Hello, I have configured *EAP-AKA virtual-server in FreeRADIUS to perform authentication. I have enabled eap cache so that fast reauth will work and session data will be stored in cache. However during store session i could not restore Counter and hence reauth fails. Logs are: Debug : (0.0) h9-auth-server - store session { Debug : (0.0) h9-auth-server - | debug_attr INFO : (0.0) h9-auth-server - Attributes matching "&session-state" INFO : (0.0) h9-auth-server - &session-State.session-State = { INFO : (0.0) h9-auth-server - Permanent-Identity = 10026000000000@wlan.mnc11343.mcc0.3gppnetwork.org INFO : (0.0) h9-auth-server - SIM-Ki = 0x465b5ce8b199b49faa5f0a2ee238a6bc INFO : (0.0) h9-auth-server - SIM-OPc = 0xcd63cb71954a9f4e48a5994e37a02baf INFO : (0.0) h9-auth-server - SIM-SQN = 528 INFO : (0.0) h9-auth-server - Identity = 27CL9C1yARfBU1l@wlan.mnc11343.mcc0.3gppnetwork.org INFO : (0.0) h9-auth-server - Session-Data = 0xd9407284e28f09c788dd047dbd2350adcf91a5ef INFO : (0.0) h9-auth-server - Counter = 0
>>>>>>>>>>> Counter is available here....>>>>>> INFO : (0.0) h9-auth-server - } Debug : (0.0) h9-auth-server - | eap-aka-sim.Session-ID Debug : (0.0) h9-auth-server - | %{eap-aka-sim.Session-ID} Debug : (0.0) h9-auth-server - | --> 0x34374631353345367a547775664157 Debug : (0.0) eap_aka_cache - No cache entry found for "47F153E6zTwufAW" Debug : (0.0) eap_aka_cache - Creating new cache entry Debug : (0.0) eap_aka_cache - &session-State.Session-Data := &session-State.Session-Data -> 0xd9407284e28f09c788dd047dbd2350adcf91a5ef Debug : (0.0) eap_aka_cache - EXPAND %{session-state.Permanent-Identity} Debug : (0.0) eap_aka_cache - | session-state.Permanent-Identity Debug : (0.0) eap_aka_cache - | %{session-state.Permanent-Identity} Debug : (0.0) eap_aka_cache - | --> 10026000000000@wlan.mnc11343.mcc0.3gppnetwork.org Debug : (0.0) eap_aka_cache - --> 10026000000000@wlan.mnc11343.mcc0.3gppnetwork.org Debug : (0.0) eap_aka_cache - &session-State.Permanent-Identity := "10026000000000@wlan.mnc11343.mcc0.3gppnetwork.org" Debug : (0.0) eap_aka_cache - EXPAND %{session-state.Encr-Data.Counter} Debug : (0.0) eap_aka_cache - | session-state.Encr-Data.Counter Debug : (0.0) eap_aka_cache - | %{session-state.Encr-Data.Counter} Debug : (0.0) eap_aka_cache - (null) Debug : (0.0) eap_aka_cache - --> Debug : (0.0) eap_aka_cache - Skipping %{session-state.Encr-Data.Counter} Debug : (0.0) eap_aka_cache - Committed entry, TTL 150 seconds Debug : (0.0) h9-auth-server - eap_aka_cache (updated)
Session is stored in eap cache however it could not store Counter as its value is nil in Encr-Data and direct access to Counter in session-state is failing. During Reauth request , it could fetch the session from the cache but as Counter is not there, fast reauth is failing... Debug : (2.0) h9-auth-server - New EAP-AKA session Debug : (2.0) h9-auth-server - Changed state INIT -> REAUTHENTICATION Debug : (2.0) h9-auth-server - load session { Debug : (2.0) h9-auth-server - | eap-aka-sim.Session-ID Debug : (2.0) h9-auth-server - | %{eap-aka-sim.Session-ID} Debug : (2.0) h9-auth-server - | --> 0x34374631353345367a547775664157 Debug : (2.0) eap_aka_cache - Found entry for "47F153E6zTwufAW" Debug : (2.0) eap_aka_cache - Merging cache entry into request Debug : (2.0) eap_aka_cache - &session-State.Session-Data := 0xd9407284e28f09c788dd047dbd2350adcf91a5ef Debug : (2.0) eap_aka_cache - &session-State.Permanent-Identity := '10026000000000@wlan.mnc11343.mcc0.3gppnetwork.org' Debug : (2.0) h9-auth-server - eap_aka_cache (updated) Debug : (2.0) h9-auth-server - ok (ok) Debug : (2.0) h9-auth-server - | debug_attr INFO : (2.0) h9-auth-server - Attributes matching "&session-state" INFO : (2.0) h9-auth-server - &session-State.session-State = { INFO : (2.0) h9-auth-server - Session-Data = 0xd9407284e28f09c788dd047dbd2350adcf91a5ef INFO : (2.0) h9-auth-server - Permanent-Identity = 10026000000000@wlan.mnc11343.mcc0.3gppnetwork.org INFO : (2.0) h9-auth-server - } Debug : (2.0) h9-auth-server - | %debug_attr({&session-state}) Debug : (2.0) h9-auth-server - } # send Reauthentication-Request (ok) Debug : (2.0) h9-auth-server - Generating new session keys Debug : (2.0) h9-auth-server - No &session-state.Counter attribute found, can't calculate re-auth keys Debug : (2.0) h9-auth-server - Composing EAP-Request/Reauthentication failed. Clearing reply attributes and requesting additional Identity Debug : (2.0) h9-auth-server - Changed state REAUTHENTICATION -> AKA-IDENTITY Debug : (2.0) h9-auth-server - send Identity-Request { Store session setting in virtual server: store session { "%(debug_attr:&session-state)" eap_aka_cache "%(debug_attr:&session-state)" ok } Currently my eap_cache is cache eap_aka_cache { # # key:: Cache key. # key = "%{eap-aka-sim.Session-ID}" # # ttl:: TTL for cache entries. # ttl = 150 # # update <section> { ... }:: # update session-state { &session-state.Session-Data := &session-state.Session-Data &Permanent-Identity := "%{session-state.Permanent-Identity}" &Encr-Data.Counter := "%{session-state.Encr-Data.Counter}" } } If i add accessing Counter, it fails as follows: &session-state.Counter := &session-state.Counter Debug : Compiling policies in - store session {...} Error : /usr/local/etc/raddb/mods-enabled/eap-cache[22]: Failed parsing attribute reference &session-state.Counter - Unresolved attributes are not allowed here Error : /usr/local/etc/raddb/mods-enabled/eap-cache[22]: &session-state.Counter Error : /usr/local/etc/raddb/mods-enabled/eap-cache[22]: ^ Error : /usr/local/etc/raddb/mods-enabled/eap-cache[22]: Failed creating map from '&session-state.Counter = &session-state.Counter' Error : /usr/local/etc/raddb/mods-enabled/eap-cache[1]: Failed parsing configuration section update Error : /usr/local/etc/raddb/sites-enabled/h9-auth-server[1006]: Invalid keyword "eap_aka_cache". Am i missing any configuration? Can anyone help? Summary of my setup: * FreeRadius version4 - Configured, compiled and installed from master Branch synced on 10th May 2024. * wpa_supplicant version 2.10 * Ubuntu 20.04 LTS Thanks, Deepika