On Tue, Jun 10, 2014 at 1:28 AM, Alan DeKok <aland@deployingradius.com> wrote:
Peter Lambrechtsen wrote:
So this means that the Message-Authenticator HMAC value should be calculated on the assumption the Packet Authenticator is all zero bytes
Yes. That's how FreeRADIUS works. The code is available, you just need to read it.
so it would look something like this:
2b90002b000000000000000000000000000000000105626f62501200000000000000000000000000000000
And then the Packet Authenticator and the Message-Authenticator gets added in and you end up with a packet like this:
2b90002b9b6756059c3b56559d67f44418ae1fb70105626f6250125d68bd8fc122f6f2346e51872ba21fc3
Not entirely. Order is important.
Step 1:
2b90002b000000000000000000000000000000000105626f62501200000000000000000000000000000000
Step 2:
2b90002b000000000000000000000000000000000105626f6250125d68bd8fc122f6f2346e51872ba21fc3
Step 3:
2b90002b9b6756059c3b56559d67f44418ae1fb70105626f6250125d68bd8fc122f6f2346e51872ba21fc3
Is this correct? As that is how it seems to be working for me. And I just wanted to make sure I was approaching this correctly. As it seems a little strange that the CoA/DM messages would prefer to have a null Authenticator message when calculating a Message-Authenticator. But it seems to be the way it is.
You have to calculate one and then the other. There's no way to do both at the same time.
Thanks Alan, that is what I had realised (after reading the code, and wanting to make sure I was reading it correctly as C isn't my strong suit). I had mis-understood and now know that the Packet Authenticator needs to be a "proper" one based off the MD5 of the Packet Type/Identifier/Attributes rather than just the purely random number that is used for the Access-Request. After I figured out the MD5 encoding process from Step 2 to Step 3 then everything works. I now have a working JMeter test suite that can make Radius calls including Message-Authenticator for all common packet types Access-Request/Accounting/CoA/DM/Status after hacking TinyRadius. Seems to work well for me. Now I just need to get the build a patch for the JMeter folks to accept. Happy to send you a link if you were interested. Cheers Peter