rfc2138.txt

gnu 的radius服务器很好用的


RFC 2138                         RADIUS                       April 1997


    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Code      |  Identifier   |            Length             |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                                                               |
   |                     Request Authenticator                     |
   |                                                               |
   |                                                               |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |  Attributes ...
   +-+-+-+-+-+-+-+-+-+-+-+-+-

   Code

      1 for Access-Request.

   Identifier

      The Identifier field MUST be changed whenever the content of the
      Attributes field changes, and whenever a valid reply has been
      received for a previous request.  For retransmissions, the
      Identifier MUST remain unchanged.

   Request Authenticator

      The Request Authenticator value MUST be changed each time a new
      Identifier is used.

   Attributes

      The Attribute field is variable in length, and contains the list
      of Attributes that are required for the type of service, as well
      as any desired optional Attributes.

4.2.  Access-Accept

   Description

      Access-Accept packets are sent by the RADIUS server, and provide
      specific configuration information necessary to begin delivery of
      service to the user.  If all Attribute values received in an
      Access-Request are acceptable then the RADIUS implementation MUST
      transmit a packet with the Code field set to 2 (Access-Accept).







Rigney, et. al.             Standards Track                    [Page 14]

RFC 2138                         RADIUS                       April 1997


      On reception of an Access-Accept, the Identifier field is matched
      with a pending Access-Request.  Additionally, the Response
      Authenticator field MUST contain the correct response for the
      pending Access-Request.  Invalid packets are silently discarded.

   A summary of the Access-Accept packet format is shown below.  The
   fields are transmitted from left to right.

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Code      |  Identifier   |            Length             |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                                                               |
   |                     Response Authenticator                    |
   |                                                               |
   |                                                               |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |  Attributes ...
   +-+-+-+-+-+-+-+-+-+-+-+-+-

   Code

      2 for Access-Accept.

   Identifier

      The Identifier field is a copy of the Identifier field of the
      Access-Request which caused this Access-Accept.

   Response Authenticator

      The Response Authenticator value is calculated from the Access-
      Request value, as described earlier.

   Attributes

      The Attribute field is variable in length, and contains a list of
      zero or more Attributes.












Rigney, et. al.             Standards Track                    [Page 15]

RFC 2138                         RADIUS                       April 1997


4.3.  Access-Reject

   Description

      If any value of the received Attributes is not acceptable, then
      the RADIUS server MUST transmit a packet with the Code field set
      to 3 (Access-Reject).  It MAY include one or more Reply-Message
      Attributes with a text message which the NAS MAY display to the
      user.

   A summary of the Access-Reject packet format is shown below.  The
   fields are transmitted from left to right.

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Code      |  Identifier   |            Length             |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                                                               |
   |                     Response Authenticator                    |
   |                                                               |
   |                                                               |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |  Attributes ...
   +-+-+-+-+-+-+-+-+-+-+-+-+-

   Code

      3 for Access-Reject.

   Identifier

      The Identifier field is a copy of the Identifier field of the
      Access-Request which caused this Access-Reject.

   Response Authenticator

      The Response Authenticator value is calculated from the Access-
      Request value, as described earlier.

   Attributes

      The Attribute field is variable in length, and contains a list of
      zero or more Attributes.







Rigney, et. al.             Standards Track                    [Page 16]

RFC 2138                         RADIUS                       April 1997


4.4.  Access-Challenge

   Description

      If the RADIUS server desires to send the user a challenge
      requiring a response, then the RADIUS server MUST respond to the
      Access-Request by transmitting a packet with the Code field set to
      11 (Access-Challenge).

      The Attributes field MAY have one or more Reply-Message
      Attributes, and MAY have a single State Attribute, or none.  No
      other Attributes are permitted in an Access-Challenge.

      On receipt of an Access-Challenge, the Identifier field is matched
      with a pending Access-Request.  Additionally, the Response
      Authenticator field MUST contain the correct response for the
      pending Access-Request.  Invalid packets are silently discarded.

      If the NAS does not support challenge/response, it MUST treat an
      Access-Challenge as though it had received an Access-Reject
      instead.

      If the NAS supports challenge/response, receipt of a valid
      Access-Challenge indicates that a new Access-Request SHOULD be
      sent.  The NAS MAY display the text message, if any, to the user,
      and then prompt the user for a response.  It then sends its
      original Access-Request with a new request ID and Request
      Authenticator, with the User-Password Attribute replaced by the
      user's response (encrypted), and including the State Attribute
      from the Access-Challenge, if any.  Only 0 or 1 instances of the
      State Attribute can be present in an Access-Request.

      A NAS which supports PAP MAY forward the Reply-Message to the
      dialin client and accept a PAP response which it can use as though
      the user had entered the response.  If the NAS cannot do so, it
      should treat the Access-Challenge as though it had received an
      Access-Reject instead.














Rigney, et. al.             Standards Track                    [Page 17]

RFC 2138                         RADIUS                       April 1997


   A summary of the Access-Challenge packet format is shown below.  The
   fields are transmitted from left to right.

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Code      |  Identifier   |            Length             |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                                                               |
   |                     Response Authenticator                    |
   |                                                               |
   |                                                               |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |  Attributes ...
   +-+-+-+-+-+-+-+-+-+-+-+-+-

   Code

      11 for Access-Challenge.

   Identifier

      The Identifier field is a copy of the Identifier field of the
      Access-Request which caused this Access-Challenge.

   Response Authenticator

      The Response Authenticator value is calculated from the Access-
      Request value, as described earlier.

   Attributes

      The Attributes field is variable in length, and contains a list of
      zero or more Attributes.

5.  Attributes

   RADIUS Attributes carry the specific authentication, authorization,
   information and configuration details for the request and reply.

   Some Attributes MAY be included more than once.  The effect of this
   is Attribute specific, and is specified in each Attribute
   description.

   The end of the list of Attributes is indicated by the Length of the
   RADIUS packet.





Rigney, et. al.             Standards Track                    [Page 18]

RFC 2138                         RADIUS                       April 1997


   A summary of the Attribute format is shown below.  The fields are
   transmitted from left to right.

    0                   1                   2
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
   |     Type      |    Length     |  Value ...
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-

   Type

      The Type field is one octet.  Up-to-date values of the RADIUS Type
      field are specified in the most recent "Assigned Numbers" RFC [3].
      Values 192-223 are reserved for experimental use, values 224-240
      are reserved for implementation-specific use, and values 241-255
      are reserved and should not be used.  This specification concerns
      the following values:

      A RADIUS server MAY ignore Attributes with an unknown Type.

      A RADIUS client MAY ignore Attributes with an unknown Type.

          1      User-Name
          2      User-Password
          3      CHAP-Password
          4      NAS-IP-Address
          5      NAS-Port
          6      Service-Type
          7      Framed-Protocol
          8      Framed-IP-Address
          9      Framed-IP-Netmask
         10      Framed-Routing
         11      Filter-Id
         12      Framed-MTU
         13      Framed-Compression
         14      Login-IP-Host
         15      Login-Service
         16      Login-TCP-Port
         17      (unassigned)
         18      Reply-Message
         19      Callback-Number
         20      Callback-Id
         21      (unassigned)
         22      Framed-Route
         23      Framed-IPX-Network
         24      State
         25      Class
         26      Vendor-Specific



Rigney, et. al.             Standards Track                    [Page 19]

RFC 2138                         RADIUS                       April 1997


         27      Session-Timeout
         28      Idle-Timeout
         29      Termination-Action
         30      Called-Station-Id
         31      Calling-Station-Id
         32      NAS-Identifier
         33      Proxy-State
         34      Login-LAT-Service
         35      Login-LAT-Node
         36      Login-LAT-Group
         37      Framed-AppleTalk-Link
         38      Framed-AppleTalk-Network
         39      Framed-AppleTalk-Zone
         40-59   (reserved for accounting)
         60      CHAP-Challenge
         61      NAS-Port-Type
         62      Port-Limit
         63      Login-LAT-Port

   Length

      The Length field is one octet, and indicates the length of this
      Attribute including the Type, Length and Value fields.  If an
      Attribute is received in an Access-Request but with an invalid
      Length, an Access-Reject SHOULD be transmitted.  If an Attribute