.c:1307:17: error: ‘ENGINE_finish’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 1307 | ENGINE_finish(conn->engine); > | ^~~~~~~~~~~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:628:27: note: declared here > 628 | OSSL_DEPRECATEDIN_3_0 int ENGINE_finish(ENGINE *e); > | ^~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c: In function ‘tls_engine_get_cert’: > ../src/crypto/tls_openssl.c:3605:9: error: ‘ENGINE_ctrl_cmd’ is deprecated: > Since OpenSSL 3.0 [-Werror=deprecated-declarations] > 3605 | if (!ENGINE_ctrl_cmd(conn->engine, "LOAD_CERT_CTRL", > | ^~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:450:27: note: declared here > 450 | OSSL_DEPRECATEDIN_3_0 int ENGINE_ctrl_cmd(ENGINE *e, const char *cmd_name, > | ^~~~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c: In function ‘tls_connection_private_key’: > ../src/crypto/tls_openssl.c:3827:17: error: ‘SSL_use_RSAPrivateKey_ASN1’ is > deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations] > 3827 | if (SSL_use_RSAPrivateKey_ASN1(conn->ssl, > | ^~ > In file included from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/ssl.h:1652:12: note: declared here > 1652 | __owur int SSL_use_RSAPrivateKey_ASN1(SSL *ssl, > | ^~~~~~~~~~~~~~~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c: In function ‘tls_connection_dh’: > ../src/crypto/tls_openssl.c:3966:9: error: ‘PEM_read_bio_DHparams’ is > deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations] > 3966 | dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL); > | ^~ > In file included from /usr/include/openssl/ssl.h:36, > from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/pem.h:469:1: note: declared here > 469 | DECLARE_PEM_rw_attr(OSSL_DEPRECATEDIN_3_0, DHparams, DH) > | ^~~~~~~~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:3977:17: error: ‘PEM_read_bio_DSAparams’ is > deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations] > 3977 | dsa = PEM_read_bio_DSAparams(bio, NULL, NULL, NULL); > | ^~~ > In file included from /usr/include/openssl/ssl.h:36, > from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/pem.h:455:1: note: declared here > 455 | DECLARE_PEM_rw_attr(OSSL_DEPRECATEDIN_3_0, DSAparams, DSA) > | ^~~~~~~~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:3987:17: error: ‘DSA_dup_DH’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 3987 | dh = DSA_dup_DH(dsa); > | ^~ > In file included from /usr/include/openssl/x509.h:37, > from /usr/include/openssl/ssl.h:31, > from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/dsa.h:198:27: note: declared here > 198 | OSSL_DEPRECATEDIN_3_0 DH *DSA_dup_DH(const DSA *r); > | ^~~~~~~~~~ > ../src/crypto/tls_openssl.c:3988:17: error: ‘DSA_free’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 3988 | DSA_free(dsa); > | ^~~~~~~~ > In file included from /usr/include/openssl/x509.h:37, > from /usr/include/openssl/ssl.h:31, > from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/dsa.h:127:28: note: declared here > 127 | OSSL_DEPRECATEDIN_3_0 void DSA_free(DSA *r); > | ^~~~~~~~ > ../src/crypto/tls_openssl.c:4007:17: error: ‘DH_free’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 4007 | DH_free(dh); > | ^~~~~~~ > In file included from /usr/include/openssl/dsa.h:51, > from /usr/include/openssl/x509.h:37, > from /usr/include/openssl/ssl.h:31, > from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/dh.h:200:28: note: declared here > 200 | OSSL_DEPRECATEDIN_3_0 void DH_free(DH *dh); > | ^~~~~~~ > ../src/crypto/tls_openssl.c:4010:9: