Re: [tcpm] ECN++ control packet handling

["Scheffenegger, Richard" <[e-mail]>]

Sounds good to me!

Thanks for the quick turnaround!

Best regards,
    Richard

Am 09.02.2021 um 16:48 schrieb Bob Briscoe:
> Richard,
>
> Good point. Thanks for noticing this potential implementation pit-fall.
>
> In my local copy of the ECN++ draft I have added the following to the
> end of "3.2.6 RST (Send)":
>
> + Implementers SHOULD ensure that RST packets (and control packets
>
> + generally) are always sent out with the same ECN field regardless of
>
> + the TCP state machine. Otherwise the ECN field could reveal internal
>
> + TCP state. For instance, the ECN field on a RST ought not to reveal
>
> + any distinction between a non-listening port, a recently in-use
>
> + port, and a closed session port.
>
> And I've added this to the end of Security Considerations:
>
> + Section 3.2.6 on sending TCP RSTs points out
>
> + that implementers need to take care to ensure that the ECN field on a
>
> + RST does not depend on TCP's state machine. Otherwise the internal
>
> + information revealed could be of use to potential attackers. This point
>
> + applies more generally to all control packets, not just RSTs.
>
> Do you think that's correct / sufficient?
>
> Cheers
>
> Bob
>
> On 08/02/2021 21:03, Scheffenegger, Richard wrote:
>> Hi Bob, Marcelo,
>>
>> While working on the ecn++ code for fbsd patch, I found that the
>> codepath for dealing with out-of-window, past-established and
>> non-listening ports is actually quite different there.
>>
>> Casually glancing over the draft for ecn++, I didn’t find a reference
>> specifically about the handling of RST (non-listening port, vs. closing
>> session etc).
>>
>> This may need a hint in the security section, that an implementation
>> should ensure, that control packets are always sent out with similar
>> headers, regardless of the TCP state machine. Otherwise, you could
>> potentially leak information (eg. Recently in-use ports) which may be a
>> clue to malicious players…
>>
>>
>> Richard Scheffenegger
>>
>> _______________________________________________
>> tcpm mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/tcpm
>
> --
> ________________________________________________________________
> Bob Briscoehttp://bobbriscoe.net/
>