Matching of plain request and DTLS response

[boaks]

private boolean isResponseRelatedToRequest(final Exchange exchange, final CorrelationContext responseContext) {
	if (exchange.getCorrelationContext() == null) {
		// no correlation information available for request, thus any
		// additional correlation information available in the response is ignored
		return true;
	}

Seems, that, if the request is sent in plain, its not checked, that the response is also plain.
May be this is not really important, but its also no big issue.
So, does anbody depend on that behavior?

[sophokles73]

The idea here was that the transport layer may indeed attach some context information in the response (even if the request was sent via UDP). However, in this case, we simply do not care.
Do you see any security issues here?

[boaks]

My understanding was:
If a channel (connector) supports such a CorrelationContext, it should be used to ensure the request and response are mapped proper. I have already started an idea of introducing a "context matching strategy" to provide more flexibility her, but though there are too many changes required, I'm very delayed with that approach.

The idea here was that the transport layer may indeed attach some context information in the response (even if the request was sent via UDP).

Any example?

Do you see any security issues here?

Depending on the "token" definition (unique per directed connection/unique per peer for outgoing), there may be missinterpretations. So someone using DTLS relays on its secure mapping but would wrongely be delivered to a unsecure request.

[sophokles73]

My understanding was:
If a channel (connector) supports such a CorrelationContext, it should be used to ensure the request and response are mapped proper.

I agree if we replace should with may :-)

Any example?

The transport layer might include information about the path MTU determined for the peer or whatever. The point is: not all information contained in the context is necessarily security related.

[boaks]

Hm, so should we check, if the request has no context, if the response context is "secure"?

[sophokles73]

If the request has no context then we only need to check whether the source of the response is the same as the destination of the request, right?