RFC 6613

RADIUS over TCP

📅 published May 2012, from ietf

RADIUS over TCP 🎀

Title block, the tea ☕ RFC 6613 is called RADIUS over TCP. It was written by A. DeKok from FreeRADIUS, and it's dated May 2012. It's an Experimental doc from the IETF, with ISSN 2070-1721. The header doesn't list anything it obsoletes or updates.

Abstract ✨

okay so RADIUS has always used UDP as its transport layer, no exceptions 🙈 This doc defines RADIUS over TCP (RADIUS/TCP) to fix some handling problems that showed up with RADIUS over TLS (RADIUS/TLS). TCP is only allowed as a transport for RADIUS when something like TLS or IPsec is providing confidentiality and security. No security layer, no TCP. 🔒

Status of This Memo 📋

this one is not a Standards Track spec. It's being published so people can look at it, try implementing it, and evaluate it 🧪

It's an Experimental Protocol for the Internet community 🦋 It's a product of the IETF and it reflects IETF community consensus. It got public review and the IESG approved it for publication. Not every IESG-approved doc is a candidate for any level of Internet Standard, so check Section 2 of RFC 5741 if you're curious about that part 💅

For the current status, errata, and how to send feedback, look at:

http://www.rfc-editor.org/info/rfc6613

Copyright (c) 2012 IETF Trust and the persons identified as the document authors. All rights reserved.

This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents, which you can find at http://trustee.ietf.org/license-info (as in effect on the publication date). Read these carefully because they spell out your rights and restrictions for this doc 📜 If you pull Code Components out of this doc, they have to include the Simplified BSD License text described in Section 4.e of the Trust Legal Provisions, and they come with no warranty, as the Simplified BSD License describes.

Table of Contents 🗂️

1. Introduction ....................................................3
   1.1. Applicability of Reliable Transport ........................4
   1.2. Terminology ................................................6
   1.3. Requirements Language ......................................6
2. Changes to RADIUS ...............................................6
   2.1. Packet Format ..............................................7
   2.2. Assigned Ports for RADIUS/TCP ..............................7
   2.3. Management Information Base (MIB) ..........................8
   2.4. Detecting Live Servers .....................................8
   2.5. Congestion Control Issues ..................................9
   2.6. TCP Specific Issues ........................................9
        2.6.1. Duplicates and Retransmissions .....................10
        2.6.2. Head of Line Blocking ..............................11
        2.6.3. Shared Secrets .....................................11
        2.6.4. Malformed Packets and Unknown Clients ..............12
        2.6.5. Limitations of the ID Field ........................13
        2.6.6. EAP Sessions .......................................13
        2.6.7. TCP Applications Are Not UDP Applications ..........14
3. Diameter Considerations ........................................14
4. Security Considerations ........................................14
5. References .....................................................15
   5.1. Normative References ......................................15
   5.2. Informative References ....................................15

1. Introduction 🌸

RADIUS is defined in [RFC2865] as running over the User Datagram Protocol (UDP) for its transport layer. UDP has real perks, and [RFC2865], Section 2.4 goes through them, but it also comes with some limitations 🥲

  • Unreliable transport. Because of this, systems that use RADIUS have to build their own application-layer timers and retransmissions, as described in [RFC5080], Section 2.2.1.
  • Packet fragmentation. [RFC2865], Section 3, allows RADIUS packets up to 4096 octets long. That's bigger than the common Internet MTU (576), so the packets get fragmented at the IP layer when they're proxied over the Internet. Fragmented UDP traffic seems to be a poorly tested code path on network devices. Some devices look like they can't carry fragmented UDP packets at all, which makes it hard to deploy RADIUS on a network that includes them 😭
  • Connectionless transport. Neither clients nor servers get a clear signal that a "connection" is down. Instead they have to work it out from a request that never gets a reply.
  • Lack of congestion control. Clients can send as much traffic as they want with little or no feedback. That lack of feedback can lead to congestive collapse of the network 💀

RADIUS has been widely deployed for well over a decade and it's still everywhere ✨ Experience shows these issues were minor in some use cases and a real problem in others. For use cases like inter-server proxying, there's an alternative transport and security model, RADIUS/TLS, defined in [RFC6614]. That document covers the transport implications of running RADIUS/TLS 🔐

