Re: [radext] New Version Notification for draft-dekok-radext-reverse-coa-01.txt

Alan DeKok <aland@deployingradius.com> Wed, 09 August 2023 14:43 UTC

Return-Path: <aland@deployingradius.com>
X-Original-To: radext@ietfa.amsl.com
Delivered-To: radext@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BD1ADC14CE4D for <radext@ietfa.amsl.com>; Wed, 9 Aug 2023 07:43:58 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.908
X-Spam-Level:
X-Spam-Status: No, score=-1.908 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Bq3nwUyAhIS3 for <radext@ietfa.amsl.com>; Wed, 9 Aug 2023 07:43:56 -0700 (PDT)
Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3447DC14CE47 for <radext@ietf.org>; Wed, 9 Aug 2023 07:43:55 -0700 (PDT)
Received: from smtpclient.apple (135-23-95-173.cpe.pppoe.ca [135.23.95.173]) by mail.networkradius.com (Postfix) with ESMTPSA id 4C7B6380; Wed, 9 Aug 2023 14:43:53 +0000 (UTC)
Authentication-Results: NetworkRADIUS; dmarc=none (p=none dis=none) header.from=deployingradius.com
Content-Type: text/plain; charset="us-ascii"
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3696.120.41.1.1\))
From: Alan DeKok <aland@deployingradius.com>
In-Reply-To: <2f0f3db9-00b2-4657-9f55-a4e88da38c24@app.fastmail.com>
Date: Wed, 09 Aug 2023 10:43:51 -0400
Cc: radext@ietf.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <1552BE22-E77E-4D9C-9EA8-A4BD6BEF0642@deployingradius.com>
References: <169049719437.3324.16812994471629733778@ietfa.amsl.com> <9C8D6E14-3CCA-4651-BD2E-39A1A6077A37@deployingradius.com> <2f0f3db9-00b2-4657-9f55-a4e88da38c24@app.fastmail.com>
To: Alexander Clouter <alex+ietf@coremem.com>
X-Mailer: Apple Mail (2.3696.120.41.1.1)
Archived-At: <https://mailarchive.ietf.org/arch/msg/radext/yFr7ItbwrqiDeaOmGuM26ayXWBE>
Subject: Re: [radext] New Version Notification for draft-dekok-radext-reverse-coa-01.txt
X-BeenThere: radext@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: RADIUS EXTensions working group discussion list <radext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/radext>, <mailto:radext-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/radext/>
List-Post: <mailto:radext@ietf.org>
List-Help: <mailto:radext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/radext>, <mailto:radext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 09 Aug 2023 14:43:58 -0000

On Aug 8, 2023, at 7:21 PM, Alexander Clouter <alex+ietf@coremem.com> wrote:
> Section 4:
> 
> Any reason why the server could not just send a CoA and record if it was accepted? This could be extended to pre-emptively send CoA's for sessions that cannot exist to capture if there is a response.

  That's one way, I guess.  It seems fragile to me, though.  It would be better to have some kind of positive signalling that this path supports the reverse CoA functionality.

  Barring general agreement on what that looks like, the only approach is to say "It can be used when administratively configured".

> An observed ACK/NAK would be indicative that reverse CoA is supported whilst no response (the client would drop the packet, right?) is "no support".
> 
> This sort of is what happens for traditional forward proxying of CoA as you do not know if the visited site supports CoA.

  That also tends to be administratively configured. :(

> I would not be too surprised if a number of embedded clients just processed the CoA on whatever socket it appeared on.

  I would hope so!  That would make things much easier.

> Of course NASs are strange things and I yield to your experience, but I figure if it is going to barf on a reverse CoA there is a chance it would barf on the Status-Server too...right?

  Yes.

> Section 5:
> 
> I think this "It is not one-to-one, or 1-N, or M-1." is easier to read as " It is not one-to-one, or 1:N, or M:1. It is many-to-many." (ratio style).
> 
> I personally read '1-N' and 'M-1' as a calculation.

  OK.  I'll fix that.

  Alan DeKok.