FreeRADIUS v4 test Segfault

20 Apr 2022

      Hello All,

I started to play with FreeRADIUS v4 and i use the Dockerfile (Debian 11) in order to have the lastest FreeRADIUS v4 version (last commit id) running.

The only thing i changed from the default configuration is the clients.conf file just to add my my source ip:

```
client test {
        ipaddr = 172.17.0.1
        secret = testing123
}
```

I did a simple test with eapol_test with a fake account and it end with a seg fault.

eapol_test -c v4_peap_user.conf -s testing123 -a 172.17.0.1 -M de:ad:be:ef:42:42 -N 30:s:00:11:22:33:44:55:UConnect -N4:x:c0a80001

v4_peap_user.conf:

```
network={
        ssid="UConnect"
        key_mgmt=WPA-EAP
        eap=PEAP
        identity="testuser@testuser.ca"
        anonymous_identity="testuser@testuser.ca"
        password="strongestpasswordintheworld"
        phase2="autheap=MSCHAPV2"

        #
        #  Uncomment the following to perform server certificate validation.
#       ca_cert="/etc/raddb/certs/ca.der"
}
```

```
(6.0)      eap.peap - Virtual server (null) received request
(6.0)      eap.peap -   EAP-Identity = "testuser@testuser.ca"
(6.0)      eap.peap -   EAP-Type = PEAP
(6.0)      eap.peap - server (null) {
CAUGHT SIGNAL: Segmentation fault
Backtrace of last 2 frames:
/opt/freeradius/lib/libfreeradius-util.so(fr_fault+0xe8)[0x7f6ea5a1106b]
/lib/x86_64-linux-gnu/libpthread.so.0(+0x14140)[0x7f6ea5797140]
No panic action set
_EXIT(139) CALLED src/lib/util/debug.c[1052]
```

Not sure what happen exactly, but can it be a configuration issue or is it too early to start to test FreeRADIUS 4 ?

Thanks
Regards
Fabrice

```

root@d8616b73313c:/opt/freeradius# ./sbin/radiusd -X
Info  : FreeRADIUS Version 4.0.0
Info  : Copyright 1999-2022 The FreeRADIUS server project and contributors
Info  : There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
Info  : PARTICULAR PURPOSE
Info  : You may redistribute copies of FreeRADIUS under the terms of the
Info  : GNU General Public License
Info  : For more information about these matters, see the file named COPYRIGHT
Getting debug state failed: ptrace capability not set.  If debugger detection is required run as root or: setcap cap_sys_ptrace+ep <path_to_binary>
Info  : Starting - reading configuration files ...
Debug : Including dictionary file "/opt/freeradius/etc/raddb/dictionary"
including configuration file /opt/freeradius/etc/raddb/radiusd.conf
Including files in directory "/opt/freeradius/etc/raddb/template.d/"
including configuration file /opt/freeradius/etc/raddb/template.d/default
including configuration file /opt/freeradius/etc/raddb/clients.conf
Including files in directory "/opt/freeradius/etc/raddb/mods-enabled/"
including configuration file /opt/freeradius/etc/raddb/mods-enabled/always
including configuration file /opt/freeradius/etc/raddb/mods-enabled/attr_filter
including configuration file /opt/freeradius/etc/raddb/mods-enabled/cache_eap
including configuration file /opt/freeradius/etc/raddb/mods-enabled/chap
including configuration file /opt/freeradius/etc/raddb/mods-enabled/client
including configuration file /opt/freeradius/etc/raddb/mods-enabled/delay
including configuration file /opt/freeradius/etc/raddb/mods-enabled/detail
including configuration file /opt/freeradius/etc/raddb/mods-enabled/detail.log
including configuration file /opt/freeradius/etc/raddb/mods-enabled/digest
including configuration file /opt/freeradius/etc/raddb/mods-enabled/eap
including configuration file /opt/freeradius/etc/raddb/mods-enabled/eap_inner
including configuration file /opt/freeradius/etc/raddb/mods-enabled/echo
including configuration file /opt/freeradius/etc/raddb/mods-enabled/escape
including configuration file /opt/freeradius/etc/raddb/mods-enabled/exec
including configuration file /opt/freeradius/etc/raddb/mods-enabled/expr
including configuration file /opt/freeradius/etc/raddb/mods-enabled/files
including configuration file /opt/freeradius/etc/raddb/mods-enabled/linelog
including configuration file /opt/freeradius/etc/raddb/mods-enabled/logintime
including configuration file /opt/freeradius/etc/raddb/mods-enabled/mschap
including configuration file /opt/freeradius/etc/raddb/mods-enabled/ntlm_auth
including configuration file /opt/freeradius/etc/raddb/mods-enabled/pap
including configuration file /opt/freeradius/etc/raddb/mods-enabled/passwd
including configuration file /opt/freeradius/etc/raddb/mods-enabled/radutmp
including configuration file /opt/freeradius/etc/raddb/mods-enabled/soh
including configuration file /opt/freeradius/etc/raddb/mods-enabled/sradutmp
including configuration file /opt/freeradius/etc/raddb/mods-enabled/stats
including configuration file /opt/freeradius/etc/raddb/mods-enabled/unix
including configuration file /opt/freeradius/etc/raddb/mods-enabled/unpack
including configuration file /opt/freeradius/etc/raddb/mods-enabled/utf8
Including files in directory "/opt/freeradius/etc/raddb/policy.d/"
including configuration file /opt/freeradius/etc/raddb/policy.d/abfab-tr
including configuration file /opt/freeradius/etc/raddb/policy.d/accounting
including configuration file /opt/freeradius/etc/raddb/policy.d/canonicalisation
including configuration file /opt/freeradius/etc/raddb/policy.d/control
including configuration file /opt/freeradius/etc/raddb/policy.d/cui
including configuration file /opt/freeradius/etc/raddb/policy.d/debug
including configuration file /opt/freeradius/etc/raddb/policy.d/dhcp
including configuration file /opt/freeradius/etc/raddb/policy.d/eap
including configuration file /opt/freeradius/etc/raddb/policy.d/filter
including configuration file /opt/freeradius/etc/raddb/policy.d/operator-name
including configuration file /opt/freeradius/etc/raddb/policy.d/tacacs
including configuration file /opt/freeradius/etc/raddb/policy.d/time
including configuration file /opt/freeradius/etc/raddb/policy.d/vendor
Including files in directory "/opt/freeradius/etc/raddb/sites-enabled/"
including configuration file /opt/freeradius/etc/raddb/sites-enabled/default
Loaded module "process_radius"
Loaded module "proto_radius"
including configuration file /opt/freeradius/etc/raddb/sites-enabled/inner-tunnel
Parsing security rules to bootstrap UID / GID / chroot / etc.
main {
  prefix = /opt/freeradius
  security {
    allow_core_dumps = no
    allow_vulnerable_openssl = yes
    openssl_fips_mode = no
  }
  name = radiusd
  local_state_dir = "/opt/freeradius/var"
  run_dir = /opt/freeradius/var/run/radiusd
}
Parsing main configuration.
