Subject: Re: [Capwap] transition to join state

From: "Scott G. Kelly" <[email-masked]>
Date: Thu, 26 Oct 2006 10:29:37 -0700 (GMT-07:00)

Hi Smitha,

>
>Scott,
>
>The idea was to isolate details of DTLS handshake from CAPWAP. If we
>need to keep track of DTLS Client Hello (with a valid cookie), then the
>earlier transitions were OK. 
>
>Why do we need a CAPWAP transition based on DTLS packets (unless a
>session is established) and a WaitDTLS timer that CAPWAP needs to
>maintain? That would be part of DTLS.

You need this because DTLS provides no timeout of its own. It provides an exponential back-off timer, but this never terminates (I know, sounds like a major foobar in the protocol design, but they probably had their reasons...)

If we don't add the timer, resource-exhaustion DoS (from a bunch of half-open sessions) is trivial to mount.

Scott

_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap

---

From: "sujay gupta" <[email-masked]>
Date: Tue, 31 Oct 2006 17:04:25 +0530

Hi Scott,
Good point, but shouldn't this timer(WaitDTLS) be a part of the
DTLS implementation, probably an add-on, if not present.

For if we are to separate the CAPWAP transitions from the DTLS
handshake messages, a WaitDTLS timer doesn't make sense there.
Regds,
Sujay

On 10/26/06, Scott G. Kelly <[email-masked]> wrote:
> You need this because DTLS provides no timeout of its own. It provides an
> exponential back-off timer, but this never terminates (I know, sounds like a
> major foobar in the protocol design, but they probably had their reasons...)
>