[RADIATOR] the authenticator in COA Ack not as rfc3576 described
Mike McCauley
mikem at open.com.au
Wed Aug 12 06:51:55 CDT 2009
Hello Jack,
thanks for reporting this.
It was due to a bug in Raditor which has now been fixed in the latest patch
set.
We apologise for any inconvenience.
Cheers.
On Wednesday 12 August 2009 04:10:58 pm Jack Ho wrote:
> Why is it that the authenticator in the COA Ack is the same as the
> authenticator in the COA request?
>
> in rfc 3576,
>
> Response Authenticator
>
> The Authenticator field in a Response packet (e.g. Disconnect-ACK,
> Disconnect-NAK, CoA-ACK, or CoA-NAK) is called the Response
> Authenticator, and contains a one-way MD5 hash calculated over a
> stream of octets consisting of the Code, Identifier, Length, the
> Request Authenticator field from the packet being replied to, and
> the response Attributes if any, followed by the shared secret.
> The resulting 16 octet MD5 hash value is stored in the
> Authenticator field of the Response packet.
>
>
>
> I am configuring my radiusd to ack all incoming coa requests
>
> <Handler Request-Type = Change-Filter-Request>
> <AuthBy INTERNAL>
> DefaultResult accept
> </AuthBy>
> </Handler>
>
>
> Here are the request and ack
>
>
>
> No. Time Source Destination Protocol
> Info 1 0.000000 10.192.17.163 10.192.16.34 RADIUS
> CoA-Request(43) (id=136, l=590)
>
> Frame 1 (632 bytes on wire, 632 bytes captured)
> Arrival Time: Aug 11, 2009 22:44:21.864816000
> [Time delta from previous captured frame: 0.000000000 seconds]
> [Time delta from previous displayed frame: 0.000000000 seconds]
> [Time since reference or first frame: 0.000000000 seconds]
> Frame Number: 1
> Frame Length: 632 bytes
> Capture Length: 632 bytes
> [Frame is marked: False]
> [Protocols in frame: eth:ip:udp:radius]
> [Coloring Rule Name: UDP]
> [Coloring Rule String: udp]
> Ethernet II, Src: SunMicro_31:a1:05 (00:03:ba:31:a1:05), Dst:
> 3com_40:7f:52 (00:01:02:40:7f:52)
> Destination: 3com_40:7f:52 (00:01:02:40:7f:52)
> Address: 3com_40:7f:52 (00:01:02:40:7f:52)
> .... ...0 .... .... .... .... = IG bit: Individual address
> (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique
> address (factory default)
> Source: SunMicro_31:a1:05 (00:03:ba:31:a1:05)
> Address: SunMicro_31:a1:05 (00:03:ba:31:a1:05)
> .... ...0 .... .... .... .... = IG bit: Individual address
> (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique
> address (factory default)
> Type: IP (0x0800)
> Internet Protocol, Src: 10.192.17.163 (10.192.17.163), Dst:
> 10.192.16.34 (10.192.16.34)
> Version: 4
> Header length: 20 bytes
> Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
> 0000 00.. = Differentiated Services Codepoint: Default (0x00)
> .... ..0. = ECN-Capable Transport (ECT): 0
> .... ...0 = ECN-CE: 0
> Total Length: 618
> Identification: 0x1b27 (6951)
> Flags: 0x04 (Don't Fragment)
> 0... = Reserved bit: Not set
> .1.. = Don't fragment: Set
> ..0. = More fragments: Not set
> Fragment offset: 0
> Time to live: 255
> Protocol: UDP (0x11)
> Header checksum: 0x2717 [correct]
> [Good: True]
> [Bad : False]
> Source: 10.192.17.163 (10.192.17.163)
> Destination: 10.192.16.34 (10.192.16.34)
> User Datagram Protocol, Src Port: 53560 (53560), Dst Port: radius-dynauth
> (3799) Source port: 53560 (53560)
> Destination port: radius-dynauth (3799)
> Length: 598
> Checksum: 0xd7c1 [correct]
> [Good Checksum: True]
> [Bad Checksum: False]
> Radius Protocol
> Code: CoA-Request (43)
> Packet identifier: 0x88 (136)
> Length: 590
> Authenticator: B27FE9422D7B33E533221618C0EAE0F7
> [The response to this request is in frame 2]
> Attribute Value Pairs
> AVP: l=49 t=Vendor-Specific(26) v=Redback(2352)
> VSA: l=43 t=Unknown-Attribute(196):
> 706F6C6963652D636C6173732D7261746520444154412072...
