Re: [tcpm] Feedbackt on draft-ietf-tcpm-tcpsecure-13.txt

["Smith, Donald" <[e-mail]>]

First throughout this draft the authors refer to sequence number checking where they really mean acknowledgement number checking:( You can't quite do :g/sequence number/s//acknowledgement number/g as in a few places it is the senders sequence number they are discussing.
The authors also use "the exact expected sequence number" a lot.
I think they mean: last sent sequence number + the data length sent

This looks a LOT like gonts draft but may be an attempt to address just one issue identified here.

http://tools.ietf.org/html/draft-gont-tcp-security-00#section-3.4


This is slightly incorrect. In window would include an exact match for rcv.net+rcv.wnd
so the right side should be =<.
The wording for how to do the challenge ack is a bit difficult to follow too.



   3) If the RST bit is set and the sequence number does not exactly
      match the next expected sequence value, yet is within the current
      receive window (RCV.NXT < SEG.SEQ < RCV.NXT+RCV.WND), TCP MUST
      send an acknowledgment (challenge ACK):

      <SEQ=SND.NXT><ACK=RCV.NXT><CTL=ACK>

Ramaiah, et al.         Expires November 4, 2010                [Page 9]
Internet-Draft                TCP Security                      May 2010

      After sending the challenge ACK, TCP MUST drop the unacceptable
      segment and stop processing the incoming packet further.  Further
      segments destined to this connection will be processed as normal.






   3) If the RST bit is set and the sequence number does not exactly
      match the next expected sequence value, yet is within the current
      receive window (RCV.NXT < SEG.SEQ =< RCV.NXT+RCV.WND), TCP MUST
      send an acknowledgment (challenge ACK):

      <SEQ=SND.NXT><ACK=RCV.NXT><CTL=ACK>







Ramaiah, et al.         Expires November 4, 2010                [Page 9]

Internet-Draft                TCP Security                      May 2010


      After sending the challenge ACK, TCP MUST silently drop the in window
      but not exact match segment and stop processing it.  Additional
      segments destined to this connection MUST be processed as normal.

That last line is really extraneous. You don't say what happens to the packets before this event I am not sure you have to say handle the next packet per normal behavior;)
The authors need to explain exactly what that challenge ACK looks like.
I think it is the same 4 tuple, ack = last sent ack, seq = last sent seq (no data).




Still on page 9.
In all states except SYN-SENT, all reset (RST) segments are validated
   by checking their SEQ-fields [sequence numbers].  A reset is valid if
   its sequence number exactly matches the next expected sequence
   number.  If the RST arrives and its sequence number field does NOT
   match the next expected sequence number but is within the window,
   then the receiver should generate an ACK.  In all other cases where
   the SEQ-field does not match and is outside the window, the receiver
   MUST silently discard the segment.


Should be:
In all states except SYN-SENT, all reset (RST) segments are validated
   by checking their ACK-fields [acknowledgement numbers].  A reset is valid if
   its acknowledgement number exactly matches the last sent sequence number + the data length sent.
   If the RST arrives and its acknowledgement number field does NOT
   match the last sent sequence number + the data length sent but is within the window,
   then the receiver SHOULD (or MUST?) generate an ACK.  In all other cases where
   the ACK-field does not match and is outside the window, the receiver
   MUST silently discard the segment.



(coffee != sleep) & (!coffee == sleep)
[e-mail] gcia


This communication is the property of Qwest and may contain confidential or
privileged information. Unauthorized use of this communication is strictly
prohibited and may be unlawful.  If you have received this communication
in error, please immediately notify the sender by reply e-mail and destroy
all copies of the communication and any attachments.