From: Alan T. DeKok Date: Fri, 23 Oct 2020 12:40:54 +0000 (-0400) Subject: make packet_ctx.vector[16] instead of a pointer. Fixes #3703 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=fbe54ef67849f83bb4875e803fa6fe48444aaa90;p=thirdparty%2Ffreeradius-server.git make packet_ctx.vector[16] instead of a pointer. Fixes #3703 --- diff --git a/src/protocols/radius/base.c b/src/protocols/radius/base.c index 51a50c8cb09..8bc91d3d4a9 100644 --- a/src/protocols/radius/base.c +++ b/src/protocols/radius/base.c @@ -202,14 +202,6 @@ bool const fr_request_packets[FR_RADIUS_MAX_PACKET_CODE + 1] = { [FR_CODE_DISCONNECT_REQUEST] = true, }; -/* - * For request packets which have the Request Authenticator being - * all zeros. We need to decode attributes using a Request - * Authenticator of all zeroes, but the actual Request - * Authenticator contains the signature of the packet, so we - * can't use that. - */ -static uint8_t nullvector[RADIUS_AUTH_VECTOR_LENGTH] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }; /** Return the on-the-wire length of an attribute value * @@ -930,7 +922,6 @@ ssize_t fr_radius_encode(uint8_t *packet, size_t packet_len, uint8_t const *orig uint8_t *out_p, *out_end; packet_ctx.secret = secret; - packet_ctx.vector = packet + 4; packet_ctx.rand_ctx.a = fr_rand(); packet_ctx.rand_ctx.b = fr_rand(); @@ -945,6 +936,7 @@ ssize_t fr_radius_encode(uint8_t *packet, size_t packet_len, uint8_t const *orig switch (code) { case FR_CODE_ACCESS_REQUEST: case FR_CODE_STATUS_SERVER: + memcpy(packet_ctx.vector, packet + 4, sizeof(packet_ctx.vector)); break; case FR_CODE_ACCESS_ACCEPT: @@ -960,19 +952,15 @@ ssize_t fr_radius_encode(uint8_t *packet, size_t packet_len, uint8_t const *orig fr_strerror_printf("Cannot encode response without request"); return -1; } - packet_ctx.vector = original + 4; + memcpy(packet_ctx.vector, original + 4, sizeof(packet_ctx.vector)); memcpy(packet + 4, packet_ctx.vector, RADIUS_AUTH_VECTOR_LENGTH); break; case FR_CODE_ACCOUNTING_REQUEST: - packet_ctx.vector = nullvector; - memcpy(packet + 4, packet_ctx.vector, RADIUS_AUTH_VECTOR_LENGTH); - break; - case FR_CODE_COA_REQUEST: case FR_CODE_DISCONNECT_REQUEST: - packet_ctx.vector = nullvector; - memcpy(packet + 4, packet_ctx.vector, RADIUS_AUTH_VECTOR_LENGTH); + memset(packet_ctx.vector, 0, sizeof(packet_ctx.vector)); + memset(packet + 4, 0, RADIUS_AUTH_VECTOR_LENGTH); break; default: @@ -1088,7 +1076,7 @@ ssize_t fr_radius_decode(TALLOC_CTX *ctx, uint8_t const *packet, size_t packet_l packet_ctx.tmp_ctx = talloc_init_const("tmp"); packet_ctx.secret = secret; - packet_ctx.vector = original ? original + 4 : packet + 4; + memcpy(packet_ctx.vector, original ? original + 4 : packet + 4, sizeof(packet_ctx.vector)); attr = packet + 20; end = packet + packet_len; diff --git a/src/protocols/radius/decode.c b/src/protocols/radius/decode.c index f7244907af4..5c65f2440f2 100644 --- a/src/protocols/radius/decode.c +++ b/src/protocols/radius/decode.c @@ -1709,8 +1709,9 @@ static int _test_ctx_free(UNUSED fr_radius_ctx_t *ctx) static int decode_test_ctx(void **out, TALLOC_CTX *ctx) { - static uint8_t vector[] = { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, - 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f }; + static uint8_t vector[RADIUS_AUTH_VECTOR_LENGTH] = { + 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, + 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f }; fr_radius_ctx_t *test_ctx; @@ -1718,7 +1719,7 @@ static int decode_test_ctx(void **out, TALLOC_CTX *ctx) test_ctx = talloc_zero(ctx, fr_radius_ctx_t); test_ctx->secret = talloc_strdup(test_ctx, "testing123"); - test_ctx->vector = vector; + memcpy(test_ctx->vector, vector, sizeof(test_ctx->vector)); test_ctx->tmp_ctx = talloc_zero(ctx, uint8_t); talloc_set_destructor(test_ctx, _test_ctx_free); diff --git a/src/protocols/radius/encode.c b/src/protocols/radius/encode.c index 055511766da..3891d19baea 100644 --- a/src/protocols/radius/encode.c +++ b/src/protocols/radius/encode.c @@ -1477,8 +1477,9 @@ static int _test_ctx_free(UNUSED fr_radius_ctx_t *ctx) static int encode_test_ctx(void **out, TALLOC_CTX *ctx) { - static uint8_t vector[] = { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, - 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f }; + static uint8_t vector[RADIUS_AUTH_VECTOR_LENGTH] = { + 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, + 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f }; fr_radius_ctx_t *test_ctx; @@ -1488,7 +1489,7 @@ static int encode_test_ctx(void **out, TALLOC_CTX *ctx) if (!test_ctx) return -1; test_ctx->secret = talloc_strdup(test_ctx, "testing123"); - test_ctx->vector = vector; + memcpy(test_ctx->vector, vector, sizeof(test_ctx->vector)); test_ctx->rand_ctx.a = 6809; test_ctx->rand_ctx.b = 2112; talloc_set_destructor(test_ctx, _test_ctx_free); diff --git a/src/protocols/radius/packet.c b/src/protocols/radius/packet.c index f3f0ce565bf..7e701b4d7cb 100644 --- a/src/protocols/radius/packet.c +++ b/src/protocols/radius/packet.c @@ -121,7 +121,6 @@ int fr_radius_packet_decode(RADIUS_PACKET *packet, RADIUS_PACKET *original, fr_cursor_t cursor, out; fr_radius_ctx_t packet_ctx = { .secret = secret, - .vector = packet->vector, .tunnel_password_zeros = tunnel_password_zeros }; @@ -132,6 +131,7 @@ int fr_radius_packet_decode(RADIUS_PACKET *packet, RADIUS_PACKET *original, switch (packet->code) { case FR_CODE_ACCESS_REQUEST: case FR_CODE_STATUS_SERVER: + memcpy(packet_ctx.vector, packet->vector, sizeof(packet_ctx.vector)); break; case FR_CODE_ACCESS_ACCEPT: @@ -146,19 +146,18 @@ int fr_radius_packet_decode(RADIUS_PACKET *packet, RADIUS_PACKET *original, * radsniff doesn't always have a response */ if (original) { - packet_ctx.vector = original->vector; + memcpy(packet_ctx.vector, original->vector, sizeof(packet_ctx.vector)); } else { memset(packet->vector, 0, sizeof(packet->vector)); + memset(packet_ctx.vector, 0, sizeof(packet_ctx.vector)); } break; case FR_CODE_ACCOUNTING_REQUEST: - memset(packet->vector, 0, sizeof(packet->vector)); - break; - case FR_CODE_COA_REQUEST: case FR_CODE_DISCONNECT_REQUEST: memset(packet->vector, 0, sizeof(packet->vector)); + memset(packet_ctx.vector, 0, sizeof(packet_ctx.vector)); break; default: diff --git a/src/protocols/radius/radius.h b/src/protocols/radius/radius.h index 23af6c94561..f4b9551c2e6 100644 --- a/src/protocols/radius/radius.h +++ b/src/protocols/radius/radius.h @@ -165,7 +165,7 @@ typedef struct { typedef struct { TALLOC_CTX *tmp_ctx; //!< for temporary things cleaned up during decoding - uint8_t const *vector; //!< vector for encryption / decryption of data + uint8_t vector[RADIUS_AUTH_VECTOR_LENGTH]; //!< vector for encryption / decryption of data char const *secret; //!< shared secret. MUST be talloc'd fr_fast_rand_t rand_ctx; //!< for tunnel passwords int salt_offset; //!< for tunnel passwords