Subject: [radext] AD Review of draft-ietf-radext-ip-port-radius-ext

From: Kathleen Moriarty <[email-masked]>
Date: Wed, 27 Jul 2016 20:58:12 -0400

Hello,

Thank you for your work on draft-ietf-radext-ip-port-radius-ext.  This
is an easy to understand document.  I found a few nits and think more
text is needed in the security considerations section.  My review is
below.

Abstract
second sentence nit: s/implementing/implement/
From: For devices that
   implementing IP port ranges, these attributes are used to communicate
   with a RADIUS server in order to configure and report TCP/UDP ports
   and ICMP identifiers, as well as mapping behavior for specific hosts.
To: For devices that
   implement IP port ranges, these attributes are used to communicate
   with a RADIUS server in order to configure and report TCP/UDP ports
   and ICMP identifiers, as well as mapping behavior for specific hosts.

2. Terminology

I think some rewording is needed, 'in respective' doesn't quite fit in
the following definition:

    External realm: refers to the networking segment where external IP
      addresses are used in respective of the device supporting port
      ranges.
In the following definition, expand out CGN. I am pretty sure the
others are acronyms that are in the do not have to expand list.  This
one isn't one that I am familiar with:
  o  Port-based device: a device that is capable of providing IP
      address and IP port mapping services and in particular, with the
      granularity of one or more subsets within the 16-bit IP port
      number range.  A typical example of this device is a CGN, CPE,
      Provider WLAN Gateway, etc.

Section 4.1.2: s/once/one/
   As one practice, a CGN may allocate a bulk of TCP/UDP ports or ICMP
   identifiers once at a time for a specific user,

Security considerations:

Shouldn't there be some considerations about the communications for
these attributes between the radius server and NAt44 or other devices?
 Since these attributes can be used to communicate a change in
permissions (port/address mappings) that open/shut permissions for a
user, the user could be subject to attacks by alterations or tampering
of this stream.  One might be to allow ports to be open that would
make the system vulnerable to attack.  The other would be to close
ports off that are needed, resulting in a denial of service.

I would think there are considerations to list with each of the new
attributes along these lines.  This would be specific text to the
added attributes and communication of these attributes on the wire.

Let me know if I am missing something as to why this is already
covered in radius security considerations.  I think the specific
attribute addd should have their concerns listed.

Thanks!
-- 

Best regards,
Kathleen