/*
- * The RFC says 4096 octets max, and most packets are less than 256.
- */
-#define MAX_PACKET_LEN 4096
-
-/*
* The maximum number of attributes which we allow in an incoming
* request. If there are more attributes than this, the request
* is rejected.
case PW_TYPE_STRING:
case PW_TYPE_OCTETS:
data = vp->data.ptr;
- if (!data) {
- fr_strerror_printf("ERROR: Cannot encode NULL data for attribute %s", vp->da->name);
- return -1;
- }
+ if (!data) return 0;
break;
case PW_TYPE_IFID:
ptr[0] = attribute & 0xff;
ptr[1] = 2;
- if (room > ((unsigned) 255 - ptr[1])) room = 255 - ptr[1];
+ if (room > 255) room = 255;
- len = vp2data_any(packet, original, secret, 0, pvp, ptr + ptr[1], room);
+ len = vp2data_any(packet, original, secret, 0, pvp, ptr + ptr[1], room - ptr[1]);
if (len <= 0) return len;
ptr[1] += len;
}
- if (room > ((unsigned) 255 - (dv->type + dv->length))) {
- room = 255 - (dv->type + dv->length);
- }
+ if (room > 255) room = 255;
len = vp2data_any(packet, original, secret, 0, pvp,
- ptr + dv->type + dv->length, room);
+ ptr + dv->type + dv->length, room - (dv->type + dv->length));
if (len <= 0) return len;
if (dv->length) ptr[dv->type + dv->length - 1] += len;
lvalue = htonl(vp->da->vendor);
memcpy(ptr + 2, &lvalue, 4);
- if (room > ((unsigned) 255 - ptr[1])) room = 255 - ptr[1];
+ if (room > 255) room = 255;
len = vp2attr_vsa(packet, original, secret, pvp,
vp->da->attr, vp->da->vendor,
- ptr + ptr[1], room);
+ ptr + ptr[1], room - ptr[1]);
if (len < 0) return len;
#ifndef NDEBUG
* RFC format attributes take the fast path.
*/
if (!vp->da->vendor) {
- if (vp->da->attr > 255) return 0;
+ if (vp->da->attr > 255) {
+ *pvp = vp->next;
+ return 0;
+ }
return rad_vp2rfc(packet, original, secret, pvp,
start, room);
*/
reply = packet->vps;
while (reply) {
- size_t last_len;
+ size_t last_len, room;
char const *last_name = NULL;
VERIFY_VP(reply);
}
/*
+ * We allow zero-length strings in "unlang", but
+ * skip them (except for CUI, thanks WiMAX!) on
+ * all other attributes.
+ */
+ if (reply->vp_length == 0) {
+ if ((reply->da->vendor != 0) ||
+ ((reply->da->attr != PW_CHARGEABLE_USER_IDENTITY) &&
+ (reply->da->attr != PW_MESSAGE_AUTHENTICATOR))) {
+ reply = reply->next;
+ continue;
+ }
+ }
+
+ /*
* Set the Message-Authenticator to the correct
* length and initial value.
*/
}
last_name = reply->da->name;
- len = rad_vp2attr(packet, original, secret, &reply, ptr,
- ((uint8_t *) data) + sizeof(data) - ptr);
+ room = ((uint8_t *) data) + sizeof(data) - ptr;
+
+ if (room <= 2) break;
+
+ len = rad_vp2attr(packet, original, secret, &reply, ptr, room);
if (len < 0) return -1;
/*
* the original vector, prior to signing.
