Subject: RE: Matching addresses in INIT and INIT ACK

From: "Vijay Kumar Choudhary" <[email-masked]>
Date: Tue, 25 Feb 2003 16:59:00 +0530 (India Standard Time)

Hi Ivan,
    Thanx for ur reply !!!!  Now i got it.

Regards,
Vijay

-------Original Message-------
From: [email-masked]
Date: Tuesday, February 25, 2003 10:00:39 PM
To: [email-masked]; [email-masked]
Subject: RE: Matching addresses in INIT and INIT ACK
Hi Vijay!
See my comment below...
> Hi All,
> In the sctp imp guide, a new point is added
> 
> New text: Section 5.1.2
> 
> D) When searching for a matching TCB upon reception of an INIT
> or INIT-ACK chunk the receiver SHOULD use not only the
> source address of the packet (containing the INIT or
> INIT-ACK) but the receiver SHOULD also use all valid
> address parameters contained within the chunk.
> 
> 
> I want to ask, is it wrong to match only the address received 
> in IP header ?
Yes, it is... If you don't do that, you could end up having open
associations that having the same address/port as source, also have the same
address/port at the destination.
Imagine that you have an open association with AddrA/PortA... Then I send
you an INIT from AddrB/PortA which also includes AddrA inside a parameter...
If you go on with the association establishment, at the end you will have
that packets coming from AddrA/PortA go either to the first or the second
association. Depending on how much care you have put on this, it could be
that an attacker is able to abort associations established by others...
Or another example with the INIT ACK. Imagine your user tells you to
establish an association with AddrA/PortA and also with AddrB/PortA, roughly
at the same time... But then, inside the first INIT ACK you receive, you
realize that those two addresses belong to the same peer... When you receive
the second INIT ACK you shouldn't send back the COOKIE ECHO but understand
that you are basically trying to establish the same association twice...
> What will happen if i will not match the addresses, which are 
> contained in
> the INIT or INIT ACK ?
See above.
BR Iván Arias Rodríguez
> Regards,
> Vijay

---

From: <[email-masked]>
Date: Tue, 25 Feb 2003 13:24:43 +0200

Hi Vijay!

	See my comment below...

> I want to ask, is it wrong to match only the address received 

	Yes, it is... If you don't do that, you could end up having open associations that having the same address/port as source, also have the same address/port at the destination.

	Imagine that you have an open association with AddrA/PortA... Then I send you an INIT from AddrB/PortA which also includes AddrA inside a parameter... If you go on with the association establishment, at the end you will have that packets coming from AddrA/PortA go either to the first or the second association. Depending on how much care you have put on this, it could be that an attacker is able to abort associations established by others...

	Or another example with the INIT ACK. Imagine your user tells you to establish an association with AddrA/PortA and also with AddrB/PortA, roughly at the same time... But then, inside the first INIT ACK you receive, you realize that those two addresses belong to the same peer... When you receive the second INIT ACK you shouldn't send back the COOKIE ECHO but understand that you are basically trying to establish the same association twice...

	See above.

	BR Iván Arias Rodríguez

---

From: "Brian F. G. Bidulock" <[email-masked]>
Date: Tue, 25 Feb 2003 06:20:27 -0700

Iván,

But I don't have to look in either the INIT or INIT-ACK to determine
this.  All I have to do is look in the cookie of the COOKIE-ECHO.

(For the second INIT ACK below, the verification tag gives away
the establishing association and a second COOKIE-ECHO can be
avoided without looking at the address list.)

So that doesn't really explain the section to me...

Also the section in the IG implies that associations will fail to be
formed that would otherwise be formed (not that multiple associations
will be attempted to be formed and could fail in one way instead of
another).

--brian

-- 
Brian F. G. Bidulock    ¦ The reasonable man adapts himself to the ¦
[email-masked]    ¦ world; the unreasonable one persists in  ¦
http://www.openss7.org/ ¦ trying  to adapt the  world  to himself. ¦
                        ¦ Therefore  all  progress  depends on the ¦
                        ¦ unreasonable man. -- George Bernard Shaw ¦