error: ‘DH_free’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 4010 | DH_free(dh); > | ^~~~~~~ > In file included from /usr/include/openssl/dsa.h:51, > from /usr/include/openssl/x509.h:37, > from /usr/include/openssl/ssl.h:31, > from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/dh.h:200:28: note: declared here > 200 | OSSL_DEPRECATEDIN_3_0 void DH_free(DH *dh); > | ^~~~~~~ > ../src/crypto/tls_openssl.c: In function ‘tls_global_dh’: > ../src/crypto/tls_openssl.c:4041:9: error: ‘PEM_read_bio_DHparams’ is > deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations] > 4041 | dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL); > | ^~ > In file included from /usr/include/openssl/ssl.h:36, > from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/pem.h:469:1: note: declared here > 469 | DECLARE_PEM_rw_attr(OSSL_DEPRECATEDIN_3_0, DHparams, DH) > | ^~~~~~~~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:4052:17: error: ‘PEM_read_bio_DSAparams’ is > deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations] > 4052 | dsa = PEM_read_bio_DSAparams(bio, NULL, NULL, NULL); > | ^~~ > In file included from /usr/include/openssl/ssl.h:36, > from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/pem.h:455:1: note: declared here > 455 | DECLARE_PEM_rw_attr(OSSL_DEPRECATEDIN_3_0, DSAparams, DSA) > | ^~~~~~~~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:4062:17: error: ‘DSA_dup_DH’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 4062 | dh = DSA_dup_DH(dsa); > | ^~ > In file included from /usr/include/openssl/x509.h:37, > from /usr/include/openssl/ssl.h:31, > from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/dsa.h:198:27: note: declared here > 198 | OSSL_DEPRECATEDIN_3_0 DH *DSA_dup_DH(const DSA *r); > | ^~~~~~~~~~ > ../src/crypto/tls_openssl.c:4063:17: error: ‘DSA_free’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 4063 | DSA_free(dsa); > | ^~~~~~~~ > In file included from /usr/include/openssl/x509.h:37, > from /usr/include/openssl/ssl.h:31, > from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/dsa.h:127:28: note: declared here > 127 | OSSL_DEPRECATEDIN_3_0 void DSA_free(DSA *r); > | ^~~~~~~~ > ../src/crypto/tls_openssl.c:4082:17: error: ‘DH_free’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 4082 | DH_free(dh); > | ^~~~~~~ > In file included from /usr/include/openssl/dsa.h:51, > from /usr/include/openssl/x509.h:37, > from /usr/include/openssl/ssl.h:31, > from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/dh.h:200:28: note: declared here > 200 | OSSL_DEPRECATEDIN_3_0 void DH_free(DH *dh); > | ^~~~~~~ > ../src/crypto/tls_openssl.c:4085:9: error: ‘DH_free’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 4085 | DH_free(dh); > | ^~~~~~~ > In file included from /usr/include/openssl/dsa.h:51, > from /usr/include/openssl/x509.h:37, > from /usr/include/openssl/ssl.h:31, > from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/dh.h:200:28: note: declared here > 200 | OSSL_DEPRECATEDIN_3_0 void DH_free(DH *dh); > | ^~~~~~~ > cc1: all warnings being treated as errors > make: *** [../src/build.rules:86: > /root/radiusconfig/wpa_supplicant-2.10/build/wpa_supplicant/src/crypto/tls_openssl.o] > Error 1 > > ======End compilation > output============================================================================================================== > > _______________________________________________ > Hostap mailing list > Hostap(a)lists.infradead.org > http://lists.infradead.org/mailman/listinfo/hostap

