Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for OpenLDAP and 389ds PBKDF2 passwords #5329

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

olvrlrnz
Copy link

@olvrlrnz olvrlrnz commented Jun 3, 2024

This commit enables the PAP module to recognize and handle OpenLDAP and 389ds style PBKDF2 passwords.
A new password type was added that leaves the password header intact when passing it to the authentication module, because it contains the hash function used. Currently, password_process_header strips that out, as none of the other supported hash formats need it.

This commit enables the PAP module to recognize and handle OpenLDAP
and 389ds style PBKDF2 passwords.
A new password type was added that leaves the password header intact
when passing it to the authentication module, because it contains
the hash function used. Currently, password_process_header strips
that out, as none of the other supported hash formats need it.
@alandekok
Copy link
Member

This seems bad :(

Fri Jun  7 13:40:36 2024: Debug : (0)        pap - Comparing with "known good" Password.PBKDF2-389DS = 0x7b50424b4446322d5348413531327d3130303030246b58375a467a6e796c69486f425a2b375a494941493179482b5639795a67366a246b797a7a343333432f706476646b7a50546a77693877723663484e5446443064434b75556b4b564d6d5367696c474244516a4e78664451775a7a46426950674368514a5446416d386f54686d363578724c47466e41673d3d (142)
Fri Jun  7 13:40:36 2024: Debug : (0)        pap - Comparing with "known-good" Password.PBKDF2
=================================================================
==71020==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61100037b52e at pc 0x7fb507e396d5 bp 0x7fff88ce9df0 sp 0x7fff88ce9de8
READ of size 1 at 0x61100037b52e thread T0
    #0 0x7fb507e396d4 in strlcpy /home/runner/work/freeradius-server/freeradius-server/src/lib/util/strlcpy.c:52:10
    #1 0x7fb5007b891b in pap_auth_pbkdf2_parse /home/runner/work/freeradius-server/freeradius-server/src/modules/rlm_pap/rlm_pap.c:576:3
    #2 0x7fb5007b7cba in pap_auth_pbkdf2_389ds /home/runner/work/freeradius-server/freeradius-server/src/modules/rlm_pap/rlm_pap.c:724:10
    #3 0x7fb5007a8fdf in mod_authenticate /home/runner/work/freeradius-server/freeradius-server/src/modules/rlm_pap/rlm_pap.c:1007:2

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants