Add tain to fr_pair_value_strdup

diff --git a/src/bin/radclient.c b/src/bin/radclient.c
index 1659c2ac279987e938b9f0c364986b4e05c531e0..dcb781aabdf5f2cb55358727a4588b103933e777 100644 (file)
--- a/src/bin/radclient.c
+++ b/src/bin/radclient.c
@@ -837,7 +837,7 @@ static int send_one_packet(rc_request_t *request)
                        fr_pair_t *vp;
 
                        if ((vp = fr_pair_find_by_da(&request->request_pairs, attr_user_password, 0)) != NULL) {
-                               fr_pair_value_strdup(vp, request->password->vp_strvalue);
+                               fr_pair_value_strdup(vp, request->password->vp_strvalue, false);
 
                        } else if ((vp = fr_pair_find_by_da(&request->request_pairs, attr_chap_password, 0)) != NULL) {
                                uint8_t         buffer[17];

diff --git a/src/lib/server/exfile.c b/src/lib/server/exfile.c
index f50a002c5818a9001eb0b1075e9aa5ea810ca629..e0609c74a74265d67388ed7b7bdccdb921402d1a 100644 (file)
--- a/src/lib/server/exfile.c
+++ b/src/lib/server/exfile.c
@@ -90,7 +90,7 @@ static inline void exfile_trigger_exec(exfile_t *ef, exfile_entry_t *entry, char
        fr_dcursor_init(&cursor, fr_pair_list_order(&args));
 
        MEM(vp = fr_pair_afrom_da(NULL, da));
-       fr_pair_value_strdup(vp, entry->filename);
+       fr_pair_value_strdup(vp, entry->filename, false);
 
        fr_dcursor_prepend(&cursor, vp);
 

diff --git a/src/lib/server/log.c b/src/lib/server/log.c
index 952185e833d72953c0841567ebf11873512d9914..8bda670a648d6d8ec91c326e7676030aad03a333 100644 (file)
--- a/src/lib/server/log.c
+++ b/src/lib/server/log.c
@@ -554,7 +554,7 @@ void vlog_module_failure_msg(request_t *request, char const *fmt, va_list ap)
        if (request->module && (request->module[0] != '\0')) {
                fr_pair_value_aprintf(vp, "%s: %s", request->module, p);
        } else {
-               fr_pair_value_strdup(vp, p);
+               fr_pair_value_strdup(vp, p, false);
        }
 
        talloc_free(p);

diff --git a/src/lib/server/trigger.c b/src/lib/server/trigger.c
index 0171585fae44a9601fbd9341b344079c253edd75..a13b0295d1c01459d61f6544cce7db532e57e88d 100644 (file)
--- a/src/lib/server/trigger.c
+++ b/src/lib/server/trigger.c
@@ -495,7 +495,7 @@ void trigger_args_afrom_server(TALLOC_CTX *ctx, fr_pair_list_t *list, char const
        }
 
        MEM(vp = fr_pair_afrom_da(ctx, server_da));
-       fr_pair_value_strdup(vp, server);
+       fr_pair_value_strdup(vp, server, false);
        fr_pair_append(list, vp);
 
        MEM(vp = fr_pair_afrom_da(ctx, port_da));

diff --git a/src/lib/tls/pairs.c b/src/lib/tls/pairs.c
index efa8c948d09b2891fa344ec3dc125d616cb4543a..098f31bc7be8192e0130a942b42fc1fe79d535f9 100644 (file)
--- a/src/lib/tls/pairs.c
+++ b/src/lib/tls/pairs.c
@@ -118,7 +118,7 @@ int fr_tls_session_pairs_from_x509_cert(fr_pair_list_t *pair_list, TALLOC_CTX *c
 
                OBJ_obj2txt(buff, sizeof(buff), alg->algorithm, 0);
                MEM(fr_pair_append_by_da(ctx, &vp, pair_list, attr_tls_certificate_signature_algorithm) == 0);
-               fr_pair_value_strdup(vp, buff);
+               fr_pair_value_strdup(vp, buff, false);
        }
 
