18.2 Information carried in the Transport Header
18.2 Information carried in the Transport Header
For TCP, an ECN-capable TCP receiver notifies its TCP peer in the TCP header at connection establishment that it supports ECN at the TCP level. This document does not consider the potential hazards introduced by changes in the network to the transport header. We note that when IPsec is used, the transport header is protected in both tunnel and transport mode [ESP, AH].
Another issue concerns TCP packets with forged IP source addresses that carry invalid ECN information in the transport header. For completeness, we examine here some of the possible ways that a node forging the IP source address of another node could use the two ECN flags in the TCP header to launch denial-of-service attacks. However, these attacks require that the attacker have access to valid TCP sequence numbers, and any attacker with this capability and the ability to forge IP source addresses could compromise the TCP connection without using ECN flags. Thus, ECN does not add any new vulnerabilities in this regard.
Acknowledgement packets with a forged IP source address of the TCP data receiver might include the ECE bit set. If accepted by the TCP data sender as a valid packet, this forged acknowledgement packet could cause the TCP data sender to unnecessarily halve its congestion window. However, to be accepted by the data sender, such a forged acknowledgement packet would have to have the correct 32-bit sequence number as well as a valid acknowledgement number. An attacker capable of successfully sending such a forged acknowledgement packet could also send a forged RST packet, or perform other equally harmful operations on the TCP connection.
Data packets with a forged IP source address of the TCP data sender might include the CWR bit set. Again, to be accepted, such a packet would have to have a valid sequence number. In addition, the performance impact of such a forged packet is limited. A forged packet with the CWR bit set could cause the TCP data receiver to send fewer ECE packets than it otherwise would, if the data receiver was sending ECE packets at the time of receiving the forged CWR packet.