From 546a56efdcf3f2834a5fc00acb6e9bf54c5a12f4 Mon Sep 17 00:00:00 2001
From: Clinton Thomas <1033162+KernelClint@users.noreply.github.com>
Date: Tue, 1 Sep 2026 14:15:30 -0400
Subject: [PATCH] radius: verify the request Message-Authenticator

AI-Assisted: yes (GPT-5.6-Cyber)
---
 scapy/layers/radius.py      | 22 ++++++++++++++++++++++
 test/answering_machines.uts |  9 +++++++++
 2 files changed, 31 insertions(+)

diff --git a/scapy/layers/radius.py b/scapy/layers/radius.py
index 14a1fd8787e..72df7ab3714 100644
--- a/scapy/layers/radius.py
+++ b/scapy/layers/radius.py
@@ -1605,6 +1605,28 @@ def make_reply(self, req):
             for x in req.attributes
         }
 
+        # Verify the request Message-Authenticator, if present
+        if 80 in attrs:
+            mauth = attrs[80]
+            received = mauth.value
+            attributes = b"".join(
+                bytes(attr)[:2] + b"\x00" * 16
+                if attr is mauth else bytes(attr)
+                for attr in req.attributes
+            )
+            radius = req[Radius]
+            length = radius.len or 20 + len(attributes)
+            expected = hmac.new(
+                self.secret,
+                struct.pack("!BBH", radius.code, radius.id, length)
+                + radius.authenticator
+                + attributes,
+                hashlib.md5,
+            ).digest()
+            if not hmac.compare_digest(received, expected):
+                log_runtime.warning("Invalid Message-Authenticator !")
+                return None
+
         # Build Radius response
         rad = Radius(code=2, id=req[Radius].id)
 
diff --git a/test/answering_machines.uts b/test/answering_machines.uts
index 7aa36eee261..f13b493231f 100644
--- a/test/answering_machines.uts
+++ b/test/answering_machines.uts
@@ -341,6 +341,15 @@ test_am(LdapPing_am,
 + Radius_am
 ~ crypto
 
+= Radius_am - Validate request Message-Authenticator
+
+request = Ether(b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00E\x00\x00Z\x00\x8e\x00\x00@\x11|\x03\x7f\x00\x00\x01\x7f\x00\x00\x01\x9f<\x07\x14\x00F\xfeY\x01\xfb\x00>s0\x00\x13\x86x\xd7\x11\xc4\x9e\xe1=\xce&r<P\x12\xbfL!\xb2\xd5WP!\xa8)}\tYZ&*\x01\x06user\x02\x12\x8f\x00\x8e\xdb4\xb1\x1a\xaf\x1f\xc7[\x9aD\xfff\xbd')
+server = Radius_am(secret="SECRET", IDENTITIES={"user": "password"})
+assert server.make_reply(request)[Radius].code == 2
+mauth = request[RadiusAttr_Message_Authenticator]
+mauth.value = bytes([mauth.value[0] ^ 1]) + mauth.value[1:]
+assert server.make_reply(Ether(bytes(request))) is None
+
 = Radius_am PAP - Test Access-Success
 
 def check_radius_pap_reply_success(x):