Subject: RE: [nfsv4] Issue 28 denial of service in NFSv4.x state management

From: "Noveck, Dave" <[email-masked]>
Date: Fri, 9 Jun 2006 09:52:49 -0400

I'm not so worried about the lack of issue cross-referencing, at 
least at this stage.  Right now there are a small enough set of
important issues that we can keep track of the important inter-
connections by hand.  If we had a lot more active issues, this
would be more of a problem.

One suggestion about co-ordinated changes of this nature is that
one of you might take the other's text and make that the basis
of a co-ordinated set of changes to the XML (I'm assuming that
we will soon have the XML available) and get those in shape so
that we have eliminated inter-section inconsistencies on these
issues and then pass those changes to Spencer as a unit, with
the undesrtanding that he will propagate them into a subsequent
spec draft as a unit.

-----Original Message-----
From: Talpey, Thomas 
Sent: Friday, June 09, 2006 8:53 AM
To: [email-masked]
Subject: Re: [nfsv4] Issue 28 denial of service in NFSv4.x state
management

We need to do this, in order to complete the security model for a session.
The original Sessions protocol (2003-2004) had a "BIND_CHANNEL" operation
which was removed due to problematic linkage of transport connections
with server operation context. The current version simply includes the
sessionid in each SEQUENCE.

Your proposal cryptographically closes the hole which might allow an
eavesdropper to attack a session. The existing proposal relies on prior
authentication, which can lead to requiring machine creds to implement.
We don't want that, therefore your proposal is good.

Accepting these new ops will change some discussion in the sessions
text around session establishment and reconnection. I don't see a way
to cross-reference issues in the tracker, so I'll add text I guess.
Definitely issues 27 and 30 will be affected.

Tom.

At 02:46 PM 6/8/2006, Mike Eisler wrote:
>email thread starts at:
>
>http://www1.ietf.org/mail-archive/web/nfsv4/current/msg02910.html
>
>My proposed edits are here:
>
>http://www.nfsv4-editor.org/cgi-bin/roundup/nfsv4/file9/sessions-dos-changes.txt
>
>In summary two new ops are added: BIND_CONN_TO_SESSION and
>SET_SSV. The former binds a connection to a session. The
>latter establishes a shared secret key between the client and
>server for the purpose of authenticating BIND_CONN_TO_SESSION
>operations.
>
>
>
>
>_______________________________________________
>nfsv4 mailing list
>[email-masked]
>https://www1.ietf.org/mailman/listinfo/nfsv4

_______________________________________________
nfsv4 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nfsv4

_______________________________________________
nfsv4 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nfsv4