--- 1/draft-ietf-radext-rfc3576bis-07.txt 2007-06-07 22:12:06.000000000 +0200 +++ 2/draft-ietf-radext-rfc3576bis-08.txt 2007-06-07 22:12:06.000000000 +0200 @@ -1,17 +1,17 @@ Network Working Group Murtaza S. Chiba INTERNET-DRAFT Gopal Dommety Obsoletes: 3576 Mark Eklund Category: Informational Cisco Systems, Inc. - David Mitton -27 May 2007 RSA Security, Inc. + David Mitton +4 June 2007 RSA Security, Inc. Bernard Aboba Microsoft Corporation Dynamic Authorization Extensions to Remote Authentication Dial In User Service (RADIUS) By submitting this Internet-Draft, each author represents that any applicable patent or other IPR claims of which he or she is aware have been or will be disclosed, and any of which he or she becomes aware will be disclosed, in accordance with Section 6 of BCP 79. @@ -51,63 +51,63 @@ 1. Introduction .......................................... 3 1.1 Applicability ................................... 3 1.2 Requirements Language ........................... 4 1.3 Terminology ..................................... 4 2. Overview ............................................. 5 2.1 Disconnect Messages (DM) ........................ 5 2.2 Change-of-Authorization Messages (CoA) .......... 5 2.3 Packet Format ................................... 6 3. Attributes ............................................ 10 3.1 Proxy State ..................................... 12 - 3.2 Authorize Only .................................. 12 + 3.2 Authorize Only .................................. 13 3.3 State ........................................... 13 3.4 Message-Authenticator ........................... 14 3.5 Error-Cause ..................................... 15 3.6 Table of Attributes ............................. 18 -4. Diameter Considerations ............................... 21 -5. IANA Considerations ................................... 23 -6. Security Considerations ............................... 24 - 6.1 Authorization Issues ............................ 24 - 6.2 Impersonation ................................... 25 - 6.3 IPsec Usage Guidelines .......................... 25 - 6.4 Replay Protection ............................... 28 -7. Example Traces ........................................ 29 -8. References ............................................ 29 - 8.1 Normative References ............................ 29 - 8.2 Informative References .......................... 30 -ACKNOWLEDGMENTS .............................................. 31 -AUTHORS' ADDRESSES ........................................... 32 -Appendix A - Changes from RFC 3576 ........................... 33 -Full Copyright Statement ..................................... 35 -Intellectual Property ........................................ 35 +4. Diameter Considerations ............................... 22 +5. IANA Considerations ................................... 24 +6. Security Considerations ............................... 25 + 6.1 Authorization Issues ............................ 25 + 6.2 Impersonation ................................... 26 + 6.3 IPsec Usage Guidelines .......................... 26 + 6.4 Replay Protection ............................... 29 +7. Example Traces ........................................ 30 +8. References ............................................ 30 + 8.1 Normative References ............................ 30 + 8.2 Informative References .......................... 31 +ACKNOWLEDGMENTS .............................................. 32 +AUTHORS' ADDRESSES ........................................... 33 +Appendix A - Changes from RFC 3576 ........................... 34 +Full Copyright Statement ..................................... 36 +Intellectual Property ........................................ 36 1. Introduction The RADIUS protocol, defined in [RFC2865], does not support unsolicited messages sent from the RADIUS server to the Network Access Server (NAS). However, there are many instances in which it is desirable for changes to be made to session characteristics, without requiring the NAS to initiate the exchange. For example, it may be desirable for - administrators to be able to terminate a user session in progress. + administrators to be able to terminate user session(s) in progress. Alternatively, if the user changes authorization level, this may - require that authorization attributes be added/deleted from a user - session. + require that authorization attributes be added/deleted from user + session(s). To overcome these limitations, several vendors have implemented additional RADIUS commands in order to be able to support unsolicited messages to be sent to the NAS. These extended commands provide support for Disconnect and Change-of-Authorization (CoA) packets. - Disconnect packets cause a user session to be terminated immediately, - whereas CoA packets modify session authorization attributes such as - data filters. + Disconnect packets cause user session(s) to be terminated + immediately, whereas CoA packets modify session authorization + attributes such as data filters. 