FreeRADIUS 3.2.3 CoA代理返回无效Message-Authenticator求助

问题背景 #

在FreeRADIUS 3.2.3 Docker镜像中配置CoA代理，已正确配置消息发起方（radclient）与代理服务器的共享密钥，以及代理服务器与目标NAS的共享密钥。CoA请求能成功代理到NAS，NAS回复后代理也能转发，但发起端收到回复时提示：

Reply verification failed: Received packet from 192.168.2.157 with invalid Message-Authenticator! (Shared secret is incorrect.)

各方共享密钥均确认无误，但签名验证始终失败。

日志与命令详情 #

Radius服务器调试日志（主机IP：192.168.2.157） #

2) Received Disconnect-Request Id 33 from 192.168.2.227:37369 to 172.17.0.2:3799 length 51
(2)   NAS-IP-Address = 192.168.2.224
(2)   Calling-Station-Id = "BC:54:51:EF:70:AE"
(2)   Event-Timestamp = "Oct 31 2023 00:11:47 UTC"
(2) # Executing section recv-coa from file /etc/freeradius/sites-enabled/coa
(2)   recv-coa {
(2)     [suffix] = noop
(2)     update control {
(2)       EXPAND %{NAS-IP-Address}
(2)          --> 192.168.2.224
(2)       Packet-Dst-IP-Address = 192.168.2.224
(2)     } # update control = noop
(2)     [ok] = ok
(2)   } # recv-coa = ok
(2) Starting proxy to home server 192.168.2.224 port 3799
(2) server coa {
(2) }
(2) Proxying request to home server 192.168.2.224 port 3799 timeout 30.000000
(2) Sent Disconnect-Request Id 119 from 0.0.0.0:44638 to 192.168.2.224:3799 length 55
(2)   NAS-IP-Address = 192.168.2.224
(2)   Calling-Station-Id = "BC:54:51:EF:70:AE"
(2)   Event-Timestamp = "Oct 31 2023 00:11:47 UTC"
(2)   Proxy-State = 0x3333
Waking up in 0.3 seconds.
(2) Clearing existing &reply: attributes
(2) Received Disconnect-ACK Id 119 from 192.168.2.224:3799 to 172.17.0.2:44638 length 48
(2)   Proxy-State = 0x3333
(2)   Event-Timestamp = "Oct 31 2023 00:12:03 UTC"
(2)   Message-Authenticator = 0xa8348c88a62f140ba3d61e1725c34dc7
(2) server coa {
(2) }
(2) # Executing section send-coa from file /etc/freeradius/sites-enabled/coa
(2)   send-coa {
(2)     [ok] = ok
(2)   } # send-coa = ok
(2) Sent Disconnect-ACK Id 33 from 172.17.0.2:3799 to 192.168.2.227:37369 length 44
(2)   Event-Timestamp = "Oct 31 2023 00:12:03 UTC"
(2)   Message-Authenticator = 0xa8348c88a62f140ba3d61e1725c34dc7
(2) Finished request

请求命令及结果 #

echo "
 NAS-IP-Address = 192.168.2.224
 Calling-Station-Id = 'BC:54:51:EF:70:AE'
 Event-Timestamp = $(date +%s)
" | radclient -x 192.168.2.157:3799 disconnect <secret>

Sent Disconnect-Request Id 33 from 0.0.0.0:37369 to 192.168.2.157:3799 length 51
NAS-IP-Address = 192.168.2.224
Calling-Station-Id = "BC:54:51:EF:70:AE"
Event-Timestamp = "Oct 30 2023 18:11:47 MDT"
(0) Reply verification failed: Received packet from 192.168.2.157 with invalid Message-Authenticator!  (Shared secret is incorrect.)

问题根源 #

从日志可见，FreeRADIUS转发CoA回复时，直接复用了目标NAS生成的Message-Authenticator值。但该签名是NAS通过与代理服务器的共享密钥计算得出的，而发起端（radclient）是用自己与代理服务器的共享密钥来验证签名，两者密钥不同，自然验证失败。

解决方案 #

修改/etc/freeradius/sites-enabled/coa配置文件中的send-coa段，强制服务器重新计算Message-Authenticator：

1. 打开配置文件，找到send-coa块：

send-coa {
    [ok] = ok
}

2. 添加update reply指令重置Message-Authenticator，让服务器用发起端的共享密钥重新生成签名：

send-coa {
    update reply {
        Message-Authenticator := 0x00
    }
    [ok] = ok
}

3. 重启FreeRADIUS Docker容器：

docker restart <your-radius-container-name>

4. 重新执行radclient命令验证，此时签名验证会正常通过。

内容的提问来源于stack exchange，提问作者AlexS