summaryrefslogtreecommitdiff
path: root/accel-pppd/radius
diff options
context:
space:
mode:
Diffstat (limited to 'accel-pppd/radius')
-rw-r--r--accel-pppd/radius/backup.c21
-rw-r--r--accel-pppd/radius/packet.c32
2 files changed, 30 insertions, 23 deletions
diff --git a/accel-pppd/radius/backup.c b/accel-pppd/radius/backup.c
index 6d4db636..bfca0e49 100644
--- a/accel-pppd/radius/backup.c
+++ b/accel-pppd/radius/backup.c
@@ -6,6 +6,7 @@
#include "log.h"
#include "memdebug.h"
+#include "utils.h"
#include "backup.h"
#include "ap_session_backup.h"
@@ -22,6 +23,7 @@
#define RAD_TAG_ACCT_SERVER_ADDR 9
#define RAD_TAG_ACCT_SERVER_PORT 10
#define RAD_TAG_IDLE_TIMEOUT 11
+
#define RAD_TAG_ACCT_USERNAME 12
@@ -94,10 +96,10 @@ static void restore_ipv4_addr(struct ap_session *ses)
list_for_each_entry(tag, &m->tag_list, entry) {
switch (tag->id) {
case SES_TAG_IPV4_ADDR:
- ses->ipv4->addr = *(in_addr_t *)tag->data;
+ ses->ipv4->addr = u_read_native32(tag->data);
break;
case SES_TAG_IPV4_PEER_ADDR:
- ses->ipv4->peer_addr = *(in_addr_t *)tag->data;
+ ses->ipv4->peer_addr = u_read_native32(tag->data);
break;
}
}
@@ -121,16 +123,16 @@ void radius_restore_session(struct ap_session *ses, struct radius_pd_t *rpd)
list_for_each_entry(tag, &m->tag_list, entry) {
switch (tag->id) {
case RAD_TAG_INTERIM_INTERVAL:
- rpd->acct_interim_interval = *(uint32_t *)tag->data;
+ rpd->acct_interim_interval = u_read_native32(tag->data);
break;
case RAD_TAG_INTERIM_JITTER:
- rpd->acct_interim_jitter = *(uint32_t *)tag->data;
+ rpd->acct_interim_jitter = u_read_native32(tag->data);
break;
case RAD_TAG_SESSION_TIMEOUT:
- rpd->session_timeout.expire_tv.tv_sec = *(uint64_t *)tag->data - ses->start_time;
+ rpd->session_timeout.expire_tv.tv_sec = u_read_native64(tag->data) - ses->start_time;
break;
case RAD_TAG_IDLE_TIMEOUT:
- rpd->idle_timeout.period = (*(uint32_t *)tag->data) * 1000;
+ rpd->idle_timeout.period = u_read_native32(tag->data) * 1000;
break;
case RAD_TAG_IPV4_ADDR:
ses->ipv4 = &rpd->ipv4_addr;
@@ -150,16 +152,16 @@ void radius_restore_session(struct ap_session *ses, struct radius_pd_t *rpd)
rpd->attr_state_len = tag->size;
break;
case RAD_TAG_TERMINATION_ACTION:
- rpd->termination_action = *(uint32_t *)tag->data;
+ rpd->termination_action = u_read_native32(tag->data);
break;
case RAD_TAG_ACCT_USERNAME:
rpd->acct_username = _strndup(tag->data, tag->size);
break;
case RAD_TAG_ACCT_SERVER_ADDR:
- acct_addr = *(in_addr_t *)tag->data;
+ acct_addr = u_read_native32(tag->data);
break;
case RAD_TAG_ACCT_SERVER_PORT:
- acct_port = *(uint16_t *)tag->data;
+ acct_port = u_read_native16(tag->data);
break;
}
}
@@ -182,4 +184,3 @@ static void init(void)
}
DEFINE_INIT(100, init);
-
diff --git a/accel-pppd/radius/packet.c b/accel-pppd/radius/packet.c
index c7e91349..4a0ab244 100644
--- a/accel-pppd/radius/packet.c
+++ b/accel-pppd/radius/packet.c
@@ -24,6 +24,7 @@
#include "mempool.h"
#include "radius_p.h"
#include "attr_defs.h"
+#include "utils.h"
#include "memdebug.h"
