Process/proxy an Access-Request via RadSec to another RADIUS server with an expired server certificate.
Platform:
5.10.0-13-amd64 #1 SMP Debian 5.10.106-1 (2022-03-17) GNU/Linux
Log output from the FreeRADIUS daemon
FreeRADIUS Version 3.0.26
Copyright (C) 1999-2021 The FreeRADIUS server project and contributors
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License
For more information about these matters, see the file named COPYRIGHT
Starting - reading configuration files ...
including dictionary file /usr/share/freeradius/dictionary
including dictionary file /usr/share/freeradius/dictionary.dhcp
including dictionary file /usr/share/freeradius/dictionary.vqp
including dictionary file /etc/freeradius/dictionary
including configuration file /etc/freeradius/radiusd.conf
including configuration file /etc/freeradius/proxy.conf
including configuration file /etc/freeradius/clients.conf
including files in directory /etc/freeradius/mods-enabled/
including configuration file /etc/freeradius/mods-enabled/digest
including configuration file /etc/freeradius/mods-enabled/passwd
including configuration file /etc/freeradius/mods-enabled/detail
including configuration file /etc/freeradius/mods-enabled/sradutmp
including configuration file /etc/freeradius/mods-enabled/expr
including configuration file /etc/freeradius/mods-enabled/replicate
including configuration file /etc/freeradius/mods-enabled/dynamic_clients
including configuration file /etc/freeradius/mods-enabled/exec
including configuration file /etc/freeradius/mods-enabled/utf8
including configuration file /etc/freeradius/mods-enabled/linelog
including configuration file /etc/freeradius/mods-enabled/pap
including configuration file /etc/freeradius/mods-enabled/mschap
including configuration file /etc/freeradius/mods-enabled/unpack
including configuration file /etc/freeradius/mods-enabled/echo
including configuration file /etc/freeradius/mods-enabled/ntlm_auth
including configuration file /etc/freeradius/mods-enabled/detail.log
including configuration file /etc/freeradius/mods-enabled/preprocess
including configuration file /etc/freeradius/mods-enabled/totp
including configuration file /etc/freeradius/mods-enabled/realm
including configuration file /etc/freeradius/mods-enabled/logintime
including configuration file /etc/freeradius/mods-enabled/always
including configuration file /etc/freeradius/mods-enabled/eap
including configuration file /etc/freeradius/mods-enabled/radutmp
including configuration file /etc/freeradius/mods-enabled/files
including configuration file /etc/freeradius/mods-enabled/attr_filter
including configuration file /etc/freeradius/mods-enabled/date
including configuration file /etc/freeradius/mods-enabled/soh
including configuration file /etc/freeradius/mods-enabled/expiration
including configuration file /etc/freeradius/mods-enabled/unix
including configuration file /etc/freeradius/mods-enabled/chap
including files in directory /etc/freeradius/policy.d/
including configuration file /etc/freeradius/policy.d/debug
including configuration file /etc/freeradius/policy.d/cui
including configuration file /etc/freeradius/policy.d/accounting
including configuration file /etc/freeradius/policy.d/rfc7542
including configuration file /etc/freeradius/policy.d/filter
including configuration file /etc/freeradius/policy.d/canonicalization
including configuration file /etc/freeradius/policy.d/eap
including configuration file /etc/freeradius/policy.d/dhcp
including configuration file /etc/freeradius/policy.d/moonshot-targeted-ids
including configuration file /etc/freeradius/policy.d/control
including configuration file /etc/freeradius/policy.d/abfab-tr
including configuration file /etc/freeradius/policy.d/operator-name
including files in directory /etc/freeradius/sites-enabled/
including configuration file /etc/freeradius/sites-enabled/tls
including configuration file /etc/freeradius/sites-enabled/check-eap-tls
including configuration file /etc/freeradius/sites-enabled/blackhole
including configuration file /etc/freeradius/sites-enabled/inner-tunnel
including configuration file /etc/freeradius/sites-enabled/default
main {
security {
user = "freerad"
group = "freerad"
allow_core_dumps = no
}
name = "freeradius"
prefix = "/usr"
localstatedir = "/var"
logdir = "/var/log/freeradius"
run_dir = "/var/run/freeradius"
}
main {
name = "freeradius"
prefix = "/usr"
localstatedir = "/var"
sbindir = "/usr/sbin"
logdir = "/var/log/freeradius"
run_dir = "/var/run/freeradius"
libdir = "/usr/lib/freeradius"
radacctdir = "/var/log/freeradius/radacct"
hostname_lookups = no
max_request_time = 30
cleanup_delay = 10
max_requests = 16384
postauth_client_lost = no
pidfile = "/var/run/freeradius/freeradius.pid"
checkrad = "/usr/sbin/checkrad"
debug_level = 0
proxy_requests = yes
log {
stripped_names = no
auth = yes
auth_badpass = no
auth_goodpass = no
colourise = yes
msg_denied = "You are already logged in - access denied"
}
resources {
}
security {
max_attributes = 200
reject_delay = 0.000000
status_server = yes
}
}
radiusd: #### Loading Realms and Home Servers ####
proxy server {
retry_delay = 5
retry_count = 3
default_fallback = no
dead_time = 120
wake_all_if_all_dead = no
}
home_server test-example-org {
ipaddr = 194.160.185.188
port = 2083
type = "auth"
proto = "tcp"
secret = <<< secret >>>
response_window = 30.000000
response_timeouts = 1
max_outstanding = 65536
zombie_period = 40
status_check = "none"
ping_interval = 30
check_timeout = 4
num_answers_to_alive = 3
revive_interval = 300
limit {
max_connections = 16
max_requests = 0
lifetime = 0
idle_timeout = 0
}
coa {
irt = 2
mrt = 16
mrc = 5
mrd = 30
}
}
tls {
verify_depth = 0
pem_file_type = yes
private_key_file = "/etc/freeradius/certs/server.pem"
certificate_file = "/etc/freeradius/certs/server.pem"
ca_file = "/etc/freeradius/certs/ca.pem"
private_key_password = <<< secret >>>
dh_file = "/etc/freeradius/certs/dh"
random_file = "/dev/urandom"
fragment_size = 8192
include_length = yes
check_crl = no
cipher_list = "DEFAULT"
ca_path_reload_interval = 0
ecdh_curve = "prime256v1"
tls_min_version = "1.2"
}
tls: Setting DH parameters from /etc/freeradius/certs/dh - this is no longer necessary.
tls: You should comment out the 'dh_file' configuration item.
