Re: [radext] A proposal to allow more than 256 packets on any connection

[Alan DeKok <[e-mail]>]

On Apr 24, 2017, at 5:04 PM, Ignacio Goyret <[e-mail]> wrote:
> 
> At what point would a new header be better instead of hacking new attributes
> into the uniqueness equation?

 When you want to use Diameter.

> And at what point RADIUS becomes Diameter?

  When you change the header.

> Since this proposal would require non-trivial changes to both servers and
> clients to agree on a new algorithm,

  I don't know what you mean by "new algorithm".  *Any* change to RADIUS requires negotiation.  And any change requires changes on both the client and server.

> they might as well agree on a new header,

  Which requires *more* changes to clients and servers than my proposal.

> This way, the uniqueness function (src/dst ip/port + id) doesn't need to change.

  I'm proposing to change  (src/dst ip/port + id)  to  (src/dst ip/port + id + request-authenticator)

  Which is a smaller change than the one you propose.

  In this proposal, all RADIUS request packets are *identical* to existing RADIUS.  All RADIUS response packets contain one new attribute.  The responses are otherwise 100% standard RADIUS.

  There are *implementation* changes on client and server.  But again, they are largely limited to using "Request Authenticator" in the key that determines packet identity.  The encoding and decoding procedures are *exactly* the same as for standard RADIUS.

  Alan DeKok.