segfault with regex and hint
Hi, It's that time of year to overhaul the cesspool that makes up my FreeRADIUS config files. I am running FreeRADIUS from git[1] about two days ago and found that by putting the following in my 'hints' file gives me the segfault shown below[2]. If I remove the end bit[3] then I do not get the segfault, but then I also do not get my comparison :) Any more information needed, then let me know. Cheers [1] at commit 08baab6769fea367bda5dd006b659621bb9aac18 from yesterday-ish [2] strlcpy sourced from address 0x0 [3] User-Name =~ "/^%{1}%{2}%{3}%{4}%{5}%{6}$/i" ---- DEFAULT NAS-Port-Type == "Ethernet", User-Name == "%{User-Password}", Calling-Station-Id =~ "/^([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2})$/i", User-Name =~ "/^%{1}%{2}%{3}%{4}%{5}%{6}$/i" Hint = mac-auth ---- ---- server dot1x { modules { Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = yes with_alvarion_vsa_hack = no } Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7f943272eae0 (LWP 3894)] strlcpy (dst=0x13545e8 "", src=0x0, siz=<value optimized out>) at strlcpy.c:50 50 if ((*d++ = *s++) == 0) (gdb) where #0 strlcpy (dst=0x13545e8 "", src=0x0, siz=<value optimized out>) at strlcpy.c:50 #1 0x00007f9432315164 in pairmake (attribute=<value optimized out>, value=0x0, operator=17) at valuepair.c:1549 #2 0x00007f9432315a39 in pairread (ptr=0x7fff3a7352a8, eol=0x7fff3a7352b4) at valuepair.c:1703 #3 0x00007f9432315b7f in userparse (buffer=<value optimized out>, first_pair=0x7fff3a739470) at valuepair.c:1804 #4 0x000000000040ec5c in pairlist_read (file=0x1352140 "/etc/freeradius/hints", list=0x13522b8, complain=<value optimized out>) at files.c:192 #5 0x00007f942dd21aeb in preprocess_instantiate (conf=0x1217110, instance=0x1352108) at rlm_preprocess.c:497 #6 0x0000000000413bc1 in find_module_instance (modules=<value optimized out>, instname=0x121e0c0 "preprocess", do_link=20259360) at modules.c:506 #7 0x0000000000414fee in do_compile_modsingle (parent=0x0, component=1, ci=0x121e080, grouptype=0, modname=0x7fff3a739b38) at modcall.c:1872 #8 0x0000000000412db3 in load_component_section (cs=0x121df00, components=0x1351ea0, comp=1) at modules.c:794 #9 0x0000000000413368 in load_byserver (cs=0x121d6d0) at modules.c:993 #10 0x0000000000413697 in virtual_servers_load (config=0x1203030) at modules.c:1121 #11 0x0000000000414058 in setup_modules (reload=<value optimized out>, config=0x1203030) at modules.c:1368 #12 0x000000000041245a in read_mainconfig (reload=<value optimized out>) at mainconfig.c:904 #13 0x0000000000416d1a in main (argc=2, argv=0x7fff3a73a418) at radiusd.c:257 (gdb) ---- -- Alexander Clouter .sigmonster says: Keep it short for pithy sake.
Hi,
Hi,
It's that time of year to overhaul the cesspool that makes up my FreeRADIUS config files.
I am running FreeRADIUS from git[1] about two days ago and found that by putting the following in my 'hints' file gives me the segfault shown below[2]. If I remove the end bit[3] then I do not get the segfault, but then I also do not get my comparison :)
you are doing 2 seperate comparisons for the one attribute. is that correct/allowed? alan
Hi, Alan Buxey <A.L.M.Buxey@lboro.ac.uk> wrote:
It's that time of year to overhaul the cesspool that makes up my FreeRADIUS config files.
I am running FreeRADIUS from git[1] about two days ago and found that by putting the following in my 'hints' file gives me the segfault shown below[2]. If I remove the end bit[3] then I do not get the segfault, but then I also do not get my comparison :)
you are doing 2 seperate comparisons for the one attribute. is that correct/allowed?
/me shrugs I'm just here to report bugs :) For mac-auth detection I just moved to a policy, so I really do not care if the bug gets fixed or not[1]. I can imagine cases where people want to use the hints file to 'sanitise' incoming RADIUS packets though in a neat one-liner that keeps it out of the virtual host stanza for example: ---- DEFAULT Calling-Station-Id =~ "/^([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2})$/i" Calling-Station-Id := "%{1}%{2}%{3}%{4}%{5}%{6}" ---- For any who is curious/cares for the archives, I use the following policy: ---- mac_auth { if ( Realm == NULL && !EAP-Message && NAS-Port-Type == "Ethernet" \ && Service-Type == Call-Check \ && Stripped-User-Name == "%{User-Password}" \ && Stripped-User-Name =~ /^[0-9a-f]{12}$/i \ && Calling-Station-Id =~ /^([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2})$/i \ && Stripped-User-Name =~ /^%{1}%{2}%{3}%{4}%{5}%{6}$/i ) { ok } else { notfound } } ---- Cheers [1] although I guess having a "hey lets copy from address 0x0" path in FreeRADIUS is probably considered bad style :) -- Alexander Clouter .sigmonster says: Debug is human, de-fix divine.
Hello! You using ProCurve NAS then? Or have other people started using Service-Type = 'Call-Check' to hint at Mac-Auth? -Arran
Alan Buxey <A.L.M.Buxey@lboro.ac.uk> wrote:
It's that time of year to overhaul the cesspool that makes up my FreeRADIUS config files.
