Subject: verification tag handling for ootb packets

From: Dirk Tepelmann <[email-masked]>
Date: Tue, 09 Dec 2008 17:19:40 +0100

Hello,

I have a question about the handling of the verification tag handling in 
the following situation:
No association is established. INIT ACK is sent with verification tag A 
and initiate tag B.
Based on RFC4960 chapter 8.4 8):

The receiver should respond to the sender of the OOTB packet with
       an ABORT.  When sending the ABORT, the receiver of the OOTB
       packet MUST fill in the Verification Tag field of the outbound
       packet with the value found in the Verification Tag field of the
       OOTB packet and set the T bit in the Chunk Flags to indicate that
       the Verification Tag is reflected.  After sending this ABORT, the
       receiver of the OOTB packet shall discard the OOTB packet and
       take no further action.

the verification tag in the ABORT is the verification tag of the INIT ACK.

However having mind RFC4960 chapter 8.5.1 B):

The endpoint MUST always fill in the Verification Tag field of
       the outbound packet with the destination endpoint's tag value, if
       it is known.

the initiate tag should be used.

I'm getting confused with this two statements and want to catch your 
opinion. What should be the verification tag of the ABORT message, the 
verification or the initiate tag of the INIT ACK?

Best regards,
Dirk

-- 
---------------------------------------------------------------------------
Dirk Tepelmann

Testing Technologies IST GmbH
Michaelkirchstraße 17/18
10179 Berlin, Germany

Phone     +49 30 726 19 19 19		Email     [email-masked]
Fax       +49 30 726 19 19 20		Internet  www.testingtech.de
---------------------------------------------------------------------------
Geschäftsführung: Theofanis Vassiliou-Gioles, Stephan Pietsch
Handelsregister HRB 77805 B, Amtsgericht Charlottenburg
Ust ID Nr.: DE 813 143 070

This e-mail may contain confidential and privileged material for the
sole use of the intended recipient. Any review, use, distribution or
disclosure by others is strictly prohibited. If you are not the intended
recipient (or authorized to receive for the recipient), please contact
the sender by reply e-mail and delete all copies of this message.

---

From: Michael Tuexen <[email-masked]>
Date: Tue, 9 Dec 2008 17:50:18 +0100

Hi Dirk,

if you get
INIT-ACK(v-tag=A, initiate_tag=B)
and it is OOTB I would send back an
ABORT(t-tag=B, T-Bit=0).

Best regards
Michael
On Dec 9, 2008, at 5:19 PM, Dirk Tepelmann wrote:

> Hello,
>
> I have a question about the handling of the verification tag  
> handling in the following situation:
> No association is established. INIT ACK is sent with verification  
> tag A and initiate tag B.
> opinion. What should be the verification tag of the ABORT message,  
> the verification or the initiate tag of the INIT ACK?
>
> Best regards,
> Dirk
>
> --

---

From: Vlad Yasevich <[email-masked]>
Date: Tue, 09 Dec 2008 11:55:58 -0500

>       the outbound packet with the destination endpoint's tag value, if

You didn't read far enough.  The second item is:
  -   If the ABORT is sent in response to an OOTB packet, the endpoint
       MUST follow the procedure described in Section 8.4.

Thus, the text from 8.4 applies and the verification tag is reflected.

-vlad

---

From: Dirk Tepelmann <[email-masked]>
Date: Tue, 09 Dec 2008 18:09:08 +0100

Hi Vlad, hi Michael,

On the one side the opinion is that it has to be reflected and the 
verification tag is the same:
3.3.7:

If the Verification Tag is reflected, the T
      bit MUST be set to 1.  Reflecting means that the sent Verification
      Tag is the same as the received one.

On the other side:
"if you get
INIT-ACK(v-tag=A, initiate_tag=B)
and it is OOTB I would send back an
ABORT(t-tag=B, T-Bit=0)."

That's exactly the confusion I was running in reading the RFC.

So can we clarify here?

Best regards,
Dirk

---

From: Vlad Yasevich <[email-masked]>
Date: Tue, 09 Dec 2008 12:27:18 -0500

> and it is OOTB I would send back an

Looking at some older BSD code, it looks like it would set the T-Bit.
sctp_is_there_an_abort_here() only fills in the vtag for an INIT chunk.

-vlad

>> I have a question about the handling of the verification tag handling
>> in the following situation:
>> No association is established. INIT ACK is sent with verification tag
>> A and initiate tag B.

---

From: Michael Tuexen <[email-masked]>
Date: Tue, 9 Dec 2008 21:21:52 +0100

Hi Vlad,

I have not looked at the code, but I think one should
try to send an ABORT without the T-bit set when possible.

Best regards
Michael

On Dec 9, 2008, at 6:27 PM, Vlad Yasevich wrote:

>>> tag
>>> the verification tag in the ABORT is the verification tag of the  
>>> INIT
>>> ACK.
>>>
>>> the

---

From: Michael Tuexen <[email-masked]>
Date: Tue, 9 Dec 2008 21:20:43 +0100

Hi Dirk,

you might want to post the message on [email-masked]. Based on the
outcome we might add an errata to RFC 4960.

Best regards
Michael

On Dec 9, 2008, at 6:09 PM, Dirk Tepelmann wrote:

>>> tag A
>>> INIT ACK.

