From: Alan T. DeKok <aland@freeradius.org>
Date: Mon, 17 Aug 2020 00:23:41 +0000 (-0400)
Subject: check UNENCRYPTED flag, not multiple connections flag
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9955c01b2c19d35fecee607273c87b79b4c9020c;p=thirdparty%2Ffreeradius-server.git

check UNENCRYPTED flag, not multiple connections flag
---

diff --git a/src/protocols/tacacs/decode.c b/src/protocols/tacacs/decode.c
index 905317c0440..0236eff0479 100644
--- a/src/protocols/tacacs/decode.c
+++ b/src/protocols/tacacs/decode.c
@@ -232,8 +232,10 @@ ssize_t fr_tacacs_decode(TALLOC_CTX *ctx, uint8_t const *buffer, size_t buffer_l
 
 	/*
 	 *	3.6. Encryption
+	 *
+	 *	Packets are encrypted if the unencrypted flag is clear.
 	 */
-	if (pkt->hdr.flags == FR_TAC_PLUS_ENCRYPTED_MULTIPLE_CONNECTIONS_FLAG) {
+	if ((pkt->hdr.flags & FR_TAC_PLUS_UNENCRYPTED_FLAG) == 0) {
 		size_t length;
 
 		if (!secret || secret_len < 1) {
diff --git a/src/protocols/tacacs/encode.c b/src/protocols/tacacs/encode.c
index c99eff5c474..4640b7d6e45 100644
--- a/src/protocols/tacacs/encode.c
+++ b/src/protocols/tacacs/encode.c
@@ -514,8 +514,10 @@ ssize_t fr_tacacs_encode(uint8_t *buffer, size_t buffer_len, char const *secret,
 
 	/*
 	 *	3.6. Encryption
+	 *
+	 *	Packets are encrypted if the unencrypted flag is clear.
 	 */
-	if (packet->hdr.flags == FR_TAC_PLUS_ENCRYPTED_MULTIPLE_CONNECTIONS_FLAG) {
+	if ((packet->hdr.flags & FR_TAC_PLUS_UNENCRYPTED_FLAG) == 0) {
 		uint8_t *body = (buffer + sizeof(fr_tacacs_packet_hdr_t));
 
 		fr_assert(secret != NULL);
diff --git a/src/protocols/tacacs/tacacs.h b/src/protocols/tacacs/tacacs.h
index d27a4c5fe83..13ffd1dd019 100644
--- a/src/protocols/tacacs/tacacs.h
+++ b/src/protocols/tacacs/tacacs.h
@@ -59,9 +59,9 @@ typedef enum {
 } fr_tacacs_type_t;
 
 typedef enum {
-	FR_TAC_PLUS_ENCRYPTED_MULTIPLE_CONNECTIONS_FLAG	= 0x00,	/* gdb candy */
-	FR_TAC_PLUS_UNENCRYPTED_FLAG			= 0x01,
-	FR_TAC_PLUS_SINGLE_CONNECT_FLAG			= 0x04
+	FR_TAC_PLUS_FLAGS_NONE			= 0x00,
+	FR_TAC_PLUS_UNENCRYPTED_FLAG		= 0x01,
+	FR_TAC_PLUS_SINGLE_CONNECT_FLAG		= 0x04
 } fr_tacacs_flags_t;
 
 typedef struct CC_HINT(__packed__) {