rfc2869.txt

gnu 的radius服务器很好用的

   server will typically return an Access-Accept/EAP-Success message
   without inclusion of the expected attributes currently returned in an
   Access-Accept. This means that the RADIUS server MUST add these
   attributes prior to sending an Access-Accept/EAP-Success message to
   the NAS.

3.  Packet Format

   Packet Format is identical to that defined in RFC 2865 [1] and 2866
   [2].

4.  Packet Types

   Packet types are identical to those defined in RFC 2865 [1] and 2866
   [2].

   See "Table of Attributes" below to determine which types of packets
   can contain which attributes defined here.



Rigney, et al.               Informational                     [Page 19]

RFC 2869                   RADIUS Extensions                   June 2000


5.  Attributes

   RADIUS Attributes carry the specific authentication, authorization
   and accounting details for the request and response.

   Some attributes MAY be included more than once.  The effect of this
   is attribute specific, and is specified in each attribute
   description.  The order of attributes of the same type SHOULD be
   preserved.  The order of attributes of different types is not
   required to be preserved.

   The end of the list of attributes is indicated by the Length of the
   RADIUS packet.

   A summary of the attribute format is the same as in RFC 2865 [1] but
   is included here for ease of reference.  The fields are transmitted
   from left to right.

    0                   1                   2
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Type      |    Length     |  Value ...
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+


   Type

      The Type field is one octet.  Up-to-date values of the RADIUS Type
      field are specified in the most recent "Assigned Numbers" RFC [5].
      Values 192-223 are reserved for experimental use, values 224-240
      are reserved for implementation-specific use, and values 241-255
      are reserved and should not be used.  This specification concerns
      the following values:

           1-39   (refer to RFC 2865 [1], "RADIUS")
          40-51   (refer to RFC 2866 [2], "RADIUS Accounting")
          52      Acct-Input-Gigawords
          53      Acct-Output-Gigawords
          54      Unused
          55      Event-Timestamp
          56-59   Unused
          60-63   (refer to RFC 2865 [1], "RADIUS")
          64-67   (refer to [6])
          68      (refer to [7])
          69      (refer to [6])
          70      ARAP-Password
          71      ARAP-Features
          72      ARAP-Zone-Access



Rigney, et al.               Informational                     [Page 20]

RFC 2869                   RADIUS Extensions                   June 2000


          73      ARAP-Security
          74      ARAP-Security-Data
          75      Password-Retry
          76      Prompt
          77      Connect-Info
          78      Configuration-Token
          79      EAP-Message
          80      Message-Authenticator
          81-83   (refer to [6])
          84      ARAP-Challenge-Response
          85      Acct-Interim-Interval
          86      (refer to [7])
          87      NAS-Port-Id
          88      Framed-Pool
          89      Unused
          90-91   (refer to [6])
          92-191  Unused

   Length

      The Length field is one octet, and indicates the length of this
      attribute including the Type, Length and Value fields.  If an
      attribute is received in a packet with an invalid Length, the
      entire request should be silently discarded.

   Value

      The Value field is zero or more octets and contains information
      specific to the attribute.  The format and length of the Value
      field is determined by the Type and Length fields.

      Note that none of the types in RADIUS terminate with a NUL (hex
      00).  In particular, types "text" and "string" in RADIUS do not
      terminate with a NUL (hex 00).  The Attribute has a length field
      and does not use a terminator.  Text contains UTF-8 encoded 10646
      [8] characters and String contains 8-bit binary data.  Servers and
      servers and clients MUST be able to deal with embedded nulls.
      RADIUS implementers using C are cautioned not to use strcpy() when
      handling strings.

      The format of the value field is one of five data types.  Note
      that type "text" is a subset of type "string."

      text      1-253 octets containing UTF-8 encoded 10646 [8]
                characters. Text of length zero (0) MUST NOT be sent;
                omit the entire attribute instead.





