Re: [Softwires] [Technical Errata Reported] RFC6519 (3372)

Could we update the description of 'service-type(6)=Call check' as follows, 

'... typically based on the NAS-Port-Id(87), or Calling-Station-Id(31) attributes, etc. It is recommended that such Access-Requests use the value of NAS-Port-Id or Calling-Station-Id as the value of the User-Name.'

if we believe the *call* is not only associated with the telephone system?

Best Regards,
Leaf

-----Original Message-----
From: softwires-bounces@ietf.org [mailto:softwires-bounces@ietf.org] On Behalf Of RFC Errata System
Sent: Monday, October 08, 2012 8:31 PM
To: roberta.maglione@telecomitalia.it; adurand@juniper.net; rdroms.ietf@gmail.com; brian@innovationslab.net; suresh.krishnan@ericsson.com; cuiyong@tsinghua.edu.cn
Cc: softwires@ietf.org; rfc-editor@rfc-editor.org; aland@deployingradius.com
Subject: [Softwires] [Technical Errata Reported] RFC6519 (3372)

The following errata report has been submitted for RFC6519,
"RADIUS Extensions for Dual-Stack Lite".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata_search.php?rfc=6519&eid=3372

--------------------------------------
Type: Technical
Reported by: Alan DeKok <aland@deployingradius.com>

Section: 3

Original Text
-------------
   In the scenario depicted in Figure 2, the Access-Request packet
   contains a Service-Type attribute with the value Authorize Only (17);
   thus, according to [RFC5080], the Access-Request packet MUST contain
   a State attribute.

Corrected Text
--------------
    In the scenario depicted in Figure 2, the Access-Request packet
   contains a Service-Type attribute with the value Call-Check (10).

Notes
-----
The document references RFC 5080.  However, the use of the State attribute in this document is wrong.  The text in RFC 5080 clearly says that State is used to tie an "Authorize Only" request to a previous authentication.  The text requiring State in "Authorize Only" is surrounded by explanations describing *why* it's required.

The original text in RFC 6519 appears to say that adding State magically satisfies the requirements of 5080.  But it ignores all of the surrounding text.

The NAS can't simply invent a State attribute, to satisfy the requirement of 5080.  It MUST get the State from a previous Access-Accept.  Since there's no previous Access-Accept here, the use of Authorize-Only and State is wrong.

RFC 2865 suggests the use of "Service-Type = Call Check" for this kind of authorization checking:

      Call Check 

         Used by the NAS in an Access-Request packet to
                          indicate that a call is being received and
                          that the RADIUS server should send back an
                          Access-Accept to answer the call, or an
                          Access-Reject to not accept the call,
                          typically based on the Called-Station-Id or
                          Calling-Station-Id attributes.  It is
                          recommended that such Access-Requests use the
                          value of Calling-Station-Id as the value of
                          the User-Name

Instructions:
-------------
This errata is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party (IESG)
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC6519 (draft-ietf-softwire-dslite-radius-ext-07)
--------------------------------------
Title               : RADIUS Extensions for Dual-Stack Lite
Publication Date    : February 2012
Author(s)           : R. Maglione, A. Durand
Category            : PROPOSED STANDARD
Source              : Softwires
Area                : Internet
Stream              : IETF
Verifying Party     : IESG
_______________________________________________
Softwires mailing list
Softwires@ietf.org
https://www.ietf.org/mailman/listinfo/softwires