Hi everyone,
My fragmented VSA in a nested TLV is being cut in the next fragment after 9
characters.
RADIUS server version:
radiusd: FreeRADIUS Version 3.1.0 (git #fef25aa), for host
x86_64-unknown-linux-gnu, built on May 13 2016 at 14:22:49
FreeRADIUS Version 3.1.0
Copyright (C) 1999-2016 The FreeRADIUS server project and contributors
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License
For more information about these matters, see the file named COPYRIGHT
My RADIUS dictionary contains this:
VENDOR Alcatel-IPD 6527
BEGIN-VENDOR Alcatel-IPD format=Extended-Vendor-Specific-5
ATTRIBUTE Alc-Test-TLV 1 tlv
ATTRIBUTE Alc-Test-TLV-nested 1.1 tlv
ATTRIBUTE Alc-Test-VSA-1 1.1.1 string
ATTRIBUTE Alc-Test-VSA-2 1.1.2 string
ATTRIBUTE Alc-Test-VSA-3 1.1.3 string
END-VENDOR Alcatel-IPD
This is the entry in my RADIUS users file:
00:00:01:00:00:01 Auth-Type := Accept
Alc-Test-VSA-1 =
"01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
end",Alc-Test-VSA-2 =
"01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
end",
Alc-Test-VSA-3 = "test vsa"
The RADIUS server debugging:
(1) Received Access-Request Id 71 from 30.100.0.1:64446 to 30.100.0.9:1812
via eth9 length 63
(1) User-Name = "00:00:01:00:00:01"
(1) User-Password = "admin"
(1) NAS-IP-Address = 1.0.0.1
(1) Running section authorize from file
/opt/freeradius-3.1.x/etc/raddb/sites-enabled/default
(1) authorize {
(1) filter_username {
(1) if (&User-Name) {
(1) if (&User-Name =~ / /) {
(1) ...
(1) }
(1) if (&User-Name =~ /@[^@]*@/ ) {
(1) ...
(1) }
(1) if (&User-Name =~ /\.\./ ) {
(1) ...
(1) }
(1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)[^.]+(\.[^.]+)+$/)
</(a)[%5e.]+(\.%5b%5e.%5d+)+$/)>) {
(1) ...
(1) }
(1) if (&User-Name =~ /\.$/) {
(1) ...
(1) }
(1) if (&User-Name =~ /(a)\./) {
(1) ...
(1) }
(1) } # if (&User-Name) (notfound)
(1) } # filter_username (notfound)
(1) preprocess (ok)
(1) chap (noop)
(1) mschap (noop)
(1) digest (noop)
(1) suffix - Checking for suffix after "@"
(1) suffix - No '@' in User-Name = "00:00:01:00:00:01", looking up
realm NULL
(1) suffix - No such realm "NULL"
(1) suffix (noop)
(1) eap - No EAP-Message, not doing EAP
(1) eap (noop)
(1) files - Found match "00:00:01:00:00:01" one line 1 of
/opt/freeradius-3.1.x/etc/raddb/mods-config/files/authorize
(1) files (ok)
(1) expiration (noop)
(1) logintime (noop)
(1) pap - WARNING: Auth-Type already set. Not setting to PAP
(1) pap (noop)
(1) } # authorize (ok)
(1) Using 'Auth-Type = Accept' for authenticate {...}
(1) Auth-Type = Accept, accepting the user
(1) Running section post-auth from file
/opt/freeradius-3.1.x/etc/raddb/sites-enabled/default
(1) post-auth {
(1) update {
(1) &reply: skipped: No values available
(1) } # update (noop)
(1) exec (noop)
(1) remove_reply_message_if_eap {
(1) if (&reply:EAP-Message && &reply:Reply-Message) {
(1) ...
(1) }
(1) else {
(1) noop (noop)
(1) } # else (noop)
(1) } # remove_reply_message_if_eap (noop)
(1) } # post-auth (noop)
(1) Sent Access-Accept Id 71 from 30.100.0.9:1812 to 30.100.0.1:64446 via
eth9 length 0
(1) Alc-Test-VSA-1 =
"0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
1234567890123456789 end"
(1) Alc-Test-VSA-2 =
"0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
1234567890123456789 end"
(1) Alc-Test-VSA-3 = "test vsa"
(1) Finished request
Waking up in 4.9 seconds.
(1) Cleaning up request packet ID 71 with timestamp +12
Wireshark shows that Alc-Test-VSA-2 is cut:
0000 a6 12 01 01 00 09 00 ff 04 00 00 09 08 00 45 00 ..............E.
