Re: [tcpm] TCP Long Options - Why not as payload in SYNs?

[Joe Touch <[e-mail]>]

Adam Langley wrote:
...
> Extensions which involve SYN options thus need to cope with the case
> where they are ignored by a host under attack. (I've a draft, that
> I'll probably post tomorrow, that does exactly that.)

I don't think that's tenable. SYNs are where the presence of all 
capabilities are negotiated. TCP has no semantics for turning 
capabilities on after a connection is negotiated.

If you ignore options in the SYN, you're saying "I can't do that 
capability for the entirety of this connection". For options that are 
optional (i.e., that are disabled if not ACKd), that works fine, but 
then disables the feature for the rest of the connection.

For options that initiators want to require (e.g., TCP-AO, for one), if 
you ignore the option in the SYN-ACK, or forget that it was negotiated, 
the option will not work and the connection will be dropped.

That says you've hit a case where SYN cookies don't support TCP, not 
where your options aren't supported by SYN cookies, IMO.

Joe

_______________________________________________
tcpm mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/tcpm