added msg_auth flag in radius_message_t sign() method

src/libcharon/plugins/eap_radius/eap_radius_dae.c

@@ -190,7 +190,7 @@ static void send_response(private_eap_radius_dae_t *this,
 	response = radius_message_create(code);
 	response->set_identifier(response, request->get_identifier(request));
 	response->sign(response, request->get_authenticator(request),
-				   this->secret, this->hasher, this->signer, NULL);
+				   this->secret, this->hasher, this->signer, NULL, FALSE);
 
 	send_message(this, response, client);
 	save_retransmit(this, response, client);

src/libcharon/plugins/tnc_pdp/tnc_pdp.c

@@ -183,7 +183,7 @@ static void send_response(private_tnc_pdp_t *this,
 	}
 	response->set_identifier(response, request->get_identifier(request));
 	response->sign(response, request->get_authenticator(request),
-				   this->secret, this->hasher, this->signer, NULL);
+				   this->secret, this->hasher, this->signer, NULL, TRUE);
 
 	DBG1(DBG_CFG, "sending RADIUS %N to client '%H'", radius_message_code_names,
 		 code, client);

src/libradius/radius_message.c

@@ -280,7 +280,7 @@ METHOD(radius_message_t, add, void,
 
 METHOD(radius_message_t, sign, void,
 	private_radius_message_t *this, u_int8_t *req_auth, chunk_t secret,
-	hasher_t *hasher, signer_t *signer, rng_t *rng)
+	hasher_t *hasher, signer_t *signer, rng_t *rng, bool msg_auth)
 {
 	if (rng)
 	{
@@ -289,7 +289,7 @@ METHOD(radius_message_t, sign, void,
 	}
 	else
 	{
-		/* build Response-Authenticator */
+		/* prepare build of Response-Authenticator */
 		if (req_auth)
 		{
 			memcpy(this->msg->authenticator, req_auth, HASH_SIZE_MD5);
@@ -300,9 +300,7 @@ METHOD(radius_message_t, sign, void,
 		}
 	}
 
-	if (rng || this->msg->code == RMC_ACCESS_CHALLENGE
+	if (msg_auth)
-			|| this->msg->code == RMC_ACCESS_ACCEPT
-			|| this->msg->code == RMC_ACCESS_REJECT)
 	{
 		char buf[HASH_SIZE_MD5];
 
@@ -318,6 +316,7 @@ METHOD(radius_message_t, sign, void,
 	{
 		chunk_t msg;
 
+		/* build Response-Authenticator */
 		msg = chunk_create((u_char*)this->msg, ntohs(this->msg->length));
 		hasher->get_hash(hasher, msg, NULL);
 		hasher->get_hash(hasher, secret, this->msg->authenticator);

src/libradius/radius_message.h

@@ -251,10 +251,11 @@ struct radius_message_t {
 	 * @param secret		shared RADIUS secret
 	 * @param signer		HMAC-MD5 signer with secret set
 	 * @param hasher		MD5 hasher
-	 * @param rng			RNG to create Message-Authenticator, NULL to omit
+	 * @param rng			RNG to create Request-Authenticator, NULL to omit
+	 * @param msg_auth		calculate and add Message-Authenticator
 	 */
 	void (*sign)(radius_message_t *this, u_int8_t *req_auth, chunk_t secret,
-				 hasher_t *hasher, signer_t *signer, rng_t *rng);
+				 hasher_t *hasher, signer_t *signer, rng_t *rng, bool msg_auth);
 
 	/**
 	 * Verify the integrity of a received RADIUS message.

src/libradius/radius_socket.c

@@ -157,7 +157,8 @@ METHOD(radius_socket_t, request, radius_message_t*,
 	/* set Message Identifier */
 	request->set_identifier(request, this->identifier++);
 	/* sign the request */
-	request->sign(request, NULL, this->secret, this->hasher, this->signer, rng);
+	request->sign(request, NULL, this->secret, this->hasher, this->signer,
+						   rng, rng != NULL);
 
 	if (!check_connection(this, fd, port))
 	{