2 2

Log some errors to file or database
by Fabricio Viana 15 Jun '23

15 Jun '23

Hello! When running freeradius -X to debug network problems I got three type of messages: Received Accounting-Request Id 2 from x.x.x.x:1813 to y.y.y.y:1813 length 416. Dropping packet without response because of error: Received Accounting-Request packet from client x.x.x.x with invalid Request Authenticator! (Shared secret is incorrect.) Ignoring request to acct address * port 1813 bound to server default from unknown client x.x.x.x port 58428 proto udp Ignoring request to auth address * port 1812 bound to server default from unknown client x.x.x.x port 36350 proto udp I know how to solve these problems. But to catch these errors I need to enter debug mode (freeradius -X). This sometimes takes some time as it requires someone with shell access to the server. Is it possible to log these messages into a file or database without having to enter debug mode? Thanks! Fabricio

2 1

Using libkqueue, how stable it is with freeradius 3.x?
by work vlpl 15 Jun '23

15 Jun '23

Hi, I want to try to use freeradius 3.2.x which is compiled with libkquueue. In my tests, it is working fine. But I also see the list of know issues https://github.com/mheily/libkqueue/blob/master/BUGS.md of libkqueue and just want to double-check if I should not use it. But I hope that since freeradius 4.x by default will use it the library integration is fine and the listed issues are not affecting freeradius 4.x or 3.x. Best regards, Vladimir

2 7

DHCP Radius proxy (IPv4 and IPv6)
by Ľudovít Mikula 09 Jun '23

09 Jun '23

Hi all, I have a relay-agent which does only DHCP and is not capable of talking to RADIUS server (using auth/acct). However the requirement is to be able to use freeradius with it for the additional functionalities and configurability, over both IPv4 and IPv6. The "authentication" should be done only by checking Option82 circuit-id/remote-id against configured user in freeradius. What are the options for configuring it over IPv6? Probably some dhcp to radius proxy able to do message conversion like: DHCP Discover/Solicit -> RADIUS Access-Request RADIUS Access-Accept -> DHCP Offer/Advertise What would be the best approach to handle this use case (unfortunately I cannot change the hardware). Regards -- Ludo Mikula

2 8

EAP-TLS unable to get local issuer certificate
by MH 08 Jun '23

08 Jun '23

Hello, I am trying to setup EAP-TLS and I am getting radius server error "eap_tls: (TLS) OpenSSL says error 20 : unable to get local issuer certificate", "send TLS 1.2 Alert, fatal unknown_ca" Test client is wpa_supplicant 2.1 built on Ubuntu Linux 22.04.2. All tests are done locally on FreeRadius server 3.2.3 (Ubuntu Linux 22.04.2) When I test "client.crt" with "openssl verify ./client.crt" I get "OK". Specifying -CAFile OpenSSL parameter with chained CA cert also produces "OK". All CA certificates (there is also an intermediate certificate) are in /etc/freeradius/certs, /etc/freeradius/certs_eaptls and also /usr/lib/ssl/cert. One certificate per file. FreeRadius's EAP-TLS stanza is cadir = ${certdir}/certs_eaptls private_key_file = ${certdir}/rad.key certificate_file = ${certdir}/rad.crt auto_chain = no Server and client certificates are signed by different commercial CA. All certificates have intermediate CA. eapol_test config file for EAP-TLS is network={ key_mgmt=WPA-EAP eap=TLS identity="blabla(a)domain.tld" ca_cert="/etc/ssl/certs/chain.crt" client_cert="client.crt" private_key="client.key" private_key_passwd="blabla" } AppArmor disabled. Permissions for all certs are r--r--r-- (at least). OpenSSL rehash done. I have no idea what could be wrong.

3 10

TEAP support
by Natarajan M 07 Jun '23

07 Jun '23

> Is EAP-FAST & TEAP are same? I couldn't find a way to configure freeradius > for TEAP, some mentioned EAP-FAST & TEAP may be similar and TEAP is like > EAP-FASTv2, any pointers will help on configuring TEAP on freeradius if it > is supported. > > Thanks > Natarajan >

2 1

rlm_perl module crash on high load, need to restart service
by Imdad Hasan 05 Jun '23

