Re: WG chair on buffer exhaustion

On Tuesday, July 29, 2003, at 02:39 PM, Mallikarjun C. wrote:

> Section 3.2 to:
>     " Note, however, that the ULP needs to address flow control 
> issues.  Any
>       ULP that runs on DDP SHOULD consider the lack of an associated 
> receive
>       buffer to place an inbound Untagged Message of the ULP as an 
> exception."

If the local interface has allows the DDP endpoint to know the valid
range of MSNs on a stream (which it will for simple Receive Queues at
the minimum)\ then it definitely SHOULD NOT consider the lack of a
buffer for an *invalid message* to be "an exception".

It is a *violation* of the Upper Layer Protocol, and quite possibly
represents an *attack*. It definitely SHOULD terminate the stream
promptly.

I am willing to accept Pat Thaler's argument that some applications
will find it awkward to share credits with the DDP layer on a per-stream
basis. That is why there is an "If" on the above wording. But the change
you propose implies that the DDP layer SHOULD be attempting to accept
untagged messages by whatever means possible and only terminate the
stream as a last resort.

That would be a mistake, and create a major security vulnerability.

The DDP layer SHOULD reject messages known to be invalid, whether or
not there are buffers available.

I would go further to state that DDP MUST NOT accept invalid untagged
messages if doing so would endanger any other ULP session.