Subject: [Tsvwg] SCTP Implementer's guide question...

From: "Balani, Sandeep" <[email-masked]>
Date: Tue, 12 Feb 2002 09:45:43 -0800

Hi all, 
  I have a question regarding SCTP implementer's guide. I remember this
issue was discussed during 2nd Bakeoff. 

In http://www.ietf.org/internet-drafts/draft-ietf-tsvwg-sctpimpguide-03.txt
section 5.2.2. We are describing the case of association RESTART when INIT
is received in any state other than CLOSED, COOKIE-ECHOED, COOKIE-WAIT and
SHUTDOWN-ACK-SENT. The text says 

 " Before responding the endpoint MUST check to see if the
   unexpected INIT adds new addresses to the association. If new
   addresses are added to the association, the endpoint MUST respond
   with an ABORT copying the 'Initiation Tag' of the unexpected INIT
   into the 'Verification Tag' of the outbound packet carrying the ABORT. " 

I think that we should check the additional IP addresses when we receive
COOKIE-ECHO from the peer not when we receive INIT from peer, because if we
send ABORT when we receive INIT then an *INTRUDER* can break an ESTABLISHED
association by sending INIT on an existing association with addition of any
IP addresses.

Correct me here please . 

Thanks
sandeep 

_______________________________________________
tsvwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tsvwg

---

From: "Brian F. G. Bidulock" <[email-masked]>
Date: Tue, 12 Feb 2002 12:03:19 -0600

Sandeep,

For an intruder to abort the association, the intruder would also
have to place the verification tag of the existing association in
the INIT.  That is rather difficult.

--brian

-- 
Brian F. G. Bidulock    ¦ The reasonable man adapts himself to the ¦
[email-masked]    ¦ world; the unreasonable one persists in  ¦
http://www.openss7.org/ ¦ trying  to adapt the  world  to himself. ¦
                        ¦ Therefore  all  progress  depends on the ¦
                        ¦ unreasonable man. -- George Bernard Shaw ¦