Subject: RE: Association initialization

From: <[email-masked]>
Date: Mon, 14 Oct 2002 14:39:22 +0300

Hi Morten!

	See my comments inline...

> -----Original Message-----
> From: ext Morten Laursen [mailto:[email-masked]]
> Sent: 14. October 2002 13:55
> To: [email-masked]'
> Subject: Association initialization
> 
> 
> Hi,
> 
> I've got a couple of questions about association initializion:
> 
> 1) The specification doesn't mention anything about what to 
> do if you do not
> wish to accept an association. To me it seems reasonable to 
> send an abort,
> but because there is no matching error cause I'm uncertain if 
> that is not
> how it is supposed to be done?

	I guess "Out of resource" is nice... Unless the reason why you don't want to open an association is closer to any other error cause.

	In any case you don't have to include any error cause. It will make life easier to the client though (for debugging purposes).

> I notice that lksctp (in linux 2.5.41) send an abort with 
> verification tag
> 0. Is it legal to use verification tag 0 when you know the peer's
> verification tag (since you got the init chunk)?

	Well, there has been some discussion about this, and the new Implementer's Guide will include some modification related to this.

	I think the final agreement was to set the T bit of the ABORT to 0, but still use the Initiate Tag as the Verification Tag of the datagram. This makes that the meaning of the T bit changes a little bit. Instead of meaning "I didn't erase any TCB", it would mean "I send you the 'reverse' VT". However, these two definitions will always be equivalent except for this case...

> 2) What is the point of being able to choose an initial TSN instead of
> always using 0, when we can use the verification tags to 
> distinguish old
> associations?

	In general, I considered it as an extra security measure for blind attacks. If somebody fakes your IP and sends some DATA, not only he has to guess the VT but also the TSN value... The SACKs will carry the right value of the TSN, but they will go back to the real peer...

	BR Iván Arias Rodríguez

> Thanks in advance...
> 
> Venlig Hilsen / Regards 
> Morten
> 
> -- 
> Morten Laursen, M.Sc.S.E.
> RTX Telecom A/S - http://www.rtx.dk/
> Direct phone: (+45) 96 32 24 03
> 
>

---

From: Meyknecht Bernward <[email-masked]>
Date: Mon, 14 Oct 2002 14:38:07 +0200

Hi Morten,
Hi Iván,

I'm also re-using the 'User initiated Abort' error cause value, 
together with some cause spec. info, on SCTP level, 
in cases, where the reason for not accepting the association 
is related to some upper layer defined filter or configuration.
Main reason for doing this is debugging.

Best regards,
Bernward

-----Ursprüngliche Nachricht-----
Von: [email-masked]
[mailto:[email-masked]]
Gesendet: Montag, 14. Oktober 2002 13:39
An: [email-masked]; [email-masked]
Betreff: RE: Association initialization

	Hi Morten!

	BR Iván Arias Rodríguez