Re: [Spud] Connect and ACK Bits: Why?

[Phillip Hallam-Baker <[e-mail]>]

On Mon, Jul 13, 2015 at 1:25 PM, Toerless Eckert <[e-mail]> wrote:

> Route changes:
>
> the middleboxes of interest are setup so that route-changes don't
> matter, eg: eithre single point of failure or chassis redundancy or
> the like.
>
> Teardown:
>
> Explicit teardown in TCP doesn't seem to be bad enough of a
> problem that TCP was changed, right ? And it is sen as valuable by
> middlebox vendors.
>

TCP was designed in an era when malice was rarely considered as part of
network design and when it was considered it was (correctly) regarded as
secondary to getting the system working at all.

So the lack of authenticated teardown is certainly a concern, but not that
difficult to address using some lightweight symmetric crypto:


Sender, on session startup:
   Generate nonce n1, send 128 bits of H(n1) with connect message.

Sender on session shutdown:
   Send nonce n1 with teardown message.


Middleboxen:

* On receipt of packet without connect, optionally buffer till connect is
visible

* On receipt of teardown, keep connection open for MAX_TIME seconds.


Once a sender has sent a teardown message it is contracting that it is not
going to source any further packets without re-establishing the connection.
So while a middleboxen may see packets out of order, if it sees packets
after the max network time to live has expired, it is an error and they can
be discarded.