*/
switch (packet->code) {
- case PW_CODE_ACCOUNTING_RESPONSE:
- if (original && original->code == PW_CODE_STATUS_SERVER) {
- goto do_ack;
- }
-
case PW_CODE_ACCOUNTING_REQUEST:
case PW_CODE_DISCONNECT_REQUEST:
- case PW_CODE_DISCONNECT_ACK:
- case PW_CODE_DISCONNECT_NAK:
case PW_CODE_COA_REQUEST:
- case PW_CODE_COA_ACK:
- memset(hdr->vector, 0, AUTH_VECTOR_LEN);
memset(packet->vector, 0, AUTH_VECTOR_LEN);
break;
- do_ack:
case PW_CODE_ACCESS_ACCEPT:
case PW_CODE_ACCESS_REJECT:
case PW_CODE_ACCESS_CHALLENGE:
+ case PW_CODE_ACCOUNTING_RESPONSE:
+ case PW_CODE_DISCONNECT_ACK:
+ case PW_CODE_DISCONNECT_NAK:
+ case PW_CODE_COA_ACK:
+ case PW_CODE_COA_NAK:
if (!original) {
fr_strerror_printf("ERROR: Cannot sign response packet without a request packet");
return -1;
}
- memcpy(hdr->vector, original->vector, AUTH_VECTOR_LEN);
memcpy(packet->vector, original->vector, AUTH_VECTOR_LEN);
break;
- default: /* others have vector already set to whatever */
- break;
+ case PW_CODE_ACCESS_REQUEST:
+ case PW_CODE_STATUS_SERVER:
+ default:
+ break; /* packet->vector is already random bytes */
}
+#ifndef NDEBUG
+ if ((fr_debug_lvl > 3) && fr_log_fp) rad_print_hex(packet);
+#endif
+
/*
* If there's a Message-Authenticator, update it
- * now, using the zero / original authentication vector.
+ * now.
*/
if (packet->offset > 0) {
uint8_t calc_auth_vector[AUTH_VECTOR_LEN];
+ switch (packet->code) {
+ case PW_CODE_ACCOUNTING_RESPONSE:
+ if (original && original->code == PW_CODE_STATUS_SERVER) {
+ goto do_ack;
+ }
+
+ case PW_CODE_ACCOUNTING_REQUEST:
+ case PW_CODE_DISCONNECT_REQUEST:
+ case PW_CODE_DISCONNECT_ACK:
+ case PW_CODE_DISCONNECT_NAK:
+ case PW_CODE_COA_REQUEST:
+ case PW_CODE_COA_ACK:
+ case PW_CODE_COA_NAK:
+ memset(hdr->vector, 0, AUTH_VECTOR_LEN);
+ break;
+
+ do_ack:
+ case PW_CODE_ACCESS_ACCEPT:
+ case PW_CODE_ACCESS_REJECT:
+ case PW_CODE_ACCESS_CHALLENGE:
+ memcpy(hdr->vector, original->vector, AUTH_VECTOR_LEN);
+ break;
+
+ default:
+ break;
+ }
+
/*
* Set the authentication vector to zero,
* calculate the HMAC, and put it
(uint8_t const *) secret, strlen(secret));
memcpy(packet->data + packet->offset + 2,
calc_auth_vector, AUTH_VECTOR_LEN);
-
- /*
- * Copy the request vector back
- * to the raw packet.
- */
- memcpy(hdr->vector, packet->vector, AUTH_VECTOR_LEN);
}
/*
+ * Copy the request authenticator over to the packet.
+ */
+ memcpy(hdr->vector, packet->vector, AUTH_VECTOR_LEN);
+
+ /*
* Switch over the packet code, deciding how to
* sign the packet.
*/
bool seen_ma = false;
uint32_t num_attributes;
decode_fail_t failure = DECODE_FAIL_NONE;
+ bool eap = false;
+ bool non_eap = false;
/*
* Check for packets smaller than the packet header.
*/
case PW_EAP_MESSAGE:
require_ma = true;
+ eap = true;
+ break;
+
+ case PW_USER_PASSWORD:
+ case PW_CHAP_PASSWORD:
+ case PW_ARAP_PASSWORD:
+ non_eap = true;
break;
case PW_MESSAGE_AUTHENTICATOR:
goto finish;
}
+ if (eap && non_eap) {
+ FR_DEBUG_STRERROR_PRINTF("Bad packet from host %s: Packet contains EAP-Message and non-EAP authentication attribute",
+ inet_ntop(packet->src_ipaddr.af,
+ &packet->src_ipaddr.ipaddr,
+ host_ipaddr, sizeof(host_ipaddr)));
+ failure = DECODE_FAIL_TOO_MANY_AUTH;
+ goto finish;
+ }
+
/*
* Fill RADIUS header fields
*/
projects / freeradius.git / blobdiff