1.1. Applicability This protocol is being recommended for publication as an Informational RFC rather than as a standards-track RFC because of problems that cannot be fixed without creating incompatibilities with deployed implementations. This includes security vulnerabilities, as well as semantic ambiguities resulting from the design of the Change- of-Authorization (CoA) commands. While fixes are recommended, they cannot be made mandatory since this would be incompatible with @@ -188,76 +188,76 @@ packet, and SHOULD record the event in a statistics counter. 2. Overview This section describes the most commonly implemented features of Disconnect and Change-of-Authorization (CoA) packets. 2.1. Disconnect Messages (DM) A Disconnect-Request packet is sent by the Dynamic Authorization - Client in order to terminate a user session on a NAS and discard all + Client in order to terminate user session(s) on a NAS and discard all associated session context. The Disconnect-Request packet is sent to - UDP port 3799, and identifies the NAS as well as the user session to - be terminated by inclusion of the identification attributes described - in Section 3. + UDP port 3799, and identifies the NAS as well as the user session(s) + to be terminated by inclusion of the identification attributes + described in Section 3. +----------+ +----------+ | | Disconnect-Request | | | | <-------------------- | Dynamic | | NAS | | Authz | | | Disconnect-Response | Client | | | ---------------------> | | +----------+ +----------+ The NAS responds to a Disconnect-Request packet sent by a Dynamic Authorization Client with a Disconnect-ACK if all associated session - context is discarded and the user session is no longer connected, or - a Disconnect-NAK, if the NAS was unable to disconnect the session and - discard all associated session context. A Disconnect-ACK MAY contain - the Attribute Acct-Terminate-Cause (49) [RFC2866] with the value set - to 6 for Admin-Reset. + context is discarded and the user session(s) are no longer connected, + or a Disconnect-NAK, if the NAS was unable to disconnect one or more + sessions and discard all associated session context. A Disconnect- + ACK MAY contain the Attribute Acct-Terminate-Cause (49) [RFC2866] + with the value set to 6 for Admin-Reset. 2.2. Change-of-Authorization Messages (CoA) CoA-Request packets contain information for dynamically changing session authorizations. Typically this is used to change data filters. The data filters can be of either the ingress or egress kind, and are sent in addition to the identification attributes as described in section 3. The port used, and packet format (described in Section 2.3), are the same as that for Disconnect-Request packets. The following attributes MAY be sent in a CoA-Request: Filter-ID (11) - Indicates the name of a data filter list - to be applied for the session that the + to be applied for the session(s) that the identification attributes map to. NAS-Filter-Rule (92) - Provides a filter list to be applied - for the session that the identification + for the session(s) that the identification attributes map to [RFC4849]. +----------+ +----------+ | | CoA-Request | | | | <-------------------- | Dynamic | | NAS | | Authz | | | CoA-Response | Client | | | ---------------------> | | +----------+ +----------+ The NAS responds to a CoA-Request sent by a Dynamic Authorization Client with a CoA-ACK if the NAS is able to successfully change the - authorizations for the user session, or a CoA-NAK if the CoA-Request - is unsuccessful. A NAS MUST respond to a CoA-Request including a - Service-Type Attribute with an unsupported value with a CoA-NAK; an - Error-Cause Attribute with value "Unsupported Service" SHOULD be - included. + authorizations for the user session(s), or a CoA-NAK if the CoA- + Request is unsuccessful. A NAS MUST respond to a CoA-Request + including a Service-Type Attribute with an unsupported value with a + CoA-NAK; an Error-Cause Attribute with value "Unsupported Service" + SHOULD be included. 2.3. Packet Format For either Disconnect-Request or CoA-Request packets UDP port 3799 is used as the destination port. For responses, the source and destination ports are reversed. Exactly one RADIUS packet is encapsulated in the UDP Data field. A summary of the data format is shown below. The fields are transmitted from left to right. @@ -375,136 +375,154 @@ Administrative note: As noted in [RFC2865] Section 3, the secret (password shared between the Dynamic Authorization Client and the Dynamic Authorization Server) SHOULD be at least as large and unguessable as a well-chosen password. The Dynamic Authorization Server MUST use the source IP address of the RADIUS UDP packet to decide which shared secret to use, so that requests can be proxied. Attributes - In Disconnect and CoA-Request packets, all attributes are treated - as mandatory. If one or more authorization changes specified in a - CoA-Request cannot be carried out, the NAS MUST send a CoA-NAK. A - NAS MUST respond to a CoA-Request containing one or more - unsupported Attributes or Attribute values with a CoA-NAK; an - Error-Cause Attribute with value 401 (Unsupported Attribute) or - 407 (Invalid Attribute Value) MAY be included. A NAS MUST respond - to a Disconnect-Request containing one or more unsupported - Attributes or Attribute values with a Disconnect-NAK; an Error- - Cause Attribute with value 401 (Unsupported Attribute) or 407 - (Invalid Attribute Value) MAY be included. + In CoA-Request and Disconnect-Request packets, all attributes MUST + be treated as mandatory. If one or more authorization changes + specified in a CoA-Request cannot be carried out, the NAS MUST + send a CoA-NAK. A NAS MUST respond to a CoA-Request containing + one or more unsupported Attributes or Attribute values with a CoA- + NAK; an Error-Cause Attribute with value 401 (Unsupported + Attribute) or 407 (Invalid Attribute Value) MAY be included. A + NAS MUST respond to a Disconnect-Request containing one or more + unsupported Attributes or Attribute values with a Disconnect-NAK; + an Error-Cause Attribute with value 401 (Unsupported Attribute) or + 407 (Invalid Attribute Value) MAY be included. State changes resulting from a CoA-Request MUST be atomic: if the - CoA-Request is successful, the Dynamic Authorization Server MUST + CoA-Request is successful for all matching sessions, the NAS MUST send a CoA-ACK in reply, and all requested authorization changes - MUST be made. If the CoA-Request is unsuccessful, a CoA-NAK MUST - be sent in reply, and the requested authorization changes MUST NOT - be made. Similarly, a state change MUST NOT occur as a result of - an unsuccessful Disconnect-Request; the Dynamic Authorization - Server MUST send a Disconnect-NAK in reply. + MUST be made. If the CoA-Request is unsuccessful for any matching + sessions, the NAS MUST send as CoA-NAK in reply, and the requested + authorization changes MUST NOT be made for any of the matching + sessions. Similarly, a state change MUST NOT occur as a result of + a Disconnect-Request that is unsuccessful with respect to any of + the matching sessions; a NAS MUST send a Disconnect-NAK in reply + if any of the matching sessions cannot be successfully terminated. + A NAS which does not support dynamic authorization changes + applying to multiple sessions MUST send a CoA-NAK or Disconnect- + NAK in reply; an Error-Cause Attribute with value 508 (Multiple + Session Selection Unsupported) SHOULD be included. Within this specification attributes can be used for identification, authorization or other purposes. RADIUS Attribute specifications created after publication of this document SHOULD state whether an attribute can be included in CoA or Disconnect messages and if so, which messages it can be included in and whether it serves as an identification or authorization attribute. Even if a NAS implements an attribute for use with RADIUS authentication and accounting, it is possible that it will not support inclusion of that attribute within CoA-Request and Disconnect-Request packets, given the difference in attribute semantics. This is true even for attributes specified as allowable within Access-Accept packets (such as those defined within [RFC2865], [RFC2868], [RFC2869], [RFC3162], [RFC3579], [RFC4372], [RFC4675], [RFC4818] and [RFC4849]). 3. Attributes In Disconnect-Request and CoA-Request packets, certain attributes are - used to uniquely identify the NAS as well as a user session on the - NAS. All NAS identification attributes included in a Request packet - MUST match in order for a Disconnect-Request or CoA-Request to be - successful; otherwise a Disconnect-NAK or CoA-NAK SHOULD be sent. - For session identification attributes, the User-Name and Acct- - Session-Id Attributes, if included, MUST match in order for a - Disconnect-Request or CoA-Request to be successful; other session - identification attributes SHOULD match. Where a mismatch of session - identification attributes is detected, a Disconnect-NAK or CoA-NAK - SHOULD be sent. + used to uniquely identify the NAS as well as user session(s) on the + NAS. All NAS and session identification attributes included in a + CoA-Request or Disconnect-Request packet MUST match at least one + session in order for a Request to be successful; otherwise a + Disconnect-NAK or CoA-NAK MUST be sent. If all NAS identification + attributes match, and more than one session matches all of the + session identification attributes, then a CoA-Request or Disconnect- + Request MUST apply to all matching sessions. - The ability to use NAS or session identification attributes to map to - unique/multiple sessions is beyond the scope of this document. Identification attributes include NAS and session identification attributes, as described below. NAS identification attributes Attribute # Reference Description --------- --- --------- ----------- NAS-IP-Address 4 [RFC2865] The IPv4 address of the NAS. NAS-Identifier 32 [RFC2865] String identifying the NAS. NAS-IPv6-Address 95 [RFC3162] The IPv6 address of the NAS. Session identification attributes Attribute # Reference Description --------- --- --------- ----------- User-Name 1 [RFC2865] The name of the user - associated with the session. - NAS-Port 5 [RFC2865] The port on which the + associated with one or + more sessions. + NAS-Port 5 [RFC2865] The port on which a session is terminated. + Framed-IP-Address 8 [RFC2865] The IPv4 address associated + with a session. + Vendor-Specific 