Hello, We have tested 802.1X with eap/ttls/mschapv2 using freeradius. Every things works fine with Cisco, but, when we tested the solution with extreme networks products (Alpine3804 and summit48si) the solution did not work as expected. Apparently, the problem is a different RFC interpretation. The EAP implemented in freeradius make a unnecessary check in handle->identity variable. So we build a path for freeradius (only taking off some lines;-). Please , consider that change to next version. Joao Marcelo Ceron Leandro Bertholdo +++ eap.patch.c Sun Jun 25 21:04:58 2006 @@ -1046,13 +1046,18 @@ * request as the NAS is doing something * funny. */ - if (strncmp(handler->identity, vp->strvalue, - MAX_STRING_LEN) != 0) { - radlog(L_ERR, "rlm_eap: Identity does not match User-Name. Authentication failed."); - free(*eap_packet_p); - *eap_packet_p = NULL; - return NULL; - } + + // Commented here <Leandro Bertholdo/Joao Marcelo Ceron> + + // Changed by <Leandro Bertholdo/Joao Marcelo Ceron> + /* if (strncmp(handler->identity, vp->strvalue, + * MAX_STRING_LEN) != 0) { + * radlog(L_ERR, "rlm_eap: Identity does not match User-Name. Authentication failed."); + * free(*eap_packet_p); + * *eap_packet_p = NULL; + * return NULL; + *} + */ } } else { /* packet was EAP identity */ handler = eap_handler_alloc(); @@ -1101,14 +1106,17 @@ * identity, the NAS is doing something * funny, so reject the request. */ - if (strncmp(handler->identity, vp->strvalue, - MAX_STRING_LEN) != 0) { - radlog(L_ERR, "rlm_eap: Identity does not match User-Name, setting from EAP Identity."); - free(*eap_packet_p); - *eap_packet_p = NULL; - eap_handler_free(handler); - return NULL; - } + + // Changed by <Leandro Bertholdo/Joao Marcelo Ceron> + /* if (strncmp(handler->identity, vp->strvalue, + * MAX_STRING_LEN) != 0) { + * radlog(L_ERR, "rlm_eap: Identity does not match User-Name, setting from EAP Identity."); + * free(*eap_packet_p); + * *eap_packet_p = NULL; + * eap_handler_free(handler);
Joao Marcelo Ceron <ceron@tche.br> wrote:
We have tested 802.1X with eap/ttls/mschapv2 using freeradius. Every things works fine with Cisco, but, when we tested the solution with extreme networks products (Alpine3804 and summit48si) the solution did not work as expected.
Please explain why.
Apparently, the problem is a different RFC interpretation. The EAP implemented in freeradius make a unnecessary check in handle->identity variable.
Why is the check unnecessary? I've never heard of this being a problem with Extreme devices before.
Please , consider that change to next version.
If you could explain what the problem is, and why you changed it, perhaps. Right now, your message says nothing more than "Something went wrong, so we changed code to do stuff." Changes go in ONLY if they have reasonable explanations. Alan DeKok.
Apparently, the problem is a different RFC interpretation. The EAP implemented in freeradius make a unnecessary check in handle->identity variable.
RFC 3579, Section 2.1, in the second paragraph on page 7 says: In order to permit non-EAP aware RADIUS proxies to forward the Access-Request packet, if the NAS initially sends an EAP-Request/Identity message to the peer, the NAS MUST copy the contents of the Type-Data field of the EAP-Response/Identity received from the peer into the User-Name attribute and MUST include the Type-Data field of the EAP-Response/Identity in the User-Name attribute in every subsequent Access-Request. ... This is what FreeRADIUS enforces. The text could not be more clear. It *does* go on to say: If the NAS initially sends an EAP-Request for an authentication method, and the peer identity cannot be determined from the EAP-Response, then the User-Name attribute SHOULD be determined by another means. As noted in [RFC2865] Section 5.6, it is recommended that Access-Requests use the value of the Calling-Station-Id as the value of the User-Name attribute. Note that this text does NOT contradict the previous text. Note also that the patch you supplied changes the behavior for everyone else, which is not nice. Alan DeKok.
participants (2)
-
Alan DeKok -
Joao Marcelo Ceron