Hi everyone, Thanks for the quick fix in master. I pulled the newest changes and rebuilt the freeradius binary. I noticed that if I do not explicitly set the SIM-Algo-Version, thus leaving it to the default of 1, then eapol_test client is able to authenticate (*default.log). However, when I do explictely set the SIM-Algo-Version to 1, then eapol_test is unable to authenticate, stating a MAC invalidation (*explicit_set_1.log). Can someone help me understand why this would be the case, when I am merely explicitly setting a variable to its default, instead of leaving it alone? Perhaps I misunderstood what the purpose of SIM-Algo-Version is. Thanks again! Shane ________________________________ From: Freeradius-Users <freeradius-users-bounces+shaneguan=microsoft.com@lists.freeradius.org> on behalf of Arran Cudbard-Bell <a.cudbardb@freeradius.org> Sent: Friday, February 11, 2022 9:51 AM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Cc: Davut Karabay <davutk@microsoft.com>; Corbin Phipps <corbinphipps@microsoft.com>; Paul Irwin <Irwin.Paul@microsoft.com> Subject: Re: [EXTERNAL] Help in Configuring EAP-SIM
On Feb 10, 2022, at 4:46 PM, Alan DeKok <aland@deployingradius.com> wrote:
On Feb 10, 2022, at 3:11 PM, Shane Guan via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
Thanks for the tip about libkqueue. I built and installed the latest version of that library and then was able to compile, install, and run the master branch with freeradius -Xf. However, I am still having difficulty with the configuration for eap-sim. For some reason the eapol_test client says that it can't process a packet? I have attached logs.
The eapol_test log says:
EAP-SIM: Unexpected Challenge in state CONTINUE EAP-SIM: CONTINUE -> FAILURE
and FreeRADIUS says:
Debug : (1.0) eap-sim - New EAP-SIM session Debug : (1.0) eap-sim - Changed state INIT -> SIM-CHALLENGE Debug : (1.0) send Challenge-Request {
So FreeRADIUS is intending to do this, but eapol_test doesn't like it. I'll have to defer to Arran about this. :(
Yeah, my fault. Moved to a unified state machine for all three EAP-Methods. EAP-SIM requires you to always send EAP-SIM-START, EAP-AKA and EAP-AKA' allow you to jump straight into the challenge round if you recognise the identity. I've corrected the state machine to always enter SIM-Start, even when no identity is being requested when we're running EAP-SIM. f4c433d4ef1494cc40fbe84da91046d0333bb8c7 - Fixes the problem by always requesting an ID 6be2c02b3a12930e31f9a46bc677a8a562acea46 - Expands on the previous commit to allow SIM-Start without identity requests. I've tested locally and it appears to fix the issue, could you rebuild with HEAD and verify it corrects the problem for you also. -Arran