Subject: [tcpm] tcpsecure: request clarification on data injection solution

From: "Charlet, Ricky" <[email-masked]>
Date: Wed, 19 May 2004 16:54:56 -0700

Howdy,

	I'm attempting to implement draft-ietf-tcpm-tcpsecure-00.txt. I
would appreciate a better description of how each (RST, SYN,
data-injection) work in practice. The RST and SYN, I think I have pretty
much figured out. But the data-injection solution is beyond my capacity
to grok.

	The draft says:
----------------cut-----------------
4.2  Solution

   An additional input check should be added to any incoming segment.
   The ACK value should be acceptable only if it is in the range of
   ((SND.UNA - MAX.SND.WND) <= SEG.ACK < SND.NXT). 
---------------paste------------------

	How can we subtract a number of bytes from a sequence number and
compare that to other expected sequence numbers? I assume it does work
out, but I don't see why it does. And I deeply suspect that I would mess
up the zero-wrap-around math sicne I don't really see why this
'solution' works.

	Also

" This window is the scaled value i.e. the value may be larger than
65,535 bytes."

Can someone shed more light on what you mean by 'scaled value' (as
opposed to what other alternative)?

Thanks in advance.

---
Ricky Charlet
[email-masked]
USA 831.466.4968 

0  ASCII Ribbon campaign - against HTML Email
^        - against auto-execute attachments

---
Ricky Charlet
[email-masked]
USA 831.466.4968

-----------------------------------------------------------
Unless otherwise expressly stated, this message does not
create or vary any contractual relationship between you and 
ARC International.  The contents of this e-mail may be 
confidential and if you have received it in error, please 
delete it from your system, destroy any hard copies and 
telephone the above number.  Incoming emails to ARC may be 
subject to monitoring other than by the addressee.

_______________________________________________
tcpm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tcpm

---

From: "Randall Stewart (cisco)" <[email-masked]>
Date: Thu, 20 May 2004 11:50:32 -0400

>---------------paste------------------

Well for FreeBSD the fix I did simply does the following:
***************************************
    if(tlen &&
       (thflags & TH_ACK) &&
       (SEQ_LT(th->th_ack,(tp->snd_una - tp->max_sndwnd)))) {
        goto drop;
    }
***************************************

max_sndwnd is a variable FreeBSD was already maintaining. We
subtract snd_una - max_sndwnd... since it is all unsigned that
places it somewhere behind SND_UNA by the largest window.

We check to see if th_ack (what came in the segment) is behind
this value with the SEQ_LT macro. If so we goto the fixed point
that is in the BSD code to drop the segment... Pretty simple
fix and it just takes advantage of the standard macros that are
there (I would imagine most tcp stacks have this type of macro's
laying around since they all have to deal with unsigned 32 bit arith....

Hope that helps..

R

-- 
Randall R. Stewart
ITD - Transport Technologies
815-477-2127(o) or 815-342-5222(c)