main {
  server default {
    namespace = radius
    radius {
      Access-Request {
        log {
          stripped_names = no
          auth = no
          auth_badpass = no
          auth_goodpass = no
          msg_denied = "You are already logged in - access denied"
        }
        session {
          timeout = 15
          max = 4096
        }
      }
    }
    listen {
      type = Access-Request
      type = Status-Server
      transport = udp
Loaded module "proto_radius_udp"
      udp {
        ipaddr = *
        port = 1812
        networks {
          allow = 127/8
          allow = 192.0.2/24
        }
        max_packet_size = 4096
        max_attributes = 255
      }
      limit {
        cleanup_delay = 5.068619887
        idle_timeout = 60.068619887
        nak_lifetime = 30.068619887
        max_connections = 256
        max_clients = 256
        max_pending_packets = 256
      }
      priority {
        Access-Request = high
        Accounting-Request = low
        CoA-Request = normal
        Disconnect-Request = low
        Status-Server = now
      }
    }
    listen {
      type = Access-Request
      type = Status-Server
      transport = tcp
Loaded module "proto_radius_tcp"
      tcp {
        ipaddr = *
        port = 1812
        networks {
          allow = 127/8
          allow = 192.0.2/24
        }
        max_packet_size = 4096
        max_attributes = 255
      }
      limit {
        cleanup_delay = 16.70678144
        idle_timeout = 36.719805145
        nak_lifetime = 37.379572924
        max_connections = 1024
        max_clients = 256
        max_pending_packets = 256
      }
      priority {
        Access-Request = high
        Accounting-Request = low
        CoA-Request = normal
        Disconnect-Request = low
        Status-Server = now
      }
    }
    listen {
      type = Accounting-Request
      transport = udp
      udp {
        ipaddr = *
        port = 1813
        networks {
        }
        max_packet_size = 4096
        max_attributes = 255
      }
      limit {
        cleanup_delay = 21.384014109
        idle_timeout = 41.397037814
        nak_lifetime = 42.056805593
        max_connections = 1024
        max_clients = 256
        max_pending_packets = 256
      }
      priority {
        Access-Request = high
        Accounting-Request = low
        CoA-Request = normal
        Disconnect-Request = low
        Status-Server = now
      }
    }
  }
  server inner-tunnel {
    namespace = radius
    radius {
      Access-Request {
        log {
          stripped_names = no
          auth = no
          auth_badpass = no
          auth_goodpass = no
          msg_denied = "You are already logged in - access denied"
        }
        session {
          timeout = 15
          max = 4096
        }
      }
    }
    listen {
      type = Access-Request
      transport = udp
      udp {
        ipaddr = 127.0.0.1
        port = 18120
        networks {
        }
        max_packet_size = 4096
        max_attributes = 255
      }
      limit {
        cleanup_delay = 16.966142743
        idle_timeout = 36.979166448
        nak_lifetime = 37.638934227
        max_connections = 1024
        max_clients = 256
        max_pending_packets = 256
      }
      priority {
        Access-Request = high
        Accounting-Request = low
        CoA-Request = normal
        Disconnect-Request = low
        Status-Server = now
      }
    }
  }
  security {
  }
  sbin_dir = "/opt/freeradius/sbin"
  logdir = /opt/freeradius/var/log/radius
  radacctdir = /opt/freeradius/var/log/radius/radacct
  reverse_lookups = no
  hostname_lookups = yes
  max_request_time = 30
  pidfile = /opt/freeradius/var/run/radiusd/radiusd.pid
  debug_level = 0
  max_requests = 16384
  log {
    colourise = yes
  }
  resources {
  }
  thread pool {
    num_networks = 1
    num_workers = 0
Setting thread.workers = 2
    openssl_async_pool_init = 64
    openssl_async_pool_max = 1024
  }
}
Switching to configured log settings
radiusd: #### Loading Clients ####
  client localhost {
    ipaddr = 127.0.0.1
    require_message_authenticator = no
    dedup_authenticator = no
    secret = <<< secret >>>
    proto = *
    limit {
      max_connections = 16
      lifetime = 0
      idle_timeout = 30
    }
  }
  client localhost_ipv6 {
    ipv6addr = ::1
    require_message_authenticator = no
    dedup_authenticator = no
    secret = <<< secret >>>
    limit {
      max_connections = 16
      lifetime = 0
      idle_timeout = 30
    }
  }
  client test {
    ipaddr = 172.17.0.1
    require_message_authenticator = no
    dedup_authenticator = no
    secret = <<< secret >>>
    limit {
      max_connections = 16
      lifetime = 0
      idle_timeout = 30
    }
  }
Debug state unknown (cap_sys_ptrace capability not set)
systemd watchdog is disabled
pre-suid-down capabilities: cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap=ep
trigger { ... } subsection not found, triggers will be disabled
#### Bootstrapping listeners ####
    client localhost {
      ipaddr = 192.0.2.1
      require_message_authenticator = no
      dedup_authenticator = no
      secret = <<< secret >>>
      shortname = sample
      limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
      }
    }
Creating Auth-Type = pap
Creating Auth-Type = chap
Creating Auth-Type = mschap
Creating Auth-Type = digest
Creating Auth-Type = ldap
Creating Auth-Type = eap
#### Bootstrapping modules ####
 modules {
Loaded module "rlm_always"
    always reject {
      rcode = reject
      simulcount = 0
      mpp = no
    }
Bootstrapping module "reject"
    always fail {
      rcode = fail
      simulcount = 0
      mpp = no
    }
Bootstrapping module "fail"
    always ok {
      rcode = ok
      simulcount = 0
      mpp = no
    }
Bootstrapping module "ok"
    always handled {
      rcode = handled
      simulcount = 0
      mpp = no
    }
Bootstrapping module "handled"
    always invalid {
      rcode = invalid
      simulcount = 0
      mpp = no
    }
Bootstrapping module "invalid"
    always disallow {
      rcode = disallow
      simulcount = 0
      mpp = no
    }
Bootstrapping module "disallow"
    always notfound {
      rcode = notfound
      simulcount = 0
      mpp = no
    }
Bootstrapping module "notfound"
    always noop {
      rcode = noop
      simulcount = 0
      mpp = no
    }
Bootstrapping module "noop"
    always updated {
      rcode = updated
      simulcount = 0
      mpp = no
    }
Bootstrapping module "updated"
Loaded module "rlm_attr_filter"
    attr_filter attr_filter.pre-proxy {
      filename = /opt/freeradius/etc/raddb/mods-config/attr_filter/pre-proxy
      key = "%{Realm}"
      relaxed = no
    }
    attr_filter attr_filter.post-proxy {
      filename = /opt/freeradius/etc/raddb/mods-config/attr_filter/post-proxy
      key = "%{Realm}"
      relaxed = no
    }
    attr_filter attr_filter.access_reject {
      filename = /opt/freeradius/etc/raddb/mods-config/attr_filter/access_reject
      key = "%{User-Name}"
      relaxed = no
    }
    attr_filter attr_filter.access_challenge {
      filename = /opt/freeradius/etc/raddb/mods-config/attr_filter/access_challenge
      key = "%{User-Name}"
      relaxed = no
    }
    attr_filter attr_filter.accounting_response {
      filename = /opt/freeradius/etc/raddb/mods-config/attr_filter/accounting_response
      key = "%{User-Name}"
      relaxed = no
    }
Loaded module "rlm_cache"
    cache cache_eap {
      driver = rbtree
Loaded module "rlm_cache_rbtree"
      key = "%{%{control.State}:-%{%{reply.State}:-%{State}}}"
      ttl = 15
      max_entries = 0
      epoch = 0
      add_stats = no
    }
Bootstrapping module "cache_eap"
Loaded module "rlm_chap"
Loaded module "rlm_client"
Loaded module "rlm_delay"
    delay {
      delay = 1.0
      relative = no
      force_reschedule = no
    }
Bootstrapping module "delay"
    delay delay_reject {
      delay = "%{%{reply.FreeRADIUS-Response-Delay}:-1}"
      relative = yes
      force_reschedule = no
    }
Bootstrapping module "delay_reject"
Loaded module "rlm_detail"
    detail {
      filename = /opt/freeradius/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y-%m-%d
      header = "%t"
      permissions = 384
      locking = no
      escape_filenames = no
      log_packet_header = no
    }
    detail auth_log {
      filename = /opt/freeradius/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y-%m-%d
      header = "%t"
