Reputation: 1
when sending Radius request with Message-Authenticator attribute in it, Dropping packet without response because of error: Received packet from 172.21.248.41 with invalid Message-Authenticator! (Shared secret is incorrect.) (from client localhost) getting from server side even though shared secret is correct, Using tinyradius-1.1.3 jar.
Installed freeradius in one of the instance(ex : 10.255.68.68)
Here is the sample program
package test;
import java.io.ByteArrayOutputStream;
import java.io.DataOutputStream;
import java.io.IOException;
import java.security.SecureRandom;
import java.util.Arrays;
import java.util.Iterator;
import java.util.List;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import org.tinyradius.attribute.RadiusAttribute;
import org.tinyradius.packet.AccessRequest;
import org.tinyradius.packet.RadiusPacket;`your text`
import org.tinyradius.util.RadiusClient;
public class RadiusAuthenticatorClient {
public static void main(String[] args) throws Exception {
String server = "<<Example IP>>";
String sharedSecret = "<<secret>>";
RadiusClient client = new RadiusClient(server, sharedSecret);
client.setAuthPort(1812); // Set to your RADIUS authentication port
// Example: Username and password
String username = "admin";
String password = "password1";
// Create and send the Access-Request packet
AccessRequest accessRequest = new AccessRequest(username, password);
SecureRandom random = new SecureRandom();
byte[] requestAuthenticator = new byte[16];
random.nextBytes(requestAuthenticator);
accessRequest.setAuthenticator(requestAuthenticator);
addMessageAuthenticator(accessRequest, client, sharedSecret);
RadiusPacket response = client.authenticate(accessRequest);
}
public static void addMessageAuthenticator(AccessRequest accessRequest, RadiusClient client, String sharedSecret) throws Exception {
// Create a 16-byte authenticator (MD5 HMAC of the shared secret)
byte[] messageAuthenticator = new byte[16];
// Generate the HMAC MD5 hash
Mac mac = Mac.getInstance("HmacMD5");
SecretKeySpec keySpec = new SecretKeySpec(sharedSecret.getBytes("UTF-8"), "HmacMD5");
mac.init(keySpec);
byte[] packetBytes = createPacketBytes(accessRequest);
mac.update(packetBytes);
mac.update(new byte[16]); // Zeroed-out Message-Authenticator placeholder
messageAuthenticator = mac.doFinal();
// Add updated Message-Authenticator to the request
RadiusAttribute messageAuthenticatorAttr = new RadiusAttribute(80, messageAuthenticator);
accessRequest.addAttribute(messageAuthenticatorAttr);
}
public static byte[] createPacketBytes(AccessRequest accessRequest) throws IOException {
List attributes = accessRequest.getAttributes();
ByteArrayOutputStream bos = new ByteArrayOutputStream(4096);
for (Iterator i = attributes.iterator(); i.hasNext();) {
RadiusAttribute a = (RadiusAttribute) i.next();
bos.write(a.writeAttribute());
}
bos.flush();
byte[] attrs = bos.toByteArray();
ByteArrayOutputStream out = new ByteArrayOutputStream();
DataOutputStream dos = new DataOutputStream(out);
dos.writeByte(accessRequest.getPacketType());
dos.writeByte(accessRequest.getPacketIdentifier());
dos.writeShort(20+attrs.length);
dos.write(accessRequest.getAuthenticator());
dos.write(attrs);
dos.flush();
return out.toByteArray();
}
}
Is Message-Authentication calculation is wrong or Do I need to configure something at server or client side?
Shared secret configured as "testing123" in Radius server. could anyone help me in calculating and adding Message-Authenticator in request with which I can get proper response (Accept-Accept or Accept-Reject).
Upvotes: 0
Views: 138