Re: [tcpm] Congestion control in face of ICMP unreachable messages

Hi, Daniel,

Daniel Schaffrath wrote:
> 
> On 2007/09/07  , at 16:13, Joe Touch wrote:
>> Daniel Schaffrath wrote:
>>> On 2007/08/17  , at 18:41, Joe Touch wrote:
>>>> AFAIK, congestion control response to in-band messages (ACKs) and
>>>> timeouts (implied loss, as TCP interprets it), as well as to some new
>>>> fields (ECN, etc.) which are carried in the same packets.
>>>>
>>>> Reactions to external congestion signals - ICMP source quench (which
>>>> has
>>>> been informally deprecated a while ago, but has not been documented as
>>>> such yet) or otherwise - would constitute another opportunity for a DOS
>>>> attack, and seem like a bad idea to encourage.
>>>
>>> I am note sure your security concerns really apply :) If the bad user
>>> controls the forwarding node, there is no need to rely on ICMP message
>>> to cause harm. Instead, just dropping random segments would do the job.
>>> If the bad user is off the forwarding node, she would need (as usual)
>>> guess port and sequence numbers.
>>
>> Only port numbers. Sequence numbers strictly don't matter for ICMPs.
> But that is under way, if I am not mistaken
> (draft-ietf-tcpm-icmp-attacks-02). And Linux for instance already
> implements it...

I've already spoken about this at previous IETFs and on this list. The
basic summary:
- the network is under no obligation to respond with ICMPs within one RTT
- as a result, checking to ensure that ICMPs are in-window is incorrect
as it will drop legitimate responses - or worse, interpret them as attacks

The fact that an I-D remains on this point and that Linux implements it
does not change the above.

>>> If she is able to guess right, she
>>> might as well opt to send forged ACK dupacks to cause harm, or for an
>>> ECN capable transport just one ECE marked ACK.
>>
>> ICMPs don't need to come from the endpoint IP address, i.e., address
>> verification will prevent spoofed ACKs, but cannot prevent ICMPs, since
>> the latter need not have spoofed source addresses.
>
> Ok, but if a router is (potentially) able to check for spoofed IP source
> addresses it could as well check for spoofed/illegal ICMP payloads
> (which contain both IP addresses) . Isn't that true?

Routers can check for spoofed addresses as they enter protected regions
of the Internet; if there's a hole in that 'fence' however, packets can
leak in. Once in, they can't necessarily be checked for spoofed
addresses unless they're authenticated, and most are not.

> Apart from that: how common is it to drop spoofed datagrams? It's
> probably a idealistic assumption, isn't it?

In general, yes. You can't assume that spoofed packets are dropped.

Joe

-- 
----------------------------------------------------------------------
Joe Touch                Sr. Network Engineer, USAF TSAT Space Segment
               Postel Center Director & Research Assoc. Prof., USC/ISI

Re: [tcpm] Congestion control in face of ICMP unreachable messages

Attachment: signature.asc