Hello,
Based on my tests, it seems Decodepacket calls the handler even if the hash is insane.
I think the good behaevior would be to silently drop malformed packet (perhaps notify but NOT call the handler)

The following decode check the hash correctly before calling the handler.
tofgau

func DecodePacket(Secret string, buf []byte) (p Packet, err error) {
// fmt.Printf("\n\ndecEntr*%v", buf)
if len(buf) < 20 {
return nil, errors.New("invalid length")
}
p = &Packet{Secret: Secret}
p.Code = PacketCode(buf[0])
p.Identifier = buf[1]
copy(p.Authenticator[:], buf[4:20])
//read attributes
b := buf[20:]
for len(b) >= 2 {
length := uint8(b[1])
if int(length) > len(b) {
return nil, errors.New("invalid length")
}
attr := AVP{}
attr.Type = AttributeType(b[0])
attr.Value = append(attr.Value, b[2:length]...)
p.AVPs = append(p.AVPs, attr)
b = b[length:]
}

//验证Message-Authenticator,并且通过测试验证此处算法是正确的
//Verify Message-Authenticator, and tested to verify the algorithm is correct here
//	err = p.checkMessageAuthenticator()
//Tofgau 201812 : this is not used anymore

//tofau : Dump Original Buffer
//fmt.Printf("\n\n****BUF0 %x", buf)
oldAuth := p.Authenticator
//fmt.Printf("\n****PKHASH %x", oldAuth)

//Duplicate the buffer and white the hash part
tmp := make([]byte, len(buf))
copy(tmp, buf)
var white [16]byte
copy(tmp[4:20], white[:])

//tofau : Calculate a hash on this new buffer concatenated with the secret
hasher := crypto.Hash(crypto.MD5).New()
hasher.Write(tmp)
hasher.Write([]byte(p.Secret))

calculatedHash := hasher.Sum(nil)

//tofau :
//fmt.Printf("\n****MYHASH %x", calculatedHash)

if !hmac.Equal(calculatedHash, oldAuth[:]) {
	//fmt.Printf("\n\nINVALID PACKET")
	return p, ErrMessageAuthenticatorCheckFail
} else {
	//fmt.Printf("\n\nVALID PACKET")
}

return p, nil

/* supressed by tofgau
if err != nil {

	return p, err
}

return p, nil
*/

}

Tested with radius client on switch huawei s5700
I may try to implement it myself.

relative: layeh/radius#96

Following godoc style documentation would be a great addition.

Hi,
Really like this library. Although, i need to send back bandwidth up and down message when accepting a request, for traffic shaping. Do you have any suggestions where in the code would be best to attack.
Thanks

I can not understand how the query extracted VSA attribute.

if i do:

attr := request.GetAVP(radius.VendorSpecfic)

then he extracts the first.

I have 27 such parameters, how to find what I need?

As a temporary solution did such a function

func getVSA(vendor uint32, attr uint8, p *radius.Packet) *radius.VSA {
	for i := range p.AVPs {
		if p.AVPs[i].Type == radius.VendorSpecific {
			a := p.AVPs[i]
			vsa := new(radius.VSA)
			value := a.Value
			vsa.Vendor = binary.BigEndian.Uint32(value[0:4])
			vsa.Type = uint8(value[4])
			vsa.Value = make([]byte, value[5]-2)
			copy(vsa.Value, value[6:])
			if vsa.Type == attr && vsa.Vendor == vendor {
				return vsa
			}
		}
	}
	return nil
}

Used the library to create a Access Accept reply to ServerStatus message from radius client. The message authenticator calculated is not correct ! We can test using radclient (a standard freeradius-server client !)

echo "Client-IP-Address=192.168.1.10, Called-Station-Id=00:00:00:00:a3:58" | radclient -c 1 -r 1 -t 5 -x 10.65.1.10 status mysecret

Sent Status-Server Id 7 from 0.0.0.0:49396 to 10.65.1.10:1812 length 39
Client-IP-Address = 192.168.1.10
Called-Station-Id = "00:00:00:00:a3:58"
(0) Reply verification failed: Received packet from 10.65.1.10 with invalid Message-Authenticator!  (Shared secret is incorrect.)

npac.AddVSA( radius.VSA{Vendor: 9, Type: 23, Value: []byte("10.20.30.40")} )

radius26 attributes.

For example:

npac.VSAadd(1, []byte{0x00, 0x00, 0x11, 0x2b}) // type:1 InputBasicRate

npac.VSAadd(12, []byte{0x00, 0x00, 0x11, 0x2b}) // type:2 InputAverageRate