---

From: Michael Tuexen <[email-masked]>
Date: Tue, 9 Dec 2008 21:37:43 +0100

Hi Vlad,

I would send the packet as stated but would accept
it with
ABORT(v-tag=B, T-bit=0)
or
ABORT(v-tag=A, T-bit=1)

However, I'm not sure what accepting would mean since
the sender of the INIT-ACK normally has not state...

I think the best is to bring this up on [email-masked]

We only added text for the INIT, not the INIT-ACK...
Maybe we missed that.

Best regards
Michael

---

From: Vlad Yasevich <[email-masked]>
Date: Tue, 09 Dec 2008 15:55:18 -0500

> We only added text for the INIT, not the INIT-ACK...

I don't see what would be gained by using the initiate TAG
from the INIT-ACK.  It makes sense in the INIT case since INIT
has no verification tag set.

It makes perfect sense to reflect the verification TAG since
TCB doesn't exist and we don't really "know" the peer's tag.
To know it, we would have to try to parse the INIT-ACK chunk,
which IMO is a waste of time since it's OOTB.

I'd say leave it as is since I think 8.5.1 makes is clear:

8.5.1.  Exceptions in Verification Tag Rules

   A) Rules for packet carrying INIT:

   -   The sender MUST set the Verification Tag of the packet to 0.

   -   When an endpoint receives an SCTP packet with the Verification
       Tag set to 0, it should verify that the packet contains only an
       INIT chunk.  Otherwise, the receiver MUST silently discard the
       packet.

   B) Rules for packet carrying ABORT:

   -   The endpoint MUST always fill in the Verification Tag field of
       the outbound packet with the destination endpoint's tag value, if
       it is known.

The second paragraph from point B refers to what should be done when sending
ABORT in response to OOTB.

Still not sure what really so confusing.

-vlad

---

From: "Brian F. G. Bidulock" <[email-masked]>
Date: Tue, 9 Dec 2008 14:13:18 -0700

Vlad,

I think that this case is clearly handled by section 8.4 (8),
(the INIT-ACK is clearly an OOTB packet and section 8.4 is
clearly referenced as applicable to INIT-ACKs).  Therefore,
Section 8.4 (8) applies, and states that (when the implementation
sends and ABORT--which it SHOULD) the v-tag from the INIT-ACK
message must be used and the T bit must be set.

There is no need to dig the initiate tag out and in fact doing
so might introduce a vulnerability.

The proper response is therefore an ABORT with the T-bit set
and the v-tag from the INIT-ACK.

--brian

-- 
Brian F. G. Bidulock    ¦ The reasonable man adapts himself to the ¦
[email-masked]    ¦ world; the unreasonable one persists in  ¦
http://www.openss7.org/ ¦ trying  to adapt the  world  to himself. ¦
                        ¦ Therefore  all  progress  depends on the ¦
                        ¦ unreasonable man. -- George Bernard Shaw ¦

---

From: Vlad Yasevich <[email-masked]>
Date: Tue, 09 Dec 2008 16:22:48 -0500

> and the v-tag from the INIT-ACK.

I agree with you.

-vlad

---

From: "Brian F. G. Bidulock" <[email-masked]>
Date: Tue, 9 Dec 2008 14:28:20 -0700

Vlad,

I checked my implementation and I don't even send ABORTs in
response to OOTB INIT-ACK.  This reason being is that the
INIT-ACK is only properly sent in response to an INIT that
I sent.  The peer does not have a TCB and can do nothing
with the ABORT anyway.  If it is simply malformed, I have
a T1-init timer running and will reattempt another INIT
later.  If I send an ABORT, it just opens the door for an
attacker to get me to send ABORTs to spoofed IP addresses.

Note that 8.4 (8) is a SHOULD on sending the ABORT.  For an
INIT-ACK, there is a very good reason not to send one and
I don't.  (But if I did, it would have the T-bit set).

--brian

---

From: "Brian F. G. Bidulock" <[email-masked]>
Date: Tue, 9 Dec 2008 14:58:17 -0700

Vlad,

More justification for not sending ABORT in response to
OOTB INIT-ACK:

The only non-malicious scenario for an OOTB INIT-ACK that
I can think of is as follows:

Host A sends INIT in response to a user requesting an
association to be formed to Host B.  A TCB is created
at Host A before the INIT is sent.

Some time passes without receiving an INIT-ACK.  The user
abandons the association (closes the socket) and the TCB
is destroyed.

The INIT-ACK arrives and as there is no TCB, it is OOTB.

It should just be discarded.  If an ABORT is sent with or
without the T-bit set, Host B cannot use it: it has no
TCB.  The information for setting up a TCB was in the cookie
of the INIT-ACK.  Therefore, if an ABORT is sent with or
without the T-bit set, Host B will simply discard it.

So, sending ABORT in response with T-bit set to a spoofed
IP address is ok because Host A has already verified that
there is no TCB to host B for the v-tag in the ABORT.
However, if the initiate tag is used, the initate tag
might correspond to an existing association between Host A
and Host B, so sending ABORT with no T-bit and the initiate
tag creates a vulnerability.

If a change to the spec is to be made, it should be to say
to discard OOTB INIT-ACKs and not respond with an ABORT at
all.

--brian

---

From: Michael Tuexen <[email-masked]>
Date: Tue, 9 Dec 2008 23:30:02 +0100

Hi Vlad,

OK, I can live with it... So it is
ABORT(v-tag=A, T-bit=1)

Best regards
Michael

---

From: Michael Tuexen <[email-masked]>
Date: Tue, 9 Dec 2008 23:33:35 +0100

Hi Brian,

I agree...

Best regards
Michael