From: Alan T. DeKok <aland@freeradius.org>
Date: Wed, 2 Aug 2017 13:53:54 +0000 (+0200)
Subject: manually add Message-Authenticator to proxied packets
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=fadd4cf5bc092a857d11ca38e495513fe102a6fe;p=thirdparty%2Ffreeradius-server.git

manually add Message-Authenticator to proxied packets
---

diff --git a/src/modules/rlm_radius/rlm_radius.c b/src/modules/rlm_radius/rlm_radius.c
index 085bc09ee0a..d32f10612ee 100644
--- a/src/modules/rlm_radius/rlm_radius.c
+++ b/src/modules/rlm_radius/rlm_radius.c
@@ -262,15 +262,6 @@ static void radius_fixups(REQUEST *request)
 		fr_pair_value_memcpy(vp, request->packet->vector, sizeof(request->packet->vector));
 		fr_pair_add(&request->packet->vps, vp);
 	}
-
-	/*
-	 *	Access-Requests have a Message-Authenticator added,
-	 *	unless one already exists.
-	 */
-	if (!fr_pair_find_by_num(request->packet->vps, 0, FR_MESSAGE_AUTHENTICATOR, TAG_ANY)) {
-		fr_pair_make(request->packet, &request->packet->vps,
-			     "Message-Authenticator", "0x00", T_OP_SET);
-	}
 }
 
 
diff --git a/src/modules/rlm_radius/rlm_radius_udp.c b/src/modules/rlm_radius/rlm_radius_udp.c
index 63d7af0e44b..d0adddf12da 100644
--- a/src/modules/rlm_radius/rlm_radius_udp.c
+++ b/src/modules/rlm_radius/rlm_radius_udp.c
@@ -400,14 +400,16 @@ static void conn_writable(fr_event_list_t *el, int fd, UNUSED int flags, void *u
 
 		rad_assert(c->inst->parent->allowed[u->code]);
 
+		// @todo - print out packet header and attributes
+
 		packet_len = fr_radius_encode(c->buffer, c->buflen, NULL,
 					      c->inst->secret, u->rr->id, u->code, u->rr->id,
 					      request->packet->vps);
 		if (packet_len <= 0) break;
 
 		/*
-		 *	@todo - add Proxy-State to the tail end of the
-		 *	packet.  We need to add it here, and NOT in
+		 *	Ad Proxy-State to the tail end of the packet.
+		 *	We need to add it here, and NOT in
 		 *	request->packet->vps, because multiple modules
 		 *	may be sending the packets at the same time.
 		 */
@@ -424,9 +426,43 @@ static void conn_writable(fr_event_list_t *el, int fd, UNUSED int flags, void *u
 			c->buffer[2] = (hdr_len >> 8) & 0xff;
 			c->buffer[3] = hdr_len & 0xff;
 
+			// @todo - print out Proxy-State
+
 			packet_len += 6;
 		}
 
+		/*
+		 *	Add Message-Authenticator manually.
+		 */
+		if ((c->buffer[0] == FR_CODE_ACCESS_REQUEST) &&
+		    ((size_t) (packet_len + 18) <= c->buflen)) {
+			uint8_t *attr, *end;
+			int hdr_len;
+
+			end = c->buffer + packet_len;
+			for (attr = c->buffer + 20;
+			     attr < end;
+			     attr += attr[1]) {
+				if (attr[0] != FR_MESSAGE_AUTHENTICATOR) continue;
+
+				break;
+			}
+
+			if (attr == end) {
+				// @todo - save ptr to attr
+				attr[0] = FR_PROXY_STATE;
+				attr[1] = 18;
+				memset(attr + 2, 0, 16);
+
+				hdr_len = (c->buffer[2] << 8) | (c->buffer[3]);
+				hdr_len += 18;
+				c->buffer[2] = (hdr_len >> 8) & 0xff;
+				c->buffer[3] = hdr_len & 0xff;
+
+				packet_len += 18;
+			}
+		}
+
 		if (fr_radius_sign(c->buffer, NULL, (uint8_t const *) c->inst->secret,
 				   strlen(c->inst->secret)) < 0) {
 			ERROR("Failed signing packet");
@@ -434,10 +470,9 @@ static void conn_writable(fr_event_list_t *el, int fd, UNUSED int flags, void *u
 			return;
 		}
 
-		/*
-		 *	@todo - print out the packet we're proxying,
-		 *	including socket name.
-		 */
+		// @todo - print out actual value of signed Message-Authenticator
+
+		// @todo - if debug >= 3, print out hex of the packet.
 
 		MEM(u->packet = talloc_memdup(u, c->buffer, packet_len));
 		u->packet_len = packet_len;