home_server_pool examplepool {
type = fail-over
home_server = test-example-org
}
realm example.org {
auth_pool = examplepool
nostrip
}
realm DEFAULT {
nostrip
virtual_server = blackhole
}
radiusd: #### Loading Clients ####
client localhost {
ipaddr = 127.0.0.1
require_message_authenticator = no
secret = <<< secret >>>
nas_type = "other"
proto = "*"
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client localhost_ipv6 {
ipv6addr = ::1
require_message_authenticator = no
secret = <<< secret >>>
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
Debugger not attached
systemd watchdog is disabled
# Creating Auth-Type = mschap
# Creating Auth-Type = eap
# Creating Auth-Type = PAP
# Creating Auth-Type = CHAP
# Creating Auth-Type = MS-CHAP
# Creating Auth-Type = digest
# Creating Autz-Type = New-TLS-Connection
radiusd: #### Instantiating modules ####
modules {
# Loaded module rlm_digest
# Loading module "digest" from file /etc/freeradius/mods-enabled/digest
# Loaded module rlm_passwd
# Loading module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd
passwd etc_passwd {
filename = "/etc/passwd"
format = "*User-Name:Crypt-Password:"
delimiter = ":"
ignore_nislike = no
ignore_empty = yes
allow_multiple_keys = no
hash_size = 100
}
# Loaded module rlm_detail
# Loading module "detail" from file /etc/freeradius/mods-enabled/detail
detail {
filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"
header = "%t"
permissions = 384
locking = no
escape_filenames = no
log_packet_header = no
}
# Loaded module rlm_radutmp
# Loading module "sradutmp" from file /etc/freeradius/mods-enabled/sradutmp
radutmp sradutmp {
filename = "/var/log/freeradius/sradutmp"
username = "%{User-Name}"
case_sensitive = yes
check_with_nas = yes
permissions = 420
caller_id = no
}
# Loaded module rlm_expr
# Loading module "expr" from file /etc/freeradius/mods-enabled/expr
expr {
safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ"
}
# Loaded module rlm_replicate
# Loading module "replicate" from file /etc/freeradius/mods-enabled/replicate
# Loaded module rlm_dynamic_clients
# Loading module "dynamic_clients" from file /etc/freeradius/mods-enabled/dynamic_clients
# Loaded module rlm_exec
# Loading module "exec" from file /etc/freeradius/mods-enabled/exec
exec {
wait = no
input_pairs = "request"
shell_escape = yes
timeout = 10
}
# Loaded module rlm_utf8
# Loading module "utf8" from file /etc/freeradius/mods-enabled/utf8
# Loaded module rlm_linelog
# Loading module "linelog" from file /etc/freeradius/mods-enabled/linelog
linelog {
filename = "/var/log/freeradius/linelog"
escape_filenames = no
syslog_severity = "info"
permissions = 384
format = "This is a log message for %{User-Name}"
reference = "messages.%{%{reply:Packet-Type}:-default}"
}
# Loading module "log_accounting" from file /etc/freeradius/mods-enabled/linelog
linelog log_accounting {
filename = "/var/log/freeradius/linelog-accounting"
escape_filenames = no
syslog_severity = "info"
permissions = 384
format = ""
reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}"
}
# Loaded module rlm_pap
# Loading module "pap" from file /etc/freeradius/mods-enabled/pap
pap {
normalise = yes
}
# Loaded module rlm_mschap
# Loading module "mschap" from file /etc/freeradius/mods-enabled/mschap
mschap {
use_mppe = yes
require_encryption = yes
require_strong = yes
with_ntdomain_hack = yes
passchange {
}
allow_retry = yes
winbind_retry_with_normalised_username = no
}
# Loaded module rlm_unpack
# Loading module "unpack" from file /etc/freeradius/mods-enabled/unpack
# Loading module "echo" from file /etc/freeradius/mods-enabled/echo
exec echo {
wait = yes
program = "/bin/echo %{User-Name}"
input_pairs = "request"
output_pairs = "reply"
shell_escape = yes
}
# Loading module "ntlm_auth" from file /etc/freeradius/mods-enabled/ntlm_auth
exec ntlm_auth {
wait = yes
program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}"
shell_escape = yes
}
# Loading module "auth_log" from file /etc/freeradius/mods-enabled/detail.log
detail auth_log {
filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d"
header = "%t"
permissions = 384
locking = no
escape_filenames = no
log_packet_header = no
}
# Loading module "reply_log" from file /etc/freeradius/mods-enabled/detail.log
detail reply_log {
filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d"
header = "%t"
permissions = 384
locking = no
escape_filenames = no
log_packet_header = no
}
# Loading module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log
detail pre_proxy_log {
filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d"
header = "%t"
permissions = 384
locking = no
escape_filenames = no
log_packet_header = no
}
# Loading module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log
detail post_proxy_log {
filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d"
header = "%t"
permissions = 384
locking = no
escape_filenames = no
log_packet_header = no
}
# Loaded module rlm_preprocess
# Loading module "preprocess" from file /etc/freeradius/mods-enabled/preprocess
preprocess {
huntgroups = "/etc/freeradius/mods-config/preprocess/huntgroups"
hints = "/etc/freeradius/mods-config/preprocess/hints"
with_ascend_hack = no
ascend_channels_per_line = 23
with_ntdomain_hack = no
with_specialix_jetstream_hack = no
with_cisco_vsa_hack = no
with_alvarion_vsa_hack = no
}
# Loaded module rlm_totp
# Loading module "totp" from file /etc/freeradius/mods-enabled/totp
# Loaded module rlm_realm
# Loading module "IPASS" from file /etc/freeradius/mods-enabled/realm
realm IPASS {
format = "prefix"
delimiter = "/"
ignore_default = no
ignore_null = no
}
# Loading module "suffix" from file /etc/freeradius/mods-enabled/realm
realm suffix {
format = "suffix"
delimiter = "@"
ignore_default = no
ignore_null = no
}
# Loading module "bangpath" from file /etc/freeradius/mods-enabled/realm
realm bangpath {
format = "prefix"
delimiter = "!"
ignore_default = no
ignore_null = no
}
# Loading module "realmpercent" from file /etc/freeradius/mods-enabled/realm
realm realmpercent {
format = "suffix"
delimiter = "%"
ignore_default = no
ignore_null = no
}
# Loading module "ntdomain" from file /etc/freeradius/mods-enabled/realm
realm ntdomain {
format = "prefix"
delimiter = "\\"
ignore_default = no
ignore_null = no
}
# Loaded module rlm_logintime
# Loading module "logintime" from file /etc/freeradius/mods-enabled/logintime
logintime {
minimum_timeout = 60
}
# Loaded module rlm_always
# Loading module "reject" from file /etc/freeradius/mods-enabled/always
always reject {
rcode = "reject"
simulcount = 0
mpp = no
}
# Loading module "fail" from file /etc/freeradius/mods-enabled/always
always fail {
rcode = "fail"
simulcount = 0
mpp = no
}
# Loading module "ok" from file /etc/freeradius/mods-enabled/always
always ok {
rcode = "ok"
simulcount = 0
mpp = no
}
# Loading module "handled" from file /etc/freeradius/mods-enabled/always
always handled {
rcode = "handled"
simulcount = 0
mpp = no
}
# Loading module "invalid" from file /etc/freeradius/mods-enabled/always
always invalid {
rcode = "invalid"
simulcount = 0
mpp = no
}
# Loading module "userlock" from file /etc/freeradius/mods-enabled/always
always userlock {
rcode = "userlock"
simulcount = 0
mpp = no
}
# Loading module "notfound" from file /etc/freeradius/mods-enabled/always
always notfound {
rcode = "notfound"
simulcount = 0
mpp = no
}
# Loading module "noop" from file /etc/freeradius/mods-enabled/always
always noop {
rcode = "noop"
simulcount = 0
mpp = no
}
# Loading module "updated" from file /etc/freeradius/mods-enabled/always
always updated {
rcode = "updated"
simulcount = 0
mpp = no
}
# Loaded module rlm_eap
# Loading module "eap" from file /etc/freeradius/mods-enabled/eap
eap {
default_eap_type = "ttls"
timer_expire = 60
ignore_unknown_eap_types = no
cisco_accounting_username_bug = no
max_sessions = 16384
}
# Loading module "radutmp" from file /etc/freeradius/mods-enabled/radutmp
radutmp {
filename = "/var/log/freeradius/radutmp"
username = "%{User-Name}"
case_sensitive = yes
check_with_nas = yes
permissions = 384
caller_id = yes
}
# Loaded module rlm_files
# Loading module "files" from file /etc/freeradius/mods-enabled/files
files {
filename = "/etc/freeradius/mods-config/files/authorize"
acctusersfile = "/etc/freeradius/mods-config/files/accounting"
preproxy_usersfile = "/etc/freeradius/mods-config/files/pre-proxy"
}
# Loaded module rlm_attr_filter
# Loading module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter
attr_filter attr_filter.post-proxy {
filename = "/etc/freeradius/mods-config/attr_filter/post-proxy"
key = "%{Realm}"
relaxed = no
}
# Loading module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter
attr_filter attr_filter.pre-proxy {
filename = "/etc/freeradius/mods-config/attr_filter/pre-proxy"
key = "%{Realm}"
relaxed = no
}
# Loading module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter
attr_filter attr_filter.access_reject {
filename = "/etc/freeradius/mods-config/attr_filter/access_reject"
key = "%{User-Name}"
relaxed = no
}
# Loading module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter
attr_filter attr_filter.access_challenge {
filename = "/etc/freeradius/mods-config/attr_filter/access_challenge"
key = "%{User-Name}"
relaxed = no
}
# Loading module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter
attr_filter attr_filter.accounting_response {
filename = "/etc/freeradius/mods-config/attr_filter/accounting_response"
key = "%{User-Name}"
relaxed = no
}
# Loading module "attr_filter.coa" from file /etc/freeradius/mods-enabled/attr_filter
attr_filter attr_filter.coa {
filename = "/etc/freeradius/mods-config/attr_filter/coa"
key = "%{User-Name}"
relaxed = no
}
# Loaded module rlm_date
# Loading module "date" from file /etc/freeradius/mods-enabled/date
date {
format = "%b %e %Y %H:%M:%S %Z"
utc = no
}
# Loading module "wispr2date" from file /etc/freeradius/mods-enabled/date
date wispr2date {
format = "%Y-%m-%dT%H:%M:%S"
utc = no
}
# Loaded module rlm_soh
# Loading module "soh" from file /etc/freeradius/mods-enabled/soh
soh {
dhcp = yes
}
