Subject: [radext] Call for WG document adoption

From: <[email-masked]>
Date: Mon, 2 Nov 2015 13:55:17 +0000

Hi

After a detailed check, it seems that I had an issue with my email account during the summer break (and even after) and that some of my emails were not correctly distributed on the RADEXT mailing list.

To repeat what was agreed at the last IETF meeting, the following drafts are (more than) candidates as WG documents:
-  draft-dekok-radext-coa-proxy-00.txt
- draft-winter-radext-populating-eapidentity-01

Both items are already part of the new charter.
Support for both was already expressed on the mailing list and during the meeting.

Therefore, if no concern is raised before November, Monday 7, I will (finally) confirm the adoption of these drafts as WG documents. 

Sorry for this mess!

Regards,

Lionel

_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.

---

From: Peter Deacon <[email-masked]>
Date: Mon, 2 Nov 2015 13:41:53 -0800 (Pacific Standard Time)

On Mon, 2 Nov 2015, [email-masked] wrote:

> Hi
> After a detailed check, it seems that I had an issue with my email 
> account during the summer break (and even after) and that some of my 
> emails were not correctly distributed on the RADEXT mailing list.

> To repeat what was agreed at the last IETF meeting, the following drafts 
> are (more than) candidates as WG documents:

> -  draft-dekok-radext-coa-proxy-00.txt

I do not support adoption of this draft at this time.

As discussed earlier this draft fails to offer either constraints, 
specific mechanisms or enabling infrastructure by which sessions are 
protected from attack by operators of competing potentially unfriendly or 
compromised realms.

This draft requires every participant in a roaming network to trust every 
other participant.  I believe trust should only be required between the 
participant and operator of the roaming network.

I do not believe trust requirements of this draft are likely to be deemed 
viable by operators nor are they technically necessary.

regards,
Peter

---

From: Alan DeKok <[email-masked]>
Date: Mon, 2 Nov 2015 18:36:00 -0500

On Nov 2, 2015, at 4:41 PM, Peter Deacon <[email-masked]> wrote:
> 
> As discussed earlier this draft fails to offer either constraints, specific mechanisms or enabling infrastructure by which sessions are protected from attack by operators of competing potentially unfriendly or compromised realms.

  Well.. no.

  The draft doesn't have to be perfect in order to be adopted as a WG draft.  It is perfectly fine to have WG members review the document, and provide feedback, for document updates.

> This draft requires every participant in a roaming network to trust every other participant.

  And again, no.

  Even RFC 5176 has provisions for participants in the RADIUS infrastructure who are not fully trusted.  This draft builds on that lack of trust.

>  I believe trust should only be required between the participant and operator of the roaming network.

  That's nice.  How do you implement it?

> I do not believe trust requirements

  The draft doesn't make trust "requirements".   It makes trade-offs, and acknowledges the trade-offs.  This is the reality of protocol design.

> of this draft are likely to be deemed viable by operators

  I disagree.

> nor are they technically necessary.

  Which is an opinion.  Unsupported by facts or argument.

  I believe that the WG would welcome suggestions which requires minimal trust between parties, and has maximal validation.  As yet, I have not seen any concrete proposal which is better than the current draft.

  Alan DeKok.

---

From: <[email-masked]>
Date: Tue, 3 Nov 2015 00:58:06 +0000

Hi,

Letting out the technical points discussed here, Alan is right.
The idea is not to endorse the draft as 'THE' WG solution for CoA proxing but to agree on this document as a basis for future WG contribution, review, discussion. It is NOT a WG last call before sending the document for IESG review and RFC publication.

The call for adoption is there to acknowledge that:
- the draft addresses one of our work item
- the draft is stable enough to initiate technical discussions on its content.

The conclusion of these discussions can be:
- OK with the draft as it is
- OK with correction/clarification
- NOK and another approach is required
- No solution at all is required/possible

I personally think that the ongoing discussion is a good example of what should a discussion on a WG document :)

So Peter, can you reevaluate your position taking into account the clarifications above? Obviously, not being OK for adoption is a valid position. But the reasons given in your mail just illustrate that some points might be missing or not correctly addressed in the draft but do not mean that you are not OK to discuss this document as WG document.

Regards,

Lionel

-----Message d'origine-----
De : radext [mailto:[email-masked]] De la part de Alan DeKok
Envoyé : mardi 3 novembre 2015 00:36
À : Peter Deacon
Cc : [email-masked]
Objet : [radext] CoA proxying

  Well.. no.

  And again, no.

  I disagree.

  Alan DeKok.

_______________________________________________
radext mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/radext

---

From: Peter Deacon <[email-masked]>
Date: Mon, 2 Nov 2015 19:36:00 -0800 (Pacific Standard Time)

> The idea is not to endorse the draft as 'THE' WG solution for CoA 
> proxing but to agree on this document as a basis for future WG 
> contribution, review, discussion. It is NOT a WG last call before 
> sending the document for IESG review and RFC publication.

> So Peter, can you reevaluate your position taking into account the 
> clarifications above? Obviously, not being OK for adoption is a valid 
> position. But the reasons given in your mail just illustrate that some 
> points might be missing or not correctly addressed in the draft but do 
> not mean that you are not OK to discuss this document as WG document.

Hi Lionel,

Yes, I can support adoption with correction this problem will be addressed 
and not ignored:

Section 5:
"This specification adds one new attribute, and defines new behavior for
RADIUS proxying.  As this behavior mirrors existing RADIUS proxying, we do
not believe that it introduces any new security issues."

I would hope we can all agree with the principal RealmA's nice users not 
needlessly suffer constant disconnects and extreme rate limiting at evil 
hands of RealmB.

When describing problem in detail previously I offered a couple of ideas 
for approaches to address the problem.  I would be happy to contribute 
text and or discuss them further if this draft is adopted.

regards,
Peter