      permissions = 384
      locking = no
      escape_filenames = no
      log_packet_header = no
    }
    detail reply_log {
      filename = /opt/freeradius/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y-%m-%d
      header = "%t"
      permissions = 384
      locking = no
      escape_filenames = no
      log_packet_header = no
    }
    detail pre_proxy_log {
      filename = /opt/freeradius/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y-%m-%d
      header = "%t"
      permissions = 384
      locking = no
      escape_filenames = no
      log_packet_header = no
    }
    detail post_proxy_log {
      filename = /opt/freeradius/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y-%m-%d
      header = "%t"
      permissions = 384
      locking = no
      escape_filenames = no
      log_packet_header = no
    }
Loaded module "rlm_digest"
Loaded module "rlm_eap"
    eap {
      require_identity_realm = nai
      type = md5
Loaded module "rlm_eap_md5"
      type = gtc
Loaded module "rlm_eap_gtc"
      gtc {
        challenge = "Password: "
        auth_type = PAP
      }
      type = tls
Loaded module "rlm_eap_tls"
      tls {
        tls = tls-common
        require_client_cert = yes
        include_length = yes
      }
      type = ttls
Loaded module "rlm_eap_ttls"
      ttls {
        tls = tls-common
        virtual_server = "inner-tunnel"
        include_length = yes
        require_client_cert = no
      }
      type = mschapv2
Loaded module "rlm_eap_mschapv2"
      mschapv2 {
        with_ntdomain_hack = no
        auth_type = mschap
        send_error = no
      }
      type = peap
Loaded module "rlm_eap_peap"
      peap {
        tls = tls-common
        virtual_server = "inner-tunnel"
        soh = no
        require_client_cert = no
      }
      ignore_unknown_eap_types = no
    }
Bootstrapping module "eap"
    eap inner-eap {
      require_identity_realm = nai
      default_eap_type = mschapv2
      type = md5
      type = gtc
      gtc {
        challenge = "Password: "
        auth_type = PAP
      }
      type = mschapv2
      mschapv2 {
        with_ntdomain_hack = no
        auth_type = mschap
        send_error = no
      }
      type = tls
      tls {
        tls = tls-peer
        require_client_cert = yes
        include_length = yes
      }
      ignore_unknown_eap_types = no
    }
Bootstrapping module "inner-eap"
Loaded module "rlm_exec"
    exec echo {
      wait = yes
      program = "/bin/echo Tmp-String-0 := %{User-Name}"
      input_pairs = request
      output_pairs = reply
      shell_escape = yes
      env_inherit = no
    }
Bootstrapping module "echo"
Loaded module "rlm_escape"
    escape {
      safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ"
    }
Bootstrapping module "escape"
    exec {
      wait = yes
      input_pairs = request
      shell_escape = yes
      env_inherit = no
      timeout = 10
    }
Bootstrapping module "exec"
Loaded module "rlm_expr"
Bootstrapping module "expr"
Loaded module "rlm_files"
    files {
      filename = /opt/freeradius/etc/raddb/mods-config/files/authorize
      acctusersfile = /opt/freeradius/etc/raddb/mods-config/files/accounting
      key = "%{%{Stripped-User-Name}:-%{User-Name}}"
    }
Loaded module "rlm_linelog"
    linelog {
      destination = file
      delimiter = "\n"
      format = "This is a log message for %{User-Name}"
      reference = "messages.%{%{reply.Packet-Type}:-default}"
      file {
        filename = /opt/freeradius/var/log/radius/linelog
        permissions = 384
        escape_filenames = no
      }
      syslog {
        severity = "info"
      }
      unix {
      }
      tcp {
        server = localhost IPv4 address [127.0.0.1]
        port = 514
        timeout = 7.284352243
      }
      udp {
        server = localhost IPv4 address [127.0.0.1]
        port = 514
        timeout = 4.749470769
      }
    }
    linelog log_accounting {
      destination = file
      delimiter = "\n"
      format = ""
      reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}"
      file {
        filename = /opt/freeradius/var/log/radius/linelog-accounting
        permissions = 384
        escape_filenames = no
      }
      syslog {
        severity = "info"
      }
      unix {
      }
      tcp {
        timeout = 1000
      }
      udp {
        timeout = 1000
      }
    }
Loaded module "rlm_logintime"
    logintime {
      minimum_timeout = 60
    }
Loaded module "rlm_mschap"
    mschap {
      normalise = yes
      use_mppe = yes
      require_encryption = no
      require_strong = no
      with_ntdomain_hack = yes
      passchange {
      }
      allow_retry = yes
      winbind {
        retry_with_normalised_username = no
      }
    }
Bootstrapping module "mschap"
    exec ntlm_auth {
      wait = yes
      program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%(mschap:User-Name) --password=%{User-Password}"
      shell_escape = yes
      env_inherit = no
    }
Bootstrapping module "ntlm_auth"
Loaded module "rlm_pap"
    pap {
      normalise = yes
    }
Loaded module "rlm_passwd"
    passwd etc_passwd {
      filename = /etc/passwd
      format = "*User-Name:Crypt-Password:"
      delimiter = ":"
      ignore_nislike = no
      ignore_empty = yes
      allow_multiple_keys = no
      hash_size = 100
    }
Loaded module "rlm_radutmp"
    radutmp {
      filename = /opt/freeradius/var/log/radius/radutmp
      username = "%{User-Name}"
      check_with_nas = yes
      permissions = 384
      caller_id = no
    }
Loaded module "rlm_soh"
    soh {
      dhcp = yes
    }
Bootstrapping module "soh"
    radutmp sradutmp {
      filename = /opt/freeradius/var/log/radius/sradutmp
      username = "%{User-Name}"
      check_with_nas = yes
      permissions = 420
      caller_id = no
    }
Loaded module "rlm_stats"
    stats {
    }
Loaded module "rlm_unix"
    unix {
    }
Bootstrapping module "unix"
Creating attribute Unix-Group
Loaded module "rlm_unpack"
Bootstrapping module "unpack"
Loaded module "rlm_utf8"
 } # modules
#### Instantiating listeners ####
Compiling policies in server default { ... }
Compiling policies in - recv Access-Request {...}
/opt/freeradius/etc/raddb/sites-enabled/default[795]: Ignoring "-sql" as the "sql" module is not enabled.
/opt/freeradius/etc/raddb/sites-enabled/default[811]: Ignoring "-ldap" as the "ldap" module is not enabled.
Compiling policies in - send Access-Accept {...}
/opt/freeradius/etc/raddb/sites-enabled/default[1122]: Ignoring "-sql" as the "sql" module is not enabled.
Compiling policies in - send Access-Challenge {...}
Compiling policies in - send Access-Reject {...}
/opt/freeradius/etc/raddb/sites-enabled/default[1239]: Ignoring "-sql" as the "sql" module is not enabled.
Compiling policies in - recv Accounting-Request {...}
Compiling policies in - send Accounting-Response {...}
/opt/freeradius/etc/raddb/sites-enabled/default[1458]: Ignoring "-sql" as the "sql" module is not enabled.
Compiling policies in - recv Status-Server {...}
Compiling policies in - authenticate pap {...}
Compiling policies in - authenticate chap {...}
Compiling policies in - authenticate mschap {...}
Compiling policies in - authenticate digest {...}
Compiling policies in - authenticate ldap {...}
/opt/freeradius/etc/raddb/sites-enabled/default[981]: Ignoring "-ldap" as the "ldap" module is not enabled.
Compiling policies in - authenticate eap {...}
Compiling policies in - accounting Start {...}
Compiling policies in - accounting Stop {...}
Compiling policies in - accounting Alive {...}
Compiling policies in - accounting Accounting-On {...}
Compiling policies in - accounting Accounting-Off {...}
Compiling policies in - accounting Failed {...}
/opt/freeradius/etc/raddb/sites-enabled/default[80]: radius  { ... } section is unused
Compiling policies in server inner-tunnel { ... }
Compiling policies in - recv Access-Request {...}
/opt/freeradius/etc/raddb/sites-enabled/inner-tunnel[124]: Ignoring "-sql" as the "sql" module is not enabled.
/opt/freeradius/etc/raddb/sites-enabled/inner-tunnel[134]: Ignoring "-ldap" as the "ldap" module is not enabled.
Compiling policies in - send Access-Accept {...}
/opt/freeradius/etc/raddb/sites-enabled/inner-tunnel[269]: Ignoring "-sql" as the "sql" module is not enabled.
Compiling policies in - send Access-Reject {...}
/opt/freeradius/etc/raddb/sites-enabled/inner-tunnel[304]: Ignoring "-sql" as the "sql" module is not enabled.
