Subject: [eap] Question about proper incrementing of eap-id.

From: [email-masked] ([email-masked])
Date: Thu, 20 Mar 2003 18:17:43 -0500

--=======AEB1997=======
Content-Type: text/plain; x-avg-checked=avg-ok-58FA54BE; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 8bit

I am having a situation with some EAP/RADIUS servers that are rejecting, 
when several
simultaneous connections are being made and the request/responses are being 
intermingled and
the eap/radius server is kicking out a client because a mismatching of the 
eap-ids.

Below is the flow of the messages to three clients trying to connect. 
Client #3
is getting rejected because his eap-id is 48, the same as a challenge
to client#2.

Clients                           NAS                          RADIUS

      <== REQ/IDENT  id:46  Client#1
      <== REQ/IDENT  id:47  Client#2
      <== REQ/IDENT  id:48  Client#3
      Client#2 id:47  RESP/IDENT ==>
                                         id:47  RESP/IDENT ==>
                                        <== REQ/MD5-CHALLENGE id:48
      <== REQ/MD5-CHALLENGE id:48 Client#2
      Client#1 id:46  RESP/IDENT ==>
                                         id:46  RESP/IDENT ==>
                                        <== REQ/MD5-CHALLENGE id:47
      <== REQ/MD5-CHALLENGE id:47 Client#1
      Client#3 id:48  RESP/IDENT ==>
                                         id:48  RESP/IDENT ==>
                                       <== REJECT Client#3

Its happend w/ two vendors radius servers, and I able to track down the 
problem by
getting one of them to do a more verbose dump, and it was saying that "User 
A" failed
challenge sequence, even though the Radius User-Name attribute was "B" .

My questions are:

Is the NAS and RADIUS server generating REQ/RESOP w/ proper incrementing
of the eap-id?

In 2284bis-01m , it says the Identifier space unique to each "session". 
What determines
a "session". How is this applyed over to EAP-over-RADIUS? Where is this 
defined?

The radius attributes that are set User-Name, EAP-Message,Message-Auth 
NAS-IP-Address,
Calling-Station-Id, and two vendor attributes.

--=======AEB1997=======
Content-Type: text/plain; charset=us-ascii; x-avg=cert; x-avg-checked=avg-ok-58FA54BE
Content-Disposition: inline

---

Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.463 / Virus Database: 262 - Release Date: 3/17/2003

--=======AEB1997=======--

---

From: [email-masked] (Jo Hermans)
Date: Fri, 21 Mar 2003 11:07:03 +0100

[email-masked] wrote:

> I am having a situation with some EAP/RADIUS servers that are 
> rejecting, when several
> simultaneous connections are being made and the request/responses are 
> being intermingled and
> the eap/radius server is kicking out a client because a mismatching of 
> the eap-ids.

[snip]

> In 2284bis-01m , it says the Identifier space unique to each 
> "session". What determines
> a "session". How is this applyed over to EAP-over-RADIUS? Where is 
> this defined?
>
The nas has started 3 different "sessions" with the client, for 3 
different clients. The identifier-space is unique for each session, 
which is pretty easy for the NAS to do. The RADIUS server should be able 
to separate the sessions on nas-ipaddress (or nas-identifier), and the 
username or caller-id, according to RFC2869bis-draft10. Since this is 
not not enough (username isn't unique), you can use the nas-port or 
nas-port-id too. Unfortunately, the nas-port isn't unique either (a huge 
mistake in RADIUS if you ask me). Neither is the caller-id.

In my own software, I'm using nas-ipaddress, nas-port, username and 
caller-id, which combination seems to work in all cases so far. But what 
we would really need is a /real/ session-identifier, especially one that 
is globally and temporarily unique. But attribute #44 isn't allowed in 
RADIUS access-requests, although a lot of RANs can be configured to send 
one.

Your RADIUS-server should be able to use username and/or caller-id, but 
clearly doesn't use them.

-- 
Jo Hermans

There are 10 types of people in this world, those who can count in binary and those who can't.