        /*

diff --git a/src/lib/tls/session.c b/src/lib/tls/session.c
index d2cb594a3d2e1ec82104d00cf67167693ec19804..8abaa46ebfaca7cde701a4966a2d27d4b1342ee3 100644 (file)
--- a/src/lib/tls/session.c
+++ b/src/lib/tls/session.c
@@ -1099,7 +1099,7 @@ static unlang_action_t tls_session_async_handshake_done_round(UNUSED rlm_rcode_t
                RDEBUG2("Adding TLS session information to request");
                vp = fr_pair_afrom_da(request->session_state_ctx, attr_tls_session_cipher_suite);
                if (vp) {
-                       fr_pair_value_strdup(vp,  SSL_CIPHER_get_name(cipher));
+                       fr_pair_value_strdup(vp,  SSL_CIPHER_get_name(cipher), false);
                        fr_pair_append(&request->session_state_pairs, vp);
                        RINDENT();
                        RDEBUG2("&session-state.%pP", vp);
@@ -1115,7 +1115,7 @@ static unlang_action_t tls_session_async_handshake_done_round(UNUSED rlm_rcode_t
 
                vp = fr_pair_afrom_da(request->session_state_ctx, attr_tls_session_version);
                if (vp) {
-                       fr_pair_value_strdup(vp, version);
+                       fr_pair_value_strdup(vp, version, false);
                        fr_pair_append(&request->session_state_pairs, vp);
                        RINDENT();
                        RDEBUG2("&session-state.TLS-Session-Version := \"%s\"", version);

diff --git a/src/lib/util/pair.c b/src/lib/util/pair.c
index 2f3b05bc3b2fa85dc5efa9e9b8abe589569cbfef..6e53ee230f4b897b4d7a28785fc934c66637b05e 100644 (file)
--- a/src/lib/util/pair.c
+++ b/src/lib/util/pair.c
@@ -1681,20 +1681,21 @@ int fr_pair_value_from_str(fr_pair_t *vp, char const *value, ssize_t inlen, char
  *
  * @note vp->da must be of type FR_TYPE_STRING.
  *
- * @param[in,out] vp to update
- * @param[in] src data to copy
+ * @param[in,out] vp   to update
+ * @param[in] src      data to copy
+ * @param[in] tainted  Whether the value came from a trusted source.
  * @return
  *     - 0 on success.
  *     - -1 on failure.
  */
-int fr_pair_value_strdup(fr_pair_t *vp, char const *src)
+int fr_pair_value_strdup(fr_pair_t *vp, char const *src, bool tainted)
 {
        int ret;
 
        if (!fr_cond_assert(vp->da->type == FR_TYPE_STRING)) return -1;
 
        fr_value_box_clear(&vp->data);  /* Free any existing buffers */
-       ret = fr_value_box_strdup(vp, &vp->data, vp->da, src, false);
+       ret = fr_value_box_strdup(vp, &vp->data, vp->da, src, tainted);
        if (ret == 0) {
                vp->type = VT_DATA;
                VP_VERIFY(vp);

diff --git a/src/lib/util/pair.h b/src/lib/util/pair.h
index 58969baa3263eb5842d8876ab32c7852eee6f496..a6703f899f27be2a1b4e1e9a0b8ef3bbe63c6939 100644 (file)
--- a/src/lib/util/pair.h
+++ b/src/lib/util/pair.h
@@ -342,7 +342,7 @@ int         fr_pair_value_copy(fr_pair_t *dst, fr_pair_t *src);
  */
 int            fr_pair_value_from_str(fr_pair_t *vp, char const *value, ssize_t len, char quote, bool tainted);
 
-int            fr_pair_value_strdup(fr_pair_t *vp, char const *src);
+int            fr_pair_value_strdup(fr_pair_t *vp, char const *src, bool tainted) CC_HINT(nonnull);
 
 int            fr_pair_value_strdup_shallow(fr_pair_t *vp, char const *src, bool tainted);
 

diff --git a/src/lib/util/pair_tests.c b/src/lib/util/pair_tests.c
index 69d94e532c70a5d71d8eae0db5f6d99b396bc5f0..ec68114c481c370497e857efef1f2100547b40e2 100644 (file)
--- a/src/lib/util/pair_tests.c
+++ b/src/lib/util/pair_tests.c
@@ -580,7 +580,7 @@ static void test_fr_pair_value_strdup(void)
        VP_VERIFY(vp);
 
        TEST_CASE("Copy content of 'test_string' to attribute value using fr_pair_value_strdup()");
-       TEST_CHECK(fr_pair_value_strdup(vp, test_string) == 0);
+       TEST_CHECK(fr_pair_value_strdup(vp, test_string, false) == 0);
 
        TEST_CASE("Validating VP_VERIFY()");
        VP_VERIFY(vp);
@@ -626,7 +626,7 @@ static void test_fr_pair_value_strtrim(void)
        VP_VERIFY(vp);
 
        TEST_CASE("Copy content of 'test_string' to attribute value using fr_pair_value_strdup_shallow()");
-       TEST_CHECK(fr_pair_value_strdup(vp, test_string) == 0);
+       TEST_CHECK(fr_pair_value_strdup(vp, test_string, false) == 0);
 
        TEST_CASE("Trim the length of the string buffer using fr_pair_value_strtrim()");
        TEST_CHECK(fr_pair_value_strtrim(vp) == 0);

diff --git a/src/listen/radius/proto_radius.c b/src/listen/radius/proto_radius.c
index 82385354414bf8fe5b44195816b5470d30c62f92..0aa83ce549eff750ba66de20ec2771a628573761 100644 (file)
--- a/src/listen/radius/proto_radius.c
+++ b/src/listen/radius/proto_radius.c
@@ -274,7 +274,7 @@ static int mod_decode(void const *instance, request_t *request, uint8_t *const d
                                        break;
 
                                case FR_TYPE_STRING:
-                                       fr_pair_value_strdup(vp, "");
+                                       fr_pair_value_strdup(vp, "", true);
                                        break;
                                }
                        }

diff --git a/src/listen/tacacs/proto_tacacs.c b/src/listen/tacacs/proto_tacacs.c
index 43c775b4e86882cf24898d292cb99f18476c73c6..bdfe1880591cc751420e4aae4ab68e1934b8c580 100644 (file)
--- a/src/listen/tacacs/proto_tacacs.c
+++ b/src/listen/tacacs/proto_tacacs.c
@@ -273,7 +273,7 @@ static int mod_decode(void const *instance, request_t *request, uint8_t *const d
                                        break;
 
                                case FR_TYPE_STRING:
-                                       fr_pair_value_strdup(vp, "");
+                                       fr_pair_value_strdup(vp, "", true);
                                        break;
                                }
                        }

diff --git a/src/modules/proto_ldap_sync/proto_ldap_sync.c b/src/modules/proto_ldap_sync/proto_ldap_sync.c
index aa22c77e964ea2e0694ad4877defe1d1469b45da..f4b88f2fd78ac5bf191aac6ee6aed5b73744d4bb 100644 (file)
--- a/src/modules/proto_ldap_sync/proto_ldap_sync.c
+++ b/src/modules/proto_ldap_sync/proto_ldap_sync.c
@@ -537,18 +537,18 @@ static int proto_ldap_attributes_add(request_t *request, sync_config_t const *co
        fr_pair_t *vp;
 
        MEM(pair_append_request(&vp, attr_ldap_sync_dn) == 0);
-       fr_pair_value_strdup(vp, config->base_dn);
+       fr_pair_value_strdup(vp, config->base_dn, false);
 
        if (config->filter) {
                MEM(pair_update_request(&vp, attr_ldap_sync_filter) >= 0);
-               fr_pair_value_strdup(vp, config->filter);
+               fr_pair_value_strdup(vp, config->filter, false);
        }
        if (config->attrs) {
                char const *attrs_p;
 
                for (attrs_p = *config->attrs; *attrs_p; attrs_p++) {
                        MEM(pair_append_request(&vp, attr_ldap_sync_attr) == 0);
-                       fr_pair_value_strdup(vp, attrs_p);
+                       fr_pair_value_strdup(vp, attrs_p, false);
                }
        }
 

diff --git a/src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c b/src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c
index 4cda58c38678bf9cf0384eaabaff3e985f7fa0a2..6d39d0f6d8bb0e83745303e3d23a22ccdffebae2 100644 (file)
--- a/src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c
+++ b/src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c
@@ -730,7 +730,7 @@ packet_ready:
                         *      FIXME: Put it into MS-CHAP-Domain?
                         */
                        username++; /* skip the \\ */
-                       fr_pair_value_strdup(auth_challenge, username);
+                       fr_pair_value_strdup(auth_challenge, username, auth_challenge->vp_tainted);
                }
 
                /*

diff --git a/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c b/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c
index b8ac86bb3d72e11957ab7185a8cf2387910ad7cd..cc25f859331c68715fe3f9344082be66b78d44ef 100644 (file)
--- a/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c
+++ b/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c
@@ -323,7 +323,7 @@ do_value:
                /*
                 *      Diameter pads strings (i.e. User-Password) with trailing zeros.
                 */
-               if (vp->vp_type == FR_TYPE_STRING) fr_pair_value_strdup(vp, vp->vp_strvalue);
+               if (vp->vp_type == FR_TYPE_STRING) fr_pair_value_strdup(vp, vp->vp_strvalue, vp->vp_tainted);
        }
 
