Re: Summary of responses so far and proposal moving forward[WasRe: [tcpm] Is this a problem?]

[Joe Touch <[e-mail]>]

Mark Allman wrote:
>> Mark Allman wrote:
>>> Joe-
>>>
>>> You and I are just going to disagree.
>>>
>>>> That OS is required to reserve per-connection resources when
>>>> connections are created. It can halt new connections.
>>> If this is the general reading of the spec then TCP has a built-in DoS
>>> vulnerability that we need to fix.
>> There's nothing in TCP that says that new connections will ALWAYS
>> succeed.
> 
> Can you find a prohibition on connections failing?
> 
> Joe, you surely see the problem, right?

I see an OS that has to decide how to allocate resources:

	a- leave them with existing apps and prohibit new ones

	b- terminate existing apps to make room for new ones

I expect that a reasonable, modern OS would do (a).

> I am not saying that new
> connections always have to succeed.  I am saying that if the spec allows
> for a case whereby an attacker can coax a host into a state whereby all
> new connections will fail that is a DoS attack.  Do you disagree with
> that?

I agree that attackers, as well as legitimate users, can consume local
resources on servers, and that such consumption can reach a limit beyond
what the server can support.

The question is "what do you do when you run out of resources?"

TCP allows killing connections where the other end doesn't respond, via
timeouts. We're all talking about what to do when the attacker is
willing to commit more resources, i.e., to keep ACKing, or even just go
very slowly.

IMO, under those conditions you cannot know the difference between a
legitimate user and an attacker. Under those conditions, 1122
specifically claims that not making progress due to an ACKd zero window
isn't a connection failure.

IMO, the application (i.e., service) ought to determine when to give up
on a connection, and issue ABORTs.

That solves the problem entirely and is entirely within the scope of
1122 as it currently exists.

I don't agree that the OS has any business terminating connections to
make up for poorly-written, and thus DOS-susceptible applications, or
that 1122 should be modified to either permit or encourage this sloppy
handling of DOS attacks.

Joe

_______________________________________________
tcpm mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/tcpm