Date: Thu, 13 Mar 2003 16:58:52 +0000 From: B.Candler@pobox.com To: FreeBSD-gnats-submit@FreeBSD.org Subject: bin/49990: tcpdump pointer error when decoding radius acct-status-type Message-ID: <E18tW2e-000HvP-00@bloodhound.uk.tiscali.com>
index | next in thread | raw e-mail
>Number: 49990
>Category: bin
>Synopsis: tcpdump pointer error when decoding radius acct-status-type
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Thu Mar 13 09:00:33 PST 2003
>Closed-Date:
>Last-Modified:
>Originator: B.Candler@pobox.com
>Release: FreeBSD 4.7-RELEASE i386
>Organization:
>Environment:
System: FreeBSD bloodhound 4.7-RELEASE FreeBSD 4.7-RELEASE #0: Sat Oct 12 16:58:24 BST 2002 root@bloodhound.uk.worldonline.com:/u/src/sys/compile/BLOODHOUND i386
>Description:
tcpdump incorrectly decodes Acct-Status-Type in RADIUS accounting packets.
It appears to be accessing the wrong part of the packet to get a value. In
the following example it is off-by-one:
16:33:08.693992 xxxx > xxxx: rad-account-req 183 [id 234] Attr[ Acct_status{#3076} NAS_ipaddr{... etc
0x0020 56c1 2cc3 a468 9343 866a ecbd b128 f06d V.,..h.C.j...(.m
0x0030 2806 0000 000c 0406 xxxx xxxx xxxx xxxx (.......P..!)...
^^^^^^^^^
The correct Acct-Status-Type here is 12
28 = attribute #40
06 = length
0000000c = type 12 <<<
However it has been decoded as 3076 which is 00000c04
It's not just off-by-one though (e.g. in the next packet I saw
Acct_status{#507} where the sequence 00000205 exists but at an offset of 21
bytes)
>How-To-Repeat:
Run:
tcpdump -i fxp0 -n -X -s1500 udp port 1813
with a suitable stream of accounting packets coming in (or use radtest)
>Fix:
>Release-Note:
>Audit-Trail:
>Unformatted:
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message
help
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?E18tW2e-000HvP-00>