Choosing TCP as the transport is mostly about making RADIUS more secure by using RADIUS/TLS. For practical reasons, the transport protocol (TCP) is defined separately from the security mechanism (TLS) 🧩

Since "bare" TCP doesn't give you confidentiality or let you negotiate credible ciphersuites, it isn't appropriate for inter-server communications where strong security is required. So "bare" TCP transport MUST NOT be used without TLS, IPsec, or another secure upper layer. Not negotiable, bestie 🚫

However, "bare" TCP transport MAY be used when another method, such as IPsec [RFC4301], is used to provide additional confidentiality and security 🦋 Should experience show that these deployments are useful, this specification could be moved to the Standards Track 🌈

(part 1 of 4 done, part 2 is next, Section 2 is where the real main-character energy starts 💅)

1.1. Applicability of Reliable Transport ✨

okay so bestie, the whole point of this doc is fixing transport problems in RADIUS/TLS [RFC6614] for inter-server stuff, like proxies talking to other proxies across domains 🦋. TLS is literally the main character here because it brings confidentiality and cipher negotiation, and it's already sitting inside the OS on most proxies, so nobody has a big setup barrier 💅.

When RADIUS proxies are pushing a huge pile of packets, there's usually enough traffic to keep the congestion window wider than its minimum for the long haul, which means ACK piggybacking actually works 🌈. With an application-layer watchdog like the one in [RFC3539], you can deal with the complaints about reliable transport from [RFC2865], Section 2.4, without adding a bunch of watchdog traffic, since regular traffic is flowing both ways anyway 🫶.

RADIUS/TLS also makes EAP over RADIUS [RFC3579] way less painful. EAP fragmentation usually adds round trips, and it gets wild fast. Take EAP-TLS [RFC5216] with 8 KB certificate chains on both the peer and the server: if RADIUS packets are stuck at the common Ethernet MTU (1500 octets) for EAP over LAN (EAPoL), you can end up needing as many as 15 round trips 💀. Fragmenting RADIUS/UDP packets is generally a no-go because filtering routers, firewalls, and NATs often can't handle fragments 🙈. The annoying part is that RADIUS/UDP implementations usually don't do MTU discovery, so fragmentation can still happen even when you cap the packet size at 1500 octets.

These problems vanish if you can use a 4096-octet application-layer payload with RADIUS/TLS ✨. Most TCP stacks do MTU discovery, so the TCP Maximum Segment Size (MSS) adjusts itself for the MTU automatically, and TCP's bigger congestion window can fit several segments into one window. Even the few TCP stacks that skip Path MTU discovery can still carry arbitrary payloads 🧚.

When the EAP MTU is large, that same EAP-TLS flow with 8-KB certificate chains can drop to 7 round trips or fewer, which means authentication is way faster 🔥.

Also, EAP sessions over RADIUS/TLS are less likely to die halfway, and that's a huge win 👑. RADIUS-over-UDP (see Section 1.2) implementations have historically had bad retransmission behavior. Some retransmit, some don't, and some send brand-new packets instead of retransmitting. Some can't even detect EAP retransmissions and treat them as errors 😭. So with RADIUS/UDP, retransmissions have a high chance of breaking the EAP session. Imagine a system with a million logins a day running EAP-TLS mutual authentication with 15 round trips and a packet loss probability of P=0.01%. We'd expect 0.3% of connections to see at least one lost packet, which is 3,000 user sessions a day failing to authenticate. That's way too high a failure rate for a mass-market network service, bestie 😤.

Reliable transport like TCP fixes this because RADIUS implementations can drop all their application-layer retransmissions and let the OS kernel's well-tested TCP handle Path MTU discovery and reliable delivery 💖. Modern TCP stacks also have anti-spoofing protections, which are a lot harder to build into a UDP application 🛡️.

Now the plot twist: TCP is usually a poor fit between a Network Access Server (NAS) and a RADIUS server 🙃. As noted in [RFC3539], Section 2.1, when a system only sends a few RADIUS request packets, the gap between packets is often longer than the packet Round-Trip Time (RTT). So the congestion window usually stays under its minimum value over the long term. You end up with more ACK packets than UDP would need and no real benefit to show for it. Plus, without much traffic you need extra watchdog traffic just to confirm the server is reachable 😩.

