diff options
| author | brian <brian@FreeBSD.org> | 2002-06-23 23:38:06 +0000 |
|---|---|---|
| committer | brian <brian@FreeBSD.org> | 2002-06-23 23:38:06 +0000 |
| commit | 20a617c09d0233b4529f659b62dce87d38204593 (patch) | |
| tree | aef10246580a40c0485e151018a0f5ba9eca8227 /usr.sbin | |
| parent | 37d2aea25ace33f2775465f9d6c331b002d6156f (diff) | |
| download | FreeBSD-src-20a617c09d0233b4529f659b62dce87d38204593.zip FreeBSD-src-20a617c09d0233b4529f659b62dce87d38204593.tar.gz | |
Add a hack to handle RADIUS responses from peers that forget that
there's an ``Ident'' field in the MS-CHAP2-Response and
MS-CHAP-Error attributes.
The RADIATOR server seems to be guilty of this.
Diffstat (limited to 'usr.sbin')
| -rw-r--r-- | usr.sbin/ppp/radius.c | 24 |
1 files changed, 20 insertions, 4 deletions
diff --git a/usr.sbin/ppp/radius.c b/usr.sbin/ppp/radius.c index be6953a..50e1917 100644 --- a/usr.sbin/ppp/radius.c +++ b/usr.sbin/ppp/radius.c @@ -419,8 +419,16 @@ radius_Process(struct radius *r, int got) if (len == 0) r->errstr = NULL; else { - if ((r->errstr = rad_cvt_string((const char *)data + 1, - len - 1)) == NULL) { + if (len < 3 || ((const char *)data)[1] != '=') { + /* + * Only point at the String field if we don't think the + * peer has misformatted the response. + */ + ((const char *)data)++; + len--; + } + if ((r->errstr = rad_cvt_string((const char *)data, + len)) == NULL) { log_Printf(LogERROR, "rad_cvt_string: %s\n", rad_strerror(r->cx.rad)); auth_Failure(r->cx.auth); @@ -436,8 +444,16 @@ radius_Process(struct radius *r, int got) if (len == 0) r->msrepstr = NULL; else { - if ((r->msrepstr = rad_cvt_string((const char *)data + 1, - len - 1)) == NULL) { + if (len < 3 || ((const char *)data)[1] != '=') { + /* + * Only point at the String field if we don't think the + * peer has misformatted the response. + */ + ((const char *)data)++; + len--; + } + if ((r->msrepstr = rad_cvt_string((const char *)data, + len)) == NULL) { log_Printf(LogERROR, "rad_cvt_string: %s\n", rad_strerror(r->cx.rad)); auth_Failure(r->cx.auth); |