26 [RFC2865] One or more vendor-specific + identification attributes. Called-Station-Id 30 [RFC2865] The link address to which - the session is connected. + a session is connected. Calling-Station-Id 31 [RFC2865] The link address from which - the session is connected. + one or more sessions are + connected. Acct-Session-Id 44 [RFC2866] The identifier uniquely - identifying the session + identifying a session on the NAS. Acct-Multi-Session-Id 50 [RFC2866] The identifier uniquely identifying related sessions. NAS-Port-Id 87 [RFC2869] String identifying the port - where the session is. - Chargeable-User- 89 [RFC4372] The CUI associated with the - Identity session. Needed where a - privacy NAI is used, because - the User-Name may not be - unique (e.g. "anonymous"). + where a session is. + Chargeable-User- 89 [RFC4372] The CUI associated with one + Identity or more sessions. Needed + where a privacy NAI is used, + since in this case the + User-Name (e.g. "anonymous") + may not identify sessions + belonging to a given user. + Framed-Interface-Id 96 [RFC3162] The IPv6 Interface Identifier + associated with a session; + always sent with + Framed-IPv6-Prefix. + Framed-IPv6-Prefix 97 [RFC3162] The IPv6 prefix associated + with a session, always sent + with Framed-Interface-Id. To address security concerns described in Section 6.1, either the User-Name or Chargeable-User-Identity attribute SHOULD be present in Disconnect-Request and CoA-Request packets. Where a Diameter client utilizes the same Session-Id for both authorization and accounting, inclusion of an Acct-Session-Id Attribute in a Disconnect-Request or CoA-Request can assist with Diameter/RADIUS translation, since Diameter RAR and ASR commands include a Session-Id AVP. An Acct-Session-Id Attribute SHOULD be included in Disconnect-Request and CoA-Request packets. A NAS implementing this specification SHOULD send an Acct-Session-Id or Acct-Multi-Session-Id Attribute within an Access-Request. Where an Acct-Session-Id or Acct-Multi-Session-Id Attribute is not included - within an Access-Request, the Dynamic Authorizatoin Client will not + within an Access-Request, the Dynamic Authorization Client will not know the Acct-Session-Id or Acct-Multi-Session-Id of the session it is attempting to target, unless it also has access to the accounting data for that session. Where an Acct-Session-Id or Acct-Multi-Session-Id Attribute is not present in a CoA-Request or Disconnect-Request, it is possible that the the User-Name or Chargeable-User-Identity attributes will not be - sufficient to uniquely identify the session (e.g. if the same user - has multiple sessions on the NAS, or if the privacy NAI is used). In - this case, session identification MAY be performed by using one or - more of the Called-Station-Id, Calling-Station-Id, NAS-Port and NAS- - Port-Id attributes. + sufficient to uniquely identify a single session (e.g. if the same + user has multiple sessions on the NAS, or if the privacy NAI is + used). In this case if it is desired to identify a single session, + session identification MAY be performed by using one or more of the + Framed-IP-Address, Framed-IPv6-Prefix/Framed-Interface-Id, Called- + Station-Id, Calling-Station-Id, NAS-Port and NAS-Port-Id attributes. To address security concerns described in Section 6.2, one or more of the NAS-IP-Address or NAS-IPv6-Address Attributes SHOULD be present in CoA-Request and Disconnect-Request packets; the NAS-Identifier Attribute MAY be present. A Disconnect-Request MUST contain only NAS and session identification attributes. If other attributes are included in a Disconnect- Request, implementations MUST send a Disconnect-NAK; an Error-Cause Attribute with value "Unsupported Attribute" MAY be included. @@ -565,26 +583,29 @@ If a CoA-Request packet including a Service-Type value of "Authorize Only" is successfully processed, the NAS MUST respond with a CoA-NAK containing a Service-Type Attribute with value "Authorize Only", and an Error-Cause Attribute with value 507 (Request Initiated). The NAS then MUST send an Access-Request to the RADIUS server including a Service-Type Attribute with value "Authorize Only", along with a State Attribute. This Access-Request SHOULD contain the NAS identification attributes from the CoA-Request, as well as the session identification attributes from the CoA-Request permitted in - an Access-Request. As noted in [RFC2869] Section 5.19, a Message- - Authenticator attribute SHOULD be included in an Access-Request that - does not contain a User-Password, CHAP-Password, ARAP-Password or - EAP-Message Attribute. The RADIUS server then will respond to the - Access-Request with an Access-Accept to (re-)authorize the session or - an Access-Reject to refuse to (re-)authorize it. + an Access-Request; it also MAY contain other attributes permitted in + an Access-Request. + + As noted in [RFC2869] Section 5.19, a Message-Authenticator attribute + SHOULD be included in an Access-Request that does not contain a User- + Password, CHAP-Password, ARAP-Password or EAP-Message Attribute. The + RADIUS server then will respond to the Access-Request with an Access- + Accept to (re-)authorize