Re: PS & Arch drafts: status and security issues

On Feb 20, 2004, at 8:08 PM, Jeffrey Mogul wrote:

> I'm not sure this is true -- the question quoted in David's
> original message was (in effect) whether an attacker could sneak
> bytes past a packet authentication stage in a way that would not
> be possible if RDMA were not used.  Whether or not the application
> *should* look at such bytes is not the issue; the problem arises
> when the application can be tricked into looking at them.

A given byte in user memory space is either exposed for read
and/or write or it is not. The ULP validity of the packet
that takes advantage of that enabled access is irrelevant.

Developing packet steering logic for each ULP creates *more*
of a vulnerability because there are more algorithms that can
be fooled.

RDMA standardizes the unpacking process, making it easier
to validate. But there is nothing in the RDMAP or DDP headers
that "authorizes" access to memory, it merely *requests*
access to memory. The authorization came from the local
ULP, and cannot exceed the authority that the local ULP
was already in possession of.

And yes, the local interface could be compromised, leading
to an RNIC making unauthorized access to local memory. But
that is true of *any* DMA-enabled device on virtually any
local system bus.

By standardizing payload placement, RDMA can reduce the
temptation to create multiple application specific solutions
that must be promoted to the kernel for efficiency. Providing
a mechanism for efficient handling of incoming data even for
user mode applications, RDMA should decrease the temptation
of "opening up" the kernel for new applications.


-- 
Caitlin Bestler - [email protected] - http://asomi.com/
http://asomi.com/CaitlinBestlerPublicPgpKey.html