Fix message-authenticator attribute check for rfc 5997

Alan DeKok aland at
Mon Jun 27 13:09:39 CEST 2011

Frederic Leroy wrote:
> Hello,
> I have a device which adds message-authenticator attribute (80) in its
> accounting-response.
> If I understand correctly, it follows rfc5997 ( see section 5 ) which is 
> informational.

  Ah... the authentication vector for Status-Server is random, while
it's zero for Accounting-Request.  As a result, the calculation of the
response authenticator for Accounting-Request is different.

> Using radclient, it rejects the accounting-response of my device.
> So here is a patch to libfreeradius to make it works.

  That breaks accounting packets.

  I've put a better fix into git.

  Alan DeKok.

More information about the Freeradius-Devel mailing list