Re: Question regarding RFC 4960 Out of the Blue packets

Horsham, Ian wrote:

[BTW, SCTP is usually discussed over on the tsvwg list now.]

> Section 1.5.6 only says "Packets received without the expected
> Verification Tag value are discarded" (it doesn't actually state that
> they are silently discarded). It does go on to say that "The receiver of
> an SCTP packet with an invalid CRC32c checksum silently discards the
> packet.". However I'm considering a packet with a correct CRC32c check
> and an incorrect verification tag.
> 
> This has made me think that there is a difference between invalid
> packets (CRC32c error) and OOTB packets (CRC32c passed but verification
> tag incorrect) and that is why section 8.4 exists.
> 
> Do you think that section 8.4 can be ignored or is there a difference
> between invalid packets and OOTB packets? I think that there is a
> difference and the RFC is saying that OOTB packets should be handled
> differently (as per section 8.4).
> 
> Consequently, I can see the benefits of silently discarding these
> packets (for security).

Maybe this explanation helps:

Section 1.5.6's guidance to discard packets with "unexpected" vtags only 
applies when the receiver of the packet has a matching (based on the 
addresses) association.  So, in Michael's words, the receiver has an 
expectation as to what the vtag should be and the packet does not match it.

OOTB, on the other hand, applies to packets for which the receiver has 
no association.

You shouldn't send an ABORT in the "unexpected" case to avoid aborting a 
valid association due to a lucky hit on a blind masquerade attack or 
because a (very late) packet from a previous instance of that 
association arrived.

You should send an ABORT (as per section 8.4) to correct a peer who 
seems to think you have an association that you don't have.