Hi Stefan and list Am 13.10.2015 um 12:20 schrieb Stefan Paetow: [...]

eap2 was removed in v3. See Arran's post here: http://lists.freeradius.org/pipermail/freeradius-users/2014-September/073588... Concluding that the freeradius.org/features/eap.html is in fact outdated in terms of v3.x.

The FreeRADIUS source. If the product doesn't support the EAP type(s) you want to use/support, [...] That's not the question I asked, I asked for the whereabouts saying which rlm_eap driver is considered stable with the current releases.

I have located information with via src/modules/stable and i.e. src/modules/rlm_sql/stable indicating which modules are considered stable and thus built without the --with-experimental configure switch.(Based on Github when selecting v2.2.9 and v3.0.10 release tags) However such a compareable file is not present in src/modules/rlm_eap. Thus I'd have initially reasoned: src/modules/stable contains rlm_eap, so every driver inside should be stable, right? But then I see the outdated webpage features/eap.html ... In case of rlm_eap_ikev2: features/eap.html says it's experimental, but we know it's content likely outdated. I am not very familiar with the codebase, but I've scanned through src/modules/rlm_eap/ and its subfolder rlm_eap_ikev2 on both latest v2.2.9 and v3.0.10 tags and couldn't find a mentioning about it being experimental. I admit: I may have overlooked something, but I've gone back till 2.0.0 where it was was first part of a release.

you're encouraged to contribute this to the FR effort [...]

I am more than willing to contribute an update to that page - as soon I have certain information. :-) I've likely found responsible github repo for this page: https://github.com/FreeRADIUS/www.freeradius.org/blob/master/features/eap.ht... Regards, Mathieu

Hi, Am 13.10.2015 um 14:24 schrieb Alan DeKok:

There is no list of "stable" EAP modules. I suppose one could be added.

EAP-IKE is rarely used. But should work.

EAP-TNC should probably be deleted.

All of the other EAP modules are widely used.

Thanks Alan, let me check if I can provide a pull request for that webpage in order to avoid someone else in the future asking the same question again. :-) -- Mathieu

On Oct 13, 2015, at 1:16 PM, Jouni Malinen <jkmalinen@gmail.com> wrote:

On Tue, Oct 13, 2015 at 3:24 PM, Alan DeKok <aland@deployingradius.com> wrote:

...

EAP-IKE is rarely used. But should work.

Is this still based on the libeap-ikev2 from 2006? If so, please note that I don't think it is compliant with EAP-IKEv2 as defined in RFC 5106.

Done.

I used to have some workaround code in wpa_supplicant to allow interop testing with this implementation (under #ifdef CCNS_PL), but I dropped those last year since there does not seem to be any point in maintaining non-compliant implementation. I would discourage any deployments based on this old implementation unless those compliancy issues with the published RFC are first addressed. As such, I hope that this does not get documented as "working" in FreeRADIUS..

Good point. I think it's worth removing. The only consumer I'm aware of is StrongSWAN, and alternatives for it exist. Alan DeKok.

On 13 Oct 2015, at 15:24, Mathieu Simon (Lists) <matsimon.lists@simweb.ch> wrote:

Hi list

Though (definitely) not the initial intention of this thread, Alan went on and nuked roughly 10k LoC* from the freeradius source code, EAP-TNC and EAP-IKEv2 are gone and the website contains updated information. Thank you!

If the library was not compliant then sure, there's no reason to keep it. But StrongSwan at least still seems to be continuing with TNC work. They have examples for FreeRADIUS... I'm not sure what the advantage of removing EAP-TNC is, as there's very little cost to keeping it in the server. https://wiki.strongswan.org/projects/strongswan/wiki/TrustedNetworkConnect -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2