From: Alan T. DeKok <aland@freeradius.org>
Date: Thu, 10 Aug 2017 09:01:56 +0000 (+0200)
Subject: Status-Server require Message-Authenticator, too
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=09b492bd871c5da6febc75909ff8427f2e6c1dbf;p=thirdparty%2Ffreeradius-server.git

Status-Server require Message-Authenticator, too

and not Proxy-State
---

diff --git a/src/modules/rlm_radius/rlm_radius_udp.c b/src/modules/rlm_radius/rlm_radius_udp.c
index 751f7a0fdfe..7c561f9f823 100644
--- a/src/modules/rlm_radius/rlm_radius_udp.c
+++ b/src/modules/rlm_radius/rlm_radius_udp.c
@@ -748,6 +748,7 @@ static int conn_write(rlm_radius_udp_connection_t *c, rlm_radius_udp_request_t *
 	ssize_t packet_len;
 	uint8_t *msg = NULL;
 	bool require_ma = false;
+	int proxy_state = 6;
 	REQUEST *request;
 	char const *module_name;
 
@@ -774,6 +775,15 @@ static int conn_write(rlm_radius_udp_connection_t *c, rlm_radius_udp_request_t *
 		require_ma = true;
 	}
 
+	/*
+	 *	Status-Server requires Message-Authenticator, but not
+	 *	Proxy-State.
+	 */
+	if (c->buffer[0] == FR_CODE_STATUS_SERVER) {
+		require_ma = true;
+		proxy_state = 0;
+	}
+
 	/*
 	 *	Leave room for the Message-Authenticator.
 	 */
@@ -786,7 +796,7 @@ static int conn_write(rlm_radius_udp_connection_t *c, rlm_radius_udp_request_t *
 	/*
 	 *	Encode it, leaving room for Proxy-State, too.
 	 */
-	packet_len = fr_radius_encode(c->buffer, buflen - 6, NULL,
+	packet_len = fr_radius_encode(c->buffer, buflen - proxy_state, NULL,
 				      c->inst->secret, u->rr->id, u->code, u->rr->id,
 				      request->packet->vps);
 	if (packet_len <= 0) return -1;
@@ -816,10 +826,12 @@ static int conn_write(rlm_radius_udp_connection_t *c, rlm_radius_udp_request_t *
 	 *	Note that the length check will always pass, due to
 	 *	the buflen manipulation done above.
 	 */
-	if ((size_t) (packet_len + 6) <= c->buflen) {
+	if (proxy_state) {
 		uint8_t *attr = c->buffer + packet_len;
 		int hdr_len;
 
+		rad_assert((size_t) (packet_len + 6) <= c->buflen);
+
 		attr[0] = FR_PROXY_STATE;
 		attr[1] = 6;
 		memcpy(attr + 2, &c->inst->parent->proxy_state, 4);