RADIUS + EAP AVP Structure

[Bryan Kadzban]

Eliot wrote:
> When an EAP attribute (79) is specified in a RADIUS Access-Challenge,
> what is the structure of the value?

Take a look at a network capture (either Ethereal or MS Network Monitor)
-- that might give some useful information.

In particular, you should note that EAP data sent by the supplicant gets
repackaged into RADIUS attributes by the AP.  And since the length of a
RADIUS attribute is given (in the packet at least) by a single byte, the
maximum length is 255 -- so if the EAP data is longer than 255 bytes,
it'll take up more than one RADIUS attribute.

I'm not sure how each attribute's data is represented, although I would
guess that Ethereal's RADIUS dissector knows.  Perhaps it even knows
well enough to give you the original EAPOL frame.

> Also, if I test the RADIUS attributes, there are two types that 
> interest me. One type is what FreeRADIUS terms "EAP-Message" and that
> is type ID 79.

IIRC, that's the one that contains each piece of the EAP data.  Many of
these can exist in a single RADIUS request (up to the maximum size of a
RADIUS packet, minus any other attributes that have been included).
Microsoft's IAS extension API doesn't have a name for that one, but it's
the one you should be looking for if you're doing EAP from wireless clients.

> The other type is what Microsoft calls ratEAPTLV, which I'm not 
> certain what the number is for that one.

According to:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/ias/ias/radius_attribute_type.asp

the number is 272.  It also says "see the IETF draft for EAP-TLV"
(and gives a 404 link), which I would presume contains part of the EAP
packet's format.  Although I don't know why it doesn't use 79...  maybe
because it's nonstandard?  Many of the other 2xx attributes on that page
seem to be extension attributes; maybe this one is similar.

Maybe you should see if there's anything else helpful in that IAS
extension DLL reference section of MSDN.  Failing that, see if perhaps
your company has a contact with Microsoft who might know who to ask
about stuff like this (like my company did with cert services, when we
had questions about autoenrollment) -- or possibly use a development
support call.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 256 bytes
Desc: OpenPGP digital signature
Url : http://lists.shmoo.com/pipermail/hostap/attachments/20051129/5fe62930/attachment.pgp