Subject: [eap] EAP-04 lower layer indications

From: [email-masked] ([email-masked])
Date: Sun, 6 Jul 2003 17:22:40 +0300

EAP-04 lower layer indications
Submitter name: Pasi Eronen
Submitter email address: [email-masked]
Date first submitted: July 6, 2003
Reference:=20
Document: RFC2284bis
Comment type: T
Priority: 1
Section: 3.4
Rationale/Explanation of issue:

Section 3.4 says that=20

   "Section 4.2 defines the circumstances in which a peer,
   having concluded an EAP method with successful acknowledged
   result indications, may conclude that a Success packet has
   been lost after expiration of a timeout.  In those same
   circumstances, if a peer receives a lower layer success
   indication as defined in Section 7.2, it MAY conclude that a
   Success packet has been lost without waiting for a
   timeout. This ensures that an attacker spoofing lower layer
   indications can at best succeed in a denial of service
   attack."

This is not exactly what the current state machine does...

The current text says that "if you are in a situation where a
timeout would lead to success (that is, you have received a
method-specific success indication), also lower-layer success
indication does."

What the current state mechine does is "if you are in a
situation where receiving an EAP Success packet would lead to
success, also lower-layer success indication does." Or in other
words, the effect of receiving a lower-layer success indication
is identical to receiving an EAP Success: if an EAP Success
packet would be silently discarded, so is the lower-layer
success indication.

Both are IMHO quite reasonable approaches, and I just
wanted to clarify which one we really want to use?

A second issue: Earlier versions of the draft also mentioned
lower-layer failure indications (e.g. "Lower layer failure
indications provided to EAP by the lower layer MUST be processed
and will cause an EAP exchange in progress to be aborted." in
-03 version).  This seems to be missing from -04, and I think
the old text still applies?

Best regards,
Pasi

---

From: [email-masked] (Jari Arkko)
Date: Sun, 06 Jul 2003 17:35:41 +0300

[email-masked] wrote:

> Section 3.4 says that 

Hmm... if we get a method specific success indication, shouldn't
we enable then in all three cases below:
(a) Success received
(b) Lower-layer success indication
(c) Timeout?

> the old text still applies?

Can't remember what happened to this.

--Jari

---

From: [email-masked] (John Vollbrecht)
Date: Tue, 08 Jul 2003 18:04:32 -0400

> (b) Lower-layer success indication

seems right to me

> _______________________________________________
> eap mailing list
> [email-masked]
> http://mail.frascone.com/mailman/listinfo/eap
>

---

From: [email-masked] (Henrik Levkowetz)
Date: Wed, 9 Jul 2003 00:45:32 +0200

> Can't remember what happened to this.

This was changed as part of the edits of issue 131.
Issue 131:
 http://www.drizzle.com/~aboba/EAP/eapissues.html#Issue%20131
Diff:
 http://www.levkowetz.com/pub/ietf/drafts/eap/draft-ietf-eap-rfc2284bis-04.d-from-4.b.diff.html

	Henrik