Re: [tcpm] [Technical Errata Reported] RFC5961 (4772)

On Thu, Aug 11, 2016 at 12:40 PM, Joe Touch <touch@isi.edu> wrote:
> FWIW, I don't really see the need for this new doc at all.
+1
>
> Everything in 5961 is within the context of a single connection. The
> misreading of this doc doesn't warrant updating, clarifying, etc.
I think an errata on recommending per-connection limit and cite the
research finding is worthy.

>
> The behavior of Linux should be treated simply as the bug that it is and
> corrected, but there's no reason to pollute the RFC stream or increase
> the complexity of TCP requirements on the basis of a bug.
>
> Joe
>
>
> On 8/11/2016 12:36 PM, Joe Touch wrote:
>> FWIW, I see nothing in RFC5961 that implies that ACK throttling - or
>> anything in the doc - should be across connections.
>>
>> This new doc can claim to clarify Sec 7 of that RFC, but I see no reason
>> to deprecate it.
>>
>> Joe
>>
>>
>> On 8/11/2016 9:27 AM, Loganaden Velvindron wrote:
>>> I submitted this draft, yesterday.:
>>>
>>> https://tools.ietf.org/html/draft-lvelvindron-ack-throttling-02
>>>
>>> It's a work-in-progress, but I welcome feedback.
>>>
>>>
>>> On Wed, Aug 10, 2016 at 10:36 PM, RFC Errata System
>>> <rfc-editor@rfc-editor.org> wrote:
>>>> The following errata report has been submitted for RFC5961,
>>>> "Improving TCP's Robustness to Blind In-Window Attacks".
>>>>
>>>> --------------------------------------
>>>> You may review the report below and at:
>>>> http://www.rfc-editor.org/errata_search.php?rfc=5961&eid=4772
>>>>
>>>> --------------------------------------
>>>> Type: Technical
>>>> Reported by: Stéphane Bortzmeyer <bortzmeyer+ietf@nic.fr>
>>>>
>>>> Section: 7
>>>>
>>>> Original Text
>>>> -------------
>>>> [The entire section]
>>>>
>>>> Corrected Text
>>>> --------------
>>>> No suggested text because it requires a much more serious analysis.
>>>> May be adding that the rate-limit counter SHOULD be per-connection,
>>>> in the spirit of RFC 6528?
>>>>
>>>> Notes
>>>> -----
>>>> It appears the section does not specify that the counter for ACK throttling SHOULD be per-connection. In Linux, it is apparently global, which allowed its use as a side channel enabling nasty attacks (CVE-2016-5696 and the paper "Off-Path TCP Exploits: Global Rate Limit Considered Dangerous" <http://www.cs.ucr.edu/~zhiyunq/pub/sec16_TCP_pure_offpath.pdf>)
>>>>
>>>> Instructions:
>>>> -------------
>>>> This erratum is currently posted as "Reported". If necessary, please
>>>> use "Reply All" to discuss whether it should be verified or
>>>> rejected. When a decision is reached, the verifying party (IESG)
>>>> can log in to change the status and edit the report, if necessary.
>>>>
>>>> --------------------------------------
>>>> RFC5961 (draft-ietf-tcpm-tcpsecure-13)
>>>> --------------------------------------
>>>> Title               : Improving TCP's Robustness to Blind In-Window Attacks
>>>> Publication Date    : August 2010
>>>> Author(s)           : A. Ramaiah, R. Stewart, M. Dalal
>>>> Category            : PROPOSED STANDARD
>>>> Source              : TCP Maintenance and Minor Extensions
>>>> Area                : Transport
>>>> Stream              : IETF
>>>> Verifying Party     : IESG
>>>>
>>>>
>>>> _______________________________________________
>>>> tcpm mailing list
>>>> tcpm@ietf.org
>>>> https://www.ietf.org/mailman/listinfo/tcpm
>>>>
>>> _______________________________________________
>>> tcpm mailing list
>>> tcpm@ietf.org
>>> https://www.ietf.org/mailman/listinfo/tcpm
>
> _______________________________________________
> tcpm mailing list
> tcpm@ietf.org
> https://www.ietf.org/mailman/listinfo/tcpm