| Newsgroups |
gmane.ietf.rddp |
| Message-ID |
<[email protected]> |
I agree with this and also about the dangers of silent drop. Silent drop would allow silent data corroruption. The RDMAP protocol relies on stream completeness and its ordering rules to ensure behavior to the upper layers.
Pat
-----Original Message-----
From: [email protected] [mailto:[email protected]]On Behalf Of Jim Pinkerton
Sent: Thursday, July 08, 2004 6:47 AM
To: Caitlin Bestler; RDDP
Cc: David Black
Subject: RE: [rddp] Some RDDP attacks
I agree with Caitlin - once you've figured out the right values in TCP (i.e. "forge a packet"), TCP allows you to reset the connection without ever dealing with DDP/RDMAP - just send a RST segment. Thus I don't see how solving this in DDP/RDMAP changes the exposure.
As is noted in the following ID, this is viewed as non-trivial, but possible.
http://www.ietf.org/internet-drafts/draft-ietf-rpsec-bgpattack-00.txt, section 2.1.6 "Reset a single BGP Session".
jim
_____
From: Caitlin Bestler [mailto:[email protected]]
Sent: Thu 7/8/2004 6:20 AM
To: RDDP
Cc: David Black; Jim Pinkerton
Subject: Re: [rddp] Some RDDP attacks
On Jul 5, 2004, at 1:50 PM, [email protected] wrote:
>
>> If we took a moment to look at the packet header for DDP for how a
>> malicious user that has successfully guessed the SCTP/TCP transport
>> parameters can effect the connection, there is actually a far simpler
>> attack than guessing the 32 bit STag value - and the attack abortively
>> terminates the connection and thus truncates the data stream. Use
>> untagged messages with just about any MSN, and the receiver will get a
>> "no buffers available" error and tear down the connection. Thus
>> claiming
>> the STag is a risk actually ignores a much easier attack.
>
> I think that's actually indicative of a DDP problem, in that the
> current
> DDP draft is too quick to close a connection when receiving anything it
> doesn't expect. Mandating "silent drop" rather than "tear down the
> connection" would make this attack significantly harder to pull off.
If you can forge a TCP packet within the TCP window you can force the
connection to close. No RDDP Layer capabilities are required. This is
also true for SCTP, although forging a valid packet is slightly harder.
_______________________________________________
rddp mailing list
[email protected]
https://www1.ietf.org/mailman/listinfo/rddp