On Nov 30, 2015, at 10:39 AM, Stefano Mason <stefano.mason@eng-mo.it> wrote:

From Brocade switch:

Mon Nov 30 16:33:56 2015 : Debug: (1) Received Access-Request Id 4 from X.X.X.X:10185 to X.X.X.X:1812 length 93 Mon Nov 30 16:33:56 2015 : Debug: (1) User-Name = "db00000" Mon Nov 30 16:33:56 2015 : Debug: (1) User-Password = "db00000\000\000\000\000\000\000\000\000\031"

The brocade switch is broken.

Resolved in this way:

update request { Tmp-String-0 := "%{string:User-Password}" User-Password := "%{string:Tmp-String-0}" }

That works. I'll add this to the default policies. Alan DeKok.

On Nov 30, 2015, at 11:00 AM, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:

Better to do something more explicit with a regex, in case we get around to fixing string expansion :)

Regexes on some platforms don't deal well with embedded zeros. I'm happy with leaving %{string:..} as being explicitly not binary safe. The alternative is: update request { Tmp-Octets-0 := &User-Password } # Some systems send User-Password = "\000\000foo" # which is stupid if (Tmp-Octets-0 =~ /^0x00/) { reject } if (Tmp-Octets-0 =~ /^(0x(..)+)00/) { # get the text BEFORE the zeros update request { Tmp-Octets-0 := "%{1}" } update request { User-Password := "%{string:Tmp-Octets-0}" } } Alan DeKok.

On 11/30/2015 05:04 PM, Alan DeKok wrote:

Regexes on some platforms don't deal well with embedded zeros.

I'm happy with leaving %{string:..} as being explicitly not binary safe.

The alternative is:

update request { Tmp-Octets-0 := &User-Password }

# Some systems send User-Password = "\000\000foo" # which is stupid if (Tmp-Octets-0 =~ /^0x00/) { reject }

if (Tmp-Octets-0 =~ /^(0x(..)+)00/) {

# get the text BEFORE the zeros update request { Tmp-Octets-0 := "%{1}" } update request { User-Password := "%{string:Tmp-Octets-0}" } }

Thanks Alan, but the alternative isn't good in all situation. When I used the previous code the regex fail with all the password that end with zero, like: mikemouse00. Anyway thank you very much because it was just your code that allowed me to find the one proposed: update request { Tmp-String-0 := "%{string:User-Password}" User-Password := "%{string:Tmp-String-0}" } Best regards. Stefano

On 11/30/2015 05:34 PM, Alan DeKok wrote:

On Nov 30, 2015, at 11:30 AM, Stefano Mason <stefano.mason@eng-mo.it> wrote:

...

Thanks Alan, but the alternative isn't good in all situation. When I used the previous code the regex fail with all the password that end with zero, like: mikemouse00. No.

The code I posted converts the User-Password to an *octet* string in Tmp-Octets-0. So if the ASCII version ends with "00", the octet string will end with "3030".

