awaneesh kumar wrote:
Hi All,
I have downloaded patch from http://bugs.freeradius.org/show_bug.cgi?id=386. I have succesfully applied patch to Freeradius1.1.2. Few questions i have..
a) Does patch supports optional identity privacy support, optional result indications, and an optional fast re-authentication procedure.
No idea.
b) After receiving EAP-Request/AKA-Challenge from server, client should calculate AT_MAC and compares with the received one. If it matches it should send back the EAP-Response/AKA-Challenge with AT_RES and new AT_MAC. As per section 10.8 of RFC 4187, AT_RES should be encoded as follows. // / The value field of this attribute begins with the 2-byte RES Length,which identifies the exact length of the RES in bits. The RES length is followed by the AKA RES parameter. According to [TS33.105 <http://tools.ietf.org/html/rfc4187#ref-TS33.105>], the length of the AKA RES can vary between 32 and 128 bits. Because the length of the AT_RES attribute must be a multiple of 4 bytes, the sender pads the RES with zero bits where necessary/
Trace below is packet from client to server:-
0x0242003017010000*03050000d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0*0b0500 000d6eb3a8082c9d2c0a031505b7a0fac0
Looks to be wrong. As always, patches are welcome.
c) As per section 3 (Figure 2) from RFC 4187, if server is unable to authenticate client if AT_MAC or AT_RES is incorrect, it should back the EAP-Request/AKA-Notification to client and client should respond back with EAP-Response/AKA-Notification. Then only server should send back EAP result as Failure. But Freeradius1.1.2 sends back the EAP Result (FAILURE) with Access-Reject. How ever success scenarion works perfectly.
As always, patches are welcome.
d) After receiving AKA-Challenge from Radius server, does patch supports the checking of Sequence No from AUTN parameter?
No idea. Check the source code.
Do we have any latest patch to support EAP-AKA?
Yes. If you have issues with it, you can always send an updated patch with bugs fixed. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog