Re: [tcpm] [Technical Errata Reported] RFC5925 (7135)

Hi, all,

I disagree with this errata.

The decision is based on whether the segments match an MKT. If TCP-AO is required, an MKT would have been configured; packets with the option would match the MKT and proceed. Packets without the option would not match the MKT - because an MKT requires info in the option.

Recommend reject.

Joe

—
Dr. Joe Touch, temporal epistemologist
www.strayalpha.com

> On Sep 16, 2022, at 1:31 AM, RFC Errata System <rfc-editor@rfc-editor.org> wrote:
> 
> The following errata report has been submitted for RFC5925,
> "The TCP Authentication Option".
> 
> --------------------------------------
> You may review the report below and at:
> https://www.rfc-editor.org/errata/eid7135
> 
> --------------------------------------
> Type: Technical
> Reported by: Venkatesh Natarajan <venkatesh.natarajan@hpe.com>
> 
> Section: 7.3
> 
> Original Text
> -------------
>>> A TCP-AO implementation MUST allow for configuration of the
>   behavior of segments with TCP-AO but that do not match an MKT.  The
>   initial default of this configuration SHOULD be to silently accept
>   such connections.  If this is not the desired case, an MKT can be
>   included to match such connections, or the connection can indicate
>   that TCP-AO is required.  Alternately, the configuration can be
>   changed to discard segments with the AO option not matching an MKT.
> 
> Corrected Text
> --------------
>>> A TCP-AO implementation MUST allow for configuration of the
>   behavior of segments with TCP-AO but that do not match any MKT or 
>   no MKT is available. The initial default of this configuration 
>   SHOULD be to silently accept such connections. In this mode of 
>   operation, both the endpoints will not perform TCP-AO validation.
>   If this is not the desired case, an MKT can be included to match such 
>   connections, or the connection can indicate that TCP-AO is required. 
>   Alternately, the configuration can be changed to discard segments
>   with the AO option not matching an MKT.
> 
> Notes
> -----
> The RFC does not clearly draw out the distinction between treatment of segments with TCP-AO and without TCP-AO option.
> Note that in the case of MKT mismatch as per existing RFC text, if either endpoint does TCP-AO validation, the session would not get established.
> 
> Instructions:
> -------------
> This erratum is currently posted as "Reported". If necessary, please
> use "Reply All" to discuss whether it should be verified or
> rejected. When a decision is reached, the verifying party  
> can log in to change the status and edit the report, if necessary. 
> 
> --------------------------------------
> RFC5925 (draft-ietf-tcpm-tcp-auth-opt-11)
> --------------------------------------
> Title               : The TCP Authentication Option
> Publication Date    : June 2010
> Author(s)           : J. Touch, A. Mankin, R. Bonica
> Category            : PROPOSED STANDARD
> Source              : TCP Maintenance and Minor Extensions
> Area                : Transport
> Stream              : IETF
> Verifying Party     : IESG
> 
> _______________________________________________
> tcpm mailing list
> tcpm@ietf.org
> https://www.ietf.org/mailman/listinfo/tcpm