Subject: Re: [tcpm] SYN's in draft-ietf-tcpm-tcpsecure.txt :-)

From: Sandy Murphy <[email-masked]>
Date: Thu, 20 May 2004 17:50:38 -0400 (EDT)

>    RCV.NXT < SEG.SEQ || RCV.NXT >= SEG.SEQ+SEG.LEN
>        Just send an ACK and drop the segment.  If we received a
>        legitimate SYN, the ACK will trigger a RST response.

In the "corner case" that's the current topic of conversation,
SEG.SEQ = RCV.NXT-1.  That means that SEG.SEQ+SEG.LEN = RCV.NXT.
Which means that the ACK would look to a SYN-SENT peer like an
acceptable ACK, but with the SYN not set, the segment would be
dropped and ignored.  Leading to new SYN's until timeout.

The adjustment of the ACK when SEG.SEQ = RCV.NXT-1 was intended to
eliminate the livelock until timeout, but only in the case
of implementations that support the SEG.SEQ = RCV.NXT-1 acceptability
test for RST.

From my reading of what's been said, of course.

--Sandy

_______________________________________________
tcpm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tcpm

---

From: Don Lewis <[email-masked]>
Date: Thu, 20 May 2004 15:09:07 -0700 (PDT)

> of implementations that support the SEG.SEQ = RCV.NXT-1 acceptability

Yeah, it looks like I've got an off by one problem in my proposal. Cases
2 and 3 should be:

    RCV.NXT <= SEG.SEQ || RCV.NXT > SEG.SEQ+SEG.LEN
        Just send an ACK and drop the segment.  If we received a
        legitimate SYN, the ACK will trigger a RST response.  If this
        was a spoofed SYN, our peer will accept the ACK and not respond.

    RCV.NXT == SEG.SEQ+1 && !ACK
        For simplicity, just drop the connection.  An ACK challenge
        could be done to guard against the unlikely case of an attacker
        guessing just the right sequence number to tear down the
        connection.

and the fifth case should be adjusted to match.  From the point of view
of the sender of the SYN, case 2 corresponds to (assuming only one
segment is sent):

   If the state is SYN-SENT then

      first check the ACK bit

        If the ACK bit is set

          If SEG.ACK =< ISS, or SEG.ACK > SND.NXT, send a reset (unless
          the RST bit is set, if so drop the segment and return)

---

From: Don Lewis <[email-masked]>
Date: Thu, 20 May 2004 15:49:05 -0700 (PDT)

> dropped and ignored.  Leading to new SYN's until timeout.

Hmn, that case won't be seen if segment processing is done in the order
specified by RFC 793.  The SYN flag will be trimmed off and SEG.SEQ will
be incremented before the first step (page 69) before the SYN flag is
examined in the fourth step (page 71).