Possible bug in rlm_perl

[Josh Hiner]

I think I may have found a bug in rlm_perl? I have written script with 
the aid of another freeradius list member that checks to see if a user 
is in a certain samba windows group. If they are not in the group (the 
wireless group) the module rejects the login. The module works perfectly 
except for those users who's usernames begin with a letter t. For 
instance ISD\josh will succeed but ISD\\ted will fail. I have done much 
testing and cant find my script to be the issue. Look below for debug 
output for the perl module.

Notice that right after the ++[files] line I print out the radius items 
for debugging. Notice the User-Name value is correct going into the perl 
script. Notice on the exit of the perl script on each debug that the 
username is correct. Then notice later in each debug where these lines are:
Login OK: [ISD\\josh] (from client CCISD-REMC-Radius port 0 via TLS tunnel)
but when the username begins with a "t" it fails here like this:
Login incorrect: [ISD\tbraun] (from client CCISD-REMC-Radius port 0 via 
TLS tunnel)
Notice only one backslash.

I have tried to make it succeed by adding backslashes (for users that 
start with t) but no success. It will do ISD\\\tbraun and ISD\tbraun but 
never ISD\\tbraun. Therefore, with users that start with "t" I always 
get User-name does not match eap identity failure.

Thanks for any help. At the very bottom after the debug output you will 
find my simple perl script that is well commented.

-Josh

------- Successful attempt --------
++[files] returns noop
They key is User-Name and the value is ISD\\josh.They key is EAP-Message 
and the value is 0x020900061a03.They key is EAP-Type and the value is 
MS-CHAP-V2.They key is State and the value is 
0xfeecb38bffe5a965a0ca1cd92ce6c42b.They key is FreeRADIUS-Proxied-To and 
the value is 127.0.0.1.
rlm_perl: Added pair User-Name = ISD\josh
rlm_perl: Added pair EAP-Message = 0x020900061a03
rlm_perl: Added pair EAP-Type = MS-CHAP-V2
rlm_perl: Added pair State = 0xfeecb38bffe5a965a0ca1cd92ce6c42b
rlm_perl: Added pair FreeRADIUS-Proxied-To = 127.0.0.1
rlm_perl: Added pair Auth-Type = EAP
rlm_perl: Added pair Proxy-To-Realm = LOCAL
++[perl] returns updated
++[expiration] returns noop
++[logintime] returns noop
++[pap] returns noop
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/mschapv2
[eap] processing type mschapv2
[eap] Freeing handler
++[eap] returns ok
Login OK: [ISD\\josh] (from client CCISD-REMC-Radius port 0 via TLS tunnel)
} # server inner-tunnel
[peap] Got tunneled reply code 2
    EAP-Message = 0x03090004
    Message-Authenticator = 0x00000000000000000000000000000000
    User-Name = "ISD\\josh"
[peap] Got tunneled reply RADIUS code 2
    EAP-Message = 0x03090004
    Message-Authenticator = 0x00000000000000000000000000000000
    User-Name = "ISD\\josh"
[peap] Tunneled authentication was successful.
[peap] SUCCESS
[peap] Saving tunneled attributes for later
--------- End snip of successful attempt ---------

--------- Failed attempt from user who's username begins with a "t"  
(tbraun) ---------
++[files] returns noop
They key is User-Name and the value is ISD\\tbraun.They key is 
EAP-Message and the value is 0x0207000f014953445c74627261756e.They key 
is EAP-Type and the value is Identity.They key is FreeRADIUS-Proxied-To 
and the value is 127.0.0.1.rlm_perl: Added pair User-Name = ISD\tbraun
rlm_perl: Added pair EAP-Message = 0x0207000f014953445c74627261756e
rlm_perl: Added pair EAP-Type = Identity
rlm_perl: Added pair FreeRADIUS-Proxied-To = 127.0.0.1
rlm_perl: Added pair Auth-Type = EAP
rlm_perl: Added pair Proxy-To-Realm = LOCAL
rlm_perl: Added pair EAP-Type = MS-CHAP-V2
++[perl] returns updated
++[expiration] returns noop
++[logintime] returns noop
++[pap] returns noop
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] Identity does not match User-Name, setting from EAP Identity.
[eap] Failed in handler
++[eap] returns invalid
Failed to authenticate the user.
Login incorrect: [ISD\tbraun] (from client CCISD-REMC-Radius port 0 via 
TLS tunnel)
} # server inner-tunnel
[peap] Got tunneled reply code 3
[peap] Got tunneled reply RADIUS code 3
[peap] Tunneled authentication was rejected.
[peap] FAILURE
----------- End of snip of failed attempt ----------------

