Fragmented VSA in nested TLV cut in next fragment

Hi everyone, My fragmented VSA in a nested TLV is being cut in the next fragment after 9 characters. RADIUS server version: radiusd: FreeRADIUS Version 3.1.0 (git #fef25aa), for host x86_64-unknown-linux-gnu, built on May 13 2016 at 14:22:49 FreeRADIUS Version 3.1.0 Copyright (C) 1999-2016 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT My RADIUS dictionary contains this: VENDOR Alcatel-IPD 6527 BEGIN-VENDOR Alcatel-IPD format=Extended-Vendor-Specific-5 ATTRIBUTE Alc-Test-TLV 1 tlv ATTRIBUTE Alc-Test-TLV-nested 1.1 tlv ATTRIBUTE Alc-Test-VSA-1 1.1.1 string ATTRIBUTE Alc-Test-VSA-2 1.1.2 string ATTRIBUTE Alc-Test-VSA-3 1.1.3 string END-VENDOR Alcatel-IPD This is the entry in my RADIUS users file: 00:00:01:00:00:01 Auth-Type := Accept Alc-Test-VSA-1 = "01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 end",Alc-Test-VSA-2 = "01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 end", Alc-Test-VSA-3 = "test vsa" The RADIUS server debugging: (1) Received Access-Request Id 71 from 30.100.0.1:64446 to 30.100.0.9:1812 via eth9 length 63 (1) User-Name = "00:00:01:00:00:01" (1) User-Password = "admin" (1) NAS-IP-Address = 1.0.0.1 (1) Running section authorize from file /opt/freeradius-3.1.x/etc/raddb/sites-enabled/default (1) authorize { (1) filter_username { (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) ... (1) } (1) if (&User-Name =~ /@[^@]*@/ ) { (1) ... (1) } (1) if (&User-Name =~ /\.\./ ) { (1) ... (1) } (1) if ((&User-Name =~ /@/) && (&User-Name !~ /@[^.]+(\.[^.]+)+$/) </@[%5e.]+(\.%5b%5e.%5d+)+$/)>) { (1) ... (1) } (1) if (&User-Name =~ /\.$/) { (1) ... (1) } (1) if (&User-Name =~ /@\./) { (1) ... (1) } (1) } # if (&User-Name) (notfound) (1) } # filter_username (notfound) (1) preprocess (ok) (1) chap (noop) (1) mschap (noop) (1) digest (noop) (1) suffix - Checking for suffix after "@" (1) suffix - No '@' in User-Name = "00:00:01:00:00:01", looking up realm NULL (1) suffix - No such realm "NULL" (1) suffix (noop) (1) eap - No EAP-Message, not doing EAP (1) eap (noop) (1) files - Found match "00:00:01:00:00:01" one line 1 of /opt/freeradius-3.1.x/etc/raddb/mods-config/files/authorize (1) files (ok) (1) expiration (noop) (1) logintime (noop) (1) pap - WARNING: Auth-Type already set. Not setting to PAP (1) pap (noop) (1) } # authorize (ok) (1) Using 'Auth-Type = Accept' for authenticate {...} (1) Auth-Type = Accept, accepting the user (1) Running section post-auth from file /opt/freeradius-3.1.x/etc/raddb/sites-enabled/default (1) post-auth { (1) update { (1) &reply: skipped: No values available (1) } # update (noop) (1) exec (noop) (1) remove_reply_message_if_eap { (1) if (&reply:EAP-Message && &reply:Reply-Message) { (1) ... (1) } (1) else { (1) noop (noop) (1) } # else (noop) (1) } # remove_reply_message_if_eap (noop) (1) } # post-auth (noop) (1) Sent Access-Accept Id 71 from 30.100.0.9:1812 to 30.100.0.1:64446 via eth9 length 0 (1) Alc-Test-VSA-1 = "0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 1234567890123456789 end" (1) Alc-Test-VSA-2 = "0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 1234567890123456789 end" (1) Alc-Test-VSA-3 = "test vsa" (1) Finished request Waking up in 4.9 seconds. (1) Cleaning up request packet ID 71 with timestamp +12 Wireshark shows that Alc-Test-VSA-2 is cut: 0000 a6 12 01 01 00 09 00 ff 04 00 00 09 08 00 45 00 ..............E. 0010 01 48 29 e0 00 00 40 11 12 f4 1e 64 00 09 1e 64 .H)...