diff options
Diffstat (limited to 'accel-pppd/radius')
| -rw-r--r-- | accel-pppd/radius/dm_coa.c | 8 | ||||
| -rw-r--r-- | accel-pppd/radius/radius.c | 7 |
2 files changed, 11 insertions, 4 deletions
diff --git a/accel-pppd/radius/dm_coa.c b/accel-pppd/radius/dm_coa.c index df8cdf3e..728fd938 100644 --- a/accel-pppd/radius/dm_coa.c +++ b/accel-pppd/radius/dm_coa.c @@ -146,16 +146,16 @@ static void disconnect_request(struct radius_pd_t *rpd) } #ifdef HAVE_VRF -int rad_update_vrf(struct radius_pd_t *rpd, const char *vrf_name) +static int rad_update_vrf(struct radius_pd_t *rpd, const char *vrf_name, int len) { - if (*vrf_name == '0') { + if (len == 1 && *vrf_name == '0') { // Delete interface from VRF if (!ap_session_vrf(rpd->ses, NULL, 0)) return 1; } else { // Add interface to VRF - if(!ap_session_vrf(rpd->ses, vrf_name, -1)) + if(!ap_session_vrf(rpd->ses, vrf_name, len)) return 1; } @@ -215,7 +215,7 @@ static void coa_request(struct radius_pd_t *rpd) #ifdef HAVE_VRF attr = rad_packet_find_attr(rpd->dm_coa_req, "Accel-PPP", "Accel-VRF-Name"); if (attr){ - if(!rad_update_vrf(rpd, attr->val.string)){ + if(!rad_update_vrf(rpd, attr->val.string, attr->len)){ goto out; } } diff --git a/accel-pppd/radius/radius.c b/accel-pppd/radius/radius.c index fa77a916..89f1e398 100644 --- a/accel-pppd/radius/radius.c +++ b/accel-pppd/radius/radius.c @@ -545,9 +545,16 @@ int rad_proc_attrs(struct rad_req_t *req) } else if (attr->vendor->id == VENDOR_Accel_PPP) { switch (attr->attr->id) { case Accel_VRF_Name: + if (attr->len < 0 || attr->len >= IFNAMSIZ || + memchr(attr->val.string, 0, attr->len)) { + log_ppp_warn("radius: invalid Accel-VRF-Name, rejecting Access-Accept\n"); + return -1; + } if (rpd->ses->vrf_name) _free(rpd->ses->vrf_name); rpd->ses->vrf_name = _malloc(attr->len + 1); + if (!rpd->ses->vrf_name) + return -1; memcpy(rpd->ses->vrf_name, attr->val.string, attr->len); rpd->ses->vrf_name[attr->len] = 0; break; |