Hi! Situation gets more clear if eap module is being called in post-proxy section of proxy-inner-tunnel: Wed Feb 13 01:31:41 2008 : Debug: +- entering group post-proxy Wed Feb 13 01:31:41 2008 : Debug: modsingle[post-proxy]: calling eap (rlm_eap) for request 7 Wed Feb 13 01:31:41 2008 : Debug: rlm_eap_mschapv2: Passing reply from proxy back into the tunnel 0x8185f20 2. Wed Feb 13 01:31:41 2008 : Debug: rlm_eap_mschapv2: Authentication succeeded. Wed Feb 13 01:31:41 2008 : Debug: MSCHAP Success Wed Feb 13 01:31:41 2008 : Debug: modsingle[post-proxy]: returned from eap (rlm_eap) for request 7 Wed Feb 13 01:31:41 2008 : Debug: ++[eap] returns ok Wed Feb 13 01:31:41 2008 : Debug: POST-PROXY 2 Wed Feb 13 01:31:41 2008 : Debug: POST-AUTH 2 But it still fails to authorize: Wed Feb 13 03:17:19 2008 : Debug: rlm_eap_peap: Session established. Decoding tunneled attributes. PEAP tunnel data in 0000: 1a 03 Wed Feb 13 03:17:19 2008 : Debug: rlm_eap_peap: EAP type mschapv2 PEAP: Got tunneled EAP-Message EAP-Message = 0x020a00061a03 Wed Feb 13 03:17:19 2008 : Debug: PEAP: Setting User-Name to aaa PEAP: Sending tunneled request EAP-Message = 0x020a00061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "aaa" State = 0x29fd9dc228f787186321d63394dc60d5 Framed-MTU = 1466 NAS-IP-Address = 192.168.2.3 NAS-Identifier = "D-Link" Service-Type = Framed-User NAS-Port = 33 NAS-Port-Type = Ethernet NAS-Port-Id = "ether3_33" Called-Station-Id = "00-15-e9-b8-79-dd" Calling-Station-Id = "00-a9-40-0f-83-a5" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" server proxy-inner-tunnel { Wed Feb 13 03:17:19 2008 : Debug: +- entering group authorize Wed Feb 13 03:17:19 2008 : Debug: ++[control] returns notfound } # server proxy-inner-tunnel PEAP: Got tunneled reply RADIUS code 0 Wed Feb 13 03:17:19 2008 : Debug: PEAP: Calling authenticate in order to initiate tunneled EAP session. Wed Feb 13 03:17:19 2008 : Debug: +- entering group authenticate Wed Feb 13 03:17:19 2008 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 8 Wed Feb 13 03:17:19 2008 : Error: rlm_eap: No EAP session matching the State variable. Wed Feb 13 03:17:19 2008 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Wed Feb 13 03:17:19 2008 : Debug: rlm_eap: Failed in handler Wed Feb 13 03:17:19 2008 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 8 Wed Feb 13 03:17:19 2008 : Debug: ++[eap] returns invalid In normal case inner tunnel has "EAP-Type = MS-CHAP-V2" and Auth-Type = EAP in check_items: Wed Feb 13 03:09:51 2008 : Debug: EAP-Message = 0x020a00061a03 Wed Feb 13 03:09:51 2008 : Debug: FreeRADIUS-Proxied-To = 127.0.0.1 Wed Feb 13 03:09:51 2008 : Debug: User-Name = "aaa" Wed Feb 13 03:09:51 2008 : Debug: State = 0xe314f6cee21eecffcdeca66afa541172 Wed Feb 13 03:09:51 2008 : Debug: Framed-MTU = 1466 Wed Feb 13 03:09:51 2008 : Debug: NAS-IP-Address = 192.168.2.3 Wed Feb 13 03:09:51 2008 : Debug: NAS-Identifier = "D-Link" Wed Feb 13 03:09:51 2008 : Debug: Service-Type = Framed-User Wed Feb 13 03:09:51 2008 : Debug: NAS-Port = 33 Wed Feb 13 03:09:51 2008 : Debug: NAS-Port-Type = Ethernet Wed Feb 13 03:09:51 2008 : Debug: NAS-Port-Id = "ether3_33" Wed Feb 13 03:09:51 2008 : Debug: Called-Station-Id = "00-15-e9-b8-79-dd" Wed Feb 13 03:09:51 2008 : Debug: Calling-Station-Id = "00-a9-40-0f-83-a5" Wed Feb 13 03:09:51 2008 : Debug: Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Wed Feb 13 03:09:51 2008 : Debug: EAP-Type = MS-CHAP-V2 In this (proxied) case inner tunnel contains only following attributes: (gdb) p vp_listdebug(request->packet->vps) Wed Feb 13 03:15:10 2008 : Debug: EAP-Message = 0x020a00061a03 Wed Feb 13 03:15:10 2008 : Debug: FreeRADIUS-Proxied-To = 127.0.0.1 Wed Feb 13 03:15:10 2008 : Debug: User-Name = "aaa" Wed Feb 13 03:15:10 2008 : Debug: State = 0x7f6817377e620dc906c84fac864d0550 Wed Feb 13 03:15:10 2008 : Debug: Framed-MTU = 1466 Wed Feb 13 03:15:10 2008 : Debug: NAS-IP-Address = 192.168.2.3 Wed Feb 13 03:15:10 2008 : Debug: NAS-Identifier = "D-Link" Wed Feb 13 03:15:10 2008 : Debug: Service-Type = Framed-User Wed Feb 13 03:15:10 2008 : Debug: NAS-Port = 33 Wed Feb 13 03:15:10 2008 : Debug: NAS-Port-Type = Ethernet Wed Feb 13 03:15:10 2008 : Debug: NAS-Port-Id = "ether3_33" Wed Feb 13 03:15:10 2008 : Debug: Called-Station-Id = "00-15-e9-b8-79-dd" Wed Feb 13 03:15:10 2008 : Debug: Calling-Station-Id = "00-a9-40-0f-83-a5" Wed Feb 13 03:15:10 2008 : Debug: Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" request->check_items contain only Proxy-To-Realm AVPair. Dmitry Sergienko wrote:
Thanks for committing patches. But I have to return to the question of proxying EAP-PEAP-MS-CHAPv2. I've spent several nights with gdb, radsniff and xsupplicant to figure out why authentication passes on eapol_test and fails on WinXP supplicant. Even tried Juniper Odissey 802.1x client :)
The reason why authentication fails is missing EAP-MSCHAP Success packet inside EAP-PEAP response.
-- Best regards, Dmitry Sergienko