Hi!
Today I noticed some strange problems on a number of RADIUS users in a
test setup: I have a number of users in MySQL that contain a large number
of attributes that should not occur in the Access-Request (i.e. attributes
with the !* operator). When I tried to authenticate these users, I noticed
that in some cases users were getting authenticated while they should have
been rejected.
Some investigation later, it turned out that after the first row in the
radcheck table that contains a !* operator, all further attributes get
ignored...
I crawled through the code a bit more, and the problem appears to occur on
line 287 of main/valuepair.c. This is in the function paircmp, which
iterates over the list of check items to verify whether the incoming
request matches:
/*
* Not found, it's not a match.
*/
if (auth_item == NULL) {
/*
* Didn't find it. If we were *trying*
* to not find it, then we succeeded.
*/
if (check_item->operator == T_OP_CMP_FALSE)
return 0;
else
return -1;
}
The 'return 0;' above causes paircmp to exit successfully (accepting the
user) if it could not find the attribute and it should not find the
attribute (because of the !* operator) instead of continuing to see if the
rest of the attributes is correct too.
I've changed the 'return 0;' to a 'continue;', so it does not break the
for loop anymore. This appears to work, is this fix correct or would this
introduce problems elsewhere?
Gtnx
Marcel
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
