From 9c21307ad3413efd68e74eff573a3f26ed26ed90 Mon Sep 17 00:00:00 2001
From: Junaid Saeed Uppal <junaid.uppal@gmail.com>
Date: Tue, 23 Dec 2025 23:29:57 +0500
Subject: [PATCH] Add proper PAP authentication with *strip fix for null
 padding
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two-processor approach:
1. AuthGetPassword: Fetches user password from attributes
2. AuthPAP: Uses *radauth + *pap with *strip:*suffix:*nil converter
   to remove null padding from PAP passwords before comparison

Uses ~*req.User-Password{*strip:*suffix:*nil} as recommended by
CGRateS maintainers to fix the null-padding comparison bug.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 cgrates.json | 30 ++++++++++++++++++++++++++----
 1 file changed, 26 insertions(+), 4 deletions(-)

diff --git a/cgrates.json b/cgrates.json
index c84f923..3f8ad95 100644
--- a/cgrates.json
+++ b/cgrates.json
@@ -82,12 +82,34 @@
 	},
 	"request_processors": [
 		{
-			"id": "Auth",
+			"id": "AuthGetPassword",
 			"filters": ["*string:~*vars.*radReqType:*radAuth"],
-			"flags": ["*none", "*log"],
-			"request_fields": [],
+			"flags": ["*attributes", "*continue", "*log"],
+			"request_fields": [
+				{"tag": "Account", "path": "*cgreq.Account", "type": "*variable", "value": "~*req.User-Name"}
+			],
+			"reply_fields": []
+		},
+		{
+			"id": "AuthPAP",
+			"filters": ["*string:~*vars.*radReqType:*radAuth"],
+			"flags": ["*radauth", "*pap", "*log"],
+			"request_fields": [
+				{"tag": "UserPassword", "path": "*vars.UserPassword", "type": "*variable",
+					"value": "~*req.Password"},
+				{"tag": "StrippedPassword", "path": "*cgreq.Password", "type": "*variable",
+					"value": "~*req.User-Password{*strip:*suffix:*nil}"}
+			],
 			"reply_fields": [
-				{"tag": "SessionTimeout", "path": "*rep.Session-Timeout", "type": "*constant", "value": "3600"}
+				{"tag": "RemoveOnError", "filters": ["*notempty:~*cgrep.Error:"], "type": "*removeall", "path": "*rep"},
+				{"tag": "Code", "path": "*rep.*radReplyCode", "filters": ["*notempty:~*cgrep.Error:"],
+					"type": "*constant", "value": "AccessReject"},
+				{"tag": "ReplyMessage", "path": "*rep.Reply-Message", "filters": ["*notempty:~*cgrep.Error:"],
+					"type": "*variable", "value": "~*cgrep.Error"},
+				{"tag": "SessionTimeout", "path": "*rep.Session-Timeout", "filters": ["*empty:~*cgrep.Error:"],
+					"type": "*constant", "value": "3600"},
+				{"tag": "AcctInterimInterval", "path": "*rep.Acct-Interim-Interval", "filters": ["*empty:~*cgrep.Error:"],
+					"type": "*constant", "value": "30"}
 			]
 		}
 	]