we only support TACACS+ version 12.0 or 12.1

diff --git a/src/protocols/tacacs/base.c b/src/protocols/tacacs/base.c
index 94106d0fc00bcb28cef64a7efcd01c944b7f1026..94010f3dc6ca88105a5814275c9215152dde9a81 100644 (file)
--- a/src/protocols/tacacs/base.c
+++ b/src/protocols/tacacs/base.c
@@ -194,6 +194,14 @@ ssize_t fr_tacacs_length(uint8_t const *buffer, size_t buffer_len)
                return sizeof(pkt->hdr);
        }
 
+       /*
+        *      TACACS major / minor version MUST be 12.0 or 12.1
+        */
+       if (!((buffer[0] == 0xc0) || (buffer[0] == 0xc1))) {
+               fr_strerror_printf("Unsupported TACACS+ version %02x", buffer[0]);
+               return -1;
+       }
+
        /*
         *      There's no reason to accept 64K TACACS+ packets.
         */

diff --git a/src/protocols/tacacs/decode.c b/src/protocols/tacacs/decode.c
index 1137d135e3967f03f05655bad9394c9ce60122c3..4dbb8adc97a91d44b6b979876eaa5b98039961b4 100644 (file)
--- a/src/protocols/tacacs/decode.c
+++ b/src/protocols/tacacs/decode.c
@@ -185,6 +185,14 @@ ssize_t fr_tacacs_decode(TALLOC_CTX *ctx, uint8_t const *buffer, size_t buffer_l
                return -1;
        }
 
+       /*
+        *      TACACS major / minor version MUST be 12.0 or 12.1
+        */
+       if (!((buffer[0] == 0xc0) || (buffer[0] == 0xc1))) {
+               fr_strerror_printf("Unsupported TACACS+ version %02x", buffer[0]);
+               return -1;
+       }
+
        /*
         *      There's no reason to accept 64K TACACS+ packets.
         */