Re: Bang-path routing

[Alan DeKok <aland@deployingradius.com>]

Bernard Aboba wrote:
> I think the issue is *when* the NAI is normalized.  For example is the
> RADIUS server expected to do the normalization, or is it the client?

  I don't think anyone other than the client has access to locale
information.  I think the client must convert the NAI to normalized
UTF-8.  I don't think this is too hard.  It only needs to be done once,
when the user name && realm are entered (or when the locale changes).

> Some references to John Klensin's RFCs on registry behavior would probably
> be appropriate.

  OK.

> What's wierd is that the ABNF actually includes support for UTF-8
> characters.
> Last time I looked, this appeared to be supported for *both* the
> username and
> the realm.

  Nope.  Only for the User-Name, from 4282:

   realm       =  1*( label "." ) label
   label       =  let-dig *(ldh-str)
   ldh-str     =  *( alpha / digit / "-" ) let-dig
   let-dig     =  alpha / digit
   alpha       =  %x41-5A  ; 'A'-'Z'
   alpha       =/ %x61-7A  ; 'a'-'z'
   digit       =  %x30-39  ; '0'-'9'

  Characters with the high bit set are forbidden in realm names.

> One might want to normalize the realm prior to doing the lookup in the
> realm table.

  Normalize... to what?  How can the intermediate nodes know what
normalization rules to apply?

> Unfortunately, not *all* DNS libraries do the right thing.  For example,
> GetAddrInfoW() currently sends UTF-8 queries on the wire, not punycode.
> On *NIX systems, I've seen applications use libidn to do the conversion
> prior to calling name resolution APIs.

  Ugh.  I guess this needs to be mentioned, too.

  Alan DeKok.

--
to unsubscribe send a message to radiusext-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>