Re: [tcpm] [Technical Errata Reported] RFC5961 (4772)

FWIW, I don't really see the need for this new doc at all.

Everything in 5961 is within the context of a single connection. The
misreading of this doc doesn't warrant updating, clarifying, etc.

The behavior of Linux should be treated simply as the bug that it is and
corrected, but there's no reason to pollute the RFC stream or increase
the complexity of TCP requirements on the basis of a bug.

Joe

On 8/11/2016 12:36 PM, Joe Touch wrote:
> FWIW, I see nothing in RFC5961 that implies that ACK throttling - or
> anything in the doc - should be across connections.
>
> This new doc can claim to clarify Sec 7 of that RFC, but I see no reason
> to deprecate it.
>
> Joe
>
>
> On 8/11/2016 9:27 AM, Loganaden Velvindron wrote:
>> I submitted this draft, yesterday.:
>>
>> https://tools.ietf.org/html/draft-lvelvindron-ack-throttling-02
>>
>> It's a work-in-progress, but I welcome feedback.
>>
>>
>> On Wed, Aug 10, 2016 at 10:36 PM, RFC Errata System
>> <rfc-editor@rfc-editor.org> wrote:
>>> The following errata report has been submitted for RFC5961,
>>> "Improving TCP's Robustness to Blind In-Window Attacks".
>>>
>>> --------------------------------------
>>> You may review the report below and at:
>>> http://www.rfc-editor.org/errata_search.php?rfc=5961&eid=4772
>>>
>>> --------------------------------------
>>> Type: Technical
>>> Reported by: Stéphane Bortzmeyer <bortzmeyer+ietf@nic.fr>
>>>
>>> Section: 7
>>>
>>> Original Text
>>> -------------
>>> [The entire section]
>>>
>>> Corrected Text
>>> --------------
>>> No suggested text because it requires a much more serious analysis.
>>> May be adding that the rate-limit counter SHOULD be per-connection,
>>> in the spirit of RFC 6528?
>>>
>>> Notes
>>> -----
>>> It appears the section does not specify that the counter for ACK throttling SHOULD be per-connection. In Linux, it is apparently global, which allowed its use as a side channel enabling nasty attacks (CVE-2016-5696 and the paper "Off-Path TCP Exploits: Global Rate Limit Considered Dangerous" <http://www.cs.ucr.edu/~zhiyunq/pub/sec16_TCP_pure_offpath.pdf>)
>>>
>>> Instructions:
>>> -------------
>>> This erratum is currently posted as "Reported". If necessary, please
>>> use "Reply All" to discuss whether it should be verified or
>>> rejected. When a decision is reached, the verifying party (IESG)
>>> can log in to change the status and edit the report, if necessary.
>>>
>>> --------------------------------------
>>> RFC5961 (draft-ietf-tcpm-tcpsecure-13)
>>> --------------------------------------
>>> Title               : Improving TCP's Robustness to Blind In-Window Attacks
>>> Publication Date    : August 2010
>>> Author(s)           : A. Ramaiah, R. Stewart, M. Dalal
>>> Category            : PROPOSED STANDARD
>>> Source              : TCP Maintenance and Minor Extensions
>>> Area                : Transport
>>> Stream              : IETF
>>> Verifying Party     : IESG
>>>
>>>
>>> _______________________________________________
>>> tcpm mailing list
>>> tcpm@ietf.org
>>> https://www.ietf.org/mailman/listinfo/tcpm
>>>
>> _______________________________________________
>> tcpm mailing list
>> tcpm@ietf.org
>> https://www.ietf.org/mailman/listinfo/tcpm