Subject: [tcpm] tcpsecure: Corner case in the mitigation for the SYN-based reset

From: Fernando Gont <[email-masked]>
Date: Mon, 27 Nov 2006 09:59:51 -0300

Folks,

Section 4.2 of tcpsecure describes a corner case that is supposedly un-handled.

My understanding is that the mitigation does *not* harm any feature 
of TCP. Can anybody think of a reason for which RFC 793 states that a 
reset should be sent in response to in-window SYNs, rather than 
responding with an ACK (as suggested by TCP secure)?

(maybe simply the fact that an out-of-window SYN could be an 
old-duplicate, while an in-window SYN certainly indicates an abnormal 
behaviour (i.e., error condition)?)

Thanks!

--
Fernando Gont
e-mail: [email-masked] || [email-masked]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

_______________________________________________
tcpm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tcpm

; Mon, 27 Nov 2006 10:30:39 -0300
Date: Mon, 27 Nov 2006 09:53:28 -0300
To: [email-masked]
From: Fernando Gont <[email-masked]>
Subject: [tcpm] tcpsecure & IPR

Folks,

I was having a look at the tcpsecure doc, and at some point I 
recalled the issue of the pending patent, etc.

A few questions with respect to this issue:

* Is the pending patent on all the mitigations, or just on some of 
them? If so, which ones?
* Do vendors have to do paperwork with Cisco (or whoever) before 
being able to implement this? No matter what the answer to this one 
is: Is there any online documentation of this that one could show to 
vendors willing to implement this (but afraid of the patent thing)?
* Any data regarding implementation of these counter-measures by 
vendors other than Cisco & Juniper? Open source OSes?

Thanks!

Kindest regards,

--
Fernando Gont
e-mail: [email-masked] || [email-masked]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

_______________________________________________
tcpm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tcpm