> Unknown-Attribute:
> 706F6C6963652D636C6173732D7261746520444154412072...
> AVP: l=48 t=Vendor-Specific(26) v=Redback(2352)
> VSA: l=42 t=Unknown-Attribute(196):
> 6D657465722D636C6173732D726174652044415441207261...
> Unknown-Attribute:
> 6D657465722D636C6173732D726174652044415441207261...
> AVP: l=38 t=Vendor-Specific(26) v=Redback(2352)
> VSA: l=32 t=Unknown-Attribute(196):
> 706F6C6963652D636C6173732D6275727374204441544120...
> Unknown-Attribute:
> 706F6C6963652D636C6173732D6275727374204441544120...
> AVP: l=37 t=Vendor-Specific(26) v=Redback(2352)
> VSA: l=31 t=Unknown-Attribute(196):
> 6D657465722D636C6173732D627572737420444154412031...
> Unknown-Attribute:
> 6D657465722D636C6173732D627572737420444154412031...
> AVP: l=35 t=Vendor-Specific(26) v=Redback(2352)
> VSA: l=29 t=Unknown-Attribute(88):
> 64656661756C745F716F735F6D65746572696E675F706F6C...
> Unknown-Attribute:
> 64656661756C745F716F735F6D65746572696E675F706F6C...
> AVP: l=35 t=Vendor-Specific(26) v=Redback(2352)
> VSA: l=29 t=Unknown-Attribute(87):
> 64656661756C745F716F735F706F6C6963696E675F706F6C...
> Unknown-Attribute:
> 64656661756C745F716F735F706F6C6963696E675F706F6C...
> AVP: l=8 t=Vendor-Specific(26) v=Redback(2352)
> VSA: l=2 t=Unknown-Attribute(92):
> Unknown-Attribute: <MISSING>
> AVP: l=8 t=Vendor-Specific(26) v=Redback(2352)
> VSA: l=2 t=Unknown-Attribute(105):
> Unknown-Attribute: <MISSING>
> AVP: l=8 t=Vendor-Specific(26) v=Redback(2352)
> VSA: l=2 t=Unknown-Attribute(89):
> Unknown-Attribute: <MISSING>
> AVP: l=6 t=Idle-Timeout(28): 0
> Idle-Timeout: 0
> AVP: l=6 t=Session-Timeout(27): 0
> Session-Timeout: 0
> AVP: l=2 t=Filter-Id(11):
> Filter-Id:
> AVP: l=8 t=Vendor-Specific(26) v=Redback(2352)
> VSA: l=2 t=Unknown-Attribute(165):
> Unknown-Attribute: <MISSING>
> AVP: l=8 t=Vendor-Specific(26) v=Redback(2352)
> VSA: l=2 t=Unknown-Attribute(107):
> Unknown-Attribute: <MISSING>
> AVP: l=12 t=Vendor-Specific(26) v=Redback(2352)
> VSA: l=6 t=Mcast-Receive(34): Unknown(0)
> Mcast-Receive: Unknown (0)
> AVP: l=8 t=Vendor-Specific(26) v=Redback(2352)
> VSA: l=2 t=Unknown-Attribute(90):
> Unknown-Attribute: <MISSING>
> AVP: l=8 t=Vendor-Specific(26) v=Redback(2352)
> VSA: l=2 t=Unknown-Attribute(156):
> Unknown-Attribute: <MISSING>
