Subject: [rddp] RE: STag invalidation

From: [email-masked]
Date: Mon, 14 Apr 2003 11:19:08 -0400

WG chair hat still off ...

> > > Without header checking *any* address that is open to *any*
> > > STag valid within the Protection Domain is targettable by an
> > > incorrect (and unchecked) DDP header. To be safe,
> > > applications would have to very actively invalidate STags
> > > after every received message.
> > 
> > An application that cares about data integrity and does not fully
> > trust its senders (there are lots of examples, as this is likely to
> > be the case for anything other than a tightly integrated cluster)
> > is likely to want to invalidate the STag after each received message
> > in order to avoid attacks based on a remote overwrite
> > after some application validity check has been made on the received
> > data.  See Section 4.1 of the DDP and RDMA Concerns draft.
> 
> If you don't trust a client, it is really only necessary to protect work
done
> for other clients from meddling. If an untrusted client wants to sabotage
> work done on their behalf, well let them.

Only if the work has no lasting value after it's done.  If I store a
file to a fileserver and 3 months later the fileserver tells me that
it is corrupted due to something that probably happened when the
file was originally stored ... I'm going to go buy a fileserver that
actually works unlike that piece of <bleep>.

> Creating a Protection Domain for each client is more than enough to ensure
> that clients cannot interfere with other clients (and standard application
layer
> security).

Only if "standard application security" includes some serious defenses
against attacks on the application integrity (generally denial of service,
but could be worse).  The scenario of concern is that a data structure
placed by  RDDP is used by application code that doesn't recheck its
assumptions at every if statement just in case the structure was
overwritten.  Again, invalidating the STag may well be in order.

> The original point is that without header protection, an error within a
> session can invalidate work done for that session -- unless almost
> draconian measures of STag invalidation are undertaken. That would
> *include* having no more than one operation pending at a time.

I think that conclusion starts from a decision not to trust the TCP/IP
checksums.  A different starting point could reach a different conclusion,
but I don't have a problem with a mandatory header CRC.

Thanks,
--David
----------------------------------------------------
David L. Black, Senior Technologist
EMC Corporation, 176 South St., Hopkinton, MA  01748
+1 (508) 293-7953             FAX: +1 (508) 293-7786
[email-masked]        Mobile: +1 (978) 394-7754
----------------------------------------------------
_______________________________________________
rddp mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rddp