Subject: (radius) RFC2868: Is Tag field optional on Tunnel-Password attribute?

From: "Mark Jones" <[email-masked]>
Date: Tue, 29 Aug 2000 15:34:57 -0400

Most of the RADIUS Tunnel Authentication attributes allow the Tag field to
be optional if it is not supported, i.e. "If the Tag field is greater than
0x1F, it SHOULD be interpreted as the first byte of the following String
field."

From the Tag field description, this does not appear to be the case for the
Tunnel Password attribute even though the Salt value range is restricted to
allow the Tag field to be optional in this case.

Is this an oversight or MUST the Tag octet always be present in the
Tunnel-Password field even if not supported?

Regards,
       Mark

-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: "Mark Jones" <[email-masked]>
Date: Wed, 30 Aug 2000 09:21:50 -0400

Thanks Marc,

> You can be permissive with this in software - from looking at the
> first byte:
>
> 00	- tag field present, no tag number (just skip it)
> 01-1f 	- tag field present and valid tag number
> 20-7f	- no tag field present, unsalted password (illegal)
> 80-ff	- no tag field present, salted password

Looking at the Tag description in the current version of RFC2868, I do not
understand how the Tag field could be interpreted as being optional.  I'm
also assuming (maybe wrongly) that a Tag value of zero is illegal for other
tunnel attributes and so it would be for this one too. Could an RFC author
comment on the intention?

Was there an issue with using the same approach as with the other Tunnel
attributes, i.e. "If the Tag field is greater than 0x1F, it SHOULD be
interpreted as the first byte of the following Salt field." ?

Regards,
       Mark

-