Re: [radext] RDTLS #64 (new): 4.1 source port inclusion in the tracking table

[Alan DeKok <aland@deployingradius.com>]

radext issue tracker wrote:
>  Throughout the document it is recommended clients use connected socket
>  options... Now what happens when a client tries to send a new Access-
>  Request message using a different source port over a DTLS session that was
>  already established?

  Then the packet is discarded.  The DTLS sessions are keyed by (src
ip/port, dst ip/port).  It is by definition impossible to send packets
for one DTLS session from two different source ports.

>  If this is the intention it should be made clear clients can't switch
>  their source ports unless they also open a new DTLS session.  Client
>  implementors (most of us:) tend to gloss over server specific areas and
>  may not realize the implication.

  Hmm... OK.

>  If true and this is really the intention what stops clients from
>  originating packets from different processes per sec 3 above?

  Nothing.

>  My recommendation is to remove the source port from the tracking table key
>  and just allow DTLS session to be client specific so any source port can
>  be used as we do traditionally to get around the ID limit mess.

  IMHO, that is a very bad idea, and quite likely impossible to
implement in practice.  If you have two DTLS sessions from a client, and
packets from more than two different source ports, you'll need to
somehow inspect the traffic to determine which packet belongs to which
session.

>  This approach will cut down on the number of DTLS sessions in a busy
>  environment and simplify implementations. If you want to support NATs and
>  the like you still can by broadcasting the packet to all matching DTLS
>  sessions.

  Ouch.  With 100 sessions, that means every packet results in 99 failures.

  I don't think that's a good idea at all.

  Alan DeKok.

--
to unsubscribe send a message to radiusext-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>