August 2006 - Freeradius-Devel - lists.freeradius.org

proxying accounting packets without a realm
by Peter Nixon 14 Aug '06

14 Aug '06

Hi Guys I have the following in the "users" file: DEFAULT Called-Station-Id == "YYYYYY", Proxy-To-Realm := realm1 DEFAULT Called-Station-Id == "ZZZZZZZ", Proxy-To-Realm := realm2 This works great for Authentication, however I want the same rules to also apply to accounting packets. Is there any sane way to do this at present? Cheers -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

2 4

Re: Patch: eaptls packets too large, clash MTU
by Michael Joosten 12 Aug '06

12 Aug '06

> > while using EAPTLS via RADIUS for authentication of a PPP/L2TP/IPSec VPN > > (Microsoft style), I discovered that the generated EAPTLS packets are a > > little > > bit to large. If you take Framed-MTU serious, most of the EAPTLS header is > > not > > accounted for. Result: PPP communication with max. possible IPSec MTU > > fails > > silently, because the EAPTLS packets (esp. those with long certificates) > > are > > silently discarded. > > Framed-MTU works, BUT of course you need to set fragment_size in eap.conf to a value larger than possible MTUs, otherwise you just get fragment_size'd chunks of the TLS conversation in multiple EAP_MESSAGE attributes, as you can see in the code: ssn->length_flag = inst->conf->include_length; /* * We set a default fragment size, unless the Framed-MTU * tells us it's too big. */ ssn->offset = inst->conf->fragment_size; /* * Framed-MTU is the whole packet, so we cut off the * EAPOW header (4 bytes) to be prepended by the NAS. * NOTE: This does not account for other protocols and * purposes like wired PPP, which has 8 bytes overhead. */ vp = pairfind(handler->request->packet->vps, PW_FRAMED_MTU); if (vp && ((vp->lvalue - 4) < ssn->offset)) { ssn->offset = vp->lvalue - 4; } /* * And even more for the EAP TLS header: * code + id + length + type + flags + TLS len * 1 + 1 + 2 + 1 + 1 + 4 = 10 */ ssn->offset -= 10; Actually, I discussed that a little with Alan last year: =========================================================== In addition, we had a little problem with fragment_size and Framed-MTU in eap_tls.c. Somehow the EAP headers were forgotten in the calculation, such that EAP packets 10 bytes too large were furnished. We are also testing this with MS IAS, which takes the Frame-MTU very literally. In FreeRadius, fragment_size is by default set to 1024, which is nicely conservative. Setting it to higher values or using a lower MTU, though, shows that while some 4 bytes are subtracted (802.1x header ?), the actual EAP header (code, id, len, type, flags and TLS len) is not accounted for. This depends, of course, also on the meaning of fragment_size: It seems to implemented as just the TLS fragment size, such that the calculation from Framed-MTU to fragment_size (or ssn->offset) should also subtract these 10 bytes of the full EAP header. Actually, the fixed subtract of 4 bytes should also look at Framed-Protocol, since PPP uses max. 8 bytes overhead (header = 4, FCS and flag bytes = 2+1+1, sum: 8). Having looked at some definitions and implementations, I'm currently quite confused about this MTU vs MRU issue. Perhaps it would have been better to have a Framed-MRU instead of a -MTU, and have the NAS figure out how much packet space he can give to EAP-TLS/TTLS/PEAP. At some point, it's > difficult for an application to know what MTU to use, because it > doesn't now what protocol is being used to encapsulate it. > After my 'excursion' in what-the-heck-is-the-right-MTU land, I'm just more confused. After glancing through the relevant RFCs, I have the impression that Framed-MTU is not the MTU of the encaps. RADIUS reply, but the overall MTU to be used by the NAS. Which, as you agree, does not make much sense... =============================================================== ... which would mean that fragment_size needs to be adjusted depending on what Framed-Protocol is in use... (any other than EAPOW and PPP?) It's probably better to just reduce it by some "safety" value, to be on the right side, like another 10 bytes or so. Why PPP? My scenario is high-security VPN a la Microsoft, using PPP with EAPTLS over L2TP over IPSec. The intention is to have at least the server side also running free software, using RADIUS for authentication and rp-l2tpd with pppd as NAS. In the mean time, using EAPTLS patches for client PPP, we also have an experimental client using smartcard authentication for Linux. Michael PS: The next days I'm updating the X509 extensions I also created, will make an announcement for discussion to catch some ideas I've seen popping up in this list the last year. Regards, Michael

