Encode multiple sub-attributes in single vsa?
Hi, RFC2865 states "Multiple subattributes MAY be encoded within a single Vendor-Specific attribute, although they do not have to be." in section 5.26. Does Freeradius support this? if yes, how to enable it? F.R
Far.Runner wrote:
Hi, RFC2865 states "Multiple subattributes MAY be encoded within a single Vendor-Specific attribute, although they do not have to be." in section 5.26. Does Freeradius support this? if yes, how to enable it?
FreeRADIUS will correctly handle this. It will NOT put multiple sub-attributes into a VSA, because many NASes will break. A better response is: Why do you need this? Alan DeKok.
2012/10/5 Alan DeKok <aland@deployingradius.com>:
FreeRADIUS will correctly handle this. It will NOT put multiple sub-attributes into a VSA, because many NASes will break.
A better response is: Why do you need this?
I need to test a radius client, one test item is to see if the client could handle a VSA includes multiple sub-attrs, so I need a radius server that could generate an access-accept that contains such VSA. Thanks for your answer.
Far.Runner wrote:
I need to test a radius client, one test item is to see if the client could handle a VSA includes multiple sub-attrs, so I need a radius server that could generate an access-accept that contains such VSA.
You can use the Perl RADIUS libraries to create a packet. Or, use "Raw-Attribute" in FreeRADIUS. It puts data into a packet exactly as-is. It means that you do the work of creating a VSA with subattributes, and FreeRADIUS handles all of the signing, packet sending, etc. e.g.: bob Cleartext-Password := "bob" Raw-Attribute = 0x1a1200000001010612345678020612345678" You'll have to create the contents of the VSA by hand. Alan DeKok.
2012/10/6 Alan DeKok <aland@deployingradius.com>:
You can use the Perl RADIUS libraries to create a packet.
Or, use "Raw-Attribute" in FreeRADIUS. It puts data into a packet exactly as-is. It means that you do the work of creating a VSA with subattributes, and FreeRADIUS handles all of the signing, packet sending, etc.
e.g.:
bob Cleartext-Password := "bob" Raw-Attribute = 0x1a1200000001010612345678020612345678"
You'll have to create the contents of the VSA by hand.
Great tip, I think Raw-Attribute should do the work. Thanks!
On Sat, Oct 6, 2012 at 4:03 AM, Alan DeKok <aland@deployingradius.com> wrote:
Or, use "Raw-Attribute" in FreeRADIUS. It puts data into a packet exactly as-is. It means that you do the work of creating a VSA with subattributes, and FreeRADIUS handles all of the signing, packet sending, etc.
e.g.:
bob Cleartext-Password := "bob" Raw-Attribute = 0x1a1200000001010612345678020612345678"
You'll have to create the contents of the VSA by hand.
I have tried Raw-Attribute, but the result packet doesn't contain the synthesized VSA, and there is no error message in "-X" debug output. I search around, and found following in 2.0.2 release notes: "* Added ability send raw attributes via "Raw-Attribute = 0x0102..."This is available only debug builds. It can be used to create invalid packets! Use it with care." so it seems Raw-Attribute only work with a"debug build", but how do I install a "debug build"?
Far Runner wrote:
I have tried Raw-Attribute, but the result packet doesn't contain the synthesized VSA, and there is no error message in "-X" debug output. I search around, and found following in 2.0.2 release notes: "* Added ability send raw attributes via "Raw-Attribute = 0x0102..."This is available only debug builds. It can be used to create invalid packets! Use it with care." so it seems Raw-Attribute only work with a"debug build", but how do I install a "debug build"?
Build it from source, with "./configure --enable-developer" Alan DeKok.
On Wed, Oct 10, 2012 at 8:36 AM, Alan DeKok <aland@deployingradius.com> wrote:
Far Runner wrote:
I have tried Raw-Attribute, but the result packet doesn't contain the synthesized VSA, and there is no error message in "-X" debug output. I search around, and found following in 2.0.2 release notes: "* Added ability send raw attributes via "Raw-Attribute = 0x0102..."This is available only debug builds. It can be used to create invalid packets! Use it with care." so it seems Raw-Attribute only work with a"debug build", but how do I install a "debug build"?
Build it from source, with "./configure --enable-developer"
Interestingly enough, debian packages enable that option while redhat doesn't. What are the performance implications of enabling it? Is it something huge, or only several-percent-penalty and careful-you-can-shoot-yourself-in-the-foot kind of thing? -- Fajar
On 10/10/2012 04:56 AM, Fajar A. Nugraha wrote:
Interestingly enough, debian packages enable that option while redhat doesn't. What are the performance implications of enabling it? Is it something huge, or only several-percent-penalty and careful-you-can-shoot-yourself-in-the-foot kind of thing?
I'm not sure there are any performance implications per-se. If I read the ./configure script correctly, what it primarily does is enable debugging symbols ("-g") and a whole bunch of C warnings. However, debugging symbols are conditionally enabled if the compiler supports them further up anyway, so really it's just the warnings AFACIT.
participants (5)
-
Alan DeKok -
Fajar A. Nugraha -
Far Runner -
Far.Runner
-
Phil Mayers