errata logo graphic

Found 4 records.

Status: Verified (2)

RFC4673, "RADIUS Dynamic Authorization Server MIB", September 2006

Source of RFC: radext (ops)

Errata ID: 888

Status: Verified
Type: Technical

Reported By: Alfred Hoenes
Date Reported: 2006-11-06
Verifier Name: Stefaan De Cnodder
Date Verified: 2006-11-07

 

severe MIB module structural problem
-- issue instantiated similarly in both RFC 4672 and 4673

Let's start with RFC 4672 and the RADIUS-DYNAUTH-CLIENT-MIB module.

On page 5 of RFC 4672, two module-global scalar objects are specified;
the DESCRIPTION clause of the
radiusDynAuthClientDisconInvalidServerAddresses OBJECT-TYPE says:

                                           [...].  This counter may
                 experience a discontinuity when the DAC module
                 (re)starts, as indicated by the value of
                 radiusDynAuthClientCounterDiscontinuity."

and the literally same sentence appears again in the DESCRIPTION
clause of the radiusDynAuthClientCoAInvalidServerAddresses OBJECT-TYPE.

This would make sense iff radiusDynAuthClientCounterDiscontinuity
would have been defined as another module-global scalar MIB object.
But unfortunately, radiusDynAuthClientCounterDiscontinuity is a
tabular row object in the radiusDynAuthServerTable, with separate
instances for every radiusDynAuthServerIndex instantiated there.
So, which object instance should be taken for reference ???
Moreover, should ever the radiusDynAuthServerTable be empty,
no such CounterDiscontinuity objects would be instantiated,
invalidating the semantical integrity of the MIB module.

Thus, let's take a closer look at the DESCRIPTION clause of the
radiusDynAuthClientCounterDiscontinuity OBJECT-TYPE, on page 17
of the RFC:

          DESCRIPTION
                "The time (in hundredths of a second) since the
                 last counter discontinuity.  A discontinuity may
                 be the result of a reinitialization of the DAC
                 module within the managed entity."

It remains unclear which scope was intended, i.e. whether "the last
counter discontinuity" was meant to just cover the counters within
the same conceptual row of the table, of it was meant to cover all
the counter objects in the MIB module.
If the former interpretation is to be accepted, the references
to this object from the scalar objects' DESCRIPTIONS quoted above
would be severely ambiguous.
In case of the latter interpretation, the semantics of this object
indeed do not depend in any way on the conceptual row, i.e. the
related radiusDynAuthServerIndex instance; but if an object of
the same semantics appears in every table row instantiated, all
of its instances must have the same value at any point in time.
Hence, the object with that semantics should have been modeled
as a module-global scalar object, and not as a tabular object !!!

IMHO, such a single, module-global scalar object would perhaps be
sufficient for the desired purpose.

In a similar way, the module-global scalar counters in the
RADIUS-DYNAUTH-SERVER-MIB module,
radiusDynAuthServerDisconInvalidClientAddresses and
adiusDynAuthServerCoAInvalidClientAddresses,
as specified on page 6 of RFC 4673, refer to the object,
radiusDynAuthServerCounterDiscontinuity,
which turns out to be a tabular row object in the
radiusDynAuthClientTable, not another scalar object,
thus leading to the same kind of ambiguity.

Taken altogether, the specifications are ambigous and will certainly
lead to interoperability problems.

I strongly propose to revise these MIB module specifications as
soon as possible.

Notes:

from pending

--VERIFIER COMMENT--
seems to be correct. The scalars do not have a discontinuity object.
That sentence should be removed or either an object has to be added. It
seems that the other mibs like RFC4668 also does not have such an object
for the scalars while it has a discontinuity timer for the objects in
the table... It should be for all or for none I would think.


Errata ID: 25

Status: Verified
Type: Editorial

Reported By: Alfred Hoenes
Date Reported: 2006-11-06
Verifier Name: Stefaan De Cnodder
Date Verified: 2006-11-07

Section 4 says:

hundredths of a second

It should say:

centiseconds

Notes:

Why not use the common ISO-standard unit-multiple name, "centiseconds" (abbreviation: "cs"), instead of the long-winded "hundredths of a second" ?

This applies to the UNITS and the DESCRIPTION clause of
- radiusDynAuthServerCounterDiscontinuity (RFC 4673, page 17),

from pending

--VERIFIER COMMENT--
well, yes, centiseconds can be used as well but both terms are the same.


Status: Held for Document Update (1)

RFC4673, "RADIUS Dynamic Authorization Server MIB", September 2006

Source of RFC: radext (ops)

Errata ID: 891

Status: Held for Document Update
Type: Editorial

Reported By: Alfred Hoenes
Date Reported: 2006-11-06
Held for Document Update by: Dan Romascanu

Section 4 says:

[[DESCRIPTION clause of the radiusDynAuthServCoAUserSessChanged on page 15]]

       DESCRIPTION
             "The number of user sessions authorization
              changed for the CoA-Requests received from this
              Dynamic Authorization Client.

It should say:

       DESCRIPTION
|            "The number of user sessions with authorization
              changed for the CoA-Requests received from this
              Dynamic Authorization Client.  [...]

Notes:

word omission

from pending


Status: Rejected (1)

RFC4673, "RADIUS Dynamic Authorization Server MIB", September 2006

Source of RFC: radext (ops)

Errata ID: 885

Status: Rejected
Type: Technical

Reported By: Alfred Hoenes
Date Reported: 2006-11-06
Rejected by: Stefaan De Cnodder
Date Rejected: 2006-11-07

 

I am surprised that the 'OID anchor' of the RADIUS-DYNAUTH-xxx-MIB
modules does not match the OID hierarchy used in the other RADIUS
MIB modules published/updated concurrently.
I would have expected the new RADIUS MIB modules to be assigned OIDs
in the following, hierarchical way (using abbreviated notation):

  radiusMIB                  { mib-2 67 }  -- legacy, assigned by IANA
  radiusDynAuth              { radiusMIB 3 }       -- new
  RADIUS-DYNAUTH-CLIENT-MIB  { radiusDynAuth 1 }   -- new
  RADIUS-DYNAUTH-SERVER-MIB  { radiusDynAuth 2 }   -- new

instead of obtaining separate IANA assignments for the MIB module
OIDs, directly under mib-2.

Has there been a strong reason for this deviation from the established
pattern?

Notes:

from pending

--VERIFIER COMMENT--
Yes, there is a strong reason for it. In fact original in the first
versions of the draft, it was as follows:

radiusDynamicAuthorization OBJECT IDENTIFIER ::= { radiusMIB 3 }

radiusDynAuthServerMIBObjects OBJECT IDENTIFIER ::=
{ radiusDynAuthServerMIB 1 }

radiusDynAuthServer OBJECT IDENTIFIER ::=
{ radiusDynAuthServerMIBObjects 1 }


check
http://www.watersprings.org/pub/id/draft-decnodder-radext-dynauth-server-mib-00.txt

The reason for not doing so was that this was more difficult to
maintain. It was discussed at the mailinglist but I should search in the
archives to find it back.


Report New Errata