RFC 964
Some problems with the specification of the Military Standard Transmission Control Protocol
RFC 964: SOME PROBLEMS WITH THE SPECIFICATION OF THE MILITARY STANDARD TRANSMISSION CONTROL PROTOCOL 🎀
Okay bestie, this one is from the Network Working Group, written by Deepinder P. Sidhu and Thomas P. Blumer, both at SDC - A Burroughs Company, dated November 1985. 💅 Their whole thing is picking apart the MIL standard TCP spec. The title block doesn't list anything it obsoletes or updates, and it doesn't name a category, so no extra drama there 🫶
STATUS OF THIS MEMO 📜
The purpose of this RFC is to give you helpful info on the Military Standard Transmission Control Protocol (MIL-STD-1778) so you can get a reliable implementation of this protocol standard. Distribution of this note is unlimited. 🦋
Reprinted from: Proc. Protocol Specification, Testing and Verification IV, (ed.) Y. Yemini, et al, North-Holland (1984).
ABSTRACT 🔥
Okay so this note points out three errors in the specification of the Military Standard Transmission Control Protocol (MIL-STD-1778, dated August 1983 [MILS83]). 😭 It's based on an initial look at this protocol standard. The first problem is that data riding along with a SYN can not be accepted, because the acceptance policy has errors. The second problem is that no retransmission timer is set for a SYN packet, so if it gets lost, it won't be retransmitted, which is so not it 💀 The third problem is that once the connection is established, neither entity takes the proper steps to accept incoming data. The note also proposes solutions to all of these problems ✨
1. Introduction ✨
Lowkey, a lot of progress has been made in building an integrated set of tools for developing reliable communication protocols 🛠️ These tools help with the specification, verification, implementation and testing of protocols, and several protocols have already been analyzed and developed using them. 🌈
In a recent paper, the authors talked about verifying the connection management of the NBS class 4 transport protocol (TP4). That verification was done with the help of a software tool they built [BLUT82] [BLUT83] [SIDD83]. Even though TP4 has a very precise specification, their analysis still found several errors in the current spec. These are incompleteness errors, meaning there are states where there's no transition for the reception of some input event 🙈 Their analysis did not find deadlocks, livelocks or any other problem in the connection management of TP4. In that paper they proposed solutions for all the errors except the ones tied to 2 states, whose proper fix might mean redesigning parts of TP4. Changes to the TP4 spec are currently underway to solve the remaining incompleteness problems with those 2 states. It's important to emphasize that they did not find any obvious error in the NBS specification of TP4 💖
The authors are currently working on verifying the connection management of the Military Standard Transmission Control Protocol (TCP). This analysis will be based on the published specification [MILS83] of TCP dated 12 August 1983 🧚
While studying the MIL standard TCP spec to get ready for that analysis, they noticed several errors in it. Because of these errors, the Transmission Control Protocol (as specified in [MILS83]) will not permit data to be received by TCP entities in the SYN_RECVD and ESTAB states. Not me, bestie 😭
The proof of this statement comes from the spec of the three-way handshake mechanism of TCP [MILS83] and from a decision table associated with the ESTAB state 🎀
2. Transmission Control Protocol 🌸
The Transmission Control Protocol (TCP) is a transport level, connection-oriented protocol in the DoD protocol hierarchy, made for use in packet-switched and other networks. Its most important services are reliable transfer and ordered delivery of data over full-duplex and flow-controlled virtual connections. TCP is designed to work successfully over channels that are inherently unreliable, meaning they can lose, damage, duplicate, and reorder packets. It's giving main character energy for dealing with messy networks 👑
TCP is based, in part, on a protocol discussed by Cerf and Kahn [CERV74]. Over the years DARPA has supported specifications of several versions of this protocol, and the last one appeared in [POSJ81]. Some issues in the connection management of this protocol are discussed in [SUNC78] 🍓
A few years ago, DCA decided to standardize TCP for use in DoD networks, and it supported a formal specification of this protocol following the design discussed in [POSJ81]. A detailed specification of this protocol, given in [MILS83], has been adopted as the DoD standard for the Transmission Control Protocol, a reliable connection-oriented transport protocol for DoD networks 💅
A TCP connection goes through three phases: opening (or synchronization), maintenance, and closing. In this note we look at data transfer during the opening and maintenance phases of the connection 💜
3. Problems with MIL Standard TCP 💀