Compiling policies in - authenticate pap {...}
Compiling policies in - authenticate chap {...}
Compiling policies in - authenticate mschap {...}
Compiling policies in - authenticate eap {...}
src/lib/server/virtual_servers.c[380]: radius  { ... } section is unused
#### Instantiating modules ####
Instantiating module "attr_filter.access_challenge"
Reading file /opt/freeradius/etc/raddb/mods-config/attr_filter/access_challenge
Instantiating module "attr_filter.access_reject"
Reading file /opt/freeradius/etc/raddb/mods-config/attr_filter/access_reject
Instantiating module "attr_filter.accounting_response"
Reading file /opt/freeradius/etc/raddb/mods-config/attr_filter/accounting_response
Instantiating module "attr_filter.post-proxy"
Reading file /opt/freeradius/etc/raddb/mods-config/attr_filter/post-proxy
Instantiating module "attr_filter.pre-proxy"
Reading file /opt/freeradius/etc/raddb/mods-config/attr_filter/pre-proxy
Instantiating module "auth_log"
auth_log - 'User-Password' suppressed, will not appear in detail output
Instantiating module "cache_eap"
Instantiating module "chap"
Instantiating module "detail"
Instantiating module "digest"
Instantiating module "disallow"
Instantiating module "eap"
Instantiating module "echo"
Instantiating module "etc_passwd"
Instantiating module "exec"
Instantiating module "fail"
Instantiating module "files"
Reading file /opt/freeradius/etc/raddb/mods-config/files/authorize
Reading file /opt/freeradius/etc/raddb/mods-config/files/accounting
Instantiating module "handled"
Instantiating module "inner-eap"
inner-eap - Failed to find 'authenticate inner-eap {...}' section.  EAP authentication will likely not work
Instantiating module "invalid"
Instantiating module "linelog"
Instantiating module "log_accounting"
Instantiating module "logintime"
Instantiating module "mschap"
mschap - Using internal authentication
Instantiating module "noop"
Instantiating module "notfound"
Instantiating module "ntlm_auth"
Instantiating module "ok"
Instantiating module "pap"
Instantiating module "post_proxy_log"
Instantiating module "pre_proxy_log"
Instantiating module "reject"
Instantiating module "reply_log"
Instantiating module "stats"
Instantiating module "updated"
Instantiating module "cache_eap.rbtree"
Instantiating module "eap.mschapv2"
Instantiating module "eap.peap"
      tls-config tls-common {
        chain rsa {
          format = pem
          certificate_file = /opt/freeradius/etc/raddb/certs/rsa/server.pem
          private_key_password = <<< secret >>>
          private_key_file = /opt/freeradius/etc/raddb/certs/rsa/server.key
          ca_file = /opt/freeradius/etc/raddb/certs/rsa/ca.pem
          verify_mode = hard
          include_root_ca = no
        }
        verify_depth = 0
        ca_path = /opt/freeradius/etc/raddb/certs
        ca_file = /opt/freeradius/etc/raddb/certs/rsa/ca.pem
        dh_file = /opt/freeradius/etc/raddb/certs/dh
        fragment_size = 1024
        cipher_list = "DEFAULT"
        cipher_server_preference = yes
        allow_renegotiation = no
        ecdh_curve = prime256v1
        tls_min_version = 1.200000
        session {
          mode = auto
          name = "%{EAP-Type}%{Virtual-Server}"
          lifetime = 86400
          require_extended_master_secret = yes
          require_perfect_forward_secrecy = no
        }
        verify {
          mode = all
          attribute_mode = client-and-issuer
          check_crl = no
        }
      }
tls - A virtual_server must be provided for stateful caching. cache.mode = "auto" rewritten to cache.mode = "stateless"
Instantiating module "eap.tls"
tls - Using cached TLS configuration from previous invocation
Instantiating module "eap.ttls"
tls - Using cached TLS configuration from previous invocation
Instantiating module "inner-eap.mschapv2"
Instantiating module "inner-eap.tls"
      tls-config tls-peer {
        chain {
          format = pem
          certificate_file = /opt/freeradius/etc/raddb/certs/rsa/server.pem
          private_key_password = <<< secret >>>
          private_key_file = /opt/freeradius/etc/raddb/certs/rsa/server.key
          ca_file = /opt/freeradius/etc/raddb/certs/rsa/ca.pem
          verify_mode = hard
          include_root_ca = no
        }
        verify_depth = 0
        ca_path = /opt/freeradius/etc/raddb/certs
        ca_file = /opt/freeradius/etc/raddb/certs/rsa/ca.pem
        dh_file = /opt/freeradius/etc/raddb/certs/dh
        fragment_size = 16384
        cipher_server_preference = yes
        allow_renegotiation = no
        ecdh_curve = "prime256v1"
        tls_min_version = 1.200000
        session {
          mode = auto
          name = "%{EAP-Type}%{Virtual-Server}"
          lifetime = 86400
          require_extended_master_secret = yes
          require_perfect_forward_secrecy = no
        }
        verify {
          mode = all
          attribute_mode = client-and-issuer
          check_crl = no
        }
      }
tls - A virtual_server must be provided for stateful caching. cache.mode = "auto" rewritten to cache.mode = "stateless"
Scheduler created in single-threaded mode
#### Opening listener interfaces ####
Listening on radius_udp server * port 1812 bound to virtual server default
Listening on radius_tcp server * port 1812 bound to virtual server default
Listening on radius_udp server * port 1813 bound to virtual server default
Listening on radius_udp server 127.0.0.1 port 18120 bound to virtual server inner-tunnel
post-suid-down capabilities: cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap=ep
Ready to process requests
proto_radius_udp - Received Access-Request ID 0 length 182 radius_udp server * port 1812
Worker - Resetting cleanup timer to +30
(0)  default {
(0)    Received Access-Request ID 0 from 172.17.0.1:49022 to 172.17.0.2:1812 via eth0 
(0)      User-Name = "testuser@testuser.ca"
(0)      Calling-Station-Id = "DE-AD-BE-EF-42-42"
(0)      Framed-MTU = 1400
(0)      NAS-Port-Type = Wireless-802.11
(0)      Service-Type = Framed-User
(0)      Connect-Info = "CONNECT 11Mbps 802.11b"
(0)      Called-Station-Id = "00:11:22:33:44:55:UConnect"
(0)      NAS-IP-Address = 192.168.0.1
(0)      EAP-Message = 0x02e100190174657374757365724074657374757365722e6361
(0)      Message-Authenticator = 0x0974fe1b57a5e18d67d63ebca3cca28b
(0)      Packet-Type = Access-Request
(0)    Running 'recv Access-Request' from file /opt/freeradius/etc/raddb/sites-enabled/default
(0)    recv Access-Request {
(0)      policy filter_username {
(0)        if (&State) {
(0)          ...
(0)        }
(0)        elsif (&User-Name) {
(0)          if (&User-Name =~ / /) {
(0)            ...
(0)          }
(0)          if (&User-Name =~ /@[^@]*@/ ) {
(0)            ...
(0)          }
(0)          if (&User-Name =~ /\.\./ ) {
(0)            ...
(0)          }
(0)          if ((&User-Name =~ /@/) && (&User-Name !~ /@[^.]+(\.[^.]+)+$/)) {
(0)            ...
(0)          }
(0)          if (&User-Name =~ /\.$/) {
(0)            ...
(0)          }
(0)          if (&User-Name =~ /@\./) {
(0)            ...
(0)          }
(0)          update session-state {
(0)            &Session-State-User-Name := &User-Name -> "testuser@testuser.ca"
(0)          } # update session-state (noop)
(0)        } # elsif (&User-Name) (noop)
(0)      } # policy filter_username (noop)
(0)      chap (noop)
(0)      mschap (noop)
(0)      digest (noop)
(0)      eap - Peer sent EAP Response (code 2) ID 225 length 25
(0)      eap - Peer sent EAP-Identity.  Returning 'ok' so we can short-circuit the rest of authorize
(0)      eap - Setting &control.Auth-Type = eap
(0)      eap (ok)
(0)    } # recv Access-Request (ok)
(0)    radius - Running 'authenticate eap' from file /opt/freeradius/etc/raddb/sites-enabled/default
(0)    authenticate eap {
(0)      eap - New EAP session started
(0)      eap - Peer sent packet with EAP method Identity (1)
(0)      eap - Calling submodule eap_md5
(0)      subrequest {
(0.0)      eap.md5 - Issuing MD5 Challenge
(0.0)      eap.md5 (handled)
(0)        subrequest - Resuming execution
(0)      } # subrequest (noop)
(0)      eap - Sending EAP Request (code 1) ID 226 length 22
(0)      eap (handled)
(0)    } # authenticate eap (handled)
(0)    radius - Running 'send Access-Challenge' from file /opt/freeradius/etc/raddb/sites-enabled/default
(0)    send Access-Challenge {
(0)      attr_filter.access_challenge - EXPAND %{User-Name}
(0)      attr_filter.access_challenge -   --> testuser@testuser.ca
(0)      attr_filter.access_challenge -    --> testuser@testuser.ca
(0)      attr_filter.access_challenge - Matched entry DEFAULT at line 12
(0)      attr_filter.access_challenge.post-auth (updated)
(0)      handled (handled)
(0)    } # send Access-Challenge (handled)
(0)    radius - Saving &session-state
(0)    radius -   &session-state.Session-State-User-Name = "testuser@testuser.ca"
(0)    radius (ok)
(0)  } # default (ok)
(0)  Done request
(0)  Sending Access-Challenge ID 0 from 172.17.0.2:1812 to 172.17.0.1:49022 length 80 via socket radius_udp server * port 1812
(0)    EAP-Message = 0x01e200160410cf1c6b1980299aa0d90419f575e2436d
(0)    Message-Authenticator = 0x00000000000000000000000000000000
(0)    State = 0x01018d0013280e7289558d518d7bb3b9
(0)    Packet-Type = Access-Challenge
(0)  Finished request
proto_radius_udp - cleaning up request in 5.068620s
proto_radius_udp - Received Access-Request ID 1 length 181 radius_udp server * port 1812
(1)  default {
(1)    Received Access-Request ID 1 from 172.17.0.1:49022 to 172.17.0.2:1812 via eth0 
(1)      User-Name = "testuser@testuser.ca"
(1)      Calling-Station-Id = "DE-AD-BE-EF-42-42"
(1)      Framed-MTU = 1400
(1)      NAS-Port-Type = Wireless-802.11
(1)      Service-Type = Framed-User
(1)      Connect-Info = "CONNECT 11Mbps 802.11b"
(1)      Called-Station-Id = "00:11:22:33:44:55:UConnect"
(1)      NAS-IP-Address = 192.168.0.1
(1)      EAP-Message = 0x02e200060319
(1)      State = 0x01018d0013280e7289558d518d7bb3b9
(1)      Message-Authenticator = 0x497720a6d791a595ceaa6044754cf031
(1)      Packet-Type = Access-Request
(1)    Restored &session-state
(1)      &session-state.Session-State-User-Name = "testuser@testuser.ca"
(1)    Running 'recv Access-Request' from file /opt/freeradius/etc/raddb/sites-enabled/default
(1)    recv Access-Request {
(1)      policy filter_username {
(1)        if (&State) {
(1)          if (&User-Name) {
(1)            if (!&session-state.Session-State-User-Name) {
(1)              ...