# Loaded module rlm_expiration
# Loading module "expiration" from file /etc/freeradius/mods-enabled/expiration
# Loaded module rlm_unix
# Loading module "unix" from file /etc/freeradius/mods-enabled/unix
unix {
radwtmp = "/var/log/freeradius/radwtmp"
}
Creating attribute Unix-Group
# Loaded module rlm_chap
# Loading module "chap" from file /etc/freeradius/mods-enabled/chap
instantiate {
}
# Instantiating module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd
rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no
# Instantiating module "detail" from file /etc/freeradius/mods-enabled/detail
# Instantiating module "linelog" from file /etc/freeradius/mods-enabled/linelog
# Instantiating module "log_accounting" from file /etc/freeradius/mods-enabled/linelog
# Instantiating module "pap" from file /etc/freeradius/mods-enabled/pap
# Instantiating module "mschap" from file /etc/freeradius/mods-enabled/mschap
rlm_mschap (mschap): using internal authentication
# Instantiating module "auth_log" from file /etc/freeradius/mods-enabled/detail.log
rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output
# Instantiating module "reply_log" from file /etc/freeradius/mods-enabled/detail.log
# Instantiating module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log
# Instantiating module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log
# Instantiating module "preprocess" from file /etc/freeradius/mods-enabled/preprocess
reading pairlist file /etc/freeradius/mods-config/preprocess/huntgroups
reading pairlist file /etc/freeradius/mods-config/preprocess/hints
# Instantiating module "IPASS" from file /etc/freeradius/mods-enabled/realm
# Instantiating module "suffix" from file /etc/freeradius/mods-enabled/realm
# Instantiating module "bangpath" from file /etc/freeradius/mods-enabled/realm
# Instantiating module "realmpercent" from file /etc/freeradius/mods-enabled/realm
# Instantiating module "ntdomain" from file /etc/freeradius/mods-enabled/realm
# Instantiating module "logintime" from file /etc/freeradius/mods-enabled/logintime
# Instantiating module "reject" from file /etc/freeradius/mods-enabled/always
# Instantiating module "fail" from file /etc/freeradius/mods-enabled/always
# Instantiating module "ok" from file /etc/freeradius/mods-enabled/always
# Instantiating module "handled" from file /etc/freeradius/mods-enabled/always
# Instantiating module "invalid" from file /etc/freeradius/mods-enabled/always
# Instantiating module "userlock" from file /etc/freeradius/mods-enabled/always
# Instantiating module "notfound" from file /etc/freeradius/mods-enabled/always
# Instantiating module "noop" from file /etc/freeradius/mods-enabled/always
# Instantiating module "updated" from file /etc/freeradius/mods-enabled/always
# Instantiating module "eap" from file /etc/freeradius/mods-enabled/eap
# Linked to sub-module rlm_eap_gtc
gtc {
challenge = "Password: "
auth_type = "PAP"
}
# Linked to sub-module rlm_eap_tls
tls {
tls = "tls-common"
virtual_server = "check-eap-tls"
}
tls-config tls-common {
verify_depth = 0
pem_file_type = yes
private_key_file = "/etc/freeradius/certs/radius-sanet/key-cert.pem"
certificate_file = "/etc/freeradius/certs/radius-sanet/key-cert.pem"
fragment_size = 1024
include_length = yes
auto_chain = no
check_crl = no
check_all_crl = no
ca_path_reload_interval = 0
cipher_list = "DEFAULT"
cipher_server_preference = no
reject_unknown_intermediate_ca = no
ecdh_curve = ""
tls_max_version = "1.2"
tls_min_version = "1.2"
cache {
enable = yes
lifetime = 24
name = "EAP module"
max_entries = 255
persist_dir = "/var/log/freeradius/tlscache"
}
verify {
skip_if_ocsp_ok = no
}
ocsp {
enable = no
override_cert_url = yes
url = "http://127.0.0.1/ocsp/"
use_nonce = yes
timeout = 0
softfail = no
}
}
# Linked to sub-module rlm_eap_ttls
ttls {
tls = "tls-common"
default_eap_type = "mschapv2"
copy_request_to_tunnel = yes
use_tunneled_reply = no
virtual_server = "inner-tunnel"
include_length = yes
require_client_cert = no
}
tls: Using cached TLS configuration from previous invocation
# Linked to sub-module rlm_eap_peap
peap {
tls = "tls-common"
default_eap_type = "mschapv2"
copy_request_to_tunnel = yes
use_tunneled_reply = no
proxy_tunneled_request_as_eap = yes
virtual_server = "inner-tunnel"
soh = no
require_client_cert = no
}
tls: Using cached TLS configuration from previous invocation
# Linked to sub-module rlm_eap_mschapv2
mschapv2 {
with_ntdomain_hack = no
send_error = no
}
# Instantiating module "files" from file /etc/freeradius/mods-enabled/files
reading pairlist file /etc/freeradius/mods-config/files/authorize
[/etc/freeradius/mods-config/files/authorize]:326 Check item "Group" found in reply item list for user "ms". This attribute MUST go on the first line with the other check items
reading pairlist file /etc/freeradius/mods-config/files/accounting
reading pairlist file /etc/freeradius/mods-config/files/pre-proxy
# Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter
reading pairlist file /etc/freeradius/mods-config/attr_filter/post-proxy
# Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter
reading pairlist file /etc/freeradius/mods-config/attr_filter/pre-proxy
# Instantiating module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter
reading pairlist file /etc/freeradius/mods-config/attr_filter/access_reject
# Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter
reading pairlist file /etc/freeradius/mods-config/attr_filter/access_challenge
# Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter
reading pairlist file /etc/freeradius/mods-config/attr_filter/accounting_response
# Instantiating module "attr_filter.coa" from file /etc/freeradius/mods-enabled/attr_filter
reading pairlist file /etc/freeradius/mods-config/attr_filter/coa
# Instantiating module "expiration" from file /etc/freeradius/mods-enabled/expiration
} # modules
radiusd: #### Loading Virtual Servers ####
server { # from file /etc/freeradius/radiusd.conf
} # server
server check-eap-tls { # from file /etc/freeradius/sites-enabled/check-eap-tls
# Loading authorize {...}
} # server check-eap-tls
server blackhole { # from file /etc/freeradius/sites-enabled/blackhole
# Loading authorize {...}
} # server blackhole
server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel
# Loading authenticate {...}
Compiling Auth-Type PAP for attr Auth-Type
Compiling Auth-Type CHAP for attr Auth-Type
Compiling Auth-Type MS-CHAP for attr Auth-Type
# Loading authorize {...}
Ignoring "sql" (see raddb/mods-available/README.rst)
Ignoring "ldap" (see raddb/mods-available/README.rst)
# Loading post-proxy {...}
# Loading post-auth {...}
Compiling Post-Auth-Type REJECT for attr Post-Auth-Type
} # server inner-tunnel
server default { # from file /etc/freeradius/sites-enabled/default
# Loading authenticate {...}
Compiling Auth-Type PAP for attr Auth-Type
Compiling Auth-Type CHAP for attr Auth-Type
Compiling Auth-Type MS-CHAP for attr Auth-Type
# Loading authorize {...}
Compiling Autz-Type New-TLS-Connection for attr Autz-Type
# Loading preacct {...}
# Loading accounting {...}
# Loading pre-proxy {...}
# Loading post-proxy {...}
# Loading post-auth {...}
Compiling Post-Auth-Type REJECT for attr Post-Auth-Type
Compiling Post-Auth-Type Challenge for attr Post-Auth-Type
Compiling Post-Auth-Type Client-Lost for attr Post-Auth-Type
} # server default
thread pool {
start_servers = 5
max_servers = 32
min_spare_servers = 3
max_spare_servers = 10
max_requests_per_server = 0
cleanup_delay = 5
max_queue_size = 65536
auto_limit_acct = no
}
Thread spawned new child 1. Total threads in pool: 1
Thread spawned new child 2. Total threads in pool: 2
Thread spawned new child 3. Total threads in pool: 3
Thread spawned new child 4. Total threads in pool: 4
Thread spawned new child 5. Total threads in pool: 5
Thread pool initialized
radiusd: #### Opening IP addresses and Ports ####
listen {
type = "auth+acct"
virtual_server = "default"
ipaddr = *
port = 2083
proto = "tcp"
tls {
verify_depth = 0
pem_file_type = yes
private_key_file = "/etc/freeradius/certs/server.pem"
certificate_file = "/etc/freeradius/certs/server.pem"
ca_file = "/etc/freeradius/certs/ca.pem"
private_key_password = <<< secret >>>
random_file = "/dev/urandom"
fragment_size = 8192
include_length = yes
auto_chain = yes
check_crl = no
check_all_crl = no
ca_path_reload_interval = 3600
cipher_list = "DEFAULT"
cipher_server_preference = no
require_client_cert = yes
reject_unknown_intermediate_ca = no
ecdh_curve = "prime256v1"
tls_max_version = "1.3"
tls_min_version = "1.2"
cache {
enable = yes
lifetime = 24
name = "TLS RadSec"
max_entries = 255
persist_dir = "/var/log/freeradius/tlscache"
}
verify {
skip_if_ocsp_ok = no
tmpdir = "/var/log/freeradius/temporary"
}
ocsp {
enable = no
override_cert_url = no
use_nonce = yes
timeout = 0
softfail = no
}
}
Thread 5 waiting to be assigned a request
Thread 4 waiting to be assigned a request
check_client_connections = no
limit {
max_connections = 32
lifetime = 0
idle_timeout = 30
}
Thread 3 waiting to be assigned a request
Thread 2 waiting to be assigned a request
Thread 1 waiting to be assigned a request
clients = "radsec"
client 127.0.0.1 {
ipaddr = 127.0.0.1
require_message_authenticator = no
secret = <<< secret >>>
proto = "tls"
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
}
listen {
type = "auth"
ipaddr = *
port = 0
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
listen {
type = "acct"
ipaddr = *
port = 0
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
listen {
type = "auth"
ipv6addr = ::
port = 0
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
listen {
type = "acct"
ipv6addr = ::
port = 0
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
Listening on auth+acct proto tcp address * port 2083 (TLS) bound to server default
Listening on auth address * port 1812 bound to server default
Listening on acct address * port 1813 bound to server default
Listening on auth address :: port 1812 bound to server default
Listening on acct address :: port 1813 bound to server default
Ready to process requests
Threads: total/active/spare threads = 5/0/5
Waking up in 0.3 seconds.
