Hi Alan, Thanks for your response! I tried putting the Ki and OP into the /etc/freeradius/users file as follows DEFAULT Suffix == "3gppnetwork.org" EAP-Type := SIM, EAP-SIM-Ki := 0xd0356b75c19b4a62b1a5423aacc96e42, EAP-Sim-Algo-Version := 1 I know that this will apply for any user with a suffix of 3gppnetwork.org but I just wanted to do a sanity check with it. Unfortunately, this doesn't cause the attributes to be put in the control list, but instead in request->reply->vps. What would be the best way to configure the server to put those attributes in the control list? Thanks, Shane ________________________________ From: Freeradius-Users <freeradius-users-bounces+shaneguan=microsoft.com@lists.freeradius.org> on behalf of Alan DeKok <aland@deployingradius.com> Sent: Friday, February 4, 2022 7:14 AM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: [EXTERNAL] Re: Help in Configuring EAP-SIM [You don't often get email from aland@deployingradius.com. Learn why this is important at http://aka.ms/LearnAboutSenderIdentification.] On Feb 3, 2022, at 5:28 PM, Shane Guan via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:

I am writing to inquire about the best way to configure freeradius for eap-sim.

* I am using version 3.0.25 * I have a test sim peer and know the Ki, OP, and IMSI for it.

That's good.

How would I configure freeradius to use the Ki and OP when it receives a message from the test peer requesting to authenticate with EAP-SIM?

You just tell the server what they are, and the server does the right thing.

I tried putting the Ki and OP in the users file but that didn't work.

What does that mean?

According to doc/modules/rlm_eap it says I need to write a separate module to generate GSM triplets given the Ki. However, in src/modules/rlm_eap/types/rlm_eap_sim/rlm_eap_sim.c:eap_sim_get_challenge it looks like there is already a module to generate GSM triplets given the Ki. How could I configure freeradius to call it?

To be honest... this isn't a commonly used feature. :( From a quick check of the source, you put the EAP-SIM-* attributes into the "control" list, and it *should* just work. Alan DeKok. - List info/subscribe/unsubscribe? See https://nam06.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=04%7C01%7Cshaneguan%40microsoft.com%7C73bd55f4ac354c72876e08d9e7f10aaf%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637795844733223927%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=L%2BbAiOw9WtcaOVZYBLXJ%2FKV5sTyXVV8nJMQ7viXhey4%3D&reserved=0

Hi Alan, Thanks for the response! I put everything in the first line as per your suggestion and the server did put them in the control list. Unfortunately, the server ran into a segfault after parsing a packet from the peer and I have attached the logs below. I did some preliminary investigations on this and gdb says that the segfault happened at src/modules/rlm_eap/libeap/eapsimlib.c:341 To be exact, fr_pair_afrom_num(r, eapsim_attribute+PW_EAP_SIM_BASE, 0); returned a null pointer, because the attr/vendor combination was not recognized by the server. I noticed that in the comments for that function, it says that it is supposed to call a function to create a dynamic DICT_ATTR, but the function never did. Could you direct me to the documentation on this? Perhaps I didn't configure the server to recognize some attribute sent by eapol_test? Thanks! Shane ________________________________ From: Alan DeKok <aland@deployingradius.com> Sent: Monday, February 7, 2022 12:46 PM To: Shane Guan <shaneguan@microsoft.com> Cc: Paul Irwin <Irwin.Paul@microsoft.com>; Davut Karabay <davutk@microsoft.com>; Corbin Phipps <corbinphipps@microsoft.com>; Shane Guan via Freeradius-Users <freeradius-users@lists.freeradius.org> Subject: Re: [EXTERNAL] Help in Configuring EAP-SIM On Feb 7, 2022, at 3:26 PM, Shane Guan <shaneguan@microsoft.com> wrote:

I tried putting the Ki and OP into the /etc/freeradius/users file as follows DEFAULT Suffix == "3gppnetwork.org" EAP-Type := SIM, EAP-SIM-Ki := 0xd0356b75c19b4a62b1a5423aacc96e42, EAP-Sim-Algo-Version := 1

See "man users".

I know that this will apply for any user with a suffix of 3gppnetwork.org but I just wanted to do a sanity check with it.

Unfortunately, this doesn't cause the attributes to be put in the control list, but instead in request->reply->vps. What would be the best way to configure the server to put those attributes in the control list?

See "man users". This is documented extensively. Control items are on the first line. Reply items are on other lines. The server can't magically figure out where things go. The configuration files have a specific format, and that format helps to tell the server what you want it to do. Alan DeKok.

