[radext] Re: Final update to RADIUS/(D)TLS-bis

[Peter Deacon <[e-mail]>]

On Sun, 6 Sep 2026, Jan-Frederik Rieckers wrote:

> Hello,
> I'm not sure if a "SHOULD" for the connection closure is sufficient.

> If a connection has a security issue it should always be closed 
> immediately. Keeping the connection artificially open is harmful, 
> because the client might start to send packets and those may even time 
> out if the server knows the connection is unacceptable and does not 
> process anything received on that connection.

If a client offends a server in some way a server should not be required 
to provide immediate feedback if doing so would be harmful to the server.

A robust client implementation could issue an application keepalive 
immediate upon session establishment or initially concurrently connect to 
multiple servers using the one that responds first.  I don't support 
requiring instant feedback to an offensive client.

Unfortunately given current draft even over a "reliable" transport a 
perfectly valid request over a perfectly valid connection is allowed to be 
summarily ignored with not even a best effort expectation of any kind of 
response.

Clients therefore have to be able to handle these bizarre situations where 
even reliable transports act for all intent and purposes as if they were 
unreliable.  Not just initially but throughout the life of the session.

regards,
Peter