RADIUS Filter Rule Attribute
Extracted elements (19)
The NAS-Filter-Rule attribute was created because RFC 2865's Filter-Id attribute requires the NAS to be pre-populated with named filters, making it unusable when the server operator does not know which filters are available on the NAS.
The String field uses IPFilterRule syntax (from RFC 3588 Section 4.3) and the attribute mirrors Diameter NAS-Filter-Rule AVP (400) from RFC 4005 to enable straightforward Diameter/RADIUS interoperability and reuse of an existing, well-defined filter syntax.
A translated Diameter message can exceed the maximum RADIUS packet size (4096 bytes). If a Diameter/RADIUS gateway cannot fit a NAS-Filter-Rule AVP into a RADIUS packet, it responds with Result-Code DIAMETER_RADIUS_AVP_UNTRANSLATABLE (5018) and a Failed-AVP containing the offending AVP; the originating peer should treat this as a terminal error.
Diameter/RADIUS gateways must be configured to translate RADIUS attribute 92 (NAS-Filter-Rule) to Diameter NAS-Filter-Rule AVP (400) and vice versa. When translating from Diameter to RADIUS, rules are NUL-delimited and split on 253-octet boundaries; when translating RADIUS to Diameter, each rule becomes a separate AVP.
Filter rules may be continued across NAS-Filter-Rule attribute boundaries; implementations cannot assume that individual filter rules begin or end on attribute boundaries. On reception, all attributes must be concatenated before splitting on NUL delimiters.
Filter-Id and NAS-Filter-Rule attributes SHOULD NOT appear in the same RADIUS packet, as there are no well-defined precedence rules for combining them and behavior of NASes receiving both is undefined.
If a NAS conforming to this specification receives an Access-Accept packet containing a NAS-Filter-Rule attribute that it cannot apply, it MUST act as though it had received an Access-Reject.
It is RECOMMENDED that a CoA-NAK responding to an unsupported NAS-Filter-Rule attribute include an Error-Cause attribute with value 'Unsupported Attribute' (401).
NAS-Filter-Rule and NAS-Traffic-Rule attributes MUST NOT appear in the same RADIUS packet. If a NAS-Traffic-Rule attribute is present, a NAS implementing this specification MUST silently discard any NAS-Filter-Rule attributes that are present.
The NAS-Filter-Rule attribute SHOULD only be sent to a NAS that is known to support it, because a legacy NAS may silently discard the attribute while permitting unfiltered network access.
The set of NAS-Filter-Rule attributes SHOULD be created by concatenating the individual filter rules separated by a NUL (0x00) octet, then splitting on 253-octet boundaries to obtain the set of attributes.
When translating Diameter NAS-Filter-Rule AVPs to RADIUS NAS-Filter-Rule attributes, the resulting concatenated data SHOULD be split on 253-octet boundaries.
Zero or more NAS-Filter-Rule attributes MAY be sent in Access-Accept, CoA-Request, or Accounting-Request packets; the attribute MUST NOT be present in Access-Request, Access-Reject, or Access-Challenge packets.
The NAS-Filter-Rule attribute (Type 92) carries IPFilterRule-syntax filter rules to be applied for a user. Multiple attributes may appear in a single packet; their String fields are concatenated to form the complete rule set.
Diameter Result-Code value 5018 (DIAMETER_RADIUS_AVP_UNTRANSLATABLE) is allocated in the 5xxx permanent failure range within the Diameter namespace.
RADIUS Attribute Type 92 is assigned to NAS-Filter-Rule in the IANA RADIUS Attribute Types registry (http://www.iana.org/assignments/radius-types). No new registries are created.
Because RADIUS lacks capability negotiation, a server cannot automatically discover whether a NAS supports NAS-Filter-Rule. A non-compliant NAS may silently discard the attribute while granting unfiltered access, so the attribute should only be sent to NASes known to support it.
RADIUS/Diameter security mechanisms prevent packet spoofing and transit modification, but do not prevent an authorized proxy from maliciously modifying, inserting, or removing attributes. A proxy that removes filter attributes could allow a user unfiltered network access without that being reflected in accounting logs.
The NAS-Filter-Rule attribute has a Type field (1 octet, value 92), a Length field (1 octet, value >= 3), and a String field (one or more octets) containing IPFilterRule-syntax rules separated by NUL (0x00) bytes. Rules may span attribute boundaries.