Re: [Tsvwg] SCTP and ICMP Protocol Unreachable

[Michael Tuexen <[e-mail]>]

Brian,

see my comment in-line.

Best regards
Michael

On Sep 20, 2006, at 1:51 PM, Brian F. G. Bidulock wrote:

> Stephane,
>
> Stephane Chazelas wrote:                  (Wed, 20 Sep 2006 10:40:32)
>>
>> There has to be another explanation. Would you be so kind as to
>> point me to where to find those examples you were refering to,
>> please?
>
> Section 5.3. of:
>   http://www.ietf.org/internet-drafts/draft-ietf-tsvwg- 
> sctpthreat-00.txt
>
> With the new requirements to validate addresses with a nonce-HB before
> sending to them, most of the destination address list spoofing attacks
> are defeated.
>
> Also, not sending to a destination (putting it on a permanent black  
> list
> for the association and not even sending heartbeats) after  
> receiving the
> ICMP serves to defeat the attack equally well to aborting the
> association.  (Not to mention that we won't even send other than INIT
> or HB chunks to a non-SCTP aware host any more and nonce-HB is very
> restricted and avoids amplification.)
The idea with the text in () is problematic. An host might support SCTP
at given points of time. Only after a kernel extension is loaded or
when a userland implementation is running. So putting it in a permanent
black list does not allow starting SCTP on hosts...
>
> I agree with you: an SCTP implementation should be allowed to  
> strike the
> destination instead of the association, thus bypassing busted middle
> boxes, but I think that it MUST strike the destination to avoid  
> hackers
> bypassing a given nonce-HB implementation.
>
> --brian
>
> -- 
> Brian F. G. Bidulock
> [e-mail]
> http://www.openss7.org/
>