question on ldap_escape_func in rlm_ldap.c (author: Kostas Kalevras)
Hi All, I'm new to Radius, now encountered problems with ldap_escape_func in rlm_ldap. please help me since it's really a bit urgent. the comments regarding to this function is 'Add an ldap_escape_func. Escape the * character from the filter so that we can avoid the trivial DoS of username=*'. if i was not wrong, this function intends to filter out the * which follows the username, i.e, if username is 'userid*' in access-request packet, ldapsearch is only based on 'userid'. but what's the purpose for doing this and is it secure? or did i misunderstand the comments? the lastest version freeradius-1.0.5 has a slightly different version for this piece of code, ***************************************************************** freeradius-1.0.5 if (strchr("*=\\,()", *in)) { static const char *hex = "0123456789abcdef"; if (outlen <= 3) break; *(out++) = '\\'; *(out++) = hex[((*in) >> 4) & 0x0f]; *(out++) = hex[(*in) & 0x0f]; outlen -= 3; continue; } ************************************************************** freeradius-1.0.4 and previous if (strchr("*", *in)) { in++; outlen--; continue; } i couldn't figure out what does the change intend to do, is it to filter out '*', '\\', '()' and '=' from username? and why should it be in that way? please help me. thanks a lot in advance.
Qin Zhen wrote:
i couldn't figure out what does the change intend to do, is it to filter out '*', '\\', '()' and '=' from username? and why should it be in that way? please help me. thanks a lot in advance.
The function ldap_escape_func() filters all LDAP-specific characters from RFC 2254. This prevents LDAP injection attacks. BTW there's a known bug in this function, you can get a fixed version here. (the patch will be included in next release) http://www.freeradius.org/cgi-bin/cvsweb.cgi/radiusd/src/modules/rlm_ldap/rl... -- Nicolas Baradakis
thanks for Nicolas's reply. so in lastest version (1.0.5), a username 'jam\' will be converted into 'jam\5c' and ldapsearch will be based on 'jam\5c' right? so this username is supposed not to be found in ldap in this case? but how come in my server, the ldapsearch will base on 'jam' and those invalid charactors r just simply eliminated? scratching head...pls assist..thanks so much ----- Original Message ----- From: "Nicolas Baradakis" <nbk@sitadelle.com> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Wednesday, December 07, 2005 6:51 PM Subject: Re: question on ldap_escape_func in rlm_ldap.c
Qin Zhen wrote:
i couldn't figure out what does the change intend to do, is it to filter out '*', '\\', '()' and '=' from username? and why should it be in that way? please help me. thanks a lot in advance.
The function ldap_escape_func() filters all LDAP-specific characters from RFC 2254. This prevents LDAP injection attacks.
BTW there's a known bug in this function, you can get a fixed version here. (the patch will be included in next release)
http://www.freeradius.org/cgi-bin/cvsweb.cgi/radiusd/src/modules/rlm_ldap/rl...
-- Nicolas Baradakis
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Qin Zhen wrote:
so in lastest version (1.0.5), a username 'jam\' will be converted into 'jam\5c' and ldapsearch will be based on 'jam\5c' right? so this username is supposed not to be found in ldap in this case? but how come in my server, the ldapsearch will base on 'jam' and those invalid charactors r just simply eliminated? scratching head...pls assist..thanks so much
That's what is said in http://www.ietf.org/rfc/rfc2254.txt <<<<< If a value should contain any of the following characters Character ASCII value --------------------------- * 0x2a ( 0x28 ) 0x29 \ 0x5c NUL 0x00 the character must be encoded as the backslash '\' character (ASCII 0x5c) followed by the two hexadecimal digits representing the ASCII value of the encoded character. The case of the two hexadecimal digits is not significant.
-- Nicolas Baradakis
Hi, thanks Nicolas. sorry to trouble u, but i am still not so clear abt the lastest freeradius's behaviour. suppose there is an username 'james', when i trys to login with username 'james*', ldap_escape_fun acctually converts it into 'james\2a\2a\2a\2a\2a\2a...', but the radius debug mode still shows Debug: rlm_ldap:performing search in dc=sg, o=company, with filter (&objectclass=radiusprofile)(userlogin=james)) that measn ldap still search based on filter 'userlogin=james' and ignores those '\2a\2a\2a' followed, and hence it finds the username 'james' from ldap and allows the user to login. is it the way lastest freeradius supposed to be? or there's anyth wrong with my configuration? if user james can use 'james*' or 'james\\' to login as usual, isnt it unsecure? thanks really a loooooooot! ----- Original Message ----- From: "Nicolas Baradakis" <nbk@sitadelle.com> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Wednesday, December 07, 2005 9:17 PM Subject: Re: question on ldap_escape_func in rlm_ldap.c
Qin Zhen wrote:
so in lastest version (1.0.5), a username 'jam\' will be converted into 'jam\5c' and ldapsearch will be based on 'jam\5c' right? so this username is supposed not to be found in ldap in this case? but how come in my server, the ldapsearch will base on 'jam' and those invalid charactors r just simply eliminated? scratching head...pls assist..thanks so much
That's what is said in http://www.ietf.org/rfc/rfc2254.txt
<<<<< If a value should contain any of the following characters
Character ASCII value --------------------------- * 0x2a ( 0x28 ) 0x29 \ 0x5c NUL 0x00
the character must be encoded as the backslash '\' character (ASCII 0x5c) followed by the two hexadecimal digits representing the ASCII value of the encoded character. The case of the two hexadecimal digits is not significant.
-- Nicolas Baradakis
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Qin Zhen wrote:
when i trys to login with username 'james*', ldap_escape_fun acctually converts it into 'james\2a\2a\2a\2a\2a\2a...', but the radius debug mode still shows Debug: rlm_ldap:performing search in dc=sg, o=company, with filter (&objectclass=radiusprofile)(userlogin=james)) that measn ldap still search based on filter 'userlogin=james' and ignores those '\2a\2a\2a' followed, and hence it finds the username 'james' from ldap and allows the user to login. is it the way lastest freeradius supposed to be?
No, it's a known bug in FreeRADIUS 1.0.5. That's why I told you earlier to get a fixed version in CVS.
if user james can use 'james*' or 'james\\' to login as usual, isnt it unsecure?
I think "james*" (without escaping) in a LDAP filter is insecure, it may disclose informations about other users named "jamesfoo" or "jamesbar" ... -- Nicolas Baradakis
participants (2)
-
Nicolas Baradakis -
Qin Zhen