Re: [radext] Implementation inventions

[Heikki Vatiainen <[e-mail]>]

On Tue, 8 Aug 2023 at 00:33, Alan DeKok <[e-mail]> wrote:

> On Aug 7, 2023, at 5:20 PM, Michael Sym <[e-mail]> wrote:
> >
> > Great list, Alan.  We’ve unfortunately seen so many of these “inventive”
> behaviors.  And are trying to address the garbage Acct-Input/Output-Octets
> values in WBA’s RADIUS Accounting Assurance work area.
> >
> > I wholeheartedly agree with the challenge in reliably tying accounting
> packets to an authentication.  That would be an extremely helpful missing
> piece for this group to address.  Requiring “Acct-Session-Id” and/or
> “Acct-Multi-Session-Id” in Access-Requests could be a good place to start.
>
>   Part of the interest in posting the list is to get input from other
> people who've seen additional issues.
>
>   I'm not sure if the WG has opinions on a new document "Issues and fixes
> part 2", or even pushing 2866 to Standards track.  Both of those ideas have
> a "here be dragons" label in my mind.
>

Something for the list: RADIUS dynauth server that returned NAK when
Message-Authenticator was in a dynauth request. It's been a while when that
was noticed, but not that many years. The attribute is not required, but
these kinds of small variations make it hard to create dynauth messages in
multivendor systems.

Maybe the list could be added to the WG github for the moment? It could
help to avoid it to getting lost.

-- 
Heikki Vatiainen
[e-mail]