(1)            }
(1)            if (&User-Name != &session-state.Session-State-User-Name) {
(1)              ...
(1)            }
(1)          } # if (&User-Name) (noop)
(1)        } # if (&State) (noop)
(1)      } # policy filter_username (noop)
(1)      chap (noop)
(1)      mschap (noop)
(1)      digest (noop)
(1)      eap - Peer sent EAP Response (code 2) ID 226 length 6
(1)      eap - Continuing on-going EAP conversation
(1)      eap - Setting &control.Auth-Type = eap
(1)      eap (updated)
(1)      files - EXPAND %{Stripped-User-Name}
(1)      files -   --> 
(1)      files - EXPAND %{User-Name}
(1)      files -   --> testuser@testuser.ca
(1)      files - EXPAND %{%{Stripped-User-Name}:-%{User-Name}}
(1)      files -   --> testuser@testuser.ca
(1)      files (noop)
(1)      policy expiration {
(1)        if (&control.Expiration) {
(1)          ...
(1)        }
(1)      } # policy expiration (updated)
(1)      logintime (noop)
(1)      pap (noop)
(1)    } # recv Access-Request (updated)
(1)    radius - Running 'authenticate eap' from file /opt/freeradius/etc/raddb/sites-enabled/default
(1)    authenticate eap {
(1)      eap - Continuing EAP session
(1)      eap - Peer sent packet with EAP method NAK (3)
(1)      eap - Calling submodule eap_peap
(1)      subrequest {
(1.0)      eap.peap - Initiating new TLS session
(1.0)      eap.peap - EXPAND %{EAP-Type}
(1.0)      eap.peap -   --> PEAP
(1.0)      eap.peap - EXPAND %{Virtual-Server}
(1.0)      eap.peap -   --> 
(1.0)      eap.peap (handled)
(1)        subrequest - Resuming execution
(1)      } # subrequest (noop)
(1)      eap - Sending EAP Request (code 1) ID 227 length 6
(1)      eap (handled)
(1)    } # authenticate eap (handled)
(1)    radius - Running 'send Access-Challenge' from file /opt/freeradius/etc/raddb/sites-enabled/default
(1)    send Access-Challenge {
(1)      attr_filter.access_challenge - EXPAND %{User-Name}
(1)      attr_filter.access_challenge -   --> testuser@testuser.ca
(1)      attr_filter.access_challenge -    --> testuser@testuser.ca
(1)      attr_filter.access_challenge - Matched entry DEFAULT at line 12
(1)      attr_filter.access_challenge.post-auth (updated)
(1)      handled (handled)
(1)    } # send Access-Challenge (handled)
(1)    radius - Saving &session-state
(1)    radius -   &session-state.Session-State-User-Name = "testuser@testuser.ca"
(1)    radius (ok)
(1)  } # default (ok)
(1)  Done request
(1)  Sending Access-Challenge ID 1 from 172.17.0.2:1812 to 172.17.0.1:49022 length 64 via socket radius_udp server * port 1812
(1)    EAP-Message = 0x01e300061920
(1)    Message-Authenticator = 0x00000000000000000000000000000000
(1)    State = 0x02038d008bd3a65c89558d518d7bb3b9
(1)    Packet-Type = Access-Challenge
(1)  Finished request
proto_radius_udp - cleaning up request in 5.068620s
proto_radius_udp - Received Access-Request ID 2 length 375 radius_udp server * port 1812
(2)  default {
(2)    Received Access-Request ID 2 from 172.17.0.1:49022 to 172.17.0.2:1812 via eth0 
(2)      User-Name = "testuser@testuser.ca"
(2)      Calling-Station-Id = "DE-AD-BE-EF-42-42"
(2)      Framed-MTU = 1400
(2)      NAS-Port-Type = Wireless-802.11
(2)      Service-Type = Framed-User
(2)      Connect-Info = "CONNECT 11Mbps 802.11b"
(2)      Called-Station-Id = "00:11:22:33:44:55:UConnect"
(2)      NAS-IP-Address = 192.168.0.1
(2)      EAP-Message = 0x02e300c81980000000be16030100b9010000b5030340c75eff9a2146e20efd7538a0308ec6ed2d6df3a09d48d5f53abb65ccdaf553000038c02cc030009fcca9cca8ccaac02bc02f009ec024c028006bc023c0270067c00ac0140039c009c0130033009d009c003d003c0035002f00ff01000054000b000403000102000a000c000a001d0017001e001900180016000000170000000d0030002e040305030603080708080809080a080b080408050806040105010601030302030301020103020202040205020602
(2)      State = 0x02038d008bd3a65c89558d518d7bb3b9
(2)      Message-Authenticator = 0xf0aedc9cd95dfc616efb7c16b85ac4ca
(2)      Packet-Type = Access-Request
(2)    Restored &session-state
(2)      &session-state.Session-State-User-Name = "testuser@testuser.ca"
(2)    Running 'recv Access-Request' from file /opt/freeradius/etc/raddb/sites-enabled/default
(2)    recv Access-Request {
(2)      policy filter_username {
(2)        if (&State) {
(2)          if (&User-Name) {
(2)            if (!&session-state.Session-State-User-Name) {
(2)              ...
(2)            }
(2)            if (&User-Name != &session-state.Session-State-User-Name) {
(2)              ...
