Re: [Spud] States in draft-trammell-plus-statefulness-00

[Brian Trammell <[e-mail]>]

hi Dave,

Thanks for the feedback! Responses inline...

> On 11 Nov 2016, at 19:55, Dave Dolson <[e-mail]> wrote:
> 
> Mirja, Brian, Joe,
> 
> I think it is an interesting idea to formalize/standardize the state machine that should be used by flow-stateful network equipment.
> 
> But having read about the four states and three timeouts, I feel you are missing a state after biflow that represents a fully proven connection.
> 
> I’m thinking of the problem of source-spoofed SYN attack packets that attempt to consume state memory in servers and flow-stateful network devices.
> A network device may see client SYN and server SYN-ACK but never the completed 3-way handshake because the client is not real.
> 
> Until the 3-way handshake is completed, only short timeouts should be used. This is true for server as well as stateful network devices.

The 3-way handshake is TCP-specific; other protocols will have different patterns. However, to generalize, it may make sense to require a two-way association signal before entering the biflow state, i.e.

[zero] --packet fwd--> [uniflow] --association rev--> [associating] --association fwd--> [biflow]

with the timeout remaining t1 for the associating state.

> The nice thing about the client’s ACK of the server’s SYN flag is that it echoes back (in the ACK field) the SYN sequence number, which is unlikely to be guessed by an attacking node that doesn’t own the address it used in the SYN packet. The ACK packet also carries the original client sequence# + 1, proving it has a stateful connection.
> 
> As an alternative to adding a state, you could enter the bi-flow state only when the TCP 3-way handshake is complete.

We'd need an additional state to do this anyway, as above.

> 
> Does QUIC carry a network-observable signal indicating receipt of the server packet?

Not yet defined; I'll be talking about this in QUIC tomorrow; see also my slides for that talk at https://www.ietf.org/proceedings/97/slides/slides-97-quic-flow-state-signaling-and-quic-00.pdf

Cheers,

Brian