Re: PPTP and Freeradius

Hi,

I've seen this before when using xl2tpd ONLY and this is fixed in xl2tpd 1.3
through  a patch to control.c file before complilation

Nev

-----Original Message-----
From: Steve Phillips [mailto:[email protected]] 
Sent: 19 July 2012 4:00 AM
Cc: [email protected]
Subject: Re: [Poptop-server] PPTP and Freeradius

Mostly right.

The pppd plugin appears to pass the ipparam value to the avpair construction
routine as seen by the many occurrences of the following code in radius.c
(part of the pppd sources)

     if (*remote_number) {
         rc_avpair_add(&send, PW_CALLING_STATION_ID, remote_number, 0,
                        VENDOR_NONE);
     } else if (ipparam)
         rc_avpair_add(&send, PW_CALLING_STATION_ID, ipparam, 0,
VENDOR_NONE);

There doesn't appear to be any manipulation of the ipparam variable up to
this point, so i'm not sure why it would be being truncated here.

Before contacting the freeradius list, it may pay to check that the radius
packet is actually being constructed properly by getting a packet dump, you
may also find the radattr plugin helpful for this - or setup freeradius on a
remote server and use tcpdump to capture a packer and load that into
something like wireshark for easy decoding.

If the packet is being constructed with the right values and freeradius is
mangling it - then post on the free radius list.

If the packet is being constructed incorrectly then I'm guessing something
in the 'add this avpair' function is truncating the ipparam variable

Sadly, I'm not too hot with C so i'm having a little difficulty trying to
track down why this could be happening. If the packet is being constructed
incorrectly however, you may want to direct your query to the pppd mailing
list.

HTH,

--
Steve.

On 19/07/2012 12:43 PM, James Cameron wrote:
> pptpd has the original client IP address, from the incoming 
> connection.
>
> The address is given to pppd by pptpd using the ipparam option, unless 
> the noipparam option is set in pptpd.conf, or the --noipparam option 
> is used on the command line.  There is no change made to the address.
> It is either passed in full, or not passed at all.
>
> One of the plugins available is part of the pptpd source tree, the 
> logwtmp plugin, which uses the pptpd-original-ip option, and calls the 
> logwtmp function to record the IP address in wtmp.  There is no change 
> made to the address.  I doubt if you are using this plugin.
>
> pppd also passes the ipparam value to any ip-up or ip-pre-up scripts 
> called.  There is no change made to the address.  I don't know if you 
> are using ip-up or ip-pre-up scripts for this logging.
>
> The address is given to plugins of pppd.  I don't know enough about 
> the freeradius plugin to say if it is used.  It seems from what you 
> observe that the address is changed before being used in freeradius 
> logging.
>
> Is there a freeradius project mailing list you can ask?
>
> Without understanding the cause of problem, I doubt that any tweak, 
> configuration or re-install will work.
>






------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/