From: Felix Windt Date: 2007-10-27T21:08:24+09:00 Subject: Re: Ruby Radius Dictionary ------=_NextPart_000_0895_01C81856.B1C6A9A0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit > -----Original Message----- > From: list-bounce@example.com > [mailto:list-bounce@example.com] On Behalf Of Aby azid Abu bakar > Sent: Friday, October 26, 2007 7:31 PM > To: ruby-talk ML > Subject: Re: Ruby Radius Dictionary > > I'm still new with radius protocol. Does the dictionary in > radius client > have to be the same as dictionary in Radius Server?. I > checked packet.rb > and found comment that the coding is referring to RFC 2138. The > dictionary in the Radius server is following the RFC 2865. > Could this be > the problem? > > Thanks > > -- > Posted via http://www.ruby-forum.com/. This is how dictionaries work: A RADIUS packet is made up of a header and a payload. The header has the following structure: [ Code - 1 Octet ][ Identifier - 1 Octet ][ Length - 2 Octets ][ Authenticator - 16 Octets ] Where the code is one of 1 - Access-Request, 2 - Access-Accept, 3 - Access-Reject, 4 - Accounting-Request, 5 - Accounting-Reponse, 11 Access-Challenge and distinguishes the type of RADIUS packet. The Identifier is used to perform threading and link initial requests and subsequest replies. The Length is the sum of all fields in the packet (much be between 20 and 4096 octets. According to spec, longer messages get trimmed at 4096, shorter ones are thrown away. The Authenticator region is used differently depending on whether the type is a request or a responose and contains either completely random data, or calculated using MD5 hashes on the value of the code, identifier, length and request-authenticator random payload, followed by packet payload and shared secret. The header is followed by the payload, where each attribute and value are transmitted as such: [ Number - 1 Octet ][ Length - > 3 ][ Value - dependent on attribute number ] The Number is between 1 and 255 and is what gets translated by the dictionary. For example, Attribute-Number 39 is translated to "Framed-AppleTalk-Zone" in the standard dictionaries, so that you can refer to it as such instead of using the number. The Length is the length of the attribute-value pair, and must be larger than 3 (1 octet for the Number, 1 octet for the Length, 1 octet for the value) The Value is dependent on the attribute name in that the dictionary also specifies the type of value. An abbribute number is mapped to one of: Integer (INT) (4 Octets, 32-bit unsigned) Enumerated (ENUM) (4 Octets, 32-bit unsigned) IP Address (IPADDR) (4 Octets, 32 bit) Character String (STRING) (1-253 Octets, variable) Date (DATE) (4 Octets, 32-bit unsigned) Binary (BINARY) (1 bit) So a dictionary entry such as 1 User-Name STRING Signifies that Attribute Number 1 can be referred to as 'User-Name' and carries