(2)            }
(2)          } # if (&User-Name) (noop)
(2)        } # if (&State) (noop)
(2)      } # policy filter_username (noop)
(2)      chap (noop)
(2)      mschap (noop)
(2)      digest (noop)
(2)      eap - Peer sent EAP Response (code 2) ID 227 length 200
(2)      eap - Continuing tunnel setup
(2)      eap - Setting &control.Auth-Type = eap
(2)      eap (ok)
(2)    } # recv Access-Request (ok)
(2)    radius - Running 'authenticate eap' from file /opt/freeradius/etc/raddb/sites-enabled/default
(2)    authenticate eap {
(2)      eap - Continuing EAP session
(2)      eap - Peer sent packet with EAP method PEAP (25)
(2)      eap - Calling submodule eap_peap
(2)      subrequest {
(2.0)      eap.peap - Continuing EAP-TLS
(2.0)      eap.peap - Peer indicated complete TLS record size will be 190 bytes
(2.0)      eap.peap - Got complete TLS record, with length field (190 bytes)
(2.0)      eap.peap - [eap-tls verify] = complete
(2.0)      Handshake state - before SSL initialization (0)
(2.0)      Handshake state - Server before SSL initialization (0)
(2.0)      Handshake state - Server before SSL initialization (0)
(2.0)      <<< recv TLS 1.3, handshake[length 185], client_hello
(2.0)      Allowing future session-resumption
(2.0)      Handshake state - Server SSLv3/TLS read client hello (20)
(2.0)      >>> send TLS 1.2, handshake[length 61], server_hello
(2.0)      Handshake state - Server SSLv3/TLS write server hello (22)
(2.0)      >>> send TLS 1.2, handshake[length 1397], certificate
(2.0)      Handshake state - Server SSLv3/TLS write certificate (23)
(2.0)      >>> send TLS 1.2, handshake[length 333], server_key_exchange
(2.0)      Handshake state - Server SSLv3/TLS write key exchange (24)
(2.0)      >>> send TLS 1.2, handshake[length 4], server_hello_done
(2.0)      Handshake state - Server SSLv3/TLS write server done (26)
(2.0)      Need more data from client
(2.0)      SSL_read (tls_session_async_handshake_cont) - SSL_ERROR_WANT_READ (2)
(2.0)      Complete TLS record (1815 bytes) larger than MTU (990 bytes), will fragment
(2.0)      Sending first TLS record fragment (990 bytes), 825 bytes remaining
(2.0)      eap.peap - [eap-tls process] = handled
(2.0)      eap.peap (handled)
(2)        subrequest - Resuming execution
(2)      } # subrequest (noop)
(2)      eap - Sending EAP Request (code 1) ID 228 length 1000
(2)      eap (handled)
(2)    } # authenticate eap (handled)
(2)    radius - Running 'send Access-Challenge' from file /opt/freeradius/etc/raddb/sites-enabled/default
(2)    send Access-Challenge {
(2)      attr_filter.access_challenge - EXPAND %{User-Name}
(2)      attr_filter.access_challenge -   --> testuser@testuser.ca
(2)      attr_filter.access_challenge -    --> testuser@testuser.ca
(2)      attr_filter.access_challenge - Matched entry DEFAULT at line 12
(2)      attr_filter.access_challenge.post-auth (updated)
(2)      handled (handled)
(2)    } # send Access-Challenge (handled)
(2)    radius - Saving &session-state
(2)    radius -   &session-state.Session-State-User-Name = "testuser@testuser.ca"
(2)    radius (ok)
(2)  } # default (ok)
(2)  Done request
(2)  Sending Access-Challenge ID 2 from 172.17.0.2:1812 to 172.17.0.1:49022 length 1064 via socket radius_udp server * port 1812
(2)    EAP-Message = 0x01e403e819c000000717160303003d020000390303d477d2cab8c6e912f6ef31ac9b07c9c80d7ba2779e10ab73444f574e4752440100c030000011ff01000100000b0004030001020017000016030305750b00057100056e00056b308205673082044fa003020102020101300d06092a864886f70d01010b0500308192310b3009060355040613024652310f300d06035504080c065261646975733112301006035504070c09536f6d65776865726531143012060355040a0c0b4578616d706c6520496e633120301e06092a864886f70d010901161161646d696e406578616d706c652e6f72673126302406035504030c1d4578616d706c6520436572746966696361746520417574686f72697479301e170d3232303431323134303733385a170d3232303631313134303733385a307b310b3009060355040613024652310f300d06035504080c0652616469757331143012060355040a0c0b4578616d706c6520496e633123302106035504030c1a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e6f726730820122300d06092a864886f70d01010105000382010f003082010a0282010100e2eae82feaa1c197c639331ba5b8dd5320f9a880088620953e3bceb947e3df8192158f5ee6544cc63104c322da2f345ea14c23892f10cdfb888707e06e0b968be0f322858e5c0c30811986d836886b88b210bd23fcb8eae1a2ff65608d1c799927a4dfaf5401e9b793698ab6ff9193fdf193d18e972b89adb1c07d8f1be784e7d8540fe70bfa8a23bb6cea24aec8a7611c6121b1fd4550fbd927595b66038f972be2508ee3e9cb8ec388e9fa7ea7ff4ef6284767d66ea3cf9c56f31480ae767300aba7e448d1b8158f354023508eac4e9e8dd8643229620e09ff1d74001dc4302ee4d343d49c52bf7b66d54cecf9b232fb46e78a31087f39bb2a8d7b6a139b6d0203010001a38201dc308201d8301d0603551d0e0416041431dc74562239f150d15fd33ce06d6189473c69f63081d20603551d230481ca3081c780147ddde3d24fb7f2c6258d40079b632740a6d36deda18198a48195308192310b3009060355040613024652310f300d06035504080c065261646975733112301006035504070c09536f6d65776865726531143012060355040a0c0b4578616d706c6520496e633120301e06092a864886f70d010901161161646d696e406578616d706c652e6f72673126302406035504030c1d4578616d706c6520436572746966696361746520417574686f7269747982146a1367d2f5e1005ae876ac00c9def9da9e3c943830090603551d1304023000300b0603551d0f0404030205e0301d
(2)    Message-Authenticator = 0x00000000000000000000000000000000
(2)    State = 0x03018d0013280e7289558d518d7bb3b9
(2)    Packet-Type = Access-Challenge
(2)  Finished request
proto_radius_udp - cleaning up request in 5.068620s
proto_radius_udp - Received Access-Request ID 3 length 181 radius_udp server * port 1812
(3)  default {
(3)    Received Access-Request ID 3 from 172.17.0.1:49022 to 172.17.0.2:1812 via eth0 
(3)      User-Name = "testuser@testuser.ca"
(3)      Calling-Station-Id = "DE-AD-BE-EF-42-42"
(3)      Framed-MTU = 1400
(3)      NAS-Port-Type = Wireless-802.11
(3)      Service-Type = Framed-User
(3)      Connect-Info = "CONNECT 11Mbps 802.11b"
(3)      Called-Station-Id = "00:11:22:33:44:55:UConnect"
(3)      NAS-IP-Address = 192.168.0.1
(3)      EAP-Message = 0x02e400061900
(3)      State = 0x03018d0013280e7289558d518d7bb3b9
(3)      Message-Authenticator = 0x6828bc2a6be551813cfe294e29a7817d
(3)      Packet-Type = Access-Request
(3)    Restored &session-state
(3)      &session-state.Session-State-User-Name = "testuser@testuser.ca"
(3)    Running 'recv Access-Request' from file /opt/freeradius/etc/raddb/sites-enabled/default
(3)    recv Access-Request {
(3)      policy filter_username {
(3)        if (&State) {
(3)          if (&User-Name) {
(3)            if (!&session-state.Session-State-User-Name) {
(3)              ...
(3)            }
(3)            if (&User-Name != &session-state.Session-State-User-Name) {
(3)              ...
(3)            }
(3)          } # if (&User-Name) (noop)
(3)        } # if (&State) (noop)
(3)      } # policy filter_username (noop)
(3)      chap (noop)
(3)      mschap (noop)
(3)      digest (noop)
(3)      eap - Peer sent EAP Response (code 2) ID 228 length 6
(3)      eap - Continuing tunnel setup
(3)      eap - Setting &control.Auth-Type = eap
(3)      eap (ok)
(3)    } # recv Access-Request (ok)
(3)    radius - Running 'authenticate eap' from file /opt/freeradius/etc/raddb/sites-enabled/default
(3)    authenticate eap {
(3)      eap - Continuing EAP session
(3)      eap - Peer sent packet with EAP method PEAP (25)
(3)      eap - Calling submodule eap_peap
(3)      subrequest {
(3.0)      eap.peap - Continuing EAP-TLS
(3.0)      eap.peap - Peer ACKed our handshake fragment
(3.0)      eap.peap - [eap-tls verify] = request
(3.0)      eap.peap - Sending final TLS record fragment (825 bytes)
(3.0)      eap.peap - [eap-tls process] = handled
(3.0)      eap.peap (handled)
(3)        subrequest - Resuming execution
(3)      } # subrequest (noop)
(3)      eap - Sending EAP Request (code 1) ID 229 length 831
(3)      eap (handled)
(3)    } # authenticate eap (handled)
(3)    radius - Running 'send Access-Challenge' from file /opt/freeradius/etc/raddb/sites-enabled/default
(3)    send Access-Challenge {
(3)      attr_filter.access_challenge - EXPAND %{User-Name}
(3)      attr_filter.access_challenge -   --> testuser@testuser.ca
(3)      attr_filter.access_challenge -    --> testuser@testuser.ca
(3)      attr_filter.access_challenge - Matched entry DEFAULT at line 12
(3)      attr_filter.access_challenge.post-auth (updated)
(3)      handled (handled)
(3)    } # send Access-Challenge (handled)
