Subject: [Capwap] Issue 157: Issue with handling of cookies

From: "Pat Calhoun (pacalhou)" <[email-masked]>
Date: Mon, 28 Jul 2008 12:47:51 -0700

Here is Pasi's comment:

   Section 2.4.3: handling of cookies that fail to validate is really a
DTLS 
   detail, and shouldn't be in this specification. RFC 4347 doesn't say
what the 
   DTLS server should do, but I think the right approach is to treat an
invalid 
   cookie the same as no cookie (and not discard the whole message, as
is 
   suggested here -- I think that could lead to weird failure modes even
in the 
   absence of malicious attackers).  I'll raise this on the TLS mailing
list, so 
   it can be clarified in DTLS 1.2 update.

Given the nature of the question, I would like to defer to Scott or
Charles. I recall us going back and forth on this, and would like their
guidance before we propose a change.

PatC
_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap

---

From: Charles Clancy <[email-masked]>
Date: Mon, 28 Jul 2008 21:03:55 -0400

I'd be okay with treating a cookie failure as not receiving the cookie. 
  Replace:

    If a cookie fails to validate, this could represent a WTP error, or
    it could represent a DoS attack.  Hence, AC resource utilization
    SHOULD be minimized.  The AC MAY log a message indicating the
    failure, but SHOULD NOT attempt to reply to the WTP.

With:

    If a cookie fails to validate, this could represent a WTP error, or
    it could represent a DoS attack.  Hence, AC resource utilization
    SHOULD be minimized.  The AC MAY log a message indicating the
    failure, and SHOULD treat the message as though no cookie were
    present.

--
t. charles clancy, ph.d.                 eng.umd.edu/~tcc
electrical & computer engineering, university of maryland