[P2PSIP] 答复: An overlay resource leak scenario

邓灵莉/Lingli Deng <denglingli@chinamobile.com> Thu, 04 July 2013 22:58 UTC

From: 邓灵莉/Lingli Deng <denglingli@chinamobile.com>
To: 'Michael Chen' <michaelc@idssoftware.com>, p2psip@ietf.org
References: <20130704105617.59ca11a9ba9389561a029f06442e67fa.27bdf1c864.mailapi@email03.secureserver.net>
In-Reply-To: <20130704105617.59ca11a9ba9389561a029f06442e67fa.27bdf1c864.mailapi@email03.secureserver.net>
Date: Fri, 05 Jul 2013 06:57:57 +0800
Message-ID: <022901ce7909$ee903da0$cbb0b8e0$@com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_022A_01CE794C.FCB37DA0"
Thread-Index: Ac544XllHtGmtekAQYOEmqyNQUpByAAJ+z7A
Content-Language: zh-cn
Subject: [P2PSIP] 答复: An overlay resource leak scenario
Precedence: list

Hi Michael,

 

I don’t quite follow the case you described.

 

Shouldn’t a well-behaved rejoining peer be using the still valid certificate in the first place?

Otherwise, it is easy to exploit this to launch a DoS attack against ES, which must be protected.

 

BR

Lingli

 

发件人: p2psip-bounces@ietf.org [mailto:p2psip-bounces@ietf.org] 代表 Michael Chen
发送时间: 2013年7月5日 1:56
收件人: p2psip@ietf.org
主题: [P2PSIP] An overlay resource leak scenario

 

Hi,

 

Background

==========

In a SIP usage of RELOAD, a peer can store its AoR and certificate in a single RELOAD Store Request with a SIP Registration kind and a Certificate By User kind. The data model for the SIP Registration is dictionary with its Node-ID as key, and Certificate By User is array.

 

P2PSIP Draft

===========

In pspsip-base-26, section 11.3, bullet #5 says:

   o  One or more Node-IDs ...
      ...  The enrollment server
      SHOULD maintain a mapping of users to Node-IDs and if the same
      user returns (e.g., to have their certificate re-issued) return
      the same Node-IDs, thus avoiding the need for implementations to
      re-store all their data when their certificates expire.

 

Implementation

=============

The enrollment server always returns a new Node-ID or keeps the above mapping for a short period compared to the expiration time of the certificate.

 

Usage Scenario

=============

A device goes in and out of the range of WiFi as it moves or sleeps then awakes. Each time it loses the WiFi, RELOAD does not get the chance to properly Leave the overlay. Each time it gets the WiFi back, it rejoins the overlay and receives a new Node-ID and thus a new certificate.

 

Resource Leak

=============

Due to the data model (dictionary key off Node-ID) and array (Store by appending), the overlay holds on to more and more useless SIP Registration and Certificate By User at the Resource-ID (hash of the device's AoR).

 

Possible Remedy 1

================

(p2psip-base) The enrollment server MUST maintain the same AoR to Node-ID mapping as long as the corresponding certificate is still valid. Con: expensive enrollment server storage.

 

Possible Remedy 2

================

(p2psip-sip and p2psip-base?) The joining peer MUST fetch and remove existing SIP Registration and Certificate By User at the Resource-ID before storing its current one. Con: peer-join complexity.

 

Do I have a case?

 

Thanks

 

--Michael

Re: [P2PSIP] An overlay resource leak scenario Michael Chen
[P2PSIP] An overlay resource leak scenario Michael Chen
[P2PSIP] 答复: An overlay resource leak scenario 邓灵莉/Lingli Deng
Re: [P2PSIP] 答复: An overlay resource leak scenario Marc Petit-Huguenin
[P2PSIP] 答复: 答复: An overlay resource leak scenario 邓灵莉/Lingli Deng
[P2PSIP] 答复: An overlay resource leak scenario 邓灵莉/Lingli Deng