Hi Alan, Which commit would you suggest to use for testing EAP-SIM in v4? I tried using the nested_coding branch for the eap-aka-sim submodule, since that branch had its latest commit last year while passing all tests on github. However, I could not get it working -- it results in a segfault and I have attached the logs (*segfault.log). gdb said that the segfault was caused by src/lib/eap_aka_sim/vector.c:vector_gsm_from_ki, specifically the following line memcpy(keys->auc.opc, opc_p, sizeof(keys->auc.opc)); opc_p was a pointer that was not properly initialized. I set SIM-Algo-Version to be 1 in the send Challenge-Request section. I was unsure where to put SIM-Algo-Version, as I know that EAP-SIM has a version negotiation step (at least eapol_test expects that step). I noticed in the comments for the send Start-Request section that the version could be negotiated here, but when I put the SIM-Algo-Version attribute in that section instead of in the Challenge-Request section, that didn't cause the version negotiation step to happen. send Start { update control { &SIM-Algo-Version := 1 } } I have attatched logs for that scenario (*no_version_negotiate.log). Again, thanks for your help! Shane ________________________________ From: Freeradius-Users <freeradius-users-bounces+shaneguan=microsoft.com@lists.freeradius.org> on behalf of Alan DeKok <aland@deployingradius.com> Sent: Monday, February 7, 2022 7:31 PM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: [EXTERNAL] Help in Configuring EAP-SIM On Feb 7, 2022, at 6:29 PM, Shane Guan via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:

Thanks for the response! I put everything in the first line as per your suggestion and the server did put them in the control list. Unfortunately, the server ran into a segfault after parsing a packet from the peer and I have attached the logs below.

That's pretty bad. :(

I did some preliminary investigations on this and gdb says that the segfault happened at src/modules/rlm_eap/libeap/eapsimlib.c:341 To be exact, fr_pair_afrom_num(r, eapsim_attribute+PW_EAP_SIM_BASE, 0); returned a null pointer, because the attr/vendor combination was not recognized by the server. I noticed that in the comments for that function, it says that it is supposed to call a function to create a dynamic DICT_ATTR, but the function never did.

I don't see any such comments there. The function is supposed to create a new VALUE_PAIR, which references a DICT_ATTR. But if the DICT_ATTR doesn't exist... it runs into the problem you saw.

Could you direct me to the documentation on this? Perhaps I didn't configure the server to recognize some attribute sent by eapol_test? Thanks!

There really isn't much documentation on EAP-SIM. It hasn't been widely used that I can recall. The code was written in 2003, and then largely left untouched since then. I've pushed a patch to the v3.0.x branch on GitHub so it won't crash any more. But... v3 doesn't do identity negotiation, session resumption, identity hints, or resync for EAP-SIM. So it's a bare-bones implementation. The code in "master" has a full implementation of EAP-SIM with all of that. It's also been tested with real-world traffic, so it's a lot better. We hope to release v4 real soon now. :( Alan DeKok. - List info/subscribe/unsubscribe? See https://nam06.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=04%7C01%7Cshaneguan%40microsoft.com%7C5af933b23c444bfc2e3808d9eab39205%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637798879545593250%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=twKmJTj6uCiUDBrksspv7cZN4GfkhmDI1KSoP9EKvzY%3D&reserved=0

On Feb 8, 2022, at 5:27 PM, Alan DeKok <aland@deployingradius.com> wrote:

On Feb 8, 2022, at 4:34 PM, Shane Guan via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:

...

Which commit would you suggest to use for testing EAP-SIM in v4? I tried using the nested_coding branch for the eap-aka-sim submodule, since that branch had its latest commit last year while passing all tests on github. However, I could not get it working -- it results in a segfault and I have attached the logs (*segfault.log).

Use the "master" branch. The current tests which are failing are not relevant to SIM.

...

I set SIM-Algo-Version to be 1 in the send Challenge-Request section.

Fixed in master. ... but that's unlikely to be the algorithm used by your sim card. -Arran

On Feb 8, 2022, at 7:36 PM, Shane Guan via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:

Thanks for your responses. I switched over to master branch but I am unable to start the server. I have attached logs when I invoke "sudo freeradius -Xf" What would be the cause for this?

Error : Network - Failed adding new socket to network event loop: Failed inserting filters for FD 16: EFAULT: Bad address Error : /etc/freeradius/sites-enabled/default[209]: Opening radius I/O interface failed

Hmm... I don't recall seeing that. My guess is that you're using an older libkqueue? We've put a lot of fixes into the upstream libkqueue repository, but those fixes haven't all made it into the Linux distributions. In any case... the "master" branch isn't released, and may or may not work on a daily basis. I've pushed fixes to v3 for the crash you saw. So basic SIM authentication should work there. Alan DeKok.

On Feb 9, 2022, at 10:05 AM, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:

Signed PGP part

...

