Re: [Spud] States in draft-trammell-plus-statefulness-00

["Christian Huitema" <[e-mail]>]

On Monday, November 14, 2016 9:58 AM, Eliot Lear wrote:
> The nice thing about TCP being stateful, however, is that the middlebox
> has reason to trust how an end device is going to handle something that
> is outside the state machine.  It's really well defined.  That's the
> good part.  The bad part is that then the state machine is ossified.

That's not the only bad part. Looking for SYN/SYN-ACK won't work if packets follow a new path after a route change, as could easily happen with multi-homing. 

Also, the lack of authentication allows for the "spoofed RST" attack, in which injecting a single packet can cause connections to be dropped. That's why I would rather see mechanisms in which the magic packets have to flow in both directions. For example, a middlebox sees "drop me" coming from the left, and simply marks the state as "drop from left requested". If it receives a corresponding "drop me" from the right, the state is dropped. If on the contrary it receives a regular packet from the left, then it suspects spoofing and the state reverts to normal.

-- Christian Huitema