0010 01 48 29 e0 00 00 40 11 12 f4 1e 64 00 09 1e 64 .H)...@....d...d
0020 00 01 07 14 fb 82 01 34 c1 14 02 0b 01 2c 2b 2e .......4.....,+.
0030 62 76 e0 63 0a ee 3d ee ec 48 c9 c7 ad 62 f5 ff bv.c..=..H...b..
0040 1a 80 00 00 19 7f 01 01 ff 01 ec 30 31 32 33 34 ...........01234
0050 35 36 37 38 39 30 31 32 33 34 35 36 37 38 39 30 5678901234567890
0060 31 32 33 34 35 36 37 38 39 30 31 32 33 34 35 36 1234567890123456
0070 37 38 39 30 31 32 33 34 35 36 37 38 39 30 31 32 7890123456789012
0080 33 34 35 36 37 38 39 30 31 32 33 34 35 36 37 38 3456789012345678
0090 39 30 31 32 33 34 35 36 37 38 39 30 31 32 33 34 9012345678901234
00a0 35 36 37 38 39 30 31 32 33 34 35 36 37 38 39 30 5678901234567890
00b0 31 32 33 34 35 36 37 38 39 30 31 32 33 34 35 36 1234567890123456
00c0 37 38 39 30 31 32 33 34 35 36 37 38 39 30 31 32 7890123456789012
00d0 33 34 35 36 37 38 39 30 31 32 33 34 35 36 37 38 3456789012345678
00e0 39 30 31 32 33 34 35 36 37 38 39 30 31 32 33 34 9012345678901234
00f0 35 36 37 38 39 30 31 32 33 34 35 36 37 38 39 30 5678901234567890
0100 31 32 33 34 35 36 37 38 39 30 31 32 33 34 35 36 1234567890123456
0110 37 38 39 30 31 32 33 34 35 36 37 38 39 30 31 32 7890123456789012
0120 33 34 35 36 37 38 39 30 31 32 33 34 35 36 37 38 3456789012345678
0130 39 20 65 6e 64 02 11 30 31 32 33 34 35 f5 19 1a 9 end..012345...
0140 00 36 37 38 39 30 31 32 33 34 01 0c 03 0a 74 65 .678901234....te
0150 73 74 20 76 73 61 st vsa
When I cut 10 characters from VSA-1, I see this in wireshark:
0000 a6 12 01 01 00 09 00 ff 04 00 00 09 08 00 45 00 ..............E.
0010 01 48 29 e7 00 00 40 11 12 ed 1e 64 00 09 1e 64 .H)...@....d...d
0020 00 01 07 14 fb 89 01 34 05 ae 02 12 01 2c 8e c8 .......4.....,..
0030 ea bd 9f fe 6f a9 e8 fa 57 6b e9 ac 22 6f f5 ff ....o...Wk.."o..
0040 1a 80 00 00 19 7f 01 01 ff 01 e2 30 31 32 33 34 ...........01234
0050 35 36 37 38 39 30 31 32 33 34 35 36 37 38 39 30 5678901234567890
0060 31 32 33 34 35 36 37 38 39 30 31 32 33 34 35 36 1234567890123456
0070 37 38 39 30 31 32 33 34 35 36 37 38 39 30 31 32 7890123456789012
0080 33 34 35 36 37 38 39 30 31 32 33 34 35 36 37 38 3456789012345678
0090 39 30 31 32 33 34 35 36 37 38 39 30 31 32 33 34 9012345678901234
00a0 35 36 37 38 39 30 31 32 33 34 35 36 37 38 39 30 5678901234567890
00b0 31 32 33 34 35 36 37 38 39 30 31 32 33 34 35 36 1234567890123456
00c0 37 38 39 30 31 32 33 34 35 36 37 38 39 30 31 32 7890123456789012
00d0 33 34 35 36 37 38 39 30 31 32 33 34 35 36 37 38 3456789012345678
00e0 39 30 31 32 33 34 35 36 37 38 39 30 31 32 33 34 9012345678901234
00f0 35 36 37 38 39 30 31 32 33 34 35 36 37 38 39 30 5678901234567890
0100 31 32 33 34 35 36 37 38 39 30 31 32 33 34 35 36 1234567890123456
0110 37 38 39 30 31 32 33 34 35 36 37 38 39 30 31 32 7890123456789012
0120 33 34 35 36 37 38 39 20 65 6e 64 02 1b 30 31 32 3456789 end..012
0130 33 34 35 36 37 38 39 30 31 32 33 34 35 f5 19 1a 3456789012345...
