Subject: Re: [radext] #65: Multiple dtls sessions in a tuple?

From: "radext issue tracker" <[email-masked]>
Date: Mon, 28 Jan 2013 19:13:03 -0000

#65: Multiple dtls sessions in a tuple?

Comment (by [email-masked]):

 Added text:

-- 
----------------------------------+----------------------------------------
 Reporter:  peterd@iea-           |       Owner:  [email-masked]
  software.com                    |      Status:  assigned
     Type:  enhancement           |   Milestone:  milestone1
 Priority:  trivial               |     Version:  1.0
Component:  dtls                  |  Resolution:
 Severity:  Active WG Document    |
 Keywords:                        |
----------------------------------+----------------------------------------

Ticket URL: <http://tools.ietf.org/wg/radext/trac/ticket/65#comment:3>
radext <http://tools.ietf.org/radext/>

---

From: "radext issue tracker" <[email-masked]>
Date: Mon, 28 Jan 2013 19:13:25 -0000

Changes (by [email-masked]):

 * status:  assigned => closed
 * resolution:   => fixed

Comment:

 Added text:

 Since UDP is stateless, the potential exists for the client to
 initiate a new DTLS session using a particular 4-tuple, before the
 server has closed the old session.  For security reasons, the server
 must keep the old session active until it has received secure
 notification from the client that the session is closed.  Or, when the
 server has decided for itself that the session is closed.  Taking any
 other action would permit unauthenticated clients to perform a DoS
 attack, by closing active DTLS session.

 As a result, servers MUST ignore any attempts to re-use an existing
 4-tuple from an active session.  This requirement can likely be
 reached by simply processing the packet through the existing session,
 as with any other packet received via that 4-tuple.  Non-compliant, or
 unexpected packets will be ignored by the SSL layer.

 The above requirement is mitigated by the suggestion in Section 6.1,
 below, that the client use a local proxy for all RADIUS traffic.  That
 proxy can then track the ports which it uses, and ensure that re-use
 of 4-tuples is avoided.  The exact process by which this tracking is
 done is outside of the scope of this document.

-- 
----------------------------------+----------------------------------------
 Reporter:  peterd@iea-           |       Owner:  [email-masked]
  software.com                    |      Status:  closed
     Type:  enhancement           |   Milestone:  milestone1
 Priority:  trivial               |     Version:  1.0
Component:  dtls                  |  Resolution:  fixed
 Severity:  Active WG Document    |
 Keywords:                        |
----------------------------------+----------------------------------------

Ticket URL: <http://tools.ietf.org/wg/radext/trac/ticket/65#comment:4>
radext <http://tools.ietf.org/radext/>