Re: [radext] RDTLS #65 (new): Multiple dtls sessions in a tuple?

[Alan DeKok <aland@deployingradius.com>]

Peter Deacon wrote:
> There are no implications.  DTLS does not know or care about the
> underlying transport.  It does not know what "UDP" is.  If the transport
> can't handle app data it does not know about then there are much bigger
> problems because its trivial for anyone to spoof such packets.

  That makes sense.

> I agree with you it is better not to go there if not absolutely
> necessary and in this case it may not be but old ports are now
> potholes... and this scares me.

  Yes.

> These things should be in the RDTLS draft. It would stink if someone
> used a "connected" socket and (IMHO naturally) tried to reconnect the
> TLS channel using the same socket(src port).. and when doing this some
> servers sometimes did not accept the new connection for some period of
> time because of this behavior.

  That is an issue, unfortunately.  The solution is largely to have
graceful shutdowns, and don't re-use ports.

  Alan DeKok.

--
to unsubscribe send a message to radiusext-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>