Subject: Re: I-D Action:draft-ietf-radext-radius-extensions-00.txt

From: Victor Gamov <[email-masked]>
Date: Wed, 02 Mar 2011 16:08:22 +0300

Hi All !

To extend Type space and allow large values I propose following format 
with new unassigned Type:

  0                   1                   2                   3
+---------------------------------------------------------------+
|0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1|
+---------------+---------------+-------------------------------+
|      Type     |    Length=0   |        Actual Length          |
+---------------+---------------+-------------------------------+
| New Type (up to 65535 types)  |Long Value (up to 65529 bytes)..
+---------------+---------------+---------------+---------------+

Incompatible implementations will generate reject or discard such 
attributes due Length=0.

To allow VSA with extended types (more than 255) and values (Type is new 
unassigned type):

  0                   1                   2                   3
+---------------------------------------------------------------+
|0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1|
+---------------+---------------+-------------------------------+
|      Type     |    Length=0   |        Actual Length          |
+---------------+---------------+-------------------------------+
|                           Vendor ID                           |
+---------------+---------------+---------------+---------------+
|            VSA Type           |Long Value (up to 65525 bytes)..
+---------------+---------------+---------------+---------------+

In more general, second format may be used to extend RADIUS-standard 
attributes when 'Vendor ID' = 0

--
CU,
Victor Gamov

---

From: Victor Gamov <[email-masked]>
Date: Fri, 04 Mar 2011 11:57:30 +0300

On 02.03.2011 16:08, Victor Gamov wrote:
> Hi All !
>
> To extend Type space and allow large values I propose following
> format with new unassigned Type:
>
> 0 1 2 3
> +---------------------------------------------------------------+ |0
> 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1|
> +---------------+---------------+-------------------------------+ |
> Type | Length=0 | Actual Length |
> +---------------+---------------+-------------------------------+ |
> New Type (up to 65535 types) |Long Value (up to 65529 bytes)..

Some explanations

If RADIUS-client wants to deliver long-value attribute to RADIUS-server,
then this server and client needs to realize some mechanism to allow
such values. Any splitting or other -- its need to be realized into both
server and clinet.

If client wants to deliver any important info by new (compatible)
mechanism but server does not know anything about this mechanism, so
this important info will be not processed by server.  And client does
not know about it!
If server drop or reject packets with Length=0 then client know about it.

If RADIUS-server send replies with important long-value attributes with
Length=0 then client drops such packets and session never started.
Client may send Acct-Stop by failure and server clear info about session
early started (from the point of view of RADIUS-server)

-- 
CU,
Victor Gamov