the session or an Access-Reject to refuse to + (re-)authorize it. 3.3. State The State Attribute is available to be sent by the Dynamic Authorization Client to the NAS in a CoA-Request packet and MUST be sent unmodified from the NAS to the Dynamic Authorization Client in a subsequent ACK or NAK packet. [RFC2865] Section 5.44 states: @@ -716,26 +736,27 @@ 405 Unsupported Service 406 Unsupported Extension 407 Invalid Attribute Value 501 Administratively Prohibited 502 Request Not Routable (Proxy) 503 Session Context Not Found 504 Session Context Not Removable 505 Other Proxy Processing Error 506 Resources Unavailable 507 Request Initiated + 508 Multiple Session Selection Unsupported "Residual Session Context Removed" is sent in response to a - Disconnect-Request if the user session is no longer active, but - residual session context was found and successfully removed. This - value is only sent within a Disconnect-ACK and MUST NOT be sent - within a CoA-ACK, Disconnect-NAK or CoA-NAK. + Disconnect-Request if one or more user session(s) are no longer + active, but residual session context was found and successfully + removed. This value is only sent within a Disconnect-ACK and MUST + NOT be sent within a CoA-ACK, Disconnect-NAK or CoA-NAK. "Invalid EAP Packet (Ignored)" is a non-fatal error that MUST NOT be sent by implementations of this specification. "Unsupported Attribute" is a fatal error sent if a Request contains an attribute (such as a Vendor-Specific or EAP-Message Attribute) that is not supported. "Missing Attribute" is a fatal error sent if critical attributes (such as NAS or session identification attributes) are missing @@ -750,36 +771,36 @@ EAP- Message Attribute(s)) are not formatted properly. "Unsupported Service" is a fatal error sent if a Service-Type Attribute included with the Request is sent with an invalid or unsupported value. This error cannot be sent in response to a Disconnect-Request. "Unsupported Extension" is a fatal error sent due to lack of support for an extension such as Disconnect and/or CoA packets. This will typically be sent by a proxy receiving an ICMP port - unreachable message after attempting to forward a CoA or + unreachable message after attempting to forward a CoA-Request or Disconnect-Request to the NAS. "Invalid Attribute Value" is a fatal error sent if a CoA-Request or Disconnect-Request contains an attribute with an unsupported value. "Administratively Prohibited" is a fatal error sent if the NAS is configured to prohibit honoring of CoA-Request or Disconnect- Request packets for the specified session. "Request Not Routable" is a fatal error which MAY be sent by a proxy and MUST NOT be sent by a NAS. It indicates that the proxy - was unable to determine how to route a CoA or Disconnect-Request - to the NAS. For example, this can occur if the required entries - are not present in the proxy's realm routing table. + was unable to determine how to route a CoA-Request or Disconnect- + Request to the NAS. For example, this can occur if the required + entries are not present in the proxy's realm routing table. "Session Context Not Found" is a fatal error sent if the session context identified in the CoA-Request or Disconnect-Request does not exist on the NAS. "Session Context Not Removable" is a fatal error sent in response to a Disconnect-Request if the NAS was able to locate the session context, but could not remove it for some reason. It MUST NOT be sent within a CoA-ACK, CoA-NAK or Disconnect-ACK, only within a Disconnect-NAK. @@ -788,138 +809,147 @@ to a CoA or Disconnect-Request that could not be processed by a proxy, for reasons other than routing. "Resources Unavailable" is a fatal error sent when a CoA or Disconnect-Request could not be honored due to lack of available NAS resources (memory, non- volatile storage, etc.). "Request Initiated" is a fatal error sent by a NAS in response to a CoA-Request including a Service-Type Attribute with a value of "Authorize Only". It indicates that the CoA-Request has not been - honored, but that the NAS is sending a RADIUS Access-Request - including a Service-Type Attribute with value "Authorize Only" to - the RADIUS server. + honored, but that the NAS is sending one or more RADIUS Access- + Request(s) including a Service-Type Attribute with value + "Authorize Only" to the RADIUS server. + + "Multiple Session Selection Unsupported" is a fatal error sent by + a NAS in response to a CoA-Request or Disconnect-Request whose + session identification attributes match multiple sessions, where + the NAS does not support Requests applying to multiple sessions. 