Previously Cristian Novac wrote:

What do you think? It could be possible to make radius deal with such situations(larger than 253 octets attributes)? If you think it is, I would like to give it a try. In case it is possible, may you tell me please what part of the source code should I give attention in order to solve this.

The protocol does not allow for it. That means it is not possible. Wichert. -- Wichert Akkerman <wichert@wiggy.net> It is simple to make things. http://www.wiggy.net/ It is hard to make things simple.

On Mar 26, 2008, at 5:05 PM, Cristian Novac wrote: [..]

What do you think? It could be possible to make radius deal with such situations(larger than 253 octets attributes)? If you think it is, I would like to give it a try. In case it is possible, may you tell me please what part of the source code should I give attention in order to solve this.

For passing information of more than 253, I have done so in VSAs split up and put into multiple attributes - sorta like an EAP- Message. Perhaps that could work for you too. Cheers, David

Cristian Novac wrote:

I think this solution may work for me too(splitting the attribute); could you tell me how have you done this?because implicitly freeradius doesn't do the split;

It doesn't do that because there's no standard way to do it. If you want to have longer attributes, you need to modify *both* the client and the server. In most cases, you can't modify the client (e.g. commercial equipment), so modifying the server is a waste of time. There *is* a standard being worked on which may allow longer attributes. Once it is standardized, then clients and servers will support it. Until then, don't waste your time trying to create longer attributes. Alan DeKok.

On Mar 27, 2008, at 9:09 AM, Cristian Novac wrote: [...]

I think this solution may work for me too(splitting the attribute); could you tell me how have you done this?because implicitly freeradius doesn't do the split; Do you have a patch for this?

No patch required, as you are just inserting vendor specific attributes and coding the logic behind the VSAs. Assuming you are using a VSA (which always requires a bit of client and server support), you can chunk up your data into individual attributes and insert them in order into the request. Server-side, simply reassemble - much like an EAP-Message.

On Mar 27, 2008, at 9:25 AM, Alan DeKok wrote: [...]

It doesn't do that because there's no standard way to do it.

EAP-Message is at least an example - and why one can be assured that attributes maintain their ordering in the packet, no?

If you want to have longer attributes, you need to modify *both* the client and the server. In most cases, you can't modify the client (e.g. commercial equipment), so modifying the server is a waste of time.

What if you aren't using commercial equipment and _do_ have control over both client and server :) David

wlan@mac.com wrote:

On Mar 27, 2008, at 9:09 AM, Cristian Novac wrote: [...]

...

I think this solution may work for me too(splitting the attribute); could you tell me how have you done this?because implicitly freeradius doesn't do the split; Do you have a patch for this?

No patch required, as you are just inserting vendor specific attributes and coding the logic behind the VSAs.

Assuming you are using a VSA (which always requires a bit of client and server support), you can chunk up your data into individual attributes and insert them in order into the request. Server-side, simply reassemble - much like an EAP-Message.

I would like to be able to put in a reply list of attributes of a user, in "users" file from the server,one attribute whitch is longer than 253 B; then...radius server to process this attribute and split it in two or more new attributes. Could you just tell what part of the source code should I concern about in order to do this....

...

On Mar 27, 2008, at 9:25 AM, Alan DeKok wrote: [...]

...

It doesn't do that because there's no standard way to do it.

EAP-Message is at least an example - and why one can be assured that attributes maintain their ordering in the packet, no?

...

If you want to have longer attributes, you need to modify *both* the client and the server. In most cases, you can't modify the client (e.g. commercial equipment), so modifying the server is a waste of time.

What if you aren't using commercial equipment and _do_ have control over both client and server :)

David - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html