EAP-AKA set-up failure on 4.0 dev. stream
I'm setting up EAP-AKA on 4.0 dev. stream, because I have to set up EAP-AKA. I got the following error. Radiusd -X /// snip /// Loaded module "rlm_eap_aka" aka { /usr/local/etc/raddb/mods-enabled/eap[1190]: Configuration item "network_id" must have a value /usr/local/etc/raddb/mods-enabled/eap[1190]: Failed evaluating configuration for module "rlm_eap_aka" /usr/local/etc/raddb/mods-enabled/eap[15]: Failed evaluating configuration for module "rlm_eap" /usr/local/etc/raddb/mods-enabled# vi eap 1187 ## EAP-AKA 1188 # 1189 # 1190 aka { 1191 1192 } 1193 } /usr/local/src/freeradius-server-4.0.x/src/modules/rlm_eap/types/rlm_eap_aka# find . -type f | xargs grep network_id ./eap_aka.h: char const *network_id; //!< Network ID as described by RFC 5448. ./rlm_eap_aka.c: { FR_CONF_OFFSET("network_id", FR_TYPE_STRING | FR_TYPE_REQUIRED, rlm_eap_aka_t, network_id ) }, ./rlm_eap_aka.c: eap_aka_session->keys.network = (uint8_t *) talloc_bstrndup(eap_aka_session, inst->network_id, ./rlm_eap_aka.c: talloc_array_length(inst->network_id) - 1); It seems ""network_id" must have a value", what should I do for this error? I know it's dev. stream, but any comment would be really appreciated to set it up. Regards,
On Apr 13, 2018, at 8:37 AM, yukou katori <k10lie.gm@gmail.com> wrote:
I'm setting up EAP-AKA on 4.0 dev. stream, because I have to set up EAP-AKA.
I got the following error.
Radiusd -X
/// snip ///
Loaded module "rlm_eap_aka" aka { /usr/local/etc/raddb/mods-enabled/eap[1190]: Configuration item "network_id" must have a value /usr/local/etc/raddb/mods-enabled/eap[1190]: Failed evaluating configuration for module "rlm_eap_aka" /usr/local/etc/raddb/mods-enabled/eap[15]: Failed evaluating configuration for module "rlm_eap"
The module code is written in such a way that it prefers AKA' over AKA. The supplicant can still negotiate EAP-AKA, but the code will include AT_BIDDING indicating that AKA' is supported and should be used. network_id (now network_name to match RFC 5448) is a KDF input parameter which binds EAP-AKA' authentication to a particular access network. We could add manual KDF toggles like we have for TLS versions, and only require network_name be set if an AKA' KDF (i.e. > 0) is allowed. If someone wants to put together a patch for that then i'd be happy to review it. Detail of the network name format are in RFC5448 section 3.1 -Arran
Thank you, Arran I will think about it. I will try to keep you posted. Regards, On 13 April 2018 at 14:29, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On Apr 13, 2018, at 8:37 AM, yukou katori <k10lie.gm@gmail.com> wrote:
I'm setting up EAP-AKA on 4.0 dev. stream, because I have to set up EAP-AKA.
I got the following error.
Radiusd -X
/// snip ///
Loaded module "rlm_eap_aka" aka { /usr/local/etc/raddb/mods-enabled/eap[1190]: Configuration item "network_id" must have a value /usr/local/etc/raddb/mods-enabled/eap[1190]: Failed evaluating configuration for module "rlm_eap_aka" /usr/local/etc/raddb/mods-enabled/eap[15]: Failed evaluating configuration for module "rlm_eap"
The module code is written in such a way that it prefers AKA' over AKA. The supplicant can still negotiate EAP-AKA, but the code will include AT_BIDDING indicating that AKA' is supported and should be used.
network_id (now network_name to match RFC 5448) is a KDF input parameter which binds EAP-AKA' authentication to a particular access network.
We could add manual KDF toggles like we have for TLS versions, and only require network_name be set if an AKA' KDF (i.e. > 0) is allowed.
If someone wants to put together a patch for that then i'd be happy to review it.
Detail of the network name format are in RFC5448 section 3.1
-Arran
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
participants (2)
-
Arran Cudbard-Bell -
yukou katori