3.6. Table of Attributes The following table provides a guide to which attributes may be found in which packets, and in what quantity. Change-of-Authorization Messages Request ACK NAK # Attribute 0-1 0 0 1 User-Name [Note 1] 0-1 0 0 4 NAS-IP-Address [Note 1] 0-1 0 0 5 NAS-Port [Note 1] 0-1 0 0-1 6 Service-Type 0-1 0 0 7 Framed-Protocol [Note 3] - 0-1 0 0 8 Framed-IP-Address [Note 6] - 0-1 0 0 9 Framed-IP-Netmask [Note 6] + 0-1 0 0 8 Framed-IP-Address [Notes 1,6] + 0-1 0 0 9 Framed-IP-Netmask [Note 3] 0-1 0 0 10 Framed-Routing [Note 3] 0+ 0 0 11 Filter-ID [Note 3] 0-1 0 0 12 Framed-MTU [Note 3] + Request ACK NAK # Attribute + Request ACK NAK # Attribute 0+ 0 0 13 Framed-Compression [Note 3] 0+ 0 0 14 Login-IP-Host [Note 3] 0-1 0 0 15 Login-Service [Note 3] 0-1 0 0 16 Login-TCP-Port [Note 3] 0+ 0 0 18 Reply-Message [Note 2] 0-1 0 0 19 Callback-Number [Note 3] 0-1 0 0 20 Callback-Id [Note 3] 0+ 0 0 22 Framed-Route [Note 3] - 0-1 0 0 23 Framed-IPX-Network [Note 6] + 0-1 0 0 23 Framed-IPX-Network [Note 3] 0-1 0-1 0-1 24 State 0+ 0 0 25 Class [Note 3] - 0+ 0 0 26 Vendor-Specific [Note 3] + 0+ 0 0 26 Vendor-Specific [Note 7] 0-1 0 0 27 Session-Timeout [Note 3] 0-1 0 0 28 Idle-Timeout [Note 3] 0-1 0 0 29 Termination-Action [Note 3] 0-1 0 0 30 Called-Station-Id [Note 1] 0-1 0 0 31 Calling-Station-Id [Note 1] 0-1 0 0 32 NAS-Identifier [Note 1] 0+ 0+ 0+ 33 Proxy-State 0-1 0 0 34 Login-LAT-Service [Note 3] 0-1 0 0 35 Login-LAT-Node [Note 3] 0-1 0 0 36 Login-LAT-Group [Note 3] 0-1 0 0 37 Framed-AppleTalk-Link [Note 3] 0+ 0 0 38 Framed-AppleTalk-Network [Note 3] 0-1 0 0 39 Framed-AppleTalk-Zone [Note 3] 0-1 0 0 44 Acct-Session-Id [Note 1] 0-1 0 0 50 Acct-Multi-Session-Id [Note 1] - Request ACK NAK # Attribute - Request ACK NAK # Attribute 0-1 0-1 0-1 55 Event-Timestamp 0+ 0 0 56 Egress-VLANID [Note 3] 0-1 0 0 57 Ingress-Filters [Note 3] 0+ 0 0 58 Egress-VLAN-Name [Note 3] 0-1 0 0 59 User-Priority-Table [Note 3] 0-1 0 0 61 NAS-Port-Type [Note 3] 0-1 0 0 62 Port-Limit [Note 3] 0-1 0 0 63 Login-LAT-Port [Note 3] 0+ 0 0 64 Tunnel-Type [Note 5] 0+ 0 0 65 Tunnel-Medium-Type [Note 5] 0+ 0 0 66 Tunnel-Client-Endpoint [Note 5] 0+ 0 0 67 Tunnel-Server-Endpoint [Note 5] 0+ 0 0 69 Tunnel-Password [Note 5] 0-1 0 0 71 ARAP-Features [Note 3] 0-1 0 0 72 ARAP-Zone-Access [Note 3] 0+ 0 0 78 Configuration-Token [Note 3] + Request ACK NAK # Attribute + Request ACK NAK # Attribute 0+ 0-1 0 79 EAP-Message [Note 2] 0-1 0-1 0-1 80 Message-Authenticator 0+ 0 0 81 Tunnel-Private-Group-ID [Note 5] 0+ 0 0 82 Tunnel-Assignment-ID [Note 5] 0+ 0 0 83 Tunnel-Preference [Note 5] 0-1 0 0 85 Acct-Interim-Interval [Note 3] 0-1 0 0 87 NAS-Port-Id [Note 1] - 0-1 0 0 88 Framed-Pool [Note 6] + 0-1 0 0 88 Framed-Pool [Note 3] 0-1 0 0 89 Chargeable-User-Identity [Note 1] 0+ 0 0 90 Tunnel-Client-Auth-ID [Note 5] 0+ 0 0 91 Tunnel-Server-Auth-ID [Note 5] 0-1 0 0 92 NAS-Filter-Rule [Note 3] 0 0 0 94 Originating-Line-Info 0-1 0 0 95 NAS-IPv6-Address [Note 1] - 0-1 0 0 96 Framed-Interface-Id [Note 6] - 0+ 0 0 97 Framed-IPv6-Prefix [Note 6] + 0-1 0 0 96 Framed-Interface-Id [Notes 1,6] + 0+ 0 0 97 Framed-IPv6-Prefix [Notes 1,6] 0+ 0 0 98 Login-IPv6-Host [Note 3] 0+ 0 0 99 Framed-IPv6-Route [Note 3] - 0-1 0 0 100 Framed-IPv6-Pool [Note 6] + 0-1 0 0 100 Framed-IPv6-Pool [Note 3] 0 0 0+ 101 Error-Cause - 0+ 0 0 123 Delegated-IPv6-Prefix [Note 6] + 0+ 0 0 123 Delegated-IPv6-Prefix [Note 3] Request ACK NAK # Attribute + Disconnect Messages Request ACK NAK # Attribute 0-1 0 0 1 User-Name [Note 1] 0-1 0 0 4 NAS-IP-Address [Note 1] 0-1 0 0 5 NAS-Port [Note 1] 0 0 0 6 Service-Type - 0 0 0 8 Framed-IP-Address [Note 6] + 0 0 0 8 Framed-IP-Address [Note 1] 0+ 0 0 18 Reply-Message [Note 2] 0 0 0 24 State 0+ 0 0 25 Class [Note 4] - 0+ 0 0 26 Vendor-Specific + 0+ 0 0 26 Vendor-Specific [Note 1] 0-1 0 0 30 Called-Station-Id [Note 1] 0-1 0 0 31 Calling-Station-Id [Note 1] 0-1 0 0 32 NAS-Identifier [Note 1] 0+ 0+ 0+ 33 Proxy-State 0-1 0 0 44 Acct-Session-Id [Note 1] 0-1 0-1 0 49 Acct-Terminate-Cause 0-1 0 0 50 Acct-Multi-Session-Id [Note 1] 0-1 0-1 0-1 55 Event-Timestamp 0 0 0 61 NAS-Port-Type 0+ 0-1 0 79 EAP-Message [Note 2] + Request ACK NAK # Attribute + Request ACK NAK # Attribute 0-1 0-1 0-1 80 Message-Authenticator 0-1 0 0 87 NAS-Port-Id [Note 1] 0-1 0 0 89 Chargeable-User-Identity [Note 1] 0-1 0 0 95 NAS-IPv6-Address [Note 1] - 0 0 0 96 Framed-Interface-Id [Note 6] - 0 0 0 97 Framed-IPv6-Prefix [Note 6] - 0 0 0 100 Framed-IPv6-Pool [Note 6] + 0 0 0 96 Framed-Interface-Id [Note 1] + 0 0 0 97 Framed-IPv6-Prefix [Note 1] 0 0 0+ 101 Error-Cause Request ACK NAK # Attribute The following table defines the meaning of the above table entries. 0 This attribute MUST NOT be present in packet. 0+ Zero or more instances of this attribute MAY be present in packet. 0-1 Zero or one instance of this attribute MAY be present in packet. 1 Exactly one instance of this attribute MUST be present in packet. @@ -947,51 +977,66 @@ a Disconnect-ACK is subsequently sent), the Class Attribute SHOULD be sent unmodified by the NAS to the RADIUS accounting server in the Accounting Stop packet. If the Disconnect-Request is unsuccessful, then the Class Attribute is not processed. [Note 5] When included within a CoA-Request, these attributes represent an authorization change request. Where tunnel attribute(s) are included within a successful CoA-Request, all existing tunnel attributes are removed and replaced by the new attribute(s). - [Note 6] Where included within a CoA-Request, these attributes - represent a renumbering request. Since these attributes are not used - for session identification, they MUST NOT be included within a - Disconnect-Request. Note that renumbering may not be possible in all - situations. For example, in order to change an IP address