(3)    radius - Saving &session-state
(3)    radius -   &session-state.Session-State-User-Name = "testuser@testuser.ca"
(3)    radius (ok)
(3)  } # default (ok)
(3)  Done request
(3)  Sending Access-Challenge ID 3 from 172.17.0.2:1812 to 172.17.0.1:49022 length 895 via socket radius_udp server * port 1812
(3)    EAP-Message = 0x01e5033f19000603551d250416301406082b0601050507030106082b0601050507030e30360603551d1f042f302d302ba029a0278625687474703a2f2f7777772e6578616d706c652e636f6d2f6578616d706c655f63612e63726c303706082b06010505070101042b3029302706082b06010505073001861b687474703a2f2f7777772e6578616d706c652e6f72672f6f637370303a0603551d110433303182127261646975732e6578616d706c652e6f7267a01b06082b06010505070808a00f0c0d2a2e6578616d706c652e636f6d300d06092a864886f70d01010b05000382010100678d89096e6b3e48248e71e584e9faf3aa8098dd75bf170fb9cb754086997897441c3e72dee297dfa73c153d203c2eda6a06d403b12732d3ac8f7bbf64c20c3be5a9580892abc692368bf68b3cc31bf41a175cf374e0d3bcef0f9fcda4bda7b33544c7e5a4170bb3345bf5f385a54ae974fb97c862dcc35ea0f116efedcc7ac4b89bc2db453dada5ba77f16d5c8b9c5dbd2e8dfb65400cc3f1e14ad9789a83ba32fc6304f7f4f07ad99f3a73cd4faab8cc2131e9b906a46395530d28b0ec95148f7a210853bdfa024623c6ecb41d5c9f20cf27b56a8d40885d7fd81afe4aef185e58819100ac5aee5e20c08333dbad3e16750472614ca278405106d1986fa3f4160303014d0c000149030017410476028412e9b00c2630154399c78ae7b787ed8f87e0a714cbe3b3dc73651afbbe104b6b0e49f83cf27fec9379764f4bab6ba48ca1dc415068fd1bd69e671a421e0804010049f912f96ead536a287d6ff62c6bdf45cf0671b73f530402157bc31789aa3352ac7d72803bc668fee51eb8a6c01eb064f51c003a34284e120f5d856b50c705050c0c04b126f5783f5ac4b7f137109225c2da4cd612e8ace939012af571bc0acc70f25d4dfcdd52c5f741ace11c7cba85e3c0920b935fe920a54db3b056c7434f21a0e4b14cff035d445ff2ceca367a6446120dff3e1aa93190360d07a22cb9bf9503255989d9fd4459fd20486ed1af4082df96acd9516b2c6c4c4e1d57af8675796d98c09424751707adcfb9871438aac2527d1edcfc402c6b08ba52c4b196fffda00564b7d6cfe8c5875e6119914bada29860db0bd4ad3cf5cf75851a5aaeed16030300040e000000
(3)    Message-Authenticator = 0x00000000000000000000000000000000
(3)    State = 0x04078d008bd3a65c89558d518d7bb3b9
(3)    Packet-Type = Access-Challenge
(3)  Finished request
proto_radius_udp - cleaning up request in 5.068620s
proto_radius_udp - Received Access-Request ID 4 length 311 radius_udp server * port 1812
(4)  default {
(4)    Received Access-Request ID 4 from 172.17.0.1:49022 to 172.17.0.2:1812 via eth0 
(4)      User-Name = "testuser@testuser.ca"
(4)      Calling-Station-Id = "DE-AD-BE-EF-42-42"
(4)      Framed-MTU = 1400
(4)      NAS-Port-Type = Wireless-802.11
(4)      Service-Type = Framed-User
(4)      Connect-Info = "CONNECT 11Mbps 802.11b"
(4)      Called-Station-Id = "00:11:22:33:44:55:UConnect"
(4)      NAS-IP-Address = 192.168.0.1
(4)      EAP-Message = 0x02e5008819800000007e1603030046100000424104af5f0fd9357c5f1ef85c44412ded07130f03214653071decbdd2423cb8d921a4f1fc02b262f63b1ac40dee0720d86e6327a0240932586a76dd4827c434e3bf0e1403030001011603030028f54dfcc389a7197acb64f4cac2ddd2e4602d8a8909d86a71b151adc37da7fa6fbf1625581506cb05
(4)      State = 0x04078d008bd3a65c89558d518d7bb3b9
(4)      Message-Authenticator = 0x5321739cd526678d61b3d552e3ea2aa0
(4)      Packet-Type = Access-Request
(4)    Restored &session-state
(4)      &session-state.Session-State-User-Name = "testuser@testuser.ca"
(4)    Running 'recv Access-Request' from file /opt/freeradius/etc/raddb/sites-enabled/default
(4)    recv Access-Request {
(4)      policy filter_username {
(4)        if (&State) {
(4)          if (&User-Name) {
(4)            if (!&session-state.Session-State-User-Name) {
(4)              ...
(4)            }
(4)            if (&User-Name != &session-state.Session-State-User-Name) {
(4)              ...
(4)            }
(4)          } # if (&User-Name) (noop)
(4)        } # if (&State) (noop)
(4)      } # policy filter_username (noop)
(4)      chap (noop)
(4)      mschap (noop)
(4)      digest (noop)
(4)      eap - Peer sent EAP Response (code 2) ID 229 length 136
(4)      eap - Continuing tunnel setup
(4)      eap - Setting &control.Auth-Type = eap
(4)      eap (ok)
(4)    } # recv Access-Request (ok)
(4)    radius - Running 'authenticate eap' from file /opt/freeradius/etc/raddb/sites-enabled/default
(4)    authenticate eap {
(4)      eap - Continuing EAP session
(4)      eap - Peer sent packet with EAP method PEAP (25)
(4)      eap - Calling submodule eap_peap
(4)      subrequest {
(4.0)      eap.peap - Continuing EAP-TLS
(4.0)      eap.peap - Peer indicated complete TLS record size will be 126 bytes
(4.0)      eap.peap - Got complete TLS record, with length field (126 bytes)
(4.0)      eap.peap - [eap-tls verify] = complete
(4.0)      Handshake state - Server SSLv3/TLS write server done (26)
(4.0)      <<< recv TLS 1.2, handshake[length 70], client_key_exchange
(4.0)      Handshake state - Server SSLv3/TLS read client key exchange (28)
(4.0)      Handshake state - Server SSLv3/TLS read change cipher spec (31)
(4.0)      <<< recv TLS 1.2, handshake[length 16], finished
(4.0)      Handshake state - Server SSLv3/TLS read finished (32)
(4.0)      >>> send TLS 1.2, change_cipher_spec[length 1]
(4.0)      Handshake state - Server SSLv3/TLS write change cipher spec (35)
(4.0)      >>> send TLS 1.2, handshake[length 16], finished
(4.0)      Handshake state - Server SSLv3/TLS write finished (36)
(4.0)      Handshake state - SSL negotiation finished successfully (1)
(4.0)      SSL_read (tls_session_async_handshake_cont) - SSL_ERROR_WANT_READ (2)
(4.0)      Cipher suite: ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD 
(4.0)      Adding TLS session information to request
(4.0)        &session-state.TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384"
(4.0)        &session-state.TLS-Session-Version := "TLS 1.2"
(4.0)      Sending complete TLS record (51 bytes)
(4.0)      eap.peap - [eap-tls process] = handled
(4.0)      eap.peap (handled)
(4)        subrequest - Resuming execution
(4)      } # subrequest (noop)
(4)      eap - Sending EAP Request (code 1) ID 230 length 57
(4)      eap (handled)
(4)    } # authenticate eap (handled)
(4)    radius - Running 'send Access-Challenge' from file /opt/freeradius/etc/raddb/sites-enabled/default
(4)    send Access-Challenge {
(4)      attr_filter.access_challenge - EXPAND %{User-Name}
(4)      attr_filter.access_challenge -   --> testuser@testuser.ca
(4)      attr_filter.access_challenge -    --> testuser@testuser.ca
(4)      attr_filter.access_challenge - Matched entry DEFAULT at line 12
(4)      attr_filter.access_challenge.post-auth (updated)
(4)      handled (handled)
(4)    } # send Access-Challenge (handled)
(4)    radius - Saving &session-state
(4)    radius -   &session-state.Session-State-User-Name = "testuser@testuser.ca"
(4)    radius (ok)
(4)  } # default (ok)
(4)  Done request
(4)  Sending Access-Challenge ID 4 from 172.17.0.2:1812 to 172.17.0.1:49022 length 115 via socket radius_udp server * port 1812
(4)    EAP-Message = 0x01e600391900140303000101160303002855e89feef9aefa2d98c2a520be9d5ba60e5becc07fd359d0f164a8ac94bb6c198ab372d7cf082a1f
(4)    Message-Authenticator = 0x00000000000000000000000000000000
(4)    State = 0x05018d0013280e7289558d518d7bb3b9
(4)    Packet-Type = Access-Challenge
(4)  Finished request
proto_radius_udp - cleaning up request in 5.068620s
proto_radius_udp - Received Access-Request ID 5 length 181 radius_udp server * port 1812
(5)  default {
(5)    Received Access-Request ID 5 from 172.17.0.1:49022 to 172.17.0.2:1812 via eth0 
(5)      User-Name = "testuser@testuser.ca"
(5)      Calling-Station-Id = "DE-AD-BE-EF-42-42"
(5)      Framed-MTU = 1400
(5)      NAS-Port-Type = Wireless-802.11
(5)      Service-Type = Framed-User
(5)      Connect-Info = "CONNECT 11Mbps 802.11b"
(5)      Called-Station-Id = "00:11:22:33:44:55:UConnect"
(5)      NAS-IP-Address = 192.168.0.1
(5)      EAP-Message = 0x02e600061900
(5)      State = 0x05018d0013280e7289558d518d7bb3b9
(5)      Message-Authenticator = 0xaa9bd0de2ab4c9a24039a10d8964adf3
(5)      Packet-Type = Access-Request
(5)    Restored &session-state
(5)      &session-state.Session-State-User-Name = "testuser@testuser.ca"
(5)    Running 'recv Access-Request' from file /opt/freeradius/etc/raddb/sites-enabled/default
(5)    recv Access-Request {
(5)      policy filter_username {
(5)        if (&State) {
(5)          if (&User-Name) {
(5)            if (!&session-state.Session-State-User-Name) {
(5)              ...
