From: Nick Porter <nick@portercomputing.co.uk>
Date: Mon, 16 Jun 2025 09:53:04 +0000 (+0100)
Subject: CHAP-Challenge is not fixed to 16 octets
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=eb042becffe7db29cd05c0acfeccbc9e5cd688c7;p=thirdparty%2Ffreeradius-server.git

CHAP-Challenge is not fixed to 16 octets

RFC2865 says min length is 7
---

diff --git a/src/bin/radclient-ng.c b/src/bin/radclient-ng.c
index 8251f4eef6c..60fc4d04dcc 100644
--- a/src/bin/radclient-ng.c
+++ b/src/bin/radclient-ng.c
@@ -1011,14 +1011,15 @@ static int send_one_packet(fr_bio_packet_t *client, rc_request_t *request)
 			 *	Request Authenticator otherwise.
 			 */
 			challenge = fr_pair_find_by_da(&request->request_pairs, NULL, attr_chap_challenge);
-			if (challenge && (challenge->vp_length == RADIUS_AUTH_VECTOR_LENGTH)) {
+			if (challenge && (challenge->vp_length >= 7)) {
 				vector = challenge->vp_octets;
 			} else {
 				vector = request->packet->vector;
 			}
 
 			fr_chap_encode(buffer,
-				       fr_rand() & 0xff, vector, RADIUS_AUTH_VECTOR_LENGTH,
+				       fr_rand() & 0xff, vector,
+				       challenge ? challenge->vp_length : RADIUS_AUTH_VECTOR_LENGTH,
 				       request->password->vp_strvalue,
 				       request->password->vp_length);
 			fr_pair_value_memdup(vp, buffer, sizeof(buffer), false);
diff --git a/src/bin/radclient.c b/src/bin/radclient.c
index d0f2110dd48..727d9fef7b7 100644
--- a/src/bin/radclient.c
+++ b/src/bin/radclient.c
@@ -1017,14 +1017,15 @@ static int send_one_packet(rc_request_t *request)
 				 *	Request Authenticator otherwise.
 				 */
 				challenge = fr_pair_find_by_da(&request->request_pairs, NULL, attr_chap_challenge);
-				if (challenge && (challenge->vp_length == RADIUS_AUTH_VECTOR_LENGTH)) {
+				if (challenge && (challenge->vp_length >= 7)) {
 					vector = challenge->vp_octets;
 				} else {
 					vector = request->packet->vector;
 				}
 
 				fr_chap_encode(buffer,
-					       fr_rand() & 0xff, vector, RADIUS_AUTH_VECTOR_LENGTH,
+					       fr_rand() & 0xff, vector,
+					       challenge ? challenge->vp_length : RADIUS_AUTH_VECTOR_LENGTH,
 					       request->password->vp_strvalue,
 					       request->password->vp_length);
 				fr_pair_value_memdup(vp, buffer, sizeof(buffer), false);