<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:13px"><font face="Times New Roman" size="3">
</font><font id="yui_3_16_0_1_1421887009198_8861" face="Calibri" size="3">I have faced the above subject matter when using the
latest git sources and built hostapd.</font><font face="Times New Roman" size="3">
</font><div id="yui_3_16_0_1_1421887009198_8863" style="margin: 0cm 0cm 0pt;"><font id="yui_3_16_0_1_1421887009198_8862" face="Calibri" size="3">This issue is not a problem in hostapd stable release
versions 2.1 and earlier.</font></div><font face="Times New Roman" size="3">
</font><div id="yui_3_16_0_1_1421887009198_8864" style="margin: 0cm 0cm 0pt;"><font face="Calibri" size="3"></font><br></div><font face="Times New Roman" size="3">
</font><div id="yui_3_16_0_1_1421887009198_8850" style="margin: 0cm 0cm 0pt;"><font id="yui_3_16_0_1_1421887009198_8849" face="Calibri" size="3">Is there intention to reattempt connection to RADIUS
server after start-up first attempt connection fail?</font></div><font face="Times New Roman" size="3">
</font><div style="margin: 0cm 0cm 0pt;"><font face="Calibri" size="3">If so, the below is an analysis of what changed from
stable release 2.2 onwards.</font></div><font face="Times New Roman" size="3">
</font><div id="yui_3_16_0_1_1421887009198_8851" style="margin: 0cm 0cm 0pt;"><font face="Calibri" size="3"></font><br></div><font face="Times New Roman" size="3">
</font><div id="yui_3_16_0_1_1421887009198_8853" style="margin: 0cm 0cm 0pt;"><font id="yui_3_16_0_1_1421887009198_8852" face="Calibri" size="3">Steps to reproduce failure environment:</font></div><font face="Times New Roman" size="3">
</font><div id="yui_3_16_0_1_1421887009198_8855" style="margin: 0cm 0cm 0pt;"><font id="yui_3_16_0_1_1421887009198_8854" face="Calibri" size="3">1. Start-up hostapd which is configured to connect to a
single external RADIUS server IP address.</font></div><font face="Times New Roman" size="3">
</font><div style="margin: 0cm 0cm 0pt;"><font face="Calibri" size="3">2. In the case when system has no network connection to
said IP address (be it the necessary network interface to access the RADIUS
server is not up yet, or relevant routing is not up yet, etc.), system will
fail to connect at startup initialisation. (hostapd log output at this point: '
connect[radius]: Network is unreachable ' )</font></div><font face="Times New Roman" size="3">
</font><div style="margin: 0cm 0cm 0pt;"><font face="Calibri" size="3">3. Subsequent attempts by hostapd to send radius packets
out when WiFi clients associate & negotiate security would continuously
fail, even though RADIUS server is now pingable by system. (hostapd log output
at this point: ' RADIUS No authentication server configured. ' )</font></div><font face="Times New Roman" size="3">
</font><div style="margin: 0cm 0cm 0pt;"><font face="Calibri" size="3"></font><br></div><font face="Times New Roman" size="3">
</font><div style="margin: 0cm 0cm 0pt;"><font face="Calibri" size="3">After reviewing the src/radius/radius_client.c file, the
following are my findings:</font></div><font face="Times New Roman" size="3">
</font><div style="margin: 0cm 0cm 0pt;"><font face="Calibri" size="3">a) In step 2 above, startup initialisation would run into
the radius_change_server() function which would attempt to make connect to
RADIUS server but fail in the fail case environment of step 2 above. The code
would then exit the function at an earlier point, without setting the
radius->auth_sock which occurs at tail end of radius_change_server().</font></div><font face="Times New Roman" size="3">
