Subject: [radext] [Errata Verified] RFC5176 (4311)

From: RFC Errata System <[email-masked]>
Date: Mon, 20 Jul 2015 04:01:12 -0700 (PDT)

The following errata report has been verified for RFC5176,
"Dynamic Authorization Extensions to Remote Authentication Dial In User Service (RADIUS)". 

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata_search.php?rfc=5176&eid=4311

--------------------------------------
Status: Verified
Type: Technical

Reported by: Alan DeKok <[email-masked]>
Date Reported: 2015-03-23
Verified by: Kathleen Moriarty (IESG)

Section: 2.3

Original Text
-------------
Section 2.3 says:

      In CoA-Request and Disconnect-Request packets, all attributes MUST
      be treated as mandatory. 

Corrected Text
--------------
In CoA-Request and Disconnect-Request packets, all attributes MUST
be treated as mandatory to understand by the NAS, except Proxy-State
attributes that MUST be treated as opaque data.  See Section 3.1 for a
discussion of how the NAS must handle Proxy-State.

Notes
-----
This was seen with vendor equipment.  CoA proxying was done to the NAS, and the proxy was adding and forwarding Proxy-State as required by Section 3.1.  However, the NAS was returning a CoA-NAK with Error-Cause = Unsupported-Attribute.

The issue comes because Proxy-State is called out in Section 3.1 for special handling.  However, that special handling isn't called out in Section 2.3.  As a result, implementors can get confused.

The RADEXT WG is rechartering with a document to address CoA proxying.  We will also be addressing this issue in that document.  There are additional attributes which a NAS should ignore, OR which should be filtered out by the proxy closest to the NAS.

The text was slightly updated by the WG from the originally submitted text.

--------------------------------------
RFC5176 (draft-ietf-radext-rfc3576bis-13)
--------------------------------------
Title               : Dynamic Authorization Extensions to Remote Authentication Dial In User Service (RADIUS)
Publication Date    : January 2008
Author(s)           : M. Chiba, G. Dommety, M. Eklund, D. Mitton, B. Aboba
Category            : INFORMATIONAL
Source              : RADIUS EXTensions
Area                : Operations and Management
Stream              : IETF
Verifying Party     : IESG