On 17/3/09 16:26, Jouni Malinen wrote:
On Mon, Mar 16, 2009 at 11:56 PM, Arran Cudbard-Bell <a.cudbard-bell@sussex.ac.uk> wrote:
A magical check box appeared in the XP SP3 and Vista supplicant 'Enable Quarantine Checks'. It'd be a huge win if FR could expose these values so that they were usable for policy decisions.
This requires bit more than just minor changes in parsing additional data and making it available. The PEAP server will need to ask the PEAP peer to start SoH to get the extra data.
Yes I just found the appropriate article on MSDN. So 'Enable Quarantine Checks' just means that the supplicant is willing to participate in SoH, not that it will, unless explicitly requested to by the server.
This needs at least minimal functionality to support sequence of EAP methods inside the PEAP tunnel, but with that done, you should be able to process the SoH TLVs in FreeRADIUS.
There is specification available for all the needed functionality and you should be able to find example code on how to do this in hostapd
Very interesting. Which version/ git branch is this available in ?
(it has experimental support for SoH and it dumps the TLVs received from the client in debug info if you want to run a quick test to see what data is available).
Just found an explanation of the other magical 'Crypto binding' check box. It appears it's used to check that the phase 1 and phase 2 endpoints were actually the same server. Have you done any work this feature ? Many thanks, Arran -- Arran Cudbard-Bell (A.Cudbard-Bell@sussex.ac.uk), Authentication, Authorisation and Accounting Officer, Infrastructure Services (IT Services), E1-1-08, Engineering 1, University Of Sussex, Brighton, BN1 9QT DDI+FAX: +44 1273 873900 | INT: 3900 GPG: 86FF A285 1AA1 EE40 D228 7C2E 71A9 25BB 1E68 54A2