<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2900.2769" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>Hi All,</FONT></DIV>
<DIV><FONT face=Arial size=2>I'm new to Radius, now encountered problems with
ldap_escape_func in rlm_ldap. please help me since it's really a bit urgent.
</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>the comments regarding to this function is 'Add an
ldap_escape_func. Escape the * character from the filter so that we can avoid
the trivial DoS of username=*'. if i was not wrong, this function intends to
filter out the * which follows the username, i.e, if username is 'userid*'
in access-request packet, ldapsearch is only based on 'userid'. but what's the
purpose for doing this and is it secure? or did i misunderstand the comments?
</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>the lastest version freeradius-1.0.5 has a slightly
different version for this piece of code, </FONT></DIV>
<DIV><FONT face=Arial
size=2>*****************************************************************</FONT></DIV>
<DIV><FONT face=Arial size=2>freeradius-1.0.5</FONT></DIV>
<DIV><FONT face=Arial
size=2>
if (strchr("*=\\,()", *in))
{<BR>
static const char *hex =
"0123456789abcdef";<BR>
if (outlen <= 3) break;</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial
size=2>
*(out++) =
'\\';<BR>
*(out++) = hex[((*in) >> 4) &
0x0f];<BR>
*(out++) = hex[(*in) &
0x0f];<BR>
outlen -=
3;<BR>
continue;<BR>
}</FONT></DIV>
<DIV><FONT face=Arial
size=2>**************************************************************</FONT></DIV>
<DIV><FONT face=Arial size=2>freeradius-1.0.4 and previous </FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial
size=2>
if (strchr("*", *in))
{<BR>
in++;<BR>
outlen--;<BR>
continue;<BR>
}</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>i couldn't figure out what does the change intend
to do, is it to filter out '*', '\\', '()' and '=' from username? and why should
it be in that way? please help me. thanks a lot in advance. </DIV>
<DIV><BR></DIV></FONT></BODY></HTML>