So the objections to reliable transport from [RFC2865], Section 2.4, still apply to NAS-to-RADIUS server communication, and UDP SHOULD continue to be used as the transport protocol in this scenario 🌸. Also, implementations of RADIUS Dynamic Authorization Extensions [RFC5176] SHOULD continue to use UDP transport, since dynamic authorization traffic is usually pretty small 🦋.

1.2. Terminology 📖

okay, here are the terms we're using in this doc, so we're all on the same page 🫶:

  • RADIUS client: A device that gives a user access to a network. It's also called a Network Access Server, or NAS.
  • RADIUS server: A device that provides one or more of authentication, authorization, and/or accounting (AAA) services to a NAS.
  • RADIUS proxy: A RADIUS proxy acts as a RADIUS server to the NAS and as a RADIUS client to the RADIUS server. Main character of the middle 🧚.
  • RADIUS request packet: A packet that a RADIUS client sends to a RADIUS server. Examples are Access-Request, Accounting-Request, CoA-Request, or Disconnect-Request.
  • RADIUS response packet: A packet that a RADIUS server sends back to a RADIUS client in response to a RADIUS request packet. Examples are Access-Accept, Access-Reject, Access-Challenge, Accounting-Response, or CoA-ACK.
  • RADIUS/UDP: RADIUS over UDP, as defined in [RFC2865].
  • RADIUS/TCP: RADIUS over TCP, as defined in this document 💜.
  • RADIUS/TLS: RADIUS over TLS, as defined in [RFC6614].

1.3. Requirements Language 💅

okay so the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be read the way [RFC2119] describes 🎀.

2. Changes to RADIUS 🍓

RADIUS/TCP is basically RADIUS application messages sent over a TCP connection 🦋. In the sections below, we look at what that means for the RADIUS packet format (Section 2.1), port usage (Section 2.2), RADIUS MIBs (Section 2.3), and RADIUS proxies (Section 2.5). TCP-specific stuff gets its own spot in Section 2.6 ✨.

2.1. Packet Format 📦

The RADIUS packet format doesn't change from [RFC2865], [RFC2866], and [RFC5176] 💖. Specifically, all of these parts of RADIUS MUST be unchanged when you're using RADIUS/TCP:

  • Packet format
  • Permitted codes
  • Request Authenticator calculation
  • Response Authenticator calculation
  • Minimum packet length
  • Maximum packet length
  • Attribute format
  • Vendor-Specific Attribute (VSA) format
  • Permitted data types
  • Calculations of dynamic attributes such as CHAP-Challenge, or Message-Authenticator.
  • Calculation of "encrypted" attributes such as Tunnel-Password.

Using TLS transport doesn't change how security fields like the Response-Authenticator get calculated in RADIUS [RFC2865] or RADIUS Dynamic Authorization [RFC5176] 🔐. Calculations for attributes like User-Password [RFC2865] or Message-Authenticator [RFC3579] also stay the same 🙌.

Clients and servers MUST be able to store and manage shared secrets based on the key described in Section 2.6, which is (IP address, port, transport protocol) 🗝️.

The changes needed to implement this spec are mostly limited to the bits that send and receive packets on the network. Everything else is basically the same, bestie ✨.

2.2. Assigned Ports for RADIUS/TCP 🔌

IANA has already assigned TCP ports for RADIUS transport, and they look like this 🌈:

radius          1812/tcp
radius-acct     1813/tcp
radius-dynauth  3799/tcp

These ports aren't used by existing RADIUS implementations, so the assigned values MUST be used as the default ports for RADIUS over TCP 👑.

RADIUS was first deployed over UDP port number 1645, which clashes with the "datametrics" service 😬. So implementations using RADIUS/TCP MUST NOT use TCP ports 1645 or 1646 as the default ports for this spec 🚫.

The "radsec" port (2083/tcp) SHOULD be used as the default port for RADIUS/TLS 🎀. The "radius" port (1812/tcp) SHOULD NOT be used for RADIUS/TLS 🙅.

2.3. Management Information Base (MIB) 📊

The MIB Module definitions in [RFC4668], [RFC4669], [RFC4670], [RFC4671], [RFC4672], and [RFC4673] are meant for RADIUS over UDP. That means they don't support RADIUS/TCP, and they'll need updating down the road 🛠️. Implementations of RADIUS/TCP SHOULD NOT reuse these MIB Modules to count statistics for RADIUS/TCP connections 📉.