as a value a string between 1 and 253 octets in length. Since that means there can only be 255 higher order RADIUS attributes, there is also the special case of vvendor-specific attributes (VSAs). They have the Attribute-Number 26 and a payload consisting of: [ ID - 4 octets ][ Number - 1 Octet ][ Length > 7 ][ Value - dependent on attribute number ] Which essentially behaves much like an attribute/value pair wrapped in an attribute/value pair, adding a field for the Vendor ID. The vendor ID is coded using NMPECs in network byte ordering and is unique to the vendor, and again described by an entry in a dictionary. So therefore, client and server _strictly_ speaking do not need to implement identical dictionaries, in that they can be free to change values in the second column of format ("Attribute-Number", "Human-Readable String", "Value Kind") so that the client can refer to Attribute-Number 1 as 'User-Name' while the server refers to it as 'Username'. They do, however, usually need to have dictionary entries to be able to refer to the fields in some way. If your server is sending packets with AV-pairs that your client does not have dictionaries for, you'd have to go to a very low level to interpret them on byte level instead of being able to use the Ruby interface, which deals with the pairs once they're translated from the dictionary. Hope that helps, Felix ------=_NextPart_000_0895_01C81856.B1C6A9A0 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIII3jCCAmYw ggHPoAMCAQICEFJ3uelO4AJUNG7Np2ieTWkwDQYJKoZIhvcNAQEFBQAwYjELMAkGA1UEBhMCWkEx JTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQ ZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBMB4XDTA3MDMxMTEzMzk1OVoXDTA4MDMxMDEzMzk1 OVowSjEfMB0GA1UEAxMWVGhhd3RlIEZyZWVtYWlsIE1lbWJlcjEnMCUGCSqGSIb3DQEJARYYZndt YWlsaW5nbGlzdHNAZ21haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDoHQNMSMIi 1fb3BhJdz7Byt8PSeaa/Yx0wJ1BzLj7dJZK+8djBP06HvolZ9IYibnGerNg+LnxXT8tyGUZ0vw0Q f3qSYtuGcYfdm44qVOAtV+fex14uBSmSj8i/QOL+710oSQdPGAJE1L+8N1bLvJAxznsF6tpD5GUZ iPRY1HcloQIDAQABozUwMzAjBgNVHREEHDAagRhmd21haWxpbmdsaXN0c0BnbWFpbC5jb20wDAYD VR0TAQH/BAIwADANBgkqhkiG9w0BAQUFAAOBgQCtXsHSAFBpcohm7/t5Vlak0eySI5c5cghVELhu LyoNMdx+qCyKE4HJoWrr2+id/+YVPfiOaBsxsir3Aeg3DPuCODoafFYErm3OzJV13lRlwKWfrz01 vczScC2VvABk0ZvlQEHA54IJqiV8QoXntlQWaa2NYO3ggalUyaOeNmsk1TCCAy0wggKWoAMCAQIC AQAwDQYJKoZIhvcNAQEEBQAwgdExCzAJBgNVBAYTAlpBMRUwEwYDVQQIEwxXZXN0ZXJuIENhcGUx EjAQBgNVBAcTCUNhcGUgVG93bjEaMBgGA1UEChMRVGhhd3RlIENvbnN1bHRpbmcxKDAmBgNVBAsT H0NlcnRpZmljYXRpb24gU2VydmljZXMgRGl2aXNpb24xJDAiBgNVBAMTG1RoYXd0ZSBQZXJzb25h bCBGcmVlbWFpbCBDQTErMCkGCSqGSIb3DQEJARYccGVyc29uYWwtZnJlZW1haWxAdGhhd3RlLmNv bTAeFw05NjAxMDEwMDAwMDBaFw0yMDEyMzEyMzU5NTlaMIHRMQswCQYDVQQGEwJaQTEVMBMGA1UE CBMMV2VzdGVybiBDYXBlMRIwEAYDVQQHEwlDYXBlIFRvd24xGjAYBgNVBAoTEVRoYXd0ZSBDb25z dWx0aW5nMSgwJgYDVQQLEx9DZXJ0aWZpY2F0aW9uIFNlcnZpY2VzIERpdmlzaW9uMSQwIgYDVQQD