Subject: Re: [radext] Errata 3103 on RFC 5176

From: Bernard Aboba <[email-masked]>
Date: Wed, 6 Jun 2012 16:48:18 -0700

>> Reviewing the text of RFC 5176 and RFC 3576 and the discussion in Issue 226, it seems fairly clear that Framed-IP-Address should not have been prohibited as a session identifier in a Disconnect-Request. Framed-IP-Address is noted as a session identifier early on and in the table of attributes for Disconnect, Note 1 is listed indicating that Framed-IP-Address is a session-identification attribute.  The change in the table was not listed in RFC 5176 Appendix A because there was no intent to introduce a change. And Framed-IP-Address is included in a Disconnect-Request example.  The reasoning for not changing RFC 3576 is noted at the end of Issue 226:
>> 
>> a. Renumbering is a rare event.  Therefore there is no requirement that we optimize for this case; instead we should focus on more common cases. 
>> 
>> b. Session identification via Framed-IP-Address/Framed-IPv6-Prefix/Framed-Identifier was included in RFC 3576 and appears to have been implemented (at least by Dynamic Authorization Clients).   Therefore an argument may be made for retaining backward compatibility. 
>> 
>> c. A Disconnect-Request may only contain NAS and session identification attributes.  Therefore IP address attributes included in a Disconnect-Request have an unambiguous meaning. 
>> 
>> Overall therefore there is very little confusion here; this is exactly the kind of small mistake That can be fixed with an errata. 
>> 
>> 
>> 
>> From: [email-masked]
>> Subject: Fwd: Errata 3103 on RFC 5176
>> Date: Mon, 7 May 2012 09:22:08 -0700
>> To: [email-masked]
>> 
>> Hi Bernard,
>> 	Do you recall why IP Adress was prohibited for the Disconnect Requests?
>> 
>> Best Regards,
>> -murtaza
>> 
>> Begin forwarded message:
>> 
>> From: Benoit Claise <[email-masked]>
>> Subject: Re: Errata 3103 on RFC 5176
>> Date: May 4, 2012 12:54:50 PM PDT
>> To: David Mitton <[email-masked]>
>> Cc: [email-masked], [email-masked], "Murtaza Chiba (mchiba)" <[email-masked]>, [email-masked], "Romascanu, Dan (Dan)" <[email-masked]>
>> 
>> Hi Dave,
>> 
>> Here is the errata.
>> 
>> Errata ID: 3103
>> 
>> Status: Reported
>> Type: Technical
>> 
>> Reported By: Davide Magistri
>> Date Reported: 2012-02-03
>> 
>> Section 7 says: 
>> Disconnect Request with User-Name:
>> 
>>        0: xxxx xxxx xxxx xxxx xxxx 2801 001c 1b23    .B.....$.-(....#
>>       16: 624c 3543 ceba 55f1 be55 a714 ca5e 0108    bL5C..U..U...^..
>>       32: 6d63 6869 6261
>> 
>> Disconnect Request with Acct-Session-ID:
>> 
>>        0: xxxx xxxx xxxx xxxx xxxx 2801 001e ad0d    .B..... ~.(.....
>>       16: 8e53 55b6 bd02 a0cb ace6 4e38 77bd 2c0a    .SU.......N8w.,.
