I'll give it a shot. I'm trying to build 1.1.2 with that patch, but I'm having issues when compiling rlm_eap and rlm_eap_tls: gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/root/syssec/reverb/src/include -I../.. -I../../libeap -I/root/syssec/reverb/libltdl -DOPENSSL_NO_KRB5 -c rlm_eap_tls.c -fPIC -DPIC -o .libs/rlm_eap_tls.lo In file included from rlm_eap_tls.h:26, from rlm_eap_tls.c:30: eap_tls.h:163: syntax error before "uint8_t" eap_tls.h:163: warning: no semicolon at end of struct or union eap_tls.h:164: warning: type defaults to `int' in declaration of `data' eap_tls.h:164: warning: data definition has no type or storage class eap_tls.h:165: syntax error before '}' token eap_tls.h:165: warning: type defaults to `int' in declaration of `eaptls_packet_t' eap_tls.h:165: warning: data definition has no type or storage class eap_tls.h:168: syntax error before "uint8_t" eap_tls.h:168: warning: no semicolon at end of struct or union eap_tls.h:169: warning: type defaults to `int' in declaration of `id' eap_tls.h:169: warning: data definition has no type or storage class eap_tls.h:170: syntax error before "length" eap_tls.h:170: warning: type defaults to `int' in declaration of `length' eap_tls.h:170: warning: data definition has no type or storage class eap_tls.h:171: syntax error before "flags" eap_tls.h:171: warning: type defaults to `int' in declaration of `flags' eap_tls.h:171: warning: data definition has no type or storage class eap_tls.h:172: syntax error before '*' token eap_tls.h:172: warning: type defaults to `int' in declaration of `data' eap_tls.h:172: conflicting types for `data' eap_tls.h:164: previous declaration of `data' eap_tls.h:172: warning: redundant redeclaration of `data' in same scope eap_tls.h:164: warning: previous declaration of `data' eap_tls.h:172: warning: data definition has no type or storage class eap_tls.h:173: syntax error before "dlen" eap_tls.h:173: warning: type defaults to `int' in declaration of `dlen' eap_tls.h:173: warning: data definition has no type or storage class eap_tls.h:176: warning: type defaults to `int' in declaration of `EAPTLS_PACKET' eap_tls.h:176: warning: data definition has no type or storage class eap_tls.h:209: syntax error before "SSL_CTX" eap_tls.h:209: warning: no semicolon at end of struct or union eap_tls.h:210: warning: type defaults to `int' in declaration of `eap_tls_t' eap_tls.h:210: warning: data definition has no type or storage class eap_tls.h:214: syntax error before '*' token eap_tls.h:214: warning: type defaults to `int' in declaration of `eaptls_alloc' eap_tls.h:214: warning: data definition has no type or storage class eap_tls.h:215: syntax error before '*' token eap_tls.h:215: warning: function declaration isn't a prototype eap_tls.h:216: syntax error before '*' token eap_tls.h:216: warning: function declaration isn't a prototype eap_tls.h:217: syntax error before '*' token eap_tls.h:217: warning: function declaration isn't a prototype eap_tls.h:221: warning: type defaults to `int' in declaration of `SSL' eap_tls.h:221: syntax error before '*' token eap_tls.h:221: warning: function declaration isn't a prototype eap_tls.h:222: syntax error before "X509_STORE_CTX" eap_tls.h:222: warning: function declaration isn't a prototype eap_tls.h:224: syntax error before "size_t" eap_tls.h:224: warning: function declaration isn't a prototype eap_tls.h:225: syntax error before '*' token eap_tls.h:225: syntax error before '*' token eap_tls.h:225: warning: type defaults to `int' in declaration of `cbtls_rsa' eap_tls.h:225: warning: function declaration isn't a prototype eap_tls.h:225: warning: data definition has no type or storage class eap_tls.h:228: syntax error before '*' token eap_tls.h:228: syntax error before '*' token eap_tls.h:228: warning: type defaults to `int' in declaration of `eaptls_new_session' eap_tls.h:228: warning: function declaration isn't a prototype