[radext] RADIUS/(D)TLS port usage (was: Review of draft-ietf-radext-radiusdtls)

[Jan-Frederik Rieckers <[e-mail]>]

Hi to all,

I'm currently working on including the feedback from the session in 
Brisbane and other feedback on the list into the RADIUS/(D)TLS-bis draft.

I'll probably send a few mails, so we can have separate mail threads 
discussing the different issues.

This first is about RADIUS/(D)TLS port usage.

The current text in the draft contradicts itself:

On 20.03.24 03:55, Jan-Frederik Rieckers wrote:
>>    ... RADIUS/(D)TLS peers MUST NOT use the old RADIUS/UDP or 
>> RADIUS/TCP ports for RADIUS/DTLS or RADIUS/TLS.
>>
>>    This seems to contradict the first paragraph in 3.2?
> 
> I think this might be a result of different wording in 6614/7360. Would 
> have to check. I've added a TODO note.


In RFC7360 this text is in Section 3.2 (Server Behavior)

> Servers MUST NOT accept DTLS packets on the old RADIUS/UDP ports.
> Early versions of this specification permitted this behavior.  It is
> forbidden here, as it depended on behavior in DTLS that may change
> without notice.


RFC6613 (RADIUS/TCP), Section 2.2 (Assigned ports for RADIUS/TCP) has 
this to say:

> The "radsec" port (2083/tcp) SHOULD be used as the default port for
> RADIUS/TLS.  The "radius" port (1812/tcp) SHOULD NOT be used for
> RADIUS/TLS.


So basically, for DTLS using 1812/1813 is forbidden, for TLS it is 
discouraged.

My suggestion is to generally forbid using the RADIUS/UDP and RADIUS/TCP 
ports for RADIUS/(D)TLS, to make it absolutely clear that this is 
completely different.

With RADIUS/DTLS the argumentation is very clear, because this is not 
connection-based and it would clash if the same client also uses 
RADIUS/UDP without DTLS.

For RADIUS/TLS it would work to re-use the RADIUS/TCP port (RADIUS/TCP 
is probably not even implemented, only RADIUS/TLS), but to have it 
consistent, I would forbid it anyway.

Cheers,
Janfred

-- 
Herr Jan-Frederik Rieckers
Security, Trust & Identity Services

E-Mail: [e-mail] | Fon: [phone] | Fax: [phone]
Pronomen: er/sein | Pronouns: he/him
__________________________________________________________________________________

DFN - Deutsches Forschungsnetz | German National Research and Education 
Network
Verein zur Förderung eines Deutschen Forschungsnetzes e.V.
Alexanderplatz 1 | 10178 Berlin
https://www.dfn.de

Vorstand: Prof. Dr.-Ing. Stefan Wesner | Prof. Dr. Helmut Reiser | 
Christian Zens
Geschäftsführung: Dr. Christian Grimm | Jochem Pattloch
VR AG Charlottenburg 7729B | USt.-ID. DE 136623822