IETF Logo Mail Archive

Re: [radext] [internet-drafts@ietf.org] New Version Notification for draft-hartman-radext-bigger-packets-00.txt

Alan DeKok <aland@deployingradius.com> Sat, 15 February 2014 22:37 UTC

Return-Path: <aland@deployingradius.com>
X-Original-To: radext@ietfa.amsl.com
Delivered-To: radext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CB49E1A00AA for <radext@ietfa.amsl.com>; Sat, 15 Feb 2014 14:37:49 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UrkNkhYQPjjR for <radext@ietfa.amsl.com>; Sat, 15 Feb 2014 14:37:47 -0800 (PST)
Received: from power.freeradius.org (power.freeradius.org [88.190.25.44]) by ietfa.amsl.com (Postfix) with ESMTP id 856E61A0163 for <radext@ietf.org>; Sat, 15 Feb 2014 14:37:46 -0800 (PST)
Received: from localhost (localhost [127.0.0.1]) by power.freeradius.org (Postfix) with ESMTP id 1BE1B2240164; Sat, 15 Feb 2014 23:37:44 +0100 (CET)
X-Virus-Scanned: Debian amavisd-new at power.freeradius.org
Received: from power.freeradius.org ([127.0.0.1]) by localhost (power.freeradius.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UOlOzappDKlM; Sat, 15 Feb 2014 23:37:40 +0100 (CET)
Received: from Thor.local (unknown [70.50.217.206]) by power.freeradius.org (Postfix) with ESMTPSA id 36B6E224003A; Sat, 15 Feb 2014 23:37:40 +0100 (CET)
Message-ID: <52FFEC37.6010500@deployingradius.com>
Date: Sat, 15 Feb 2014 17:37:43 -0500
From: Alan DeKok <aland@deployingradius.com>
User-Agent: Thunderbird 2.0.0.24 (Macintosh/20100228)
MIME-Version: 1.0
To: Sam Hartman <hartmans@painless-security.com>
References: <tslsivuv1kq.fsf@mit.edu> <52662FAE.3040900@um.es> <tslk3d0qbsk.fsf@mit.edu>
In-Reply-To: <tslk3d0qbsk.fsf@mit.edu>
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 7bit
Archived-At: http://mailarchive.ietf.org/arch/msg/radext/nn5o7QJ_DlR4IgOkpKXfISyd8xE
Cc: radext@ietf.org, Alejandro Perez Mendez <alex@um.es>
Subject: Re: [radext] [internet-drafts@ietf.org] New Version Notification for draft-hartman-radext-bigger-packets-00.txt
X-BeenThere: radext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: RADIUS EXTensions working group discussion list <radext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/radext>, <mailto:radext-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/radext/>
List-Post: <mailto:radext@ietf.org>
List-Help: <mailto:radext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/radext>, <mailto:radext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 15 Feb 2014 22:37:50 -0000

Sam Hartman wrote:
> This is only possible for access-request packets.  You cannot send an
> access-reject in response to an accounting packet for example.
> However, we could send an access-reject rather than a new code for
> packet too big.

  If the packet is too big, it's likely to be dropped entirely.  So it
doesn't really matter what the reply is.

> It seems clear to me that we need the new code  in the
> non-access-request cases.
> One potential issue with access-reject is that it is end-to-end and this
> is a transport issue.
> On the other hand, perhaps tdhe failure should be end-to-end.

  IMHO, the failure should be hop by hop.  It's unfortunately the RADIUS
way.

  The issue then becomes how to tell hop 1 failures from hop 2 failures.
 RADIUS can't do that, so you're pretty much SoL.

  Alan DeKok.

v2.26.15 | Report a Bug | By Email | System Status