Subject: [rddp] Potential data corruption in DDP with MSN protocol violation

From: "Barry Reinhold" <[email-masked]>
Date: Fri, 23 Apr 2004 13:40:43 -0400

Based on the current wording in ddp draft 02, clause 9 it appears that a
receiver can place and deliver a sequence of DDP messages that arrive
with sequence number MSN=1, MSN=3, MSN=4 if there is no gap in the LLP
stream sequence. This could only be generated by a protocol error on the
transmitting side. 
However, if the transmitter did indeed generate this sequence
incorrectly it is conceivable that the receiver would have old data in a
buffer associated with MSN=2 and deliver it to the ULP.

Although one does not in general like to have the receiver check for
protocol errors, this may be an area in which the wording of the
standard should be strengthened a bit, such that DDP messages can not be
delivered when there are holes in the MSN space.

Barry Reinhold
Lamprey Networks
[email-masked]
(603) 868-8411

_______________________________________________
rddp mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rddp

---

From: Caitlin Bestler <[email-masked]>
Date: Fri, 23 Apr 2004 22:29:45 +0300

> buffer associated with MSN=2 and deliver it to the ULP.

The buffer associated with MSN 2 cannot be delivered unless a segment
for MSN 2 arrives with the L bit set.

It *is* possible for a sender to deliberately deliver undefined data
to a peer, by simply not sending the entire message. It is unlikely
that the receiver would take the effort to detect this (given that the
MAY be out of order even in relation to LLP sequence, they only
SHOULD be in order).

But since the buffer belonged to the Data Sink ULP anyway I
cannot imagine there being an exploit for this. Tricks involving
*system* buffers might reveal interesting data if the system
fails to zap them when assigning them to a new user. But
that's one of the problems that RDMA avoids.