Common Remote Authentication Dial In User Service (RADIUS) Implementation Issues and Suggested Fixes
draft-ietf-radext-fixes-08
Revision differences
Document history
Date | Rev. | By | Action |
---|---|---|---|
2012-08-22
|
08 | (System) | post-migration administrative database adjustment to the Yes position for Jari Arkko |
2012-08-22
|
08 | (System) | post-migration administrative database adjustment to the No Objection position for Lars Eggert |
2007-09-19
|
08 | Amy Vezza | State Changes to RFC Ed Queue from Approved-announcement sent by Amy Vezza |
2007-09-19
|
08 | (System) | IANA Action state changed to No IC from In Progress |
2007-09-19
|
08 | (System) | IANA Action state changed to In Progress |
2007-09-19
|
08 | Amy Vezza | IESG state changed to Approved-announcement sent |
2007-09-19
|
08 | Amy Vezza | IESG has approved the document |
2007-09-19
|
08 | Amy Vezza | Closed "Approve" ballot |
2007-09-19
|
08 | Dan Romascanu | Note field has been cleared by Dan Romascanu |
2007-09-13
|
08 | (System) | New version available: draft-ietf-radext-fixes-08.txt |
2007-09-10
|
08 | Dan Romascanu | A number of editorial changes are being discussed by the WG, see the dialog between Bernard and Alan at https://ops.ietf.org/lists/radiusext/2007/msg00756.html The chairs and the editors … A number of editorial changes are being discussed by the WG, see the dialog between Bernard and Alan at https://ops.ietf.org/lists/radiusext/2007/msg00756.html The chairs and the editors need to decide if they want to issue a revised I-D or include the changes in a note to the RFC Editor |
2007-09-06
|
08 | Lars Eggert | [Ballot Position Update] Position for Lars Eggert has been changed to No Objection from Discuss by Lars Eggert |
2007-09-05
|
07 | (System) | New version available: draft-ietf-radext-fixes-07.txt |
2007-09-04
|
08 | Jari Arkko | [Ballot comment] > The CPE may also require a delegated prefix for its own use, if it is > decrementing the Time To Live (TTL) … [Ballot comment] > The CPE may also require a delegated prefix for its own use, if it is > decrementing the Time To Live (TTL) field of IP headers. In that > case, it should be delegated a prefix by the NAS via the Delegated- > IPv6-Prefix attribute. [RFC4818]. If the CPE is not decrementing > TTL, it does not require a delegated prefix. Time To Live is called Hop Limit in IPv6, and since this is an IPv6 specific Section, perhaps this is the name that you should use. |
2007-09-04
|
08 | Jari Arkko | [Ballot Position Update] Position for Jari Arkko has been changed to Yes from Discuss by Jari Arkko |
2007-08-29
|
06 | (System) | New version available: draft-ietf-radext-fixes-06.txt |
2007-07-25
|
08 | (System) | Sub state has been changed to AD Follow up from New Id Needed |
2007-07-25
|
05 | (System) | New version available: draft-ietf-radext-fixes-05.txt |
2007-07-06
|
08 | (System) | Removed from agenda for telechat - 2007-07-05 |
2007-07-05
|
08 | Amy Vezza | State Changes to IESG Evaluation::Revised ID Needed from IESG Evaluation by Amy Vezza |
2007-07-05
|
08 | David Ward | [Ballot Position Update] New position, No Objection, has been recorded by David Ward |
2007-07-05
|
08 | Lisa Dusseault | [Ballot Position Update] New position, No Objection, has been recorded by Lisa Dusseault |
2007-07-05
|
08 | Ron Bonica | [Ballot Position Update] New position, No Objection, has been recorded by Ron Bonica |
2007-07-05
|
08 | Sam Hartman | [Ballot comment] I am concerned about how this draft seems to break the ability to negotiate future extensions. In particular the recommendation that client should … [Ballot comment] I am concerned about how this draft seems to break the ability to negotiate future extensions. In particular the recommendation that client should treat access-accept with unknown attributes as access-reject seems problematic. However this issue seems to have been discussed sufficiently so this is only a comment. |
2007-07-05
|
08 | Sam Hartman | [Ballot Position Update] New position, No Objection, has been recorded by Sam Hartman |
2007-07-05
|
08 | Mark Townsley | [Ballot Position Update] New position, No Objection, has been recorded by Mark Townsley |
2007-07-05
|
08 | Jon Peterson | [Ballot Position Update] New position, No Objection, has been recorded by Jon Peterson |
2007-07-05
|
08 | Chris Newman | [Ballot Position Update] New position, No Objection, has been recorded by Chris Newman |
