Hi All, I am using freeradius-2.2.0 and configure it as EAP authentication server. I met some problem of the EAP authentication. Could you help take a look? Thanks in advance. The phenomenon I encounter in an EAP-SIM exchange is as below, peer denotes the client, and AAA denotes the freeradius. 1. peer-->AAA, with EAP-response (id=0) – in response to EAP-identity 2.AAA-->peer, with EAP-request (id=119) 3.peer-->AAA, with EAP-response(id=119) 4.AAA-->peer, with EAP-request (id=120) 5.peer-->AAA, with EAP-response(id=120) 6. AAA-->peer, Access-Accept, with EAP-success (id=121) EAP-success with id that is different from the one in message #5. Should the client regards the authentication as successful? I found some client did not do in this way and re-send the message 5 (and then AAA replies with access reject), and some client do regard it as success I test with some other AAA server and some indeed do not increase the message id in the EAP-success, and in this case the authentication passed. What’s the standard way then? Thanks very much for the kind help! Thanks and regards, Zhen
Cao,Zhen (cz) wrote:
What’s the standard way then?
RFC 2284 Section 2.2.2 says this for EAP-Success: Identifier The Identifier field is one octet and aids in matching replies to Responses. The Identifier field MUST match the Indentifier field of the Response packet that it is sent in response to. This is what FreeRADIUS does. See src/modules/rlm_eap/eap.c, eap_compose() function. Success and Failure send the same ID. Other EAP packet types increment the ID. Alan DeKok.
On Mon, Feb 4, 2013 at 12:11 PM, Alan DeKok <aland@deployingradius.com> wrote:
Cao,Zhen (cz) wrote:
What’s the standard way then?
RFC 2284 Section 2.2.2 says this for EAP-Success:
Identifier
The Identifier field is one octet and aids in matching replies to Responses. The Identifier field MUST match the Indentifier field of the Response packet that it is sent in response to.
This is what FreeRADIUS does. See src/modules/rlm_eap/eap.c, eap_compose() function. Success and Failure send the same ID. Other EAP packet types increment the ID.
Alan DeKok.
Thank you very much for the quick response. But I am using the fr-2.2.0, and for EAP-SIM to run, we patched it with http://seek-for-android.googlecode.com/files/eap-sim-aka_0.4.1.tar.gz I am going to check the patched code. thanks, cz
Hi Alan, We tested with eap-ttls and eap-tls, there was no id+1 behavior. So i went into the code in eap-sim. src/modules/rlm_eap/types/rlm_eap_sim/rlm_eap_sim.c In functions eap_sim_sendstart(EAP_HANDLER * handler), eap_sim_sendchallenge(EAP_HANDLER * handler), and eap_sim_sendsuccess(EAP_HANDLER * handler), there is code like this ‘*newvp->vp_integer = ess->sim_id++;’ this makes the server uses the increased id when sending out the eap-success. I believe this the cause of the problem. What's your opinion? thanks and regards, zhen On Mon, Feb 4, 2013 at 12:11 PM, Alan DeKok <aland@deployingradius.com> wrote:
Cao,Zhen (cz) wrote:
What’s the standard way then?
RFC 2284 Section 2.2.2 says this for EAP-Success:
Identifier
The Identifier field is one octet and aids in matching replies to Responses. The Identifier field MUST match the Indentifier field of the Response packet that it is sent in response to.
This is what FreeRADIUS does. See src/modules/rlm_eap/eap.c, eap_compose() function. Success and Failure send the same ID. Other EAP packet types increment the ID.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Alan DeKok -
Cao,Zhen (cz)