Hi Alan, Thank you again for all your hard work on the FreeRADIUS project, the related RFCs, and taking the time to help on the mailing list. It is much appreciated. I see you updated the VSA in the source on github already. I personally agree with you that the attributes should have the Aruba prefix. I'm not sure what it would take to make that happen? I honestly don't recall where exactly I found that dictionary file. Looking at the github code, I do see the ALIAS directive at the bottom. Does this alias directive force the prefix "Aruba"? I was having issues with the older version of FreeRADIUS not accepting the VSA because of conflicting attributes, and the older version didn't accept the ALIAS directive in the dictionary files. This is likely why I manually changed several of the attributes...just to get it "working". I chose octets for the Aruba-MPSK-Lookup-Info datatype with a length of 178 for 2 reasons. 1) The Aruba-MPSK-Lookup-Info attribute is encoded WPA2 EAPOL request data as part of the WPA2 handshake. The returned data is a binary structure that makes more sense when reading as a string of hex values. 2) When doing a packet capture, wireshark indicated a length of 178 bytes for that attribute. I hope this helps. Thanks, Brandon On Sat, Nov 18, 2023 at 8:01 AM Alan DeKok <aland@deployingradius.com> wrote:
On Nov 17, 2023, at 6:26 PM, Brandon Miller <webasdf@gmail.com> wrote:
Attached is my working dictionary file.
With all of the "Aruba-" prefixes removed. :( That's not good.
The dictionaries don't have "namespaces". So if two vendors define an attribute "Foo", then the only way to tell the attributes apart is by name. One attribute is "Vendor1-Foo", and the other attribute is "Vendor2-Foo" But that's minor.
For the Aruba-MPSK-Lookup-Info attribute, why is it marked "octets" instead of "string"? When the attribute is decoded, are the contents ASCII text, or some kind of hex structure?
Do you have a reference for the definition of the attribute?
My Patch:
I'll push a slightly different patch. There's no real reason to limit password attributes to be 128 characters.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html