Common Remote Authentication Dial In User Service (RADIUS) Implementation Issues and Suggested Fixes
draft-ietf-radext-fixes-08

A number of editorial changes are being discussed by the WG, see the dialog between Bernard and Alan at https://ops.ietf.org/lists/radiusext/2007/msg00756.html

The chairs and the editors need to decide if they want to issue a revised I-D or include the changes in a note to the RFC Editor

[Ballot comment]
> The CPE may also require a delegated prefix for its own use, if it is
> decrementing the Time To Live (TTL) field of IP headers.  In that
> case, it should be delegated a prefix by the NAS via the Delegated-
> IPv6-Prefix attribute.  [RFC4818].  If the CPE is not decrementing
> TTL, it does not require a delegated prefix.

Time To Live is called Hop Limit in IPv6, and since this is
an IPv6 specific Section, perhaps this is the name that you
should use.

[Ballot comment]
I am concerned about how this draft seems to break the ability to
negotiate future extensions.  In particular the recommendation that
client should treat access-accept with unknown attributes as
access-reject seems problematic.  However this issue seems to have
been discussed sufficiently so this is only a comment.

[Ballot discuss]
Section 2.2.1., paragraph 6:
> [a]  Jitter.  To avoid synchronization, a RADIUS client SHOULD
>      incorporate jitter within its retransmission algorithm.

  DISCUSS: Please specify how a random factor is to be incorporated into the
  computation - see Section 9 of draft-ietf-pana-pana for an example.


Section 2.2.1., paragraph 7:
> [b]  Congestive backoff.  While it is not necessary for RADIUS client
>      implementations to implement complex retransmission algorithms,
>      implementations SHOULD support congestive backoff within the limits
>      suggested by [RFC2865] Section 2.4.  For example, an implementation
>      SHOULD double the initial retransmission timer until a maximum
>      retransmission time is reached, after which the client will
>      failover to another RADIUS server.  For example, if the initial
>      retransmission timer is one second, a maximum retransmission timer
>      of 16 seconds might be used.

  DISCUSS: RFC2865 Section 2.4 does not suggests any timer management
  scheme or timer limits, and I couldn't find this anywhere else in
  RFC2865, either. Consequently, this document needs to specify the
  desired mechanism. See RFC2988 for an example of such a mechanism.


Section 2.2.2., paragraph 0:
> 2.2.2.  Duplicate detection and orderly delivery.

  DISCUSS: This section is all about duplicate detection at the server
  due to client retransmissions. But any UDP packet can be duplicated in
  the network. This section should hence also discuss detection of
  duplicate responses at the client.


Section 2.2.2., paragraph 2:
>      The RADIUS server can detect a duplicate request if it has the
>      same client source IP address and source UDP port and Identifier
>      within a short span of time.

  DISCUSS: I could not find a discussion in RFC2865 on how the
  Identifier field is to be managed. For duplicate detection, it should
  be monotonically increasing or similar. If RFC2865 doesn't specify how
  the Identifier fields is to be used, this document needs to do so if
  it wants to base duplicate detection  on it.


Section 2.2.2., paragraph 8:
>    Each cache entry SHOULD be purged after a period of time.  This time
>    SHOULD be no less than 5 seconds, and no more than 30 seconds.

  DISCUSS: The Internet MSL is 2 minutes - choosing this as a lower
  bound will prevent late duplicates from remaining undetected.

[Ballot comment]
I personally find this text in the last sentence in section 2.1.1 to be unclear:

"neither including an authentication attribute nor a Service-Type attribute"

I suggest rewriting this sentence, deleting the double negative for clarity.

[Ballot comment]
> This suggests that the User-Name attribute may be ommitted if it is

s/ommitted/omitted/

> The CPE may also require a delegated prefix for its own use, if it is
> decrementing the Time To Live (TTL) field of IP headers.  In that
> case, it should be delegated a prefix by the NAS via the Delegated-
> IPv6-Prefix attribute.  [RFC4818].  If the CPE is not decrementing
> TTL, it does not require a delegated prefix.

Time To Live is called Hop Limit in IPv6, and since this is
an IPv6 specific Section, perhaps this is the name that you
should use.

[Ballot discuss]
This is an overall great document, long overdue, and I will
move to a Yes vote once the below issues have been properly
handled.