</font><div style="margin: 0cm 0cm 0pt;"><font face="Calibri" size="3">b) In step 3 above, hostapd would send out RADIUS packets
to RADIUS server in radius_client_send() function when a WiFi client is in
security negotiation, but fails and generates the log message in step 3 above
which originates from this function. This is due to a conditional check on the
same radius->auth_sock which did not get populated at startup as explained
in step a)</font></div><font face="Times New Roman" size="3">
</font><div style="margin: 0cm 0cm 0pt;"><font face="Calibri" size="3"></font><br></div><font face="Times New Roman" size="3">
</font><div id="yui_3_16_0_1_1421887009198_8848" style="margin: 0cm 0cm 0pt;"><font id="yui_3_16_0_1_1421887009198_8847" face="Calibri" size="3">Comparing the radius_client.c code between releases 2.1
& 2.2 shows that 2.2 adds this conditional check on radius->auth_sock in
radius_client_send().</font></div><font face="Times New Roman" size="3">
</font><div style="margin: 0cm 0cm 0pt;"><font face="Calibri" size="3"></font><br></div><font face="Times New Roman" size="3">
</font><div style="margin: 0cm 0cm 0pt;"><font face="Calibri"><font size="3">This is the point which causes the re-connection attempt
failure as</font><span style="mso-spacerun: yes;"><font size="3"> </font></span><font size="3">the code does not proceed
further down the function radius_client_send() to fail at sending packets
through the socket, thus triggering radius_client_handle_send_error() to run,
which would then trigger radius_change_server() to run again (successfully as
and when RADIUS server is pingable), and things will then work when the next
time the radius packet is retransmitted (I believe this was how it worked in
stable release 2.1 and earlier).</font></font></div><font face="Times New Roman" size="3">
</font><div style="margin: 0cm 0cm 0pt;"><font face="Calibri" size="3"></font><br></div><font face="Times New Roman" size="3">
</font><div style="margin: 0cm 0cm 0pt;"><font face="Calibri" size="3">I have tried removing the radius->auth_sock
conditional check from latest git code, and tested it to work successfully,
similar to releases 2.1 & earlier with respect to RADIUS server
reconnection attempt.</font></div><font face="Times New Roman" size="3">
</font><div style="margin: 0cm 0cm 0pt;"><font face="Calibri" size="3">The below is the patch which was used (basically reverting
the radius->auth_sock & radius->acct_sock condition check):</font></div><font face="Times New Roman" size="3">
</font><div style="margin: 0cm 0cm 0pt;"><font face="Calibri" size="3"></font><br></div><font face="Times New Roman" size="3">
</font><div style="margin: 0cm 0cm 0pt;"><font face="Calibri" size="3">diff --git a/src/radius/radius_client.c
b/src/radius/radius_client.c</font></div><font face="Times New Roman" size="3">
</font><div style="margin: 0cm 0cm 0pt;"><font face="Calibri" size="3">index 34f5685..9694cb6 100644</font></div><font face="Times New Roman" size="3">
</font><div style="margin: 0cm 0cm 0pt;"><font face="Calibri" size="3">--- a/src/radius/radius_client.c</font></div><font face="Times New Roman" size="3">
</font><div style="margin: 0cm 0cm 0pt;"><font face="Calibri" size="3">+++ b/src/radius/radius_client.c</font></div><font face="Times New Roman" size="3">
</font><div style="margin: 0cm 0cm 0pt;"><font face="Calibri" size="3">@@ -658,7 +658,7 @@ int radius_client_send(struct
radius_client_data *radius,</font></div><font face="Times New Roman" size="3">
</font><div style="margin: 0cm 0cm 0pt;"><font face="Calibri"><span style="mso-spacerun: yes;"><font size="3"> </font></span><font size="3">}</font></font></div><font face="Times New Roman" size="3">
</font><div style="margin: 0cm 0cm 0pt;"><span style="mso-spacerun: yes;"><font face="Calibri" size="3"></font></span><br></div><font face="Times New Roman" size="3">
</font><div style="margin: 0cm 0cm 0pt;"><font face="Calibri"><span style="mso-spacerun: yes;"><font size="3"> </font></span><font size="3">if
(msg_type == RADIUS_ACCT || msg_type == RADIUS_ACCT_INTERIM) {</font></font></div><font face="Times New Roman" size="3">
</font><div style="margin: 0cm 0cm 0pt;"><font face="Calibri"><font size="3">-</font><span style="mso-spacerun: yes;"><font size="3"> </font></span><font size="3">if
(conf->acct_server == NULL || radius->acct_sock < 0 ||</font></font></div><font face="Times New Roman" size="3">
</font><div style="margin: 0cm 0cm 0pt;"><font face="Calibri"><font size="3">+</font><span style="mso-spacerun: yes;"><font size="3"> </font></span><font size="3">if
(conf->acct_server == NULL ||</font></font></div><font face="Times New Roman" size="3">
</font><div id="yui_3_16_0_1_1421887009198_8928" style="margin: 0cm 0cm 0pt;"><font id="yui_3_16_0_1_1421887009198_8927" face="Calibri"><span style="mso-spacerun: yes;"><font size="3">
</font></span><font id="yui_3_16_0_1_1421887009198_8926" size="3">conf->acct_server->shared_secret == NULL) {</font></font></div><font face="Times New Roman" size="3">
</font><div id="yui_3_16_0_1_1421887009198_8931" style="margin: 0cm 0cm 0pt;"><font id="yui_3_16_0_1_1421887009198_8930" face="Calibri"><span style="mso-spacerun: yes;"><font size="3">
</font></span><font id="yui_3_16_0_1_1421887009198_8929" size="3">hostapd_logger(radius->ctx, NULL,</font></font></div><font face="Times New Roman" size="3">
</font><div id="yui_3_16_0_1_1421887009198_8934" style="margin: 0cm 0cm 0pt;"><font id="yui_3_16_0_1_1421887009198_8933" face="Calibri"><span style="mso-spacerun: yes;"><font size="3">
</font></span><font id="yui_3_16_0_1_1421887009198_8932" size="3">HOSTAPD_MODULE_RADIUS,</font></font></div><font face="Times New Roman" size="3">
</font><div id="yui_3_16_0_1_1421887009198_8870" style="margin: 0cm 0cm 0pt;"><font id="yui_3_16_0_1_1421887009198_8869" face="Calibri" size="3">@@ -673,7 +673,7 @@ int radius_client_send(struct
radius_client_data *radius,</font></div><font face="Times New Roman" size="3">
</font><div id="yui_3_16_0_1_1421887009198_8846" style="margin: 0cm 0cm 0pt;"><font id="yui_3_16_0_1_1421887009198_8845" face="Calibri"><span style="mso-spacerun: yes;"><font size="3"> </font></span><font id="yui_3_16_0_1_1421887009198_8844" size="3">s =
radius->acct_sock;</font></font></div><font face="Times New Roman" size="3">
</font><div id="yui_3_16_0_1_1421887009198_8937" style="margin: 0cm 0cm 0pt;"><font id="yui_3_16_0_1_1421887009198_8936" face="Calibri"><span style="mso-spacerun: yes;"><font size="3">
</font></span><font id="yui_3_16_0_1_1421887009198_8935" size="3">conf->acct_server->requests++;</font></font></div><font face="Times New Roman" size="3">
</font><div id="yui_3_16_0_1_1421887009198_8871" style="margin: 0cm 0cm 0pt;"><font face="Calibri"><span style="mso-spacerun: yes;"><font size="3"> </font></span><font size="3">} else {</font></font></div><font face="Times New Roman" size="3">
</font><div id="yui_3_16_0_1_1421887009198_8940" style="margin: 0cm 0cm 0pt;"><font id="yui_3_16_0_1_1421887009198_8939" face="Calibri"><font size="3">-</font><span style="mso-spacerun: yes;"><font size="3"> </font></span><font id="yui_3_16_0_1_1421887009198_8938" size="3">if
