Hi guys, It looks like the FreeRADIUS client library 1.1.6 doesn't handle challenge/response (code == PW_ACCESS_CHALLENGE). At the end of rc_send_server(), around line 390, only PW_ACCESS_ACCEPT, PW_PASSWORD_ACK, PW_ACCOUNTING_RESPONSE,PW_ACCESS_REJECT, and PW_PASSWORD_REJECT are valid responses. I'm working on a project that may require this functionality, so I'll look into adding it. I'll post what I can when I've got it. Unless I'm horribly wrong and there is already Access-Challenge support, in which case, please feel free to tell me how stupid I am and show me how to use it. Side note: Are PW_PASSWORD_{REQUEST,ACK,REJECT} experimental or extensions? I couldn't find them in RFC 2865. Thanks, ScottN
Scott Neugroschl wrote:
It looks like the FreeRADIUS client library 1.1.6 doesn't handle challenge/response (code == PW_ACCESS_CHALLENGE).
At the end of rc_send_server(), around line 390, only PW_ACCESS_ACCEPT, PW_PASSWORD_ACK, PW_ACCOUNTING_RESPONSE,PW_ACCESS_REJECT, and PW_PASSWORD_REJECT are valid responses.
Hmm.. OK.
I'm working on a project that may require this functionality, so I'll look into adding it. I'll post what I can when I've got it.
OK, thanks.
Unless I'm horribly wrong and there is already Access-Challenge support, in which case, please feel free to tell me how stupid I am and show me how to use it.
I don't think there is support for Access-Challenge.
Side note: Are PW_PASSWORD_{REQUEST,ACK,REJECT} experimental or extensions? I couldn't find them in RFC 2865.
They're old and deprecated. They should really be removed from the code. Alan DeKok.
Scott Neugroschl wrote:
Alan DeKok wrote:
Scott Neugroschl wrote:
Side note: Are PW_PASSWORD_{REQUEST,ACK,REJECT} experimental or extensions? I couldn't find them in RFC 2865.
They're old and deprecated. They should really be removed from the code.
I'll throw that into my patch, then, if you'd like.
Patch attached and also submitted to bugzilla (Bug 85). This patch: 1) provides Access-Challenge support by defining a new return code from rc_aaa/rc_auth/rc_acct: CHALLENGE_RC 2) Deletes the deprecated PW_PASSWORD_{REQUEST,ACK,REJECT} codes. Hope you guys like it ScottN
Scott Neugroschl wrote:
It looks like the FreeRADIUS client library 1.1.6 doesn't handle challenge/response (code == PW_ACCESS_CHALLENGE).
At the end of rc_send_server(), around line 390, only PW_ACCESS_ACCEPT, PW_PASSWORD_ACK, PW_ACCOUNTING_RESPONSE,PW_ACCESS_REJECT, and PW_PASSWORD_REJECT are valid responses.
As a side note, if the patch that I submitted isn't accepted, then PW_ACCESS_CHALLENGE should be added to the list of items giving a REJECT_RC in rc_send_server(). Per RFC 2865, section 4.4: "If the NAS does not support challenge/response, it MUST treat an Access-Challenge as though it had received an Access-Reject instead." (comment also added to Bug 85) ScottN
participants (2)
-
Alan DeKok -
Scott Neugroschl