        /*

diff --git a/src/modules/rlm_ldap/groups.c b/src/modules/rlm_ldap/groups.c
index f9c4cb0261c97918db5da00b7e17f7cb398de310..8b38843dd5fec8ffefe00187c91379a01044f720 100644 (file)
--- a/src/modules/rlm_ldap/groups.c
+++ b/src/modules/rlm_ldap/groups.c
@@ -406,7 +406,7 @@ unlang_action_t rlm_ldap_cacheable_userobj(rlm_rcode_t *p_result, rlm_ldap_t con
 
        for (dn_p = group_dn; *dn_p; dn_p++) {
                MEM(vp = fr_pair_afrom_da(list_ctx, inst->cache_da));
-               fr_pair_value_strdup(vp, *dn_p);
+               fr_pair_value_strdup(vp, *dn_p, false);
                fr_pair_append(list, vp);
 
                RDEBUG2("&control.%s += \"%pV\"", inst->cache_da->name, &vp->data);
@@ -503,7 +503,7 @@ unlang_action_t rlm_ldap_cacheable_groupobj(rlm_rcode_t *p_result, rlm_ldap_t co
                        fr_ldap_util_normalise_dn(dn, dn);
 
                        MEM(pair_append_control(&vp, inst->cache_da) == 0);
-                       fr_pair_value_strdup(vp, dn);
+                       fr_pair_value_strdup(vp, dn, false);
 
                        RINDENT();
                        RDEBUG2("&control.%pP", vp);

diff --git a/src/modules/rlm_ldap/user.c b/src/modules/rlm_ldap/user.c
index c7ad63e643f1389ecf0e5f36b839734233cffd4e..b84768a5d4fc9c01f9c52602f4446e6b2dac05b7 100644 (file)
--- a/src/modules/rlm_ldap/user.c
+++ b/src/modules/rlm_ldap/user.c
@@ -197,7 +197,7 @@ char const *rlm_ldap_find_user(rlm_ldap_t const *inst, request_t *request, fr_ld
        RDEBUG2("User object found at DN \"%s\"", dn);
 
        MEM(pair_update_control(&vp, attr_ldap_userdn) >= 0);
-       fr_pair_value_strdup(vp, dn);
+       fr_pair_value_strdup(vp, dn, false);
        *rcode = RLM_MODULE_OK;
 
        ldap_memfree(dn);

diff --git a/src/modules/rlm_radius/rlm_radius_udp.c b/src/modules/rlm_radius/rlm_radius_udp.c
index 76c2f6e11c0383c956fc714a36747eca4d9414b4..df70cfd7de03e6ecea9a948feea3892b6fd81439 100644 (file)
--- a/src/modules/rlm_radius/rlm_radius_udp.c
+++ b/src/modules/rlm_radius/rlm_radius_udp.c
@@ -405,7 +405,7 @@ static void CC_HINT(nonnull) status_check_alloc(udp_handle_t *h)
                fr_pair_t *vp;
 
                MEM(pair_append_request(&vp, attr_nas_identifier) >= 0);
-               fr_pair_value_strdup(vp, "status check - are you alive?");
+               fr_pair_value_strdup(vp, "status check - are you alive?", false);
        }
 
        /*

diff --git a/src/modules/rlm_securid/rlm_securid.c b/src/modules/rlm_securid/rlm_securid.c
index 8b5579dc43c402dd15deb3cc044bbabc96e614af..de50fa5081a19ee8429a1d2c2a9b8a5b81e6e4be 100644 (file)
--- a/src/modules/rlm_securid/rlm_securid.c
+++ b/src/modules/rlm_securid/rlm_securid.c
@@ -535,7 +535,7 @@ static unlang_action_t CC_HINT(nonnull) mod_authenticate(rlm_rcode_t *p_result,
 
        if (*buffer) {
                MEM(pair_update_reply(&vp, attr_reply_message) >= 0);
-               fr_pair_value_strdup(vp, buffer);
+               fr_pair_value_strdup(vp, buffer, false);
        }
        RETURN_MODULE_RCODE(rcode);
 }

diff --git a/src/modules/rlm_sql/rlm_sql.c b/src/modules/rlm_sql/rlm_sql.c
index 14b60017bc22e4af71aab814b4acd52b409eefd8..a8d50a84563958c4202a03f068dc3156d43eb5d1 100644 (file)
--- a/src/modules/rlm_sql/rlm_sql.c
+++ b/src/modules/rlm_sql/rlm_sql.c
@@ -855,7 +855,7 @@ static unlang_action_t rlm_sql_process_groups(rlm_rcode_t *p_result,
        do {
        next:
                fr_assert(entry != NULL);
-               fr_pair_value_strdup(sql_group, entry->name);
+               fr_pair_value_strdup(sql_group, entry->name, true);
 
