Subject: RE: [AAA-WG]: Diameter vulnerability to connection depletion DoS attacks

From: <[email-masked]>
Date: Tue, 3 Jun 2003 16:39:35 +0300

Floroiu John wrote:

> For AAA clients, the solution would be to create a AAA session only
> as result to receiving an (positive) AAA answer. Additionaly,
>
> * the AAA server must include in the answer all those attributes
>   specified in the request the AAA client requires in order to
>   consistently setup the AAA session;
>
> * the AAA client must compute a hash over those fields contained in
>   the request that uniquely and consistently identify a session and a
>   local timestamp, using a local key. The hash must be appended to the
>   request and the AAA server is required to echo the hash along with
>   the answer.
> (see also "Stateless connections", T. Aura, P. Nikander, ICIS 1997).
>
> AAA agents, in turn, would route the answers only based on the
> Route-Record AVPs, which must be appended by all relay and proxy
> agents (draft-ietf-aaa-diameter-12.txt 6.1.8), without matching the
> answers against the requests. This task will be accomplished by the
> AAA client (and AAA server implicitly).

Diameter already includes an AVP that can be used to accomplish
what you want: Proxy-Info/Proxy-State. The AAA client can store
whatever state it needs to process the answer in the Proxy-State
AVP (possibly encrypted and MAC'd, if considered necessary),
and get it back in the server's answer.

However, I tend to agree with David Mitton's answer, that
avoiding this type of DoS is an implementation issue.

Besides, such "stateless operation" is not without problems: 
for instance, failover that retransmits the request to
an alternative server is not possible without per-session
state.

Best regards,
Pasi

---

From: [email-masked] (Floroiu John)
Date: Thu, 5 Jun 2003 11:32:29 +0200

Pasi,

> and get it back in the server's answer.

Just a small comment on that: the AVP you mention provides the support to
operate truly stateless, but the protocol still requires states to be
maintained (see the definition of the state machines), therefore the AVP
alone is not of real help! 

Anyway, I got an understanding on the "stateless AAA" issue.

John.