1 0

Re: Appending attributes post proxy
by Peter Nixon 12 Aug '06

12 Aug '06

On Fri 11 Aug 2006 19:41, Alan DeKok wrote: > Peter Nixon <listuser(a)peternixon.net> wrote: > > We are already using "preproxy_users" to > > modify packets before we send them to downstream servers but I don't see > > any "postproxy_users" file :-( > > It's in the CVS head, for 2.0. OK Great. > > Whats the easiest way to do this? The rewrite module? Is there any reason > > (other than inertia) why isn't there a "postproxy_users" file? > > Nope. > > The rlm_files module got massively re-written in the CVS head, so > that it can be used in any section. The code ended up being smaller > andmore flexible... Alan, can you give us an idea of you roadmap for radius releases? I get a bit confused as to what code should be going where (esp sqlippool which is not exactly documented yet :-) I assume there will be a 1.1.3 release at some point "real soon now". After that do you plan on switching work to cvs head? -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

2 3

Re: Patch: eaptls packets too large, clash MTU
by Michael Joosten 10 Aug '06

10 Aug '06

Quoting sumi <sumi.rs(a)gmail.com>: > hi, > > attachment is missing...? > > thanks > sumi > Should not the case, but I'm currently forced to use a braindamaged "webmailer"... So, both inline and als attachment. diff -ru ../orig/freeradius-1.1.1/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c ./src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c --- ../orig/freeradius-1.1.1/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c 2006-02-06 10:37:03.000000000 -0500 +++ ./src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c 2006-04-21 19:45:47.000000000 -0400 @@ -443,11 +459,25 @@ * tells us it's too big. */ ssn->offset = inst->conf->fragment_size; + + /* + * Framed-MTU is the whole packet, so we cut off the + * EAPOW header (4 bytes) to be prepended by the NAS. + * NOTE: This does not account for other protocols and + * purposes like wired PPP, which has 8 bytes overhead. + */ vp = pairfind(handler->request->packet->vps, PW_FRAMED_MTU); if (vp && ((vp->lvalue - 4) < ssn->offset)) { ssn->offset = vp->lvalue - 4; } + /* + * And even more for the EAP TLS header: + * code + id + length + type + flags + TLS len + * 1 + 1 + 2 + 1 + 1 + 4 = 10 + */ + ssn->offset -= 10; + handler->opaque = ((void *)ssn); handler->free_opaque = session_free; > > On 8/11/06, Michael Joosten <michael.joosten(a)c-lab.de> wrote: > > > > Hello, > > > > while using EAPTLS via RADIUS for authentication of a PPP/L2TP/IPSec VPN > > (Microsoft style), I discovered that the generated EAPTLS packets are a > > little > > bit to large. If you take Framed-MTU serious, most of the EAPTLS header is > > not > > accounted for. Result: PPP communication with max. possible IPSec MTU > > fails > > silently, because the EAPTLS packets (esp. those with long certificates) > > are > > silently discarded. > > > > Patch attached. Should I also submit this to the bug database? > > > > Regards, Michael Joosten > > > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/devel.html > > > > > > -- > "If u look at what u dont have in life, u dont have anything > > But if u look at what u have in life, u have everything.....!!" >

1 0

Patch: eaptls packets too large, clash MTU
by Michael Joosten 10 Aug '06

10 Aug '06

Hello, while using EAPTLS via RADIUS for authentication of a PPP/L2TP/IPSec VPN (Microsoft style), I discovered that the generated EAPTLS packets are a little bit to large. If you take Framed-MTU serious, most of the EAPTLS header is not accounted for. Result: PPP communication with max. possible IPSec MTU fails silently, because the EAPTLS packets (esp. those with long certificates) are silently discarded. Patch attached. Should I also submit this to the bug database? Regards, Michael Joosten

3 4

RE: sample users file
by Mitchell, Michael J 08 Aug '06

08 Aug '06

Hi Peter, Framed-IP-Address = 255.255.255.254 typically instructs the NAS to assign an IP address from its default pool, so this is quite a valid DEFAULT entry.. cheers, Mike > -----Original Message----- > From: > freeradius-devel-bounces+mitchell.michael=bigpond.com(a)lists.fr > eeradius.org > [mailto:freeradius-devel-bounces+mitchell.michael=bigpond.com@ > lists.freeradius.org] On Behalf Of Peter Nixon > Sent: Tuesday, 8 August 2006 9:17 AM > To: freeradius-devel > Subject: sample users file > > Is it just me or does the following sample from "users" not > make sense? > > # Sample defaults for all framed connections. > # > #DEFAULT Service-Type == Framed-User > # Framed-IP-Address = 255.255.255.254, > # Framed-MTU = 576, > # Service-Type = Framed-User, > # Fall-Through = Yes > > Why would we want someone to set a Framed-IP-Address for > DEFAULT? Thats just > bound to end in tears! > >

2 1

sample users file
by Peter Nixon 07 Aug '06

07 Aug '06

Is it just me or does the following sample from "users" not make sense? # Sample defaults for all framed connections. # #DEFAULT Service-Type == Framed-User # Framed-IP-Address = 255.255.255.254, # Framed-MTU = 576, # Service-Type = Framed-User, # Fall-Through = Yes Why would we want someone to set a Framed-IP-Address for DEFAULT? Thats just bound to end in tears! -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

