Re: [Sigtran] SCTP: Heartbeat ack recieved without sending Heartbeat
ash kat <[email protected]>
| Newsgroups | gmane.ietf.tsvwg,gmane.ietf.sigtran |
|---|---|
| Message-ID | <[email protected]> |
Hi IMO there can be 3 possible solutions to this problem: 1. The Endpoint should drop/discard the Heartbeat ack chunk 2. Process the Heartbeat ack as normal. 3. Send an Abort to peer. If we take the: 3) Third option [Sending the ABORT chunk] : The received HB-ACK is for a valid association but the receiver hasn't sent the HB so this HB-Ack can be from an attacker. So sending an ABORT will close [ABORT] the right association and will solve the purpose of the attacker. So this option is ruled out. 2) Second option [Process the Heartbeat Ack as normal ] : Doing this will result in the modification of some internal parameters of the SCTP stack for that association. So this option is also ruled out. 1) So the remaining option of silently Discarding/Droping this HB-Ack [without informing the peer or user] is the most appropriate one. Please share your view on this? Brian: If you remember then please mention what was the behavior for this scenario in the IG that is now removed. It willl help us to make a proper solution for this problem. Regards, Ashwani Kathuria "Brian F. G. Bidulock" <[email protected]> wrote: ash, ash kat wrote: (Sun, 18 Jun 2006 23:14:09) > > But there should be some standardized behavior [Whatever it will be as > a result of this discussion] for this scenario. > > Please let me know your opinion about this. At one time there was some (more) mention of this in the I-G (which became RFC 4460) because at early interops hacking the other implementation's HB was a popular passtime, however, it was removed at some point along the way (I'm not sure why). IMO there should be some mention, as a hacked HB-ACK could cause an implementation to overrun its congestion window, posing both a security risk as well as a risk to the Internet. --brian -- Brian F. G. Bidulock [email protected] http://www.openss7.org/ --------------------------------- Do you Yahoo!? Get on board. You're invited to try the new Yahoo! Mail Beta.