more corner cases for RADIUS

Author: alandekok

src/tests/unit/protocols/radius/errors.txt

@@ -11,5 +11,130 @@ match fr_radius_decode_pair: Insufficient data
 decode-pair 01 01 00
 match fr_radius_decode_pair: Insufficient data
 
+#
+#  Attribute length overflows input - length field says 10 but only 4 bytes total
+#
+decode-pair 01 0a 01 02
+match fr_radius_decode_pair: Insufficient data
+
+#
+#  ----  Packet-level validation tests (fr_radius_ok) ----
+#
+
+#
+#  Packet too short - 19 bytes (minimum is 20)
+#
+decode-proto 01 00 00 13 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e
+match Packet failed verification - packet is smaller than the minimum packet length
+
+#
+#  Packet too short - 10 bytes
+#
+decode-proto 01 00 00 0a 00 01 02 03 04 05
+match Packet failed verification - packet is smaller than the minimum packet length
+
+#
+#  Unknown packet code 0
+#
+decode-proto 00 00 00 14 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f
+match Packet failed verification - unknown packet code
+
+#
+#  Unknown packet code 53 (0x35) - first invalid code (FR_RADIUS_CODE_MAX)
+#
+decode-proto 35 00 00 14 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f
+match Packet failed verification - unknown packet code
+
+#
+#  Unknown packet code 255
+#
+decode-proto ff 00 00 14 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f
+match Packet failed verification - unknown packet code
+
+#
+#  Header length field too small - says 19 (0x0013) but minimum is 20
+#  Actual data is 20 bytes.
+#
+decode-proto 01 00 00 13 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f
+match Packet failed verification - header 'length' field has a value smaller than the minimum packet length
+
+#
+#  Header length field larger than received data - says 100 (0x0064)
+#  but only 20 bytes of data.
+#
+decode-proto 01 00 00 64 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f
+match Packet failed verification - header 'length' field has a value larger than the received data
+
+#
+#  Attribute header overflows packet - only 1 byte after 20-byte header
+#  Length field = 21, so the 1 byte is "attribute data" but < 2 bytes for a header
+#
+decode-proto 01 00 00 15 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f ff
+match Packet failed verification - attribute header overflows the packet
+
+#
+#  Attribute number zero is invalid
+#
+decode-proto 01 00 00 16 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 00 02
+match Packet failed verification - attribute number 0 is invalid
+
+#
+#  Attribute length field = 0 (must be >= 2)
+#
+decode-proto 01 00 00 16 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 01 00
+match Packet failed verification - attribute 'length' field contains invalid value
+
+#
+#  Attribute length field = 1 (must be >= 2)
+#
+decode-proto 01 00 00 16 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 01 01
+match Packet failed verification - attribute 'length' field contains invalid value
+
+#
+#  Attribute length overflows packet - claims 10 bytes but only 2 available
+#
+decode-proto 01 00 00 16 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 01 0a
+match Packet failed verification - attribute 'length' field overflows the packet
+
+#
+#  Message-Authenticator (type 80/0x50) with invalid length
+#  Must be exactly 18 bytes (2 header + 16 HMAC-MD5). Here it's 5 bytes.
+#
+decode-proto 01 00 00 19 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 50 05 00 00 00
+match Packet failed verification - Message-Authenticator has invalid length
+
+#
+#  Status-Server (code 12/0x0c) requires Message-Authenticator
+#  This packet has no attributes at all.
+#
+decode-proto 0c 00 00 14 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f
+match Packet failed verification - Message-Authenticator is required for this packet, but it is missing
+
+#
+#  EAP-Message (type 79/0x4f) present requires Message-Authenticator
+#  Access-Request with EAP-Message but no MA.
+#
+decode-proto 01 00 00 18 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 4f 04 01 01
+match Packet failed verification - Message-Authenticator is required for this packet, but it is missing
+
+#
+#  Status-Server with User-Name but no Message-Authenticator
+#
+decode-proto 0c 00 00 19 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 01 05 62 6f 62
+match Packet failed verification - Message-Authenticator is required for this packet, but it is missing
+
+#
+#  Multiple attribute errors: first attribute is valid, second has length 0
+#
+decode-proto 01 00 00 1a 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 01 04 68 69 02 00
+match Packet failed verification - attribute 'length' field contains invalid value
+
+#
+#  Multiple attributes: first valid, second overflows
+#  User-Name = "hi" (4 bytes), then NAS-IP (type 4) claiming 10 bytes
+#
+decode-proto 01 00 00 1a 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 01 04 68 69 04 0a
+match Packet failed verification - attribute 'length' field overflows the packet
+
 count
-match 7
+match 45