Section 2.2.2 states:

> Cache entries MUST also be purged if the server receives an
> Access- Request packet that matches a cached Access-Request
> packet in source address, source port, RADIUS Identifier,
> and receiving socket, but where the Request Authenticator
> field is different from the one in the cached packet.

This got me thinking about the way that duplicates are
detected and the cache entries managed. I re-read RFC 2865 and
the draft under consideration, but I did not find clear
guidance on this issue.  Specifically, what exactly are the
requirements for such purging?  Do you check for validity of
the packet before purging? Check the User-Password attribute
which contains the message authentication?

It seems inappropriate to purge cache entries before the
cryptographic message authentication has been verified. If you
do it before verification, it means that an attacker could
send a message that purges the cache, and if a real duplicate
arrives after this the server will erroneously process
the duplicate.

But maybe I'm missing something.

> In general, it is best for RADIUS clients to err on the side of
> caution.  On receiving an Access-Accept including an attribute of
> unknown Type, a RADIUS client SHOULD assume that it is a potential
> service definition, and treat it as an Access-Reject.  Unknown VSAs
> SHOULD be ignored by RADIUS clients.

This is a major change and can have significant
negative effects to interoperability. Has this
been discussed in the WG and have you found
convincing arguments that taking on this rule
will not lead to major problems?

[Ballot comment]
I personally find this text in the last sentence in section 2.1.1 to be unclear:

"neither including an authentication attribute nor a Service-Type attribute"

...

[Note]: 'A revised ID will be needed to solve the issue raised by Lars''s DISCUSS. The PROTO shepherd required for the proposed solutions to be discussed in the WG.' added by Dan Romascanu

[Ballot discuss]
Section 2.2.1., paragraph 6:
> [a]  Jitter.  To avoid synchronization, a RADIUS client SHOULD
>      incorporate jitter within its retransmission algorithm.

  DISCUSS: "Jitter" is not the correct term. What is suggested here is
  to incorporate a random factor into the retransmission timer
  calculation. This will prevent synchronization, but won't help against
  congestion collapse, because it doesn't reduce the number of
  retransmissions over time. Only [b] will address that. Also, please
  specify how a random factor is to be incorporated into the computation
  - see Section 9 of draft-ietf-pana-pana for an example.


Section 2.2.1., paragraph 7:
> [b]  Congestive backoff.  While it is not necessary for RADIUS client
>      implementations to implement complex retransmission algorithms,
>      implementations SHOULD support congestive backoff within the limits
>      suggested by [RFC2865] Section 2.4.  For example, an implementation
>      SHOULD double the initial retransmission timer until a maximum
>      retransmission time is reached, after which the client will
>      failover to another RADIUS server.  For example, if the initial
>      retransmission timer is one second, a maximum retransmission timer
>      of 16 seconds might be used.

  DISCUSS: RFC2865 Section 2.4 does not suggests any timer management
  scheme or timer limits, and I couldn't find this anywhere else in
  RFC2865, either. Consequently, this document needs to specify the
  desired mechanism. See RFC2988 for an example of such a mechanism.


Section 2.2.2., paragraph 0:
> 2.2.2.  Duplicate detection and orderly delivery.

  DISCUSS: This section is all about duplicate detection at the server
  due to client retransmissions. But any UDP packet can be duplicated in
  the network. This section should hence also discuss detection of
  duplicate responses at the client.


Section 2.2.2., paragraph 2:
>      The RADIUS server can detect a duplicate request if it has the
>      same client source IP address and source UDP port and Identifier
>      within a short span of time.

  DISCUSS: I could not find a discussion in RFC2865 on how the
  Identifier field is to be managed. For duplicate detection, it should
  be monotonically increasing or similar. If RFC2865 doesn't specify how
  the Identifier fields is to be used, this document needs to do so if
  it wants to base duplicate detection  on it.


Section 2.2.2., paragraph 8:
>    Each cache entry SHOULD be purged after a period of time.  This time
>    SHOULD be no less than 5 seconds, and no more than 30 seconds.

  DISCUSS: The Internet MSL is 2 minutes - choosing this as a lower
  bound will prevent late duplicates from remaining undetected.

PROTO Write-up

(1.a) Who is the Document Shepherd for this document? Has the Document
Shepherd personally reviewed this version of the document and, in particular,
does he or she believe this version is ready for forwarding to the IESG for
publication?

