Error decrypting Tunnel-Password

[osinstom]

Hi,

I'm trying to use the library to handle L2TP-specific parameters configuted in FreeRADIUS. The configuration file looks as follows:

test-l2tp@test.com    Cleartext-Password := "test"
    Tunnel-Type = L2TP,
    Tunnel-Medium-Type = IPv4,
    Tunnel-Password = "pass123",
    Tunnel-Server-Endpoint = 10.10.10.10

Tunnel-Type, Tunnel-Medium-Type and Tunnel-Server-Endpoint are read properly, but when using the below piece of code to get Tunnel-Password I got an error:

    _, tunnelPassword, err := rfc2868.TunnelPassword_LookupString(pkt)
    if err == nil {
        authResp["TunnelPassword"] = tunnelPassword
    }

Output logs:

2020/12/02 11:23:40 invalid password length

I'm wondering if you verified the behavior for Tunnel-Password? I'm not sure if the problem is with FreeRADIUS configuration or with the radius library?

[ghost]

I did some preliminary tests and I believe there is a bug in the Tunnel-Password implementation. I will try and debug ASAP. If it interests you in the meantime, here is a failing test case that I am trying to fix:

func TestTunnelPasswordPacket(t *testing.T) {
    response := []byte{
        0x2, 0x29, 0x0, 0x39, 0x7e, 0x49, 0x69, 0x75, 0x41, 0x15, 0xbd, 0x2f, 0x5, 0x22, 0x5, 0x67, 0xb4,
        0x6a, 0x21, 0x50, 0x45, 0x25, 0x1e, 0x8c, 0x2, 0x57, 0x1e, 0xef, 0xd0, 0xca, 0x25, 0x52, 0x7c, 0x9b,
        0xe, 0xff, 0x41, 0xad, 0x85, 0xd9, 0x59, 0x58, 0xb8, 0x46, 0xd0, 0xee, 0xaf, 0xfa, 0xfc, 0xad, 0x33,
        0x9d, 0xd9, 0xd3, 0x16, 0x66, 0xc5,
    }

    p, err := radius.Parse(response, []byte("radius"))
    if err != nil {
        t.Fatal(err)
    }

    tag, password, err := rfc2868.TunnelPassword_LookupString(p)
    if err != nil {
        t.Fatal(err)
    }
    if expecting := byte(30); tag != expecting {
        t.Errorf("Tunnel-Password tag = %d, expecting %d", tag, expecting)
    }
    if expecting := "123456789abcdefg"; password != expecting {
        t.Errorf("Tunnel-Password = %#v, expecting %#v", password, expecting)
    }
}

[ghost]

I tracked down the issue. A fix should be pushed later today.