Subject: [Pana] Nits on processing invalid message

From: Yoshihiro Ohba <[email-masked]>
Date: Fri, 20 Apr 2007 20:06:32 -0400

In Section 5.4:

"
   Invalid messages MUST be discarded in order to provide robustness
   against DoS attacks.  In addition, an error request message MAY be
   returned to the sender.  See Section 5.8 for details.
"

If an error request is returned in response to an erroneous message,
then this means that the sender of the error request message will
terminate the session after receiving the error answer.  This actually
does not provide robustness against DoS attacks because an attacker
can send an erroneous answer to terminate the session.  So the text
should say:

"
   Invalid messages MUST be discarded either silently in order to
   provide robustness against DoS attacks or with returning 
   an error request message to the sender.  See Section 5.8
   for details.
"

Yoshihiro Ohba

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: "Alper Yegin" <[email-masked]>
Date: Mon, 23 Apr 2007 16:20:21 +0300

>    an error request message to the sender.  See Section 5.8

I think this is effectively the same statement as the original one. If we
want to maintain the DoS resiliency, we shall just go with "Invalid messages
MUST be discarded in order to provide robustness against DoS attacks."

Alper

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 23 Apr 2007 12:59:19 -0400

> MUST be discarded in order to provide robustness against DoS attacks."

Does this mean that most protocol error result codes defined in
Section 8.8.2 are not needed, except for the folloiwng ones?

   PANA_UNABLE_TO_DELIVER                  1002
   PANA_RESOURCES_EXCEEDED                 1008
   PANA_UNABLE_TO_COMPLY                   1013

Yoshihiro Ohba

---

From: "Alper Yegin" <[email-masked]>
Date: Mon, 23 Apr 2007 22:38:27 +0300

>    PANA_UNABLE_TO_COMPLY                   1013

Yes, this is what it boils down to. Is this a concern?

I personally don't mind reducing the error list down to that. If we wanted
to keep the same longer list, yet still have DoS resiliency, we could
mandate presence of AUTH AVP in the offending messages. If the offending
message does not have a valid AUTH AVP, the message must be silently
discarded. 

When we are talking about DoS in this case, we are concerned about attackers
who don't even have a PANA SA, right?

Alper

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 23 Apr 2007 16:49:15 -0400

> Yes, this is what it boils down to. Is this a concern?

DoS attack is also possible with those errors.  The only difference is
whether the errors are supposed to be generated due to receipt of an
invalid message or some other reasons.

> message does not have a valid AUTH AVP, the message must be silently

This does not seem to solve the problem either.  If the protected
message contains errors, then the receiver will create an protected
error request, but the session will be terminated after receiving an
error answer according to the discussion (i.e., in general, the sender
of the erronerous message has no idea on what to do next other than
terminating the session.)

I think error messages should be used only in debugging mode,
regardless whether there is PANA SA or not.

Yoshihiro Ohba

---

From: "Alper Yegin" <[email-masked]>
Date: Wed, 25 Apr 2007 16:12:38 +0300

Maybe I misunderstood the problem.

PaC    PAA
 ----> req
 <---  error request
 --->  error answer

What kind of DoS attack are we looking at?

Is it about a rogue PaC spoofing an erroneous "req" and leading to PAA's
termination of the victim PaC's session? Or some other scenario....

Alper

> -----Original Message-----
> From: Yoshihiro Ohba [mailto:[email-masked]]
> Sent: Monday, April 23, 2007 11:49 PM
> To: Alper Yegin
> Cc: 'Yoshihiro Ohba'; [email-masked]
> Subject: Re: [Pana] Nits on processing invalid message
> 
> > > > I think this is effectively the same statement as the original one.
> If
> > > we

---

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 25 Apr 2007 09:31:36 -0400

On Wed, Apr 25, 2007 at 04:12:38PM +0300, Alper Yegin wrote:
> termination of the victim PaC's session? 

Yes.

Yoshihiro Ohba

> Or some other scenario....
> 
> Alper
> 
> 
> 
> 
>

---

From: "Alper Yegin" <[email-masked]>
Date: Wed, 25 Apr 2007 18:26:32 +0300

> > termination of the victim PaC's session?

OK.

> > DoS attack is also possible with those errors.  The only difference 
> > is whether the errors are supposed to be generated due to receipt of 
> > an invalid message or some other reasons.

In order not to subject the PANA to DoS based on error processing, we shall
either:
1- take error messages as informative, and not terminate the session, OR
2- do not define any error messages (i.e., always silently ignore offensive
messages, and other local failure conditions).

I think I'm fine with either approach. I'm leaning towards 2 for further
reduction in specification. 1 appears to be much for a "debug mode" of
operation....

Alper

> > > > > > want to maintain the DoS resiliency, we shall just go with
> "Invalid
> > > > > messages

---

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 25 Apr 2007 13:18:05 -0400

> messages, and other local failure conditions).

1 is not possible for an error request is sent in response to an
erroneous answer.  In this case, the sender of the error request has
an outstanding request.  Unless you terminate the outstanding request
(which means the error message is not taken as informative), the error
request cannot be transmitted.

In that sense, I also support 2.

Yoshihiro Ohba