Subject: [tcpm] ECN++ control packet handling

From: "Scheffenegger, Richard" <[email-masked]>
Date: Mon, 8 Feb 2021 22:03:33 +0100

Hi Bob, Marcelo,

While working on the ecn++ code for fbsd patch, I found that the
codepath for dealing with out-of-window, past-established and
non-listening ports is actually quite different there.

Casually glancing over the draft for ecn++, I didn’t find a reference
specifically about the handling of RST (non-listening port, vs. closing
session etc).

This may need a hint in the security section, that an implementation
should ensure, that control packets are always sent out with similar
headers, regardless of the TCP state machine. Otherwise, you could
potentially leak information (eg. Recently in-use ports) which may be a
clue to malicious players…

Richard Scheffenegger

---

From: Bob Briscoe <[email-masked]>
Date: Tue, 9 Feb 2021 15:48:52 +0000

Richard,

Good point. Thanks for noticing this potential implementation pit-fall.

In my local copy of the ECN++ draft I have added the following to the 
end of "3.2.6 RST (Send)":

+ Implementers SHOULD ensure that RST packets (and control packets

+ generally) are always sent out with the same ECN field regardless of

+ the TCP state machine. Otherwise the ECN field could reveal internal

+ TCP state. For instance, the ECN field on a RST ought not to reveal

+ any distinction between a non-listening port, a recently in-use

+ port, and a closed session port.

And I've added this to the end of Security Considerations:

+ Section 3.2.6 on sending TCP RSTs points out

+ that implementers need to take care to ensure that the ECN field on a

+ RST does not depend on TCP's state machine. Otherwise the internal

+ information revealed could be of use to potential attackers. This point

+ applies more generally to all control packets, not just RSTs.

Do you think that's correct / sufficient?

Cheers

Bob

On 08/02/2021 21:03, Scheffenegger, Richard wrote:
> _______________________________________________
> tcpm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tcpm

-- 
________________________________________________________________
Bob Briscoe                               http://bobbriscoe.net/

---

From: "Scheffenegger, Richard" <[email-masked]>
Date: Tue, 9 Feb 2021 20:29:39 +0100

Sounds good to me!

Thanks for the quick turnaround!

Best regards,
    Richard

Am 09.02.2021 um 16:48 schrieb Bob Briscoe:
> Bob Briscoehttp://bobbriscoe.net/
>