> AVP: l=12 t=Vendor-Specific(26) v=Redback(2352)
> VSA: l=6 t=Mcast-MaxGroups(35): 0
> Mcast-MaxGroups: 0
> AVP: l=8 t=Vendor-Specific(26) v=Redback(2352)
> VSA: l=2 t=Unknown-Attribute(101):
> Unknown-Attribute: <MISSING>
> AVP: l=12 t=Vendor-Specific(26) v=Redback(2352)
> VSA: l=6 t=Mcast-Send(33): Unknown(0)
> Mcast-Send: Unknown (0)
> AVP: l=8 t=Vendor-Specific(26) v=Redback(2352)
> VSA: l=2 t=Unknown-Attribute(157):
> Unknown-Attribute: <MISSING>
> AVP: l=5 t=User-Name(1): joe
> User-Name: joe
> AVP: l=27 t=Acct-Session-Id(44): 0203FFFF38001BAD-487587C7
> Acct-Session-Id: 0203FFFF38001BAD-487587C7
> AVP: l=2 t=Class(25):
> Class: <MISSING>
> AVP: l=147 t=Class(25):
> 5242414B5F434C4153535F313A5974394D36744E466A4B65...
> Class: 5242414B5F434C4153535F313A5974394D36744E466A4B65...
> AVP: l=12 t=Vendor-Specific(26) v=Redback(2352)
> VSA: l=6 t=Unknown-Attribute(113): 696E3A30
> Unknown-Attribute: 696E3A30
> AVP: l=13 t=Vendor-Specific(26) v=Redback(2352)
> VSA: l=7 t=Unknown-Attribute(113): 6F75743A30
> Unknown-Attribute: 6F75743A30
>
> 0000 00 01 02 40 7f 52 00 03 ba 31 a1 05 08 00 45 00 ... at .R...1....E.
> 0010 02 6a 1b 27 40 00 ff 11 27 17 0a c0 11 a3 0a c0 .j.'@...'.......
> 0020 10 22 d1 38 0e d7 02 56 d7 c1 2b 88 02 4e b2 7f .".8...V..+..N..
> 0030 e9 42 2d 7b 33 e5 33 22 16 18 c0 ea e0 f7 1a 31 .B-{3.3".......1
> 0040 00 00 09 30 c4 2b 70 6f 6c 69 63 65 2d 63 6c 61 ...0.+police-cla
> 0050 73 73 2d 72 61 74 65 20 44 41 54 41 20 72 61 74 ss-rate DATA rat
> 0060 65 2d 61 62 73 6f 6c 75 74 65 20 31 30 32 34 1a e-absolute 1024.
> 0070 30 00 00 09 30 c4 2a 6d 65 74 65 72 2d 63 6c 61 0...0.*meter-cla
> 0080 73 73 2d 72 61 74 65 20 44 41 54 41 20 72 61 74 ss-rate DATA rat
> 0090 65 2d 61 62 73 6f 6c 75 74 65 20 31 30 32 34 1a e-absolute 1024.
> 00a0 26 00 00 09 30 c4 20 70 6f 6c 69 63 65 2d 63 6c &...0. police-cl
> 00b0 61 73 73 2d 62 75 72 73 74 20 44 41 54 41 20 31 ass-burst DATA 1
> 00c0 32 38 30 30 30 1a 25 00 00 09 30 c4 1f 6d 65 74 28000.%...0..met
> 00d0 65 72 2d 63 6c 61 73 73 2d 62 75 72 73 74 20 44 er-class-burst D
> 00e0 41 54 41 20 31 32 38 30 30 30 1a 23 00 00 09 30 ATA 128000.#...0
> 00f0 58 1d 64 65 66 61 75 6c 74 5f 71 6f 73 5f 6d 65 X.default_qos_me
> 0100 74 65 72 69 6e 67 5f 70 6f 6c 69 63 79 1a 23 00 tering_policy.#.
