Subject: [eap] sm-02 authenticator timeout failure issue

From: [email-masked] (Jari Arkko)
Date: Wed, 14 May 2003 14:53:12 +0300

2284bis-03.f:

    The authenticator MUST NOT send a Success or Failure packet as a
    result of a timeout. After a suitable number of timeouts have
    elapsed, the authenticator SHOULD end the EAP conversation.

sm-02 authenticator:

    From the figure we can see that when aWhile goes to zero,
    you will go to RETRANSMIT, possibly retransmit a few times,
    and eventually go to FAILURE, and set eapReqData.

I have three issues with the above:

1) 2284bis could be clearer, imho, that even after a number
    of timeouts you don't send a Failure. Suggested rewrite:
    "The authenticator is responsible for retransmitting requests
     as described in Section 4.1. After a suitable number of
     retransmissions, the authenticator SHOULD end the EAP
     conversation. The authenticator MUST NOT send a Success
     or Failure packet when retransmitting or when it fails
     to get a response from the peer."

2) The FAILURE state constructs a Failure response,
    but 2284bis forbids this to be sent when the
    failure is due to a timeout (I think).

3) You could say perhaps that the Failure response
    is not really sent, and is only internally
    constructed, because eapReq is not set. However,
    if this is true then FAILURE and SUCCESS states
    both have an issue when used in other cases:
    they don't set eapReq either.

    Suggested fix: set eapReq in FAILURE and SUCCESS.
    Provide a different state for timeout-based
    failures, which does nothing.

--Jari