alandekok/freeradius-server — pull request #52 by bmork (2012-03-27 10:11:40+00:00)
Title: Decode encrypted VSAs in requests

We're trying to do proxy CoA with Juniper ERXes as targets (NAS having a home server role for CoA). Some of the VSAs are encrypted. These show up still encrypted in the debug log:

```
# Executing section pre-proxy from file /etc/freeradius/sites-enabled/coatest
+- entering group pre-proxy {...}
++[proxy-request] returns noop
Sending CoA-Request of id 234 to 192.168.3.1 port 3799
ERX-Attr-58 = 0x87cebf5f40d1848842769089371a0e708dca
Proxy-State = 0x3636
Proxying request 2 to home server 192.168.3.1 port 3799
Sending CoA-Request of id 234 to 192.168.3.1 port 3799
ERX-Attr-58 = 0x87cebf5f40d1848842769089371a0e708dca
Proxy-State = 0x3636
Going to the next request
```

Which isn't really much of a problem. The real problem is that the proxied packets contain the VSAs still encrypted using the client secret instead of the appropriate home server secret. That will of course not work.

The problem is the same as the one I previously pushed a radsniff workaround for, but this time the solution is a bit more generic: Just attempt to decode any tunnel encrypted attribute in a request using a static null vector. This should not affect most requests, as they cannot contain any encrypted attributes, and it does fix the problem for CoA requests. I've verified that the proxied requests are re-encrypted using the appropriate secret as expected, and the debug log now shows the more user-friendly:

```
# Executing section pre-proxy from file /etc/freeradius/sites-enabled/coatest
+- entering group pre-proxy {...}
++[proxy-request] returns noop
Sending CoA-Request of id 35 to 192.168.3.1 port 3799
ERX-LI-Action = noop
Proxy-State = 0x323236
Proxying request 1 to home server 192.168.3.1 port 3799
Sending CoA-Request of id 35 to 192.168.3.1 port 3799
ERX-LI-Action = noop
Proxy-State = 0x323236
Going to the next request
```

I've made this change against the v2.1.x branch for now, as I really need it in 2.2. But I'm prepared to forward port it to the master branch if the solution is accepted.

Thanks for reviewing