eap_tls.h:228: warning: data definition has no type or storage class eap_tls.h:229: syntax error before '*' token eap_tls.h:229: warning: function declaration isn't a prototype eap_tls.h:230: syntax error before '*' token eap_tls.h:230: warning: function declaration isn't a prototype eap_tls.h:231: syntax error before '*' token eap_tls.h:231: warning: function declaration isn't a prototype eap_tls.h:235: syntax error before '*' token eap_tls.h:235: warning: function declaration isn't a prototype eap_tls.h:236: syntax error before '*' token eap_tls.h:236: warning: function declaration isn't a prototype eap_tls.h:239: syntax error before '*' token eap_tls.h:239: warning: function declaration isn't a prototype eap_tls.h:240: syntax error before '*' token eap_tls.h:240: warning: function declaration isn't a prototype eap_tls.h:241: syntax error before '*' token eap_tls.h:242: warning: function declaration isn't a prototype eap_tls.h:243: syntax error before '*' token eap_tls.h:244: warning: function declaration isn't a prototype In file included from /root/syssec/reverb/src/include/libradius.h:59, from /root/syssec/reverb/src/include/radiusd.h:10, from rlm_eap_tls.h:28, from rlm_eap_tls.c:30: /root/syssec/reverb/src/include/sha1.h:22: warning: declaration of `data' shadows a global declaration eap_tls.h:172: warning: shadowed declaration is here In file included from /root/syssec/reverb/src/include/radiusd.h:10, from rlm_eap_tls.h:28, from rlm_eap_tls.c:30: /root/syssec/reverb/src/include/libradius.h:187: warning: declaration of `flags' shadows a global declaration eap_tls.h:171: warning: shadowed declaration is here /root/syssec/reverb/src/include/libradius.h:249: warning: declaration of `id' shadows a global declaration eap_tls.h:169: warning: shadowed declaration is here /root/syssec/reverb/src/include/libradius.h:367: warning: declaration of `data' shadows a global declaration eap_tls.h:172: warning: shadowed declaration is here /root/syssec/reverb/src/include/libradius.h:378: warning: declaration of `data' shadows a global declaration eap_tls.h:172: warning: shadowed declaration is here /root/syssec/reverb/src/include/libradius.h:394: warning: declaration of `data' shadows a global declaration eap_tls.h:172: warning: shadowed declaration is here /root/syssec/reverb/src/include/libradius.h:397: warning: declaration of `data' shadows a global declaration eap_tls.h:172: warning: shadowed declaration is here In file included from rlm_eap_tls.c:30: rlm_eap_tls.h:32: redefinition of `struct eap_tls_conf' rlm_eap_tls.h:57: redefinition of `EAP_TLS_CONF' eap_tls.h:203: `EAP_TLS_CONF' previously declared here rlm_eap_tls.h:62: syntax error before "SSL_CTX" rlm_eap_tls.h:62: warning: no semicolon at end of struct or union rlm_eap_tls.h:63: warning: type defaults to `int' in declaration of `eap_tls_t' rlm_eap_tls.h:63: warning: redundant redeclaration of `eap_tls_t' in same scope eap_tls.h:210: warning: previous declaration of `eap_tls_t' rlm_eap_tls.h:63: warning: data definition has no type or storage class rlm_eap_tls.c:79: syntax error before '*' token rlm_eap_tls.c:80: warning: function declaration isn't a prototype rlm_eap_tls.c: In function `load_dh_params': rlm_eap_tls.c:81: `DH' undeclared (first use in this function) rlm_eap_tls.c:81: (Each undeclared identifier is reported only once rlm_eap_tls.c:81: for each function it appears in.) rlm_eap_tls.c:81: `dh' undeclared (first use in this function) rlm_eap_tls.c:82: `BIO' undeclared (first use in this function) rlm_eap_tls.c:82: `bio' undeclared (first use in this function) rlm_eap_tls.c:84: warning: implicit declaration of function `BIO_new_file' rlm_eap_tls.c:84: `file' undeclared (first use in this function) rlm_eap_tls.c:89: warning: implicit declaration of function `PEM_read_bio_DHparams' rlm_eap_tls.c:90: warning: implicit declaration of function `BIO_free' rlm_eap_tls.c:91: warning: implicit declaration of function `SSL_CTX_set_tmp_dh' rlm_eap_tls.c:91: `ctx' undeclared (first use in this function) rlm_eap_tls.c:93: warning: implicit declaration of function `DH_free' rlm_eap_tls.c:97: warning: redundant redeclaration of `DH_free' in same scope rlm_eap_tls.c:93: warning: previous declaration of `DH_free' rlm_eap_tls.c: At top level: rlm_eap_tls.c:104: syntax error before '*' token rlm_eap_tls.c:105: warning: function declaration isn't a prototype rlm_eap_tls.c: In function `generate_eph_rsa_key': rlm_eap_tls.c:106: `RSA' undeclared (first use in this function) rlm_eap_tls.c:106: `rsa' undeclared (first use in this function) rlm_eap_tls.c:108: warning: implicit declaration of function `RSA_generate_key' rlm_eap_tls.c:108: `RSA_F4' undeclared (first use in this function) rlm_eap_tls.c:110: warning: implicit declaration of function `SSL_CTX_set_tmp_rsa' rlm_eap_tls.c:110: `ctx' undeclared (first use in this function) rlm_eap_tls.c:115: warning: implicit declaration of function `RSA_free' rlm_eap_tls.c: At top level: rlm_eap_tls.c:145: syntax error before "X509_STORE_CTX" rlm_eap_tls.c:146: warning: function declaration isn't a prototype rlm_eap_tls.c:146: warning: static declaration for `cbtls_verify' follows non-static rlm_eap_tls.c: In function `cbtls_verify': rlm_eap_tls.c:151: `EAP_HANDLER' undeclared (first use in this function) rlm_eap_tls.c:151: `handler' undeclared (first use in this function) rlm_eap_tls.c:152: `X509' undeclared (first use in this function) rlm_eap_tls.c:152: `client_cert' undeclared (first use in this function) rlm_eap_tls.c:153: `SSL' undeclared (first use in this function) rlm_eap_tls.c:153: `ssl' undeclared (first use in this function) rlm_eap_tls.c:156: `ok' undeclared (first use in this function) rlm_eap_tls.c:158: warning: implicit declaration of function `X509_STORE_CTX_get_current_cert' rlm_eap_tls.c:158: `ctx' undeclared (first use in this function) rlm_eap_tls.c:159: warning: implicit declaration of function `X509_STORE_CTX_get_error' rlm_eap_tls.c:160: warning: implicit declaration of function `X509_STORE_CTX_get_error_depth' rlm_eap_tls.c:164: warning: implicit declaration of function `X509_verify_cert_error_string' rlm_eap_tls.c:164: warning: format argument is not a pointer (arg 4) rlm_eap_tls.c:172: warning: implicit declaration of function `X509_STORE_CTX_get_ex_data' rlm_eap_tls.c:172: warning: implicit declaration of function `SSL_get_ex_data_X509_STORE_CTX_idx' rlm_eap_tls.c:173: syntax error before ')' token rlm_eap_tls.c:174: warning: implicit declaration of function `SSL_get_ex_data' rlm_eap_tls.c:180: warning: implicit declaration of function `X509_NAME_oneline' rlm_eap_tls.c:180: warning: implicit declaration of function `X509_get_subject_name' rlm_eap_tls.c:182: warning: implicit declaration of function `X509_get_issuer_name' rlm_eap_tls.c:191: warning: implicit declaration of function `X509_NAME_get_text_by_NID' rlm_eap_tls.c:192: `NID_commonName' undeclared (first use in this function) rlm_eap_tls.c:197: `X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT' undeclared (first use in this function) rlm_eap_tls.c:200: `X509_V_ERR_CERT_NOT_YET_VALID' undeclared (first use in this function) rlm_eap_tls.c:201: `X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD' undeclared (first use in this function) rlm_eap_tls.c:207: `X509_V_ERR_CERT_HAS_EXPIRED' undeclared (first use in this function) rlm_eap_tls.c:208: `X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD' undeclared (first use in this function) rlm_eap_tls.c: At top level: rlm_eap_tls.c:274: syntax error before '*' token rlm_eap_tls.c:275: warning: return type defaults to `int' rlm_eap_tls.c:275: warning: no previous prototype for `init_tls_ctx' rlm_eap_tls.c: In function `init_tls_ctx': rlm_eap_tls.c:276: `SSL_METHOD' undeclared (first use in this function) rlm_eap_tls.c:276: `meth' undeclared (first use in