2007-07-05
|
08 | Chris Newman | [Ballot comment] Editorial: > inclusion of an Event-Timestampt attribute, for example, then s/Event-Timestampt/Event-Timestamp/ |
2007-07-04
|
08 | Cullen Jennings | [Ballot Position Update] New position, Yes, has been recorded by Cullen Jennings |
2007-07-04
|
08 | Lars Eggert | [Ballot discuss] Section 2.2.1., paragraph 6: > [a] Jitter. To avoid synchronization, a RADIUS client SHOULD > incorporate jitter within its retransmission algorithm. … [Ballot discuss] Section 2.2.1., paragraph 6: > [a] Jitter. To avoid synchronization, a RADIUS client SHOULD > incorporate jitter within its retransmission algorithm. DISCUSS: Please specify how a random factor is to be incorporated into the computation - see Section 9 of draft-ietf-pana-pana for an example. Section 2.2.1., paragraph 7: > [b] Congestive backoff. While it is not necessary for RADIUS client > implementations to implement complex retransmission algorithms, > implementations SHOULD support congestive backoff within the limits > suggested by [RFC2865] Section 2.4. For example, an implementation > SHOULD double the initial retransmission timer until a maximum > retransmission time is reached, after which the client will > failover to another RADIUS server. For example, if the initial > retransmission timer is one second, a maximum retransmission timer > of 16 seconds might be used. DISCUSS: RFC2865 Section 2.4 does not suggests any timer management scheme or timer limits, and I couldn't find this anywhere else in RFC2865, either. Consequently, this document needs to specify the desired mechanism. See RFC2988 for an example of such a mechanism. Section 2.2.2., paragraph 0: > 2.2.2. Duplicate detection and orderly delivery. DISCUSS: This section is all about duplicate detection at the server due to client retransmissions. But any UDP packet can be duplicated in the network. This section should hence also discuss detection of duplicate responses at the client. Section 2.2.2., paragraph 2: > The RADIUS server can detect a duplicate request if it has the > same client source IP address and source UDP port and Identifier > within a short span of time. DISCUSS: I could not find a discussion in RFC2865 on how the Identifier field is to be managed. For duplicate detection, it should be monotonically increasing or similar. If RFC2865 doesn't specify how the Identifier fields is to be used, this document needs to do so if it wants to base duplicate detection on it. Section 2.2.2., paragraph 8: > Each cache entry SHOULD be purged after a period of time. This time > SHOULD be no less than 5 seconds, and no more than 30 seconds. DISCUSS: The Internet MSL is 2 minutes - choosing this as a lower bound will prevent late duplicates from remaining undetected. |
2007-07-03
|
08 | Tim Polk | [Ballot Position Update] New position, No Objection, has been recorded by Tim Polk |
2007-07-03
|
08 | Tim Polk | [Ballot comment] I personally find this text in the last sentence in section 2.1.1 to be unclear: "neither including an authentication attribute nor a Service-Type … [Ballot comment] I personally find this text in the last sentence in section 2.1.1 to be unclear: "neither including an authentication attribute nor a Service-Type attribute" I suggest rewriting this sentence, deleting the double negative for clarity. |
2007-07-03
|
08 | Jari Arkko | [Ballot comment] > This suggests that the User-Name attribute may be ommitted if it is s/ommitted/omitted/ > The CPE may also require a delegated prefix … [Ballot comment] > This suggests that the User-Name attribute may be ommitted if it is s/ommitted/omitted/ > The CPE may also require a delegated prefix for its own use, if it is > decrementing the Time To Live (TTL) field of IP headers. In that > case, it should be delegated a prefix by the NAS via the Delegated- > IPv6-Prefix attribute. [RFC4818]. If the CPE is not decrementing > TTL, it does not require a delegated prefix. Time To Live is called Hop Limit in IPv6, and since this is an IPv6 specific Section, perhaps this is the name that you should use. |
2007-07-03
|