2.4. Detecting Live Servers 👀

RADIUS is a "hop-by-hop" protocol, so a RADIUS proxy shields the client from any info about downstream servers 🧱. The client can figure out the operational state of the local server (aka the proxy), but it can't tell anything about the state of the downstream servers 🤷‍♀️.

In RADIUS as defined in [RFC2865], proxies usually just forward traffic between the NAS and the RADIUS server, and they don't generate their own responses 🔁. So when a NAS doesn't get a response to a request, it could be packet loss between the NAS and the proxy, a problem on the proxy, loss between the RADIUS proxy and server, or a problem with the server itself 🕵️‍♀️.

When UDP is the transport, a missing reply can make a client wrongly think the proxy is down 😵. The client might then fail over to another server or decide that no "live" servers are available (OKAY state in [RFC3539], Appendix A). It gets even messier when requests go through a proxy to multiple destinations. If the client wrongly thinks the proxy is unresponsive, a failure at one destination can cause outages for the others too 🌪️.

For RADIUS/TLS, it is RECOMMENDED that implementations use the existence of a TCP connection, along with the application-layer watchdog defined in [RFC3539], Section 3.4, to figure out whether the server is "live" ✅.

RADIUS clients using RADIUS/TCP MUST mark a connection DOWN if the network stack says the connection is no longer active 💀. If the network stack says the connection is still active, clients MUST NOT decide it's down until the application-layer watchdog algorithm has marked it DOWN ([RFC3539], Appendix A) 🐕. And RADIUS clients using RADIUS/TCP MUST NOT decide that a RADIUS server is unresponsive until all TCP connections to it have been marked DOWN 🫡.

None of the above stops a client from proactively closing connections or marking a server as DOWN because of an administrative decision 🔧. That's all for this part, so keep scrolling, bestie 🧚.

2.5. Congestion Control Issues 🚦

Okay so RADIUS proxies get a whole extra layer of drama 😭. The proxy receives packets on one transport protocol and then forwards them on a different one, and that can break the "conservation of packets" law on an end-to-end basis. That's when more packets can come in than can go out, at least for a short while. There are a couple of situations where this happens:

  • Where TCP is used between proxies, it is possible that the bandwidth consumed by incoming UDP packets destined to a given upstream server could exceed the sending rate of a single TCP connection to that server, based on the window size/RTT estimate.
  • It is possible for the incoming rate of TCP packets destined to a given realm to exceed the UDP throughput achievable using the transport guidelines established in [RFC5080]. This could happen, for example, where the TCP window between proxies has opened, but packet loss is being experienced on the UDP leg, so that the effective congestion window on the UDP side is 1.

Intrinsically, proxy systems run multiple control loops instead of one end-to-end loop, so they are less stable. This is true even for TCP-TCP proxies 🥺. As discussed in [RFC3539], the only way to get stability equivalent to a single TCP connection is to mimic the end-to-end behavior of a single TCP connection. That typically is not achievable with an application-layer RADIUS implementation, regardless of transport. Not me having to accept that one 💀

2.6. TCP Specific Issues ✨

The guidelines defined in [RFC3539] for implementing a AAA protocol over reliable transport are applicable to RADIUS/TLS. Bestie, read those first 📚.

The application-layer watchdog defined in [RFC3539], Section 3.4, MUST be used. The Status-Server packet [RFC5997] MUST be used as the application-layer watchdog message. Implementations MUST reserve one RADIUS ID per connection for the application-layer watchdog message. This restriction is described further in Section 2.6.4. Main character energy for that watchdog 👑.

RADIUS/TLS implementations MUST support receiving RADIUS packets over both UDP and TCP transports originating from the same endpoint. RADIUS packets received over UDP MUST be replied to over UDP; RADIUS packets received over TCP MUST be replied to over TCP. That is, RADIUS clients and servers MUST be treated as unique based on a key of the three-tuple (IP address, port, transport protocol). Implementations MUST permit different shared secrets to be used for UDP and TCP connections to the same destination IP address and numerical port. So the transport is literally part of who you are 🫶.

This requirement does not forbid the traditional practice of using primary and secondary servers in a failover relationship. Instead, it requires that two services sharing an IP address and numerical port, but differing in transport protocol, MUST be treated as independent services for the purpose of failover, load-balancing, etc. Same address, different transport, separate services. No cap 🧚.

Whenever the underlying network stack permits the use of TCP keepalive socket options, their use is RECOMMENDED. 💖

2.6.1. Duplicates and Retransmissions 🔁

As TCP is a reliable transport, implementations MUST NOT retransmit RADIUS request packets over a given TCP connection. Similarly, if there is no response to a RADIUS packet over one TCP connection, implementations MUST NOT retransmit that packet over a different TCP connection to the same destination IP address and port, while the first connection is in the OKAY state ([RFC3539], Appendix A).

However, if the TCP connection is broken or closed, retransmissions over new connections are permissible. RADIUS request packets that have not yet received a response MAY be transmitted by a RADIUS client over a new TCP connection. As this procedure involves using a new source port, the ID of the packet MAY change. If the ID changes, any security attributes such as Message-Authenticator MUST be recalculated. Lowkey a lot of rules, but they're giving clean 🎀.

If a TCP connection is broken or closed, any cached RADIUS response packets ([RFC5080], Section 2.2.2) associated with that connection MUST be discarded. A RADIUS server SHOULD stop the processing of any requests associated with that TCP connection. No response to these requests can be sent over the TCP connection, so any further processing is pointless. This requirement applies not only to RADIUS servers, but also to proxies. When a client's connection to a proxy server is closed, there may be responses from a home server that were supposed to be sent by the proxy back over that connection to the client. Since the client connection is closed, those responses from the home server to the proxy server SHOULD be silently discarded by the proxy. Don't waste your energy on a dead connection 🥀.

Despite the above discussion, RADIUS servers SHOULD still perform duplicate detection on received packets, as described in [RFC5080], Section 2.2.2. This detection can prevent duplicate processing of packets from non-conformant clients. Defensive queen behavior 👸.

RADIUS packets SHOULD NOT be retransmitted to the same destination IP and numerical port, but over a different transport protocol. There is no guarantee in RADIUS that the two ports are in any way related. This requirement does not, however, forbid the practice of putting multiple servers into a failover or load-balancing pool. In that situation, RADIUS request MAY be retransmitted to another server that is known to be part of the same pool. Pools are fine, just don't hop transports on the same address 🦋.

2.6.2. Head of Line Blocking 🚧

When using UDP as a transport for RADIUS, there is no ordering of packets. If a packet sent by a client is lost, that loss has no effect on subsequent packets sent by that client. UDP really said "it's fine, next" 💅.

Unlike UDP, TCP is subject to issues related to Head of Line (HoL) blocking. This occurs when a TCP segment is lost and a subsequent TCP segment arrives out of order. While the RADIUS server can process RADIUS packets out of order, the semantics of TCP makes this impossible. This limitation can lower the maximum packet processing rate of RADIUS/TCP. TCP really be like "wait, I need that one first" 😭.

2.6.3. Shared Secrets 🔐

The use of TLS transport does not change the calculation of security-related fields (such as the Response-Authenticator) in RADIUS [RFC2865] or RADIUS Dynamic Authorization [RFC5176]. Calculation of attributes such as User-Password [RFC2865] or Message-Authenticator [RFC3579] also does not change. TLS is just the outfit, the math stays the same ✨.

Clients and servers MUST be able to store and manage shared secrets based on the key described above, at the start of this section (i.e., IP address, port, transport protocol). Keep track of your secrets, babe 🗝️.

2.6.4. Malformed Packets and Unknown Clients 🙈

The RADIUS specifications ([RFC2865], and many others) say that an implementation should "silently discard" a packet in a number of circumstances. This action has no further consequences for UDP transport, as the "next" packet is completely independent of the previous one. UDP is so unbothered 🦋.

When TCP is used as a transport, decoding the "next" packet on a connection depends on the proper decoding of the previous packet. As a result, the behavior with respect to discarded packets has to change. Ngl this is where it gets spicy 🌶️.

