Re: [TLS] Record layer corner cases

["Steven M. Bellovin" <smb at cs.columbia.edu>]

On Mon, 27 Nov 2006 19:10:42 -0700
"Kyle Hamilton" <aerowolf at gmail.com> wrote:

> On 11/27/06, Peter Gutmann <pgut001 at cs.auckland.ac.nz> wrote:
> 
> > I don't handle it at all, if my code sees OOB data in the middle of
> > a TLS stream it flags it as a network-level error (my security
> > model is default- deny).  I've never seen OOB data used and can't
> > imagine why it'd ever be used except as a potential attack vector
> > targetting corner cases in TLS implementations.
> 
> Evidently you've never used SIGURG, nor seen urgent data sent (that
> which causes TCP PSH headers to be generated in BSD-type stacks).  I'd
> like to see the discussions from when TCP was designed as to what it
> was designed to be used for -- it would seem to be for metadata
> involving the connection.  (This is akin to the TLS record protocol
> being used to request a rehandshake, since the TLS implementation
> consumes those records.)
> 
First, that's not what cause the push bit to be set.  PSH is set when
there's nothing pending to be written.  More precisely, it's set to
zero when a packet is sent and the stack knows that there's nothing
else about to be sent.  Here's the comment and code in NetBSD's
tcp_output.c:

                /*
                 * If we're sending everything we've got, set PUSH.
                 * (This will keep happy those implementations which
only 
                 * give data to the user when a buffer fills or
                 * a PUSH comes in.)
                 */ 
                if (off + len == so->so_snd.sb_cc)
                        flags |= TH_PUSH;

Second, and more important, it was intended to be sent when the user had
hit BREAK on their ASR-35 Teletypes or ATTN on their IBM 2741s -- see
RFC 764.  It was part of the "flush all buffers until the urgent
pointer" mechanism; TCP Urgent is ill-suited to anything else, since
(as is noted in the RFC) multiple urgent pointers pending at the same
time are coalesced.

The only other place I can recall seeing it used was for window size
change notifications in rlogin.  Rlogin did not make suitable provision
(more accurately, did not make any useful provision) for any sort of
connection metadata; the implementors of later versions fell back on
TCP Urgent when it became important to do *something*.


		--Steve Bellovin, http://www.cs.columbia.edu/~smb

_______________________________________________
TLS mailing list
TLS at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls