From nobody Sun Sep 25 13:16:17 2022 Return-Path: X-Original-To: tcpm@ietfa.amsl.com Delivered-To: tcpm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 94443C1522AB for ; Sun, 25 Sep 2022 11:23:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.325 X-Spam-Level: X-Spam-Status: No, score=-6.325 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_NEUTRAL=0.779, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=strayalpha.com Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WQH2G-JAQmNt for ; Sun, 25 Sep 2022 11:23:28 -0700 (PDT) Received: from server217-2.web-hosting.com (server217-2.web-hosting.com [198.54.115.98]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E02D1C14F72B for ; Sun, 25 Sep 2022 11:23:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=strayalpha.com; s=default; h=To:Cc:Date:Message-Id:Subject:Mime-Version: From:Content-Transfer-Encoding:Content-Type:Sender:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=2xNfirLrRsS4kdwA1ZzIf8r2DZTib6cGaMemQhcU89A=; b=I3Fdevo15S79CxujEUo8Pw/eTk 4WhuIUd5Y3ZpagM39zFr+4c/HfgPK6PdNHZ8Dqu3w03ikZsYMFiRtwBi2Y0OS/wqyMz8gSXrQ8gtq 12ExqmC5Yu252FcyxoZ/Poi8Pftk+EJbD9ur+CSAiR6jFMABOWKZTJaDJraqEpxlz2D8vZl0bctkR n9HtZLuBg7lnwflxEDBRCM8cAxY3X+hc/+27GnaH1+b6DAwnd37ni3H/gXh0JbsRv7nu+NrzAFdxq 1KEo63Fi3FqoQKdrKzndyYqE8Yh7Oax8+y8rYHZJ1EUUKfu2x5eI31Yk9+KN6+ChkWYKkBAkmN5jT xP0OfPZA==; Received: from cpe-172-114-237-88.socal.res.rr.com ([172.114.237.88]:49534 helo=smtpclient.apple) by server217.web-hosting.com with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1ocWHY-004siS-NR; Sun, 25 Sep 2022 14:23:17 -0400 Content-Type: multipart/alternative; boundary=Apple-Mail-EB3BAEDB-D1EC-407E-A36F-560F1CD8DC04 Content-Transfer-Encoding: 7bit From: Joe Touch Mime-Version: 1.0 (1.0) Message-Id: Date: Sun, 25 Sep 2022 11:23:04 -0700 Cc: "Natarajan, Venkatesh (HP-Networking)" , Dmitry Safonov , Zaheduzzaman Sarker , Francesco Ruggeri , Allison Mankin , Ron Bonica , Michael Tuexen , tcpm@ietf.org, Salam Noureddine , RFC Errata System To: Leonard Crestez X-Mailer: iPad Mail (19G82) X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - server217.web-hosting.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - strayalpha.com X-Get-Message-Sender-Via: server217.web-hosting.com: authenticated_id: touch@strayalpha.com X-Authenticated-Sender: server217.web-hosting.com: touch@strayalpha.com X-Source: X-Source-Args: X-Source-Dir: X-From-Rewrite: unmodified, already matched Archived-At: X-Mailman-Approved-At: Sun, 25 Sep 2022 13:16:15 -0700 Subject: Re: [tcpm] [Technical Errata Reported] RFC5925 (7135) X-BeenThere: tcpm@ietf.org X-Mailman-Version: 2.1.39 Precedence: list List-Id: TCP Maintenance and Minor Extensions Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 25 Sep 2022 18:23:33 -0000 --Apple-Mail-EB3BAEDB-D1EC-407E-A36F-560F1CD8DC04 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable =EF=BB=BFHi Leonard, > On Sep 25, 2022, at 8:03 AM, Leonard Crestez wrote: > Accepting signed segments which don't match an MKT is not sufficient for e= stablishing an unsigned connection. Agreed. It indicates acceptance by that side. > The other side must also be configured to *accept unsigned replies* to its= signed packets and no such flag seems to be required by the RFC. That=E2=80=99s on OS issue, not a protocol one. It is decided by local confi= guration that does not need to be coordinated. > It might also make sense to only accept mismatch on SYN segments because o= therwise it would be possible for a TCP-AO connection to be interrupted by a= n unsigned RST. Once a connection is established, that connnection=E2=80=99s stae determines= what options are required. See sec 7.5: >> Note that TCP-AO checks MUST be performed for all incoming SYNs to avoid accepting SYNs lacking TCP-AO where required. Other segments can cache whether TCP-AO is needed in the TCB. Joe= --Apple-Mail-EB3BAEDB-D1EC-407E-A36F-560F1CD8DC04 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
=EF=BB=BFHi Leonard,

On Sep 25, 2022, at 8:03 AM, Leonar= d Crestez <cdleonard@gmail.com> wrote:

Accepting signed segments which d= on't match an MKT is not sufficient for establishing an unsigned connection.=

Agreed. It indicates acceptance by= that side.

The oth= er side must also be configured to *accept unsigned replies* to its signed p= ackets and no such flag seems to be required by the RFC.

That=E2=80=99s on OS issue, not a protocol one= . It is decided by local configuration that does not need to be coordinated.=

It might also make sense to only accept mismatch on SYN segments beca= use otherwise it would be possible for a TCP-AO connection to be interrupted= by an unsigned RST.

Once a connecti= on is established, that connnection=E2=80=99s stae determines what options a= re required. See sec 7.5:

>> Note that TCP-=
AO checks MUST be performed for all incoming SYNs to
   avoid accepting SYNs lacking TCP-AO where required.  Other segments
   can cache whether TCP-AO is needed in the TCB.

Joe
= --Apple-Mail-EB3BAEDB-D1EC-407E-A36F-560F1CD8DC04--