One basic feature of TCP is the three-way handshake, which is used to set up a properly synchronized connection between two remote TCP entities. Okay, so this mechanism is incorrectly specified in the current TCP spec 🙈 One problem is that data associated with the SYN packet can not be delivered. This comes from an incorrect spec of how the accept_policy action procedure and the record_syn action procedure interact. Neither of the 2 possible strategies suggested in accept_policy gives the correct result when it's called from the record_syn procedure, because the recv_next variable gets updated in record_syn before accept_policy is called. Literally a timing mess 😭
Another problem with the three-way handshake spec shows up in the actions listed for the Active Open event (with or without data) when in the CLOSED state. No retransmission timer is set in these actions, so if the initial SYN is lost, there will be no timer expiration to trigger a retransmission. This will prevent connection establishment if the network loses the initial SYN packet 🥺
The third problem is that the actions for receiving data in the ESTAB state are incorrect. The accept action procedure must be called when data is received, so that arriving data can be queued and possibly passed to the user ✨
A general problem with this spec is that the program language and action table portions were clearly not checked by any automatic syntax checking process. Several variable and procedure names are misspelled, and the syntax of the action statements is often incorrect. This can be confusing, especially when a procedure name can't be found in the alphabetized list of procedures because of a misspelling 🌈
These are some of the very serious errors that they discovered with the MIL standard TCP 🔥
4. Detailed Discussion of the Problem ✨
okay so this part is where we get into the nitty gritty 💅 we're looking at 3 problems, and we're gonna trace exactly what happens to each entity, step by step, bestie 🔍
Problem 1: Problem with Receiving Data Accompanying SYN 🎀
okay so the scenario here traces what 2 communicating entities do while they set up a connection. we're only looking at the simplest case, where the connection gets set up by swapping 3 segments 🤝
TCP entity A TCP entity B
------------ ------------
state segment segment state
transition recvd or sent recvd or sent transition
by A by B
CLOSED -> LISTEN
CLOSED -> SYN_SENT SYN -->
SYN --> LISTEN -> SYN_RECVD
<-- SYN ACK
SYN_SENT -> ESTAB <-- SYN ACK
ACK -->
ACK --> SYN_RECVD -> ESTABas the diagram shows, there are 5 state transitions and 3 TCP segments in the simplest version of the three-way handshake 🦋 now we're gonna look at what each entity does during this exchange, and we're paying extra attention to the sequence numbers in every packet and in each entity's state variables 🔢
in the diagrams below, actions that happen inside a procedure are indented under the procedure call. the sequence number values that come out of each step are in square brackets on the right. entity A and entity B's variables get the entity name as a prefix, so the two sets of state stay easy to tell apart 🌈
Transition 1 (entity B goes from state CLOSED to state LISTEN). the user on entity B issues a Passive Open 🌸
Actions: (see p. 104)
open; (see p. 144)
new state := LISTEN;Transition 2 (entity A goes from state CLOSED to SYN_SENT). the user on entity A issues an Active Open with Data 🚀
Actions: (see p. 104)
open; (see p. 144)
gen_syn(WITH_DATA); (see p. 141)
send_isn := gen_isn(); [A.send_isn = 100]
send_next := send_isn + 1; [A.send_next = 101]
send_una := send_isn; [A.send_una = 100]
seg.seq_num := send_isn; [seg.seq_num = 100]
seg.ack_flag := FALSE; [seg.ack_flag = FALSE]
seg.wndw := 0; [seg.wndw = 0]
amount := send_policy() [assume amount > 0]
new state := SYN_SENT;Transition 3 (entity B goes from state LISTEN to state SYN_RECVD). entity B gets the SYN segment that carries data from entity A 📦
Actions: (see p. 106)
(since this segment has no RESET, no ACK, does have SYN, and
we assume reasonable security and precedence parameters, row
3 of the table applies)
record_syn; (see p. 147)
recv_isn := seg.seq_num; [B.recv_isn = seg_seq_num = 100]
recv_next := recv_isn + 1; [B.recv_next = 101]
if seg.ack_flag then
send_una := seg.ack_num; [no change]
accept_policy; (see p. 131)
Accept in-order data only:
Acceptance Test is
seg.seq_num = recv_next;
Accept any data within the receive window:
Acceptance Test has two parts
recv_next =< seg.seq_num =< recv_next +
recv_wndw
or
recv_next =< seg.seq_num + length =<
recv_next + recv_wndw
********************************************
An error occurs here, with either possible
strategy given in accept_policy, because
recv_next > seg.seq_num. Therefore
accept_policy will incorrectly indicate that
the data cannot be accepted.
********************************************
gen_syn(WITH_ACK); (see p. 141)
send_isn := gen_isn(); [B.send_isn = 300]
send_next := send_isn + 1; [B.send_next = 301]
send_una := send_isn; [B.send_una = 300]
seg.seq_num := send_next; [seg.seq_num = 301]
seg.ack_flag := TRUE; [seg.ack_flag = TRUE]
seg.ack_num := recv_isn + 1; [seg.ack_num = 102]
new state := SYN_RECVD;ngl this is where it all goes sideways 😭 the sequence number of the data is 100, but recv_next gets set to 101, so the check thinks the data is "from the past" and rejects it. yikes 💀
Transition 4 (entity A goes from state SYN_SENT to ESTAB). entity A gets the SYN ACK that entity B sent 🫶
Actions: (see p. 107)
In order to select the applicable row of the table on p.
107, we first evaluate the decision function
ACK_status_test1.
