- Freeradius-Users - lists.freeradius.org

Re: radius_xlat chops embedded NULs in cisco-av-pair
by Kiril 31 Mar '14

31 Mar '14

> For 2.x.x I agree the best fix is just to get fr_prints_value to do the escaping. so as I thought, too. as it this was done in 1.x I can handle this issue in our current freeradius version myself and don't wait for the bug fix. while you are fixing it in the official source

2 1

Re: radius_xlat chops embedded NULs in cisco-av-pair
by Kiril 31 Mar '14

31 Mar '14

> I'll take a look and see if it's fixed in later versions. It'll almost certainly work fine in 3.0.2. I looked into the current git v3 master sources - the main thing remais the same in vp_prints_value: print.c, line 258 > /* xlat.c - need to copy raw value verbatim */ > else if (quote < 0) { > return strlcpy(out, vp->vp_strvalue, outlen); in other cases fr_print_string is used and our company is not ready to move on freeradius v3, so we need a solution on v2 branch

3 3

Valid Characters in User-Name & Password
by Ryan De Kock 31 Mar '14

31 Mar '14

Hi, Sorry if this is a dumb question but I couldn't find anything on google. Is there a list of valid characters that can be in the username & password feild of the access-request and account-start packets? for example, is a space (" ") valid in the username, #,&,^,etc. Where can I find this kind of info? Thanks!

2 1

Re: EAP session didn't finish
by Kiril 31 Mar '14

31 Mar '14

for some strange reason the topic http://freeradius.1045715.n5.nabble.com/EAP-session-didn-t-finish-td5723981… is not continued > >> ssl certs are generated during freeradius install, so the problem >> can't be in ssl >> who can tell in which case this message is shown? > > Ensure the CA for the server cert is trusted on the client. thx, but it is already trusted we have successful auths, too but sometimes it fails performing some other tests we can see that sometimes the AP is sending dissociating frame during the handshake between the device(pc, laptop, mobile, etc) and the AP. so the conversation fails

1 0

Re: EAP session didn't finish
by Kiril 31 Mar '14

31 Mar '14

> > Ensure the CA for the server cert is trusted on the client. thx, but it is already trusted we have successful auths, too but sometimes it fails performing some other tests we can see that sometimes the AP is sending dissociating frame during the handshake between the device(pc, laptop, mobile, etc) and the AP. so the conversation fails

1 0

Re: radius_xlat chops embedded NULs in cisco-av-pair
by Kiril 31 Mar '14

31 Mar '14

> No, it doesn't. > > If you look at the calls to fr_print_string, you'd see quote < 0 > is only passed in two places, valuepair.c:85 and valuepair.c:114, > both in the radius_compare_vps function, where the output is > passed to the regular expression comparison functions. > > Arguably if were doing comparisons on the raw attribute it should > be a memcpy, especially as regcomp appears to take the length > of the input string so it can probably deal with embedded NULLs > > But, this isn't related to your issue, if you read the concat > code in 3.x.x xlat.c:1911 it's calling vp_aprint, which at > the moment just does a talloc_strdup, which is as bad as > strlcpy. > > After i've fixed that, and written a regression test for 3.x.x I will > take a look at 2.x.x. thx

1 0

Re: radius_xlat chops embedded NULs in cisco-av-pair
by Kiril 31 Mar '14

31 Mar '14

> The string (RFC type 'text') should be escaped before being added to the concatenation buffer. I'll take a look and see if it's fixed in later versions. maybe the entire attribute value data is copied but when sql_escape_func from rlm_sql module is called it stops on the first NUL byte in it, so maybe the escaping fails?

2 1

radius_xlat chops embedded NULs in cisco-av-pair
by Kiril 31 Mar '14

31 Mar '14

Hi, there is a problem under freeradius 2.1.12 when incoming radius packet has embedded NUL bytes in the middle of the string attribute cisco-av-pair in debug packet output it is printed as Cisco-AVPair = "release-source=\000\000\000\002" but when we use %{Cisco-AVPair[*]} in sql accounting query it is expanded as "release-source=" in previous version 1.x the bahaviour was different - xlat-ed string in query was shown as in debug output according to RFC 2869 section 5 it is said: "Servers and servers and clients MUST be able to deal with embedded nulls. RADIUS implementers using C are cautioned not to use strcpy() when handling strings." and radius_xlat function uses strlcpy(out, vp->vp_strvalue, outlen) in vp_prints_value, so not the full string vp->vp_strvalue is copied what should be done in this case: fix the radius source, or fix the NAS?

2 2

Re: FreeRadius Authorizing and Authenticating Anyone if One User Logs in
by Lennon Mazonde 31 Mar '14

31 Mar '14

Hi Alan, Thanks for responding > Don't do that. PLEASE follow the instructions. "radiusd -X" is good > enough. When i run "radiusd -X", i get the error The program 'radiusd' can be found in the following packages: * radiusd-livingston * yardradius Try: apt-get install <selected package> > > The debug log shows one user "test" logging in, twice. It doesn't > show other users logging in. That's because I logged the user "test" in and out, and then in again. My bad, should have just posted output from one login. Anyone else who connects to the network after this (the first user) simply gets access to the internet, without any redirect to the captive portal > > You probably need to double-check the captive portal configuration. > The "double login" has nothing to do with FreeRADIUS. The captive > portal should allow ONE user in, when ONE user authenticates. The other > users should be blocked. > > As always, FreeRADIUS does authentication. It does NOT control > network access. If a user is gaining network access when they shouldn't > have it, the problem is the NAS (or Captive portal here). Thanks a lot for that pointer, i'm scouring through the configs of the captive portal to see what might be wrong > > Alan DeKok. Lennon Mazonde

4 4

Perl attribute: length vs 0-byte termination
by Julius Plenz 31 Mar '14

31 Mar '14

Hi, some recent change seems to have broken the "rlm_perl" attribute handling. For a string, instead of adding a scalar value with appropriate length, it seems the whole buffer (including 0-byte) is inserted into the Perl hash. Consider this authorize() method: sub authorize { $RAD_REPLY{'Reply-Message'} = "Username >>".$RAD_REQUEST{'User-Name'}."<<"; return RLM_MODULE_UPDATED; } This leads, wrongly, to a prematurely terminated string: rlm_perl: Added pair Reply-Message = Username >>user When you add a line like this at the beginning of the subroutine: $RAD_REQUEST{'User-Name'} =~ s/\0//g; ...then you'll receive the typical garbage that's in uncleared memory: rlm_perl: Added pair Reply-Message = Username >>user ??"c¨?ìå ??... Somehow, the length computation of the SVs must be fixed, but I don't know what broke it or how to repair it... Any help appreciated, thanks in advance! Julius P.S.: I've tested this with FreeRADIUS Git tag "release_3_0_2".

2 1