Re: [Tsvwg] WGLC for Port Randomization starts now (April 1st)

[Joe Touch <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Anantha Ramaiah (ananth) wrote:
>  
> 
>>> It's worth noting that many implementations aren't RFC compliant in 
>>> this regard, though.
>>>
>>>> It is also well known that the side-effect of TIME-WAIT 
>> requirement 
>>>> leads for the 4-tuple (socket-pairs) to be locked for some time.
>>> That is not a "side effect", that is the *desired* effect.
>>>
>>>> It needs to be pointed out at that, other transport protocols like 
>>>> SCTP doesn't have the TIME-WAIT requirement since the protocol 
>>>> supports in-built mechanisms to deal with the need for the same.
>>> SCTP has a TIME WAIT state for its connection IDs (socket pair and 
>>> vtags), just as TCP has for its (socket pair). The 
>> difference is that 
>>> SCTP has a larger connection ID space, that's *all*.
>>
>> Joe:
>>
>> Technically you are correct... there is a timed-wait on 
>> vtags. The BSD implementation (the reference implementation) 
>> does properly implement this. However the space is so large 
>> most implementations do not do so.
>>
>> I guess other developers have felt its not worth the trouble 
>> with such a large space....
>>
>> R
> 
> Yes, exactly. To rephrase :
> 
> - SCTP protocol state machine doesn't have a TIME-WAIT state.

That's not what I got from the specs or Randall's note; there is a
TIME-WAIT state, but it's generally not implemented (which I find
amazing, given the extent to which SCTP went to avoid security issues).

> - SCTP doesn't suffer from the same problem like TCP where you cannot
> reuse the socket pair. You reuse the socket pair immediately and the
> connections would get accepted. The only thing mandated by the protocol
> is that the vtag (a billon spaced one) needs to be unique for every new
> connection request. 

STCP has exactly the same issue; SCTP defines the connection ID as
including the vtag, which increases the size of the space, which makes
it not an concern, though. TCP defines the connection ID as the socket
pair, which does not have enough entropy to avoid collisions.

> - Like you said *some* implementations have chosen to do time-wait on
> vtags (NOT the TIME-WAIT on the entire TCB (socket pair) which it
> TOTALLY different. (esp for the context the current discussion is
> happenning)

SCTP defines the "TIME-WAIT" on the connection identifier, not just the
vtags.

> So, actually I should have said that other transport protocols like SCTP
> have the in-built mechanism (vtags, similar to timestamps of TCP in some
> sense as far the current discussion goes) to deal with the port reuse
> issue.

vtags are constant over the life of the connection. the closest thing
they come to in TCP terms is the ISN pair, but it is inserted in the
header of every packet.

Joe
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkodaSAACgkQE5f5cImnZrsTTwCgrWLZFkwC2JpA2Mj/GLv1GI4t
twYAoNTUzXaCw16K8ChyoZwK/5n5MLNc
=Mrty
-----END PGP SIGNATURE-----