Subject: [eap] Proposed resolution of Issue 83

From: [email-masked] (Bernard Aboba)
Date: Thu, 6 Mar 2003 05:17:53 -0800 (PST)

Change Section 2.5 to the following:

A RADIUS server receiving EAP-Message attribute(s) it does not understand
SHOULD return an Access-Reject. In order for the RADIUS server to
communicate that an invalid EAP packet has been received, but
that the problem is non-fatal, an Access-Challenge containing a
Service-Type=Packet-Reject MAY be sent.

A NAS receiving an Access-Challenge with a Service-Type=Packet-Reject
that is compliant with this specification MUST discard the current EAP
packet, and check whether it has received additional EAP Response packets
with an Identifier matching that of the last Request. If so,
a new EAP Response packet MUST be sent to the RADIUS server
within an Access-Request packet.

Once the RADIUS server responds with a packet containing a
non-null EAP-Message attribute, the NAS updates the
Identifier value, and any pending Responses that do
not match this value can be discarded. If another EAP Response
packet is not available, then the retransmission timer is
reset and the NAS retransmits the outstanding Request to the peer.

A NAS that does not support Service-Type=Packet-Reject behaves
as specified in [RFC2865], Section 5.6:

"A NAS is not required to implement all of these service types,
and MUST treat unknown or unsupported Service-Types as though
an Access-Reject had been received instead."