Re: [radext] draft-ietf-dhc-dhcpv6-radius-opt-10

Alan - option-len       Length of the option-data in octets
Q: Can it encode more than 256 octets of RADIUS attributes?  If so, what
happens then?
---

The 'option-len' is 2-octet field. It permit the length of 'option-data' is
larger than 256, when the OPTION_RADIUS includes a number of RADIUS
attributes. I think the RADIUS attribute here can also be the attribute of
Long_Extended_Type newly defined in draft-ietf-radext-radius-extensions-13.

Alan - ... Only the attributes listed in the IANA Registry of 'RADIUS
   attributes permitted in DHCPv6 RADIUS option' SHOULD be included in
   the OPTION_RADIUS.
 That should be a MUST.  There's no sense in permitting non-RADIUS traffic
in this option.
---

Do you want the text to be 'Only the attributes listed in ....MUST be
included in ...."? How about turn that 'SHOULD' to be 'should' ?

Alan - 8.  Security Considerations
   Known security vulnerabilities of the DHCPv6 and RADIUS protocol MAY
  Using "MAY" here is probably wrong.  It should be "may".
----

Accepted. That 'MAY' will update to be 'may'.

Best Regards,
Leaf

-----Original Message-----
From: radext-bounces@ietf.org [mailto:radext-bounces@ietf.org] On Behalf Of
Alan DeKok
Sent: Thursday, April 04, 2013 9:08 PM
To: Jouni Korhonen
Cc: radext@ietf.org; draft-ietf-dhc-dhcpv6-radius-opt@tools.ietf.org
Subject: Re: [radext] draft-ietf-dhc-dhcpv6-radius-opt-10

Jouni Korhonen wrote:
> draft-ietf-dhc-dhcpv6-radius-opt-10 has recently passed WGLC in DHC 
> WG. RADEXT WG is solicited for review. We can provide input as part of 
> the IETF LC once it is started.  Remember to CC the RADEXT so we can 
> keep  track of the (possible) comments better.

  A quick review:

4.  DHCPv6 RADIUS option

    option-len       Length of the option-data in octets

Q: Can it encode more than 256 octets of RADIUS attributes?  If so, what
happens then?

   ... Only the attributes listed in the IANA Registry of 'RADIUS
   attributes permitted in DHCPv6 RADIUS option' SHOULD be included in
   the OPTION_RADIUS.

 That should be a MUST.  There's no sense in permitting non-RADIUS traffic
in this option.

8.  Security Considerations

   Known security vulnerabilities of the DHCPv6 and RADIUS protocol MAY

  Using "MAY" here is probably wrong.  It should be "may".
_______________________________________________
radext mailing list
radext@ietf.org
https://www.ietf.org/mailman/listinfo/radext