radius: verify the request Message-Authenticator

scapy/layers/radius.py

@@ -1605,6 +1605,28 @@ def make_reply(self, req):
             for x in req.attributes
         }
 
+        # Verify the request Message-Authenticator, if present
+        if 80 in attrs:
+            mauth = attrs[80]
+            received = mauth.value
+            attributes = b"".join(
+                bytes(attr)[:2] + b"\x00" * 16
+                if attr is mauth else bytes(attr)
+                for attr in req.attributes
+            )
+            radius = req[Radius]
+            length = radius.len or 20 + len(attributes)
+            expected = hmac.new(
+                self.secret,
+                struct.pack("!BBH", radius.code, radius.id, length)
+                + radius.authenticator
+                + attributes,
+                hashlib.md5,
+            ).digest()
+            if not hmac.compare_digest(received, expected):
+                log_runtime.warning("Invalid Message-Authenticator !")
+                return None
+
         # Build Radius response
         rad = Radius(code=2, id=req[Radius].id)
 

test/answering_machines.uts

@@ -341,6 +341,15 @@ test_am(LdapPing_am,
 + Radius_am
 ~ crypto
 
+= Radius_am - Validate request Message-Authenticator
+
+request = Ether(b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00E\x00\x00Z\x00\x8e\x00\x00@\x11|\x03\x7f\x00\x00\x01\x7f\x00\x00\x01\x9f<\x07\x14\x00F\xfeY\x01\xfb\x00>s0\x00\x13\x86x\xd7\x11\xc4\x9e\xe1=\xce&r<P\x12\xbfL!\xb2\xd5WP!\xa8)}\tYZ&*\x01\x06user\x02\x12\x8f\x00\x8e\xdb4\xb1\x1a\xaf\x1f\xc7[\x9aD\xfff\xbd')
+server = Radius_am(secret="SECRET", IDENTITIES={"user": "password"})
+assert server.make_reply(request)[Radius].code == 2
+mauth = request[RadiusAttr_Message_Authenticator]
+mauth.value = bytes([mauth.value[0] ^ 1]) + mauth.value[1:]
+assert server.make_reply(Ether(bytes(request))) is None
+
 = Radius_am PAP - Test Access-Success
 
 def check_radius_pap_reply_success(x):