[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Proxy State and RFC 3576bis
Bernard Aboba wrote:
One of the deployment blockers with RFC 3576 is the need to modify
proxies to handle routing of RFC 3576 packets. While proxies typically
keep tables for dowstream forwarding, they typically do not keep tables
Given this, I am wondering how RADIUS proxies should handle Proxy-State
for RFC 3576 packets:
a. Do they add Proxy-State attributes to a Disconnect/CoA-Request as
suggested in the current text (and as would be done for an Access-Request)?
[Alan DeKok] No.
b. Or can the RADIUS server include a Proxy-State attribute previously
obtained from an Access-Request used in the original authentication
within the Disconnect/CoA-Request to assist the proxy in routing the
request back to the NAS? In this case, wouldn't the RADIUS proxy
*remove* Proxy-State attributes from the Disconnect/CoA-Request??
[Alan DeKok] Yes.
[BA] This suggests that paragraphs 3 and 4 in the text below are not
correct. Any suggestions on how we can fix it?
If there are any Proxy-State Attributes in a Disconnect-Request or
CoA-Request received from the server, the forwarding proxy or NAS
MUST include those Proxy-State Attributes in its response to the
A forwarding proxy or NAS MUST NOT modify existing Proxy-State,
State, or Class Attributes present in the packet. The forwarding
proxy or NAS MUST treat any Proxy-State attributes already in the
packet as opaque data. Its operation MUST NOT depend on the
content of Proxy-State attributes added by previous proxies. The
forwarding proxy MUST NOT modify any other Proxy-State Attributes
that were in the packet; it may choose not to forward them, but it
MUST NOT change their contents. If the forwarding proxy omits the
Proxy-State Attributes in the request, it MUST attach them to the
response before sending it.
When the proxy forwards a Disconnect or CoA-Request, it MAY add a
Proxy-State Attribute, but it MUST NOT add more than one. If a
Proxy-State Attribute is added to a packet when forwarding the
packet, the Proxy-State Attribute MUST be added after any existing
Proxy-State attributes. The forwarding proxy MUST NOT change the
order of any attributes of the same type, including Proxy-State.
Other Attributes can be placed before, after or even between the
When the proxy receives a response to a CoA-Request or Disconnect-
Request, it MUST remove its own Proxy-State (the last Proxy- State
in the packet) before forwarding the response. Since Disconnect
and CoA responses are authenticated on the entire packet contents,
the stripping of the Proxy-State Attribute invalidates the
integrity check - so the proxy needs to recompute it.
to unsubscribe send a message to email@example.com with
the word 'unsubscribe' in a single line as the message text body.