Subject: Re: (radius) RADIUS proxy

From: "Dmitry Goncharenko(at Crimea)" <[email-masked]>
Date: Mon, 15 Mar 1999 13:11:58 -0800

>> How can I find out whether the packet was already forwarded by my server?
>You check for a Proxy-State attribute with a value you recognize.

But the attribute is implementation dependent so any other server anywhere
in the loop could add the same Proxy-State as I did. It doesn't look as a
reliable way to check for me. Is the anything that prohibits to add a
Proxy-State with the same value to the request?

>> it looks like I can leave Request-Authenticator untouched in any case,
>> right?
>
>No, the Request-Authenticator should be regenerated by the proxy server.
...
>Regeneration is the best way to guarantee that the Request-Authenticator
>is unique over the lifetime of the shared secret between the proxy server
>and the home server.

Ok, thanks, it's just not clear from the new draft and what is more from RFC
when it's related with proxy.
Dmitry.

-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: William Bulley <[email-masked]>
Date: Mon, 15 Mar 1999 16:44:23 -0500 (EST)

> Proxy-State with the same value to the request?

I have long wanted to implement John Vollbrecht's suggestion
that the Proxy-State be a complex or multi-valued beast.  But
events have conspired to prevent that implementation, sigh...  :-(

IIRC the idea was to place the source machine's IP address
and UDP port in the Proxy-State attribute sent out to "mark"
the Access-Request as having come from "me" so that when it
came back to "me" as an Access-Accept (or whatever) that I
would be able to identify it as "mine"

This is sort of like the problem our human immune system has
to deal with in detecting foreign protein as distinct from its
own cells...  :-)

Regards,

web...

-- 
William Bulley                     Senior Systems Research Programmer
Merit Network, Inc.                Email: [email-masked]
4251 Plymouth Road, Suite C        Phone: (734) 764-9993
Ann Arbor, Michigan  48105-2785    Fax:   (734) 647-3185

[Sniglets (c) 1999] Hip-Hop-crisy: noun; the state-of-being where a
person pretends to like the Grammy Award winning musical art form...
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: Alan DeKok <[email-masked]>
Date: Tue, 16 Mar 1999 08:40:09 -0500

> would be able to identify it as "mine"

  A normal RADIUS client doesn't need a Proxy-State to match
Access-Accept's to Access-Request's.  If a RADIUS server is proxying a
request, it's acting as a RADIUS client to an end server, so it really
doesn't need a Proxy-State, either.

  I'm not saying that Proxy-State isn't *useful*.  It's just that it's
possible to modify the proxy server implementation to make Proxy-State
unnecessary.

  e.g.  For each end server, the proxy server opens a UDP port in
1024..64000, and sends proxied request out those ports.  Packets
received on those ports MUST come from the matching end server, and
those packets are matched to proxied requests through the Request
Authenticator.

  There's no room for spoofed or lost packets without the proxy server
knowing about it.  If some proxy server down the chain deletes all
Proxy-State attributes, our proxy server won't care.

  What exactly is Proxy-State for, then?  Is it simply a tag to make
it easier to implement simple proxy servers?  So far as I can see, the
Proxy-State attribute is *informational*, and should not be use to
make any sort of decisions on the proxy server.

  Alan DeKok.
-