diff -Nru radius-1.2.5/radius_init_const.h radius-1.2.5-my/radius_init_const.h
--- radius-1.2.5/radius_init_const.h	2007-03-18 22:59:40.000000000 +0100
+++ radius-1.2.5-my/radius_init_const.h	2008-05-10 19:32:09.000000000 +0200
@@ -4,6 +4,12 @@
 REGISTER_LONG_CONSTANT("RADIUS_ACCOUNTING_REQUEST", 4, CONST_PERSISTENT);
 REGISTER_LONG_CONSTANT("RADIUS_ACCOUNTING_RESPONSE", 5, CONST_PERSISTENT);
 REGISTER_LONG_CONSTANT("RADIUS_ACCESS_CHALLENGE", 11, CONST_PERSISTENT);
+REGISTER_LONG_CONSTANT("RADIUS_DISCONNECT_REQUEST", 40, CONST_PERSISTENT);
+REGISTER_LONG_CONSTANT("RADIUS_DISCONNECT_ACCEPT", 41, CONST_PERSISTENT);
+REGISTER_LONG_CONSTANT("RADIUS_DISCONNECT_REJECT", 42, CONST_PERSISTENT);
+REGISTER_LONG_CONSTANT("RADIUS_COA_REQUEST", 43, CONST_PERSISTENT);
+REGISTER_LONG_CONSTANT("RADIUS_COA_ACCEPT", 44, CONST_PERSISTENT);
+REGISTER_LONG_CONSTANT("RADIUS_COA_REJECT", 45, CONST_PERSISTENT);
 REGISTER_LONG_CONSTANT("RADIUS_USER_NAME", 1, CONST_PERSISTENT);	/* String */
 REGISTER_LONG_CONSTANT("RADIUS_USER_PASSWORD", 2, CONST_PERSISTENT);	/* String */
 REGISTER_LONG_CONSTANT("RADIUS_CHAP_PASSWORD", 3, CONST_PERSISTENT);	/* String */
diff -Nru radius-1.2.5/radlib.c radius-1.2.5-my/radlib.c
--- radius-1.2.5/radlib.c	2007-03-18 22:59:40.000000000 +0100
+++ radius-1.2.5-my/radlib.c	2008-05-10 19:22:12.000000000 +0200
@@ -131,7 +131,7 @@
 	/* Create the request authenticator */
 	MD5Init(&ctx);
 	MD5Update(&ctx, &h->request[POS_CODE], POS_AUTH - POS_CODE);
-	MD5Update(&ctx, memset(&h->request[POS_AUTH], 0, LEN_AUTH), LEN_AUTH);
+	MD5Update(&ctx, &h->request[POS_AUTH], LEN_AUTH);
 	MD5Update(&ctx, &h->request[POS_ATTRS], h->req_len - POS_ATTRS);
 	MD5Update(&ctx, srvp->secret, strlen(srvp->secret));
 	MD5Final(&h->request[POS_AUTH], &ctx);
@@ -486,13 +486,13 @@
 		if (++h->srv >= h->num_servers)
 			h->srv = 0;
 
-	if (h->request[POS_CODE] == RAD_ACCOUNTING_REQUEST)
+	/* Insert the scrambled password into the request */
+	if (h->pass_pos != 0)
+		insert_scrambled_password(h, h->srv);
+
+	if (h->request[POS_CODE] != RAD_ACCESS_REQUEST)
 		/* Insert the request authenticator into the request */
 		insert_request_authenticator(h, h->srv);
-	else
-		/* Insert the scrambled password into the request */
-		if (h->pass_pos != 0)
-			insert_scrambled_password(h, h->srv);
 
 	/* Send the request */
 	n = sendto(h->fd, h->request, h->req_len, 0,
@@ -526,14 +526,18 @@
 
 	h->request[POS_CODE] = code;
 	h->request[POS_IDENT] = ++h->ident;
-	/* Create a random authenticator */
-	for (i = 0;  i < LEN_AUTH;  i += 2) {
-		long r;
-		TSRMLS_FETCH();
-		r = php_rand(TSRMLS_C);
-		h->request[POS_AUTH+i] = (unsigned char) r;
-		h->request[POS_AUTH+i+1] = (unsigned char) (r >> 8);
-	}
+
+	if (code == RAD_ACCESS_REQUEST)
+		/* Create a random authenticator - ONLY for auth request */
+		for (i = 0;  i < LEN_AUTH;  i += 2) {
+			long r;
+			TSRMLS_FETCH();
+			r = php_rand(TSRMLS_C);
+			h->request[POS_AUTH+i] = (unsigned char) r;
+			h->request[POS_AUTH+i+1] = (unsigned char) (r >> 8);
+		}
+	else
+		memset(&h->request[POS_AUTH], 0, LEN_AUTH);
 	h->req_len = POS_ATTRS;
 	h->request_created = 1;    
 	clear_password(h);
@@ -634,13 +638,7 @@
 		}
 	}
 
-	if (h->request[POS_CODE] == RAD_ACCOUNTING_REQUEST) {
-		/* Make sure no password given */
-		if (h->pass_pos || h->chap_pass) {
-			generr(h, "User or Chap Password in accounting request");
-			return -1;
-		}
-	} else {
+	if (h->request[POS_CODE] == RAD_ACCESS_REQUEST) {
 		/* Make sure the user gave us a password */
 		if (h->pass_pos == 0 && !h->chap_pass) {
 			generr(h, "No User or Chap Password attributes given");
@@ -650,6 +648,12 @@
 			generr(h, "Both User and Chap Password attributes given");
 			return -1;
 		}
+	} else if (h->request[POS_CODE] == RAD_ACCOUNTING_REQUEST){
+		/* Make sure no password given */
+		if (h->pass_pos || h->chap_pass) {
+			generr(h, "User or Chap Password in accounting request");
+			return -1;
+		}
 	}
 
 	/* Fill in the length field in the message */
diff -Nru radius-1.2.5/radlib.h radius-1.2.5-my/radlib.h
--- radius-1.2.5/radlib.h	2007-03-18 22:59:40.000000000 +0100
+++ radius-1.2.5-my/radlib.h	2008-05-09 08:50:52.000000000 +0200
@@ -43,6 +43,13 @@
 #define RAD_ACCOUNTING_REQUEST		4
 #define RAD_ACCOUNTING_RESPONSE		5
 #define RAD_ACCESS_CHALLENGE		11
+/* RFC 3576 */
+#define RAD_DISCONNECT_REQUEST		40
+#define RAD_DISCONNECT_ACCEPT		41
+#define RAD_DISCONNECT_REJECT		42
+#define RAD_COA_REQUEST			43
+#define RAD_COA_ACCEPT			44
+#define RAD_COA_REJECT			45
 
 /* Attribute types and values */
 #define RAD_USER_NAME			1	/* String */