manually add Message-Authenticator to proxied packets

diff --git a/src/modules/rlm_radius/rlm_radius.c b/src/modules/rlm_radius/rlm_radius.c
index 085bc09ee0ac7be7f6d4b8e0b63ff37086ced033..d32f10612ee5fe85adbc9e7466e41253cace640c 100644 (file)
--- a/src/modules/rlm_radius/rlm_radius.c
+++ b/src/modules/rlm_radius/rlm_radius.c
@@ -262,15 +262,6 @@ static void radius_fixups(REQUEST *request)
                fr_pair_value_memcpy(vp, request->packet->vector, sizeof(request->packet->vector));
                fr_pair_add(&request->packet->vps, vp);
        }
-
-       /*
-        *      Access-Requests have a Message-Authenticator added,
-        *      unless one already exists.
-        */
-       if (!fr_pair_find_by_num(request->packet->vps, 0, FR_MESSAGE_AUTHENTICATOR, TAG_ANY)) {
-               fr_pair_make(request->packet, &request->packet->vps,
-                            "Message-Authenticator", "0x00", T_OP_SET);
-       }
 }
 
 

diff --git a/src/modules/rlm_radius/rlm_radius_udp.c b/src/modules/rlm_radius/rlm_radius_udp.c
index 63d7af0e44ba5293a7569176c291cfc8ef5bcb54..d0adddf12da3a8fc0928a606f226b8384e149a91 100644 (file)
--- a/src/modules/rlm_radius/rlm_radius_udp.c
+++ b/src/modules/rlm_radius/rlm_radius_udp.c
@@ -400,14 +400,16 @@ static void conn_writable(fr_event_list_t *el, int fd, UNUSED int flags, void *u
 
                rad_assert(c->inst->parent->allowed[u->code]);
 
+               // @todo - print out packet header and attributes
+
                packet_len = fr_radius_encode(c->buffer, c->buflen, NULL,
                                              c->inst->secret, u->rr->id, u->code, u->rr->id,
                                              request->packet->vps);
                if (packet_len <= 0) break;
 
                /*
-                *      @todo - add Proxy-State to the tail end of the
-                *      packet.  We need to add it here, and NOT in
+                *      Ad Proxy-State to the tail end of the packet.
+                *      We need to add it here, and NOT in
                 *      request->packet->vps, because multiple modules
                 *      may be sending the packets at the same time.
                 */
@@ -424,9 +426,43 @@ static void conn_writable(fr_event_list_t *el, int fd, UNUSED int flags, void *u
                        c->buffer[2] = (hdr_len >> 8) & 0xff;
                        c->buffer[3] = hdr_len & 0xff;
 
+                       // @todo - print out Proxy-State
+
                        packet_len += 6;
                }
 
+               /*
+                *      Add Message-Authenticator manually.
+                */
+               if ((c->buffer[0] == FR_CODE_ACCESS_REQUEST) &&
+                   ((size_t) (packet_len + 18) <= c->buflen)) {
+                       uint8_t *attr, *end;
+                       int hdr_len;
+
+                       end = c->buffer + packet_len;
+                       for (attr = c->buffer + 20;
+                            attr < end;
+                            attr += attr[1]) {
+                               if (attr[0] != FR_MESSAGE_AUTHENTICATOR) continue;
+
+                               break;
+                       }
+
+                       if (attr == end) {
+                               // @todo - save ptr to attr
+                               attr[0] = FR_PROXY_STATE;
+                               attr[1] = 18;
+                               memset(attr + 2, 0, 16);
+
+                               hdr_len = (c->buffer[2] << 8) | (c->buffer[3]);
+                               hdr_len += 18;
+                               c->buffer[2] = (hdr_len >> 8) & 0xff;
+                               c->buffer[3] = hdr_len & 0xff;
+
+                               packet_len += 18;
+                       }
+               }
+
                if (fr_radius_sign(c->buffer, NULL, (uint8_t const *) c->inst->secret,
                                   strlen(c->inst->secret)) < 0) {
                        ERROR("Failed signing packet");
@@ -434,10 +470,9 @@ static void conn_writable(fr_event_list_t *el, int fd, UNUSED int flags, void *u
                        return;
                }
 
-               /*
-                *      @todo - print out the packet we're proxying,
-                *      including socket name.
-                */
+               // @todo - print out actual value of signed Message-Authenticator
+
+               // @todo - if debug >= 3, print out hex of the packet.
 
                MEM(u->packet = talloc_memdup(u, c->buffer, packet_len));
                u->packet_len = packet_len;