Subject: [MBONED] Minor change to ssmping protocol

From: Stig Venaas <[email-masked]>
Date: Fri, 28 Nov 2008 10:29:20 +0100

I've realised that one minor change should be made to the
protocol. SessionID is used as a return routability check
to prevent spoofing of the client address (or at least to
require that an attacker is on the unicast path from the
server to the spoofed unicast address). Currently the
SessionID is not only given to the client in a Server
Response message (which is unicast), but also sent back in
unicast and multicast Echo Replies.

Sending the SessionID in multicast Replies means that the
security benefit of the SessionID is greatly reduced. In
order to keep with the current design where unicast and
multicast Replies are mostly identical, I want to change
the protocol to not include SessionID in any Echo Replies.

This is really a minor change. Simple clients that don't
use SessionID can still simply echo back what they get in
the Echo Request. The main change is that if say a server
restarts and receive Echo Requests with an old (unknown)
SessionID, it cannot just send back a Reply with a new ID.

With just this change, a server would then (unless it is
willing to use the SessionID it got from the client) send
a Server Response telling the client to stop pinging. The
client can then if desired, go through the Init - Response
process to obtain a new SessionID.

Apart from the security benefit, I also think it simplifies
the protocol and implementations a bit. Being too flexible
is not necessarily good...

Hopefully you agree this change is an improvement. I plan
to submit a new (and hopefully final) revision in a few
days where I will do this change. Please speak up now if
you disagree in any way with what I wrote above.

Stig
_______________________________________________
MBONED mailingFrom [email-masked]  Fri Nov 28 01:29:27 2008
Date: Fri, 28 Nov 2008 10:29:20 +0100
From: Stig Venaas <[email-masked]>
To: "[email-masked]" <[email-masked]>
Subject: [MBONED] Minor change to ssmping protocol
Sender: [email-masked]

I've realised that one minor change should be made to the
protocol. SessionID is used as a return routability check
to prevent spoofing of the client address (or at least to
require that an attacker is on the unicast path from the
server to the spoofed unicast address). Currently the
SessionID is not only given to the client in a Server
Response message (which is unicast), but also sent back in
unicast and multicast Echo Replies.

Sending the SessionID in multicast Replies means that the
security benefit of the SessionID is greatly reduced. In
order to keep with the current design where unicast and
multicast Replies are mostly identical, I want to change
the protocol to not include SessionID in any Echo Replies.

This is really a minor change. Simple clients that don't
use SessionID can still simply echo back what they get in
the Echo Request. The main change is that if say a server
restarts and receive Echo Requests with an old (unknown)
SessionID, it cannot just send back a Reply with a new ID.

With just this change, a server would then (unless it is
willing to use the SessionID it got from the client) send
a Server Response telling the client to stop pinging. The
client can then if desired, go through the Init - Response
process to obtain a new SessionID.

Apart from the security benefit, I also think it simplifies
the protocol and implementations a bit. Being too flexible
is not necessarily good...

Hopefully you agree this change is an improvement. I plan
to submit a new (and hopefully final) revision in a few
days where I will do this change. Please speak up now if
you disagree in any way with what I wrote above.

Stig
_______________________________________________
MBONED maili list
[email-masked]
https://www.ietf.org/mailman/listinfo/mboned

ng list
[email-masked]
https://www.ietf.org/mailman/listinfo/mboned