make packet_ctx.vector[16] instead of a pointer. Fixes #3703

diff --git a/src/protocols/radius/base.c b/src/protocols/radius/base.c
index 51a50c8cb09568e5a6b04263d864e2b9f66a871a..8bc91d3d4a9a4e0ae03d28b88f893ab9e616b1b5 100644 (file)
--- a/src/protocols/radius/base.c
+++ b/src/protocols/radius/base.c
@@ -202,14 +202,6 @@ bool const fr_request_packets[FR_RADIUS_MAX_PACKET_CODE + 1] = {
        [FR_CODE_DISCONNECT_REQUEST] = true,
 };
 
-/*
- *     For request packets which have the Request Authenticator being
- *     all zeros.  We need to decode attributes using a Request
- *     Authenticator of all zeroes, but the actual Request
- *     Authenticator contains the signature of the packet, so we
- *     can't use that.
- */
-static uint8_t nullvector[RADIUS_AUTH_VECTOR_LENGTH] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
 
 /** Return the on-the-wire length of an attribute value
  *
@@ -930,7 +922,6 @@ ssize_t fr_radius_encode(uint8_t *packet, size_t packet_len, uint8_t const *orig
        uint8_t                 *out_p, *out_end;
 
        packet_ctx.secret = secret;
-       packet_ctx.vector = packet + 4;
        packet_ctx.rand_ctx.a = fr_rand();
        packet_ctx.rand_ctx.b = fr_rand();
 
@@ -945,6 +936,7 @@ ssize_t fr_radius_encode(uint8_t *packet, size_t packet_len, uint8_t const *orig
        switch (code) {
        case FR_CODE_ACCESS_REQUEST:
        case FR_CODE_STATUS_SERVER:
+               memcpy(packet_ctx.vector, packet + 4, sizeof(packet_ctx.vector));
                break;
 
        case FR_CODE_ACCESS_ACCEPT:
@@ -960,19 +952,15 @@ ssize_t fr_radius_encode(uint8_t *packet, size_t packet_len, uint8_t const *orig
                        fr_strerror_printf("Cannot encode response without request");
                        return -1;
                }
-               packet_ctx.vector = original + 4;
+               memcpy(packet_ctx.vector, original + 4, sizeof(packet_ctx.vector));
                memcpy(packet + 4, packet_ctx.vector, RADIUS_AUTH_VECTOR_LENGTH);
                break;
 
        case FR_CODE_ACCOUNTING_REQUEST:
-               packet_ctx.vector = nullvector;
-               memcpy(packet + 4, packet_ctx.vector, RADIUS_AUTH_VECTOR_LENGTH);
-               break;
-
        case FR_CODE_COA_REQUEST:
        case FR_CODE_DISCONNECT_REQUEST:
-               packet_ctx.vector = nullvector;
-               memcpy(packet + 4, packet_ctx.vector, RADIUS_AUTH_VECTOR_LENGTH);
+               memset(packet_ctx.vector, 0, sizeof(packet_ctx.vector));
+               memset(packet + 4, 0, RADIUS_AUTH_VECTOR_LENGTH);
                break;
 
        default:
@@ -1088,7 +1076,7 @@ ssize_t   fr_radius_decode(TALLOC_CTX *ctx, uint8_t const *packet, size_t packet_l
 
        packet_ctx.tmp_ctx = talloc_init_const("tmp");
        packet_ctx.secret = secret;
-       packet_ctx.vector = original ? original + 4 : packet + 4;
+       memcpy(packet_ctx.vector, original ? original + 4 : packet + 4, sizeof(packet_ctx.vector));
 
        attr = packet + 20;
        end = packet + packet_len;

diff --git a/src/protocols/radius/decode.c b/src/protocols/radius/decode.c
index f7244907af40e5b01922d07ae6230de9ade9ae6b..5c65f2440f21ed29d585c6f70dcc6c2918487e2c 100644 (file)
--- a/src/protocols/radius/decode.c
+++ b/src/protocols/radius/decode.c
@@ -1709,8 +1709,9 @@ static int _test_ctx_free(UNUSED fr_radius_ctx_t *ctx)
 
 static int decode_test_ctx(void **out, TALLOC_CTX *ctx)
 {
-       static uint8_t vector[] = { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
-                                   0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f };
+       static uint8_t vector[RADIUS_AUTH_VECTOR_LENGTH] = {
+               0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+               0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f };
 
        fr_radius_ctx_t *test_ctx;
 
