the7729
the7729

Reputation: 1

Getting Dropping packet without response because of error: Received packet from (ip) with invalid Message-Authenticator!(Shared secret is incorrect.)

when sending Radius request with Message-Authenticator attribute in it, Dropping packet without response because of error: Received packet from 172.21.248.41 with invalid Message-Authenticator! (Shared secret is incorrect.) (from client localhost) getting from server side even though shared secret is correct, Using tinyradius-1.1.3 jar.

Installed freeradius in one of the instance(ex : 10.255.68.68)

Here is the sample program

package test;

import java.io.ByteArrayOutputStream;
import java.io.DataOutputStream;
import java.io.IOException;
import java.security.SecureRandom;
import java.util.Arrays;
import java.util.Iterator;
import java.util.List;

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;

import org.tinyradius.attribute.RadiusAttribute;
import org.tinyradius.packet.AccessRequest;
import org.tinyradius.packet.RadiusPacket;`your text`
import org.tinyradius.util.RadiusClient;

public class RadiusAuthenticatorClient {

    public static void main(String[] args) throws Exception {
        String server = "<<Example IP>>";
        String sharedSecret = "<<secret>>";
        RadiusClient client = new RadiusClient(server, sharedSecret);
        client.setAuthPort(1812);  // Set to your RADIUS authentication port
 
        // Example: Username and password
        String username = "admin";
        String password = "password1";
 
        // Create and send the Access-Request packet
        AccessRequest accessRequest = new AccessRequest(username, password);
        
        SecureRandom random = new SecureRandom();
        byte[] requestAuthenticator = new byte[16];
        random.nextBytes(requestAuthenticator);
        accessRequest.setAuthenticator(requestAuthenticator);
        addMessageAuthenticator(accessRequest, client, sharedSecret);
 
        RadiusPacket response = client.authenticate(accessRequest);
      
    }
    
public static void addMessageAuthenticator(AccessRequest accessRequest, RadiusClient client, String sharedSecret) throws Exception {
    // Create a 16-byte authenticator (MD5 HMAC of the shared secret)
   
     byte[] messageAuthenticator = new byte[16];
     
    // Generate the HMAC MD5 hash
    Mac mac = Mac.getInstance("HmacMD5");
    SecretKeySpec keySpec = new SecretKeySpec(sharedSecret.getBytes("UTF-8"), "HmacMD5");
    mac.init(keySpec);
 
    byte[] packetBytes = createPacketBytes(accessRequest);
    
    mac.update(packetBytes);
    mac.update(new byte[16]); // Zeroed-out Message-Authenticator placeholder
    messageAuthenticator = mac.doFinal();
    
    // Add updated Message-Authenticator to the request
    RadiusAttribute messageAuthenticatorAttr = new RadiusAttribute(80, messageAuthenticator);
    accessRequest.addAttribute(messageAuthenticatorAttr);
}

public static byte[] createPacketBytes(AccessRequest accessRequest) throws IOException {

    List attributes = accessRequest.getAttributes();
    ByteArrayOutputStream bos = new ByteArrayOutputStream(4096);
    for (Iterator i = attributes.iterator(); i.hasNext();) {
        RadiusAttribute a = (RadiusAttribute) i.next();
        bos.write(a.writeAttribute());
    }
    bos.flush();
    byte[] attrs = bos.toByteArray();
    ByteArrayOutputStream out = new ByteArrayOutputStream();
    DataOutputStream dos = new DataOutputStream(out);
    dos.writeByte(accessRequest.getPacketType());
    dos.writeByte(accessRequest.getPacketIdentifier());
    dos.writeShort(20+attrs.length);
    dos.write(accessRequest.getAuthenticator());
    dos.write(attrs);
    dos.flush();
    return out.toByteArray();
}
}

Is Message-Authentication calculation is wrong or Do I need to configure something at server or client side?

Shared secret configured as "testing123" in Radius server. could anyone help me in calculating and adding Message-Authenticator in request with which I can get proper response (Accept-Accept or Accept-Reject).

Upvotes: 0

Views: 138

Answers (0)

Related Questions