Thread 5 got semaphore
Thread 5 handling request 0, (1 handled so far)
(0) Received Access-Request Id 0 from 127.0.0.1:50806 to 127.0.0.1:1812 length 141
(0) User-Name = "@example.org"
(0) NAS-IP-Address = 127.0.0.1
(0) Calling-Station-Id = "22-44-66-69-73-69"
(0) Framed-MTU = 1400
(0) NAS-Port-Type = Wireless-802.11
(0) Service-Type = Framed-User
(0) Connect-Info = "rad_eap_test + eapol_test"
(0) EAP-Message = 0x0233001101406578616d706c652e6f7267
(0) Message-Authenticator = 0x8025f831b70a60f7e26cc9ec2153ffeb
(0) # Executing section authorize from file /etc/freeradius/sites-enabled/default
(0) authorize {
(0) policy filter_username {
(0) if (&User-Name) {
(0) if (&User-Name) -> TRUE
(0) if (&User-Name) {
(0) if (&User-Name =~ / /) {
(0) if (&User-Name =~ / /) -> FALSE
(0) if (&User-Name =~ /@[^@]*@/ ) {
(0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(0) if (&User-Name =~ /\.\./ ) {
(0) if (&User-Name =~ /\.\./ ) -> FALSE
(0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
(0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE
(0) if (&User-Name =~ /\.$/) {
(0) if (&User-Name =~ /\.$/) -> FALSE
(0) if (&User-Name =~ /@\./) {
(0) if (&User-Name =~ /@\./) -> FALSE
(0) } # if (&User-Name) = notfound
(0) } # policy filter_username = notfound
(0) [preprocess] = ok
(0) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(0) auth_log: --> /var/log/freeradius/radacct/127.0.0.1/auth-detail-20220401
(0) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/auth-detail-20220401
(0) auth_log: EXPAND %t
(0) auth_log: --> Fri Apr 1 18:13:49 2022
(0) [auth_log] = ok
(0) policy permit_only_eap {
(0) if (!&EAP-Message) {
(0) if (!&EAP-Message) -> FALSE
(0) } # policy permit_only_eap = ok
(0) [chap] = noop
(0) [mschap] = noop
(0) [digest] = noop
(0) suffix: Checking for suffix after "@"
(0) suffix: Looking up realm "example.org" for User-Name = "@example.org"
(0) suffix: Found realm "example.org"
(0) suffix: Adding Realm = "example.org"
(0) suffix: Proxying request from user @example.org to realm example.org
(0) suffix: Preparing to proxy authentication request to realm "example.org"
(0) [suffix] = updated
(0) eap: Request is supposed to be proxied to Realm example.org. Not doing EAP.
(0) [eap] = noop
(0) [files] = noop
(0) [expiration] = noop
(0) [logintime] = noop
(0) [pap] = noop
(0) } # authorize = updated
(0) Starting proxy to home server 194.160.185.188 port 2083
(0) server default {
(0) # Executing section pre-proxy from file /etc/freeradius/sites-enabled/default
(0) pre-proxy {
(0) if ("%{home_server_pool:name}" == "%{client:pool}") {
(0) EXPAND %{home_server_pool:name}
(0) --> EXAMPLEPOOL
(0) EXPAND %{client:pool}
(0) --> LOCAL
(0) if ("%{home_server_pool:name}" == "%{client:pool}") -> FALSE
(0) policy operator-name.pre-proxy {
(0) if (("%{request:Packet-Type}" == 'Access-Request') && "%{client:Operator-Name}") {
(0) EXPAND %{request:Packet-Type}
(0) --> Access-Request
(0) EXPAND %{client:Operator-Name}
(0) -->
(0) if (("%{request:Packet-Type}" == 'Access-Request') && "%{client:Operator-Name}") -> FALSE
(0) } # policy operator-name.pre-proxy = noop
(0) policy cui.pre-proxy {
(0) if (("%{request:Packet-Type}" == 'Access-Request') && ("%{client:add_cui}" == 'yes')) {
(0) EXPAND %{request:Packet-Type}
(0) --> Access-Request
(0) EXPAND %{client:add_cui}
(0) -->
(0) if (("%{request:Packet-Type}" == 'Access-Request') && ("%{client:add_cui}" == 'yes')) -> FALSE
(0) } # policy cui.pre-proxy = noop
(0) attr_filter.pre-proxy: EXPAND %{Realm}
(0) attr_filter.pre-proxy: --> example.org
(0) attr_filter.pre-proxy: Matched entry DEFAULT at line 50
(0) [attr_filter.pre-proxy] = updated
(0) pre_proxy_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d
(0) pre_proxy_log: --> /var/log/freeradius/radacct/127.0.0.1/pre-proxy-detail-20220401
(0) pre_proxy_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/pre-proxy-detail-20220401
(0) pre_proxy_log: EXPAND %t
(0) pre_proxy_log: --> Fri Apr 1 18:13:49 2022
(0) [pre_proxy_log] = ok
(0) } # pre-proxy = updated
(0) }
(TLS) Trying new outgoing proxy connection to proxy (0.0.0.0, 0) -> home_server (194.160.185.188, 2083)
Requiring Server certificate
(0) (TLS) Handshake state - before SSL initialization
(0) (TLS) Handshake state - Client before SSL initialization
(0) (TLS) send TLS 1.2 Handshake, ClientHello
(0) (TLS) Handshake state - Client SSLv3/TLS write client hello
(0) (TLS) Handshake state - Client SSLv3/TLS write client hello
(0) (TLS) recv TLS 1.2 Handshake, ServerHello
(0) (TLS) Handshake state - Client SSLv3/TLS read server hello
(0) (TLS) recv TLS 1.2 Handshake, Certificate
(0) (TLS) Creating attributes from server certificate
(0) TLS-Cert-Serial := "e1b726cde51cc617"
(0) TLS-Cert-Expiration := "161211133926Z"
(0) TLS-Cert-Valid-Since := "161012133926Z"
(0) TLS-Cert-Subject := "/C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress=admin@example.org/CN=Example Certificate Authority"
(0) TLS-Cert-Issuer := "/C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress=admin@example.org/CN=Example Certificate Authority"
(0) TLS-Cert-Common-Name := "Example Certificate Authority"
(0) ERROR: (TLS) OpenSSL says error 10 : certificate has expired
Segmentation fault
Reading configuration file 'eap.cfg'
Line: 1 - start of a new network block
ssid - hexdump_ascii(len=7):
65 78 61 6d 70 6c 65 example
key_mgmt: 0x8
eap methods - hexdump(len=16): 00 00 00 00 19 00 00 00 00 00 00 00 00 00 00 00
identity - hexdump_ascii(len=18):
66 6f 6f 62 61 72 40 65 78 61 6d 70 6c 65 2e 6f foobar@example.o
72 67 rg
anonymous_identity - hexdump_ascii(len=12):
40 65 78 61 6d 70 6c 65 2e 6f 72 67 @example.org
password - hexdump_ascii(len=12):
66 6f 6f 62 61 72 66 6f 6f 62 61 72 foobarfoobar
phase2 - hexdump_ascii(len=16):
61 75 74 68 65 61 70 3d 4d 53 43 48 41 50 56 32 autheap=MSCHAPV2
Priority group 0
