Re: [Tsvwg] WGLC for Port Randomization starts now (April 1st)

[Joe Touch <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Randy Stewart wrote:
> 
> On May 28, 2009, at 11:11 AM, Joe Touch wrote:
> 
> 
> 
> Randy Stewart wrote:
>>>> Joe:
>>>>
>>>> In-line..
>>>>
>>>> ...
>>>>> Basically for BSD we take a v-tag used in a connection.. call it
>>>>> 'X', and
>>>>> we place just the tag 'X' into a "timed-wait" cache for 2MSL. There
>>>>> is no
>>>>> restriction on the socket here.. just the tag 'X' will not be used
>>>>> again
>>>>> with this socket.
> 
> ...
>>>>> So basically the socket/port and peer socket/port is re-used right away
>>>>> with
>>>>> the restriction being that the vtag 'X' cannot be used.
>>>>
>>>>> Hope that clears up the issue  :-)
> 
> Yes, but it also underscores my concern. What you did was basically:
> 
>     - increase the space available to a single service from
>     a single IP address
>         going from TCP's 16 bits (max) of source port to
>         48 bits of source port + vtag
> 
>     - *decrease* the space available for different
>     services from different IP addresses
>         going from TCP's 32 bits of address +
>         16 bits of source port + 16 bits of
>         dest port (64 bits) down to only 32
> 
>> Joe:
> 
>> I don't follow your meaning here..
> 
>> I can have
> 
>> IP-A Port-X Vtag-Y <---->
>> and
>> IP-A Port-Y Vtag=Y <---->
> 
>> existing simultaneously... so I don't see how this decreased the
>> space for services from different IP addresses...

OK so there's two cases:

	1) the vtag is the unique thing held (NO OTHER STATE)
	2) the vtag is held in the context of the socket pair

In 1), the vtag effectively is the connection ID.

In 2), the connection ID is the 5-tuple of
[srcIP,srcport,dstIP,dstport,vtag]

In the case of 1), you decrease the space available for connections vs.
TCP when you include connections from different machines and for
different services.

In the case of 2), you increase the space available, and I don't have
the concern raised above.

I am still a bit confused as to which case is true; you appeared to give
two different responses.

Joe
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkoerkcACgkQE5f5cImnZrvVlQCgoNoQPGril0N687ocbOD1n0ex
cUoAn35PgtR+ogd0NGkkPZBD74H39MzN
=uJLP
-----END PGP SIGNATURE-----