Subject: Re: [Capwap] Issue 30: Inconsistent state tracking onAC priortoDTLSEstablishment

From: "Scott G. Kelly" <[email-masked]>
Date: Mon, 17 Dec 2007 16:19:22 -0500 (EST)

Hi Pat,

-----Original Message-----
>From: "Pat Calhoun (pacalhou)" <[email-masked]>
>Sent: Dec 17, 2007 3:45 PM
>To: "Scott G. Kelly" <[email-masked]>, Charles Clancy <[email-masked]>, capwap <[email-masked]>
>Subject: RE: [Capwap] Issue 30: Inconsistent state tracking onAC	priortoDTLSEstablishment
>
>The current spec clearly states:
>
>12.3.  Discovery Attacks
>
>   Since the Discovery Request messages are sent in the clear, it is
>   important that AC implementations NOT assume that receiving such a
>   request from a WTP implies that it has rebooted, and consequently
>   tear down any active DTLS sessions.
>
>We can expand this text to include the initiation of DTLS sessions.
>

Yes, the current text does preclude entering sulking state based on discovery messages. That's good. However, the proposed text says

   DTLS Setup to Sulking (d):  This transition occurs when repeated
      attempts to setup the DTLS connection have failed.
                :
                :
      AC:  The AC enters this state with the specific WTP when the
         FailedDTLSSessionCount or the FailedDTLSAuthFailCount counter
         reaches MaxFailedDTLSSessionRetry variable (see Section 4.8).
         Upon entering this state, the AC's Service thread MUST start
         the SilentInterval timer, and ignore all CAPWAP and DTLS
         protocol messages received from the WTP.  The AC immediately
         transitions the state to Idle.

This implies that if dtls session setup is spoofed, any active (valid!) sessions will be effectively disconnected, and (valid!) WTP recovery attempts will be ignored. If the attacker re-does this attack each time the SilentInterval (default: 30 seconds) expires, valid WTPs can be prevented from reconnecting indefinitely. This is the unauthenticated DoS I was referring to.

--Scott

_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap

---

From: "Pat Calhoun (pacalhou)" <[email-masked]>
Date: Mon, 17 Dec 2007 15:01:42 -0800

I'm happy to change this by simply adding text that you feel adequately
protects the AC from a flooding attack.

Could you provide some, and I can remove the (d) transition for the AC.

PatC 

-----Original Message-----
From: Scott G. Kelly [mailto:[email-masked]] 
Sent: Monday, December 17, 2007 1:19 PM
To: Pat Calhoun (pacalhou); Charles Clancy; capwap
Subject: Re: [Capwap] Issue 30: Inconsistent state trackingonAC
priortoDTLSEstablishment

Hi Pat,

-----Original Message-----
>To: "Scott G. Kelly" <[email-masked]>, Charles Clancy
<[email-masked]>, capwap <[email-masked]>
>We can expand this text to include the initiation of DTLS sessions.

Yes, the current text does preclude entering sulking state based on
discovery messages. That's good. However, the proposed text says

This implies that if dtls session setup is spoofed, any active (valid!)
sessions will be effectively disconnected, and (valid!) WTP recovery
attempts will be ignored. If the attacker re-does this attack each time
the SilentInterval (default: 30 seconds) expires, valid WTPs can be
prevented from reconnecting indefinitely. This is the unauthenticated
DoS I was referring to.

--Scott

---

From: <[email-masked]>
Date: Tue, 18 Dec 2007 19:11:19 -0600

Hi All,

I wanted to thank Pat and Scott for collaborating on Issue 30 so far.
As for this last nagging point, somehow I imagine protecting an AC from
flooding attacks sounds easier said than done.   Do the security experts
out there on the list have any proposals on this remaining glitch so we
can close Issue 30?

I know this is a busy time with the holidays, so any help is very
appreciated!

Dorothy

> From: ext Pat Calhoun (pacalhou) [mailto:[email-masked]] 
> Sent: Monday, December 17, 2007 3:02 PM
> To: Scott G. Kelly; Charles Clancy; capwap
> Subject: Re: [Capwap] Issue 30: Inconsistent 
> statetrackingonAC priortoDTLSEstablishment
> 
> I'm happy to change this by simply adding text that you feel 
> adequately protects the AC from a flooding attack.
> 
> Subject: Re: [Capwap] Issue 30: Inconsistent state 
> trackingonAC priortoDTLSEstablishment
> 
> Hi Pat,
> 
> Yes, the current text does preclude entering sulking state 
> based on discovery messages. That's good. However, the 
> proposed text says
> 
> This implies that if dtls session setup is spoofed, any 
> active (valid!) sessions will be effectively disconnected, 
> and (valid!) WTP recovery attempts will be ignored. If the 
> attacker re-does this attack each time the SilentInterval 
> (default: 30 seconds) expires, valid WTPs can be prevented 
> from reconnecting indefinitely. This is the unauthenticated 
> DoS I was referring to.
> 
> --Scott
> 
> 
>