Re: [radext] Meeting laundry list

[Peter Deacon <[e-mail]>]

On Tue, 19 Mar 2013, Stefan Winter wrote:

>> We have had a trivial proxy loop detection system in production in our
>> implementations for several years.  It works on the assumption any
>> request the same proxy system sees again completes a cycle.

>> In our implementation a systems identifier is embedded in the proxy
>> state attribute.  When a request for proxy is received we check for
>> matching system identifier in the current stack of proxy states and drop
>> the request if one is found.

> Many of those who implement loop checking in eduroam do similarly: they
> use their own VSA space to

> * in incoming packets, check for presence of their VSA like
> "Processed-By: my.ip.ad.dr" (or other halfways unique ID)
> * If found, discard and log loop
> * if not found, add "Processed-By: my.ip.ad.dr" (or other halfways
> unique ID) and process packet

> That's simple and straightforward indeed. The problem I have is that
> such a behaviour is not specified anywhere, and doesn't have its own
> attribute.

> You overload Proxy-State; which is fine if you don't need it for
> anything else.

I don't know that "overload" is applicable in this context or why it 
couldn't be used for multiple purposes concurrently.

Proxy-State is defined as an opaque field.  Its purpose is left 
intentionally out of scope RFC2865 5.33

"      Usage of the Proxy-State Attribute is implementation dependent.  A
       description of its function is outside the scope of this
       specification.
"

> I don't really care if that use of Proxy-State gets standardised, or if
> a new attribute is chosen. But having one deterministic way of doing
> things, along with a document which explains the how and why, instead of
> everyone doing his own variant on its own, is a GoodThing(tm) IMHO.

We don't really know generally what constitutes a "loop" or granularity of 
the system box (Parts of one server or entire groups of servers). 
Messages may be able to loop back for another round of processing after 
being sent outside the admin domain.

Seems easy enough to create one-off solutions yet very difficult to solve 
generally.

Perhaps some general guidance or blunt tools like TTLs on stack of 
proxy-states.

regards,
Peter