check UNENCRYPTED flag, not multiple connections flag

diff --git a/src/protocols/tacacs/decode.c b/src/protocols/tacacs/decode.c
index 905317c0440f4c2bac99e30d7e182e50a3d9b1ee..0236eff04799af6621452ead5ef696a48ee3552b 100644 (file)
--- a/src/protocols/tacacs/decode.c
+++ b/src/protocols/tacacs/decode.c
@@ -232,8 +232,10 @@ ssize_t fr_tacacs_decode(TALLOC_CTX *ctx, uint8_t const *buffer, size_t buffer_l
 
        /*
         *      3.6. Encryption
+        *
+        *      Packets are encrypted if the unencrypted flag is clear.
         */
-       if (pkt->hdr.flags == FR_TAC_PLUS_ENCRYPTED_MULTIPLE_CONNECTIONS_FLAG) {
+       if ((pkt->hdr.flags & FR_TAC_PLUS_UNENCRYPTED_FLAG) == 0) {
                size_t length;
 
                if (!secret || secret_len < 1) {

diff --git a/src/protocols/tacacs/encode.c b/src/protocols/tacacs/encode.c
index c99eff5c474354c1fd9388d2db61cf1556a6ca02..4640b7d6e45978ef60fa8e32ac651bb9cc4cb11a 100644 (file)
--- a/src/protocols/tacacs/encode.c
+++ b/src/protocols/tacacs/encode.c
@@ -514,8 +514,10 @@ ssize_t fr_tacacs_encode(uint8_t *buffer, size_t buffer_len, char const *secret,
 
        /*
         *      3.6. Encryption
+        *
+        *      Packets are encrypted if the unencrypted flag is clear.
         */
-       if (packet->hdr.flags == FR_TAC_PLUS_ENCRYPTED_MULTIPLE_CONNECTIONS_FLAG) {
+       if ((packet->hdr.flags & FR_TAC_PLUS_UNENCRYPTED_FLAG) == 0) {
                uint8_t *body = (buffer + sizeof(fr_tacacs_packet_hdr_t));
 
                fr_assert(secret != NULL);

diff --git a/src/protocols/tacacs/tacacs.h b/src/protocols/tacacs/tacacs.h
index d27a4c5fe8331b889d8a070d916f0682efaa2550..13ffd1dd019c0456c4befd642f99935cf0395516 100644 (file)
--- a/src/protocols/tacacs/tacacs.h
+++ b/src/protocols/tacacs/tacacs.h
@@ -59,9 +59,9 @@ typedef enum {
 } fr_tacacs_type_t;
 
 typedef enum {
-       FR_TAC_PLUS_ENCRYPTED_MULTIPLE_CONNECTIONS_FLAG = 0x00, /* gdb candy */
-       FR_TAC_PLUS_UNENCRYPTED_FLAG                    = 0x01,
-       FR_TAC_PLUS_SINGLE_CONNECT_FLAG                 = 0x04
+       FR_TAC_PLUS_FLAGS_NONE                  = 0x00,
+       FR_TAC_PLUS_UNENCRYPTED_FLAG            = 0x01,
+       FR_TAC_PLUS_SINGLE_CONNECT_FLAG         = 0x04
 } fr_tacacs_flags_t;
 
 typedef struct CC_HINT(__packed__) {