this function) rlm_eap_tls.c:277: `SSL_CTX' undeclared (first use in this function) rlm_eap_tls.c:277: `ctx' undeclared (first use in this function) rlm_eap_tls.c:278: `X509_STORE' undeclared (first use in this function) rlm_eap_tls.c:278: `certstore' undeclared (first use in this function) rlm_eap_tls.c:279: `SSL_VERIFY_NONE' undeclared (first use in this function) rlm_eap_tls.c:287: warning: implicit declaration of function `SSL_library_init' rlm_eap_tls.c:288: warning: implicit declaration of function `SSL_load_error_strings' rlm_eap_tls.c:290: warning: implicit declaration of function `TLSv1_method' rlm_eap_tls.c:291: warning: implicit declaration of function `SSL_CTX_new' rlm_eap_tls.c:297: `SSL_FILETYPE_PEM' undeclared (first use in this function) rlm_eap_tls.c:299: `SSL_FILETYPE_ASN1' undeclared (first use in this function) rlm_eap_tls.c:306: warning: implicit declaration of function `SSL_CTX_set_default_passwd_cb_userdata' rlm_eap_tls.c:307: warning: implicit declaration of function `SSL_CTX_set_default_passwd_cb' rlm_eap_tls.c:321: warning: implicit declaration of function `SSL_CTX_use_certificate_chain_file' rlm_eap_tls.c:322: warning: implicit declaration of function `ERR_error_string' rlm_eap_tls.c:322: warning: implicit declaration of function `ERR_get_error' rlm_eap_tls.c:322: warning: format argument is not a pointer (arg 3) rlm_eap_tls.c:327: warning: implicit declaration of function `SSL_CTX_use_certificate_file' rlm_eap_tls.c:328: warning: redundant redeclaration of `ERR_error_string' in same scope rlm_eap_tls.c:322: warning: previous declaration of `ERR_error_string' rlm_eap_tls.c:328: warning: redundant redeclaration of `ERR_get_error' in same scope rlm_eap_tls.c:322: warning: previous declaration of `ERR_get_error' rlm_eap_tls.c:328: warning: format argument is not a pointer (arg 3) rlm_eap_tls.c:335: warning: implicit declaration of function `SSL_CTX_load_verify_locations' rlm_eap_tls.c:336: warning: redundant redeclaration of `ERR_error_string' in same scope rlm_eap_tls.c:322: warning: previous declaration of `ERR_error_string' rlm_eap_tls.c:336: warning: redundant redeclaration of `ERR_get_error' in same scope rlm_eap_tls.c:322: warning: previous declaration of `ERR_get_error' rlm_eap_tls.c:336: warning: format argument is not a pointer (arg 3) rlm_eap_tls.c:340: warning: implicit declaration of function `SSL_CTX_set_client_CA_list' rlm_eap_tls.c:340: warning: implicit declaration of function `SSL_load_client_CA_file' rlm_eap_tls.c:342: warning: implicit declaration of function `SSL_CTX_use_PrivateKey_file' rlm_eap_tls.c:343: warning: redundant redeclaration of `ERR_error_string' in same scope rlm_eap_tls.c:322: warning: previous declaration of `ERR_error_string' rlm_eap_tls.c:343: warning: redundant redeclaration of `ERR_get_error' in same scope rlm_eap_tls.c:322: warning: previous declaration of `ERR_get_error' rlm_eap_tls.c:343: warning: format argument is not a pointer (arg 3) rlm_eap_tls.c:351: warning: implicit declaration of function `SSL_CTX_check_private_key' rlm_eap_tls.c:359: `SSL_OP_NO_SSLv2' undeclared (first use in this function) rlm_eap_tls.c:360: `SSL_OP_NO_SSLv3' undeclared (first use in this function) rlm_eap_tls.c:371: `SSL_OP_SINGLE_DH_USE' undeclared (first use in this function) rlm_eap_tls.c:372: warning: implicit declaration of function `SSL_CTX_set_options' rlm_eap_tls.c:389: warning: implicit declaration of function `SSL_CTX_set_info_callback' rlm_eap_tls.c:410: `SSL_VERIFY_PEER' undeclared (first use in this function) rlm_eap_tls.c:411: `SSL_VERIFY_FAIL_IF_NO_PEER_CERT' undeclared (first use in this function) rlm_eap_tls.c:412: `SSL_VERIFY_CLIENT_ONCE' undeclared (first use in this function) rlm_eap_tls.c:413: warning: implicit declaration of function `SSL_CTX_set_verify' rlm_eap_tls.c:416: warning: implicit declaration of function `SSL_CTX_set_verify_depth' rlm_eap_tls.c:420: warning: implicit