id=0 ssid='example'
Authentication server 127.0.0.1:1812
RADIUS local address: 127.0.0.1:46079
ENGINE: Loading builtin engines
ENGINE: Loading builtin engines
EAPOL: SUPP_PAE entering state DISCONNECTED
EAPOL: KEY_RX entering state NO_KEY_RECEIVE
EAPOL: SUPP_BE entering state INITIALIZE
EAP: EAP entering state DISABLED
EAPOL: External notification - portValid=0
EAPOL: External notification - portEnabled=1
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: SUPP_BE entering state IDLE
EAP: EAP entering state INITIALIZE
EAP: EAP entering state IDLE
Sending fake EAP-Request-Identity
EAPOL: Received EAP-Packet frame
EAPOL: SUPP_PAE entering state RESTART
EAP: EAP entering state INITIALIZE
EAP: EAP entering state IDLE
EAPOL: SUPP_PAE entering state AUTHENTICATING
EAPOL: SUPP_BE entering state REQUEST
EAPOL: getSuppRsp
EAP: EAP entering state RECEIVED
EAP: Received EAP-Request id=39 method=1 vendor=0 vendorMethod=0
EAP: EAP entering state IDENTITY
CTRL-EVENT-EAP-STARTED EAP authentication started
EAP: Status notification: started (param=)
EAP: EAP-Request Identity data - hexdump_ascii(len=0):
EAP: using anonymous identity - hexdump_ascii(len=12):
40 65 78 61 6d 70 6c 65 2e 6f 72 67 @example.org
EAP: EAP entering state SEND_RESPONSE
EAP: EAP entering state IDLE
EAPOL: SUPP_BE entering state RESPONSE
EAPOL: txSuppRsp
WPA: eapol_test_eapol_send(type=0 len=17)
TX EAP -> RADIUS - hexdump(len=17): 02 27 00 11 01 40 65 78 61 6d 70 6c 65 2e 6f 72 67
Encapsulating EAP message into a RADIUS packet
Learned identity from EAP-Response-Identity - hexdump(len=12): 40 65 78 61 6d 70 6c 65 2e 6f 72 67
Sending RADIUS message to authentication server
RADIUS message: code=1 (Access-Request) identifier=0 length=141
Attribute 1 (User-Name) length=14
Value: '@example.org'
Attribute 4 (NAS-IP-Address) length=6
Value: 127.0.0.1
Attribute 31 (Calling-Station-Id) length=19
Value: '22-44-66-69-73-69'
Attribute 12 (Framed-MTU) length=6
Value: 1400
Attribute 61 (NAS-Port-Type) length=6
Value: 19
Attribute 6 (Service-Type) length=6
Value: 2
Attribute 77 (Connect-Info) length=27
Value: 'rad_eap_test + eapol_test'
Attribute 79 (EAP-Message) length=19
Value: 0227001101406578616d706c652e6f7267
Attribute 80 (Message-Authenticator) length=18
Value: d8dcc9640d7e5c16f7ec9f79276e520d
Next RADIUS client retransmit in 3 seconds
EAPOL: SUPP_BE entering state RECEIVE
EAPOL: startWhen --> 0
STA 22:44:66:69:73:69: Resending RADIUS message (id=0)
Next RADIUS client retransmit in 6 seconds
recvmsg[RADIUS]: Connection refused
EAPOL test timed out
EAPOL: EAP key not available
EAPOL: EAP Session-Id not available
WPA: Clear old PMK and PTK
MPPE keys OK: 0 mismatch: 1
FAILURE
Backtrace from LLDB or GDB
Reading symbols from /usr/sbin/freeradius...
Reading symbols from /usr/lib/debug/.build-id/15/9d3d00d90b6bf5f17b76dd6cae129714a27eb6.debug...
Attaching to program: /usr/sbin/freeradius, process 55050
[New LWP 55052]
[New LWP 55053]
[New LWP 55054]
[New LWP 55055]
[New LWP 55056]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
0x00007fba7372a8b3 in __GI___select (nfds=nfds@entry=12,
readfds=readfds@entry=0x7ffdc517ba30, writefds=writefds@entry=0x0,
exceptfds=exceptfds@entry=0x0, timeout=timeout@entry=0x7ffdc517ba20)
at ../sysdeps/unix/sysv/linux/select.c:41
41 ../sysdeps/unix/sysv/linux/select.c: Permission denied.
resultvar = 18446744073709551102
sc_cancel_oldtype = 0
sc_ret = <optimized out>
nfds = 12
readfds = 0x7ffdc517ba30
writefds = 0x0
exceptfds = 0x0
timeout = 0x7ffdc517ba20
Thread 6 (Thread 0x7fba69fa2700 (LWP 55056) "freeradius"):
#0 0x00007fba73700207 in __GI___wait4 (pid=55059, stat_loc=stat_loc@entry=0x7fba69f9eb88, options=options@entry=0, usage=usage@entry=0x0) at ../sysdeps/unix/sysv/linux/wait4.c:27
No locals.
#1 0x00007fba73700187 in __GI___waitpid (pid=<optimized out>, stat_loc=stat_loc@entry=0x7fba69f9eb88, options=options@entry=0) at waitpid.c:38
No locals.
#2 0x00007fba7367daa7 in do_system (line=line@entry=0x7fba69f9f320 "gdb -silent -x /etc/freeradius/panic.gdb /usr/sbin/freeradius 55050 2>&1 | tee /var/log/freeradius/gdb-freeradius-55050.log") at ../sysdeps/posix/system.c:172
__result = <optimized out>
_buffer = {__routine = 0x7fba7367dcd0 <cancel_handler>, __arg = 0x7fba69f9eb90, __canceltype = 0, __prev = 0x0}
_avail = 1
cancel_args = {quit = 0x7fba737f63a0 <quit>, intr = 0x7fba737f6440 <intr>, pid = 55059}
status = -1
ret = 0
pid = 55059
sa = {__sigaction_handler = {sa_handler = 0x1, sa_sigaction = 0x1}, sa_mask = {__val = {65536, 0 <repeats 15 times>}}, sa_flags = 0, sa_restorer = 0x0}
omask = {__val = {1024, 0, 4294967295, 0, 140438776577760, 140438779514656, 0, 140438618631232, 37, 140438777047076, 140441063108164, 140438518583280, 140438518583280, 140438779490496, 140438618633111, 413}}
reset = {__val = {6, 0 <repeats 15 times>}}
spawn_attr = {__flags = 12, __pgrp = 0, __sd = {__val = {6, 0 <repeats 15 times>}}, __ss = {__val = {1024, 0, 4294967295, 0, 140438776577760, 140438779514656, 0, 140438618631232, 37, 140438777047076, 140441063108164, 140438518583280, 140438518583280, 140438779490496, 140438618633111, 413}}, __sp = {sched_priority = 0}, __policy = 0, __pad = {0 <repeats 16 times>}}
#3 0x00007fba7367de5a in __libc_system (line=line@entry=0x7fba69f9f320 "gdb -silent -x /etc/freeradius/panic.gdb /usr/sbin/freeradius 55050 2>&1 | tee /var/log/freeradius/gdb-freeradius-55050.log") at ../sysdeps/posix/system.c:204
No locals.
#4 0x00007fba73cc1338 in fr_fault (sig=<optimized out>) at src/lib/debug.c:793
disable = true
cmd = "gdb -silent -x /etc/freeradius/panic.gdb /usr/sbin/freeradius 55050 2>&1 | tee /var/log/freeradius/gdb-freeradius-55050.log", '\000' <repeats 408 times>
out = 0x7fba69f9f397 ".log"
left = 413
ret = <optimized out>
p = 0x7fba73cf62d1 <panic_action+113> ".log"
q = 0x0
code = <optimized out>
#5 <signal handler called>
No locals.
