Chronological Thread 

< Chronological >      < Thread >

---

Dear all,

you must send back an Abort.
If you have no established assoc that is all.
If you have an established assoc you have on of
two cases:
1. The sender of the INIT is the valid endpoint of the
assoc, but has restarted. So something is strange and
aborting is OK.
2. The sender of the INIT is an attacker. So the Abort is
send back to the attacker or the valid endpoint of the
association (so the attacker is spoofing his address). If
the verification is not valid the endpoint will discard
the Abort.

The association should NOT be terminated when sending the
Abort. If the prototype is not working like this, it is a
bug and will be fixed.

Best regards
Michael

Michael Tuexen Tel.: +49 89 722 47210
Siemens AG Fax: +49 89 722 48212
ICN WN CS SE 5 E-mail:
Michael.Tuexen AT icn.siemens.de

> -----Original Message-----
> From: Hollaus Thomas
> [SMTP:thomas.hollaus AT siemens.at]
> Sent: Thursday, February 14, 2002 3:02 PM
> To: 'Andreas Jungmaier';
> discussion AT sctp.de
> Subject: [SCTP-Discussion] AW: [Tsvwg] Possible DoS in SCTP ? (was:
> reception of invalid pa rameters)
>
> Dear all,
>
> The established association with sctp.de implementation is not safe, because
> it will be deleted on receive of e.g. INIT with MIS=0 or OS=0.
>
>
> Mit freundlichen Gruessen / Best regards
> Thomas Hollaus
>
> SIEMENS AG Austria
> Program and Systems Engineering
> mailto:thomas.hollaus AT siemens.at
> http://www.pse.siemens.at
>
>
> > -----Urspr> üngliche Nachricht-----
> > Von: Andreas Jungmaier
> > [mailto:ajung AT exp-math.uni-essen.de]
> > Gesendet am: Donnerstag, 14. Februar 2002 15:51
> > An: Randall Stewart
> > Cc:
> > discussion AT sctp.de;
> > Hollaus Thomas;
> > tsvwg AT ietf.org
> > Betreff: Re: [Tsvwg] Possible DoS in SCTP ? (was: reception of invalid
> > parameters)
> >
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> > Dear all,
> >
> > I am sorry for not explaining more exactly what I meant.
> > I am assuming an attack with IP-Spoofing. The evil attacker
> > (say E) is spoofing poor victim (say V), using oblivious
> > server (say) O.
> >
> > Now,
> >
> > Evil-Endpoint E:
> > Source IP V(spoofed)
> > Dest IP O
> > SCTP-INIT (invalid params) ----------------> Server O
> > /-------------/
> > SCTP-Abort,Error /
> > Poor Victim V <--------------/
> >
> > Now, if E can use V, it could send such packets to a large number
> > of servers. And then V gets bombed with Aborts.
> >
> > I agree fully, that an established association is safe, but that
> > was not the issue I was thinking about. Comments ?
> >
> > Andreas
> >
> > > Andreas Jungmaier wrote:
> > > > -----BEGIN PGP SIGNED MESSAGE-----
> > > > Hash: SHA1
> > > >
> > > > Hello Thomas, dear all,
> > > >
> > > > please see my comments below.
> > > > I am CC'ing TSVWG to discuss this: does this open up a possibility
> > > > for DoS attacks ?
> > > >
> > > > On Thursday, 14. February 2002 08:56, Hollaus Thomas wrote:
> > > > > Dear all,
> > > > >
> > > > > Question to unexpected chunks with invalid mandatory
> > parameters (e.g.
> > > > > MIS=0, OS=0, Init-Tag=0):
> > > > > As far as I understand the sctp.de implementation, it
> > is possible to
> > > > > attack a running association with e.g. an INIT and
> > invalid mandatory
> > > > > parameters. After receive of that unexpected chunks the
> > prototype does
> > > > > delete the running association (pre 16: sctp-control.c,
> > func scr_init,
> > > > > line 677). Is that a correct behaviour according to RFC?
> > > >
> > > > The implementation probably should return an ABORT with
> > an Error Chunk
> > > > that specifies the appropriate error code, as per RFC 2960:
> > > > Cause Code
> > > > Value Cause Code
> > > > --------- ---------------->
> > > > 1 Invalid Stream Identifier
> > > > 2 Missing Mandatory Parameter
> > > > 3 Stale Cookie Error
> > > > 4 Out of Resource
> > > > 5 Unresolvable Address
> > > > 6 Unrecognized Chunk Type
> > > > --> 7 Invalid Mandatory Parameter
> > > > 8 Unrecognized Parameters
> > > > 9 No User Data
> > > > 10 Cookie Received While Shutting Down
> > > >
> > > > However, I am not actually sure that this is a good idea,
> > since that
> > > > would make it easily possible (with IP spoofing) to start
> > > > denial-of-service attacks.
> > > > I think the rationale behind this in the RFC was to stop a broken
> > > > client from keeping retransmitting wrong INITs and tell
> > it directly
> > > > WHAT is wrong, and that something is wrong.
> > - --
> > -
> > --------------------------------------------------------------
> > ----------
> > Dipl.-Ing. Andreas Jungmaier | _
> > Computer Networking Technology Group | ASCII ribbon campaign ( )
> > University of Essen | - against HTML email X
> > http://www.exp-math.uni-essen.de/~ajung | & vcards / \
> > -----BEGIN PGP SIGNATURE-----
> > Version: GnuPG v1.0.6 (GNU/Linux)
> > Comment: For info see http://www.gnupg.org
> >
> > iD8DBQE8a864XAsLBNOCSsARAlUzAKCYTPXsNH2p23b3DAKM0/Ye7m73XACfZ9I8
> > a8KoEnC8KTIbBut4WLULsrI=
> > =6OgC
> > -----END PGP SIGNATURE-----
> >
> _______________________________________________
> discussion mailing list
> discussion AT sctp.de
> http://www.sctp.de/mailman/listinfo/discussion

---

• RE: [SCTP-Discussion] AW: [Tsvwg] Possible DoS in SCTP ? (was: r eception of invalid pa rameters), Tuexen Michael, 02/14/2002

---

Archive powered by MHonArc 2.6.19+.