ExtUaGF3dGUgUGVyc29uYWwgRnJlZW1haWwgQ0ExKzApBgkqhkiG9w0BCQEWHHBlcnNvbmFsLWZy ZWVtYWlsQHRoYXd0ZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANRp19SwlGRbcelH 2AxRtupykbCEXn0tDY97Et+FJXUodDpCLGMnn5V7S+9+GYcdhuqj3bnOlmQawhRuRKx85o/oTQ9x H0A4pgCjh3j2+ZSGXq3qwF5269kUo11uenwMpUtVfwYZKX+emibVars4JAhqmMex2qOYkf152+Va xBy5AgMBAAGjEzARMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAx+ySfk749Zal Z2IqpPBNEWDQb41gWGGsJrtSNVwIzzD7qEqWih9iQiOMFw/0umScF6xHKd+dmF7SbGBxXKKs3Hnj 524ARx+1DSjoAp3kmv0T9KbZfLH43F8jJgmRgHPQFBveQ6mDJfLmnC8Vyv6mq4oHdYsM3VGEa+T4 0c53ooEwggM/MIICqKADAgECAgENMA0GCSqGSIb3DQEBBQUAMIHRMQswCQYDVQQGEwJaQTEVMBMG A1UECBMMV2VzdGVybiBDYXBlMRIwEAYDVQQHEwlDYXBlIFRvd24xGjAYBgNVBAoTEVRoYXd0ZSBD b25zdWx0aW5nMSgwJgYDVQQLEx9DZXJ0aWZpY2F0aW9uIFNlcnZpY2VzIERpdmlzaW9uMSQwIgYD VQQDExtUaGF3dGUgUGVyc29uYWwgRnJlZW1haWwgQ0ExKzApBgkqhkiG9w0BCQEWHHBlcnNvbmFs LWZyZWVtYWlsQHRoYXd0ZS5jb20wHhcNMDMwNzE3MDAwMDAwWhcNMTMwNzE2MjM1OTU5WjBiMQsw CQYDVQQGEwJaQTElMCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UE AxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWlsIElzc3VpbmcgQ0EwgZ8wDQYJKoZIhvcNAQEBBQAD gY0AMIGJAoGBAMSmPFVzVftOucqZWh5owHUEcJ3f6f+jHuy9zfVb8hp2vX8MOmHyv1HOAdTlUAow 1wJjWiyJFXCO3cnwK4Vaqj9xVsuvPAsH5/EfkTYkKhPPK9Xzgnc9A74r/rsYPge/QIACZNenpruf ZdHFKlSFD0gEf6e20TxhBEAeZBlyYLf7AgMBAAGjgZQwgZEwEgYDVR0TAQH/BAgwBgEB/wIBADBD BgNVHR8EPDA6MDigNqA0hjJodHRwOi8vY3JsLnRoYXd0ZS5jb20vVGhhd3RlUGVyc29uYWxGcmVl bWFpbENBLmNybDALBgNVHQ8EBAMCAQYwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVByaXZhdGVM YWJlbDItMTM4MA0GCSqGSIb3DQEBBQUAA4GBAEiM0VCD6gsuzA2jZqxnD3+vrL7CF6FDlpSdf0wh uPg2H6otnzYvwPQcUCCTcDz9reFhYsPZOhl+hLGZGwDFGguCdJ4lUJRix9sncVcljd2pnDmOjCBP ZV+V2vf3h9bGCE6u9uo05RAaWzVNd+NWIXiC3CEZNd4ksdMdRv9dX2VPMYIC+DCCAvQCAQEwdjBi MQswCQYDVQQGEwJaQTElMCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoG A1UEAxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWlsIElzc3VpbmcgQ0ECEFJ3uelO4AJUNG7Np2ie TWkwCQYFKw4DAhoFAKCCAdgwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUx DxcNMDcxMDI3MTIwMzIwWjAjBgkqhkiG9w0BCQQxFgQUW3nG9j2pYwHekiHDxzgsDU5t1b4wZwYJ KoZIhvcNAQkPMVowWDAKBggqhkiG9w0DBzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAw BwYFKw4DAgcwDQYIKoZIhvcNAwICASgwBwYFKw4DAhowCgYIKoZIhvcNAgUwgYUGCSsGAQQBgjcQ BDF4MHYwYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0 ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBAhBSd7npTuAC VDRuzadonk1pMIGHBgsqhkiG9w0BCRACCzF4oHYwYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRo YXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVl bWFpbCBJc3N1aW5nIENBAhBSd7npTuACVDRuzadonk1pMA0GCSqGSIb3DQEBAQUABIGARDeHa4tl 4oNg8+hEDo9uF6SNfXXTEPS3x8zxfS1gOEt6go4S8P1lZB8whOpYSoqF6aa7IAS21PTc61F163AU pbCkqcojdXnNbIy33U6ntYtNN2m+91GQ3V9QVrtJn8whBR/QVJbfYQgkxsFNByemBX4YEuKrMZeH pvrtQKvLOaEAAAAAAAA= ------=_NextPart_000_0895_01C81856.B1C6A9A0--