08 | Jari Arkko | [Ballot discuss] This is an overall great document, long overdue, and I will move to a Yes vote once the below issues have been properly … [Ballot discuss] This is an overall great document, long overdue, and I will move to a Yes vote once the below issues have been properly handled. Section 2.2.2 states: > Cache entries MUST also be purged if the server receives an > Access- Request packet that matches a cached Access-Request > packet in source address, source port, RADIUS Identifier, > and receiving socket, but where the Request Authenticator > field is different from the one in the cached packet. This got me thinking about the way that duplicates are detected and the cache entries managed. I re-read RFC 2865 and the draft under consideration, but I did not find clear guidance on this issue. Specifically, what exactly are the requirements for such purging? Do you check for validity of the packet before purging? Check the User-Password attribute which contains the message authentication? It seems inappropriate to purge cache entries before the cryptographic message authentication has been verified. If you do it before verification, it means that an attacker could send a message that purges the cache, and if a real duplicate arrives after this the server will erroneously process the duplicate. But maybe I'm missing something. > In general, it is best for RADIUS clients to err on the side of > caution. On receiving an Access-Accept including an attribute of > unknown Type, a RADIUS client SHOULD assume that it is a potential > service definition, and treat it as an Access-Reject. Unknown VSAs > SHOULD be ignored by RADIUS clients. This is a major change and can have significant negative effects to interoperability. Has this been discussed in the WG and have you found convincing arguments that taking on this rule will not lead to major problems? |
2007-07-03
|
08 | Jari Arkko | [Ballot Position Update] New position, Discuss, has been recorded by Jari Arkko |
2007-07-03
|
08 | Tim Polk | [Ballot comment] I personally find this text in the last sentence in section 2.1.1 to be unclear: "neither including an authentication attribute nor a Service-Type … [Ballot comment] I personally find this text in the last sentence in section 2.1.1 to be unclear: "neither including an authentication attribute nor a Service-Type attribute" ... |
2007-07-03
|
08 | Dan Romascanu | [Note]: 'A revised ID will be needed to solve the issue raised by Lars''s DISCUSS. The PROTO shepherd required for the proposed solutions to be … [Note]: 'A revised ID will be needed to solve the issue raised by Lars''s DISCUSS. The PROTO shepherd required for the proposed solutions to be discussed in the WG.' added by Dan Romascanu |
2007-07-02
|
08 | Magnus Westerlund | [Ballot Position Update] New position, No Objection, has been recorded by Magnus Westerlund |
2007-07-02
|
08 | Lars Eggert | [Ballot discuss] Section 2.2.1., paragraph 6: > [a] Jitter. To avoid synchronization, a RADIUS client SHOULD > incorporate jitter within its retransmission algorithm. … [Ballot discuss] Section 2.2.1., paragraph 6: > [a] Jitter. To avoid synchronization, a RADIUS client SHOULD > incorporate jitter within its retransmission algorithm. DISCUSS: "Jitter" is not the correct term. What is suggested here is to incorporate a random factor into the retransmission timer calculation. This will prevent synchronization, but won't help against congestion collapse, because it doesn't reduce the number of retransmissions over time. Only [b] will address that. Also, please specify how a random factor is to be incorporated into the computation - see Section 9 of draft-ietf-pana-pana for an example. Section 2.2.1., paragraph 7: > [b] Congestive backoff. While it is not necessary for RADIUS client > implementations to implement complex retransmission algorithms, > implementations SHOULD support congestive backoff within the limits > suggested by [RFC2865] Section 2.4. For example, an implementation > SHOULD double the initial retransmission timer until a maximum > retransmission time is reached, after which the client will > failover to another RADIUS server. For example, if the initial > retransmission timer is one second, a maximum retransmission timer > of 16 seconds might be used. DISCUSS: RFC2865 Section 2.4 does not suggests any timer management scheme or timer limits, and I couldn't find this anywhere else in RFC2865, either. Consequently, this document needs to specify the desired mechanism. See RFC2988 for an example of such a mechanism. Section 2.2.2., paragraph 0: > 2.2.2. Duplicate detection and orderly delivery. DISCUSS: This section is