From: Alan T. DeKok <aland@freeradius.org>
Date: Wed, 22 Jul 2020 13:10:56 +0000 (-0400)
Subject: use the ID for calculating CHAP.
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a060bb1e9b52b110a5e044eca29f1840cf7dc74b;p=thirdparty%2Ffreeradius-server.git

use the ID for calculating CHAP.

We do NOT want to skip that.  It's BAD!

Add test cases so that this doesn't happen again.
---

diff --git a/src/protocols/radius/encode.c b/src/protocols/radius/encode.c
index 4d757ce22c8..5f9a2fddfe8 100644
--- a/src/protocols/radius/encode.c
+++ b/src/protocols/radius/encode.c
@@ -63,8 +63,9 @@ void fr_radius_encode_chap_password(uint8_t out[static 1 + RADIUS_CHAP_CHALLENGE
 	md5_ctx = fr_md5_ctx_alloc(true);
 
 	/*
-	 *	First ingest the password
+	 *	First ingest the ID and the password.
 	 */
+	fr_md5_update(md5_ctx, (uint8_t const *)&id, 1);
 	fr_md5_update(md5_ctx, (uint8_t const *)password, password_len);
 
 	/*
diff --git a/src/tests/auth/chap_mac_auth b/src/tests/auth/chap_mac_auth
new file mode 100644
index 00000000000..8005111d919
--- /dev/null
+++ b/src/tests/auth/chap_mac_auth
@@ -0,0 +1,3 @@
+update control {
+	&Cleartext-Password := &User-Name
+}
diff --git a/src/tests/auth/chap_mac_auth.attrs b/src/tests/auth/chap_mac_auth.attrs
new file mode 100644
index 00000000000..1276d900f10
--- /dev/null
+++ b/src/tests/auth/chap_mac_auth.attrs
@@ -0,0 +1,5 @@
+User-Name = "08000f510d1e"
+CHAP-Password = 0x9fdc274c2e3ca36a66a0581a10d44a7dd2
+CHAP-Challenge = 0xe7714b9a5d8463e7947041bdbf399c17
+
+Packet-Type == Access-Accept
diff --git a/src/tests/auth/chap_mac_auth_2 b/src/tests/auth/chap_mac_auth_2
new file mode 100644
index 00000000000..8005111d919
--- /dev/null
+++ b/src/tests/auth/chap_mac_auth_2
@@ -0,0 +1,3 @@
+update control {
+	&Cleartext-Password := &User-Name
+}
diff --git a/src/tests/auth/chap_mac_auth_2.attrs b/src/tests/auth/chap_mac_auth_2.attrs
new file mode 100644
index 00000000000..ac3f7b106ab
--- /dev/null
+++ b/src/tests/auth/chap_mac_auth_2.attrs
@@ -0,0 +1,5 @@
+User-Name =  "08000f510d1e"
+CHAP-Password = 0xa1526f5b6d5cc40d3d87df334515befc07
+CHAP-Challenge = 0xbf61a943b98f4d1b9e9885677705a6b8
+
+Packet-Type == Access-Accept