RE: Some RDDP attacks

 
Abstracting it up a level, the current DDP/RDMAP IDs require a reliable transport protocol underneath them. For example, the DDP ID is titled "DDP over Reliable Transports". Silent drop is effectively corrupting the reliable transport. 
 
Back when we were originally creating the DDP/RDMAP drafts, we spent a lot of time trying to decide on whether the protocol was generic enough to run over reliable and unreliable transports. When we dove in to it, there were significant issues that were unique to the approach of running over an unreliable transport (what is the programming model, how are completions handled when things are lost, resolving holes in sequence space, etc). The group was primarily interested in nailing reliable transports, since that has been the traditional RDMA programming model. Thus the draft title got "... over Reliable Transports" added to it to explicitly state the original author's focus. 
 
I believe since the IDs were adopted by RDDP, that there has been wide support for a focus on reliable transports as the first protocol suite to come out of RDDP. Unreliable can come later. 
 
 
 
jim
 
 

________________________________

From: [email protected] on behalf of Talpey, Thomas
Sent: Thu 7/8/2004 4:17 AM
To: [email protected]
Subject: Re: [rddp] Some RDDP attacks



At 02:50 PM 7/5/2004, [email protected] wrote: 
>I think that's actually indicative of a DDP problem, in that the current 
>DDP draft is too quick to close a connection when receiving anything it 
>doesn't expect.  Mandating "silent drop" rather than "tear down the 
>connection" would make this attack significantly harder to pull off. 

Silent drop would be a disastrous choice for DDP errors, especially 
bad MSN or invalid STag! This would be like TCP ack'ing a hole in 
sequence space or bad checksum. It would give the upper layers 
on both sides of the connection an indication that messages had 
been received when they had not. 

Consider an RDMA Write with bad STag that was dropped at the 
receiver. The subsequent Send, signalling the receipt, would then 
pass upwards. Oops. Or consider a sender exceeding its credits 
and losing a string messages in the middle, but not the end, of a 
sequence. 

Because it's an ack-less protocol, the only valid response DDP can 
make is to send a Terminate and close the connection. Which it must. 

Tom.

_______________________________________________
rddp mailing list
[email protected]
https://www1.ietf.org/mailman/listinfo/rddp