Re: [Tsvwg] WGLC for Port Randomization starts now (April 1st)

[Randy Stewart <[e-mail]>]

On May 28, 2009, at 11:15 AM, Joe Touch wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> See below; now I'm really confused:
>
> Randy Stewart wrote:
>>
>> On May 28, 2009, at 12:14 AM, Joe Touch wrote:
>>
>> Randy Stewart wrote:
>>>>> Not getting into the details of vtags.. I think you hit
>>>>> upon the key point. If you are doing time-wait.. you are
>>>>> doing time-wait on vtags... aka: 32 bit numbers.
>>>>>
>>>>> An IP address/Port is NEVER blocked from re-use right away
>>>>> like it can be in TCP due to time-wait. This was always
>>>>> one of the most irritating things I did not like in TCP.
>>
>> Sorry, maybe I'm missing this.
>>
>> Let A=srcIP, X=srcport, B=dstIP, Y=dstport.
>>
>> In TCP, if I use A,X->B,Y, then close the connection, I cannot use it
>> for another 2 minutes.
>>
>> In SCTP, if I use A,X->B,Y with Vtag Q, then close the connection,
>> clearly I cannot use A,X->B,Y with Vtag Q again for some  
>> (unspecified,
>> AFAICT, in the specs) period of time.
>>
>> You appear to be claiming that what SCTP does is block Vtag Q for  
>> that
>> period of time _for all_ socket pairs. That's strictly worse than TCP
>> was doing.
>>
>> E.g., TCP has 32 + 16 + 32 + 16 bits to play with for connections  
>> as a
>> whole, i.e., 96 bits. SCTP would have only 32. A large server with  
>> a lot
>> of short connections could easily have vtag collisions in that  
>> situation.
>>
>>
>>> No actually Q is blocked ONLY for the socket pair
>>> A,X -> B,Y for 2MSL.
>
> I don't see 2MSL anywhere in the SCTP spec.
>
> Your earlier note said you blocked Q for all sockets; this says you
> block only within the socket pair -- which is basically what I've been
> saying all along - you block on the full connection ID, i.e.,  
> [A,X,B,Y,Q].


I did not describe where the time wait is kept... I just said
I keep it ;-)

Vtag Q is blocked for the socket.. its not the full connection id.
So A/X/Q is blocked (assuming A is the IP and X is the port). We
can establish a new association with B/Y as long as we have
a different vtag i.e. Q'.

At the same time, some other socket on machine A ... lets say A/X'
can have a association to the same peer with vtag Q as well.
i.e.

A+X+Q <------assoc ---> B+Y+T

and

A+Y+Q <----- asoc ---> B+Y+U

The key is that when A+X+Q stops and starts a new association, for 2MSL
it can't use vtag Q...  i.e. it must use Q'


R


>
>
> Joe
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.9 (MingW32)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
>
> iEYEARECAAYFAkoeqpMACgkQE5f5cImnZrufNQCgi/9fCaS/wk4Yhc9oo3quwBEq
> DzoAoOgTAdS7b5jkYIFbgT2jp9sQrgc6
> =dlHs
> -----END PGP SIGNATURE-----
>

-----
Randall Stewart
[e-mail]