Subject: [eap] sm-02 authenticator timeout failure issue

From: [email-masked] ([email-masked])
Date: Wed, 14 May 2003 15:44:50 +0300

Hi,

This issue was listed in Appendix A of sm-02 draft=20
as a "known inconsistency" between 2284bis and SM
(the Failure response is actually sent although
eapReq is not set; see Section 5.1 of sm-02 draft).

Here's an updated diagram that fixes this, and also
attempts to show how timeouts are calculated=20
(changes to -02 version are shown in blue).

http://www.cs.hut.fi/~peronen/eap/eap_authenticator_14052003.png

(Does the handling of timeouts look ok? The idea is that=20
if a method has some idea what the timeout should be, it=20
sets methodTimeout. eapRttEstimate comes from the lower
layer)

Best regards,
Pasi

> -----Original Message-----
> From: ext Jari Arkko [mailto:[email-masked]]
> Sent: Wednesday, May 14, 2003 2:53 PM
> To: [email-masked]
> Subject: [eap] sm-02 authenticator timeout failure issue
>=20
>=20
>=20
> 2284bis-03.f:
>=20
>     The authenticator MUST NOT send a Success or Failure packet as a
>     result of a timeout. After a suitable number of timeouts have
>     elapsed, the authenticator SHOULD end the EAP conversation.
>=20
> sm-02 authenticator:
>=20
>     From the figure we can see that when aWhile goes to zero,
>     you will go to RETRANSMIT, possibly retransmit a few times,
>     and eventually go to FAILURE, and set eapReqData.
>=20
> I have three issues with the above:
>=20
> 1) 2284bis could be clearer, imho, that even after a number
>     of timeouts you don't send a Failure. Suggested rewrite:
>     "The authenticator is responsible for retransmitting requests
>      as described in Section 4.1. After a suitable number of
>      retransmissions, the authenticator SHOULD end the EAP
>      conversation. The authenticator MUST NOT send a Success
>      or Failure packet when retransmitting or when it fails
>      to get a response from the peer."
>=20
> 2) The FAILURE state constructs a Failure response,
>     but 2284bis forbids this to be sent when the
>     failure is due to a timeout (I think).
>=20
> 3) You could say perhaps that the Failure response
>     is not really sent, and is only internally
>     constructed, because eapReq is not set. However,
>     if this is true then FAILURE and SUCCESS states
>     both have an issue when used in other cases:
>     they don't set eapReq either.
>=20
>     Suggested fix: set eapReq in FAILURE and SUCCESS.
>     Provide a different state for timeout-based
>     failures, which does nothing.
>=20
> --Jari

---

From: [email-masked] (Jari Arkko)
Date: Wed, 21 May 2003 16:40:30 +0300

[email-masked] wrote:
> Hi,
> 
> This issue was listed in Appendix A of sm-02 draft 
> attempts to show how timeouts are calculated 
> (Does the handling of timeouts look ok? The idea is that 
> if a method has some idea what the timeout should be, it 

Looks OK, IMHO. Thanks.

--Jari