all about duplicate detection at the server due to client retransmissions. But any UDP packet can be duplicated in the network. This section should hence also discuss detection of duplicate responses at the client. Section 2.2.2., paragraph 2: > The RADIUS server can detect a duplicate request if it has the > same client source IP address and source UDP port and Identifier > within a short span of time. DISCUSS: I could not find a discussion in RFC2865 on how the Identifier field is to be managed. For duplicate detection, it should be monotonically increasing or similar. If RFC2865 doesn't specify how the Identifier fields is to be used, this document needs to do so if it wants to base duplicate detection on it. Section 2.2.2., paragraph 8: > Each cache entry SHOULD be purged after a period of time. This time > SHOULD be no less than 5 seconds, and no more than 30 seconds. DISCUSS: The Internet MSL is 2 minutes - choosing this as a lower bound will prevent late duplicates from remaining undetected. |
2007-07-02
|
08 | Lars Eggert | [Ballot Position Update] New position, Discuss, has been recorded by Lars Eggert |
2007-06-27
|
08 | Dan Romascanu | State Changes to IESG Evaluation from Waiting for Writeup by Dan Romascanu |
2007-06-27
|
08 | Dan Romascanu | Placed on agenda for telechat - 2007-07-05 by Dan Romascanu |
2007-06-27
|
08 | Dan Romascanu | [Ballot Position Update] New position, Yes, has been recorded for Dan Romascanu |
2007-06-27
|
08 | Dan Romascanu | Ballot has been issued by Dan Romascanu |
2007-06-27
|
08 | Dan Romascanu | Created "Approve" ballot |
2007-06-26
|
04 | (System) | New version available: draft-ietf-radext-fixes-04.txt |
2007-06-07
|
08 | Yoshiko Fong | IANA Last Call Comments: As described in the IANA Considerations section, we understand this document to have NO IANA Actions. |
2007-05-28
|
08 | (System) | State has been changed to Waiting for Writeup from In Last Call by system |
2007-05-17
|
08 | Samuel Weiler | Request for Last Call review by SECDIR is assigned to Joseph Salowey |
2007-05-17
|
08 | Samuel Weiler | Request for Last Call review by SECDIR is assigned to Joseph Salowey |
2007-05-14
|
08 | Amy Vezza | Last call sent |
2007-05-14
|
08 | Amy Vezza | State Changes to In Last Call from Last Call Requested by Amy Vezza |
2007-05-14
|
08 | Dan Romascanu | State Changes to Last Call Requested from Publication Requested by Dan Romascanu |
2007-05-14
|
08 | Dan Romascanu | Last Call was requested by Dan Romascanu |
2007-05-14
|
08 | (System) | Ballot writeup text was added |
2007-05-14
|
08 | (System) | Last call text was added |
2007-05-14
|
08 | (System) | Ballot approval text was added |
2007-04-11
|
08 | Dinara Suleymanova | PROTO Write-up (1.a) Who is the Document Shepherd for this document? Has the Document Shepherd personally reviewed this version of the document and, in particular, … PROTO Write-up (1.a) Who is the Document Shepherd for this document? Has the Document Shepherd personally reviewed this version of the document and, in particular, does he or she believe this version is ready for forwarding to the IESG for publication? Document Shepherd: Bernard Aboba I have personally reviewed the document. (1.b) Has the document had adequate review from both key WG members and key non-WG members? Does the Document Shepherd have any concerns about the depth or breadth of the reviews that have been performed? Yes. This document has been through a WG last call. (1.c) Does the Document Shepherd have concerns that the document needs more review from a particular or broader perspective e.g., security, operational complexity, someone familiar with AAA, internationalization or XML? Document review has focused on the RADEXT WG since the document is about RADIUS protocol issues and fixes. (1.d) Does the Document Shepherd have any specific concerns or issues with this document that the Responsible Area Director and/or the IESG should be aware of? For example, perhaps he or she is uncomfortable with certain parts of the document, or has concerns whether there really is a need for it. In any event, if the WG has discussed those issues and has indicated that it still wishes to advance the document, detail those concerns here. Has an IPR disclosure related to this document been filed? If so, please include a reference to the disclosure and summarize the WG discussion and conclusion on this issue. No