#6 fr_pair_add (add=0x7fba64034890, first=0x78) at src/lib/pair.c:253
i = <optimized out>
i = <optimized out>
#7 fr_pair_add (first=0x78, add=0x7fba64034890) at src/lib/pair.c:245
i = <optimized out>
#8 0x000055facc3da061 in cbtls_verify (ok=0, ctx=<optimized out>) at src/main/tls.c:3155
p = <optimized out>
subject = "/C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress=admin@example.org/CN=Example Certificate Authority\000\315\372U\000\000X\025\372i\272\177\000\000\235\254\320s\272\177\000\000 \000\000\000\060\000\000\000\260\374\371i\272\177\000\000\360\373\371i\272\177\000\000\000\220E\257\060\250\016\237\000\374\371i\272\177\000\000\000\220E\257\000\000\000\000\250\016\331\315\372U\000\000\320\022\331\315\372U\000\000\254\323>\314\372U\000\000"...
issuer = "/C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress=admin@example.org/CN=Example Certificate Authority\000d\272\177\000\000 \020\331\315\372U\000\000\"\000\000\000\000\000\000\000\020\000\372i\272\177\000\000 \020\331\315\372U\000\000\257\200\322s\272\177\000\000&\244\321s\272\177\000\000B\315\000d\272\177\000\000\000\000\000\000\000\000\000\000\060\000\372i\272\177\000\000\064\027\314s\272\177\000\000\320\022\331\315\372U\000\000"...
attribute = "\000\000\000\000\000\000\000\000\260\266\315s\272\177\000\000\370\002\372i\272\177\000\000\000\000\000\000\000\000\000\000\200\322\000d\272\177\000\000\300\315\000d\272\177\000\000\200\316\000d\272\177\000\000p\340\221s\272\177\000\000example.org\000\272\177\000\000 \020\331\315\372U\000\000` \326\315\372U\000\000\300\324\000d\272\177\000\000\000\000\000\000\000\000\000\000 \020\331\315\372U\000\000\000\000\000\000\000\000\000\000 \020\331\315\372U", '\000' <repeats 18 times>, "\202\255\321s\272\177\000\000\340\000\323s\272\177\000\000\235\254\320s\272\177\000\000\300\324\000d\272\177\000\000\001\000\000\000\272\177\000\000 \017\000d\272\177\000\000\000"...
value = "\263\000\000\000\000\000\000\000\263\000\000\000\000\000\000\000\\@", '\000' <repeats 14 times>, "\320\006\326\315\372U", '\000' <repeats 18 times>, " \020\331\315\372U\000\000\006\000\000\000\000\000\000\000̮\221s\272\177\000\000Q\000\000\000\000\000\000\000\225\000\000\000\000\000\000\000\220\b\000\000\000\000\000\000\371\n\316s\272\177\000\000\320\313\000d\272\177\000\000P\n\372i\272\177\000\000\005\000\000\000\000\000\000\000 \020\331\315\372U\000\000\001\000\000\000\000\000\000\000\000\220E\257\060\250\016\237\300\016\000d\272\177\000\000$\017\000d\272\177\000\000 \017\000d\272\177\000\000P\n\372i\272\177\000\000%\017\000d\272\177\000\000 "...
common_name = "Example Certificate Authority", '\000' <repeats 11 times>, "X\f\372i\272\177\000\000\000\000\000\000\000\000\000\000\004\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\030\000\000\000\000\000\000\000\002\000\000\000\272\177\000\000\037\000\000\000\000\000\000\000\t", '\000' <repeats 11 times>, "\f\000\000\000X\273\312\315\372U\000\000\000\220E\257\060\250\016\237\000\000\000\000\000\000\000\000h\304\311s\272\177\000\000\b:\003d\272\177\000\000\220\r\372i\272\177\000\000\220\r\372i\272\177\000\000\360\026\372i\272\177\000\000h\304\311s\272\177\000\000\026\213\246s\272\177\000\000\000\000\000\000\000\000\000\000"...
cn_str = "\004\000\000\000\000\000\000\000\t\233\246s\272\177\000\000\360\026\372i\272\177\000\000'\000\000\000\000\000\000\000\372\207\312\315\372U\000\000\000\220E\257\060\250\016\237 \000\000\000\000\000\000\000\037\210\312\315\372U\000\000\350=\003d\272\177\000\000\000\220E\257\060\250\016\237\300\020\372i\272\177\000\000\060\335\311s\272\177\000\000\350=\003d\272\177\000\000\060\335\311s\272\177\000\000\300\020\372i\272\177\000\000\360\026\372i\272\177\000\000\004\000\000\000\000\000\000\000\201\215\246s\272\177\000\000\004\000\000\000\000\000\000\000\000\220E\257\060\250\016\237\000\000\000\000\000\000\000\000h\304\311s\272\177\000\000\000\000\000\000\000\000\000\000`7\311s\272\177\000\000\370\207\312\315\372U\000\000\000"...
buf = "161012133926Z\000\061\067\000\022\331\315\372U\000\000K\266\314s\272\177\000\000\320\022\331\315\372U\000\000h\261\241\315\372U\000\000\220\002\316s\272\177\000\000\000\220E\257\060\250\016\237"
client_cert = <optimized out>
ext_list = <optimized out>
ssl = 0x7fba6401f400
err = 10
depth = 1
lookup = <optimized out>
loc = <optimized out>
conf = 0x55facda0fa70
my_ok = 0
sn = <optimized out>
asn_time = <optimized out>
certs = 0x7fba6400f160
identity = 0x0
ocsp_store = 0x0
issuer_cert = <optimized out>
do_verify = false
vp = <optimized out>
talloc_ctx = 0x0
request = 0x7fba64021330
#9 0x00007fba73bc5ca5 in ?? () from /lib/x86_64-linux-gnu/libcrypto.so.1.1
No symbol table info available.
#10 0x00007fba73bc5f81 in ?? () from /lib/x86_64-linux-gnu/libcrypto.so.1.1
No symbol table info available.
#11 0x00007fba73bc7f88 in ?? () from /lib/x86_64-linux-gnu/libcrypto.so.1.1
No symbol table info available.
#12 0x00007fba73bc8804 in X509_verify_cert () from /lib/x86_64-linux-gnu/libcrypto.so.1.1
No symbol table info available.
#13 0x00007fba73953dd8 in ?? () from /lib/x86_64-linux-gnu/libssl.so.1.1
No symbol table info available.
#14 0x00007fba739757cb in ?? () from /lib/x86_64-linux-gnu/libssl.so.1.1
No symbol table info available.
#15 0x00007fba7397167d in ?? () from /lib/x86_64-linux-gnu/libssl.so.1.1
No symbol table info available.
#16 0x000055facc3dcc9e in tls_new_client_session (ctx=ctx@entry=0x7fba6400f090, conf=0x55facda0fa70, fd=12, certs=certs@entry=0x7fba6400f160) at src/main/tls.c:615
ret = <optimized out>
verify_mode = 3
ssn = 0x7fba6400f220
request = <optimized out>
#17 0x000055facc3b33a6 in proxy_new_listener (ctx=<optimized out>, home=0x55facda088d0, src_port=src_port@entry=0) at src/main/listen.c:3073
now = 1648829723
this = 0x7fba6400eee0
sock = 0x7fba6400f090
buffer = "proxy (0.0.0.0, 0) -> home_server (194.160.185.188, 2083)\000\323s\272\177\000\000\002\000\000\000\000\000\000\000 \020\331\315\372U\000\000\210\034\372i\272\177\000\000\210\020\331\315\372U\000\000\350\001A\314\372U\000\000\235\254\320s\272\177\000\000 \000\000\000\060\000\000\000\200\034\372i\272\177\000\000\300\033\372i\272\177\000\000\000\220E\257\060\250\016\237\347M?\314\372U\000\000\331b\260W", '\000' <repeats 12 times>, "\330\002", '\000' <repeats 14 times>, "`\032\372i\272\177\000\000\000\000\000\000\000\000\000\000"...
#18 0x000055facc3c9661 in insert_into_proxy_hash (request=request@entry=0x55facdd91020) at src/main/process.c:2370
this = <optimized out>
sock = <optimized out>
buf = "\347M?\314\372U\000\000iI\322s\272\177\000\000D[\322s\272\177\000\000\300\315\000d\272\177\000\000\250\034\372i\272\177", '\000' <repeats 35 times>, "\220E\257\060\250\016\237\000\000\000\000\000\000\000\000 \020\331\315\372U\000\000]\r\000\000\000\000\000\000\347M?\314\372U\000\000\272[\322s\272\177\000\000(\002A\314\372U\000"
tries = <optimized out>
success = <optimized out>
proxy_listener = 0x0
#19 0x000055facc3cf2e0 in request_proxy (request=request@entry=0x55facdd91020) at src/main/process.c:3455
buffer = "\260\035\372i\272\177\000\000\342\372\313s\272\177\000\000\001\000\000\000\000\000\000\000\200\377\377\377\000\000\000\000\260\035\372i\272\177\000\000\000\000\000\000\000\000\000\000\001\000\000\000\000\000\000\000(\002A\314\372U\000\000\350\001A\314\372U\000\000\337\341\314s\272\177\000\000\210;?\314\372U\000\000\320\022\331\315\372U\000\000\250\035\372i\272\177\000\000\320\022\331\315\372U", '\000' <repeats 11 times>, "\220E\257\060\250\016\237"
#20 0x000055facc3cf631 in request_running (request=0x55facdd91020, action=<optimized out>) at src/main/process.c:1664
rcode = <optimized out>
__FUNCTION__ = "request_running"
#21 0x000055facc3c6400 in request_handler_thread (arg=0x55facdd85160) at src/main/threads.c:826
self = 0x55facdd85160
re_wait = <optimized out>
#22 0x00007fba738f2ea7 in start_thread (arg=<optimized out>) at pthread_create.c:477
ret = <optimized out>
pd = <optimized out>
unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140438618646272, -6105730398937419842, 140727910120030, 140727910120031, 140438618644288, 8396800, 6066565821550292926, 6066614313368285118}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
not_first_call = 0
#23 0x00007fba73732def in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
No locals.
Thread 5 (Thread 0x7fba6a7a3700 (LWP 55055) "freeradius"):
#0 futex_abstimed_wait_cancelable (private=0, abstime=0x0, clockid=0, expected=0, futex_word=0x55facc4101e8 <thread_pool+168>) at ../sysdeps/nptl/futex-internal.h:323
__ret = -512
clockbit = 256
op = 393
__ret = <optimized out>
oldtype = 0
err = <optimized out>
oldtype = <optimized out>
err = <optimized out>
__ret = <optimized out>
clockbit = <optimized out>
op = <optimized out>
__ret = <optimized out>
resultvar = <optimized out>
__arg6 = <optimized out>
__arg5 = <optimized out>
__arg4 = <optimized out>
__arg3 = <optimized out>
__arg2 = <optimized out>
__arg1 = <optimized out>
_a6 = <optimized out>
_a5 = <optimized out>
_a4 = <optimized out>
_a3 = <optimized out>
_a2 = <optimized out>
_a1 = <optimized out>
#1 do_futex_wait (sem=sem@entry=0x55facc4101e8 <thread_pool+168>, abstime=0x0, clockid=0) at sem_waitcommon.c:112
err = <optimized out>
#2 0x00007fba738fc278 in __new_sem_wait_slow (sem=sem@entry=0x55facc4101e8 <thread_pool+168>, abstime=0x0, clockid=0) at sem_waitcommon.c:184
_buffer = {__routine = 0x7fba738fc130 <__sem_wait_cleanup>, __arg = 0x55facc4101e8 <thread_pool+168>, __canceltype = 0, __prev = 0x0}
err = <optimized out>
d = 4294967296
#3 0x00007fba738fc2f1 in __new_sem_wait (sem=sem@entry=0x55facc4101e8 <thread_pool+168>) at sem_wait.c:42
No locals.
#4 0x000055facc3c6168 in request_handler_thread (arg=0x55facdd84fa0) at src/main/threads.c:755
self = 0x55facdd84fa0
re_wait = <optimized out>
#5 0x00007fba738f2ea7 in start_thread (arg=<optimized out>) at pthread_create.c:477
ret = <optimized out>
pd = <optimized out>
unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140438627038976, -6105730398937419842, 140727910120030, 140727910120031, 140438627036992, 8396800, 6066562524626022334, 6066614313368285118}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
not_first_call = 0
#6 0x00007fba73732def in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
No locals.
Thread 4 (Thread 0x7fba6afa4700 (LWP 55054) "freeradius"):
#0 futex_abstimed_wait_cancelable (private=0, abstime=0x0, clockid=0, expected=0, futex_word=0x55facc4101e8 <thread_pool+168>) at ../sysdeps/nptl/futex-internal.h:323
__ret = -512
clockbit = 256
op = 393
__ret = <optimized out>
oldtype = 0
err = <optimized out>
oldtype = <optimized out>
err = <optimized out>
__ret = <optimized out>
clockbit = <optimized out>
op = <optimized out>
__ret = <optimized out>
resultvar = <optimized out>
__arg6 = <optimized out>
__arg5 = <optimized out>
__arg4 = <optimized out>
__arg3 = <optimized out>
__arg2 = <optimized out>
__arg1 = <optimized out>
_a6 = <optimized out>
_a5 = <optimized out>
_a4 = <optimized out>
_a3 = <optimized out>
_a2 = <optimized out>
_a1 = <optimized out>
#1 do_futex_wait (sem=sem@entry=0x55facc4101e8 <thread_pool+168>, abstime=0x0, clockid=0) at sem_waitcommon.c:112
err = <optimized out>
#2 0x00007fba738fc278 in __new_sem_wait_slow (sem=sem@entry=0x55facc4101e8 <thread_pool+168>, abstime=0x0, clockid=0) at sem_waitcommon.c:184
_buffer = {__routine = 0x7fba738fc130 <__sem_wait_cleanup>, __arg = 0x55facc4101e8 <thread_pool+168>, __canceltype = 0, __prev = 0x0}
err = <optimized out>
d = 8589934592
#3 0x00007fba738fc2f1 in __new_sem_wait (sem=sem@entry=0x55facc4101e8 <thread_pool+168>) at sem_wait.c:42
No locals.
#4 0x000055facc3c6168 in request_handler_thread (arg=0x55facdd84de0) at src/main/threads.c:755
self = 0x55facdd84de0
re_wait = <optimized out>
#5 0x00007fba738f2ea7 in start_thread (arg=<optimized out>) at pthread_create.c:477
ret = <optimized out>
pd = <optimized out>
unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140438635431680, -6105730398937419842, 140727910120030, 140727910120031, 140438635429696, 8396800, 6066563623600779198, 6066614313368285118}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
not_first_call = 0
#6 0x00007fba73732def in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
No locals.
Thread 3 (Thread 0x7fba6b7a5700 (LWP 55053) "freeradius"):
#0 futex_abstimed_wait_cancelable (private=0, abstime=0x0, clockid=0, expected=0, futex_word=0x55facc4101e8 <thread_pool+168>) at ../sysdeps/nptl/futex-internal.h:323
__ret = -512
clockbit = 256
op = 393
__ret = <optimized out>
oldtype = 0
err = <optimized out>
oldtype = <optimized out>
err = <optimized out>
__ret = <optimized out>
clockbit = <optimized out>
op = <optimized out>
__ret = <optimized out>
resultvar = <optimized out>
__arg6 = <optimized out>
__arg5 = <optimized out>
__arg4 = <optimized out>
__arg3 = <optimized out>
__arg2 = <optimized out>
__arg1 = <optimized out>
_a6 = <optimized out>
_a5 = <optimized out>
_a4 = <optimized out>
_a3 = <optimized out>
_a2 = <optimized out>
_a1 = <optimized out>
#1 do_futex_wait (sem=sem@entry=0x55facc4101e8 <thread_pool+168>, abstime=0x0, clockid=0) at sem_waitcommon.c:112
err = <optimized out>
#2 0x00007fba738fc278 in __new_sem_wait_slow (sem=sem@entry=0x55facc4101e8 <thread_pool+168>, abstime=0x0, clockid=0) at sem_waitcommon.c:184
_buffer = {__routine = 0x7fba738fc130 <__sem_wait_cleanup>, __arg = 0x55facc4101e8 <thread_pool+168>, __canceltype = 0, __prev = 0x0}
err = <optimized out>
d = 12884901888
#3 0x00007fba738fc2f1 in __new_sem_wait (sem=sem@entry=0x55facc4101e8 <thread_pool+168>) at sem_wait.c:42
No locals.
#4 0x000055facc3c6168 in request_handler_thread (arg=0x55facdd57ee0) at src/main/threads.c:755
self = 0x55facdd57ee0
re_wait = <optimized out>
#5 0x00007fba738f2ea7 in start_thread (arg=<optimized out>) at pthread_create.c:477
ret = <optimized out>
pd = <optimized out>
unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140438643824384, -6105730398937419842, 140727910120030, 140727910120031, 140438643822400, 8396800, 6066560326676508606, 6066614313368285118}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
not_first_call = 0
#6 0x00007fba73732def in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
No locals.
Thread 2 (Thread 0x7fba6bfa6700 (LWP 55052) "freeradius"):
#0 futex_abstimed_wait_cancelable (private=0, abstime=0x0, clockid=0, expected=0, futex_word=0x55facc4101e8 <thread_pool+168>) at ../sysdeps/nptl/futex-internal.h:323
__ret = -512
clockbit = 256
op = 393
__ret = <optimized out>
oldtype = 0
err = <optimized out>
oldtype = <optimized out>
err = <optimized out>
__ret = <optimized out>
clockbit = <optimized out>
op = <optimized out>
__ret = <optimized out>
resultvar = <optimized out>
__arg6 = <optimized out>
__arg5 = <optimized out>
__arg4 = <optimized out>
__arg3 = <optimized out>
__arg2 = <optimized out>
__arg1 = <optimized out>
_a6 = <optimized out>
_a5 = <optimized out>
_a4 = <optimized out>
_a3 = <optimized out>
_a2 = <optimized out>
_a1 = <optimized out>
#1 do_futex_wait (sem=sem@entry=0x55facc4101e8 <thread_pool+168>, abstime=0x0, clockid=0) at sem_waitcommon.c:112
err = <optimized out>
#2 0x00007fba738fc278 in __new_sem_wait_slow (sem=sem@entry=0x55facc4101e8 <thread_pool+168>, abstime=0x0, clockid=0) at sem_waitcommon.c:184
_buffer = {__routine = 0x7fba738fc130 <__sem_wait_cleanup>, __arg = 0x55facc4101e8 <thread_pool+168>, __canceltype = 0, __prev = 0x0}
err = <optimized out>
d = 17179869184
#3 0x00007fba738fc2f1 in __new_sem_wait (sem=sem@entry=0x55facc4101e8 <thread_pool+168>) at sem_wait.c:42
No locals.
#4 0x000055facc3c6168 in request_handler_thread (arg=0x55facdd57f20) at src/main/threads.c:755
self = 0x55facdd57f20
re_wait = <optimized out>
#5 0x00007fba738f2ea7 in start_thread (arg=<optimized out>) at pthread_create.c:477
ret = <optimized out>
pd = <optimized out>
unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140438652217088, -6105730398937419842, 140727910120030, 140727910120031, 140438652215104, 8396800, 6066561425651265470, 6066614313368285118}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
not_first_call = 0
#6 0x00007fba73732def in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
No locals.
Thread 1 (Thread 0x7fba733087c0 (LWP 55050) "freeradius"):
#0 0x00007fba7372a8b3 in __GI___select (nfds=nfds@entry=12, readfds=readfds@entry=0x7ffdc517ba30, writefds=writefds@entry=0x0, exceptfds=exceptfds@entry=0x0, timeout=timeout@entry=0x7ffdc517ba20) at ../sysdeps/unix/sysv/linux/select.c:41
resultvar = 18446744073709551102
sc_cancel_oldtype = 0
sc_ret = <optimized out>
#1 0x00007fba73cdeea7 in fr_event_loop (el=0x55facdcb5670) at src/lib/event.c:613
i = <optimized out>
rcode = <optimized out>
when = {tv_sec = 0, tv_usec = 218591}
wake = 0x7ffdc517ba20
maxfd = 11
read_fds = {fds_bits = {4000, 0 <repeats 15 times>}}
master_fds = {fds_bits = {4000, 0 <repeats 15 times>}}
#2 0x000055facc3d0e81 in radius_event_process () at src/main/process.c:6121
No locals.
#3 0x000055facc3a4dfc in main (argc=<optimized out>, argv=<optimized out>) at src/main/radiusd.c:634
rcode = 0
status = <optimized out>
argval = <optimized out>
spawn_flag = true
display_version = false
flag = 0
from_child = {-1, -1}
state = 0x55facc40faa0 <global_state>
autofree = 0x55facd9ec330
A debugging session is active.
Inferior 1 [process 55050] will be detached.
Quit anyway? (y or n) [answered Y; input not from terminal]
[Inferior 1 (process 55050) detached]
What type of defect/bug is this?
Crash or memory corruption (segv, abort, etc...)
How can the issue be reproduced?
Process/proxy an Access-Request via RadSec to another RADIUS server with an expired server certificate. Platform: 5.10.0-13-amd64 #1 SMP Debian 5.10.106-1 (2022-03-17) GNU/Linux
Log output from the FreeRADIUS daemon
Relevant log output from client utilities
eapol_test -ceap.cfg -a127.0.0.1 -p1812 -stesting123 -t5 -M22:44:66:69:73:69 -C"rad_eap_test + eapol_test"
Reading configuration file 'eap.cfg' Line: 1 - start of a new network block ssid - hexdump_ascii(len=7): 65 78 61 6d 70 6c 65 example
key_mgmt: 0x8 eap methods - hexdump(len=16): 00 00 00 00 19 00 00 00 00 00 00 00 00 00 00 00 identity - hexdump_ascii(len=18): 66 6f 6f 62 61 72 40 65 78 61 6d 70 6c 65 2e 6f foobar@example.o 72 67 rg
anonymous_identity - hexdump_ascii(len=12): 40 65 78 61 6d 70 6c 65 2e 6f 72 67 @example.org
password - hexdump_ascii(len=12): 66 6f 6f 62 61 72 66 6f 6f 62 61 72 foobarfoobar
phase2 - hexdump_ascii(len=16): 61 75 74 68 65 61 70 3d 4d 53 43 48 41 50 56 32 autheap=MSCHAPV2 Priority group 0 id=0 ssid='example' Authentication server 127.0.0.1:1812 RADIUS local address: 127.0.0.1:46079 ENGINE: Loading builtin engines ENGINE: Loading builtin engines EAPOL: SUPP_PAE entering state DISCONNECTED EAPOL: KEY_RX entering state NO_KEY_RECEIVE EAPOL: SUPP_BE entering state INITIALIZE EAP: EAP entering state DISABLED EAPOL: External notification - portValid=0 EAPOL: External notification - portEnabled=1 EAPOL: SUPP_PAE entering state CONNECTING EAPOL: SUPP_BE entering state IDLE EAP: EAP entering state INITIALIZE EAP: EAP entering state IDLE Sending fake EAP-Request-Identity EAPOL: Received EAP-Packet frame EAPOL: SUPP_PAE entering state RESTART EAP: EAP entering state INITIALIZE EAP: EAP entering state IDLE EAPOL: SUPP_PAE entering state AUTHENTICATING EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request id=39 method=1 vendor=0 vendorMethod=0 EAP: EAP entering state IDENTITY CTRL-EVENT-EAP-STARTED EAP authentication started EAP: Status notification: started (param=) EAP: EAP-Request Identity data - hexdump_ascii(len=0): EAP: using anonymous identity - hexdump_ascii(len=12): 40 65 78 61 6d 70 6c 65 2e 6f 72 67 @example.org
EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp WPA: eapol_test_eapol_send(type=0 len=17) TX EAP -> RADIUS - hexdump(len=17): 02 27 00 11 01 40 65 78 61 6d 70 6c 65 2e 6f 72 67 Encapsulating EAP message into a RADIUS packet Learned identity from EAP-Response-Identity - hexdump(len=12): 40 65 78 61 6d 70 6c 65 2e 6f 72 67 Sending RADIUS message to authentication server RADIUS message: code=1 (Access-Request) identifier=0 length=141 Attribute 1 (User-Name) length=14 Value: '@example.org' Attribute 4 (NAS-IP-Address) length=6 Value: 127.0.0.1 Attribute 31 (Calling-Station-Id) length=19 Value: '22-44-66-69-73-69' Attribute 12 (Framed-MTU) length=6 Value: 1400 Attribute 61 (NAS-Port-Type) length=6 Value: 19 Attribute 6 (Service-Type) length=6 Value: 2 Attribute 77 (Connect-Info) length=27 Value: 'rad_eap_test + eapol_test' Attribute 79 (EAP-Message) length=19 Value: 0227001101406578616d706c652e6f7267 Attribute 80 (Message-Authenticator) length=18 Value: d8dcc9640d7e5c16f7ec9f79276e520d Next RADIUS client retransmit in 3 seconds EAPOL: SUPP_BE entering state RECEIVE EAPOL: startWhen --> 0 STA 22:44:66:69:73:69: Resending RADIUS message (id=0)
Next RADIUS client retransmit in 6 seconds recvmsg[RADIUS]: Connection refused EAPOL test timed out EAPOL: EAP key not available EAPOL: EAP Session-Id not available WPA: Clear old PMK and PTK MPPE keys OK: 0 mismatch: 1 FAILURE
Backtrace from LLDB or GDB