Document Shepherd: Bernard Aboba
I have personally reviewed the document.

(1.b) Has the document had adequate review from both key WG members and
key non-WG members? Does the Document Shepherd have any concerns
about the depth or breadth of the reviews that have been performed?

Yes. This document has been through a WG last call.

(1.c) Does the Document Shepherd have concerns that the document needs
more review from a particular or broader perspective e.g., security, operational
complexity, someone familiar with AAA, internationalization or XML?

Document review has focused on the RADEXT WG since the document is about
RADIUS protocol issues and fixes.

(1.d) Does the Document Shepherd have any specific concerns or issues with this
document that the Responsible Area Director and/or the IESG should be aware of?
For example, perhaps he or she is uncomfortable with certain parts of the document,
or has concerns whether there really is a need for it. In any event, if the WG has
discussed those issues and has indicated that it still wishes to advance the document,
detail those concerns here. Has an IPR disclosure related to this document been filed?
If so, please include a reference to the disclosure and summarize the WG discussion
and conclusion on this issue.

No concerns.

(1.e) How solid is the WG consensus behind this document? Does it
represent the strong concurrence of a few individuals, with others
being silent, or does the WG as a whole understand and agree with
it?

There is consensus behind this document. At various points,
8 people have posted review comments or made contributions relating
to the document.

The issues raised and the resolutions are available for inspection at
http://www.drizzle.com/~aboba/RADEXT/

(1.f) Has anyone threatened an appeal or otherwise indicated extreme discontent?
If so, please summarise the areas of conflict in separate email messages to the
Responsible Area Director. (It should be in a separate email because this
questionnaire is entered into the ID Tracker.)

No.

(1.g) Has the Document Shepherd personally verified that the document satisfies
all ID nits? (See http://www.ietf.org/ID-Checklist.html and
http://tools.ietf.org/tools/idnits/). Boilerplate checks are not enough; this
check needs to be thorough. Has the document met all formal review criteria it
needs to, such as the MIB Doctor, media type and URI type reviews?

Yes. An output of the run on this revision of the ID by the online nits
checker:

TBD

(1.h) Has the document split its references into normative and informative?
Are there normative references to documents that are not ready for advancement
or are otherwise in an unclear state? If such normative references exist, what
is the strategy for their completion? Are there normative references that are
downward references, as described in [RFC3967]? If so, list these downward
references to support the Area Director in the Last Call procedure for them [RFC3967].

The document splits normative and informative references.
There is a normative reference to an ID that is now in AUTH48.

(1.i) Has the Document Shepherd verified that the document IANA consideration
section exists and is consistent with the body of the document? If the document
specifies protocol extensions, are reservations requested in appropriate IANA
registries? Are the IANA registries clearly identified? If the document creates
a new registry, does it define the proposed initial contents of the registry and
an allocation procedure for future registrations? Does it suggest a reasonable
name for the new registry? See [RFC2434]. If the document describes an Expert
Review process has Shepherd conferred with the Responsible Area Director so
that the IESG can appoint the needed Expert during the IESG Evaluation?

This document has no actions for IANA.

(1.j) Has the Document Shepherd verified that sections of the document that
are written in a formal language, such as XML code, BNF rules, MIB definitions,
etc., validate correctly in an automated checker?

This document does not contain sections written in a formal language.

(1.k) The IESG approval announcement includes a Document Announcement Write-Up.
Please provide such a Document Announcement Write-Up? Recent examples can be
found in the "Action" announcements for approved documents. The approval
announcement contains the following sections:

- Technical Summary

This document describes common issues seen in RADIUS implementations
and suggests some fixes. Where applicable, ambiguities and errors in
previous RADIUS specifications are clarified.

- Working Group Summary

This document originally included issues and fixes relating to RFC 3576, but it
was decided that handling that in a separate document (RFC 3576bis) would be
more appropriate. During the development of this document, a number of issues
required extended discussion, most recently text relating to handling of
duplicate detection within RADIUS.

- Document Quality

This document describes issues that have been raised as a result of the widespread
deployment of RADIUS for authentication, authorization and accounting.

- Personnel

Bernard Aboba is the document shepherd. The responsible Area Director is
Dan Romascanu. No IANA expert is needed.