@@ -1718,7 +1719,7 @@ static int decode_test_ctx(void **out, TALLOC_CTX *ctx)
 
        test_ctx = talloc_zero(ctx, fr_radius_ctx_t);
        test_ctx->secret = talloc_strdup(test_ctx, "testing123");
-       test_ctx->vector = vector;
+       memcpy(test_ctx->vector, vector, sizeof(test_ctx->vector));
        test_ctx->tmp_ctx = talloc_zero(ctx, uint8_t);
        talloc_set_destructor(test_ctx, _test_ctx_free);
 

diff --git a/src/protocols/radius/encode.c b/src/protocols/radius/encode.c
index 055511766daba5be7b12c11be3f80997bce93430..3891d19baeae4b1407810215921aea58d716f34e 100644 (file)
--- a/src/protocols/radius/encode.c
+++ b/src/protocols/radius/encode.c
@@ -1477,8 +1477,9 @@ static int _test_ctx_free(UNUSED fr_radius_ctx_t *ctx)
 
 static int encode_test_ctx(void **out, TALLOC_CTX *ctx)
 {
-       static uint8_t vector[] = { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
-                                   0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f };
+       static uint8_t vector[RADIUS_AUTH_VECTOR_LENGTH] = {
+               0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+               0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f };
 
        fr_radius_ctx_t *test_ctx;
 
@@ -1488,7 +1489,7 @@ static int encode_test_ctx(void **out, TALLOC_CTX *ctx)
        if (!test_ctx) return -1;
 
        test_ctx->secret = talloc_strdup(test_ctx, "testing123");
-       test_ctx->vector = vector;
+       memcpy(test_ctx->vector, vector, sizeof(test_ctx->vector));
        test_ctx->rand_ctx.a = 6809;
        test_ctx->rand_ctx.b = 2112;
        talloc_set_destructor(test_ctx, _test_ctx_free);

diff --git a/src/protocols/radius/packet.c b/src/protocols/radius/packet.c
index f3f0ce565bfd194c99c7db8bc9b7f616e909342b..7e701b4d7cb1843dac8b0210ebde01d697292d25 100644 (file)
--- a/src/protocols/radius/packet.c
+++ b/src/protocols/radius/packet.c
@@ -121,7 +121,6 @@ int fr_radius_packet_decode(RADIUS_PACKET *packet, RADIUS_PACKET *original,
        fr_cursor_t             cursor, out;
        fr_radius_ctx_t         packet_ctx = {
                                        .secret = secret,
-                                       .vector = packet->vector,
                                        .tunnel_password_zeros = tunnel_password_zeros
                                };
 
@@ -132,6 +131,7 @@ int fr_radius_packet_decode(RADIUS_PACKET *packet, RADIUS_PACKET *original,
        switch (packet->code) {
        case FR_CODE_ACCESS_REQUEST:
        case FR_CODE_STATUS_SERVER:
+               memcpy(packet_ctx.vector, packet->vector, sizeof(packet_ctx.vector));
                break;
 
        case FR_CODE_ACCESS_ACCEPT:
@@ -146,19 +146,18 @@ int fr_radius_packet_decode(RADIUS_PACKET *packet, RADIUS_PACKET *original,
                 *      radsniff doesn't always have a response
                 */
                if (original) {
-                       packet_ctx.vector = original->vector;
+                       memcpy(packet_ctx.vector, original->vector, sizeof(packet_ctx.vector));
                } else {
                        memset(packet->vector, 0, sizeof(packet->vector));
+                       memset(packet_ctx.vector, 0, sizeof(packet_ctx.vector));
                }
                break;
 
        case FR_CODE_ACCOUNTING_REQUEST:
-               memset(packet->vector, 0, sizeof(packet->vector));
-               break;
-
        case FR_CODE_COA_REQUEST:
        case FR_CODE_DISCONNECT_REQUEST:
                memset(packet->vector, 0, sizeof(packet->vector));
+               memset(packet_ctx.vector, 0, sizeof(packet_ctx.vector));
                break;
 
        default:

diff --git a/src/protocols/radius/radius.h b/src/protocols/radius/radius.h
index 23af6c94561ba20b823afa728f8cd2050fceb398..f4b9551c2e602d58caac17efa503b56d0b67e1c6 100644 (file)
--- a/src/protocols/radius/radius.h
+++ b/src/protocols/radius/radius.h
@@ -165,7 +165,7 @@ typedef struct {
 
 typedef struct {
        TALLOC_CTX              *tmp_ctx;               //!< for temporary things cleaned up during decoding
-       uint8_t const           *vector;                //!< vector for encryption / decryption of data
+       uint8_t                 vector[RADIUS_AUTH_VECTOR_LENGTH]; //!< vector for encryption / decryption of data
        char const              *secret;                //!< shared secret.  MUST be talloc'd
        fr_fast_rand_t          rand_ctx;               //!< for tunnel passwords
        int                     salt_offset;            //!< for tunnel passwords