on receipt - of a changed Framed-IP-Address address, IPCP re-negotiation could be - required, which is not supported by all PPP implementations. + [Note 6] Since the Framed-IP-Address, Framed-IPv6-Prefix and Framed- + Interface-Id attributes are used for session identification, + renumbering cannot be accomplished by including values of these + attributes within a CoA-Request. Instead, a CoA-Request including a + Service-Type Attribute with a value of "Authorize Only" is sent; new + values can be supplied in an Access-Accept sent in response to the + ensuing Access-Request. Note that renumbering will not be possible + in all situations. For example, in order to change an IP address, + IPCP or IPv6CP re-negotiation could be required, which is not + supported by all PPP implementations. + + [Note 7] Within CoA-Request packets, Vendor-Specific Attributes + (VSAs) MAY be used for either session identification or authorization + change. However, the same Attribute MUST NOT be used for both + purposes simultaneously. 4. Diameter Considerations Due to differences in handling change-of-authorization requests in RADIUS and Diameter, it may be difficult or impossible for a Diameter/RADIUS gateway to successfully translate a Diameter Re-Auth- Request (RAR) to a CoA-Request and vice versa. For example, since a CoA-Request only initiates an authorization change but does not initiate re-authentication, a RAR command containing a Re-Auth- Request-Type AVP with value "AUTHORIZE_AUTHENTICATE" cannot be directly translated to a CoA-Request. A Diameter/RADIUS gateway receiving a CoA-Request containing authorization changes will need to translate this into two Diameter exchanges. First, the Diameter/RADIUS gateway will issue a RAR command including a Session- Id AVP and a Re-Auth-Request-Type AVP with value "AUTHORIZE ONLY". Then the Diameter/RADIUS gateway will respond to the ensuing access request with a response including the authorization attributes - gleaned from the CoA-Request. For the translation to be possible, - the CoA-Request MUST include a Acct-Session-Id Attribute. If the - Diameter client uses the same Session-Id for both authorization and - accounting, then the Diameter/RADIUS gateway can copy the contents of - the Acct-Session-Id Attribute into the Session-Id AVP; otherwise, it - will need to map the Acct-Session-Id value to an equivalent Session- - Id for use within a RAR command. + gleaned from the CoA-Request. To enable translation, the CoA-Request + SHOULD include a Acct-Session-Id Attribute. If the Diameter client + uses the same Session-Id for both authorization and accounting, then + the Diameter/RADIUS gateway can copy the contents of the Acct- + Session-Id Attribute into the Session-Id AVP; otherwise, it will + need to map the Acct-Session-Id value to an equivalent Session-Id for + use within a RAR command. + + Where an Acct-Session-Id attribute is not present in a CoA-Request or + Disconnect-Request, a Diameter/RADIUS gateway will either need to + determine the appropriate Acct-Session-Id, or if it cannot do so, it + can send a CoA-NAK or Disconnect-NAK in reply, possibly including an + Error-Cause Attribute with value 508 (Multiple Session Identification + Unsupported). To simplify translation between RADIUS and Diameter, Dynamic Authorization Clients can include a Service-Type Attribute with value "Authorize Only" within a CoA-Request, as described in Section 3.2. A Diameter/RADIUS gateway receiving a CoA-Request containing a Service-Type with value "Authorize Only" translates this to a RAR with Re-Auth-Request-Type AVP with value "AUTHORIZE ONLY". The received RAA is then translated to a CoA-NAK with a Service-Type value of "Authorize Only". If the Result-Code AVP in the RAA has a value in the success category, then an Error-Cause Attribute with @@ -1001,23 +1046,25 @@ Attribute is returned as suggested below. Within Diameter, a server can request that a session be aborted by sending an Abort-Session-Request (ASR), identifying the session to be terminated using Session-ID and User-Name AVPs. The ASR command is translated to a Disconnect-Request containing Acct-Session-Id and User-Name attributes. If the Diameter client utilizes the same Session-Id in both authorization and accounting, then the value of the Session-ID AVP may be placed in the Acct-Session-Id attribute; otherwise the value of the Session-ID AVP will need to be mapped to - an appropriate Acct-Session-Id value. For a Disconnect-Request to - be translatable to an ASR, an Acct-Session-Id attribute MUST be - present. If the Diameter client utilizes the same Session-Id in both + an appropriate Acct-Session-Id value. To enable translation of a + Disconnect-Request to an ASR, an Acct-Session-Id attribute SHOULD be + present. + + If the Diameter client utilizes the same Session-Id in both authorization and accounting, then the value of the Acct-Session-Id may be placed into the Session-ID AVP within the ASR; otherwise the value of the Acct-Session-Id will need to be mapped to an appropriate Session-ID value. An Abort-Session-Answer (ASA) command is sent in response to an ASR in order to indicate the disposition of the request. A Diameter/RADIUS gateway receiving a Disconnect-ACK translates this to an ASA command with a Result-Code AVP of "DIAMETER_SUCCESS". A Disconnect-NAK received from the NAS is translated to an ASA command @@ -1056,26 +1103,27 @@ Request is not needed to assist in Diameter/RADIUS translation, and may make translation more difficult. As a result, as noted in Section 3.2, the Service-Type Attribute MUST NOT be used within a Disconnect-Request. 