(conf->auth_server == NULL || radius->auth_sock < 0 ||</font></font></div><font face="Times New Roman" size="3">
</font><div id="yui_3_16_0_1_1421887009198_8872" style="margin: 0cm 0cm 0pt;"><font id="yui_3_16_0_1_1421887009198_8942" face="Calibri"><font size="3">+</font><span style="mso-spacerun: yes;"><font size="3"> </font></span><font id="yui_3_16_0_1_1421887009198_8941" size="3">if
(conf->auth_server == NULL ||</font></font></div><font face="Times New Roman" size="3">
</font><div id="yui_3_16_0_1_1421887009198_8875" style="margin: 0cm 0cm 0pt;"><font id="yui_3_16_0_1_1421887009198_8874" face="Calibri"><span style="mso-spacerun: yes;"><font size="3"> </font></span><span style="mso-spacerun: yes;"><font size="3"> </font></span><font id="yui_3_16_0_1_1421887009198_8873" size="3">conf->auth_server->shared_secret
== NULL) {</font></font></div><font face="Times New Roman" size="3">
</font><div id="yui_3_16_0_1_1421887009198_8878" style="margin: 0cm 0cm 0pt;"><font id="yui_3_16_0_1_1421887009198_8877" face="Calibri"><span style="mso-spacerun: yes;"><font size="3">
</font></span><font id="yui_3_16_0_1_1421887009198_8876" size="3">hostapd_logger(radius->ctx, NULL,</font></font></div><font face="Times New Roman" size="3">
</font><div id="yui_3_16_0_1_1421887009198_8881" style="margin: 0cm 0cm 0pt;"><font id="yui_3_16_0_1_1421887009198_8880" face="Calibri"><span style="mso-spacerun: yes;"><font size="3">
</font></span><font id="yui_3_16_0_1_1421887009198_8879" size="3">HOSTAPD_MODULE_RADIUS,</font></font></div><font face="Times New Roman" size="3">
</font><div id="yui_3_16_0_1_1421887009198_8882" style="margin: 0cm 0cm 0pt;"><font face="Calibri" size="3"></font><br></div><font face="Times New Roman" size="3">
</font><div id="yui_3_16_0_1_1421887009198_8884" style="margin: 0cm 0cm 0pt;"><font id="yui_3_16_0_1_1421887009198_8883" face="Calibri" size="3">There may be more behind the introduction of this
conditional check from release 2.2 onwards (certainly the radius client code is
more consolidated) and perhaps there are some plans/provisions to handle this
in a more elegant manner (granted that the mechanism to attempt re-connection
previously was through a failed attempt at sending a packet through the socket
with the initial invalid socket descriptor).</font></div><font face="Times New Roman" size="3">
</font><div id="yui_3_16_0_1_1421887009198_8886" style="margin: 0cm 0cm 0pt;"><font id="yui_3_16_0_1_1421887009198_8885" face="Calibri" size="3">Or perhaps there is no intention to reattempt connection
to RADIUS server altogether?</font></div><font face="Times New Roman" size="3">
</font><font face="Times New Roman" size="3">
</font><div id="yui_3_16_0_1_1421887009198_8887" style="margin: 0cm 0cm 0pt;"><font face="Calibri" size="3"></font><br></div><div id="yui_3_16_0_1_1421887009198_8889" style="margin: 0cm 0cm 0pt;"><font id="yui_3_16_0_1_1421887009198_8888" face="Calibri" size="3">Just wanted to bring notice to this RADIUS client
behavioural difference from stable release 2.2 onwards, and leave it to the
good judgement of hostapd developers.</font></div><font face="Times New Roman" size="3">
</font><span id="yui_3_16_0_1_1421887009198_8947" style='font-family: "Calibri","sans-serif"; font-size: 11pt; mso-ascii-theme-font: minor-latin; mso-fareast-font-family: Calibri; mso-fareast-theme-font: minor-latin; mso-hansi-theme-font: minor-latin; mso-bidi-font-family: "Times New Roman"; mso-bidi-theme-font: minor-bidi; mso-ansi-language: EN-MY; mso-fareast-language: EN-US; mso-bidi-language: AR-SA;'>Chrishanton</span></div></body></html>