Extract packet code even if body is not encrypted

diff --git a/src/protocols/tacacs/decode.c b/src/protocols/tacacs/decode.c
index 9d7cc98021a52be68a865efd2a9a4fa23441c738..649ad2cf754c58cfbac6846a1bfb6c714e6e2c9b 100644 (file)
--- a/src/protocols/tacacs/decode.c
+++ b/src/protocols/tacacs/decode.c
@@ -553,11 +553,6 @@ ssize_t fr_tacacs_decode(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t co
 
                FR_PROTO_HEX_DUMP(decrypted, buffer_len, "fr_tacacs_packet_t (unencrypted)");
 
-               if (code) {
-                       *code = fr_tacacs_packet_to_code((fr_tacacs_packet_t const *) decrypted);
-                       if (*code < 0) goto fail;
-               }
-
                buffer = decrypted;
        }
 
@@ -565,6 +560,11 @@ ssize_t fr_tacacs_decode(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t co
        if (fr_debug_lvl >= L_DBG_LVL_4) fr_tacacs_packet_log_hex(&default_log, pkt);
 #endif
 
+       if (code) {
+               *code = fr_tacacs_packet_to_code((fr_tacacs_packet_t const *) buffer);
+               if (*code < 0) goto fail;
+       }
+
        switch (pkt->hdr.type) {
        case FR_TAC_PLUS_AUTHEN:
                if (packet_is_authen_start_request(pkt)) {