Re: [radext] Extended IDs

[Peter Deacon <[e-mail]>]

On Wed, 13 Dec 2017, Naiming Shen (naiming) wrote:

>> How specifically can this be achieved?  What is your proposal?  Risks? 
>> Implementation complexity?

> As the draft currently specified, the server-status message returned by 
> the proxy/server has to match the specified pattern/bits; the returned

Please assume status server is NOT being used and all configuration is 
manual as allowed per section 2.2:

"  Unless specified by configuration, a client MUST NOT send a RADIUS
    packet (other than the Status-Server request) with the "Extended
    Identifier Attribute" to a server until it has received a response
    from the server confirming its support for the Extended Identifier
    feature using the "Extended Identifier Attribute"."

I failed to explicitly state this when responding to your question 
regarding misconfiguration and ability for clients to detect problems.  I 
apologize for any confusion this has caused.

> authentication-reply message has to match the id, extended-id, if not 
> there is an error. if the error is accumulated, the radius-client should 
> know. simple to implement.

Unfortunately it's not this simple.  The problem described is one in which 
packets are being dropped while at the same time the client is also 
receiving exact extended-id attribute and values it expects to see during 
normal successful operation.

How does detection algorithm work so client can detect this 
misconfiguration?  How does it know lack of any response packet is caused 
by misconfiguration vs packet loss and or system issues?  Can you offer 
technical details?

regards,
Peter