Your code in action from Brocade switch (password MATgia00): Mon Nov 30 17:47:37 2015 : Debug: (1) Received Access-Request Id 143 from XXX.XX.XX.X:13894 to XXX.XXX.XX.XX:1812 length 94 Mon Nov 30 17:47:37 2015 : Debug: (1) User-Name = "bob" Mon Nov 30 17:47:37 2015 : Debug: (1) User-Password = "MATgia00\000\000\000\000\000\000\000\031" Mon Nov 30 17:47:37 2015 : Debug: (1) NAS-IP-Address = XXX.XX.XX.X Mon Nov 30 17:47:37 2015 : Debug: (1) NAS-Identifier = "XXXXXXXXXXXXX" Mon Nov 30 17:47:37 2015 : Debug: (1) Calling-Station-Id = "XX.XX.XXX.XX" Mon Nov 30 17:47:37 2015 : Debug: (1) NAS-Port = 12869 Mon Nov 30 17:47:37 2015 : Debug: (1) NAS-Port-Type = Virtual Mon Nov 30 17:47:37 2015 : Debug: (1) session-state: No State attribute Mon Nov 30 17:47:37 2015 : Debug: (1) # Executing section authorize from file /etc/raddb/sites-enabled/default Mon Nov 30 17:47:37 2015 : Debug: (1) authorize { Mon Nov 30 17:47:37 2015 : Debug: (1) update request { Mon Nov 30 17:47:37 2015 : Debug: (1) Tmp-Octets-0 := &User-Password -> 0x4d415467696130300000000000000019 Mon Nov 30 17:47:37 2015 : Debug: (1) } # update request = noop Mon Nov 30 17:47:37 2015 : Debug: (1) if (Tmp-Octets-0 =~ /^0x00/) { Mon Nov 30 17:47:37 2015 : Debug: No matches Mon Nov 30 17:47:37 2015 : Debug: (1) if (Tmp-Octets-0 =~ /^0x00/) -> FALSE Mon Nov 30 17:47:37 2015 : Debug: (1) if (Tmp-Octets-0 =~ /^(0x(..)+)00/) { Mon Nov 30 17:47:37 2015 : Debug: No matches Mon Nov 30 17:47:37 2015 : Debug: Adding 3 matches Mon Nov 30 17:47:37 2015 : Debug: (1) if (Tmp-Octets-0 =~ /^(0x(..)+)00/) -> TRUE Mon Nov 30 17:47:37 2015 : Debug: (1) if (Tmp-Octets-0 =~ /^(0x(..)+)00/) { Mon Nov 30 17:47:37 2015 : Debug: (1) update request { Mon Nov 30 17:47:37 2015 : Debug: (1) 1/3 Found: 0x4d41546769613030000000000000 (31) Mon Nov 30 17:47:37 2015 : Debug: (1) EXPAND %{1} Mon Nov 30 17:47:37 2015 : Debug: (1) --> 0x4d41546769613030000000000000 Mon Nov 30 17:47:37 2015 : Debug: (1) Tmp-Octets-0 := 0x4d41546769613030000000000000 Mon Nov 30 17:47:37 2015 : Debug: (1) Overwriting value "0x4d415467696130300000000000000019" with "0x4d41546769613030000000000000" Mon Nov 30 17:47:37 2015 : Debug: (1) } # update request = noop Mon Nov 30 17:47:37 2015 : Debug: (1) update request { Mon Nov 30 17:47:37 2015 : Debug: (1) EXPAND %{string:Tmp-Octets-0} Mon Nov 30 17:47:37 2015 : Debug: (1) --> MATgia00\000\000\000\000\000 Mon Nov 30 17:47:37 2015 : Debug: (1) User-Password := MATgia00 Mon Nov 30 17:47:37 2015 : Debug: (1) Overwriting value "MATgia00\000\000\000\000\000\000\000\031" with "MATgia00\000\000\000\000" Mon Nov 30 17:47:37 2015 : Debug: (1) } # update request = noop Mon Nov 30 17:47:37 2015 : Debug: (1) } # if (Tmp-Octets-0 =~ /^(0x(..)+)00/) = noop Cheers. Stefano

On 11/30/2015 06:06 PM, Alan DeKok wrote:

On Nov 30, 2015, at 12:01 PM, Stefano Mason <stefano.mason@eng-mo.it> wrote:

...

Your code in action from Brocade switch (password MATgia00): ... Mon Nov 30 17:47:37 2015 : Debug: (1) Overwriting value "0x4d415467696130300000000000000019" with "0x4d41546769613030000000000000 The regular expression is matching on the last binary "00" instead of the first.

This has nothing to do with the ASCII "00" in User-Password.

Thanks Alan, you are right. When I saw this behaviour from regex I tried to change the number of zero that match on (Tmp-Octets-0 =~ /^(0x(..)+)000000/) and in this way I remove the final part of password because 3030 become 303. Best regards. Stefano

On 30 Nov 2015, at 18:37, Stefano Mason <stefano.mason@eng-mo.it> wrote:

Dear Alan, I'm curios to know why this Access-Request from Brocade switch to Freeradius 3.0.10 report the User-Password end with many NULL, instead, Freeradius 2.2.9 report a clean User-Password?

Because in v3.0.x we follow RFC 2865 to the letter, and do not give null bytes any special treatment. The FreeRADIUS 2.2.9 behaviour was incorrect, the 3.0.10 behaviour is correct. The Brocade NAS is broken. It looks like it's sending the contents of a fixed length (16 byte) buffer and incorrectly calculating the length of the data in that buffer (someone probably used sizeof() instead of strlen). Anyway, open a support case with Brocade to get this fixed, they are absolutely doing the wrong thing here. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

On my multivendor environment

<snip> That alone should have told you that the brocade kit is broken ;) alan

On Mon, Nov 30, 2015 at 04:58:54PM +0100, Stefano Zanmarchi wrote:

apart from "view /etc/raddb/modules/linelog" where can I find other documentation on the usage of linelog?

http://networkradius.com/doc/3.0.9/raddb/mods-available/linelog.html But what is confusing about the documentation in the config file? Have you tried it, and if so what didn't work? Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>

On Mon, Nov 30, 2015 at 05:19:39PM +0100, Stefano Zanmarchi wrote:

I just wanted to read the most exaustive documentation on the module before trying it so I was wondering whether /etc/raddb/modules/linelog was the right one.

Yes, there's not really very much to configure. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>

I'm not sure why so many places block access to Google :/ Perhaps there is no democracy?