rust-radius icon indicating copy to clipboard operation
rust-radius copied to clipboard

Server only capable to have 1 secret for all hosts

Open MikhailMS opened this issue 4 years ago • 1 comments

Right now server (struct Server) has a vector of hosts from where it would accept incoming requests At the same time this setting could be all together ignored by users of the library, when they implement Server

But if users decide to use allowed_host functionality they may experience the following:

When one calls create_reply_authenticator on struct Server if uses server.secret, which I assume to be the same across all hosts, which may connect to the server Not sure if that's always the case, but if not - then correct reply authenticator won't be created if host secret doesn't match server's secret

That would should be fixed at some point, if there is an ask

MikhailMS avatar Sep 18 '21 20:09 MikhailMS

As per RFC2865

      A RADIUS server MUST use the source IP address of the RADIUS UDP
      packet to decide which shared secret to use, so that RADIUS
      requests can be proxied.

So this issue should be resolved to ensure liibrary behaves according to RFC

MikhailMS avatar Sep 21 '21 19:09 MikhailMS