On Feb 9, 2022, at 8:53 AM, Alan DeKok <aland@deployingradius.com> wrote:

On Feb 8, 2022, at 7:36 PM, Shane Guan via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:

...

Thanks for your responses. I switched over to master branch but I am unable to start the server. I have attached logs when I invoke "sudo freeradius -Xf" What would be the cause for this?

...

Error : Network - Failed adding new socket to network event loop: Failed inserting filters for FD 16: EFAULT: Bad address Error : /etc/freeradius/sites-enabled/default[209]: Opening radius I/O interface failed

Hmm... I don't recall seeing that.

My guess is that you're using an older libkqueue? We've put a lot of fixes into the upstream libkqueue repository, but those fixes haven't all made it into the Linux distributions.

I don't remember that issue though, are you sure you're binding to a valid address? Just try wildcard '*'.

Ah, looks like you are. strace would be the next step then if you wanted to figure out why it's happening. I haven't seen this in CI, in our local docker images, or at the sites we have v4 deployed, so it's something specific about your environment.... -Arran

On Feb 10, 2022, at 3:11 PM, Shane Guan via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:

Thanks for the tip about libkqueue. I built and installed the latest version of that library and then was able to compile, install, and run the master branch with freeradius -Xf. However, I am still having difficulty with the configuration for eap-sim. For some reason the eapol_test client says that it can't process a packet? I have attached logs.

The eapol_test log says: EAP-SIM: Unexpected Challenge in state CONTINUE EAP-SIM: CONTINUE -> FAILURE and FreeRADIUS says: Debug : (1.0) eap-sim - New EAP-SIM session Debug : (1.0) eap-sim - Changed state INIT -> SIM-CHALLENGE Debug : (1.0) send Challenge-Request { So FreeRADIUS is intending to do this, but eapol_test doesn't like it. I'll have to defer to Arran about this. :( I don't recall if we test EAP-SIM in our CI builds. I do know we test EAP-TLS and other EAP types, and we use eapol_test. So if it's in CI, it should work. Alan DeKok.

Hi everyone, Thanks for the quick fix in master. I pulled the newest changes and rebuilt the freeradius binary. I noticed that if I do not explicitly set the SIM-Algo-Version, thus leaving it to the default of 1, then eapol_test client is able to authenticate (*default.log). However, when I do explictely set the SIM-Algo-Version to 1, then eapol_test is unable to authenticate, stating a MAC invalidation (*explicit_set_1.log). Can someone help me understand why this would be the case, when I am merely explicitly setting a variable to its default, instead of leaving it alone? Perhaps I misunderstood what the purpose of SIM-Algo-Version is. Thanks again! Shane ________________________________ From: Freeradius-Users <freeradius-users-bounces+shaneguan=microsoft.com@lists.freeradius.org> on behalf of Arran Cudbard-Bell <a.cudbardb@freeradius.org> Sent: Friday, February 11, 2022 9:51 AM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Cc: Davut Karabay <davutk@microsoft.com>; Corbin Phipps <corbinphipps@microsoft.com>; Paul Irwin <Irwin.Paul@microsoft.com> Subject: Re: [EXTERNAL] Help in Configuring EAP-SIM

On Feb 10, 2022, at 4:46 PM, Alan DeKok <aland@deployingradius.com> wrote:

On Feb 10, 2022, at 3:11 PM, Shane Guan via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:

...

Thanks for the tip about libkqueue. I built and installed the latest version of that library and then was able to compile, install, and run the master branch with freeradius -Xf. However, I am still having difficulty with the configuration for eap-sim. For some reason the eapol_test client says that it can't process a packet? I have attached logs.

The eapol_test log says:

EAP-SIM: Unexpected Challenge in state CONTINUE EAP-SIM: CONTINUE -> FAILURE

and FreeRADIUS says:

Debug : (1.0) eap-sim - New EAP-SIM session Debug : (1.0) eap-sim - Changed state INIT -> SIM-CHALLENGE Debug : (1.0) send Challenge-Request {

So FreeRADIUS is intending to do this, but eapol_test doesn't like it. I'll have to defer to Arran about this. :(

Yeah, my fault. Moved to a unified state machine for all three EAP-Methods. EAP-SIM requires you to always send EAP-SIM-START, EAP-AKA and EAP-AKA' allow you to jump straight into the challenge round if you recognise the identity. I've corrected the state machine to always enter SIM-Start, even when no identity is being requested when we're running EAP-SIM. f4c433d4ef1494cc40fbe84da91046d0333bb8c7 - Fixes the problem by always requesting an ID 6be2c02b3a12930e31f9a46bc677a8a562acea46 - Expands on the previous commit to allow SIM-Start without identity requests. I've tested locally and it appears to fix the issue, could you rebuild with HEAD and verify it corrects the problem for you also. -Arran