declaration of function `RAND_load_file' rlm_eap_tls.c:421: warning: redundant redeclaration of `ERR_error_string' in same scope rlm_eap_tls.c:322: warning: previous declaration of `ERR_error_string' rlm_eap_tls.c:421: warning: redundant redeclaration of `ERR_get_error' in same scope rlm_eap_tls.c:322: warning: previous declaration of `ERR_get_error' rlm_eap_tls.c:421: warning: format argument is not a pointer (arg 3) rlm_eap_tls.c:430: warning: implicit declaration of function `SSL_CTX_set_cipher_list' rlm_eap_tls.c: In function `eaptls_detach': rlm_eap_tls.c:446: `inst' undeclared (first use in this function) rlm_eap_tls.c:448: syntax error before ')' token rlm_eap_tls.c:452: warning: implicit declaration of function `free' rlm_eap_tls.c:467: warning: implicit declaration of function `SSL_CTX_free' rlm_eap_tls.c:470: warning: redundant redeclaration of `free' in same scope rlm_eap_tls.c:452: warning: previous declaration of `free' rlm_eap_tls.c:443: warning: unused parameter `arg' rlm_eap_tls.c: In function `eaptls_attach': rlm_eap_tls.c:482: `inst' undeclared (first use in this function) rlm_eap_tls.c:485: syntax error before ')' token rlm_eap_tls.c: At top level: rlm_eap_tls.c:552: syntax error before "EAP_HANDLER" rlm_eap_tls.c:553: warning: function declaration isn't a prototype rlm_eap_tls.c: In function `eaptls_initiate': rlm_eap_tls.c:555: `tls_session_t' undeclared (first use in this function) rlm_eap_tls.c:555: `ssn' undeclared (first use in this function) rlm_eap_tls.c:556: `inst' undeclared (first use in this function) rlm_eap_tls.c:559: `SSL_VERIFY_NONE' undeclared (first use in this function) rlm_eap_tls.c:561: syntax error before ')' token rlm_eap_tls.c:569: `handler' undeclared (first use in this function) rlm_eap_tls.c:569: `PW_EAP_TLS' undeclared (first use in this function) rlm_eap_tls.c:596: `SSL_VERIFY_PEER' undeclared (first use in this function) rlm_eap_tls.c:597: `SSL_VERIFY_FAIL_IF_NO_PEER_CERT' undeclared (first use in this function) rlm_eap_tls.c:598: `SSL_VERIFY_CLIENT_ONCE' undeclared (first use in this function) rlm_eap_tls.c:600: warning: implicit declaration of function `SSL_set_verify' rlm_eap_tls.c:610: warning: implicit declaration of function `SSL_set_ex_data' rlm_eap_tls.c:633: `PW_EAP_PEAP' undeclared (first use in this function) rlm_eap_tls.c:665: `AUTHENTICATE' undeclared (first use in this function) rlm_eap_tls.c: At top level: rlm_eap_tls.c:673: syntax error before "EAP_HANDLER" rlm_eap_tls.c:674: warning: function declaration isn't a prototype rlm_eap_tls.c: In function `eaptls_authenticate': rlm_eap_tls.c:675: `eaptls_status_t' undeclared (first use in this function) rlm_eap_tls.c:675: syntax error before "status" rlm_eap_tls.c:676: `tls_session_t' undeclared (first use in this function) rlm_eap_tls.c:676: `tls_session' undeclared (first use in this function) rlm_eap_tls.c:676: syntax error before ')' token rlm_eap_tls.c:680: `status' undeclared (first use in this function) rlm_eap_tls.c:680: warning: implicit declaration of function `eaptls_process' rlm_eap_tls.c:680: `handler' undeclared (first use in this function) rlm_eap_tls.c:687: `EAPTLS_SUCCESS' undeclared (first use in this function) rlm_eap_tls.c:695: `EAPTLS_HANDLED' undeclared (first use in this function) rlm_eap_tls.c:702: `EAPTLS_OK' undeclared (first use in this function) rlm_eap_tls.c:723: warning: implicit declaration of function `eaptls_fail' rlm_eap_tls.c:737: warning: implicit declaration of function `eaptls_success' rlm_eap_tls.c:738: warning: implicit declaration of function `eaptls_gen_mppe_keys' rlm_eap_tls.c: At top level: rlm_eap_tls.c:748: syntax error before "rlm_eap_tls" rlm_eap_tls.c:748: warning: type defaults to `int' in declaration of `rlm_eap_tls' rlm_eap_tls.c:749: warning: initialization makes integer from pointer without a cast rlm_eap_tls.c:750: warning: excess elements in scalar initializer rlm_eap_tls.c:750: warning: (near initialization for `rlm_eap_tls') rlm_eap_tls.c:751: warning: excess elements in scalar initializer rlm_eap_tls.c:751: warning: (near initialization for `rlm_eap_tls') rlm_eap_tls.c:752: warning: excess elements in scalar initializer rlm_eap_tls.c:752: warning: (near initialization for `rlm_eap_tls') rlm_eap_tls.c:753: warning: excess elements in scalar initializer rlm_eap_tls.c:753: warning: (near initialization for `rlm_eap_tls') rlm_eap_tls.c:755: warning: excess elements in scalar initializer rlm_eap_tls.c:755: warning: (near initialization for `rlm_eap_tls') rlm_eap_tls.c:755: warning: data definition has no type or storage class make[9]: *** [rlm_eap_tls.lo] Error 1 make[9]: Leaving directory `/root/syssec/reverb/src/modules/rlm_eap/types/rlm_eap_tls' make[8]: *** [common] Error 2 make[8]: Leaving directory `/root/syssec/reverb/src/modules/rlm_eap/types' make[7]: *** [all] Error 2 make[7]: Leaving directory `/root/syssec/reverb/src/modules/rlm_eap/types' make[6]: *** [common] Error 2 make[6]: Leaving directory `/root/syssec/reverb/src/modules/rlm_eap' make[5]: *** [common] Error 2 make[5]: Leaving directory `/root/syssec/reverb/src/modules' make[4]: *** [all] Error 2 make[4]: Leaving directory `/root/syssec/reverb/src/modules' make[3]: *** [common] Error 2 make[3]: Leaving directory `/root/syssec/reverb/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/root/syssec/reverb/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/root/syssec/reverb' make: *** [all] Error 2 Alan DeKok wrote:
Geoff Silver <geoff+freeradius@uslinux.net> wrote:
I'm running FreeRadius 1.1.0 on Red Hat Linux, and appear to be running into an issue where heavy load causes rlm_proxy to stop responding. If I restart radiusd, authentication will be properly proxied for 15-30 seconds, at which point I see incoming Access-Request messages logged, but I don't see any Access-Request messages being send to the backend server, and I don't see any Access-Accept or Access-Reject messages (or I see a few Access-Reject messages which appear to come from my proxy server, as there is no Reply-Message attribute set in them).
See http://bugs.freeradius.org/show_bug.cgi?id=331
If the patch works, we can include it in 1.1.3.
Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Geoff Silver <geoff+freeradius@uslinux.net> wrote:
I'll give it a shot. I'm trying to build 1.1.2 with that patch, but I'm having issues when compiling rlm_eap and rlm_eap_tls:
Weird. What OS are you bulding it on? What earlier versions of the server built on that OS? Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
Alan DeKok wrote:
Geoff Silver <geoff+freeradius@uslinux.net> wrote:
I'll give it a shot. I'm trying to build 1.1.2 with that patch, but I'm having issues when compiling rlm_eap and rlm_eap_tls:
Weird. What OS are you bulding it on?
Red Hat Enterprise Linux 3.0. Also has the same build issues on my RedHat EL4.0 dev system.
What earlier versions of the server built on that OS?
We were previously using FreeRADIUS 1.1.0, which built fine. IIRC, the problem surfaced in 1.1.1, which is why we're still using 1.1.0 (was hoping it would be fixed in 1.1.2...)
Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Geoff Silver <geoff+freeradius@uslinux.net> wrote:
Red Hat Enterprise Linux 3.0. Also has the same build issues on my RedHat EL4.0 dev system.
Weird. It works for me on FC4, and many other OSes.
We were previously using FreeRADIUS 1.1.0, which built fine. IIRC, the problem surfaced in 1.1.1, which is why we're still using 1.1.0 (was hoping it would be fixed in 1.1.2...)
Maybe 1.1.3. So... does the patch in the bug apply to 1.1.0, and does it solve the problem? Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
Alan DeKok wrote:
Geoff Silver <geoff+freeradius@uslinux.net> wrote:
Red Hat Enterprise Linux 3.0. Also has the same build issues on my RedHat EL4.0 dev system.
