Subject: Re: Segments with no flags set

From: der Mouse <[email-masked]>
Date: Wed, 30 May 2001 17:45:21 -0400 (EDT)

> I recently encountered an interoperability problem [] where [a] VoIP
> box would begin to send segments with no flags set (including ACK)
> over an established session.

RFC793 says (page 16)

  Acknowledgment Number:  32 bits

    If the ACK control bit is set this field contains the value of the
    next sequence number the sender of the segment is expecting to
    receive.  Once a connection is established this is always sent.

Note the last sentence.

Page 66 also says

        Any other control or text-bearing segment (not containing SYN)
        must have an ACK and thus [...]

The SEGMENT ARRIVES processing, starting at the top of page 65,
continues for several pages; at the top of page 72, it is clear that a
segment arriving on an established connection with no ACK (but
otherwise unremarkable) should be summarily dropped.  Page 69 begins
the discussion for most TCBs states, including ESTABLISHED; in order:
	- first, check sequence numbers (segment length, window)
	- second, check for RST
	- third, check security and precedence
	- fourth, check SYN
	- fifth, check the ACK bit
	  "if the ACK bit is off drop the segment and return"

Payload processing does not occur until the seventh step.

So the VoIP box will have those packets summarily dropped by a
conforming peer, with or without a firewall in the way.

Unless some later RFC has updated 793 on this point.  I don't see
anything in the index that "Updates" or "Obsoletes" 793....

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       [email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B

---

From: "Abolade Gbadegesin" <[email-masked]>
Date: Wed, 30 May 2001 14:50:54 -0700

RFC 793, section 3.7, paragraph 3:
  
  "... Note that once in the ESTABLISHED state all
  segments must carry current acknowledgment information."

ibid., section 3.9, page 72:

"SEGMENT ARRIVES
  ...
    fifth check the ACK field,

      if the ACK bit is off drop the segment and return"

-----Original Message-----
From: David S. Miller [mailto:[email-masked]] 
Sent: Wednesday, May 30, 2001 2:20 PM
To: [email-masked]
Cc: IETF TCP WG
Subject: Re: Segments with no flags set

[email-masked] writes:
 > I recently encountered an interoperability problem between a firewall
and a
 > Voice-over-IP hardware device (with embedded TCP stack), where the
VoIP box
 > would begin to send segments with no flags set (including ACK) over
an
 > established session.  Although I've never observed such use of TCP
before,
 > I can't find hard evidence that indicates it is a violation of spec.
Can
 > anyone confirm if this is truly against the law?

I don't see how it could be illegal, if the ACK flag bit is clear this
simply means to ignore the ACK field.

I suppose a firewall vendor could claim that this provides a 32-bit
field in which to create a covert channel of information, but the URG
field can already be (and honestly, by hardcore crackers probably is)
used for this purpose :-)

Later,
David S. Miller
[email-masked]