Subject: udp source address change

From: "mharrima101 (sent by Nabble.com)" <[email-masked]>
Date: Tue, 7 Feb 2006 10:20:37 -0800 (PST)

Please excuse if this post is not in the correct place - I wasn't sure where to put a question such as this.

We are using an HP ProCurve switch in our network as a router ( it’s a layer 3 switch ).  We are communicating with all devices on the far side of the router (HP switch) with SNMP – including the far side management interface of the HP switch.  When the switch responds to the SNMP query it uses the near side IP address as the source address in the UDP header – rather than the far side IP address that the query was addressed to.  Since this is not the IP that we are intending to talk to, our security policy does not allow us to accept the message.  

Is the behavior of the HP switch legal under UPD?   It seems to me as though this should not be allowed.
--
View this message in context: http://www.nabble.com/udp-source-address-change-t1077843.html#a2806738
Sent from the IETF - IETF forum at Nabble.com.
_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Wes Hardaker <[email-masked]>
Date: Fri, 10 Feb 2006 06:51:48 -0800

>>>>> On Tue, 7 Feb 2006 10:20:37 -0800 (PST), "mharrima101 (sent by Nabble.com)" <[email-masked]> said:

mharrima> Is the behavior of the HP switch legal under UPD?   It seems
mharrima> to me as though this should not be allowed.

Protocols and implementations should generally respond using the
address to which the request packet was sent.  That being said, there
are sometimes protocol reasons not to do this and sometimes
implementations don't necessarily handle things properly internally.
But, I doubt most protocols ever specify the "legality" of what
address is used to respond to a request.

Thus, what should happen is what you want.  In reality, as you
noticed, some implementations fail to do this.

-- 
Wes Hardaker
Sparta, Inc.

---

From: Masataka Ohta <[email-masked]>
Date: Sat, 11 Feb 2006 10:13:53 +0900

> address is used to respond to a request.

RFC1035 says it a bug. So, it should be illegal.

   - Some name servers send their responses from different
     addresses than the one used to receive the query.  That is, a
     resolver cannot rely that a response will come from the same
     address which it sent the corresponding query to.  This name
     server bug is typically encountered in UNIX systems.

However, the "bug" is overcome by ID field provided in DNS.

SNMP is seemingly doing the same thing with request ID.

						Masataka Ohta

---

From: Wes Hardaker <[email-masked]>
Date: Sat, 11 Feb 2006 21:26:43 -0800

>>>>> On Sat, 11 Feb 2006 10:13:53 +0900, Masataka Ohta <[email-masked]> said:

>> address is used to respond to a request.

Masataka> RFC1035 says it a bug. So, it should be illegal.

It does say it's a bug but doesn't exactly say "illegal".  And 1035
only applies to DNS.  There is no general statement about UDP
(unfortunately).

-- 
"In the bathtub of history the truth is harder to hold than the soap,
 and much more difficult to find."  -- Terry Pratchett

---

From: Masataka Ohta <[email-masked]>
Date: Sun, 12 Feb 2006 20:29:46 +0900

> only applies to DNS.  There is no general statement about UDP

Unfortunately for you, the statement in RFC1035 is general about UDP.

It is a bug because it is considered to be illegal not by DNS
but by UDP.

							Masataka Ohta

---

From: Joe Touch <[email-masked]>
Date: Tue, 14 Feb 2006 08:39:28 -0800

mharrima101 (sent by Nabble.com) wrote:
> We are using an HP ProCurve switch in our network as a router ( it’s a
> layer 3 switch ).  We are communicating with all devices on the far side
> of the router (HP switch) with SNMP – including the far side management
> interface of the HP switch.  When the switch responds to the SNMP query
> it uses the near side IP address as the source address in the UDP header
> – rather than the far side IP address that the query was addressed to.
>  Since this is not the IP that we are intending to talk to, our security
> policy does not allow us to accept the message.  
> 

UDP is connectionless.

From a UDP point of view, it is legal for the HP switch to send a UDP
packet with any IP address from one of its own network interfaces (as
per RFC1122, since it is acting as a host when it sources or sinks traffic).

This may or may not be the case from SNMP's point of view, however, just
as Sec 7.3 of RFC1035 points out a similar DNS "name server bug" (quoted
from the RFC, as others have raised as related).

I.e., this is probably an SNMP bug, possibly an SNMP protocol violation,
but not a UDP issue. (hint: if you have to look at the UDP payload to
decide if it's valid, it's not a UDP issue).

Joe

---

From: Mark Andrews <[email-masked]>
Date: Wed, 15 Feb 2006 09:21:57 +1100

> This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
> --===============1336328525==
> Content-Type: multipart/signed; micalg=pgp-sha1;
> 	protocol="application/pgp-signature";
> 	boundary="------------enigCADC6924BAD7521CFFC2A32E"
> 
> This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
> --------------enigCADC6924BAD7521CFFC2A32E
> Content-Type: text/plain; charset=UTF-8
> Content-Transfer-Encoding: quoted-printable
> 
> 
> 
> >=20
> > We are using an HP ProCurve switch in our network as a router ( it=E2=80=
> =99s a
> > layer 3 switch ).  We are communicating with all devices on the far sid=
> e
> > of the router (HP switch) with SNMP =E2=80=93 including the far side ma=
> nagement
> > interface of the HP switch.  When the switch responds to the SNMP query=
> 
> > it uses the near side IP address as the source address in the UDP heade=
> r
> > =E2=80=93 rather than the far side IP address that the query was addres=
> sed to.
> >  Since this is not the IP that we are intending to talk to, our securit=
> y
> > policy does not allow us to accept the message. =20
> >=20
> =46rom a UDP point of view, it is legal for the HP switch to send a UDP
> per RFC1122, since it is acting as a host when it sources or sinks traffi=
> c).
> 

	Well while not illegal it is expected that response should come
	from the address the request was sent to.  SNMP is a request /
	response application and unless otherwise specified the response
	should be coming from the address the request was being sent to.
	
	I would say the switch in question was broken.

	Mark

         4.1.3.5  UDP Multihoming

            When a UDP datagram is received, its specific-destination
            address MUST be passed up to the application layer.

            An application program MUST be able to specify the IP source
            address to be used for sending a UDP datagram or to leave it
            unspecified (in which case the networking software will
            choose an appropriate source address).  There SHOULD be a
            way to communicate the chosen source address up to the
            application layer (e.g, so that the application can later
            receive a reply datagram only from the corresponding
            interface).

            DISCUSSION:
                 A request/response application that uses UDP should use
                 a source address for the response that is the same as
                 the specific destination address of the request.  See
                 the "General Issues" section of [INTRO:1].

> --------------enigCADC6924BAD7521CFFC2A32E
> Content-Type: application/pgp-signature; name="signature.asc"
> Content-Description: OpenPGP digital signature
> Content-Disposition: attachment; filename="signature.asc"
> 
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.1 (MingW32)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
> 
> iD8DBQFD8gfAE5f5cImnZrsRAl+rAKCOXUa+35mb83cerEIiU185RGpOZwCgpB6G
> Z3Tc4vp4KFQj4P+5CBctu0M=
> =YC4M
> -----END PGP SIGNATURE-----
> 
> --------------enigCADC6924BAD7521CFFC2A32E--
> 
> 
> --===============1336328525==
> Content-Type: text/plain; charset="us-ascii"
> MIME-Version: 1.0
> Content-Transfer-Encoding: 7bit
> Content-Disposition: inline
> 
> --===============1336328525==--
> 
--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]