Re: [Spud] SPUD's open/close are unconvincing

[Eliot Lear <[e-mail]>]

On 4/11/15 12:20 AM, Jana Iyengar wrote:
> Eliot,
>
> A few responses:
>
>     Open provides an indication that the flow is not a continuation,
>     that new state should be instantiated, that any old state of the
>     5-tuple should be discarded.  Opens may flow in either direction,
>     but may be authorized for only some uses.
>
>
> If used like this, it creates another DoS vector where anyone can
> trivially kick someone else's connection off.

Huge vast numbers of devices simply look to see if ACK is set, and if
not, reject most connections, except for a few.  The reason SYN is
needed is so that the firewall simply knows that the host will reject
communications that begin with something else.
>  
> AFAIK, TCP connections are commonly torn down with an RST (not a FIN),
> and not infrequently with silence. I would love to know what the truth
> is -- is there any data that I can look at to prove myself wrong?

I don't know.  But whether one uses RST or FIN is immaterial.  The
concept is roughly similar in terms of signaling state, except that RST
allows for quicker removal of state.
> Why would a DoS attacker set the OPEN bit in SPUD if it will thwart
> their attack? That would be silly...
>  

If it knows that the end point will simply discard the packet without
the OPEN having been seen, it will set it.

Eliot