Re: [dnssd] Genart last call review of draft-ietf-dnssd-push-20

["Christopher Wood" <[e-mail]>]

On Fri, Jul 5, 2019, at 5:45 PM, David Schinazi wrote:
> 
> On Thu, Jul 4, 2019 at 9:52 AM Tom Pusateri <[e-mail]> wrote:
> >> On Jul 3, 2019, at 11:12 AM, Ted Lemon <[e-mail]> wrote:
> >> And thanks for the advice about how to terminate TLS connections—I had missed that nuance. Are TLS implementations actually able to do this (to reject RST packets)?
> > 
> > This was actually a comment from David Schinazi (and a good one). I’ve adjusted the working copy on github but there’s still one section I’m wrestling with regarding TCP RST.
> 
> On most operating systems today, TCP is in the kernel and TLS is in 
> user-space, so most implementations of TLS over TCP do not have the 
> ability to discard TCP RSTs that were injected by attackers. However, 
> the TLS close_notify alert allows endpoints to be able to tell the 
> difference between a connection that was closed gracefully by the peer 
> and one that was forcefully terminated (possibly by an attacker). So 
> upon receipt of a TCP RST without prior TLS close_notify, the 
> connection will die, but the application will know that the latest 
> message could have been truncated halfway through transmission and 
> should therefore be discarded.

+1 (though some applications might choose to use the partial message)