[e2e] Receiving RST on a MD5 TCP connection.

[Joe Touch]

See http://www.ietf.org/internet-drafts/draft-ietf-tcpm-tcp-antispoof-01.txt

This includes a summary of the issues, and alternate approaches.

Joe

Tapan Karwa wrote:
> Hi,
> 
> I was going through RFC 2385 - Protection of BGP
> Sessions via the TCP MD5 Signature Option
> 
> In Section 4.1, it mentions 
> "Similarly, resets generated by a TCP in response to
> segments sent on a stale connection will also be
> ignored. Operationally this can be a problem since
> resets help BGP recover quickly from peer crashes."
> 
> This can easily happen in the following scenario :
> XX is talking to YY and both are using MD5. YY
> suddenly reboots but XX does not know about it yet. XX
> sends the next segment to YY with the MD5 digest but
> YY does not recognize it and hence sends a RST. Of
> course this RST segment does not have the MD5 digest.
> 
> Even when XX receives the RST, it wont/cant close the
> connection since it will trash the packet as it does
> not have the MD5 digest.
> 
> I was wondering if there is any solution to this
> problem. Will it be correct to accept the RST even if
> the MD5 digest is missing ? If we do that, can that
> open doors for some other attacks ?
> 
> Thanks,
> tapan.
> 
> 
> 		
> ____________________________________________________ 
> Yahoo! Sports 
> Rekindle the Rivalries. Sign up for Fantasy Football 
> http://football.fantasysports.yahoo.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 254 bytes
Desc: OpenPGP digital signature
Url : http://www.postel.org/pipermail/end2end-interest/attachments/20050630/05d6903d/signature.bin