Status-Server require Message-Authenticator, too

and not Proxy-State

diff --git a/src/modules/rlm_radius/rlm_radius_udp.c b/src/modules/rlm_radius/rlm_radius_udp.c
index 751f7a0fdfe994e81937d9a46d4fc8f9c758cc3e..7c561f9f823305fc6575b4b4b17a9036af727fd0 100644 (file)
--- a/src/modules/rlm_radius/rlm_radius_udp.c
+++ b/src/modules/rlm_radius/rlm_radius_udp.c
@@ -748,6 +748,7 @@ static int conn_write(rlm_radius_udp_connection_t *c, rlm_radius_udp_request_t *
        ssize_t packet_len;
        uint8_t *msg = NULL;
        bool require_ma = false;
+       int proxy_state = 6;
        REQUEST *request;
        char const *module_name;
 
@@ -774,6 +775,15 @@ static int conn_write(rlm_radius_udp_connection_t *c, rlm_radius_udp_request_t *
                require_ma = true;
        }
 
+       /*
+        *      Status-Server requires Message-Authenticator, but not
+        *      Proxy-State.
+        */
+       if (c->buffer[0] == FR_CODE_STATUS_SERVER) {
+               require_ma = true;
+               proxy_state = 0;
+       }
+
        /*
         *      Leave room for the Message-Authenticator.
         */
@@ -786,7 +796,7 @@ static int conn_write(rlm_radius_udp_connection_t *c, rlm_radius_udp_request_t *
        /*
         *      Encode it, leaving room for Proxy-State, too.
         */
-       packet_len = fr_radius_encode(c->buffer, buflen - 6, NULL,
+       packet_len = fr_radius_encode(c->buffer, buflen - proxy_state, NULL,
                                      c->inst->secret, u->rr->id, u->code, u->rr->id,
                                      request->packet->vps);
        if (packet_len <= 0) return -1;
@@ -816,10 +826,12 @@ static int conn_write(rlm_radius_udp_connection_t *c, rlm_radius_udp_request_t *
         *      Note that the length check will always pass, due to
         *      the buflen manipulation done above.
         */
-       if ((size_t) (packet_len + 6) <= c->buflen) {
+       if (proxy_state) {
                uint8_t *attr = c->buffer + packet_len;
                int hdr_len;
 
+               rad_assert((size_t) (packet_len + 6) <= c->buflen);
+
                attr[0] = FR_PROXY_STATE;
                attr[1] = 6;
                memcpy(attr + 2, &c->inst->parent->proxy_state, 4);