[radext] Question for proxy behavior for bad EAP packets

[Alan DeKok <[e-mail]>]

  The eduroam people have been seeing bad EAP packets coming from some (un-named) wireless controllers.  The packets contain invalid EAP-Message attributes.  It looks like the WLC is:

  * receiving an EAPoL frame

  * extracting the EAP identity, and placing it into the User-Name field

  * creating the rest of the RADIUS packet

  * copying the contents of the EAP-Message attribute from a random buffer instead of from the input EAPoL frame

  I've put some code into FreeRADIUS to block these packets before they get proxied:  https://github.com/FreeRADIUS/freeradius-server/blob/v3.2.x/src/modules/rlm_eap/rlm_eap.c#L563

  i.e. before the server proxies the packets, it checks if EAP-Message contains a valid EAP packet.  If not, the proxy synthesizes an Access-Reject.

  One reason to do this at the proxy is that many educational institutions use a server which will just discard the entire packet.  Which makes the proxy think that the home server is down.  So it's better for the proxy to reject the packets.

  So the question is: Is this good for the proxy to do?

  I can't see any issue with it.  On one hand, the proxy is theoretically not supposed to interfere with authentication methods like this.  However, there is no possible way for the home server to authenticate this user.  The packet contains little other than a User-Name, MAC address, and some VSAs.

  So if we're 100% sure that the home server is going to drop the packet (bad), or reject the packet (better), then it's reasonable to have the proxy synthesize an Access-Reject.

  It's likely that eduroam will be rolling out this behaviour across their network.  The previous behavior of "proxy, and then the home server discards the packet" was causing instabilities, and substantial administrator overhead.  This solution doesn't fix the problem, but it means that misbehaving WLCs don't have the chance to take down the rest of the network.


   Samples of the invalid EAP packets are:

        AVP: t=EAP-Message(79) l=31 Last Segment[1]
            Type: 79
            Length: 31
            [Length: 29]
            EAP fragment: 6c6f63616c00095f7365727669636573075f646e732d7364045f756470		"local._services._dnsd._udp" in DNS label format
...
        AVP: t=EAP-Message(79) l=31 Last Segment[1]
            Type: 79
            Length: 31
            [Length: 29]
            EAP fragment: 436f6c6f72204c617365724a6574204d4650204d323737647720402053		"Color LaserJet MFP M277dw ..."
...
        AVP: t=EAP-Message(79) l=31 Last Segment[1]
            Type: 79
            Length: 31
            [Length: 29]
            EAP fragment: 0000000000000000000000000000000000000000000000000000000000		!!!! all zeroes !!!!