Re: [dnssd] Genart last call review of draft-ietf-dnssd-push-20

[David Schinazi <[e-mail]>]

On Thu, Jul 4, 2019 at 9:52 AM Tom Pusateri <[e-mail]> wrote:

> On Jul 3, 2019, at 11:12 AM, Ted Lemon <[e-mail]> wrote:
>
> And thanks for the advice about how to terminate TLS connections—I had
> missed that nuance.  Are TLS implementations actually able to do this (to
> reject RST packets)?
>
>
> This was actually a comment from David Schinazi (and a good one). I’ve
> adjusted the working copy on github but there’s still one section I’m
> wrestling with regarding TCP RST.
>

On most operating systems today, TCP is in the kernel and TLS is in
user-space, so most implementations of TLS over TCP do not have the ability
to discard TCP RSTs that were injected by attackers. However, the TLS
close_notify alert allows endpoints to be able to tell the difference
between a connection that was closed gracefully by the peer and one that
was forcefully terminated (possibly by an attacker). So upon receipt of a
TCP RST without prior TLS close_notify, the connection will die, but the
application will know that the latest message could have been truncated
halfway through transmission and should therefore be discarded.

David