Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Server only capable to have 1 secret for all hosts #19

Open
MikhailMS opened this issue Sep 18, 2021 · 1 comment
Open

Server only capable to have 1 secret for all hosts #19

MikhailMS opened this issue Sep 18, 2021 · 1 comment
Labels
good first issue Good for newcomers invalid This doesn't seem right

Comments

@MikhailMS
Copy link
Owner

Right now server (struct Server) has a vector of hosts from where it would accept incoming requests
At the same time this setting could be all together ignored by users of the library, when they implement Server

But if users decide to use allowed_host functionality they may experience the following:

When one calls create_reply_authenticator on struct Server if uses server.secret, which I assume to be the same across all hosts, which may connect to the server
Not sure if that's always the case, but if not - then correct reply authenticator won't be created if host secret doesn't match server's secret

That would should be fixed at some point, if there is an ask

@MikhailMS MikhailMS added good first issue Good for newcomers invalid This doesn't seem right labels Sep 18, 2021
@MikhailMS
Copy link
Owner Author

As per RFC2865

      A RADIUS server MUST use the source IP address of the RADIUS UDP
      packet to decide which shared secret to use, so that RADIUS
      requests can be proxied.

So this issue should be resolved to ensure liibrary behaves according to RFC

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
good first issue Good for newcomers invalid This doesn't seem right
Projects
None yet
Development

No branches or pull requests

1 participant