0140 00 36 37 38 39 30 31 32 33 34 01 0c 03 0a 74 65 .678901234....te
0150 73 74 20 76 73 61 st vsa
This problem does not occur without the nested TLV, when the dictionary
looks like this:
BEGIN-VENDOR Alcatel-IPD format=Extended-Vendor-Specific-5
ATTRIBUTE Alc-Test-TLV 1 tlv
ATTRIBUTE Alc-Test-VSA-1 1.1 string
ATTRIBUTE Alc-Test-VSA-2 1.2 string
ATTRIBUTE Alc-Test-VSA-3 1.3 string
END-VENDOR Alcatel-IPD
Wireshark dump:
0000 a6 12 01 01 00 09 00 ff 04 00 00 09 08 00 45 00 ..............E.
0010 02 15 29 ed 00 00 40 11 12 1a 1e 64 00 09 1e 64 ..)...@....d...d
0020 00 01 07 14 fb 8f 02 01 82 81 02 18 01 f9 0a 4f ...............O
0030 49 af 75 93 6d cf bc 48 a3 f1 12 f9 99 bc f5 ff I.u.m..H........
0040 1a 80 00 00 19 7f 01 01 e2 30 31 32 33 34 35 36 .........0123456
0050 37 38 39 30 31 32 33 34 35 36 37 38 39 30 31 32 7890123456789012
0060 33 34 35 36 37 38 39 30 31 32 33 34 35 36 37 38 3456789012345678
0070 39 30 31 32 33 34 35 36 37 38 39 30 31 32 33 34 9012345678901234
0080 35 36 37 38 39 30 31 32 33 34 35 36 37 38 39 30 5678901234567890
0090 31 32 33 34 35 36 37 38 39 30 31 32 33 34 35 36 1234567890123456
00a0 37 38 39 30 31 32 33 34 35 36 37 38 39 30 31 32 7890123456789012
00b0 33 34 35 36 37 38 39 30 31 32 33 34 35 36 37 38 3456789012345678
00c0 39 30 31 32 33 34 35 36 37 38 39 30 31 32 33 34 9012345678901234
00d0 35 36 37 38 39 30 31 32 33 34 35 36 37 38 39 30 5678901234567890
00e0 31 32 33 34 35 36 37 38 39 30 31 32 33 34 35 36 1234567890123456
00f0 37 38 39 30 31 32 33 34 35 36 37 38 39 30 31 32 7890123456789012
0100 33 34 35 36 37 38 39 30 31 32 33 34 35 36 37 38 3456789012345678
0110 39 30 31 32 33 34 35 36 37 38 39 30 31 32 33 34 9012345678901234
0120 35 36 37 38 39 20 65 6e 64 02 ec 30 31 32 33 34 56789 end..01234
0130 35 36 37 38 39 30 31 32 33 34 35 36 37 f5 e6 1a 5678901234567...
0140 00 38 39 30 31 32 33 34 35 36 37 38 39 30 31 32 .890123456789012
0150 33 34 35 36 37 38 39 30 31 32 33 34 35 36 37 38 3456789012345678
0160 39 30 31 32 33 34 35 36 37 38 39 30 31 32 33 34 9012345678901234
0170 35 36 37 38 39 30 31 32 33 34 35 36 37 38 39 30 5678901234567890
0180 31 32 33 34 35 36 37 38 39 30 31 32 33 34 35 36 1234567890123456
0190 37 38 39 30 31 32 33 34 35 36 37 38 39 30 31 32 7890123456789012
01a0 33 34 35 36 37 38 39 30 31 32 33 34 35 36 37 38 3456789012345678
01b0 39 30 31 32 33 34 35 36 37 38 39 30 31 32 33 34 9012345678901234
01c0 35 36 37 38 39 30 31 32 33 34 35 36 37 38 39 30 5678901234567890
01d0 31 32 33 34 35 36 37 38 39 30 31 32 33 34 35 36 1234567890123456
01e0 37 38 39 30 31 32 33 34 35 36 37 38 39 30 31 32 7890123456789012
01f0 33 34 35 36 37 38 39 30 31 32 33 34 35 36 37 38 3456789012345678
0200 39 30 31 32 33 34 35 36 37 38 39 30 31 32 33 34 9012345678901234
0210 35 36 37 38 39 20 65 6e 64 03 0a 74 65 73 74 20 56789 end..test
0220 76 73 61 vsa
Is this the expected behavior? Did I do something wrong?
Let me know if you need more information.
Thanks in advance!
Kind regards,
Ruben
