FreeRadius + FreeBSD + ipv6
Hi I'm busy with a FreeRadius Eduroam setup, but it only works with ipv4 and not with ipv6. My Setup: wifi-client <--> my-FreeRadius-proxy <---> eduroam-proxy <---> remote-site My server: FreeBSD 8.1-STABLE with freeradius-2.1.10_1 that was build from the ports, with ipv6 enabled. Here is a list of things that I've noticed when I run radiusd -X Regards Johann ------------------------------------------------------------------------------------------------------------ 1) FreeRadius with only an ipv4 listen section in radiusd.conf. (no ipv6) #listen { # type = auth # ipv6addr = :: # port = 0 #} ganymede# sockstat | grep 1812 freeradius radiusd 61076 5 udp4 *:1812 *:* FreeRadius tries to send Access-Request packets to the ipv6 address of edurom- proxy-server (eduroam0.sanren.ac.za) when I use it's dns name in proxy.conf. Sending Access-Request of id 172 to 2001:4200:ffff:14:5054:17ff:fe36:5d3d port 1812 User-Name = "nren_radius_test@ru.ac.za" NAS-IP-Address = 146.64.25.55 Called-Station-Id = "0016b6d9211b" Calling-Station-Id = "0015af8e3baa" NAS-Identifier = "0016b6d9211b" NAS-Port = 31 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200001e016e72656e5f7261646975735f746573744072752e61632e7a61 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x30 It works fine if I use the ipv4 address (no dns) for eduroam0.sanren.ac.za. ------------------------------------------------------------------------------------------------------------ 2) FreeRadius with both an ipv4 and an ipv6 listen section in radiusd.conf. listen { type = auth ipv6addr = :: port = 0 } ganymede# sockstat | grep 1812 freeradius radiusd 61076 5 udp4 *:1812 *:* freeradius radiusd 61076 6 udp6 *:1812 *:* Running radiusd -X I can see it tries to send out ipv6 requests. Sending Access-Request of id 229 to 2001:4200:ffff:14:5054:17ff:fe36:5d3d port 1812 User-Name = "nren_radius_test@ru.ac.za" NAS-IP-Address = 146.64.25.55 Called-Station-Id = "0016b6d9211b" Calling-Station-Id = "0015af8e3baa" NAS-Identifier = "0016b6d9211b" NAS-Port = 31 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201001e016e72656e5f7261646975735f746573744072752e61632e7a61 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x30 But I don't see anyting with tcpdump. After a while I get the following message in radiusd: WARNING: Internal sanity check failed in event handler for request 13: Discarding the request! Ready to process requests. ------------------------------------------------------------------------------------------------------------ 3) FreeRadius with both an ipv4 and an ipv6 listen section in radiusd.conf, but with a specific ipv6 address configured. listen { type = auth ipv6addr = 2001:4200:ffff:14:5054:17ff:fe36:5d3d port = 0 } radiusd -X stops with the following error: Failed binding to authentication address 2001:4200:ffff:14:5054:17ff:fe36:5d3d port 1812: Can't assign requested address /usr/local/etc/raddb/radiusd.conf[32]: Error binding to port for 2001:4200:ffff:14:5054:17ff:fe36:5d3d port 1812 ----------------------------------------------------------------------------------------------------------------- ## radiusd.conf -- FreeRADIUS server configuration file. ###################################################################### prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct name = radiusd confdir = ${raddbdir} run_dir = ${localstatedir}/run/${name} db_dir = ${raddbdir} libdir = /usr/local/lib/freeradius-2.1.9 pidfile = ${run_dir}/${name}.pid user = freeradius group = freeradius max_request_time = 30 cleanup_delay = 5 max_requests = 1024 listen { type = auth ipaddr = * port = 0 } listen { type = auth #ipaddr = * ipv6addr = :: #ipv6addr = 2001:4200:ffff:14:5054:17ff:fe36:5d3d port = 0 } listen { type = acct ipaddr = * # ipv6addr = :: port = 0 } hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no auth = no auth_badpass = no auth_goodpass = no } checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { $INCLUDE ${confdir}/modules/ $INCLUDE ${confdir}/eap.conf } instantiate { exec expr expiration logintime } $INCLUDE policy.conf $INCLUDE sites-enabled/ ######################################################################
Excerpts from Johann Hugo's message of Mon Dec 06 09:01:09 +0000 2010:
I'm busy with a FreeRadius Eduroam setup, but it only works with ipv4 and not with ipv6.
You seem to be using the same ipv6 address for your proxy as well as for the eduroam proxy; is that intentional?
From example 1:
Sending Access-Request of id 172 to 2001:4200:ffff:14:5054:17ff:fe36:5d3d port 1812
From example 3:
listen { type = auth ipv6addr = 2001:4200:ffff:14:5054:17ff:fe36:5d3d port = 0 }
If not, then it would explain why you do not see anything in your tcpdump on an interface, because it's being delivered locally, and why it works when you bind to ::, because it just binds to a different address than the one you think you should be using.
Failed binding to authentication address 2001:4200:ffff:14:5054:17ff:fe36:5d3d port 1812: Can't assign requested address /usr/local/etc/raddb/radiusd.conf[32]: Error binding to port for 2001:4200:ffff:14:5054:17ff:fe36:5d3d port 1812
Maybe that just isn't your local address. $ ping6 -c1 eduroam0.sanren.ac.za PING eduroam0.sanren.ac.za(2001:4200:ffff:14:5054:17ff:fe36:5d3d) 56 data bytes 64 bytes from 2001:4200:ffff:14:5054:17ff:fe36:5d3d: icmp_seq=1 ttl=56 time=236 ms Resolves correctly for the eduroam proxy. Cheers, t -- Thorsten Fischer, BOWL Project Administrator <thorsten@net.t-labs.tu-berlin.de> Technische Universität Berlin, FG INET, TEL16, 18th floor Ernst-Reuter-Platz 7, 10587 Berlin, Germany Tel: +49 30 835358542, Fax: +49 391 53478347
Oops It should be: ganymede# ifconfig em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500 options=219b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,TSO4,WOL_MAGIC> ether 00:1c:c0:fb:dc:67 inet 146.64.8.17 netmask 0xffffff00 broadcast 146.64.8.255 inet6 fe80::21c:c0ff:fefb:dc67%em0 prefixlen 64 scopeid 0x1 inet6 2001:4200:7000:1:21c:c0ff:fefb:dc67 prefixlen 64 listen { type = auth #ipaddr = * #ipv6addr = :: ipv6addr = 2001:4200:7000:1:21c:c0ff:fefb:dc67 port = 0 } radius -X ... Failed binding to authentication address 2001:4200:7000:1:21c:c0ff:fefb:dc67 port 1812: Can't assign requested address /usr/local/etc/raddb/radiusd.conf[31]: Error binding to port for 2001:4200:7000:1:21c:c0ff:fefb:dc67 port 1812 But this works for radiusd listen { type = auth #ipaddr = * ipv6addr = :: #ipv6addr = 2001:4200:7000:1:21c:c0ff:fefb:dc67 port = 0 } radius -X ... Listening on authentication address * port 1812 Listening on authentication address :: port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. ganymede# sockstat | grep 1812 freeradius radiusd 39438 5 udp4 *:1812 *:* freeradius radiusd 39438 6 udp6 *:1812 *:* But I never see the IPv6 packets going out of the ethernet interface with tcpdump Johann On Monday, December 06, 2010 11:21:05 am Thorsten Fischer wrote:
Excerpts from Johann Hugo's message of Mon Dec 06 09:01:09 +0000 2010:
I'm busy with a FreeRadius Eduroam setup, but it only works with ipv4 and not with ipv6.
You seem to be using the same ipv6 address for your proxy as well as for the eduroam proxy; is that intentional?
From example 1:
Sending Access-Request of id 172 to 2001:4200:ffff:14:5054:17ff:fe36:5d3d port 1812
From example 3:
listen {
type = auth ipv6addr = 2001:4200:ffff:14:5054:17ff:fe36:5d3d port = 0
}
If not, then it would explain why you do not see anything in your tcpdump on an interface, because it's being delivered locally, and why it works when you bind to ::, because it just binds to a different address than the one you think you should be using.
Failed binding to authentication address 2001:4200:ffff:14:5054:17ff:fe36:5d3d port 1812: Can't assign requested address /usr/local/etc/raddb/radiusd.conf[32]: Error binding to port for 2001:4200:ffff:14:5054:17ff:fe36:5d3d port 1812
Maybe that just isn't your local address.
$ ping6 -c1 eduroam0.sanren.ac.za PING eduroam0.sanren.ac.za(2001:4200:ffff:14:5054:17ff:fe36:5d3d) 56 data bytes 64 bytes from 2001:4200:ffff:14:5054:17ff:fe36:5d3d: icmp_seq=1 ttl=56 time=236 ms
Resolves correctly for the eduroam proxy.
Cheers,
t
-- Thorsten Fischer, BOWL Project Administrator <thorsten@net.t-labs.tu-berlin.de> Technische Universität Berlin, FG INET, TEL16, 18th floor Ernst-Reuter-Platz 7, 10587 Berlin, Germany Tel: +49 30 835358542, Fax: +49 391 53478347 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Excerpts from Johann Hugo's message of Mon Dec 06 09:41:40 +0000 2010:
listen { type = auth #ipaddr = * ipv6addr = :: #ipv6addr = 2001:4200:7000:1:21c:c0ff:fefb:dc67 port = 0 }
radius -X ... Listening on authentication address * port 1812 Listening on authentication address :: port 1812
Does it work for you if you bind both, v4 and v6 sockets to specific addresses? I havea a vague recollection that there might be a problem with that, but I cannot find a reference at the moment. Cheers, t -- Thorsten Fischer, BOWL Project Administrator <thorsten@net.t-labs.tu-berlin.de> Technische Universität Berlin, FG INET, TEL16, 18th floor Ernst-Reuter-Platz 7, 10587 Berlin, Germany Tel: +49 30 835358542, Fax: +49 391 53478347
On Monday, December 06, 2010 11:58:21 am Thorsten Fischer wrote:
Excerpts from Johann Hugo's message of Mon Dec 06 09:41:40 +0000 2010:
listen {
type = auth #ipaddr = * ipv6addr = :: #ipv6addr = 2001:4200:7000:1:21c:c0ff:fefb:dc67 port = 0
}
radius -X ... Listening on authentication address * port 1812 Listening on authentication address :: port 1812
Does it work for you if you bind both, v4 and v6 sockets to specific addresses? I havea a vague recollection that there might be a problem with that, but I cannot find a reference at the moment.
