Re: [tcpm] I-D Action: draft-ietf-tcpm-1323bis-13.txt

[Joe Touch <[e-mail]>]

On 5/27/2013 11:10 AM, Pasi Sarolahti wrote:
> On May 27, 2013, at 7:53 PM, Joe Touch <[e-mail]> wrote:
>
>> On 5/27/2013 3:19 AM, Pasi Sarolahti wrote:
>> ...
>>> MUST drop all (non-RST) segments without timestamp seems indeed
>>> In the worst case this might discourage enabling timestamps at all,
>>> if an implementation wants to be safe against middleboxes as
>>> described.
>>
> [...]
>> That's why RSTs MUST NEVER require anything - even, IMO, a handshake (as per RFC 5691).
>
> Fine, but my (and Olivier's) comment was about normal segments that
> do not carry RST flag.

Sorry - I misread your post. However:

> Why MUST those be dropped at the receiver if
> they are missing TSopt for some reason? This is a new requirement
> compared to earlier versions of the draft and RFC1323, and I don't
> think current implementations drop such segments either.

The original requirement was here in -13:

    Once TSopt has been successfully negotiated (sent and received)
    during the <SYN>, <SYN,ACK> exchange, TSopt MUST be sent in every
    non-<RST> segment for the duration of the connection, and SHOULD be
    sent in a <RST> segment (see Section 4.2 for details).  If a non-
    <RST> segment is received without a TSopt, a TCP MAY drop the segment
    and send an <ACK> for the last in-sequence segment.  A TCP MUST NOT
    abort a TCP connection if a non-<RST> segment is received without a
    TSopt.

Regarding handling of non-RSTs lacking TSopt, we did discuss this on the 
list; you even cited this within the past day or so:

---
> Always including TSopt seems to represent the rough consensus of the
> WG, even if it might not be a uniform agreement. This was discussed
> quite extensively some time ago. (Though judging rough consensus from
> Emails is difficult... we'd need some sort of electronic hum tool
---

Once you indicate a sender-side MUST, you need to describe how the 
receiver handles exceptions. IMO, there's little point to claiming PAWS 
protection if you're going to react *in any way* to a non-RST segment 
lacking TSopt.

I.e., a sender MUST include implies - IMO - a receiver MUST silently 
discard when the 'must' isn't there.

Joe