Skip to contentSkip to conversation

dccp: Do not send Dccp-Sync after received sequence-invalid

PATCH In review Wei Yongjun 3 participants 4 messages Aug 18, 2008 – Aug 19, 2008 Networking

lore
Share & tools
lore

Wei Yongjun

author
#0 lore raw

PATCH v2 1/1 dccp: Do not send Dccp-Sync after received sequence-invalid

RFC4340 said:

7.5.4. Handling Sequence-Invalid Packets

o A sequence-invalid DCCP-Reset packet MUST elicit a DCCP-Sync packet in response (subject to a possible rate limit). This response packet MUST use a new Sequence Number, and thus will increase GSS; GSR will not change, however, since the received packet was sequence-invalid. The response packet's Acknowledgement Number MUST equal GSR.

But reponse to a sequence-invalid DCCP-Reset with acknowledgement number equal to GSR will help to attack for sequence number. The attack method as the following:

Endpoint A Endpoint B

                                           (OPEN)
Dccp-Request      ---------------->
(SEQ=X)
                  <----------------        SYNC
                                           (SEQ=GSS+1, ACK=X)
Dccp-Reset        ---------------->
(SEQ=X+1, ACK=GSS+1)
                  <----------------        SYNC
                                           (SEQ=GSS+2, ACK=GSR)

X = invalid sequence number
GSS = sequence number of endpoint B
GSR = sequence number of endpoint A

After we received SYNC from endpoint B, we known the sequence number of both side.

The best way to avoid this is not send Dccp-Sync after received sequence-invalid Dccp-Reset.

Signed-off-by Wei Yongjun <[email protected]>
---
 net/dccp/input.c |    8 ++++++--
 1 files changed, 6 insertions(+), 2 deletions(-)
net/dccp/input.c +6 -2
index 71b24d4..fdb3c2c 100644
@@ -242,6 +242,12 @@ static int dccp_check_seqno(struct sock *sk, struct sk_buff *skb)
 		if (dh->dccph_type != DCCP_PKT_SYNC &&
 		    (ackno != DCCP_PKT_WITHOUT_ACK_SEQ))
 			dp->dccps_gar = ackno;
+	} else if (dh->dccph_type = DCCP_PKT_RESET) {
+		/*
+		 * Ignore sequence-invalid Dccp-Reset to avoid sequence numbers
+		 * attack.
+		 */
+		return -1;
 	} else {
 		unsigned long now = jiffies;
 		/*

@@ -273,8 +279,6 @@ static int dccp_check_seqno(struct sock *sk, struct sk_buff *skb)
 
 		dp->dccps_rate_last = now;
 
-		if (dh->dccph_type = DCCP_PKT_RESET)
-			seqno = dp->dccps_gsr;
 		dccp_send_sync(sk, seqno, DCCP_PKT_SYNC);
 		return -1;
 	}
Signature · 1 line
1.5.3.8
#1 lore raw

Re: [PATCHv2] dccp: Do not send Dccp-Sync after received

Quoted 24 lines

7.5.4. Handling Sequence-Invalid Packets

o A sequence-invalid DCCP-Reset packet MUST elicit a DCCP-Sync packet in response (subject to a possible rate limit). This response packet MUST use a new Sequence Number, and thus will increase GSS; GSR will not change, however, since the received packet was sequence-invalid. The response packet's Acknowledgement Number MUST equal GSR.

But reponse to a sequence-invalid DCCP-Reset with acknowledgement number equal to GSR will help to attack for sequence number. The attack method as the following:

Endpoint A Endpoint B

                                          (OPEN)
Dccp-Request      ---------------->
(SEQ=X)
                 <----------------        SYNC
                                          (SEQ=GSS+1, ACK=X)
Dccp-Reset        ---------------->
(SEQ=X+1, ACK=GSS+1)
                 <----------------        SYNC
                                          (SEQ=GSS+2, ACK=GSR)
Quoted 4 lines

X = invalid sequence number
GSS = sequence number of endpoint B
GSR = sequence number of endpoint A

The requiremement of using GSR here is related to fixing another bug which leads to a flood of Sync/Reset packets. A description of that bug is on
http://www.mail-archive.com/[email protected]/msg01594.html

#2 lore raw
In reply to Wei Yongjun
Quoted 9 lines · Gerrit Renker
Quoted 9 lines

7.5.4. Handling Sequence-Invalid Packets

o A sequence-invalid DCCP-Reset packet MUST elicit a DCCP-Sync packet in response (subject to a possible rate limit). This response packet MUST use a new Sequence Number, and thus will increase GSS; GSR will not change, however, since the received packet was sequence-invalid. The response packet's Acknowledgement Number MUST equal GSR.

Quoted 6 lines
Quoted 2 lines

But reponse to a sequence-invalid DCCP-Reset with acknowledgement number equal to GSR will help to attack for sequence number. ...

The requiremement of using GSR here is related to fixing another bug which leads to a flood of Sync/Reset packets. A description of that bug is on
http://www.mail-archive.com/[email protected]/msg01594.html

Furthermore, Yongjun, I don't see how this is an "attack." DCCP is not robust against an attacker who can receive packets in the relevant connection, such as the two DCCP-Syncs in your example. Your attack is out of the threat model.

Eddie

author
#3 lore raw
In reply to Wei Yongjun
Quoted 18 lines · Eddie Kohler
Quoted 9 lines · Gerrit Renker
Quoted 9 lines

7.5.4. Handling Sequence-Invalid Packets

o A sequence-invalid DCCP-Reset packet MUST elicit a DCCP-Sync packet in response (subject to a possible rate limit). This response packet MUST use a new Sequence Number, and thus will increase GSS; GSR will not change, however, since the received packet was sequence-invalid. The response packet's Acknowledgement Number MUST equal GSR.

Quoted 7 lines
Quoted 2 lines

But reponse to a sequence-invalid DCCP-Reset with acknowledgement number equal to GSR will help to attack for sequence number. ...

The requiremement of using GSR here is related to fixing another bug which
leads to a flood of Sync/Reset packets. A description of that bug is on
http://www.mail-archive.com/[email protected]/msg01594.html

Quoted 5 lines

Furthermore, Yongjun, I don't see how this is an "attack." DCCP is not robust against an attacker who can receive packets in the relevant connection, such as the two DCCP-Syncs in your example. Your attack is out of the threat model.

I misunderstood the sequence number attack.^_^

Thanks

Wei Yongjun