Subject: RE: [AAA-WG]: Issue 204: How to handle CER from unkwown peer

From: "Martin Julien (ECE)" <[email-masked]>
Date: Fri, 2 Nov 2001 12:31:30 +0100

I would tend to agree with the "silently discarding" discussion. 
It seems to be a better approach with regards to providing a 
basic system protection, especially if it is using a firewall 
to avoid such unwelcomed intruders.

Martin

> -----Original Message-----
> From: David Frascone [mailto:[email-masked]]
> Sent: Friday, November 02, 2001 7:23 AM
> To: [email-masked]
> Subject: Re: [AAA-WG]: Issue 204: How to handle CER from unkwown peer
> 
> 
> I was responding to the question about possible damages.
> 
> Sending a stripped down CEA is a better approach than the 
> current one in
> the draft (sending a full CEA)
> 
> Better yet is silently closing the connection.  (Just like 
> tcpwrappers does.
> Too bad it's not possible at the application layer to just 
> ignore a host,
> like you can with UDP)
> 
> 
> So, my vote is for closing the connection w/o a response.
> 
> 
> -Dave
> 
> On Thursday, 01 Nov 2001, Pat Calhoun wrote:
> > ah so I can buy Dave's point. So a stripped down CEA is 
> probably a better
> > approach then.
> > 
> > PatC
> > On Thu, Nov 01, 2001 at 10:49:14AM -0600, David Frascone wrote:
> > > 
> > > 
> > > On Tuesday, 30 Oct 2001, Pat Calhoun wrote:
> > > > On Tue, Oct 30, 2001 at 07:26:46AM -0600, David Frascone wrote:
> > > > > Also, the other avps should be optional.  A Diameter 
> server would not want
> > > > > to inform a malicious (unknown) host of it's version, 
> or of all the
> > > > > applications it supports.
> > > > 
> > > > and why? What is the damage caused by sending this information?
> > > > 
> > > 
> > > Well, if a malicious host knows that you are running 
> version 1.75b of 
> > > orginazation.com's Diameter server, which has a know 
> race-condition or 
> > > buffer overflow bug, then they know that they can exploit it.
> > > 
> > > It has become common for protocols to give as little 
> information as possible
> > > to connecting hosts.  Sendmail lines have gone from:
> > > 
> > > 220 johnson.mail.mindspring.net ESMTP Sendmail 
> 8.9.3/8.8.5; Thu, 1 Nov 2001 11:46:30 -0500 (EST)
> > > 
> > > . . . to . . .
> > > 
> > > 220 frascone.com ESMTP
> > > 
> > > 
> > >  . . . for security reasons.  The less information about 
> your system you give
> > > to a potentially malicious peer, the better.
> > > 
> > > Can you even remember the last time you were able to use 
> "finger" to look
> > > up someone's telephone number?
> > > 
> > > 
> > > Just my $.02 worth,
> > > 
> > > 
> > > Dave
> > > 
> > > 
> > > 
>

---

From: Pat Calhoun <[email-masked]>
Date: Sat, 3 Nov 2001 07:30:42 -0800

ok, seems like folks want the connection to be closed. Here is the text:

5.3  Capabilities Exchange

[...]

Receiving CERs from unknown peers are silently discarded, and the transport
connection is closed. 

PatC