Re: [radext] WGLC #2 for draft-ietf-radext-dtls-04

[Peter Deacon <[e-mail]>]

On Thu, 4 Apr 2013, Jim Schaad wrote:

> While I understand your preference, it does mean that there cannot be a 
> max 4K buffer in a server that supports both DTLS and non-DTLS clients 
> in the UDP processing code.  The UDP processing code does not know if 
> this is a DTLS or a non-DTLS message and thus you can end up in a 
> situation where a 4K buffer is received in the UDP processing code and 
> passed directly to the non-DTLS processing and have a potential buffer 
> overflow.  Using a maximum buffer size on the wire does prevent that 
> problem.

Currently you still need to cross check UDP message length with RADIUS 
packet length fields and apply maximum limits before processing anything. 
Not sure how this would be a problem unless an implementation was already 
insecure.

Nothing prevents use of compression within DTLS to create an inner RADIUS 
packet exceeding 4k so these checks are still necessary regardless of where 
they are handed off.

I don't see anything inherently more dangerous in the design of protocol 
with inner packet limits maintained.  I don't see new validation 
requirements that didn't already exist before.

regards,
Peter