5.1 Extended Comparison

The default comparison method may fail to recognize duplicate requests. if the originating NAS has modified the request authenticator or request identifier before retransmitting the request. If you happen to use such NASes, you will have to enable extended request comparison to compensate for their deficiencies.

The extended request comparison consists in comparing the contents of both requests. However, blindly comparing each A/V pair from both requests won't work, since many attributes do change their values between successive retransmits. Therefore, radiusd uses only comparable attribute, i.e. a user-defined subset of such attributes that can safely be used in comparison. Thus, extended request comparison works as follows:

1. The comparable attributes are extracted from each request. They form two sorted attribute lists.
2. If lengths of both lists differ, the requests are considered different.
3. Otherwise, the value of each A/V pair from the first list is compared against that of the corresponding A/V pair from the second list. If at least one A/V pair differs, then the requests are considered different. Notice, that values of Password and CHAP-Password are decoded prior to comparison.

To use the extended comparison, follow the procedure below:

1. Select user-defined attribute properties.

   The syntax of dictionary file allows for nine user-defined properties, denoted by characters ‘1’ through ‘9’. You should select one of them to mark comparable attributes for authentication and another one to mark those for accounting. It is strongly suggested that you use PROPERTY statement in your main dictionary file (see section PROPERTY statement), instead of modifying ATTRIBUTE statements in the underlying dictionary files.

   See section ATTRIBUTE statement, for detailed description of attribute property flags.

2. To enable the extended comparison for requests coming from any NAS, declare extended comparison flags in ‘raddb/config’.

   To enable the extended comparison for authentication requests, add to your auth block the statement

   compare-attribute-flag flag;

   The flag is the same symbol you used in the dictionary to mark comparable attributes for authentication.

   To enable the extended comparison for accounting requests, insert compare-attribute-flag statement into the acct block.

3. To enable the extended comparison for requests coming from selected NASes, declare extended comparison flags in ‘raddb/naslist’.

   Add the following statement to the declaration of those NASes, that require using the extended comparison (in flags column):

   compare-auth-flag=flag,compare-acct-flag=flag

   See section NAS List — ‘raddb/naslist’, for a description of naslist file syntax.

This document was generated by Sergey Poznyakoff on December, 6 2008 using texi2html 1.78.