I am running FreeRADIUS from git[1] about two days ago and found that by putting the following in my 'hints' file gives me the segfault shown below[2]. If I remove the end bit[3] then I do not get the segfault, but then I also do not get my comparison :)
you are doing 2 seperate comparisons for the one attribute. is that correct/allowed?
/me shrugs
I'm just here to report bugs :)
For mac-auth detection I just moved to a policy, so I really do not care if the bug gets fixed or not[1]. I can imagine cases where people want to use the hints file to 'sanitise' incoming RADIUS packets though in a neat one-liner that keeps it out of the virtual host stanza for example:
---- DEFAULT Calling-Station-Id =~ "/^([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2})$/i" Calling-Station-Id := "%{1}%{2}%{3}%{4}%{5}%{6}" ----
For any who is curious/cares for the archives, I use the following policy: ---- mac_auth { if ( Realm == NULL && !EAP-Message && NAS-Port-Type == "Ethernet" \ && Service-Type == Call-Check \ && Stripped-User-Name == "%{User-Password}" \ && Stripped-User-Name =~ /^[0-9a-f]{12}$/i \ && Calling-Station-Id =~ /^([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2})$/i \ && Stripped-User-Name =~ /^%{1}%{2}%{3}%{4}%{5}%{6}$/i ) { ok } else { notfound } } ----
Cheers
[1] although I guess having a "hey lets copy from address 0x0" path in FreeRADIUS is probably considered bad style :)
Hi, Long time no see. Arran Cudbard-Bell <a.cudbard-bell@sussex.ac.uk> wrote:
You using ProCurve NAS then? Or have other people started using Service-Type = 'Call-Check' to hint at Mac-Auth?
Cisco always have from what I can tell, well since they introduced mac auth back roughly two or so years ago...that is how long it's been in my config for. Cheers -- Alexander Clouter .sigmonster says: Keep your boss's boss off your boss's back.
Dear All, Can anybody help me in enabling the debug option for freeradius 1.1.0 version. Need to analyze a portion of the code for understanding and enhancing. Hence i want the debug enabling to be done compile time Regards Debasish Mohapatro Communication and Embedded System LARSEN & TOUBRO INFOTECH LIMITED. BANGALORE-560071 INDIA ph:- +91-80-66242424 ext-2047 ====================================== ( ) L&T Infotech Proprietary ( ) L&T Infotech Confidential ( ) L&T Infotech Internal Use Only ( ) L&T Infotech General Business Information ====================================== Larsen & Toubro Infotech Ltd. www.Lntinfotech.com This Document is classified as: L&T Infotech Proprietary L&T Infotech Confidential L&T Infotech Internal Use Only L&T Infotech General Business This Email may contain confidential or privileged information for the intended recipient (s) If you are not the intended recipient, please do not use or disseminate the information, notify the sender and delete it from your system. ______________________________________________________________________
Hi,
Can anybody help me in enabling the debug option for freeradius 1.1.0 version. Need to analyze a portion of the code for understanding and enhancing. Hence i want the debug enabling to be done compile time
???? understand and enhance the latest release - 2.1.6 1.1.0 is so old that what you're looking at may have already been fixed/upgraded alan
Hi,
Long time no see.
Indeed.
Arran Cudbard-Bell<a.cudbard-bell@sussex.ac.uk> wrote:
You using ProCurve NAS then? Or have other people started using Service-Type = 'Call-Check' to hint at Mac-Auth?
Cisco always have from what I can tell, well since they introduced mac auth back roughly two or so years ago...that is how long it's been in my config for.
Ah, so that's who they were copying. It makes it easier to be sure the NAS really is requesting MAC-Auth when it includes that Service-Type attribute. Nice condition btw, very compact :) -Arran -- Arran Cudbard-Bell <A.Cudbard-Bell@sussex.ac.uk>, Systems Administrator (AAA), Infrastructure Services (IT Services), E1-1-08, Engineering 1, University Of Sussex, Brighton, BN1 9QT DDI+FAX: +44 1273 873900 | INT: 3900 GPG: 86FF A285 1AA1 EE40 D228 7C2E 71A9 25BB 1E68 54A2
Alexander Clouter wrote:
I am running FreeRADIUS from git[1] about two days ago and found that by putting the following in my 'hints' file gives me the segfault shown below[2]. If I remove the end bit[3] then I do not get the segfault, but then I also do not get my comparison :)
Any more information needed, then let me know.
I've committed a fix.
Cheers
[1] at commit 08baab6769fea367bda5dd006b659621bb9aac18 from yesterday-ish [2] strlcpy sourced from address 0x0 [3] User-Name =~ "/^%{1}%{2}%{3}%{4}%{5}%{6}$/i"
---- DEFAULT NAS-Port-Type == "Ethernet", User-Name == "%{User-Password}", Calling-Station-Id =~ "/^([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2})$/i", User-Name =~ "/^%{1}%{2}%{3}%{4}%{5}%{6}$/i"
Well... that really won't work. The regular expressions in the "users" file are just the strings: Foo =~ "a*b" NOT Foo =~ "/a*b/i" If you want policies that are slightly complicated, use "unlang". Really. Delete these entries from the "hints" file, and replace them with unlang-style policies. Alan DeKok.
participants (5)
-
Alan Buxey -
Alan DeKok -
Alexander Clouter -
Arran Cudbard-Bell -
Debasish Mohapatro