(RADIATOR) Latest patch set breaks TTLS authentication
Mike McCauley
mikem at open.com.au
Wed May 30 17:27:30 CDT 2007
Hello Ernst,
thanks for reporting this problem. We have now fixed the patch set. We
apologise for any inconvenience.
Cheers.
On Wednesday 30 May 2007 19:07, Ernst Oudhof wrote:
> Hi,
>
> The latest patch set seems to break TTLS authentication even in a very
> simple configuration.
>
> by example:
>
>
> <Handler TunnelledByTTLS=1>
> <AuthBy FILE>
> Filename %D/users
> </AuthBy>
> </Handler>
>
>
>
>
> <Handler EAP-Message=/.+/>
> <AuthBy FILE>
> Filename %D/users
> EAPType TTLS,PEAP
> EAPTLS_CAFile %D/root.pem
> EAPTLS_CertificateFile %D/cert-srv.pem
> EAPTLS_CertificateType PEM
> EAPTLS_PrivateKeyFile %D/cert-srv.pem
> EAPTLS_MaxFragmentSize 1024
> AutoMPPEKeys
> EAPAnonymous %0
> </AuthBy>
> </Handler>
>
>
> Relevant Debug logs
>
>
> *** Received from 127.0.0.1 port 34014 ....
> Code: Access-Request
> Identifier: 4
> Authentic: <253>aLF<215>e<172><218><244><241><208>*ur<172>r
> Attributes:
> User-Name = "ernst at mailfrom.nl"
> NAS-IP-Address = 127.0.0.1
> Calling-Station-Id = "02-00-00-00-00-01"
> Framed-MTU = 1400
> NAS-Port-Type = Wireless-IEEE-802-11
> Connect-Info = "CONNECT 11Mbps 802.11b"
> EAP-Message = <2><4><0><128><21><0><23><3><1><0>
> <31><11>B7<212>X<26><233><237>\<<133><220>f<206><211><169>F^<164><197><137>
><138><30><174>{<158>c<30>zo<251><23><3><1><0>Pc<235><223>4d<233><145><170>D<
>11>$R<156><181><146><226><249><169><174><250>
> TW<200><191>t<196><134><217>]8<169><187>L<1>q%<136><245><238><223><207><19>
><197>P<244>PPcZW`<218>e]=<13><175>&<169><224>'<242><26><252>yF<148>r<172>T<2
>27><0>W`<181><201>?<192>o Message-Authenticator =
> `<151><184><205>?<240><128><2>W<223>R<21><152><1><253><25>
>
> Wed May 30 10:15:16 2007: DEBUG: Handling request with Handler
> 'EAP-Message=/.+/'
> Wed May 30 10:15:16 2007: DEBUG: Deleting session for ernst at mailfrom.nl,
> 127.0.0.1,
> Wed May 30 10:15:16 2007: DEBUG: Handling with Radius::AuthFILE:
> Wed May 30 10:15:16 2007: DEBUG: Handling with EAP: code 2, 4, 128
> Wed May 30 10:15:16 2007: DEBUG: Response type 21
> Wed May 30 10:15:16 2007: DEBUG: EAP TTLS data, 3, 4, 3
> Wed May 30 10:15:16 2007: DEBUG: TTLS Tunnelled Diameter Packet dump:
> Code: UNDEF
> Identifier: UNDEF
> Authentic: UNDEF
> Attributes:
> User-Name = "ernst at mailfrom.nl"
> User-Password = xxxxxxx
>
> Wed May 30 10:15:16 2007: DEBUG: EAP TTLS inner authentication request for
> ernst at mailfrom.nl
> Wed May 30 10:15:16 2007: DEBUG: Handling request with Handler
> 'TunnelledByTTLS=1'
> Wed May 30 10:15:16 2007: DEBUG: Deleting session for ernst at mailfrom.nl,
> 127.0.0.1,
> Wed May 30 10:15:16 2007: DEBUG: Handling with Radius::AuthFILE:
> Wed May 30 10:15:16 2007: DEBUG: Reading users file /etc/radiator/users
> Wed May 30 10:15:16 2007: DEBUG: Radius::AuthFILE looks for match with
> ernst at mailfrom.nl [ernst at mailfrom.nl]
> Wed May 30 10:15:16 2007: DEBUG: Radius::AuthFILE ACCEPT: :
> ernst at mailfrom.nl [ernst at mailfrom.nl]
> Wed May 30 10:15:16 2007: DEBUG: AuthBy FILE result: ACCEPT,
> Wed May 30 10:15:16 2007: DEBUG: Access accepted for ernst at mailfrom.nl
> Wed May 30 10:15:16 2007: DEBUG: Returned TTLS tunnelled Diameter Packet
> dump:
> Code: Access-Accept
> Identifier: UNDEF
> Authentic: A<252><232>n>x<154>s<12><145><252><191><190>B<134>+
> Attributes:
>
> Wed May 30 10:15:16 2007: ERR: Could not handle an EAP request: Can't call
> method "delete_attr" on an undefined value at
> /usr/local/share/perl/5.8.8/Radius/EAP_21.pm line 427.
>
> Wed May 30 10:15:16 2007: DEBUG: AuthBy FILE result: REJECT, Could not
> handle an EAP request
> Wed May 30 10:15:16 2007: INFO: Access rejected for ernst at mailfrom.nl:
> Could not handle an EAP request
> Wed May 30 10:15:16 2007: DEBUG: Packet dump:
> *** Sending to 127.0.0.1 port 34014 ....
> Code: Access-Reject
> Identifier: 4
> Authentic: <253>aLF<215>e<172><218><244><241><208>*ur<172>r
> Attributes:
> Reply-Message = "Request Denied"
>
>
>
> The problem seems in the following piece of code in EAP_21.pm in a
> different configuration it gives similar errors on line 425
>
> # Also copy the reply atrs from the inner request for use later
> when the
> # handshake finishes, but dont reveal any MS-CHAP2-Success
> # Override any attrs that were previously sert (eg in the case
> where # TNC follows authentication, allowing TNC to override tunnels etc
> foreach (@{$tp->{rp}->{Attributes}})
> {
> $context->{last_reply_attrs}->change_attr($_->[0], $_->[1]);
> }
> $context->{last_reply_attrs}->delete_attr('MS-CHAP2-Success');
>
>
>
> regards,
>
> Ernst
>
> --
> Archive at http://www.open.com.au/archives/radiator/
> Announcements on radiator-announce at open.com.au
> To unsubscribe, email 'majordomo at open.com.au' with
> 'unsubscribe radiator' in the body of the message.
--
Mike McCauley mikem at open.com.au
Open System Consultants Pty. Ltd Unix, Perl, Motif, C++, WWW
9 Bulbul Place Currumbin Waters QLD 4223 Australia http://www.open.com.au
Phone +61 7 5598-7474 Fax +61 7 5598-7070
Radiator: the most portable, flexible and configurable RADIUS server
anywhere. SQL, proxy, DBM, files, LDAP, NIS+, password, NT, Emerald,
Platypus, Freeside, TACACS+, PAM, external, Active Directory, EAP, TLS,
TTLS, PEAP etc on Unix, Windows, MacOS, NetWare etc.
--
Archive at http://www.open.com.au/archives/radiator/
Announcements on radiator-announce at open.com.au
To unsubscribe, email 'majordomo at open.com.au' with
'unsubscribe radiator' in the body of the message.
More information about the radiator
mailing list