(5)            }
(5)            if (&User-Name != &session-state.Session-State-User-Name) {
(5)              ...
(5)            }
(5)          } # if (&User-Name) (noop)
(5)        } # if (&State) (noop)
(5)      } # policy filter_username (noop)
(5)      chap (noop)
(5)      mschap (noop)
(5)      digest (noop)
(5)      eap - Peer sent EAP Response (code 2) ID 230 length 6
(5)      eap - Continuing tunnel setup
(5)      eap - Setting &control.Auth-Type = eap
(5)      eap (ok)
(5)    } # recv Access-Request (ok)
(5)    radius - Running 'authenticate eap' from file /opt/freeradius/etc/raddb/sites-enabled/default
(5)    authenticate eap {
(5)      eap - Continuing EAP session
(5)      eap - Peer sent packet with EAP method PEAP (25)
(5)      eap - Calling submodule eap_peap
(5)      subrequest {
(5.0)      eap.peap - Continuing EAP-TLS
(5.0)      eap.peap - Peer ACKed our handshake fragment.  handshake is finished
(5.0)      eap.peap - [eap-tls verify] = established
(5.0)      eap.peap - [eap-tls process] = established
(5.0)      eap.peap - Session established.  Decoding tunneled data
(5.0)      eap.peap - PEAP state TUNNEL ESTABLISHED
(5.0)      eap.peap - TLS application data to encrypt (5 bytes)
(5.0)      eap.peap - Sending complete TLS record (34 bytes)
(5.0)      eap.peap (handled)
(5)        subrequest - Resuming execution
(5)      } # subrequest (noop)
(5)      eap - Sending EAP Request (code 1) ID 231 length 40
(5)      eap (handled)
(5)    } # authenticate eap (handled)
(5)    radius - Running 'send Access-Challenge' from file /opt/freeradius/etc/raddb/sites-enabled/default
(5)    send Access-Challenge {
(5)      attr_filter.access_challenge - EXPAND %{User-Name}
(5)      attr_filter.access_challenge -   --> testuser@testuser.ca
(5)      attr_filter.access_challenge -    --> testuser@testuser.ca
(5)      attr_filter.access_challenge - Matched entry DEFAULT at line 12
(5)      attr_filter.access_challenge.post-auth (updated)
(5)      handled (handled)
(5)    } # send Access-Challenge (handled)
(5)    radius - Saving &session-state
(5)    radius -   &session-state.Session-State-User-Name = "testuser@testuser.ca"
(5)    radius (ok)
(5)  } # default (ok)
(5)  Done request
(5)  Sending Access-Challenge ID 5 from 172.17.0.2:1812 to 172.17.0.1:49022 length 98 via socket radius_udp server * port 1812
(5)    EAP-Message = 0x01e700281900170303001d55e89feef9aefa2eddf781269ef2298c0b711bd2d99a629cc468e62cca
(5)    Message-Authenticator = 0x00000000000000000000000000000000
(5)    State = 0x06038d008bd3a65c89558d518d7bb3b9
(5)    Packet-Type = Access-Challenge
(5)  Finished request
proto_radius_udp - cleaning up request in 5.068620s
proto_radius_udp - Received Access-Request ID 6 length 231 radius_udp server * port 1812
(6)  default {
(6)    Received Access-Request ID 6 from 172.17.0.1:49022 to 172.17.0.2:1812 via eth0 
(6)      User-Name = "testuser@testuser.ca"
(6)      Calling-Station-Id = "DE-AD-BE-EF-42-42"
(6)      Framed-MTU = 1400
(6)      NAS-Port-Type = Wireless-802.11
(6)      Service-Type = Framed-User
(6)      Connect-Info = "CONNECT 11Mbps 802.11b"
(6)      Called-Station-Id = "00:11:22:33:44:55:UConnect"
(6)      NAS-IP-Address = 192.168.0.1
(6)      EAP-Message = 0x02e700381900170303002df54dfcc389a7197b019fe17a87ecd0b81c18c14ca1e4037c6fe4b296706a65ddb4acef536fc00eb2744373cacb
(6)      State = 0x06038d008bd3a65c89558d518d7bb3b9
(6)      Message-Authenticator = 0xf56634caef4bef32092ba0e149273533
(6)      Packet-Type = Access-Request
(6)    Restored &session-state
(6)      &session-state.Session-State-User-Name = "testuser@testuser.ca"
(6)    Running 'recv Access-Request' from file /opt/freeradius/etc/raddb/sites-enabled/default
(6)    recv Access-Request {
(6)      policy filter_username {
(6)        if (&State) {
(6)          if (&User-Name) {
(6)            if (!&session-state.Session-State-User-Name) {
(6)              ...
(6)            }
(6)            if (&User-Name != &session-state.Session-State-User-Name) {
(6)              ...
(6)            }
(6)          } # if (&User-Name) (noop)
(6)        } # if (&State) (noop)
(6)      } # policy filter_username (noop)
(6)      chap (noop)
(6)      mschap (noop)
(6)      digest (noop)
(6)      eap - Peer sent EAP Response (code 2) ID 231 length 56
(6)      eap - Continuing tunnel setup
(6)      eap - Setting &control.Auth-Type = eap
(6)      eap (ok)
(6)    } # recv Access-Request (ok)
(6)    radius - Running 'authenticate eap' from file /opt/freeradius/etc/raddb/sites-enabled/default
(6)    authenticate eap {
(6)      eap - Continuing EAP session
(6)      eap - Peer sent packet with EAP method PEAP (25)
(6)      eap - Calling submodule eap_peap
(6)      subrequest {
(6.0)      eap.peap - Continuing EAP-TLS
(6.0)      eap.peap - Got complete TLS record (50 bytes)
(6.0)      eap.peap - [eap-tls verify] = complete
(6.0)      eap.peap - Decrypted TLS application data (21 bytes)
(6.0)      eap.peap - [eap-tls process] = complete
(6.0)      eap.peap - Session established.  Decoding tunneled data
(6.0)      eap.peap - PEAP state WAITING FOR INNER IDENTITY
(6.0)      eap.peap - Received EAP-Identity-Response
(6.0)      eap.peap - Got inner identity "testuser@testuser.ca"
(6.0)      eap.peap - Got tunneled request
(6.0)      eap.peap -   EAP-Message = 0x02e700190174657374757365724074657374757365722e6361
(6.0)      eap.peap - Setting &request.User-Name from tunneled (inner) identity "testuser@testuser.ca"
(6.0)      eap.peap - Running request through virtual server "(null)"
(6.0)      eap.peap - Virtual server (null) received request
(6.0)      eap.peap -   EAP-Identity = "testuser@testuser.ca"
(6.0)      eap.peap -   EAP-Type = PEAP
(6.0)      eap.peap - server (null) {
CAUGHT SIGNAL: Segmentation fault
Backtrace of last 2 frames:
/opt/freeradius/lib/libfreeradius-util.so(fr_fault+0xe8)[0x7f6ea5a1106b]
/lib/x86_64-linux-gnu/libpthread.so.0(+0x14140)[0x7f6ea5797140]
No panic action set
_EXIT(139) CALLED src/lib/util/debug.c[1052]
```

Fabrice Durand
Software Engineer Principal
Office: +1.514.447.4918Akamai Technologies
7000 Parc Avenue 
Montreal, QC H3N1X1 Canada
Connect with Us:

Fabrice Durand

Alan DeKok

tags

participants (2)