attr_filter segfault

[Alexander Clouter]

Hi,

Only me...again doing things I probably should not do with FreeRADIUS.

The new config file I'm working on makes use of all the virtual 
server bits more throughier, a lot of my existing setup is in the 
non-virtual server setup.

What I'm doing is having all the authentication handled by an inner 
virtual server (shown below) whilst the authorisation is handled by the 
server that proxied the request to 'auth'.  This is to handle both MAC 
auth and EAP-TTLS request.

I was trying to put in some sneaky LDAP avoiding shortcuts (I do not 
want to make any LDAP lookups until EAP is out the way, we use 
eDirectory's Universal Password so we use the LDAP module to extract the 
plaintext password) which speeds up the whole authentication.

So I decided to slap in unwisely placed 'handled' and the attr_filter on 
the proxying server (in post-proxy) exploded.  The backtrace is below 
and I also slipped in a 'detail' and can see that the attribute value is 
pretty borked for 'Freeradius-Proxied-To'.

Now, I know what I have done is wrong, terrible and should not be done, 
however these things possibly point to other proper corner cases where 
FreeRADIUS could explode with a safe driver at the wheel :)

It all works fine though if I comment out the whole of the first 'if' 
statement block and remove the comments for the opening/closing/eap of 
the second lot.

If you need any more, you know who to pester :)

Cheers

----
server auth {
        authorize {
                if ( EAP-Message ) {
                        eap
                        handled
                }
#               if ( !EAP-Message ) {
                        # we cannot have 'suffix' here as it makes the
                        # virtual server (and the modules) think things
                        # are going to get proxied and so PAP gives NOOP
                        #
                        # this would be unneeded if we could use
                        # 'eduPersonPrincipalName' in the ldap module :(
                        if ( User-Name =~ /^(.*)@.*$/ ) {
                                update request {
                                        Stripped-User-Name := "%{1}"
                                }
                        }

                        ldap_auth
                        pap
                        chap
                        mschap
#               }

#		eap
}
----

----
>>> Sending proxied request internally to virtual server.
server auth {
+- entering group authorize {...}
++? if (EAP-Message )
? Evaluating (EAP-Message ) -> TRUE
++? if (EAP-Message ) -> TRUE
++- entering if (EAP-Message ) {...}
[eap] EAP packet type response id 0 length 16
[eap] No EAP Start, assuming it's an on-going EAP conversation
+++[eap] returns updated
+++[handled] returns handled
++- if (EAP-Message ) returns handled
} # server auth
Going to the next request
<<< Received proxied response code 0 from internal virtual server.
+- entering group post-proxy {...}
[detail]        expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/212.219.138.68/detail-20090819
[detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/212.219.138.68/detail-20090819
[detail]        expand: %t -> Wed Aug 19 19:18:24 2009
[detail] Freeradius-Proxied-To = px?M???
++[detail] returns ok
[attr_filter.post-proxy]        expand: %{Realm} -> soas.ac.uk
 attr_filter: Matched entry DEFAULT at line 103

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7f93458daae0 (LWP 6411)]
0x00007f9340ac8cd0 in attr_filter_common (instance=<value optimized out>, request=0x146bb30, input=0x68)
    at rlm_attr_filter.c:255
255                     for (vp = *input; vp != NULL; vp = vp->next ) {(gdb) where
#0  0x00007f9340ac8cd0 in attr_filter_common (instance=<value optimized out>, request=0x146bb30, input=0x68)
    at rlm_attr_filter.c:255
#1  0x0000000000416399 in modcall (component=6, c=<value optimized out>, request=0x146bb30) at modcall.c:292
#2  0x00000000004137c6 in indexed_modcall (comp=6, idx=<value optimized out>, request=0x146bb30) at modules.c:637
#3  0x000000000041cd3b in process_proxy_reply (request=0x146bb30) at event.c:1718
#4  0x000000000042080d in proxy_to_virtual_server (request=0x146bb30) at event.c:1966
#5  0x0000000000420318 in request_post_handler (request=0x146bb30) at event.c:2236
#6  0x000000000042064d in radius_handle_request (request=0x146bb30, fun=0x7f93400b9d60 <rad_authenticate>)
    at event.c:3740
#7  0x000000000041877d in thread_pool_addrequest (request=0x1, fun=0x7fff4d8e5620) at threads.c:824
#8  0x000000000041d2ce in event_socket_handler (xel=<value optimized out>, fd=<value optimized out>, 
    ctx=<value optimized out>) at event.c:3358
#9  0x00007f93454c34ab in fr_event_loop (el=0x1461000) at event.c:400
#10 0x0000000000416ee7 in main (argc=2, argv=0x7fff4d8e85b8) at radiusd.c:398
(gdb) 
----

----
Wed Aug 19 19:18:24 2009
        User-Name = "@soas.ac.uk"
        NAS-IP-Address = 127.0.0.1
        Calling-Station-Id = "02-00-00-00-00-01"
        Framed-MTU = 1400
        NAS-Port-Type = Wireless-802.11
        Connect-Info = "CONNECT 11Mbps 802.11b"
        EAP-Message = 0x020000100140736f61732e61632e756b
        Message-Authenticator = 0x64f373450d92f42a9cff9c50c9a062c9
        Stripped-User-Name = "020000000001"
        Realm = "soas.ac.uk"
        Module-Failure-Message = "rlm_ldap: User not found"
        Realm = "soas.ac.uk"
        Freeradius-Proxied-To = px???M???
        Timestamp = 1250705904
        Request-Authenticator = Verified
----

-- 
Alexander Clouter
.sigmonster says: We have met the enemy, and he is us.
                  		-- Walt Kelly