Re: [radext] WGLC #2 for draft-ietf-radext-dtls-04

[Alan DeKok <[e-mail]>]

Peter Deacon wrote:
>> clients be known by source IP address.  RADIUS/DTLS servers MUST treat
>> packets from unknown IP addresses as being DTLS.  This requirement
>> does not mean that the server is required to accept these packets.  It
>> means that if the server chooses to accept them, they are to be
>> treated as being DTLS.
> 
> I don't think this will work for us.  This is data that people use to
> flag/report possible new clients they should have known about, existing
> clients with changed addresses and plain old configuration errors.

  I don't see how that relates to what I said.  The text doesn't
*prevent* you from flagging IP addresses, or warning an admin about
packets from those IPs.

> It can be a configuration option, done conditionally within the context
> protocol disambiguation or even a recommendation but not something
> unconditionally required.

  This is how RADIUS works today.  Clients are keyed by known IP.
Changing that is not an option for RADIUS/UDP.

> Suggest reversing this.  Have the client maintain the flag.  If DTLS
> handshake has succeeded then client uses DTLS from then on for any
> inquiries without the option of automatically falling back to UDP.

  The draft already discusses a flag for the client.

> Servers would still maintain flag but it would only be a manually turned
> knob to indicate security level it is willing to accept.

  The draft allows it to me administratively configured.

> The more I think about it the more I agree with Joe's points on separate
> UDP ports.

  It is definitely simpler.

  Alan DeKok.