Re: [secdir] draft-ietf-tcpm-tcpsecure

["Anantha Ramaiah (ananth)" <[e-mail]>]

I figured out the reply to this email doidn't make it ( I was editing
the draft based on the feedback received)  

> -----Original Message-----
> From: Sandra Murphy [mailto:[e-mail]] 
> Sent: Monday, June 08, 2009 6:59 AM
> To: Anantha Ramaiah (ananth); Mitesh Dalal (mdalal)
> Cc: [e-mail]; [e-mail]
> Subject: draft-ietf-tcpm-tcpsecure
> 
> I've been on the road, so this is just a quick note to say 
> that I still have questions, with a promise of more full 
> answer when I get back to the office tomorrow.  All the 
> following done really from memory from a re-review yesterday. 
>  Just  so you know I haven't forgotten you.
> 
> About quoting text:
> 
> The example you point to of what each mitigation says is a good case. 
> (what is "rg"?)
> 
> You posit a case 1 and case 2.  This is a summary of what 793 
> says, not a quote.  793 spreads the discussion over 2 pages.  
> your case 1 is represented in a parenthetical remark in an 
> "otherwise" clause - hard to find.  And you have a typo in 
> the inequality.  And the case 2 in 793 is broken out over 
> three different groupings of states.  Do you mean the new ACK 
> to be generated in all three state groups?

Are you talking about RST/SYN mitigations ? If so the current text is
clear. The challenge ACK will be generated, pl note that the document
quotes the processing rules of the incoming segment and talks what mods
are suggested. 

> 
> About the stingency.
> 
> If UNA is 1000, Max.snd.wnd is 50, and the ack is 975, then 
> in 793, the ack is < UNA and so "it is ignored", in your 
> draft the ack is > UNA-max.snd.wnd so it is acceptable.

Ok, I have added more text to clarify this point. "Ignored"
 means the ACK value is ignored and the segment is processed as per the
other rules, hence ignored implies "accepted" and not dropped.

> 
> So your draft accepts more ACKs that 793.
> 
> Have I lost my ability to tell > from <?  Do you regard 
> accepting more ACKS as "more stringent"?

No, I think it is a mis-interpreation of ignored.

> 
> About the guidance to implementors.
> 
> It still looks to me like this guidance is only useful to 
> implementors who are implementing both the OS TCP stack *AND* 
> the application.  I.E., freebsd won't know whether this to 
> follow the guidance or not but cisco/juniper/etc will.

Not sure why such an inference is made.

> 
> What is the "AS"?
Applicability statement (but I couldn't find the AS reference in the
draft, it is spelled out in full)
? 

-Anantha
> 
> About grammar checks:
> 
> And you did not miss email, I lost my marked up copy, so I've 
>  gone through for the grammar check again (don't think I 
> found all that many
> nits) and will send to you.
> 
> --Sandy
> 
> 
>