Look for the correct Yubikey-Counter attribute in the control list

broken in ccced6155a

diff --git a/doc/ChangeLog b/doc/ChangeLog
index 207775e88d9404dd32fd34ea772f55828aa229c3..1fdd3c7b47d161410baccae5207687a58f6d6f54 100644 (file)
--- a/doc/ChangeLog
+++ b/doc/ChangeLog
@@ -48,6 +48,8 @@ FreeRADIUS 3.0.17 Thu 11 Jan 2018 12:00:00 EST urgency=low
          Intermediate certs which are not self-signed will now be
          checked.
        * sqlippool now returns "fail" if it fails IP allocation.
+       * Fix rlm_yubikey to look for correct attribute in replay
+         attack check.
 
 FreeRADIUS 3.0.16 Thu 11 Jan 2018 12:00:00 EST urgency=low
        Feature improvements

diff --git a/src/modules/rlm_yubikey/decrypt.c b/src/modules/rlm_yubikey/decrypt.c
index 49dca4a0f61539116d175f89289d81e8c221b30f..dad90f773f2eb3503b6ff8ab91695e6538b9b367 100644 (file)
--- a/src/modules/rlm_yubikey/decrypt.c
+++ b/src/modules/rlm_yubikey/decrypt.c
@@ -23,6 +23,7 @@ rlm_rcode_t rlm_yubikey_decrypt(rlm_yubikey_t *inst, REQUEST *request, char cons
        yubikey_token_st token;
 
        DICT_ATTR const *da;
+       DICT_ATTR const *yubikey_counter_da;
 
        char private_id[(YUBIKEY_UID_SIZE * 2) + 1];
        VALUE_PAIR *key, *vp;
@@ -114,13 +115,14 @@ rlm_rcode_t rlm_yubikey_decrypt(rlm_yubikey_t *inst, REQUEST *request, char cons
 
                return RLM_MODULE_FAIL;
        }
+       yubikey_counter_da = vp->da;
        vp->vp_integer = counter;
        vp->vp_length = 4;
 
        /*
         *      Now we check for replay attacks
         */
-       vp = fr_pair_find_by_da(request->config, da, TAG_ANY);
+       vp = fr_pair_find_by_da(request->config, yubikey_counter_da, TAG_ANY);
        if (!vp) {
                RWDEBUG("Yubikey-Counter not found in control list, skipping replay attack checks");
                return RLM_MODULE_OK;