05 Jun '23

Thanks Alen, This is my perl script code which is a socket client for the swoole TCP socket server. use strict; use vars qw(%RAD_REQUEST %RAD_REPLY %RAD_CHECK); use IO::Socket; use locale; use POSIX; use JSON; use Sys::Syslog; # our (%RAD_REQUEST, %RAD_REPLY, %RAD_CHECK, %RAD_STATE); setlocale(LC_ALL, 'C'); use constant RLM_MODULE_REJECT=> 0;# /* immediately reject the request */ use constant RLM_MODULE_FAIL=> 1;# /* module failed, don't reply */ use constant RLM_MODULE_OK=> 2;# /* the module is OK, continue */ use constant RLM_MODULE_HANDLED=> 3;# /* the module handled the request, so stop. */ use constant RLM_MODULE_INVALID=> 4;# /* the module considers the request invalid. */ use constant RLM_MODULE_USERLOCK=> 5;# /* reject the request (user is locked out) */ use constant RLM_MODULE_NOTFOUND=> 6;# /* user not found */ use constant RLM_MODULE_NOOP=> 7;# /* module succeeded without doing anything */ use constant RLM_MODULE_UPDATED=> 8;# /* OK (pairs modified) */ use constant RLM_MODULE_NUMCODES=> 9;# /* How many return codes there are */ my $swoole; my $answer; sub logs { my $err2 = @_[0]; &radiusd::radlog(1, $err2); # uncomment to logs to syslog # syslog('info', $err2); } sub rtrim { my $s = shift; $s =~ s/\s+$//; return $s }; sub socket_init { &logs("Opening connection to swoole\n"); my $swoole = new IO::Socket::INET ( PeerAddr => '127.0.0.1', PeerPort => '26312', Proto => 'tcp' ); # setsockopt($swoole, SOL_SOCKET, SO_KEEPALIVE, 1); &logs("Connect to swoole finish with error: $!\n") unless $swoole; return $swoole; } sub CLONE { &logs('Cloning...'); $swoole=&socket_init; } sub check_connection() { # swoole connection check... if ((not defined $swoole) || (!$swoole->connected())) { &logs("Try to reconnect to swoole\n"); $swoole=&socket_init; } if ((not defined $swoole) || (!$swoole->connected())) { return 0; } else { return 1; } } sub authorize { if (!check_connection()) { return RLM_MODULE_REJECT; } print $swoole "::authorization::\n" .encode_json(\%RAD_REQUEST) . "\n" .encode_json(\%RAD_REPLY) ."\n" .encode_json(\%RAD_CHECK); $answer=<$swoole>; $answer=rtrim($answer); &logs("ans:".$answer); $answer=decode_json($answer); if ($answer->{radreply} ne "") { my $radreply = $answer->{radreply}; %RAD_REPLY=%{$radreply}; } if($answer->{radcheck} ne "") { my $radcheck = $answer->{radcheck}; %RAD_CHECK=%{$radcheck}; } if ($answer->{response} ne "accept") { return RLM_MODULE_REJECT; } return RLM_MODULE_OK; } sub authenticate { if ($RAD_REPLY{'Packet-Type'} eq "Access-Reject") { return RLM_MODULE_REJECT; } else { return RLM_MODULE_OK; } } sub preacct { return RLM_MODULE_OK; } sub accounting { if (!check_connection()) { return RLM_MODULE_OK; } print $swoole "::accounting::\n" . encode_json(\%RAD_REQUEST); $answer=<$swoole>; $answer=rtrim($answer); &logs("Accounting:".$answer); return RLM_MODULE_OK; } sub checksimul { return RLM_MODULE_OK; } sub pre_proxy { return RLM_MODULE_OK; } sub post_proxy { return RLM_MODULE_OK; } sub post_auth { return RLM_MODULE_OK; } Guide me if i made a mistake here.. Thanks Imdad

2 1

rlm_perl module crash on high load, need to restart service
by Imdad Hasan 05 Jun '23

05 Jun '23

Thanks Alen, Great if the perl or any module will provide async support. Right now I am using FreeRADIUS version 3.0.20 with Jan-2023 built. Actually I tried loading with Jmeter, it's handling around 300 requests per second, but sometimes the resend ratio is big compared to my last exec module php script.. Even the new perl module and php swoole back-end is very light weight with Async MySQL support. But I don't know why the resend ratio is more than the old exec module. I am using 2Core CPU/1GB RAM EC2 for new code for FreeRADIUS with perl module and php swoole backend. The MySQL server is in the same VPC with different EC2. Please guide me for a quick solution for now, after FreeRADIUS 4.x, i will upgrade it. Thanks Imdad

2 1