Rigney, et al.               Informational                     [Page 21]

RFC 2869                   RADIUS Extensions                   June 2000


      string    1-253 octets containing binary data (values 0 through
                255 decimal, inclusive). Strings of length zero (0) MUST
                NOT be sent; omit the entire attribute instead.

      address   32 bit unsigned value, most significant octet first.

      integer   32 bit unsigned value, most significant octet first.

      time      32 bit unsigned value, most significant octet first --
                   seconds since 00:00:00 UTC, January 1, 1970.

5.1.  Acct-Input-Gigawords

   Description

      This attribute indicates how many times the Acct-Input-Octets
      counter has wrapped around 2^32 over the course of this service
      being provided, and can only be present in Accounting-Request
      records where the Acct-Status-Type is set to Stop or Interim-
      Update.

   A summary of the Acct-Input-Gigawords attribute format is shown
   below.  The fields are transmitted from left to right.

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Type      |    Length     |             Value
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
              Value (cont)         |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Type

      52 for Acct-Input-Gigawords.

   Length

      6

   Value

      The Value field is four octets.








Rigney, et al.               Informational                     [Page 22]

RFC 2869                   RADIUS Extensions                   June 2000


5.2.  Acct-Output-Gigawords

   Description

      This attribute indicates how many times the Acct-Output-Octets
      counter has wrapped around 2^32 in the course of delivering this
      service, and can only be present in Accounting-Request records
      where the Acct-Status-Type is set to Stop or Interim-Update.

   A summary of the Acct-Output-Gigawords attribute format is shown
   below.  The fields are transmitted from left to right.

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Type      |    Length     |             Value
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
              Value (cont)         |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Type

      53 for Acct-Output-Gigawords.

   Length

      6

   Value

      The Value field is four octets.

5.3.  Event-Timestamp

   Description

      This attribute is included in an Accounting-Request packet to
      record the time that this event occurred on the NAS, in seconds
      since January 1, 1970 00:00 UTC.

   A summary of the Event-Timestamp attribute format is shown below.
   The fields are transmitted from left to right.









Rigney, et al.               Informational                     [Page 23]

RFC 2869                   RADIUS Extensions                   June 2000


    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Type      |    Length     |             Value
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
              Value (cont)         |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Type

      55 for Event-Timestamp

   Length

      6

   Value

      The Value field is four octets encoding an unsigned integer with
      the number of seconds since January 1, 1970 00:00 UTC.

5.4.  ARAP-Password

   Description

      This attribute is only present in an Access-Request packet
      containing a Framed-Protocol of ARAP.

      Only one of User-Password, CHAP-Password, or ARAP-Password needs
      to be present in an Access-Request, or one or more EAP-Messages.

   A summary of the ARAP-Password attribute format is shown below.  The
   fields are transmitted from left to right.

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Type      |    Length     |             Value1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
                                   |             Value2
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
                                   |             Value3
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
                                   |             Value4
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
                                   |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+




Rigney, et al.               Informational                     [Page 24]

RFC 2869                   RADIUS Extensions                   June 2000


   Type

      70 for ARAP-Password.

   Length

      18

   Value

      This attribute contains a 16 octet string, used to carry the
      dial-in user's response to the NAS challenge and the client's own
      challenge to the NAS.  The high-order octets (Value1 and Value2)
      contain the dial-in user's challenge to the NAS (2 32-bit numbers,
      8 octets) and the low-order octets (Value3 and Value4) contain the
      dial-in user's response to the NAS challenge (2 32-bit numbers, 8
      octets).

5.5.  ARAP-Features

   Description

      This attribute is sent in an Access-Accept packet with Framed-
      Protocol of ARAP, and includes password information that the NAS
      should sent to the user in an ARAP "feature flags" packet.

   A summary of the ARAP-Features attribute format is shown below.  The
   fields are transmitted from left to right.

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Type      |    Length     |     Value1    |    Value2     |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                           Value3                              |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                           Value4                              |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                           Value5                              |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Type