Bug 712903 - EAP TNC modules is not compiled and enabled by default and does not have updated TNC patch.
EAP TNC modules is not compiled and enabled by default and does not have upda...
Status: CLOSED CURRENTRELEASE
Product: Fedora
Classification: Fedora
Component: freeradius (Show other bugs)
19
Unspecified Unspecified
high Severity unspecified
: ---
: ---
Assigned To: John Dennis
Fedora Extras Quality Assurance
: Reopened
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2011-06-13 10:42 EDT by Avesh Agarwal
Modified: 2013-11-19 11:28 EST (History)
4 users (show)

See Also:
Fixed In Version: freeradius-3.0.0-1
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-11-19 11:28:47 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
updated EAP TNC patch for freeradius. (61.79 KB, patch)
2011-06-13 10:44 EDT, Avesh Agarwal
no flags Details | Diff
TNC TTLS patch (182.18 KB, patch)
2013-02-19 13:00 EST, Avesh Agarwal
no flags Details | Diff
Thsi patch fixes a regression in freeradius that prevents tnc to work. (682 bytes, patch)
2013-03-11 10:52 EDT, Avesh Agarwal
no flags Details | Diff

  None (edit)
Description Avesh Agarwal 2011-06-13 10:42:37 EDT
Description of problem:
There are 2 issues related to EAP_TNC module in Freeradius:
1. Freeradius does not have EAP_TNC module compiled and enabled by default.
2. The current EAP TNC module code base in Freeradius is from an older release of tnc@fhh (http://trust.inform.fh-hannover.de ). tnc@fhh has an updated release 0.8.2 and updated code for TNC support in Freeradius.

I have created an updated patch for latest EAP TNC support in Freeradius. The patch does:

1. Enables compilation of EAP-TNC in Freeradius.
2. Updated EAP_TNC code
3. Support of 2 inner authentication methods with EAP-MD5 as the first inner method and EAP-TNC as the second method when used with EAP_TTLS.

The patch has been created from the latest release tncffh-0.8.2.

Version-Release number of selected component (if applicable):
freeradius-2.1.10-7

How reproducible:
Always

Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info:
Comment 1 Avesh Agarwal 2011-06-13 10:44:29 EDT
Created attachment 504466 [details]
updated EAP TNC patch for freeradius.
Comment 2 Fedora End Of Life 2012-08-07 12:26:45 EDT
This message is a notice that Fedora 15 is now at end of life. Fedora
has stopped maintaining and issuing updates for Fedora 15. It is
Fedora's policy to close all bug reports from releases that are no
longer maintained. At this time, all open bugs with a Fedora 'version'
of '15' have been closed as WONTFIX.

(Please note: Our normal process is to give advanced warning of this
occurring, but we forgot to do that. A thousand apologies.)

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, feel free to reopen
this bug and simply change the 'version' to a later Fedora version.

Bug Reporter: Thank you for reporting this issue and we are sorry that
we were unable to fix it before Fedora 15 reached end of life. If you
would still like to see this bug fixed and are able to reproduce it
against a later version of Fedora, you are encouraged to click on
"Clone This Bug" (top right of this page) and open it against that
version of Fedora.

Although we aim to fix as many bugs as possible during every release's
lifetime, sometimes those efforts are overtaken by events. Often a
more recent Fedora release includes newer upstream software that fixes
bugs or makes them obsolete.

The process we are following is described here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping
Comment 3 Avesh Agarwal 2013-02-07 11:59:49 EST
Reopening as this is required for TNC support in Fedora.
Comment 4 Avesh Agarwal 2013-02-07 12:03:52 EST
wpa_supplicant enables EAP_TNC bye default now, so just FYI.
Comment 5 John Dennis 2013-02-07 15:53:24 EST
I've been following your communication with Alan DeKok on freeradius-devel. Until such point as all the necessary patches are accepted upstream and are in upstreams git repo I see little point in enabling this by default in Fedora. The last email from Alan said he didn't think it works and knows little about TNC.

That means there is no maintainer for this code at the present time. To get this enabled by default in Fedora it's going to have to have some type of community support for it. I urge you to continue to work with upstream to get TNC into a stable state the rest of the FreeRADIUS developers and community accepts, then we can enable it in our builds.

You can always build an RPM with the module enabled if you want a private build, that's trivial.
Comment 6 John Dennis 2013-02-07 17:54:38 EST
Steve:

Why did you set the priority to high? What is critical about it?

Upstream does not appear to be ready to maintain it so the question is who is going to maintain this if we enable it?
Comment 8 Avesh Agarwal 2013-02-19 13:00:35 EST
Created attachment 699571 [details]
TNC TTLS patch

This patch adds ability to do EAP_TNC inside TTLS as a second EAP (inner) method. It is dependent on the libnaaeap lib in tncfhh package.
Comment 9 John Dennis 2013-02-19 16:12:38 EST
Was the patch in comment #8 sent upstream? Do you have the git commit id from upstream?
Comment 10 Avesh Agarwal 2013-02-19 16:15:16 EST
I have not yet sent the patch to upstream, as I have done only preliminary testing. I want to test it with other pieces of tnc before sending upstream.
Comment 11 Avesh Agarwal 2013-02-19 16:16:22 EST
(In reply to comment #9)
> Was the patch in comment #8 sent upstream? Do you have the git commit id
> from upstream?

Could you please any feedback on the patch? As I am not an expert on freeradius code, so your valuable comments would be appreciated.
Comment 12 Avesh Agarwal 2013-03-11 10:47:09 EDT
John,

I have been working with freeradius upstream for getting the patch in. They have accepted the patch and upstream commit is here: 

Here is the upstream commit 

https://github.com/FreeRADIUS/freeradius-server/commit/529b3fed6964969820b83f4e1501520231af7b3f

Could you please apply the patch now in fedora?
Comment 13 Avesh Agarwal 2013-03-11 10:52:43 EDT
Created attachment 708447 [details]
Thsi patch fixes a regression in freeradius that prevents tnc to work.

Freeradius upstream code introduced a regression by not allowing messages more than 253 bytes. It caused tnc to fail as thc messages were more than 253 bytes. This patch has been tailrod for current freeradius v2 branch. There is upstream commit for freeradius master branch here:


https://github.com/FreeRADIUS/freeradius-server/commit/4fdb8152223e3c5292ffaff32de6f9c840ad9da4
Comment 14 Fedora End Of Life 2013-04-03 15:49:26 EDT
This bug appears to have been reported against 'rawhide' during the Fedora 19 development cycle.
Changing version to '19'.

(As we did not run this process for some time, it could affect also pre-Fedora 19 development
cycle bugs. We are very sorry. It will help us with cleanup during Fedora 19 End Of Life. Thank you.)

More information and reason for this action is here:
https://fedoraproject.org/wiki/BugZappers/HouseKeeping/Fedora19
Comment 15 John Dennis 2013-11-19 11:28:47 EST
The FreeRADIUS 3.x packages now build rlm_eap_tnc

Note You need to log in before you can comment on or make changes to this bug.