search

FreeRADIUS / freeradius-client

A BSD licenced RADIUS client library
http://freeradius.org/freeradius-client/
Other
143 stars 100 forks source link

Collisions in attribute type/vendor conversion #72

Closed mcpat closed 6 years ago

mcpat commented 8 years ago

According to RFC 2865 the attribute type is one octet and the vendor ID is three octets. To combine that together into one 32-bit integer the following may be done: combined = (vendor_id << 8) | attribute_type

In the code instead, the vendor_id is shifted 16 bits thus dropping one byte which may lead to collisions.

So I propose to change the calculation above as well as to switch to an integer type with at least 32-bits. Also the default dictionary should be stripped of all server-internal attribute specifications, because clients won't see them anyway.

alandekok commented 8 years ago

We would prefer a patch to a report that it's wrong.

As things go, it's a minor problem. The private enterprise numbers aren't yet at 16 bits.