5. IANA Considerations This document uses the RADIUS [RFC2865] namespace, see . In addition to the allocations already made in [RFC3575] and [RFC3576], this - specification requests allocation of an additional value of the - Error-Cause Attribute (101): + specification requests allocation of additional values of the Error- + Cause Attribute (101): # Value --- ----- 407 Invalid Attribute Value + 508 Multiple Session Selection Unsupported 6. Security Considerations 6.1. Authorization Issues Where a NAS is shared by multiple providers, it is undesirable for one provider to be able to send Disconnect-Request or CoA-Requests affecting the sessions of another provider. A Dynamic Authorization Server MUST silently discard Disconnect- @@ -1093,21 +1141,21 @@ To perform the RPF check, the Dynamic Authorization Server uses the session identification attributes included in Disconnect-Request or CoA-Request packets, in order to determine the RADIUS server(s) to which an equivalent Access-Request could be routed. If the source address of the Disconnect-Request or CoA-Request is within this set, then the CoA-Request or Disconnect-Request is forwarded; otherwise it MUST be silently discarded. Typically the Dynamic Authorization Server will extract the realm from the Network Access Identifier [RFC4282] included within the - User-Name or Chargeble-User-Identity Attribute, and determine the + User-Name or Chargeable-User-Identity Attribute, and determine the corresponding RADIUS servers in the realm routing tables. If the Dynamic Authorization Server maintains long-term session state, it MAY perform the authorization check based on the session identification attributes in the CoA-Request. The session identification attributes can be used to tie a session to a particular proxy or set of proxies, as with the NAI realm. Where no proxy is present, the RPF check can only be performed by the NAS if it maintains its own a realm routing table. If the NAS does not maintain a realm routing table (e.g. it selects forwarding @@ -1500,20 +1548,23 @@ o The term "Dynamic Authorization Client" is used instead of RADIUS server where it applies to the originator of CoA and Disconnect- Request packets. Similarly, the term "Dynamic Authorizatin Server" is used instead of NAS where it applies to the receiver of CoA and Disconnect-Request packets. Definitions of these terms have been added (Section 1.3). o Added requirement for duplicate detection on the Dynamic Authorization Server (Section 2.3). + o Clarified expected behavior when session identification attributes + match more than one session (Sections 2.3, 3, 3.5, 4). + o Added Chargeable-User-Identity as a session identification attribute. Removed Framed-IP-Address, Framed-IPv6-Prefix, Framed- Interface-Id and NAS-Port-Type attributes as session identification attributes. Recommended inclusion of Acct-Session-Id or Acct-Multi- Session-Id attributes in an Access-Request (Section 3). o Added recommendation that an Acct-Session-Id or Acct-Mult-Session- Id Attribute be included in an Access-Request (Section 3). o Added details relating to handling of the Proxy-State Attribute @@ -1523,31 +1574,36 @@ value "Authorize Only" is optional on both the NAS and Dynamic Authorization Client (Section 3.2). o Added requirement for inclusion of the State Attribute in CoA- Request packets including a Service-Type Attribute with a value of "Authorize Only" (Section 3.3). o Added clarification on the calculation of the Message-Authenticator Attribute (Section 3.4). - o An additional Error-Cause Attribute value (407) is allocated for - Invalid Attribute Value (Sections 3.5, 4). + o Additional Error-Cause Attribute values are allocated for Invalid + Attribute Value (407) and Multiple Session Identification Unsupported + (508) (Sections 3.5, 4). o Updated the CoA-Request Attribute Table to include Filter-Rule, Delegated-IPv6-Prefix, Egress-VLANID, Ingress-Filters, Egress-VLAN- Name and User-Priority attributes (Section 3.6). o Added the Chargeable-User-Identity Attribute to both the CoA- Request and Disconnect-Request Attribute table (Section 3.6). - o Added note on the use of the CoA-Request for renumbering (Section + o The use of Vendor-Specific Attributes (VSAs) for session + identification and authorization change has been clarified (Section + 3.6). + + o Added Note 6 on the use of the CoA-Request for renumbering (Section 3.6). o Use of the Service-Type Attribute within a Disconnect-Request is prohibited (Sections 3.2, 3.6). o Added Diameter Considerations (Section 4). o Changed the text to indicate that the Event-Timestamp Attribute should not be recalculated on retransmission. The implications for replay and duplicate detection are discussed (Section 6.4).