Subject: Query regarding SCTP DATA packets with invalid SSN value

From: Padmalochan Moharana <[email-masked]>
Date: Tue, 21 Dec 2010 13:28:49 +0530

Hi,

What will be the behavior of an SCTP end point on receive SCTP packets
with valid TSN but invalid SSN in case of order delivery ? Suppose
the ssn value of a sctp packet is corrupted  by a hacker then in case
of order delivery request should data packet hold by the end point and
block that stream until it receive packets with proper order?

Br,
Padmalochan

---

From: Randy Stewart <[email-masked]>
Date: Tue, 21 Dec 2010 03:40:18 -0800

Padmalochan:

Well I guess this becomes an implementation decision. Many of the
SCTP implementations will pay attention to the stream and TSN
(and the B/E/M bits too) to figure out if the peer is "broken".

If you receive

----TSN1 SSN 2 STRM=1----->
----TSN2 SSN 55555 STRM=1->
----TSN3 SSN 4 STRM=1----->

Some implementations may detect this as an error and abort
the association. 

That all being said, not all the cases are checked. I doubt that
the BSD implementation (I know it fairly well) checks this.. It checks
a lot of things but I don't think it checks the above...

Now, the question of a blind attacker being able to corrupt this
is somewhat dubious in my mind... since they have to be very very
lucky and guess the V-tag... one in 2Billion chance.

If they can see the wire packets, then thats a whole other issue. One
can always use the AUTH extension in this case (but that will be
CPU intensive if you do it for data)...

Best wishes

R

> block that stream until it receive packets with proper order?

-----
Randall Stewart
[email-masked]