Re: [radext] WGLC for draft-ietf-radext-radiusv11-02

Fabian Mauchle <fabian.mauchle@switch.ch> Mon, 06 November 2023 08:49 UTC

Return-Path: <fabian.mauchle@switch.ch>
X-Original-To: radext@ietfa.amsl.com
Delivered-To: radext@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 52823C1705FA for <radext@ietfa.amsl.com>; Mon, 6 Nov 2023 00:49:02 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.105
X-Spam-Level:
X-Spam-Status: No, score=-2.105 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=switch.ch
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UVe9y8ISu07k for <radext@ietfa.amsl.com>; Mon, 6 Nov 2023 00:48:58 -0800 (PST)
Received: from mx3.switch.ch (mx3.switch.ch [85.235.88.34]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8F88AC16F3FF for <radext@ietf.org>; Mon, 6 Nov 2023 00:48:56 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=switch.ch; l=975; s=selector1; t=1699260537; h=message-id:date:mime-version:subject:to:references:from: in-reply-to:content-transfer-encoding; bh=XY0fNqHRMwBY0N92uW4DYaeOCnpPHKodLHCtXZ4yMbg=; b=CYA4qCthQMFpCndmqrAB+jrK5eFNWbQ+BpA+n+1JlaZ/cLyMGkf987ig jkQBGdWQ0/eOMa39+c2kVAyeWXz7s2Ilsw0lrHKnqUMHfTBvswBMhbfV+ dIlliSjqAEk4hharIA6HCP1vFUaMAwAGK5AsuSAGtYMxYgqUjleGUEdal Zju82fS0DPj+6fmOzN6oaV77/QwgEHTXZ9JdMd6rEotgJ0qxt05KmPucg mCTv6G05CGDQiztGEgrhyJlXrd+XdEoNj+PpnEifGkuvE4lH6N/D3GV2B D1wz0AocjaoLMpT9IyNaOVAMWMYxt78hc6NQwsrGC/iPSLxkhwdi9yMqI g==;
X-IronPort-MAIL-FROM: fabian.mauchle@switch.ch
X-IronPort-RCPT-TO: radext@ietf.org
X-IronPort-AV: E=Sophos;i="6.03,280,1694728800"; d="scan'208";a="5834927"
Received: from unknown (HELO SWH-S02-EXC1.swd.switch.ch) ([172.16.60.11]) by mx3int.switch.ch with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 06 Nov 2023 09:48:53 +0100
Received: from [130.59.116.142] (172.16.60.33) by SWH-S02-EXC1.swd.switch.ch (172.16.60.11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1118.37; Mon, 6 Nov 2023 09:48:53 +0100
Message-ID: <72de49a9-1743-4c02-ba7d-ab4d42b84fca@switch.ch>
Date: Mon, 06 Nov 2023 09:48:52 +0100
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Content-Language: en-US, de-CH
To: radext@ietf.org
References: <06a401da0827$838550f0$8a8ff2d0$@smyslov.net>
From: Fabian Mauchle <fabian.mauchle@switch.ch>
In-Reply-To: <06a401da0827$838550f0$8a8ff2d0$@smyslov.net>
Content-Type: text/plain; charset="UTF-8"; format="flowed"
Content-Transfer-Encoding: 7bit
X-Originating-IP: [172.16.60.33]
X-ClientProxiedBy: SWH-S06-EXC4.swd.switch.ch (172.16.60.18) To SWH-S02-EXC1.swd.switch.ch (172.16.60.11)
Archived-At: <https://mailarchive.ietf.org/arch/msg/radext/4f7TXhsINj0u1IcF_UFGQIz7i4k>
Subject: Re: [radext] WGLC for draft-ietf-radext-radiusv11-02
X-BeenThere: radext@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: RADIUS EXTensions working group discussion list <radext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/radext>, <mailto:radext-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/radext/>
List-Post: <mailto:radext@ietf.org>
List-Help: <mailto:radext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/radext>, <mailto:radext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 06 Nov 2023 08:49:02 -0000

Hi,

On 26.10.23 18:14, Valery Smyslov wrote:
> Please send messages to the list with clear indication whether you support
> publication of this document or not (in the latter case it's good if the reasons are provided).

When re-reading the draft, I found a possibly critical omission:

Section 3.3, Case "1.0, 1.1", Server Behavior:

It does not define what to do if the server receives "radius/1.1". There 
should be a sentence like:

   If the server receives no ALPN name from the client, it MUST
   use historic RADIUS/TLS.

+ If the server receives an ALPN name of "radius/1.1" from
+ the client, it MUST use RADIUS/1.1.

+ Otherwise, if the server receives an ALPN name "radius/1.0" from the
   client, it MUST reply with ALPN "radius/1.0", and then use
   historic RADIUS/TLS.

Best regards,
Fabian

-- 
Fabian Mauchle, Network

SWITCH
Werdstrasse 2, P.O. Box, 8021 Zurich, Switzerland
Phone +41 44 268 15 30, direct +41 44 268 15 39