concerns. (1.e) How solid is the WG consensus behind this document? Does it represent the strong concurrence of a few individuals, with others being silent, or does the WG as a whole understand and agree with it? There is consensus behind this document. At various points, 8 people have posted review comments or made contributions relating to the document. The issues raised and the resolutions are available for inspection at http://www.drizzle.com/~aboba/RADEXT/ (1.f) Has anyone threatened an appeal or otherwise indicated extreme discontent? If so, please summarise the areas of conflict in separate email messages to the Responsible Area Director. (It should be in a separate email because this questionnaire is entered into the ID Tracker.) No. (1.g) Has the Document Shepherd personally verified that the document satisfies all ID nits? (See http://www.ietf.org/ID-Checklist.html and http://tools.ietf.org/tools/idnits/). Boilerplate checks are not enough; this check needs to be thorough. Has the document met all formal review criteria it needs to, such as the MIB Doctor, media type and URI type reviews? Yes. An output of the run on this revision of the ID by the online nits checker: TBD (1.h) Has the document split its references into normative and informative? Are there normative references to documents that are not ready for advancement or are otherwise in an unclear state? If such normative references exist, what is the strategy for their completion? Are there normative references that are downward references, as described in [RFC3967]? If so, list these downward references to support the Area Director in the Last Call procedure for them [RFC3967]. The document splits normative and informative references. There is a normative reference to an ID that is now in AUTH48. (1.i) Has the Document Shepherd verified that the document IANA consideration section exists and is consistent with the body of the document? If the document specifies protocol extensions, are reservations requested in appropriate IANA registries? Are the IANA registries clearly identified? If the document creates a new registry, does it define the proposed initial contents of the registry and an allocation procedure for future registrations? Does it suggest a reasonable name for the new registry? See [RFC2434]. If the document describes an Expert Review process has Shepherd conferred with the Responsible Area Director so that the IESG can appoint the needed Expert during the IESG Evaluation? This document has no actions for IANA. (1.j) Has the Document Shepherd verified that sections of the document that are written in a formal language, such as XML code, BNF rules, MIB definitions, etc., validate correctly in an automated checker? This document does not contain sections written in a formal language. (1.k) The IESG approval announcement includes a Document Announcement Write-Up. Please provide such a Document Announcement Write-Up? Recent examples can be found in the "Action" announcements for approved documents. The approval announcement contains the following sections: - Technical Summary This document describes common issues seen in RADIUS implementations and suggests some fixes. Where applicable, ambiguities and errors in previous RADIUS specifications are clarified. - Working Group Summary This document originally included issues and fixes relating to RFC 3576, but it was decided that handling that in a separate document (RFC 3576bis) would be more appropriate. During the development of this document, a number of issues required extended discussion, most recently text relating to handling of duplicate detection within RADIUS. - Document Quality This document describes issues that have been raised as a result of the widespread deployment of RADIUS for authentication, authorization and accounting. - Personnel Bernard Aboba is the document shepherd. The responsible Area Director is Dan Romascanu. No IANA expert is needed. |
2007-04-11
|
08 | Dinara Suleymanova | Draft Added by Dinara Suleymanova in state Publication Requested |
2007-04-10
|
03 | (System) | New version available: draft-ietf-radext-fixes-03.txt |
2007-04-04
|
02 | (System) | New version available: draft-ietf-radext-fixes-02.txt |
2007-02-14
|
01 | (System) | New version available: draft-ietf-radext-fixes-01.txt |
2007-01-03
|
00 | (System) | New version available: draft-ietf-radext-fixes-00.txt |