Re: [tcpm] TCP Long Options

On Mon, Jul 14, 2008 at 2:57 PM, Joe Touch <touch@isi.edu> wrote:
> - we can show that there are NO versions of extending TCP options that are
> truly backward compatible
>        i.e., that use a single SYN

I believe that's true if you're talking about extending the options in
a SYN packet.

> - we can also show that there are NO versions of extending TCP options that
> are compatible with SYN cookies
>        as long as the ISN is the same length, there's only so much
>        place for state

Well, it's reasonable for stacks to disable certain features when
using SYN cookies. Until very recently, I believe that Linux would
forget about SACK permitted options in the SYN when cookies were in
use. It got around that by using the TCP timestamp as extra cookie
space. (I'm informed that BSD uses the same timestamp/cookie trick.)
If SYN cookies are only enabled when some attack heuristic is met,
that's a reasonable thing to do.

Extensions which involve SYN options thus need to cope with the case
where they are ignored by a host under attack. (I've a draft, that
I'll probably post tomorrow, that does exactly that.)

AGL

-- 
Adam Langley agl@imperialviolet.org http://www.imperialviolet.org
_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www.ietf.org/mailman/listinfo/tcpm

Re: [tcpm] TCP Long Options - Why not as payload in SYNs?