Implementations of this specification SHOULD treat the "silently discard" texts referenced above as "silently discard and close the connection". That is, the TCP connection MUST be closed if any of the following circumstances are seen:

  • Connection from an unknown client
  • Packet where the RADIUS "Length" field is less than the minimum RADIUS packet length
  • Packet where the RADIUS "Length" field is more than the maximum RADIUS packet length
  • Packet that has an Attribute "Length" field has value of zero or one (0 or 1)
  • Packet where the attributes do not exactly fill the packet
  • Packet where the Request Authenticator fails validation (where validation is required)
  • Packet where the Response Authenticator fails validation (where validation is required)
  • Packet where the Message-Authenticator attribute fails validation (when it occurs in a packet)

After applying the above rules, there are still two situations where the previous specifications allow a packet to be "silently discarded" upon receipt:

  • Packets with an invalid code field
  • Response packets that do not match any outstanding request

In these situations, the TCP connections MAY remain open, or they MAY be closed, as an implementation choice. However, the invalid packet MUST be silently discarded. Choice is yours, but the packet is gone 💀.

These requirements reduce the possibility for a misbehaving client or server to wreak havoc on the network. Iconic protective energy 🛡️.

2.6.5. Limitations of the ID Field 🔢

The RADIUS ID field is one octet in size. As a result, any one TCP connection can have only 256 "in flight" RADIUS packets at a time. If more than 256 simultaneous "in flight" packets are required, additional TCP connections will need to be opened. This limitation is also noted in [RFC3539], Section 2.4. Only 256 slots, babe, plan accordingly 🍓.

An additional limit is the requirement to send a Status-Server packet over the same TCP connection as is used for normal requests. As noted in [RFC5997], the response to a Status-Server packet is either an Access-Accept or an Accounting-Response. If all IDs were allocated to normal requests, then there would be no free ID to use for the Status-Server packet, and it could not be sent over the connection. So the watchdog needs a seat at the table too 🪑.

Implementations SHOULD reserve ID zero (0) on each TCP connection for Status-Server packets. This value was picked arbitrarily, as there is no reason to choose any one value over another for this use. Zero was just the vibe 🎲.

Implementors may be tempted to extend RADIUS to permit more than 256 outstanding packets on one connection. However, doing so is a violation of a fundamental part of the protocol and MUST NOT be done. Making that extension here is outside of the scope of this specification. Bestie, do not do it 🙅‍♀️.

2.6.6. EAP Sessions 🎫

When RADIUS clients send EAP requests using RADIUS/TCP, they SHOULD choose the same TCP connection for all packets related to one EAP session. This practice ensures that EAP packets are transmitted in order, and that problems with any one TCP connection affect the minimum number of EAP sessions. Keep your session on one connection, it's cleaner 🧼.

A simple method that may work in many situations is to hash the contents of the Calling-Station-Id attribute, which normally contains the Media Access Control (MAC) address. The output of that hash can be used to select a particular TCP connection. Hash the MAC, pick the connection, easy 💜.

However, EAP packets for one EAP session can still be transported from client to server over multiple paths. Therefore, when a server receives a RADIUS request containing an EAP request, it MUST be processed without considering the transport protocol. For TCP transport, it MUST be processed without considering the source port. The algorithm suggested in [RFC5080], Section 2.1.1 SHOULD be used to track EAP sessions, as it is independent of the source port and transport protocol. Paths can be all over the place, so the server has to look past transport and port 🌈.

The retransmission requirements of Section 2.6.1, above, MUST be applied to RADIUS-encapsulated EAP packets. That is, EAP retransmissions MUST NOT result in retransmissions of RADIUS packets over a particular TCP connection. EAP retransmissions MAY result in retransmission of RADIUS packets over a different TCP connection, but only when the previous TCP connection is marked DOWN. Retransmit rules, but make it make sense 🫶✨.

2.6.7. TCP Applications Are Not UDP Applications 🎀

okay bestie, listen 👂 programming a robust TCP app is lowkey a totally different vibe from programming a robust UDP app 😭 implementors should be aware of that. it is RECOMMENDED that implementors of this specification get familiar with TCP application programming concepts 🧚

clients and servers SHOULD implement configurable connection limits 💅 they SHOULD also implement configurable limits on connection lifetime and idle timeouts, plus configurable rate limiting on new connections 🫶 no cap, letting in an unbounded number or rate of TCP connections may result in resource exhaustion 💀

more implementation stuff is outside the scope of this doc, so we're good 🌸

3. Diameter Considerations ✨

okay so this doc defines TCP as a transport layer for RADIUS 🦋 it defines no new RADIUS attributes or codes, so there's no extra vocab to memorize 🌈 the only interaction with Diameter happens in a RADIUS-to-Diameter gateway, or in a Diameter-to-RADIUS gateway. the RADIUS side of that gateway MAY implement RADIUS/TCP, but this change has no effect on Diameter 🙈

