Hello,
Am 15.07.2013 10:07, schrieb Ralf Paffrath:
...
> anyway it's a bit proprietary that Radiator ignores the correct identifier in
> an Access-Reject packet.
>
> The Identifier is also part of RFC2865:
> Identifier
> The Identifier field is one octet, and aids in matching requests
> and replies. The RADIUS server can detect a duplicate request if
> it has the same client source IP address and source UDP port and
> Identifier within a short span of time.
in case of connection oriented RADSEC/TCP proxying, it's problem to
decide on client addresses and client ports, It's always the same peer
socket and 8 bits can be very soon to short on a heavy used proxy
connection.
RADSEC/TCP or RADIUS/TCP came after RFC-2865, maybe we should make
an RFC addendum, that Proxy-State MUST ALWAYS be replied, even in
Status-Server requests.
Meanwhile we could/should add a config flag in radsecproxy to allow
this.
Best Regards
Charly
--
Karl Gaissmaier
Universität Ulm / Germany
_______________________________________________
radiator mailing list
radiator@open.com.au
http://www.open.com.au/mailman/listinfo/radiator
