Subject: [tcpm] small bit on ecnsyn-00 and syn cookies

From: Wesley Eddy <[email-masked]>
Date: Fri, 17 Mar 2006 13:17:54 -0500

Just a slight bit more discussion of syn cookies is required in the
ecnsyn draft as it stands.

The issue is that the listening (cookie-generating) host doesn't keep a
TCB for the connection, so it doesn't keep an ecn-capable bit set for
the connection.  With current algorithms for generating the cookie, the
ECN bit doesn't factor in, so it is not recovered into the rebuilt TCB
when the listener gets the ACK.

So if ECN signalling is to be used for the connection (and for the
SYN-ACK segment), the listening host has a couple of options:

1) Incorporate the ECN-capable bit into the cookie, so that it can be
recovered.

2) Infer the ECN-capability of the connection from either of the ECT
codepoints in the IP-header on the ACK.

If none of these mechanisms are in the host (which they currently aren't)
then a host that uses syn cookies can't use ECN for the SYN-ACK.

I guess this issue is not really specific to the ecnsyn draft, but moreso
to the general combination of syn cookies and ECN.  If that combination were
defined, then ecnsyn and syn cookies would have no friction.  I could add
some text to the draft on syn flooding and defenses to address this, if it is
desirable:
http://www.ietf.org/internet-drafts/draft-eddy-syn-flood-01.txt

-Wes

-- 
Wesley M. Eddy
Verizon Federal Network Systems
_______________________________________________
tcpm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tcpm

---

From: Matt Mathis <[email-masked]>
Date: Fri, 17 Mar 2006 13:33:38 -0500 (EST)

A TCP implementation that uses syn-cookies is technically "non-compliant" - for
that reason many (most?) stacks use some sort of light weight "embryonic" TCB
instead.  It can be fully protocol compliant, and provides essentially the same
protection from syn floods.

I would prefer not do design ECN signaling around problems that exist only for
non-compliant implementations.  Their implementors have more direct methods to
solve the problem.

Thanks,
--MM--
-------------------------------------------
Matt Mathis      http://www.psc.edu/~mathis
Work:412.268.3319    Home/Cell:412.654.7529
-------------------------------------------
Evil is defined by people who think they know
"The Truth" and use force to apply it to others.

---

From: Wesley Eddy <[email-masked]>
Date: Fri, 17 Mar 2006 13:43:39 -0500

> protection from syn floods.

I believe you're referring to what is commonly called a syn cache.
 
> non-compliant implementations.  Their implementors have more direct methods to

The changes I mentioned only apply to the "non-compliant" host, and do not
affect the design of the ECN signaling.

-Wes