@....d...d 0020 00 01 07 14 fb 82 01 34 c1 14 02 0b 01 2c 2b 2e .......4.....,+. 0030 62 76 e0 63 0a ee 3d ee ec 48 c9 c7 ad 62 f5 ff bv.c..=..H...b.. 0040 1a 80 00 00 19 7f 01 01 ff 01 ec 30 31 32 33 34 ...........01234 0050 35 36 37 38 39 30 31 32 33 34 35 36 37 38 39 30 5678901234567890 0060 31 32 33 34 35 36 37 38 39 30 31 32 33 34 35 36 1234567890123456 0070 37 38 39 30 31 32 33 34 35 36 37 38 39 30 31 32 7890123456789012 0080 33 34 35 36 37 38 39 30 31 32 33 34 35 36 37 38 3456789012345678 0090 39 30 31 32 33 34 35 36 37 38 39 30 31 32 33 34 9012345678901234 00a0 35 36 37 38 39 30 31 32 33 34 35 36 37 38 39 30 5678901234567890 00b0 31 32 33 34 35 36 37 38 39 30 31 32 33 34 35 36 1234567890123456 00c0 37 38 39 30 31 32 33 34 35 36 37 38 39 30 31 32 7890123456789012 00d0 33 34 35 36 37 38 39 30 31 32 33 34 35 36 37 38 3456789012345678 00e0 39 30 31 32 33 34 35 36 37 38 39 30 31 32 33 34 9012345678901234 00f0 35 36 37 38 39 30 31 32 33 34 35 36 37 38 39 30 5678901234567890 0100 31 32 33 34 35 36 37 38 39 30 31 32 33 34 35 36 1234567890123456 0110 37 38 39 30 31 32 33 34 35 36 37 38 39 30 31 32 7890123456789012 0120 33 34 35 36 37 38 39 30 31 32 33 34 35 36 37 38 3456789012345678 0130 39 20 65 6e 64 02 11 30 31 32 33 34 35 f5 19 1a 9 end..012345... 0140 00 36 37 38 39 30 31 32 33 34 01 0c 03 0a 74 65 .678901234....te 0150 73 74 20 76 73 61 st vsa When I cut 10 characters from VSA-1, I see this in wireshark: 0000 a6 12 01 01 00 09 00 ff 04 00 00 09 08 00 45 00 ..............E. 0010 01 48 29 e7 00 00 40 11 12 ed 1e 64 00 09 1e 64 .H)...@....d...d 0020 00 01 07 14 fb 89 01 34 05 ae 02 12 01 2c 8e c8 .......4.....,.. 0030 ea bd 9f fe 6f a9 e8 fa 57 6b e9 ac 22 6f f5 ff ....o...Wk.."o.. 0040 1a 80 00 00 19 7f 01 01 ff 01 e2 30 31 32 33 34 ...........01234 0050 35 36 37 38 39 30 31 32 33 34 35 36 37 38 39 30 5678901234567890 0060 31 32 33 34 35 36 37 38 39 30 31 32 33 34 35 36 1234567890123456 0070 37 38 39 30 31 32 33 34 35 36 37 38 39 30 31 32 7890123456789012 0080 33 34 35 36 37 38 39 30 31 32 33 34 35 36 37 38 3456789012345678 0090 39 30 31 32 33 34 35 36 37 38 39 30 31 32 33 34 9012345678901234 00a0 35 36 37 38 39 30 31 32 33 34 35 36 37 38 39 30 5678901234567890 00b0 31 32 33 34 35 36 37 38 39 30 31 32 33 34 35 36 1234567890123456 00c0 37 38 39 30 31 32 33 34 35 36 37 38 39 30 31 32 7890123456789012 00d0 33 34 35 36 37 38 39 30 31 32 33 34 35 36 37 38 3456789012345678 00e0 39 30 31 32 33 34 35 36 37 38 39 30 31 32 33 34 9012345678901234 00f0 35 36 37 38 39 30 31 32 33 34 35 36 37 38 39 30 5678901234567890 0100 31 32 33 34 35 36 37 38 39 30 31 32 33 34 35 36 1234567890123456 0110 37 38 39 30 31 32 33 34 35 36 37 38 39 30 31 32 7890123456789012 0120 33 34 35 36 37 38 39 20 65 6e 64 02 1b 30 31 32 3456789 end..012 0130 33 34 35 36 37 38 39 30 31 32 33 34 35 f5 19 1a 3456789012345... 