Hello Francois I have looked into rlm_eap_sim source and found that is incorrectly decode AT_IDENTITY attribute. This leads to incorrect AT_MAC attribute calculation. MAC mismatch detected by supplicant and it refuses to continue EAP-SIM authentication. Please try to apply patch I've attached. This patch fixes AT_IDENTITY attribute decoding. Francois Gaudreault wrote:
Hi,
Don't know then. The client is sending the reject - it doesn't like something the server is sending it. Clock sync - is the 2.2.0 machine a different server?
Nope. Simple yum remove / install.
Beyond that I'm only passing familiar with EAP-SIM, so would be guessing I'm afraid. I think you might have to do some debugging yourself.
I am not familiar with bisect. So I guess it will take a while (build/test/tag as good or bad).
By the way, I removed that * from the rlm_eap_sim.c (typo fix), and the auth did work, but then RADIUS segfault a bit after.
Another question I have is, do I need more than 3 triplets line with 2.2.0?
--- freeradius-server-2.2.0.orig/src/modules/rlm_eap/libeap/eapsimlib.c 2012-09-10 15:51:34.000000000 +0400 +++ freeradius-server-2.2.0/src/modules/rlm_eap/libeap/eapsimlib.c 2012-09-14 11:10:08.000000000 +0400 @@ -321,6 +321,7 @@ int eapsim_attribute; unsigned int eapsim_len; int es_attribute_count; + unsigned int id_len; es_attribute_count=0; @@ -366,12 +367,35 @@ return 0; } + /* AT_IDENTITY has special format */ + if (eapsim_attribute == PW_EAP_SIM_IDENTITY) { + if (eapsim_len < 4) { + radlog(L_ERR, "eap: EAP-Sim AT_IDENTITY (no.%d) has length too small", + es_attribute_count); + goto loop_end; + } + id_len = (attr[2] << 8) + attr[3]; + if (4 + id_len > eapsim_len) { + radlog(L_ERR, "eap: EAP-Sim AT_IDENTITY (no.%d) invalid length", + es_attribute_count); + goto loop_end; + } + } + newvp = paircreate(eapsim_attribute+ATTRIBUTE_EAP_SIM_BASE, PW_TYPE_OCTETS); - memcpy(newvp->vp_strvalue, &attr[2], eapsim_len-2); - newvp->length = eapsim_len-2; + switch (eapsim_attribute) { + case PW_EAP_SIM_IDENTITY: + memcpy(newvp->vp_strvalue, &attr[4], id_len); + newvp->length = id_len; + break; + default: + memcpy(newvp->vp_strvalue, &attr[2], eapsim_len-2); + newvp->length = eapsim_len-2; + } pairadd(&(r->vps), newvp); newvp = NULL; + loop_end: /* advance pointers, decrement length */ attr += eapsim_len; attrlen -= eapsim_len;