Weird. It works for me on FC4, and many other OSes.
We were previously using FreeRADIUS 1.1.0, which built fine. IIRC, the problem surfaced in 1.1.1, which is why we're still using 1.1.0 (was hoping it would be fixed in 1.1.2...)
Maybe 1.1.3.
So... does the patch in the bug apply to 1.1.0, and does it solve the problem?
As I can only reproduce it in production, we've slated an install for Monday morning. I'll be watching it very closely and will let you know Monday afternoon whether or not it helped. Thanks.
The patch applies to 1.1.0, but neither the patched 1.1.0 or a patched 1.1.2 fixes the problem. On the concentrator, successful auths look like: 36557 08/21/2006 08:16:24.270 SEV=4 IKE/52 RPT=42919 68.100.177.222 Group [OFFICE] User [hockingmr] User (hockingmr) authenticated. 36562 08/21/2006 08:16:25.230 SEV=4 IKE/119 RPT=62782 68.100.177.222 Group [OFFICE] User [hockingmr] PHASE 1 COMPLETED where the failures look like: 36141 08/21/2006 08:13:10.640 SEV=3 AUTH/5 RPT=30061 69.175.180.60 Authentication rejected: Reason = Unspecified handle = 6, server = 205.188.136.151, user = suzannebd, domain = <not specified> although I see the same effect when using radclient: Sending Access-Request of id 106 to 127.0.0.1 port 1645 User-Name = "bob" User-Password = "password" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 rad_recv: Access-Accept packet from host 127.0.0.1:1645, id=106, length=43 Account-Flags = 587300864 Connect-Info = "OFFICE" then: Sending Access-Request of id 121 to 127.0.0.1 port 1645 User-Name = "bob" User-Password = "password" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 rad_recv: Access-Reject packet from host 127.0.0.1:1645, id=121, length=2 I'm at a loss, and without being able to proxy auth to another server, my entire infrastructure is useless. The worst part of this is that I haven't been able to re-create it except in a production environment... for whatever reason, just running a half dozen simultaneous auths with radclient doesn't seem to cause this. Ideas? Thanks. Alan DeKok wrote:
Geoff Silver <geoff+freeradius@uslinux.net> wrote:
Red Hat Enterprise Linux 3.0. Also has the same build issues on my RedHat EL4.0 dev system.
Weird. It works for me on FC4, and many other OSes.
We were previously using FreeRADIUS 1.1.0, which built fine. IIRC, the problem surfaced in 1.1.1, which is why we're still using 1.1.0 (was hoping it would be fixed in 1.1.2...)
Maybe 1.1.3.
So... does the patch in the bug apply to 1.1.0, and does it solve the problem?
Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Geoff Silver <geoff+freeradius@uslinux.net> wrote:
rad_recv: Access-Reject packet from host 127.0.0.1:1645, id=121, length=2
You're getting a *reject* and not any other issue? Oh... That sounds to me like the home server is simply not responding to the proxy server. This *should* be mentioned in the log file. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
Alan DeKok wrote:
Geoff Silver <geoff+freeradius@uslinux.net> wrote:
rad_recv: Access-Reject packet from host 127.0.0.1:1645, id=121, length=2
You're getting a *reject* and not any other issue? Oh...
Am I? I'm not entirely sure. Usually I see the client send me an Access-Request message. I then see *me* send an Access-Request to the backend server, and finally see an Access-Accept or Access-Reject message (not sure if this last one comes from the backend to me or from me to the requesting client). In the failure case, I'm seeing only one Access-Request, and then eventually an Access-Reject that appears to be generated by me. I can't tell if I've actually sent the second request to the backend server and not logged it, or not even sent it.
That sounds to me like the home server is simply not responding to the proxy server. This *should* be mentioned in the log file.
I don't see anything in the logs about it, unfortunately. I'll fire up radiusd -AX and see if I can't get our VPN group to send some traffic to recreate the problem again.
Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Geoff Silver <geoff+freeradius@uslinux.net> wrote:
In the failure case, I'm seeing only one Access-Request, and then eventually an Access-Reject that appears to be generated by me. I can't tell if I've actually sent the second request to the backend server and not logged it, or not even sent it.
Knowing that information would help a lot. As in, make the difference between being able to slve the problem, or not solve it. You can also try setting "reject_delay = 0", to make the debugging process go a little faster. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
participants (2)
-
Alan DeKok -
Geoff Silver