> 0110 00 09 30 57 1d 64 65 66 61 75 6c 74 5f 71 6f 73 ..0W.default_qos
> 0120 5f 70 6f 6c 69 63 69 6e 67 5f 70 6f 6c 69 63 79 _policing_policy
> 0130 1a 08 00 00 09 30 5c 02 1a 08 00 00 09 30 69 02 .....0\......0i.
> 0140 1a 08 00 00 09 30 59 02 1c 06 00 00 00 00 1b 06 .....0Y.........
> 0150 00 00 00 00 0b 02 1a 08 00 00 09 30 a5 02 1a 08 ...........0....
> 0160 00 00 09 30 6b 02 1a 0c 00 00 09 30 22 06 00 00 ...0k......0"...
> 0170 00 00 1a 08 00 00 09 30 5a 02 1a 08 00 00 09 30 .......0Z......0
> 0180 9c 02 1a 0c 00 00 09 30 23 06 00 00 00 00 1a 08 .......0#.......
> 0190 00 00 09 30 65 02 1a 0c 00 00 09 30 21 06 00 00 ...0e......0!...
> 01a0 00 00 1a 08 00 00 09 30 9d 02 01 05 6a 6f 65 2c .......0....joe,
> 01b0 1b 30 32 30 33 46 46 46 46 33 38 30 30 31 42 41 .0203FFFF38001BA
> 01c0 44 2d 34 38 37 35 38 37 43 37 19 02 19 93 52 42 D-487587C7....RB
> 01d0 41 4b 5f 43 4c 41 53 53 5f 31 3a 59 74 39 4d 36 AK_CLASS_1:Yt9M6
> 01e0 74 4e 46 6a 4b 65 5a 4d 38 49 64 58 79 38 57 70 tNFjKeZM8IdXy8Wp
> 01f0 57 4c 68 41 74 43 4b 54 39 37 6c 32 43 72 66 44 WLhAtCKT97l2CrfD
> 0200 30 59 6d 45 36 34 66 36 69 32 5a 75 69 61 47 39 0YmE64f6i2ZuiaG9
> 0210 64 73 67 79 77 4e 48 49 67 79 6a 59 5a 49 4c 68 dsgywNHIgyjYZILh
> 0220 62 38 68 32 4e 4c 72 41 2b 38 65 65 78 38 70 6e b8h2NLrA+8eex8pn
> 0230 6d 62 48 49 6f 53 32 4a 76 6a 43 2f 57 76 53 48 mbHIoS2JvjC/WvSH
> 0240 6c 55 37 42 62 74 77 35 78 69 72 6a 41 44 55 35 lU7Bbtw5xirjADU5
> 0250 4e 77 6b 78 42 6c 51 53 68 54 47 61 36 49 3d 1a NwkxBlQShTGa6I=.
> 0260 0c 00 00 09 30 71 06 69 6e 3a 30 1a 0d 00 00 09 ....0q.in:0.....