@@ -111,20 +112,20 @@ int rad_packet_build(struct rad_packet_t *pack, uint8_t *RA)
*ptr = pack->code; ptr++;
*ptr = pack->id; ptr++;
- *(uint16_t*)ptr = htons(pack->len); ptr+= 2;
+ u_write_be16(ptr, pack->len); ptr += 2;
memcpy(ptr, RA, 16); ptr+=16;
list_for_each_entry(attr, &pack->attrs, entry) {
if (attr->vendor) {
*ptr = 26; ptr++;
*ptr = attr->len + 2 + 6; ptr++;
- *(uint32_t *)ptr = htonl(attr->vendor->id); ptr+=4;
+ u_write_be32(ptr, attr->vendor->id); ptr += 4;
}
*ptr = attr->attr->id; ptr++;
*ptr = attr->len + 2; ptr++;
switch(attr->attr->type) {
case ATTR_TYPE_INTEGER:
- *(uint32_t*)ptr = htonl(attr->val.integer);
+ u_write_be32(ptr, attr->val.integer);
break;
case ATTR_TYPE_OCTETS:
case ATTR_TYPE_STRING:
@@ -136,7 +137,7 @@ int rad_packet_build(struct rad_packet_t *pack, uint8_t *RA)
memcpy(ptr, &attr->val, attr->len);
break;
case ATTR_TYPE_DATE:
- *(uint32_t*)ptr = htonl(attr->val.date);
+ u_write_be32(ptr, attr->val.date);
break;
case ATTR_TYPE_IPV6PREFIX:
ptr[0] = 0;
@@ -204,17 +205,22 @@ int rad_packet_recv(int fd, struct rad_packet_t **p, struct sockaddr_in *addr)
pack->code = *ptr; ptr++;
pack->id = *ptr; ptr++;
- pack->len = ntohs(*(uint16_t*)ptr); ptr += 2;
+ pack->len = u_read_be16(ptr); ptr += 2;
- if (pack->len > n) {
+ if (pack->len < 20 || pack->len > n) {
log_ppp_warn("radius:packet: short packet received %i, expected %i\n", pack->len, n);
goto out_err;
}
ptr += 16;
- n -= 20;
+ n = pack->len - 20;
while (n>0) {
+ if (n < 2) {
+ log_ppp_warn("radius:packet: truncated attribute header received\n");
+ goto out_err;
+ }
+
id = *ptr; ptr++;
len = *ptr - 2; ptr++;
if (len < 0) {
@@ -230,7 +236,7 @@ int rad_packet_recv(int fd, struct rad_packet_t **p, struct sockaddr_in *addr)
log_ppp_warn("radius:packet: vendor attribute too short (%i)\n", len);
goto out_err;
}
- vendor_id = ntohl(*(uint32_t *)ptr);
+ vendor_id = u_read_be32(ptr);
vendor = rad_dict_find_vendor_id(vendor_id);
if (vendor) {
if (len < 4 + vendor->tag + vendor->len) {
@@ -240,14 +246,14 @@ int rad_packet_recv(int fd, struct rad_packet_t **p, struct sockaddr_in *addr)
ptr += 4;
if (vendor->tag == 2)
- id = (uint16_t)ntohs(*(uint16_t *)ptr);
+ id = u_read_be16(ptr);
else
id = *ptr;
ptr += vendor->tag;
if (vendor->len == 2)
- len = (uint16_t)ntohs(*(uint16_t *)ptr);
+ len = u_read_be16(ptr);
else
len = *ptr;
@@ -300,15 +306,15 @@ int rad_packet_recv(int fd, struct rad_packet_t **p, struct sockaddr_in *addr)
break;
}
if (len == 4)
- attr->val.integer = ntohl(*(uint32_t*)ptr);
+ attr->val.integer = u_read_be32(ptr);
else if (len == 2)
- attr->val.integer = ntohs(*(uint16_t*)ptr);
+ attr->val.integer = u_read_be16(ptr);
else if (len == 1)
attr->val.integer = *ptr;
break;
case ATTR_TYPE_DATE:
if (len == 4)
- attr->val.integer = ntohl(*(uint32_t*)ptr);
+ attr->val.integer = u_read_be32(ptr);
else
log_ppp_warn("radius:packet: attribute %s has invalid length %i (must be 4)\n", da->name, len);
break;
generated by cgit v1.2.3 (git 2.39.1) at 2026-09-16 23:18:49 +0000