                if (inst->config->authorize_group_check_query) {
                        fr_pair_t       *vp;

diff --git a/src/modules/rlm_sqlcounter/rlm_sqlcounter.c b/src/modules/rlm_sqlcounter/rlm_sqlcounter.c
index 175f5fa7858fba12ea35b74db08d13d0342353fd..cac968b21da76cf1cdeb7566946b00e8b7ff2ebc 100644 (file)
--- a/src/modules/rlm_sqlcounter/rlm_sqlcounter.c
+++ b/src/modules/rlm_sqlcounter/rlm_sqlcounter.c
@@ -442,7 +442,7 @@ static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, mod
                snprintf(msg, sizeof(msg), "Your maximum %s usage time has been reached", inst->reset);
 
                MEM(pair_update_reply(&vp, attr_reply_message) >= 0);
-               fr_pair_value_strdup(vp, msg);
+               fr_pair_value_strdup(vp, msg, false);
 
                REDEBUG2("Maximum %s usage time reached", inst->reset);
                REDEBUG2("Rejecting user, %s value (%" PRIu64 ") is less than counter value (%" PRIu64 ")",

diff --git a/src/modules/rlm_unix/rlm_unix.c b/src/modules/rlm_unix/rlm_unix.c
index e3324fb7f82078680e2f84c0fe3f59f4b5a865d6..28c691619dfed5c0d618a58b35cc55b764f60935 100644 (file)
--- a/src/modules/rlm_unix/rlm_unix.c
+++ b/src/modules/rlm_unix/rlm_unix.c
@@ -299,7 +299,7 @@ static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, UNU
                RETURN_MODULE_NOOP;
 
        MEM(pair_update_control(&vp, attr_crypt_password) >= 0);
-       fr_pair_value_strdup(vp, encrypted_pass);
+       fr_pair_value_strdup(vp, encrypted_pass, false);
 
        RETURN_MODULE_UPDATED;
 }

diff --git a/src/modules/rlm_yubikey/rlm_yubikey.c b/src/modules/rlm_yubikey/rlm_yubikey.c
index 36bd0a409e69055c8956a084cb05fd585a67e720..b810e3c8c03c16bb3065a423cc2194bd3dbe677e 100644 (file)
--- a/src/modules/rlm_yubikey/rlm_yubikey.c
+++ b/src/modules/rlm_yubikey/rlm_yubikey.c
@@ -335,7 +335,7 @@ static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, mod
                 *      portion.
                 */
                MEM(pair_update_request(&vp, attr_yubikey_otp) >= 0);
-               fr_pair_value_strdup(vp, otp);
+               fr_pair_value_strdup(vp, otp, password->vp_tainted);
 
                /*
                 *      Replace the existing string buffer for the password

diff --git a/src/process/tacacs/base.c b/src/process/tacacs/base.c
index 9c6ee5843e539c8bb11ebdaea605177b8bd6ac5c..56a76bce996352f01f5e44e220b51768443272ad 100644 (file)
--- a/src/process/tacacs/base.c
+++ b/src/process/tacacs/base.c
@@ -167,7 +167,7 @@ static void message_failed(request_t *request, PROCESS_INST *inst, fr_process_st
         */
        if (!fr_pair_find_by_da(&request->reply_pairs, attr_tacacs_server_message, 0)) {
                MEM(pair_update_reply(&vp, attr_tacacs_server_message) >= 0);
-               fr_pair_value_strdup(vp, msg);
+               fr_pair_value_strdup(vp, msg, false);
        }
 
        /*

diff --git a/src/protocols/radius/abinary.c b/src/protocols/radius/abinary.c
index c5f00edd193e13ae220b8a01f62f14995348c333..97d2b117362390a89dab040bfdad52f862ac9f93 100644 (file)
--- a/src/protocols/radius/abinary.c
+++ b/src/protocols/radius/abinary.c
@@ -1536,7 +1536,7 @@ ssize_t fr_radius_decode_abinary(fr_pair_t *vp, uint8_t const *data, size_t data
        /*
         *      Copy the finished string to the output VP.
         */
-       if (fr_pair_value_strdup(vp, string) < 0) return -1;
+       if (fr_pair_value_strdup(vp, string, true) < 0) return -1;
 
        return 0;
 }