Subject: [eap] Proposed resolution of Issue 196: Peer SM Issues

From: <[email-masked]>
Date: Thu, 27 Nov 2003 11:21:53 +0200

Hi,

Here's my proposal for resolving issue 196:

- Add "processIdentity(eapReqData)" to IDENTITY state (as first
  line) to show that the Identity Request may contain something 
  that needs to be processed. It seems that NOTIFICATION state
  needs something similar ("processNotify(eapReqData)").
  We also need to describe these procedures in Section 4.4:

  processIdentity(): Process the contents of Identity Request.

  processNotify(): Process the contents of Notification Request
  (for instance, display it to the user or log it).

- If Issue 198 removes the EapTunnelled variable, most of 
  the points below are solved.

- No change for first point (in IEEE notation, terminal states
  are identified by having no outgoing transitions; and the 
  peer doesn't send any packets at this point).

Best regards,
Pasi

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]]On Behalf Of
> ext Bernard Aboba
> Sent: Tuesday, November 11, 2003 12:36 AM
> To: [email-masked]
> Subject: [eap] Issue 196: Peer SM Issues
> 
> 
> Issue 196: Peer SM Issues
> Submitter name: Ashwin Palekar
> Submitter email address: [email-masked]
> Date first submitted: Nov 10, 2003
> Reference:
> Document: SM-01
> Comment type: T
> Priority: S
> Section: 4
> Rationale/Explanation of issue:
> 
> In Figure 3, it is not clear from the diagrams that SUCCESS
> and FAILURE are terminal states; perhaps a function call is
> necessary to cause the packet to be sent.
>
> EapTunnelled should probably be a function call rather than
> a variable, so that there is no confusion that it is set
> when the tunnelled method is selected and applies to either
> cleartext or tunnelled packets.
> 
> The EapTunnelled variable does not describe the behavior
> of current tunneled methods such as PEAP. For example
> the state IDENTITY is reached from the RECEIVED state
> if (selectedMethod == NONE || EapTunnelled). However
> inside PEAP, an Identity can't be sent when a method
> has been selected and isn't complete.
> 
> Similarly, the transition from RECEIVED to GET_METHOD
> seems to occur on EapTunnell == TRUE even if a method
> has previously been selected and is in progress. This seems 
> wrong.
>
> Suggest adding a getIdentity() call in the IDENTITY state,
> which can take into account the information that the peer
> has available, in order to determine the appropriate
> identity to put into the EAP-Response/Identity. This
> could include, for example, "hints" in the EAP-Request/Identity,
> default settings in the peer, etc.
>
> The state machine doesn't appear to suppport sequences
> of authentication methods within tunnels.
> 
> _______________________________________________
> eap mailing list
> [email-masked]
> http://mail.frascone.com/mailman/listinfo/eap
_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap