radius: verify the request Message-Authenticator

scapy/layers/radius.py

@@ -1605,6 +1605,23 @@ def make_reply(self, req):
             for x in req.attributes
         }
 
+        # Verify the request Message-Authenticator, if present
+        if 80 in attrs:
+            mauth = attrs[80]
+            received = mauth.value
+            radius = req[Radius]
+            # For a request, the Request Authenticator is the packet's own.
+            # This zeroes the attribute to hash it, so put the value back.
+            expected = mauth.compute_message_authenticator(
+                radius,
+                radius.authenticator,
+                self.secret,
+            )
+            mauth.value = received
+            if not hmac.compare_digest(received, expected):
+                log_runtime.warning("Invalid Message-Authenticator !")
+                return None
+
         # Build Radius response
         rad = Radius(code=2, id=req[Radius].id)
 

test/answering_machines.uts

@@ -341,6 +341,15 @@ test_am(LdapPing_am,
 + Radius_am
 ~ crypto
 
+= Radius_am - Validate request Message-Authenticator
+
+request = Ether(b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00E\x00\x00Z\x00\x8e\x00\x00@\x11|\x03\x7f\x00\x00\x01\x7f\x00\x00\x01\x9f<\x07\x14\x00F\xfeY\x01\xfb\x00>s0\x00\x13\x86x\xd7\x11\xc4\x9e\xe1=\xce&r<P\x12\xbfL!\xb2\xd5WP!\xa8)}\tYZ&*\x01\x06user\x02\x12\x8f\x00\x8e\xdb4\xb1\x1a\xaf\x1f\xc7[\x9aD\xfff\xbd')
+server = Radius_am(secret="SECRET", IDENTITIES={"user": "password"})
+assert server.make_reply(request)[Radius].code == 2
+mauth = request[RadiusAttr_Message_Authenticator]
+mauth.value = bytes([mauth.value[0] ^ 1]) + mauth.value[1:]
+assert server.make_reply(Ether(bytes(request))) is None
+
 = Radius_am PAP - Test Access-Success
 
 def check_radius_pap_reply_success(x):