ACK_status_test1();
if(seg.ack_flag = FALSE) then
return(NONE);
if(seg.ack_num <= send_una) or
(seg.ack_num > send_next) then
return(INVALID)
else
return(VALID);
... and so on.the big thing to catch in this scenario is the error in transition 3 🙈 the wrong value of recv_next makes record_syn turn down the data it should have taken. periodt 💅
Problem 2: Problem with Retransmission of SYN Packet 🌧️
the actions listed for an Active Open (with or without data; see p. 103) are calls to the routines open and gen_syn. neither of those routines, nor any routines they call, explicitly sets a retransmission timer 😬 so if the very first SYN gets lost, nothing ever times out to trigger a resend of the SYN. if that happens, the TCP fails to set up the connection it wanted with the remote TCP. not it 😩
this is different from how data gets sent in the ESTAB state. there, the routine dispatch (p. 137) gets called first, and that calls send_new_data (p. 156). one of the things send_new_data does is start a retransmission timer for the newly sent data ⏰ so the SYN path really is missing a piece the data path has ✨
Problem 3: Problem with Receiving Data in TCP ESTAB State 🌊
when both entities are in ESTAB and one of them sends data to the other, a mistake in the receiver's actions stops the data from being accepted 🚫 here's a simple scenario: the user on entity A issues a Send request, and A sends the data to entity B. once B gets the data, it replies with an acknowledgment 💌
TCP entity A TCP entity B
------------ ------------
state segment segment state
transition recvd or sent recvd or sent transition
by A by B
ESTAB -> ESTAB DATA -->
DATA --> ESTAB -> ESTAB
<-- ACKTransition 1 (entity A goes from state ESTAB to ESTAB). entity A sends the data packet to entity B 📤
Actions: (see p. 110)
dispatch; (see p. 137)Transition 2 (entity B goes from state ESTAB to ESTAB). entity B receives the data packet from entity B (as written in the original) 📥
Actions: (see p. 111)
Assuming the data is in order and valid, we use row 6 of the
table.
update; (see p. 159)
************************************************************
An error occurs here, because the routine update does
nothing to accept the incoming data, or to arrange to
pass it on to the user.
************************************************************5. Solutions to Problems 🔧
the problem with record_syn and accept_policy can be solved by having record_syn call accept_policy before recv_next gets updated ✅
the problem with gen_syn can be fixed by having gen_syn or open explicitly request the retransmission timer ⏱️
the problem with receiving data in the ESTAB state seems to come from the action tables on pages 111 and 112 being swapped around 🔄 those tables should be interchanged. this fix also takes care of a related problem, which is that an entity can never get to the CLOSE_WAIT state from ESTAB 🙌
syntax errors in the action statements and tables could be caught easily by an automatic syntax checker, if the document used a more formal description technique. that would be hard to do for [MILS83], since the document isn't based on a formalized description technique [BREM83] 🤓
the errors pointed out in this note have been sent to DCA and will be fixed in the next update of the MIL STD TCP specification 🎉
6. Implementation of MIL Standard TCP 🛠️
in the discussion above, we pointed out several serious errors in the specification of the Military Standard Transmission Control Protocol [MILS83] 😱 these errors mean that a TCP implementation that faithfully follows the Military TCP standard won't be able to:
- Receive data sent with a SYN packet.
- Establish a connection if the initial SYN packet is lost.
- Receive data when in the ESTAB state.
it also follows from our discussion that an implementation of MIL Standard TCP [MILS83] has to include the corrections mentioned above to get a running TCP 💖
the problems this paper points out with the current specification of the MIL Standard TCP [MILS83] come from an initial investigation of this protocol standard by the authors 🦋
References 📚
[BLUT83] Blumer, T. P., and Sidhu, D. P., "Mechanical Verification
and Automatic Implementation of Authentication Protocols
for Computer Networks", SDC Burroughs Report (1983),
submitted for publication.
[BLUT82] Blumer, T. P., and Tenney, R. L., "A Formal Specification
Technique and Implementation Method for Protocols",
Computer Networks, Vol. 6, No. 3, July 1982, pp. 201-217.
[BREM83] Breslin, M., Pollack, R. and Sidhu D. P., "Formalization of
DoD Protocol Specification Technique", SDC - Burroughs
Report 1983.
[CERV74] Cerf, V., and Kahn, R., "A Protocol for Packet Network
Interconnection", IEEE Trans. Comm., May 1974.
[MILS83] "Military Standard Transmission Control Protocol",
MIL-STD-1778, 12 August 1983.
[POSJ81] Postel, J. (ed.), "DoD Standard Transmission Control
Protocol", Defense Advanced Research Projects Agency,
Information Processing Techniques Office, RFC-793,
September 1981.
[SIDD83] Sidhu, D. P., and Blumer, T. P., "Verification of NBS Class
4 Transport Protocol", SDC Burroughs Report (1983),
submitted for publication.
[SUNC78] Sunshine, C., and Dalal, Y., "Connection Management in
Transport Protocols", Computer Networks, Vol. 2, pp.454-473
(1978).📦 where this page comes from
- ietf: rfc964 1985-11
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms