Subject: (radius) comments on

From: "Shriver, John" <[email-masked]>
Date: Thu, 4 May 2000 06:24:05 -0700

(Please keep me in the CC: list, I'm not on the list.  Enough lists!)

When draft-ietf-radius-eap-xx.txt was merged into
draft-ietf-radius-ext-00.txt, in the section on EAP-Message, the drawing and
text describing what part of the EAP packet goes into the AVP was not
included.  Thus, there is now no discussion of what part of the EAP packet
goes into "String".

Also, "String" is a very misleading name for the data portion of this AVP,
since it's really a packet.  I'd say that "Packet", or "Message" would be a
better name.

Finally, we should discuss who owns the Identifier field of the encapsulated
EAP packet.  I presume that the EAP Authenticator (PPP Authenticator) has
the last say, since these are the unique identifiers for its
retransmissions.

I would suggest that the text should read as follows, which avoids
mentioning PPP to prevent any conflict with IEEE 802.1x's use of EAP and
RADIUS:

   A summary of the EAP-Message attribute format is shown below.  The
   fields are transmitted from left to right.

    0                   1                   2
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Type      |    Length     |   Message...
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Type

      79 for EAP-Message.

   Length

      >= 3

   Message

      The Message field contains EAP packets, as defined in [3].  The
      Message field MUST start with the Code field of the EAP packet,
      and will include all the data.  The Message field MUST NOT include
      any PPP data-link padding that had been part of the EAP packet
      when received by the RADIUS authenticator.

      If multiple EAP-Message attributes are present in a received RADIUS
      packet their values MUST be concatenated; this allows EAP packets
      longer than 253 octets to be passed by RADIUS.  Similarly, EAP packets
      longer than 253 octets MUST be fragmented into multiple EAP-Message
      attributes before transmission over RADIUS.

      The Identifier field of the EAP packet is the responsibility of
      the EAP authenticator, not the RADIUS server.  The EAP authenticator
      MUST ensure that the Identifier field has a different value from the
      previous one sent, since the RADIUS server may not have used a
      unique value.

-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.