1 0

some documentation patches
by Michael Richardson 05 Aug '06

05 Aug '06

{I guess you know that rlm_policy doesn't compile in HEAD, due to lack of parent argument to compile_modgroup(). Also, ../../doc/README.failover, does not seem to exist.} I was looking for a module that might deal with selecting a L2/PPP termination machine from a list of machines, either randomly, or round robin. I didn't find one, but in the process, I made the following list, and decided that a file per module would make sense. Yes, there are man pages for a couple of them. I'm personally tired of nroff. git/cogito might have it right with "asciidoc", I'm not 100% convinced. I think that I can still commit this, if you approve of documentating in this way, and I haven't missed some other document. Some modules have README files, but often they don't even tell you what the purpose of the module is. (It self-evident) commit 59fa93c7b01dae302723f6ac45746ae7f96b0dfb Author: Michael Richardson <mcr(a)xelerance.com> Date: Sat Aug 5 14:30:40 2006 -0400 added list of modules and empty files for documentation of each module Signed-off-by: Michael Richardson <mcr(a)xelerance.com> diff --git a/doc/modules-description.txt b/doc/modules-description.txt new file mode 100644 index 0000000..76e0857 --- /dev/null +++ b/doc/modules-description.txt @@ -0,0 +1,48 @@ +-*- emacs-wiki -*- + +[[rlm_acct_unique]] - create a unique accounting key, adding Acct-Unique-Session-ID. +[[rlm_always]] - always return a specific result, and possibly change simulation +[[rlm_attr_filter]] - filter out A/V pairs from proxy, from an attribute file +[[rlm_attr_rewrite]] - change a particular attribute value +[[rlm_caching]] - cache the result of an authorization result, and use it again later +[[rlm_chap]] - perform CHAP-style authentication if user has a CHAP-style password +[[rlm_checkval]] - check an attribute for a particular value +[[rlm_copy_packet]] - copies all attributes from access request to access reply +[[rlm_counter]] - allow access based on accumulated usage of a resource (time, bytes) +[[rlm_cram]] - implements CRAM authentication method (for email. APOP/CRAM-MD5) +[[rlm_dbm]] - pull users data from dbm file +[[rlm_detail]] - log radius packets to a detailed file, primarily for accounting +[[rlm_digest]] - authenticated based upon (Cisco) SIP authentiation attributes +[[rlm_eap]] - implements EAP methods, and various subtypes +[[rlm_example]] - sample module (example only) +[[rlm_exec]] - implements Exec-Program && Exec-Program-Wait. +[[rlm_expiration]] - process expiration attribute, for expired logins +[[rlm_expr]] - invoked by dynamic expansion of strings %{expr:} to do calculations +[[rlm_fastusers]] - cached/hashing version of "users" file +[[rlm_files]] - read and parse the "users" file for authorization information +[[rlm_ippool]] - maintain a pool of IP addresses in a .db file +[[rlm_krb5]] - authenticate against KERBEROS v5 server +[[rlm_ldap]] - authorized and authenticate against LDAP server +[[rlm_linelog]] - log things to a file based upon radius_xlat(). +[[rlm_logintime]] - implement time of day restrictions on logins. +[[rlm_mschap]] - perform MS-CHAP/MS-CHAPv2 authentication +[[rlm_otp]] - implements various OTP mechanism via seperate daemon (XXX?) +[[rlm_pam]] - use PAM modules to authenticate users +[[rlm_pap]] - authenticate based upon User-Password attribute (PPP PAP) +[[rlm_passwd]] - authenticated based upon /etc/passwd-like method. +[[rlm_perl]] - create modules using perl +[[rlm_policy]] - implements the policy language +[[rlm_preprocess]] - deal with various NAS' notions of ports, mapping to huntgroups +[[rlm_protocol_filter]] - filter out certain value-pairs from requests +[[rlm_python]] - create modules using python +[[rlm_radutmp]] - maintain a utmp file of who is logged in, and do simultaenous checks +[[rlm_realm]] - parses the User-Name attribute into a User section and a Realm section +[[rlm_sim_files]] - loads EAP-SIM triplets from a file +[[rlm_smb]] - validate a user against an SMB/NMB server +[[rlm_sql]] - provides an interface to SQL databases for configuration files +[[rlm_sql_log]] - defers logging of accounting information, do it asynchronously +[[rlm_sqlcounter]] - limit users by resources, kept in a database +[[rlm_sqlippool]] - maintain a pool of IP addresses in a SQL database file +[[rlm_unix]] - authenticates against standard system unix crypt(3) passwords, +[[rlm_x99_token]] - X9.9 tokens (not complete) + diff --git a/doc/rlm_acct_unique b/doc/rlm_acct_unique new file mode 100644 index 0000000..8a46993 --- /dev/null +++ b/doc/rlm_acct_unique @@ -0,0 +1,2 @@ +-*- emacs-wiki -*- + diff --git a/doc/rlm_always b/doc/rlm_always new file mode 100644 index 0000000..8a46993 --- /dev/null +++ b/doc/rlm_always @@ -0,0 +1,2 @@ +-*- emacs-wiki -*- + diff --git a/doc/rlm_attr_filter b/doc/rlm_attr_filter new file mode 100644 index 0000000..8a46993 --- /dev/null +++ b/doc/rlm_attr_filter @@ -0,0 +1,2 @@ +-*- emacs-wiki -*- + diff --git a/doc/rlm_attr_rewrite b/doc/rlm_attr_rewrite new file mode 100644 index 0000000..8a46993 --- /dev/null +++ b/doc/rlm_attr_rewrite @@ -0,0 +1,2 @@ +-*- emacs-wiki -*- + diff --git a/doc/rlm_caching b/doc/rlm_caching new file mode 100644 index 0000000..0b5eb26 --- /dev/null +++ b/doc/rlm_caching @@ -0,0 +1 @@ +-*- emacs-wiki -*- diff --git a/doc/rlm_chap b/doc/rlm_chap new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_chap @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_checkval b/doc/rlm_checkval new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_checkval @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_copy_packet b/doc/rlm_copy_packet new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_copy_packet @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_counter b/doc/rlm_counter new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_counter @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_cram b/doc/rlm_cram new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_cram @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_detail b/doc/rlm_detail new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_detail @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_digest b/doc/rlm_digest new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_digest @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_example b/doc/rlm_example new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_example @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_exec b/doc/rlm_exec new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_exec @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_expr b/doc/rlm_expr new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_expr @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_files b/doc/rlm_files new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_files @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_ippool b/doc/rlm_ippool new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_ippool @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_linelog b/doc/rlm_linelog new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_linelog @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_logintime b/doc/rlm_logintime new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_logintime @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_mschap b/doc/rlm_mschap new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_mschap @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_otp b/doc/rlm_otp new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_otp @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_pap b/doc/rlm_pap new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_pap @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_perl b/doc/rlm_perl new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_perl @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_policy b/doc/rlm_policy new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_policy @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_preprocess b/doc/rlm_preprocess new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_preprocess @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_protocol_filter b/doc/rlm_protocol_filter new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_protocol_filter @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_radutmp b/doc/rlm_radutmp new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_radutmp @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_realm b/doc/rlm_realm new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_realm @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_sim_files b/doc/rlm_sim_files new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_sim_files @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_smb b/doc/rlm_smb new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_smb @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_sql_log b/doc/rlm_sql_log new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_sql_log @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_sqlippool b/doc/rlm_sqlippool new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_sqlippool @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_unix b/doc/rlm_unix new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_unix @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME diff --git a/doc/rlm_x99_token b/doc/rlm_x99_token new file mode 100644 index 0000000..1367855 --- /dev/null +++ b/doc/rlm_x99_token @@ -0,0 +1,3 @@ +-*- emacs-wiki -*- + +WRITE ME