It works for ipv4, but not for ipv6 IPv4: listen { type = auth #ipaddr = * ipaddr = 146.64.8.17 port = 0 } radius -X ... Listening on authentication address 146.64.8.17 port 1812 Listening on authentication address :: port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address 146.64.8.17 port 1814 Ready to process requests. IPv6: listen { type = auth #ipaddr = * #ipv6addr = :: ipv6addr = 2001:4200:7000:1:21c:c0ff:fefb:dc67 port = 0 } radius -X ... Failed binding to authentication address 2001:4200:7000:1:21c:c0ff:fefb:dc67 port 1812: Can't assign requested address /usr/local/etc/raddb/radiusd.conf[31]: Error binding to port for 2001:4200:7000:1:21c:c0ff:fefb:dc67 port 1812
Johann Hugo wrote:
radius -X ... Failed binding to authentication address 2001:4200:7000:1:21c:c0ff:fefb:dc67 port 1812: Can't assign requested address
Try and find out why the OS won't let the server bind to that address. See also the code in src/main/listen.c Maybe there's an issue parsing the IP? Alan DeKok.
On Monday, December 06, 2010 02:05:14 pm Alan DeKok wrote:
Johann Hugo wrote:
radius -X ... Failed binding to authentication address 2001:4200:7000:1:21c:c0ff:fefb:dc67 port 1812: Can't assign requested address
Try and find out why the OS won't let the server bind to that address.
See also the code in src/main/listen.c Maybe there's an issue parsing the IP?
Thanks, but I'm not that good with C code. What I did noticed, is that it works if I specify my link local address: ipv6addr = fe80::21c:c0ff:fefb:dc67%em0 Johann
Hi,
Listening on authentication address * port 1812 Listening on authentication address :: port 1812
Does it work for you if you bind both, v4 and v6 sockets to specific addresses? I havea a vague recollection that there might be a problem with that, but I cannot find a reference at the moment.
ISTR that you cannot listen to v4 and v6 in the same virtual server - setup a new VS with ipv6 listener - its what we do here successfully alan
Hi,
ISTR that you cannot listen to v4 and v6 in the same virtual server -
Hmm... There shouldn't be a problem with that.
dont shoot me, I'm just the messenger! :-) from the current supplied default config file # IP address on which to listen. # Allowed values are: # dotted quad (1.2.3.4) # hostname (radius.example.com) # wildcard (*) ipaddr = * # OR, you can use an IPv6 address, but not both # at the same time. # ipv6addr = :: # any. ::1 == localhost alan
On Monday, December 06, 2010 03:24:28 pm Alan Buxey wrote:
Hi,
ISTR that you cannot listen to v4 and v6 in the same virtual server -
Hmm... There shouldn't be a problem with that.
dont shoot me, I'm just the messenger! :-)
from the current supplied default config file
# IP address on which to listen. # Allowed values are: # dotted quad (1.2.3.4) # hostname (radius.example.com) # wildcard (*) ipaddr = *
# OR, you can use an IPv6 address, but not both # at the same time.
From some other examples that I found it looks like you cannot have both of them in the same listen section, you need to have two separate listen sections in radiusd.conf
listen { type = auth ipaddr = * port = 0 } listen { type = auth ipv6addr = :: port = 0 } Johann
Alan Buxey wrote:
dont shoot me, I'm just the messenger! :-) ... # IP address on which to listen. # Allowed values are: # dotted quad (1.2.3.4) # hostname (radius.example.com) # wildcard (*) ipaddr = *
# OR, you can use an IPv6 address, but not both # at the same time. # ipv6addr = :: # any. ::1 == localhost
I'll clarify that: A network socket can only listen on one IP/port. You can't have one socket listening on two UDP ports, or two TCP ports, or two IP addresses. You *can* have two sockets pointing to the same virtual server. i.e. the following config works Just Fine: listen { ... ipaddr = x ... server = Y } listen { ... ipv6addr = a:b::c::d server = Y } Alan DeKok.
participants (4)
-
Alan Buxey -
Alan DeKok -
Johann Hugo -
Thorsten Fischer