Re: [radext] Proposed new charter text

[Alan DeKok <[e-mail]>]

On Mar 23, 2015, at 6:21 PM, Sam Hartman <[e-mail]> wrote:
> I think solving this requirement would be necessary for moving COA to
> the standards track or removing the health warning in 5176.

  I agree.

  Let’s say that each proxy selectively forwards CoA packets based on it’s knowledge of the user sessions.  This means that every proxy has to maintain information on every user session, which is untenable.

  Or maybe the sessions contain some kind of state that the proxy can cryptographically verify.  That means sharing the cryptographic keys with all proxies, which is also untenable.

  In the end, I don’t see this as a session state problem.  It’s a routing problem.  For a situation Visited -> Proxy -> Home, packets are usually forwarded based on User-Name, and realm.  When the Home server wants to disconnect a user, it typically sends User-Name as part of the session identification attributes.  So all that’s needed is for the proxy to look up that realm.

  i.e. the algorithm is this:

forwarding proxy: receive packet with User-Name, look up realm, and forward packet to that realm.

CoA proxy: receive packet with Operator-Name and User-Name.  Look up realm from *User-Name*.  If the source of the packet does not match a known destination for that realm, then drop the packet as being non-compliant.  Otherwise, look up realm from *Operator-Name*, and forward the CoA packet there.

  This solution does have limitations.  It requires that the forwarding path contain information about CoA clients.  It requires that proxying is done on User-Name.

  However, I think that those restrictions are reasonable.  All of the cross-organization roaming I’m aware of is done via User-Name, so this solution imposes no operational changes on current systems.

  Alan DeKok.