1 0

Patch: UTF-8 for rlm_mschap
by Josh Howlett 02 Aug '06

02 Aug '06

Please find below a patch to enable support UTF-8 encoded passwords. It also adds a single configuration option to enable or disable this. josh. --- ../../../../freeradius-1.1.2/src/modules/rlm_mschap/rlm_mschap.c 2006-04-13 17:28:30.000000000 +0100 +++ rlm_mschap.c 2006-07-26 10:55:42.000000000 +0100 @@ -187,21 +187,80 @@ * ntpwdhash converts Unicode password to 16-byte NT hash * with MD4 */ -static void ntpwdhash (unsigned char *szHash, const char *szPassword) +static void ntpwdhash (unsigned char *szHash, const char *szPassword, int utf8_password) { char szUnicodePass[513]; int nPasswordLen; int i; + if (utf8_password) { + + /* + * We've been told to expect a UTF-8 password. + * Use iconv() to perform UTF-8 to Unicode conversion. + */ + + DEBUG2(" rlm_mschap: using UTF-8 to Unicode conversion"); + + iconv_t cd; + const char *fptr; + char *tptr; + size_t ileft,oleft; + fptr=szPassword; + tptr=szUnicodePass; + + cd=iconv_open("UCS-2LE", "UTF-8"); + + if (cd == (iconv_t)-1) { + DEBUG2(" rlm_mschap: iconv failed; trying the 7-bit conversion"); + /* + * Skip to the 7-bit password conversion + */ + goto sevenbit; + } + + ileft=strlen(szPassword); + oleft=512; + if (iconv(cd,&fptr, &ileft, &tptr, &oleft) != (size_t)-1) { + iconv_close(cd); + nPasswordLen = strlen(szUnicodePass); + nPasswordLen=512-oleft; + /* Encrypt Unicode password to a 16-byte MD4 hash */ + md4_calc(szHash, szUnicodePass, nPasswordLen ); + return; + } + + /* + * We encountered a problem. Recovery isn't possible, + * so log the problem and optimistically try the 7-bit conversion. + */ + + if (errno == EINVAL) { + DEBUG2(" rlm_mschap: An incomplete multibyte sequence has been encountered in the password"); + } else if (errno == E2BIG) { + DEBUG2(" rlm_mschap: password too big to convert"); + } else if (errno == EILSEQ) { + DEBUG2(" rlm_mschap: an invalid multibyte sequence has been encountered in the password"); + } else { + DEBUG2(" rlm_mschap: unknown iconv error"); + } + DEBUG2(" rlm_mschap: trying the 7-bit conversion instead"); + iconv_close(cd); + } + /* - * NT passwords are unicode. Convert plain text password - * to unicode by inserting a zero every other byte + * 7-bit password conversion */ + + sevenbit: + + DEBUG2(" rlm_mschap: using 7-bit to Unicode conversion"); + nPasswordLen = strlen(szPassword); for (i = 0; i < nPasswordLen; i++) { szUnicodePass[i << 1] = szPassword[i]; szUnicodePass[(i << 1) + 1] = 0; - } + } /* Encrypt Unicode password to a 16-byte MD4 hash */ md4_calc(szHash, szUnicodePass, (nPasswordLen<<1) ); @@ -290,6 +349,7 @@ char *xlat_name; char *ntlm_auth; char *auth_type; + int utf8_password; } rlm_mschap_t; @@ -602,6 +662,8 @@ offsetof(rlm_mschap_t, passwd_file), NULL, NULL }, { "ntlm_auth", PW_TYPE_STRING_PTR, offsetof(rlm_mschap_t, ntlm_auth), NULL, NULL }, + { "utf8_password", PW_TYPE_BOOLEAN, + offsetof(rlm_mschap_t,utf8_password), NULL, "yes" }, { NULL, -1, 0, NULL, NULL } /* end the list */ }; @@ -1121,7 +1183,7 @@ radlog(L_ERR, "No memory"); return RLM_MODULE_FAIL; } else { - ntpwdhash(nt_password->strvalue, password->strvalue); + ntpwdhash(nt_password->strvalue, password->strvalue, inst->utf8_password); nt_password->length = 16; pairadd(&request->config_items, nt_password); } --- ../../../../freeradius-1.1.2/raddb/radiusd.conf.in 2006-04-20 19:40:29.000000000 +0100 +++ ../../../raddb/radiusd.conf.in 2006-07-26 10:57:29.000000000 +0100 @@ -707,6 +707,10 @@ # Be VERY careful when editing the following line! # #ntlm_auth = "/path/to/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" + + # Use UTF-8 encoded passwords. + # + utf8_password = yes } # Lightweight Directory Access Protocol (LDAP)

1 0

Automatic report from sources (radiusd) between 01.08.2006 - 02.08.2006 GMT
by Automatic cvs log generator 02 Aug '06

02 Aug '06

CVS log entries from 01.08.2006 (Tue) 08:00:00 - 02.08.2006 (Wed) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/modules/rlm_sqlcounter/rlm_sqlcounter.c; Revisions: 1.28 ===================================================== Log entries ===================================================== Description: allow number of days, too Modified files: File: radiusd/src/modules/rlm_sqlcounter/rlm_sqlcounter.c; Revision: 1.28; Date: 2006/08/01 22:09:28; Author: aland; Lines: (+3 -3) ===================================================== Summary of modified files ===================================================== File: radiusd/src/modules/rlm_sqlcounter/rlm_sqlcounter.c Revisions: 1.28 Authors: aland (+3 -3) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0