Subject: [rddp] MPA security issues - minutes from last IETF

From: "Jim Pinkerton" <[email-masked]>
Date: Thu, 22 Jan 2004 19:04:33 -0800

>From David's minutes from the last IETF meeting, he states:

--> Action Item: The "dual stack" architecture that came up in the MPA

draft discussion has security implications, as the point of "stack
switch"

is an obvious place for an attacker to try something (e.g., louse up the
stack switch so that the connection has to be abandoned).  MPA draft
authors to look into this and post results of this investigation to
list.

Can the MPA authors comment on where we are at in terms of this action
item?

Jim

---

From: Caitlin Bestler <[email-masked]>
Date: Thu, 22 Jan 2004 21:23:37 -0600

On Jan 22, 2004, at 9:04 PM, Jim Pinkerton wrote:

>  
>
> From David’s minutes from the last IETF meeting, he states:
>
>  
>
> authors
> to look into this and post results of this investigation to list.
>
>  
>

Sending a partial MPA Request or Reply Frame can result in holding
a TCP connection open during a portion of connection establishment
that is not typically visible to the application.

APIs, such as DAT and IT-API, that attempt to make connection 
establishment
transport neutral should be aware that the iWarp "Communication Manager"
needs to protect itself against this type of attack.

But otherwise I don't see a vulnerability. You either exchange MPA
Start Frames properly, and enable an iWarp connection, or you fail
to do so and the TCP connection is terminated. The only vulnerability
is that TCP resources may be tied up if whatever component is handling
the MPA Start Frame exchange fails to diagnose failures promptly.

But that is true of *any* TCP application.

-- 
Caitlin Bestler - [email-masked] - http://asomi.com/

_______________________________________________
rddp mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rddp