Subject: RE: Address Matching in INIT-ACK/COOKIE-ECHO

From: Caitlin Bestler <[email-masked]>
Date: Tue, 4 Mar 2003 12:54:50 -0600

For the record, an example that shows that the address list
within an INIT-ACK must eventually be examined.

There are two multihomed hosts, neither of which is aware
that the other is multi-homed. The active host uses
addresses A and B, the passive host uses addresses X and Y.

While X and Y are both reachable via either of AB's
interfaces, the default route to X uses the interface
where the source address should be A while for Y the
default route implies use of source address B.

The scenario:

INIT - From A:1000 to X:1000
Address List: A,B
Initiation Tag: I

INIT - From B:1000 to Y:1000
Address List: A,B
Initiation Tag: J

                INIT-ACK - From X:1000 to A:1000
                Address List: X,Y
                Verification Tag: I
                
COOKIE-ECHO - From X:1000 to A:1000
Verificatin Tag: I
                
                INIT-ACK - From Y:1000 to B:1000
                Address List: X,Y
                Verification Tag: J
                
COOKIE-ECHO - From Y:1000 to B:1000
Verificatin Tag: J

If neither side examines the Address List, the passive
side will firmly establish two associations with the
same endpoints. Checks based solely upon IP header
information and tags will not differentiate either
the INIT-ACKs or the COOKIE-ECHOes. They cannot, without
looking at the lists, all of the packet would look identical
to the packets expected if the other side were truly two
different hosts.

The only way to avoid RFC-violating duplicate associations
is to examine the address list at some point. It should be
obvious that this check should be done at the first
opportunity (on receipt of the INIT-ACK).

Caitlin Bestler
http://asomi.com/CaitlinBestler/

---

From: "Brian F. G. Bidulock" <[email-masked]>
Date: Tue, 4 Mar 2003 12:22:30 -0700

Caitlin,

> If neither side examines the Address List, the passive

The address list does not need to be examined.  The the
first INIT-ACK in these examples always expands the TCB.

The TCB in the second INIT-ACK above can be found using
the source address of the INIT-ACK packet (Y) and does
not require looking in the address list at all "[w]hen
searching for the TCB", contrary to IG section 2.18.

> is to examine the address list at some point.

But not "[w]hen searching for the TCB" as the IG mis-states.

--brian

> It should be

-- 
Brian F. G. Bidulock    ¦ The reasonable man adapts himself to the ¦
[email-masked]    ¦ world; the unreasonable one persists in  ¦
http://www.openss7.org/ ¦ trying  to adapt the  world  to himself. ¦
                        ¦ Therefore  all  progress  depends on the ¦
                        ¦ unreasonable man. -- George Bernard Shaw ¦