0140 00 36 37 38 39 30 31 32 33 34 01 0c 03 0a 74 65 .678901234....te 0150 73 74 20 76 73 61 st vsa This problem does not occur without the nested TLV, when the dictionary looks like this: BEGIN-VENDOR Alcatel-IPD format=Extended-Vendor-Specific-5 ATTRIBUTE Alc-Test-TLV 1 tlv ATTRIBUTE Alc-Test-VSA-1 1.1 string ATTRIBUTE Alc-Test-VSA-2 1.2 string ATTRIBUTE Alc-Test-VSA-3 1.3 string END-VENDOR Alcatel-IPD Wireshark dump: 0000 a6 12 01 01 00 09 00 ff 04 00 00 09 08 00 45 00 ..............E. 0010 02 15 29 ed 00 00 40 11 12 1a 1e 64 00 09 1e 64 ..)...@....d...d 0020 00 01 07 14 fb 8f 02 01 82 81 02 18 01 f9 0a 4f ...............O 0030 49 af 75 93 6d cf bc 48 a3 f1 12 f9 99 bc f5 ff I.u.m..H........ 0040 1a 80 00 00 19 7f 01 01 e2 30 31 32 33 34 35 36 .........0123456 0050 37 38 39 30 31 32 33 34 35 36 37 38 39 30 31 32 7890123456789012 0060 33 34 35 36 37 38 39 30 31 32 33 34 35 36 37 38 3456789012345678 0070 39 30 31 32 33 34 35 36 37 38 39 30 31 32 33 34 9012345678901234 0080 35 36 37 38 39 30 31 32 33 34 35 36 37 38 39 30 5678901234567890 0090 31 32 33 34 35 36 37 38 39 30 31 32 33 34 35 36 1234567890123456 00a0 37 38 39 30 31 32 33 34 35 36 37 38 39 30 31 32 7890123456789012 00b0 33 34 35 36 37 38 39 30 31 32 33 34 35 36 37 38 3456789012345678 00c0 39 30 31 32 33 34 35 36 37 38 39 30 31 32 33 34 9012345678901234 00d0 35 36 37 38 39 30 31 32 33 34 35 36 37 38 39 30 5678901234567890 00e0 31 32 33 34 35 36 37 38 39 30 31 32 33 34 35 36 1234567890123456 00f0 37 38 39 30 31 32 33 34 35 36 37 38 39 30 31 32 7890123456789012 0100 33 34 35 36 37 38 39 30 31 32 33 34 35 36 37 38 3456789012345678 0110 39 30 31 32 33 34 35 36 37 38 39 30 31 32 33 34 9012345678901234 0120 35 36 37 38 39 20 65 6e 64 02 ec 30 31 32 33 34 56789 end..01234 0130 35 36 37 38 39 30 31 32 33 34 35 36 37 f5 e6 1a 5678901234567... 0140 00 38 39 30 31 32 33 34 35 36 37 38 39 30 31 32 .890123456789012 0150 33 34 35 36 37 38 39 30 31 32 33 34 35 36 37 38 3456789012345678 0160 39 30 31 32 33 34 35 36 37 38 39 30 31 32 33 34 9012345678901234 0170 35 36 37 38 39 30 31 32 33 34 35 36 37 38 39 30 5678901234567890 0180 31 32 33 34 35 36 37 38 39 30 31 32 33 34 35 36 1234567890123456 0190 37 38 39 30 31 32 33 34 35 36 37 38 39 30 31 32 7890123456789012 01a0 33 34 35 36 37 38 39 30 31 32 33 34 35 36 37 38 3456789012345678 01b0 39 30 31 32 33 34 35 36 37 38 39 30 31 32 33 34 9012345678901234 01c0 35 36 37 38 39 30 31 32 33 34 35 36 37 38 39 30 5678901234567890 01d0 31 32 33 34 35 36 37 38 39 30 31 32 33 34 35 36 1234567890123456 01e0 37 38 39 30 31 32 33 34 35 36 37 38 39 30 31 32 7890123456789012 01f0 33 34 35 36 37 38 39 30 31 32 33 34 35 36 37 38 3456789012345678 0200 39 30 31 32 33 34 35 36 37 38 39 30 31 32 33 34 9012345678901234 0210 35 36 37 38 39 20 65 6e 64 03 0a 74 65 73 74 20 56789 end..test 0220 76 73 61 vsa Is this the expected behavior? Did I do something wrong? Let me know if you need more information. Thanks in advance! Kind regards, Ruben