Re: [Isms] secshell-pre14 - transport validation

[Dave Shield <D.T.Shield at liverpool.ac.uk>]

2009/1/23 Juergen Schoenwaelder <j.schoenwaelder at jacobs-university.de>:
> On Thu, Jan 22, 2009 at 03:42:22PM -0500, David Harrington wrote:
>
>> This is an updated draft for secshell.
>
> Can the WG members please review the changes?

I've spotted a few (related) issues in section 5.2:
      Procedures for sending an Outgoing Message.


1)  The ASI sendMessage includes two parameters
     'destTransportDomain' and 'destTransportAddress'.
    The tmStateReference cache entry includes two fields
    'tmTransportDomain' and 'tmTransportAddress'

    The expectation is clearly that these two pairs will have the
    same value.   What should be the behaviour if they do not?


2)  If the tmSameSecurity flag is set, then tmSessionID is
     used to look up the appropriate SSH session.

     What should be the behaviour if the remote end of this
     connection does not match the specified tmTransportAddress?


Clearly, in a well-behaved environment, neither of these should
occur.  Is it safe to assume that these situations are impossible,
or should the EoP include some form of validation?


  3)  Steps 1) and 2) check and extract tmTransportDomain,
       but the value is never used (neither here, nor in 5.3)

       What should be the behaviour if this value is not
       'snmpSSHDomain' ?


  4)  Step 1) checks for the existence of various fields in the
      tmStateReference cache, but this list does not include
      tmSessionID.

      What should be the behaviour if this entry is missing
      from the cache?
      Does it make a difference whether tmSameSession
      is set or not?


Dave