> 0270 30 71 07 6f 75 74 3a 30 0q.out:0
> No. Time Source Destination Protocol
> Info 2 0.005135 10.192.16.34 10.192.17.163 RADIUS
> CoA-ACK(44) (id=136, l=20)
>
> Frame 2 (62 bytes on wire, 62 bytes captured)
> Arrival Time: Aug 11, 2009 22:44:21.869951000
> [Time delta from previous captured frame: 0.005135000 seconds]
> [Time delta from previous displayed frame: 0.005135000 seconds]
> [Time since reference or first frame: 0.005135000 seconds]
> Frame Number: 2
> Frame Length: 62 bytes
> Capture Length: 62 bytes
> [Frame is marked: False]
> [Protocols in frame: eth:ip:udp:radius]
> [Coloring Rule Name: Checksum Errors]
> [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1
>
> || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1]
>
> Ethernet II, Src: 3com_40:7f:52 (00:01:02:40:7f:52), Dst:
> SunMicro_31:a1:05 (00:03:ba:31:a1:05)
> Destination: SunMicro_31:a1:05 (00:03:ba:31:a1:05)
> Address: SunMicro_31:a1:05 (00:03:ba:31:a1:05)
> .... ...0 .... .... .... .... = IG bit: Individual address
> (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique
> address (factory default)
> Source: 3com_40:7f:52 (00:01:02:40:7f:52)
> Address: 3com_40:7f:52 (00:01:02:40:7f:52)
> .... ...0 .... .... .... .... = IG bit: Individual address
> (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique
> address (factory default)
> Type: IP (0x0800)
> Internet Protocol, Src: 10.192.16.34 (10.192.16.34), Dst:
> 10.192.17.163 (10.192.17.163)
> Version: 4
> Header length: 20 bytes
> Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
> 0000 00.. = Differentiated Services Codepoint: Default (0x00)
> .... ..0. = ECN-Capable Transport (ECT): 0
> .... ...0 = ECN-CE: 0
> Total Length: 48
> Identification: 0x0000 (0)
> Flags: 0x04 (Don't Fragment)
> 0... = Reserved bit: Not set
> .1.. = Don't fragment: Set
> ..0. = More fragments: Not set
> Fragment offset: 0
> Time to live: 64
> Protocol: UDP (0x11)
> Header checksum: 0x0379 [correct]
> [Good: True]
> [Bad : False]
> Source: 10.192.16.34 (10.192.16.34)
> Destination: 10.192.17.163 (10.192.17.163)
> User Datagram Protocol, Src Port: radius-dynauth (3799), Dst Port: 53560
> (53560) Source port: radius-dynauth (3799)
> Destination port: 53560 (53560)
> Length: 28
> Checksum: 0x3772 [incorrect, should be 0xd385 (maybe caused by
> "UDP checksum offload"?)]
> [Good Checksum: False]
> [Bad Checksum: True]
> Radius Protocol
> Code: CoA-ACK (44)
> Packet identifier: 0x88 (136)
> Length: 20
> Authenticator: B27FE9422D7B33E533221618C0EAE0F7
> [This is a response to a request in frame 1]
> [Time from request: 0.005135000 seconds]
>
> 0000 00 03 ba 31 a1 05 00 01 02 40 7f 52 08 00 45 00 ...1..... at .R..E.
> 0010 00 30 00 00 40 00 40 11 03 79 0a c0 10 22 0a c0 .0.. at .@..y..."..
> 0020 11 a3 0e d7 d1 38 00 1c 37 72 2c 88 00 14 b2 7f .....8..7r,.....
> 0030 e9 42 2d 7b 33 e5 33 22 16 18 c0 ea e0 f7 .B-{3.3"......
>
>
>
> the authenticator in both request and response are the same
>
> Authenticator: B27FE9422D7B33E533221618C0EAE0F7
>
> any comment on this?
>
> if i have to use a hook to workaround this, how should it be done.
> i dont do a lot of hook programming.
>
> thanks
> jack
> _______________________________________________
> radiator mailing list
> radiator at open.com.au
> http://www.open.com.au/mailman/listinfo/radiator
--
Mike McCauley mikem at open.com.au
Open System Consultants Pty. Ltd
9 Bulbul Place Currumbin Waters QLD 4223 Australia http://www.open.com.au
Phone +61 7 5598-7474 Fax +61 7 5598-7070
Radiator: the most portable, flexible and configurable RADIUS server
anywhere. SQL, proxy, DBM, files, LDAP, NIS+, password, NT, Emerald,
Platypus, Freeside, TACACS+, PAM, external, Active Directory, EAP, TLS,
TTLS, PEAP, TNC, WiMAX, RSA, Vasco, Yubikey, DIAMETER etc. Full source
on Unix, Windows, MacOSX, Solaris, VMS, NetWare etc.
More information about the radiator
mailing list