----------- Begin paste of perl script ------------------

#!/usr/bin/perl -w
use strict;
# use ...
use vars qw(%RAD_REQUEST %RAD_REPLY %RAD_CHECK);
use Data::Dumper;

# This is hash wich hold original request from radius
#my %RAD_REQUEST;
# In this hash you add values that will be returned to NAS.
#my %RAD_REPLY;
#This is for check items
#my %RAD_CHECK;

#
# This the remapping of return values
#
       use constant    RLM_MODULE_REJECT=>    0;#  /* immediately reject 
the request */
       use constant    RLM_MODULE_FAIL=>      1;#  /* module failed, 
don't reply */
       use constant    RLM_MODULE_OK=>        2;#  /* the module is OK, 
continue */
       use constant    RLM_MODULE_HANDLED=>   3;#  /* the module handled 
the request, so stop. */
       use constant    RLM_MODULE_INVALID=>   4;#  /* the module 
considers the request invalid. */
       use constant    RLM_MODULE_USERLOCK=>  5;#  /* reject the request 
(user is locked out) */
       use constant    RLM_MODULE_NOTFOUND=>  6;#  /* user not found */
       use constant    RLM_MODULE_NOOP=>      7;#  /* module succeeded 
without doing anything */
       use constant    RLM_MODULE_UPDATED=>   8;#  /* OK (pairs modified) */
       use constant    RLM_MODULE_NUMCODES=>  9;#  /* How many return 
codes there are */

# Function to handle authorize
sub authorize {

my $sambagroup = "10007"; #This is the numeric ID of the samba group
my $domain = "ISD";

#Testing stuff to print out all radius attributes from hash
        my $key = "";
        my $value = "";
        while (($key, $value) = each (%RAD_REQUEST)){
            print "They key is $key and the value is $value.";
        }
#End of testing
        my $auth_user = $RAD_REQUEST{'User-Name'};

        #Windows adds host/ to the begining of every machine name during 
login.
        #The following block of code cleans off host/ and replaces it with
        #the login domain and tags a $ at the end for wbinfo group query.

        if ($auth_user =~ /\bhost\b/ ) {
            $auth_user =~ s/^host\/// ;
            $auth_user = "$auth_user\$";
        }

       #Here I add the domain to the beginning of the username if the 
domain doesnt exist there
       #already.
        if ( $auth_user !~ /^\b$domain\b/ ) {
                    $auth_user = "$domain\\\\$auth_user";
        }

        #End of username/machine name cleanup.

         #The next line is the wbinfo query to see what samba groups the 
user is a member of.
                my @resultArray = qx(wbinfo -r $auth_user);

                my $arraySize = scalar @resultArray;
        my $groupID = "";

                if ($arraySize != 0) {
            foreach $groupID (@resultArray) {
                if ($groupID == $sambagroup) {
                  
                    #The below line re-writes the value stored in
                    #the radius user-name attribute in the rad_request
                    #hash. For some reason freeradius feeds in
                    #DOMAIN\\\\username instead of DOMAIN\\username.
                    #This causes the eap module to fail because the
                    #returned value from this module doesnt match the EAP
                    #identity.

                    #this is from testing --> $RAD_REQUEST{'User-Name'} 
= "ISD\\\\tbraun"

                    #The following line cleans two of the slashes "\\" 
out of the user-name before we return from the
                    #perl module. These two slashes get added in. I'm 
not sure how or why.
      
                    $RAD_REQUEST{'User-Name'} =~ s/^$domain\\/$domain/;

                    #Here I exit the subroutine and tell FreeRadius I 
updated
                    #some junk.

                    return RLM_MODULE_UPDATED;
#                    return RLM_MODULE_OK;
                }
            }

                }
                else {
                        #user not in the required group.
                       return RLM_MODULE_REJECT; #YOU have been denied....
                }
}