Subject: [Pana] NEW: [issue78] PBR without EAP-Payload AVP

From: [email-masked]
Date: Mon, 26 Apr 2004 10:14:17 +0300

New submission from Dan Forsberg <[email-masked]>:

From Yoshihiro Ohba:
--------------------
In the EAP state machine draft, there is a case in which a EAP
pass-through authenticator fails authentication without an EAP-Failure
message being forwarded to the EAP peer, i.e., when it enters
TIMEOUT_FAILURE2 state in Figure 7 of
draft-ietf-eap-statemachine-03.pdf.

This means that PANA should allow a PANA-Bind-Request message without
carrying EAP-Payload AVP.  (Another alternative is using a PANA-Error
message instead of PANA-Bind-Request for this case, but PANA-Error
message is not acknowledged and thus not an appropriate solution.)

Proposed changes:

- Add the following paragraph at the end of section 4.3
(Authentication Phase):

"EAP authentication can fail at a pass-through authenticator without
sending an EAP-Failure message [EAP-STATE].  When this occurs, the PAA
MUST send a PANA-Bind-Request message without carrying an EAP-Payload
AVP.  In this case, the Result-Code in the PANA-Bind-Request MUST be
PANA_AUTHENTICATION_REJECTED."

(Is any other error code possible for this case?)

- Add a reference to the EAP state machine draft.

- Make the EAP-Payload AVP optional in the ABNF for PBR, and 
  update the AVP occurrence table accordingly.

----------
category: Technical
document: draft-ietf-pana-pana-xx.txt
messages: 256
nosy: dforsber
priority: Must Fix
status: Text Proposed
title: PBR without EAP-Payload AVP
__________________________________________________
PANA Issues <[email-masked]>
<http://danforsberg.info:8080/pana-issues/issue78>
__________________________________________________
=�ڙ���x%��Ojv�z��m��?�0�'�~���f��f��X��)ߣ�Z