4. Security Considerations 🔐

okay this part is SERIOUS bestie 😤 read it all.

as the RADIUS packet format, signing, and client verification are unchanged from prior specifications, every security issue from earlier RADIUS/UDP specs still applies here 💀

as noted above, clients and servers SHOULD support configurable connection limits 🚧 allowing an unlimited number of connections may result in resource exhaustion, and that is not the vibe 😭

implementors should consult [RFC6614] for security issues related to RADIUS/TLS, and [RFC5246] for security issues related to the TLS protocol 📜

since "bare" TCP does not provide confidentiality or enable negotiation of credible ciphersuites, it is not appropriate for inter-server communications where strong security is required 🙅‍♀️ as a result, "bare" TCP transport MUST NOT be used without TLS, IPsec, or another secure upper layer. non-negotiable, periodt 💖

there are no (at this time) other known security issues for RADIUS-over-TCP transport 🫶

5. References 📚

5.1. Normative References

[RFC2119]    Bradner, S., "Key words for use in RFCs to Indicate
             Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC2865]    Rigney, C., Willens, S., Rubens, A., and W. Simpson,
             "Remote Authentication Dial In User Service (RADIUS)",
             RFC 2865, June 2000.

[RFC3539]    Aboba, B. and J. Wood, "Authentication, Authorization
             and Accounting (AAA) Transport Profile", RFC 3539, June
             2003.

[RFC5997]    DeKok, A., "Use of Status-Server Packets in the Remote
             Authentication Dial In User Service (RADIUS) Protocol",
             RFC 5997, August 2010.

[RFC6614]    Winter, S., McCauley, M., Venaas, S., and K. Wierenga,
             "Transport Layer Security (TLS) Encryption for RADIUS",
             RFC 6614, May 2012.

5.2. Informative References

[RFC2866]    Rigney, C., "RADIUS Accounting", RFC 2866, June 2000.

[RFC3579]    Aboba, B. and P. Calhoun, "RADIUS (Remote Authentication
             Dial In User Service) Support For Extensible
             Authentication Protocol (EAP)", RFC 3579, September
             2003.

[RFC4301]    Kent, S. and K. Seo, "Security Architecture for the
             Internet Protocol", RFC 4301, December 2005.

[RFC4668]    Nelson, D., "RADIUS Authentication Client MIB for IPv6",
             RFC 4668, August 2006.

[RFC4669]    Nelson, D., "RADIUS Authentication Server MIB for IPv6",
             RFC 4669, August 2006.

[RFC4670]    Nelson, D., "RADIUS Accounting Client MIB for IPv6", RFC
             4670, August 2006.

[RFC4671]    Nelson, D., "RADIUS Accounting Server MIB for IPv6", RFC
             4671, August 2006.

[RFC4672]    De Cnodder, S., Jonnala, N., and M. Chiba, "RADIUS
             Dynamic Authorization Client MIB", RFC 4672, September
             2006.

[RFC4673]    De Cnodder, S., Jonnala, N., and M. Chiba, "RADIUS
             Dynamic Authorization Server MIB", RFC 4673, September
             2006.

[RFC5080]    Nelson, D. and A. DeKok, "Common Remote Authentication
             Dial In User Service (RADIUS) Implementation Issues and
             Suggested Fixes", RFC 5080, December 2007.

[RFC5176]    Chiba, M., Dommety, G., Eklund, M., Mitton, D., and B.
             Aboba, "Dynamic Authorization Extensions to Remote
             Authentication Dial In User Service (RADIUS)", RFC 5176,
             January 2008.

[RFC5216]    Simon, D., Aboba, B., and R. Hurst, "The EAP-TLS
             Authentication Protocol", RFC 5216, March 2008.

[RFC5246]    Dierks, T. and E. Rescorla, "The Transport Layer
             Security (TLS) Protocol Version 1.2", RFC 5246, August
             2008.

Author's Address 🖋️

Alan DeKok
The FreeRADIUS Server Project
http://freeradius.org/

EMail: aland@freeradius.org
📦 where this page comes from