From: Alan T. DeKok <aland@freeradius.org>
Date: Fri, 21 Jul 2023 17:37:30 +0000 (-0400)
Subject: define escaping rules for secrets
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=24c14d6e99aa1e12c855c330e371abc42b22ec0b;p=thirdparty%2Ffreeradius-server.git

define escaping rules for secrets

Through the simple expedient of mashing all characters to '.'

The length of the secret still leaks, but that's not too bad.

As escaping is only done for data types "string" and "octets",
other secret values will not be escaped.  Perhaps we can fix that
later if we care.
---

diff --git a/src/lib/util/value.c b/src/lib/util/value.c
index ba53c00c214..b64afa1bdf5 100644
--- a/src/lib/util/value.c
+++ b/src/lib/util/value.c
@@ -369,6 +369,22 @@ fr_sbuff_escape_rules_t fr_value_escape_double = {
 	.do_oct = true
 };
 
+#ifdef __clang__
+#pragma clang diagnostic ignored "-Wgnu-designator"
+#endif
+
+/** Escape secret fields by simply mashing all data to '.'
+ *
+ *  The length of the secret still leaks, but that is likely fine.  Fixing that is more work.
+ *
+ */
+fr_sbuff_escape_rules_t fr_value_escape_secret = {
+	.name = "secret",
+	.subs = {
+		[ 0 ... 255 ] = '.',
+	},
+};
+
 fr_sbuff_escape_rules_t fr_value_escape_single = {
 	.name = "single",
 	.chr = '\\',
diff --git a/src/lib/util/value.h b/src/lib/util/value.h
index 39cf43df315..eee1cbbf549 100644
--- a/src/lib/util/value.h
+++ b/src/lib/util/value.h
@@ -81,6 +81,7 @@ extern fr_sbuff_escape_rules_t fr_value_escape_double;
 extern fr_sbuff_escape_rules_t fr_value_escape_single;
 extern fr_sbuff_escape_rules_t fr_value_escape_solidus;
 extern fr_sbuff_escape_rules_t fr_value_escape_backtick;
+extern fr_sbuff_escape_rules_t fr_value_escape_secret;
 extern fr_sbuff_escape_rules_t *fr_value_escape_by_quote[T_TOKEN_LAST];
 extern fr_sbuff_escape_rules_t *fr_value_escape_by_char[UINT8_MAX + 1];