Subject: Re: (radius) Tagged attribute question

From: Barney Wolff <[email-masked]>
Date: Fri, 9 Apr 1999 12:21 EDT

While we're discussing tags, I'd like to get the language (and perhaps
intent) of the tag definitions clarified.  For the binary attributes
(Tunnel-Type, Tunnel-Medium-Type, Tunnel-Preference) we are instructed
to make tag 0 (ie, 8 zero bits) to indicate the absence of a tag.  For
the string attributes (Tunnel-Client-Endpoint, Tunnel-Server-Endpoint)
we are instructed to omit the tag byte.  For Tunnel-Password, the
exact wording seems to say that we must make the tag 0x20 or greater
to indicate that it's not being used, rather than making it zero or
omitting it.  This seems unnecessarily inconsistent, given that the
length of the string portion of the Tunnel-Password is always a
multiple of 16 bytes, and so the presence or absence of the tag could
be uniquely determined by examining the attribute length.  But if
we're going to say the tag byte should always be present in Tunnel-
Password, we should make it zero when not used.

And was there any real need to treat having only a single set of
attributes as a special case, and say that the tag SHOULD NOT be
used?  That complicates the code, rather than simplifying it.

Barney Wolff  <[email-masked]>
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: Marc De Vries <[email-masked]>
Date: Fri, 09 Apr 1999 19:21:56 +0200

The special case is not just for user profiles that contain only one
tunnel attribute set. It also accomodates servers that are not tag-aware
and send plain integers and strings (and that ommit the
Tunnel-Password).

This special case may complicate the code for new implementations (IMO
not really that big a deal), but at least it does not require everybody
to upgrade their radius servers, only the dictionaries.

Marc.

-

---

From: "Darran Potter" <[email-masked]>
Date: Fri, 9 Apr 1999 20:23:19 +0100

Since we will always be using tags, CiscoSecure will always send
a non-zero tag. So I guess this will make us RFC compliant and
non-interopable in one go.

oh well.

----- Original Message ----- 
From: Marc De Vries <[email-masked]>
Cc: ietf-radius <[email-masked]>
Sent: 09 April 1999 18:21
Subject: Re: (radius) Tagged attribute question

-

---

From: "Darran Potter" <[email-masked]>
Date: Tue, 13 Apr 1999 14:48:39 +0100

Im wondering if the draft authors have any comment on any if this?

Regarding 0x20...It should probably just say "invalid tag values should be
ignored".. which is what I *think* it means..... who knows.

One last question, the plain text tunnel password length that is encrypted
along with the password itself... what benefit does this provide?

Darran

----- Original Message ----- 
From: Barney Wolff <[email-masked]>
To: <[email-masked]>
Sent: 09 April 1999 17:21
Subject: Re: (radius) Tagged attribute question

-

---

From: "Glen Zorn" <[email-masked]>
Date: Tue, 13 Apr 1999 18:28:38 -0700

> Password, we should make it zero when not used.

OK.

-