Re: Summary of responses so far and proposal moving forward[WasRe: [tcpm] Is this a problem?]

[Mark Allman <[e-mail]>]

> Mark Allman wrote:
> > Joe-
> > 
> > You and I are just going to disagree.
> > 
> >> That OS is required to reserve per-connection resources when
> >> connections are created. It can halt new connections.
> > 
> > If this is the general reading of the spec then TCP has a built-in DoS
> > vulnerability that we need to fix.
> 
> There's nothing in TCP that says that new connections will ALWAYS
> succeed.

Can you find a prohibition on connections failing?

Joe, you surely see the problem, right?  I am not saying that new
connections always have to succeed.  I am saying that if the spec allows
for a case whereby an attacker can coax a host into a state whereby all
new connections will fail that is a DoS attack.  Do you disagree with
that?

> It's very specifically in 1122. Local policies can kill applications,
> but can't go around gleaning connections it *thinks* aren't useful.

Nobody said it thought these connections were not useful.  I don't read
the standards as saying that when resources are severely constrained
then action cannot be taken based on some local policy decisions.  But,
that is just me.

> If you want a new RFC that allows connection revocation, then it's
> *definitely* a standards change.

I don't think we need to change anything.  I think the current version
covers this fine.  You and I just disagree on this point.  If consensus
is with you, then I would agree that it would be a standards track
change.

allman

_______________________________________________
tcpm mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/tcpm