Subject: [tsvwg] SCTP INIT Parameters

From: Samuel DeLaughter <[email-masked]>
Date: Wed, 11 Oct 2017 22:55:38 +0000

Hi All,

I’m a doctoral student researching Denial of Service vulnerabilities in SCTP, and am hoping someone here might be able to answer some questions about the optional parameters in INIT chunks.  Specifically, I’m curious why the IPv4 Address and IPv6 Address parameters would be included in the INIT rather than the COOKIE ECHO.  My understanding is that the receiver of an INIT should maintain no state about the sender after sending the INIT ACK — does the receiver actually do anything with the addresses provided in optional parameters before the COOKIE ECHO is received, or is there some reason that the COOKIE ECHO chunk needs to be kept short?  Was there ever a discussion about the best place to put these parameters during the early days of SCTP?  Any insight you can offer would be greatly appreciated.

Thank You,
Sam

--
--
Samuel DeLaughter
Doctoral Student / Research Assistant
Advanced Network Architecture Group
Department of Electrical Engineering and Computer Science
Massachusetts Institute of Technology

---

From: "Brian F. G. Bidulock" <[email-masked]>
Date: Thu, 19 Oct 2017 00:30:00 -0600

Samuel,

Please see comments below.

Samuel DeLaughter wrote:               (Wed, 11 Oct 2017 22:55:38)
> Hi All,
> 
> I’m a doctoral student researching Denial of Service vulnerabilities
> in SCTP, and am hoping someone here might be able to answer some
> questions about the optional parameters in INIT chunks.  Specifically,
> I’m curious why the IPv4 Address and IPv6 Address parameters would be
> included in the INIT rather than the COOKIE ECHO.  My understanding is
> that the receiver of an INIT should maintain no state about the sender
> after sending the INIT ACK — does the receiver actually do anything
> with the addresses provided in optional parameters before the COOKIE
> ECHO is received, or is there some reason that the COOKIE ECHO chunk
> needs to be kept short?  Was there ever a discussion about the best
> place to put these parameters during the early days of SCTP?  Any
> insight you can offer would be greatly appreciated.

The SCTP receiving the INIT must determine whether it is possible
to form an association with the peer.  If it cannot, it will be
possibly returning an ABORT, not an INIT-ACK.  Also, it must
determine whether it has an existing association.  To do either
of these, it must know all of the transport endpoints with which
the association must form before it generates a cookie.
Therefore the transport addresses must be sent with the INIT.

Brian

-- 
Brian F. G. Bidulock
[email-masked]
http://www.openss7.com/