Subject: Re: [Tsvwg] SCTP: Association receiving malformed packet in established state

From: [email-masked]
Date: Thu, 14 May 2009 15:29:38 +0530 (IST)

Hi Randy,
 
     By mistake I have posted an ambiguious question in my previous mail. Please see the correction below.
 
By "wrong chunk fields", I meant that sctp host is able to -identify- the chunktype, but has wrong value in "chunk length" field.  RFC 4960 says the minimum possible value for chunk length field is 4(section 3.2). Considering an established association receives a packet with chunk length field containing 0. This is a "Protocol Violation". I wanted to know the  sctp behaviour in such cases.
 
1) Should this packet be considered as valid and responded with an ABORT and also delete the association or
2) Should this packet be considered as malicious packet and responded with an ABORT but not deleting the association.
 
In general what should be done for the association that receives a packet which causes "Protocol violation".
 
Thanks,
Gaurav

--- On Wed, 13/5/09, Randy Stewart <[email-masked]> wrote:

From: Randy Stewart <[email-masked]>
Subject: Re: [Tsvwg] SCTP: Association receiving malformed packet in established state
To: "kumar gaurav" <[email-masked]>
Cc: [email-masked]
Date: Wednesday, 13 May, 2009, 9:15 PM

Kumar:

Neither of your options are what is to be done.

What you must do is follow the bit values on the chunks in question. I.e the
chunk that has the "wrong chunk field" must be examined and
you follow the RFC's specification on this.

Looking at the chunk id as an 8 bit value
X Y - - - - - -

Gives you how to handle the chunk.

Just because your implementation does NOT support a new chunk
that you have never seen does NOT mean its a protocol violation.
The RFC is very specific on how to handle these bits. In fact
it is always tested at interops (and newbees generally have it wrong..
which is why we test it).

See section: 3.2 of the RFC..

R

On May 13, 2009, at 7:17 AM, kumar gaurav wrote:

> Hi All,
> 
>       Consider a scenario where an sctp host receives a malformed packet which has valid src port, dst port, src address, dst address and verification tag but has wrong chunk fields("protocol error"). In this case it is possible to identify the the association(which is in established state) to which it is destined for.
> 
> 1) Should this packet be considered as valid and responded with an ABORT and also delete the association or
> 2) Should this packet be considered as malicious packet and responded with an ABORT but not deleting the association.
> 
> I could not find anything directly relating to this scenario from RFC 4960. Any suggestions would be helpful.
> 
> Thanks and Regards,
> Gaurav
> 
> Cricket on your mind? Visit the ultimate cricket website. Enter now!

-----
Randall Stewart
[email-masked]

      Own a website.Get an unlimited package.Pay next to nothing.*Go to http://in.business.yahoo.com/