always add Message-Authenticator for replies to Access-Request

diff --git a/src/lib/radius.c b/src/lib/radius.c
index 5dc78c3106ee90d10dc77c7d1f295c0fff4697fb..03a91469f002efb1dd3409158509b4f7c71cf503 100644 (file)
--- a/src/lib/radius.c
+++ b/src/lib/radius.c
@@ -1831,6 +1831,7 @@ int rad_encode(RADIUS_PACKET *packet, RADIUS_PACKET const *original,
        uint16_t                total_length;
        int                     len;
        VALUE_PAIR const        *reply;
+       bool                    seen_ma = false;
 
        /*
         *      A 4K packet, aligned on 64-bits.
@@ -1883,6 +1884,12 @@ int rad_encode(RADIUS_PACKET *packet, RADIUS_PACKET const *original,
                id = htonl(id);
                memcpy(hdr->vector, &id, sizeof(id));
                memset(hdr->vector + sizeof(id), 0, sizeof(hdr->vector) - sizeof(id));
+
+               /*
+                *      We don't encode Message-Authenticator
+                */
+               seen_ma = true;
+               packet->offset = -1;
        } else
 #endif
        {
@@ -1908,6 +1915,25 @@ int rad_encode(RADIUS_PACKET *packet, RADIUS_PACKET const *original,
         *      memcpy.
         */
 
+       /*
+        *      Always add Message-Authenticator for replies to
+        *      Access-Request packets.
+        *
+        *      It must be the FIRST attribute in the packet.
+        */
+       if (!packet->tls && original && (original->code == PW_CODE_ACCESS_REQUEST)) {
+               seen_ma = true;
+
+               packet->offset = RADIUS_HDR_LEN;
+
+               ptr[0] = PW_MESSAGE_AUTHENTICATOR;
+               ptr[1] = 18;
+               memset(ptr + 2, 0, 16);
+
+               ptr += 18;
+               total_length += 18;
+       }
+
        /*
         *      Loop over the reply attributes for the packet.
         */
@@ -1942,15 +1968,6 @@ int rad_encode(RADIUS_PACKET *packet, RADIUS_PACKET const *original,
                }
 
 #ifdef WITH_RADIUSV11
-               /*
-                *      Do not encode Message-Authenticator for RADIUS/1.1
-                */
-               if (packet->radiusv11 && (reply->da->vendor == 0) && (reply->da->attr == PW_MESSAGE_AUTHENTICATOR)) {
-                       reply = reply->next;
-                       continue;
-               }
-
-
                /*
                 *      Do not encode Original-Packet-Code for RADIUS/1.1
                 */
@@ -1984,15 +2001,13 @@ int rad_encode(RADIUS_PACKET *packet, RADIUS_PACKET const *original,
                 *      length and initial value.
                 */
                if (!reply->da->vendor && (reply->da->attr == PW_MESSAGE_AUTHENTICATOR)) {
-#ifdef WITH_RADIUSV11
                        /*
-                        *      RADIUSV11 does not encode or verify Message-Authenticator.
+                        *      We have already encoded the Message-Authenticator, don't do it again.
                         */
-                       if (packet->radiusv11) {
+                       if (seen_ma) {
                                reply = reply->next;
                                continue;
                        }
-#endif
 
                        if (room < 18) break;