Hi all, I have a question regarding Vendor-specific attribute encoding: What type of "smart" encoding are supported by radclient (and thus FreeRADIUS). I mean, I know I can use TLV encoded VSA - as described in the RFC, for example: WISPr-Redirection-URL=http://www.google.fr or Cisco-Account-Info=QT600 For VSA encoded only with Vendor-ID and String, I can use the syntax: Vendor-Specific=0x00000009FC140256305a31393939406f72616e67652e6672 (Cisco-Account-Info VSA I believe) I saw a strange dictionary amongst FreeRADIUS dictionaries: for USR robotics dictionay.usr It is talking about a NMC encoding, and the follinwg is added after the vendor id declaration: "format=4,0" As anyone explanation about this type of encoding?
From my side, I have a vendor (having a vendor-id) that uses the following encoding: RADIUS Attribute Id (1 byte) = 26 RADIUS Attribute Length (1 byte) = total length of attribute value + 2 Vendor ID (4 bytes) A Project Type attribute (1 byte) And as much attributes as possible (up to 248 bytes), using TLV where T is 1 byte and L is 1 byte.
The following scheme shows the attribute encoding. 0 1 2 3 4 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type (26) | Length | Vendor-Id | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Vendor-Id (cont) | Project type | N°Attribute 0 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |AttributeLength| Value Attribute 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ . . . . | N°Attribute n |AttributeLength|. . . +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Value Attribute n . . . . . . . . . . . . . . +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Is FreeRADIUS able to support such encoding method? Or maybe with only one TLV attribute per RADIUS attribute (26 + L + VendorID + ProjectType + TLV)? For the moment, we use the Vendor-Specific=0x00.... method, but as the attributes are standardized with this vendor, we would like to use it, in a smarter way. Sorry if I have been a litte long. Thankyou in advance. Geof.
Geoffroy Arnoud <geoffroy.arnoud@free.fr> wrote:
I saw a strange dictionary amongst FreeRADIUS dictionaries: for USR robotics dictionay.usr It is talking about a NMC encoding, and the follinwg is added after the vendor id declaration: "format=4,0" As anyone explanation about this type of encoding?
It's USR's old format. 4 bytes of attribute type, and no length. The VSA length is used for the length instead.
From my side, I have a vendor (having a vendor-id) that uses the following encoding: RADIUS Attribute Id (1 byte) = 26 RADIUS Attribute Length (1 byte) = total length of attribute value + 2 Vendor ID (4 bytes) A Project Type attribute (1 byte) And as much attributes as possible (up to 248 bytes), using TLV where T is 1 byte and L is 1 byte.
Ugh. What the heck is the "project type"?
Is FreeRADIUS able to support such encoding method? Or maybe with only one TLV attribute per RADIUS attribute (26 + L + VendorID + ProjectType + TLV)?
For now, only with the Vendor-Specific = 0x... method. If the server does support this, what does it do with the project type? It doesn't fit into the normal "Attribute = value" system used by the server. Are there documents from the vendor describing hw they think it should be used? And who the heck comes up with these things? Alan DeKok.
It's USR's old format. 4 bytes of attribute type, and no length. The VSA length is used for the length instead.
Thank you for the info.
Ugh. What the heck is the "project type"?
Actually, the vendor has several "projects", each one owning potentially 256 attributes.
If the server does support this, what does it do with the project type? It doesn't fit into the normal "Attribute = value" system used by the server.
I assume that if I had to implement its support, attributes name should be of the form VendorName-ProjectName-AttributeName=foo Thanks. Geof.
Geoffroy Arnoud <garnoud@yahoo.co.uk> wrote:
Actually, the vendor has several "projects", each one owning potentially 256 attributes.
That's fairly dumb. They should just have used 16-bit attributes, which would have been compatible with many RADIUS servers. My suggestion is to fix the clients. I've never seen this before, so there can't be that many clients out there using this crazy format. Fix the clients to use 16-bit attributes, and you won't have to modify the server.
I assume that if I had to implement its support, attributes name should be of the form
VendorName-ProjectName-AttributeName=foo
I guess. You didn't say who the vendor is, and you didn't answer my question about existing vendor documentation, so I'd say you're on you're own. But honestly, don't change the server. The VSA format is wrong. Fix the clients. It's a LOT easier to fix the clients now than to maintain a site-specific patch to FreeRADIUS. Alan DeKok.
participants (3)
-
Alan DeKok -
Geoffroy Arnoud -
Geoffroy Arnoud