Subject: [eap] NAK survey

From: [email-masked] (Bernard Aboba)
Date: Sun, 6 Oct 2002 02:37:28 -0700 (PDT)

During the last EAP design team meeting, there were also questions about
the NAK Type (see issues #35 and 36).

Please answer the following questions relating to the operation of your
implementation:

a. May the NAK be sent by the peer in response to any EAP request? For
example, may it be sent in the middle of an EAP method? OR

b. May the NAK be sent by the peer only in response to a method proposal
(e.g. the first EAP Request for a given Type)?

c. Does your implementation tolerate sending more than one Type within a
NAK (e.g. may not recognize additional Types, but doesn't blow up)?

d. Does your implementation permit a NAK to be sent in response to an
Identity Request? If so, what does it do if a NAK is sent?

---

From: [email-masked] (James Carlson)
Date: Mon, 7 Oct 2002 07:13:34 -0400

> Please answer the following questions relating to the operation of your

	ftp://playground.sun.com/pub/eap/index.html

> example, may it be sent in the middle of an EAP method? OR

Yes, it can be sent at any time.

> (e.g. the first EAP Request for a given Type)?

No, at any time.  I don't see how it could be otherwise -- for a
multi-stage method, it's entirely possible to get part way down an
authentication attempt only to discover that some required feature is
missing in the peer and that some other mechanism is necessary.

> NAK (e.g. may not recognize additional Types, but doesn't blow up)?

It ignores any additional Types included in a Nak and uses only the
first one.  (If *no* suggested Type is included with the message, then
it logs this fact, and treats it as a failure of the current message.)

No, it doesn't "blow up," even though including multiple Types (or any
other data) would be a violation of RFC 2284.  ;-}

> Identity Request? If so, what does it do if a NAK is sent?

If the identity of the peer was supplied by explicit configuration,
then it accepts the Nak and continues with authentication using the
suggested Type (if permitted).

If the identity was not supplied by explicit configuration, then it
treats this case as authentication failure, sends EAP Failure, and
shuts down the link.

There's one other case that your survey didn't cover (perhaps it's not
a bone of contention?): what do you do when you get a Nak Type that
isn't one that you want to deal with (either by administrative
configuration or because you don't recognize it)?  I examine my
current state and ask for the "next" possible method on the list,
returning to Identify if I fall off the end.

-- 
James Carlson, Solaris Networking         <[email-masked]>
SUN Microsystems / 1 Network Drive         71.234W   Vox +1 781 442 2084
MS UBUR02-212 / Burlington MA 01803-2757   42.497N   Fax +1 781 442 1677