unlang question

[Norbert Wegener]

I am using a recent 2.0.0-pre cvs snapshot.
For 802.1x authentication AD is querried for  a valid machine account 
and VLAN, which the ldap modules  put into the radius-attribute 
Huntgroup-Name. The client authenticates via a certificate. Everything 
works as expected. Nevertheless someone inspecting the switch logs found:

12277052: .Sep 26 13:33:45.914: RADIUS: Received from id 1645/86 
139.25.78.162:1812, *Access-Challenge,* len 1130
12277053: .Sep 26 13:33:45.914: RADIUS:  authenticator 41 6D FD 2B B1 E6 
81 32 - 92 3A 05 C1 96 B9 A5 E9
12277054: .Sep 26 13:33:45.914: RADIUS:  *Tunnel-Private-Group[81]  18  
"VL-SBS-AD02-0001"
*12277055: .Sep 26 13:33:45.914: RADIUS:  *Tunnel-Medium-Type  [65]  6   
00:ALL_802                [6]
*12277056: .Sep 26 13:33:45.914: RADIUS:  *Tunnel-Type         [64]  6   
00:VLAN                   [13]
*12277057: .Sep 26 13:33:45.914: RADIUS:  EAP-Message         [79]  255

and claimed, the Access-Challenge with Tunnel-Private-Group, 
Tunnel-Medium-Type etc. are not RFC compatible.
I can see those values in radiusd -AX, too, but didn't care.

My question is:
Is he right?
If so: How would I have to change the configuration?


In my sites-enabeld/default I have:
...
   

# ldap1/2 set control:Huntgroup-Name.

        
  redundant {
                        ldap1
                        ldap2
                        }
#####################################################################################################################################
                
                if ("%{sqlnastype:SELECT vl_vlan from vlan where vl_vlan 
= '%{control:Huntgroup-Name}' and vl_nasname='%{NAS-IP-Address}'}" == 
"%{control:Huntgroup-Name}" ) {
                # das vlan gibt es auf dem swicht
                update reply {
                Tunnel-Private-Group-ID ="%{control:Huntgroup-Name}"
                Tunnel-Medium-Type = IEEE-802
                Tunnel-Type = VLAN
                }
                }
..

This works as expected.


Sending Access-Challenge of id 135 to 172.31.110.149 port 1645^M
        Tunnel-Private-Group-Id:0 = "VL-SBS-AD02-0001"^M
        Tunnel-Medium-Type:0 = IEEE-802^M
        Tunnel-Type:0 = VLAN^M
        EAP-Message = 
0x0104040a0dc000001860160301004a02000046030146fa71a8d8d8395908fa88327d699ee4477b8e014f81fc6f5aabfabb26dda89a204f927ec5aaa134ac60f488278826fbd8be697e5826f45b2890e527d58ca26a0a00040016030113710b00136d00136a0005f6308205f2308204daa003020102020a136547850002003ae484300d06092a864886f70d01010505003081f6310b300906035504061302444531133011060a0992268993f22c64011916036e657431173015060a0992268993f22c64011916077369656d656e733110300e060355040a13075369656d656e7331453043060355040b133c49737375696e6720434120666f72206d6163^M
        EAP-Message = 
0x68696e652063657274696669636174657320696e20746865205369656d656e7320414420666f72657374313a3038060355040b1331436f7079726967687420284329205369656d656e73204147203230303320416c6c20726967687473207265736572766564312430220603550403131b5369656d656e732049737375696e6720434120436c617373204144301e170d3037303832323233333131325a170d3038303231383233333131325a3025312330210603550403131a64653730313874632e77773930312e7369656d656e732e6e657430819f300d06092a864886f70d010101050003818d0030818902818100d420d44e29fdfd018e8ff279b4^M
        EAP-Message = 
0x04d0421c8612c6cd6ba909bb50feca6a71089e6212ef9ae86a3a0cd12f201b25e62ec7395e1365a8bac4477551fed6c41183e2210a3b524e013f80952f7f7efef179f6b48d1a7e219a8e0e789d561b8472485f7792a6e51514018b40e1f90feb314aff3d7a55baceb56b72af1d1bb04ee8a4a30203010001a38202d4308202d0301d0603551d0e041604143349edcf20cbe55a68d010a8df8878bbce1714e4303306092b060104018237150a04263024300a06082b06010505070302300a06082b06010505070301300a06082b06010505080202300b0603551d0f0404030205a030270603551d250420301e06082b0601050507030206082b06010505^M
        EAP-Message = 
0x07030106082b06010505080202303c06092b0601040182371507042f302d06252b060104018237150887e4bc2b85a7c80a85d19529a08c6d819ffa1381219eaf36869ee33d020164020103301f0603551d2304183016801453cf2cd0fe413db6c4731640813764d8702909993081e50603551d1f0481dd3081da3081d7a081d4a081d18681ce6c6461703a2f2f2f434e3d5369656d656e7325323049737375696e672532304341253230436c61737325323041442832292c434e3d6d63686d393335612c434e3d4344502c434e3d5075626c69632532304b657925323053657276696365732c434e3d53657276696365732c434e3d436f6e6669677572^M
        EAP-Message = 0x6174696f6e2c44433d7369656d656e732c44433d6e65^M
        Message-Authenticator = 0x00000000000000000000000000000000^M
        State = 0xcf369d304b83244706a446310ed5b92e^M
Finished request 1 state 5^M
Going to the next request^M


The complete output can be found at http://www.wegener-net.de:/freeradius

Norbert Wegener