>>       32: 3930 3233 3435 3637                        90234567
>> 
>> Disconnect Request with Framed-IP-Address:
>> 
>>        0: xxxx xxxx xxxx xxxx xxxx 2801 001a 0bda    .B....."2.(.....
>>       16: 33fe 765b 05f0 fd9c c32a 2f6b 5182 0806    3.v[.....*/kQ...
>>       32: 0a00 0203
>> It should say:
>> Disconnect Request with User-Name:
>> 
>>        0: xxxx xxxx xxxx xxxx xxxx 2801 001c 1b23    .B.....$.-(....#
>>       16: 624c 3543 ceba 55f1 be55 a714 ca5e 0108    bL5C..U..U...^..
>>       32: 6d63 6869 6261
>> 
>> Disconnect Request with Acct-Session-ID:
>> 
>>        0: xxxx xxxx xxxx xxxx xxxx 2801 001e ad0d    .B..... ~.(.....
>>       16: 8e53 55b6 bd02 a0cb ace6 4e38 77bd 2c0a    .SU.......N8w.,.
>>       32: 3930 3233 3435 3637                        90234567
>> Notes:
>> Since cardinality notation value for Framed-IP-Address attribute has now been changed in section 3.6 ("Table of Attributes") compared to previous 3576 RFC (change was from "0-1" to "0"), the "Disconnect Request with Framed-IP-Address" example in section 7 ("Example traces") should be removed.
>> 
>> Furthermore, a new bullet in "Appendix A. Changes from RFC 3576" should be foreseen (just like the one related to Service-Type Attribute), such as:
>> o Use of the Framed-IP-Address, Framed-Interface-Id and Framed-IPv6-Prefix Attributes within a Disconnect-Request is prohibited
>> 
>> Broadly speaking, one thing that seems to me a bit unclear is that Attributes such as Framed-IP-Address, Framed-Interface-Id and Framed-IPv6-Prefix are still valid session identifiers that could be present in CoA Requests, while they have been totally prohibited in Disconnect Requests ( even if they are mentioned as valid in section 3, end of page #10 ).
>> From my point of view, either it's misplaced the example in section 7 or cardinality notation values in Disconnect Message Table of Attributes (related to the ones mentioned above) should be changed back to "0-1" (I personally think this last option would be better).
>> 
>> Regards, Benoit.
>> 
>> Is there a method of reviewing the issue that doesn't require having an RFC-Editors account? 
>> 
>> Dave. 
>> 
>> Quoting Benoit Claise <[email-masked]>: 
>> 
>> Dear RADEXT chairs, RADEXT Advisor, and RFC 5176 authors, 
>> 
>> Can you please provide some guidance on the errata 3103 
>> https://www.rfc-editor.org/verify_errata_select.php?eid=3103 
>> 
>> Regards, Benoit. 
>> RADEXT chairs, 
>> 
>> Can you please provide advice on the resolution of Errata 3103 on RFC 
>> 5176. 
>> 
>> Thanks and Regards, 
>> 
>> Dan 
>> 
>> 
>> 
>> 
>> 
>> 
>> 
>> 
>> 
>> 
_______________________________________________
radext mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/radext

---

From: Bernard Aboba <[email-masked]>
Date: Wed, 6 Jun 2012 16:48:18 -0700

---

From: Alan DeKok <[email-masked]>
Date: Thu, 07 Jun 2012 09:52:24 +0200

I agree with this assessment.

Bernard Aboba wrote:
>>> Reviewing the text of RFC 5176 and RFC 3576 and the discussion in
>>> Issue 226, it seems fairly clear that Framed-IP-Address should not
>>> have been prohibited as a session identifier in a Disconnect-Request.
>>> Framed-IP-Address is noted as a session identifier early on and in
>>> the table of attributes for Disconnect, Note 1 is listed indicating
>>> that Framed-IP-Address is a session-identification attribute.  The
>>> change in the table was not listed in RFC 5176 Appendix A because
>>> there was no intent to introduce a change. And Framed-IP-Address is
>>> included in a Disconnect-Request example.  The reasoning for not
>>> changing RFC 3576 is noted at the end of Issue 226:
>>>
>>> a. Renumbering is a rare event.  Therefore there is no requirement
>>> that we optimize for this case; instead we should focus on more
>>> common cases. 
>>>
>>> b. Session identification via
>>> Framed-IP-Address/Framed-IPv6-Prefix/Framed-Identifier was included
>>> in RFC 3576 and appears to have been implemented (at least by Dynamic
>>> Authorization Clients).   Therefore an argument may be made for
>>> retaining backward compatibility.
>>>
>>> c. A Disconnect-Request may only contain NAS and session
>>> identification attributes.  Therefore IP address attributes included
>>> in a Disconnect-Request have an unambiguous meaning.
>>>
>>> Overall therefore there is very little confusion here; this is
>>> exactly the kind of small mistake That can be fixed with an errata.
>>>
>>>
>>>
>>> ------------------------------------------------------------------------
>>> From: [email-masked] <mailto:[email-masked]>
>>> To: [email-masked] <mailto:[email-masked]>
>>>
>>> Hi Bernard,
>>>     *From: *Benoit Claise <[email-masked] <mailto:[email-masked]>>
>>>     *Subject: **Re: Errata 3103 on RFC 5176*
>>>     *Date: *May 4, 2012 12:54:50 PM PDT
>>>     *To: *David Mitton <[email-masked] <mailto:[email-masked]>>
>>>     *Cc: [email-masked]
>>>     <mailto:[email-masked]>, [email-masked]
>>>     <mailto:[email-masked]>, "Murtaza Chiba (mchiba)"
>>>     <[email-masked] <mailto:[email-masked]>>, [email-masked]
>>>     <mailto:[email-masked]>, "Romascanu, Dan (Dan)"
>>>     <[email-masked] <mailto:[email-masked]>>
>>>
>>>     Hi Dave,
>>>
>>>     Here is the errata.
>>>
>>>     Errata ID: 3103
>>>
>>>     *Status: Reported
>>>     Type: Technical
>>>     *
>>>     Since cardinality notation value for Framed-IP-Address attribute
>>>     has now been changed in section 3.6 ("Table of Attributes")
>>>     compared to previous 3576 RFC (change was from "0-1" to "0"), the
>>>     "Disconnect Request with Framed-IP-Address" example in section 7
>>>     ("Example traces") should be removed.
>>>
>>>     Furthermore, a new bullet in "Appendix A. Changes from RFC 3576"
>>>     should be foreseen (just like the one related to Service-Type
>>>     Attribute), such as:
>>>     o Use of the Framed-IP-Address, Framed-Interface-Id and
>>>     Framed-IPv6-Prefix Attributes within a Disconnect-Request is
>>>     prohibited
>>>
>>>     Broadly speaking, one thing that seems to me a bit unclear is
>>>     that Attributes such as Framed-IP-Address, Framed-Interface-Id
>>>     and Framed-IPv6-Prefix are still valid session identifiers that
>>>     could be present in CoA Requests, while they have been totally
>>>     prohibited in Disconnect Requests ( even if they are mentioned as
>>>     valid in section 3, end of page #10 ).
>>>     From my point of view, either it's misplaced the example in
>>>     section 7 or cardinality notation values in Disconnect Message
>>>     Table of Attributes (related to the ones mentioned above) should
>>>     be changed back to "0-1" (I personally think this last option
>>>     would be better).
>>>
>>>
>>>     Regards, Benoit.
>>>
>>>
>>>         Quoting Benoit Claise <[email-masked]>
>>>         <mailto:[email-masked]>:
>>>
> ------------------------------------------------------------------------
>

---

From: Alan DeKok <[email-masked]>
Date: Thu, 07 Jun 2012 09:52:24 +0200

---

From: Bernard Aboba <[email-masked]>
Date: Thu, 7 Jun 2012 09:52:44 -0700

The implication is that Errata 3103 should be REJECTED, and another errata (fixing the table for Framed-IP-Address to make it 0-1 instead of 0) should be submitted instead.

> Date: Thu, 7 Jun 2012 09:52:24 +0200
> From: [email-masked]
> CC: [email-masked]
> Subject: Re: [radext] Errata 3103 on RFC 5176
>

---

From: Bernard Aboba <[email-masked]>
Date: Thu, 7 Jun 2012 09:52:44 -0700