Freeradius not unescaping \ and "
I have the following setup: CoovaChilli accepts user login requests and sends radius packets to freeradius freeradius then proxies the requests (based on realm) onto a second freeradius server. If I attempt a login with username "A\" The first freeradius server recieves packets with UserName atribute = "A\\" and sends a packet to the sencond radius server with username attribute = "A\\\\" (as reported by wireshark) So it looks like freeradius is not correctly unescaping the username attribute. (Or incorrectly re-escaping) before the proxy. How is freeradius expected to behave when escaping backslash and quote characters before proxying? And is it possible to alter this behavior though configuration? Thanks, Murray
Murray Long wrote:
If I attempt a login with username "A\" The first freeradius server recieves packets with UserName atribute = "A\\" and sends a packet to the sencond radius server with username attribute = "A\\\\" (as reported by wireshark)
Upgrade to a recent version of the server. Alan DeKok.
I am running the latest version provided by Ubuntu, 2.1.8+dfsg-1ubuntu1 Is this not considered recent? I will try 2.1.9 from the freeradius site and see how that goes. -Murray On Fri, Sep 3, 2010 at 2:03 PM, Alan DeKok <aland@deployingradius.com>wrote:
Murray Long wrote:
If I attempt a login with username "A\" The first freeradius server recieves packets with UserName atribute = "A\\" and sends a packet to the sencond radius server with username attribute = "A\\\\" (as reported by wireshark)
Upgrade to a recent version of the server.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Ok, debug logs and config files are attached. It looks like the problem could be with rlm_perl. as the proxying happens correctly if we disable the perl module completely. However, even with no logic happening in the perl script, additional \'s are added to the attributes. Please see the attached log of a login attempt for Username: "murray/A\" Password: "A\" which is eventually proxied as User-Name = "A\\\\\\\\" User-Password = "A\\\\\\\\" Thanks, Murray On Fri, Sep 3, 2010 at 3:33 PM, Alan DeKok <aland@deployingradius.com> wrote:
Murray Long wrote:
I am running the latest version provided by Ubuntu, 2.1.8+dfsg-1ubuntu1 Is this not considered recent? I will try 2.1.9 from the freeradius site and see how that goes.
Well.. it works in the current 2.1.x branch.
How about posting debug logs?
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I have a detail configuration file, which has several sections for different files, to be handled by different listener As the NASses are GGSNs, which are sending more than 40 attributes, I will save space on HD and will remove unneeded attributes using suppress. Do I have to put every attribute in every detail-x configuration area or is there a kind of template to do this? Thank you. detail detail-2{ detailfile = /var/log/acctopus/archive/2/detail.log detailperm = 0600 dirperm = 0755 locking = yes suppress { User-Password NAS-Port ... some more } } detail detail-3{ detailfile = /var/log/acctopus/archive/3/detail.log detailperm = 0600 dirperm = 0755 locking = yes suppress { User-Password NAS-Port ... some more } } detail detail-3{ detailfile = /var/log/acctopus/archive/3/detail.log detailperm = 0600 dirperm = 0755 locking = yes suppress { User-Password NAS-Port ... some more } } Some more detail-x files.... Regards Stefan
What seems to be happening here: When passing variables to the perl module, "void fr_print_string(const char *in, size_t inlen, char *out, size_t outlen)" Escapes all special characters (including '\') When variables are returned from perl, VALUE_PAIR *pairparsevalue(VALUE_PAIR *vp, const char *value) unescapes special characters, but ignores "\\" I've patched the pairparsevalue function to handle an escaped backslash, which has solved my problems. However this is my first time looking at freeradius source, so have no idea what knock-on effects this will have, so please could someone review this for me. Many Thanks, Murray On Fri, Sep 3, 2010 at 5:58 PM, Murray Long <murray@skyrove.com> wrote:
Ok, debug logs and config files are attached.
It looks like the problem could be with rlm_perl. as the proxying happens correctly if we disable the perl module completely. However, even with no logic happening in the perl script, additional \'s are added to the attributes.
Please see the attached log of a login attempt for Username: "murray/A\" Password: "A\"
which is eventually proxied as User-Name = "A\\\\\\\\" User-Password = "A\\\\\\\\"
Thanks, Murray
On Fri, Sep 3, 2010 at 3:33 PM, Alan DeKok <aland@deployingradius.com> wrote:
Murray Long wrote:
I am running the latest version provided by Ubuntu, 2.1.8+dfsg-1ubuntu1 Is this not considered recent? I will try 2.1.9 from the freeradius site and see how that goes.
Well.. it works in the current 2.1.x branch.
How about posting debug logs?
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Murray Long wrote:
When passing variables to the perl module, "void fr_print_string(const char *in, size_t inlen, char *out, size_t outlen)" Escapes all special characters (including '\')
Yes.
When variables are returned from perl, VALUE_PAIR *pairparsevalue(VALUE_PAIR *vp, const char *value) unescapes special characters, but ignores "\\"
? I'm not sure how you conclude that. The code in the v2.1.x branch handles escaping of '\\' for "string" attributes. See pairparsevalue(), the "while" loop: while (*cp && (length < (sizeof(vp->vp_strvalue) - 1))) { char c = *cp++; if (c == '\\') { switch (*cp) { ... case '\'': c = '\''; cp++; break; ...
I've patched the pairparsevalue function to handle an escaped backslash, which has solved my problems. However this is my first time looking at freeradius source, so have no idea what knock-on effects this will have, so please could someone review this for me.
What code did you change? Alan DeKok.
That switch statement has no condition for *cp == "\\". Which is what I have added. (Please see patch attached to my previous message) On Tue, Sep 7, 2010 at 12:37 PM, Alan DeKok <aland@deployingradius.com> wrote:
Murray Long wrote:
When passing variables to the perl module, "void fr_print_string(const char *in, size_t inlen, char *out, size_t outlen)" Escapes all special characters (including '\')
Yes.
When variables are returned from perl, VALUE_PAIR *pairparsevalue(VALUE_PAIR *vp, const char *value) unescapes special characters, but ignores "\\"
? I'm not sure how you conclude that. The code in the v2.1.x branch handles escaping of '\\' for "string" attributes. See pairparsevalue(), the "while" loop:
while (*cp && (length < (sizeof(vp->vp_strvalue) - 1))) { char c = *cp++;
if (c == '\\') { switch (*cp) { ... case '\'': c = '\''; cp++; break; ...
I've patched the pairparsevalue function to handle an escaped backslash, which has solved my problems. However this is my first time looking at freeradius source, so have no idea what knock-on effects this will have, so please could someone review this for me.
What code did you change?
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alan DeKok -
Murray Long -
Stefan A.