Re: [tcpm] Some comments on tcpsecure

[Joe Touch <[e-mail]>]

Ted Faber wrote:
> On Fri, Apr 04, 2008 at 01:21:27PM -0700, Joe Touch wrote:
>>
>> Fernando Gont wrote:
>>> At 04:55 p.m. 04/04/2008, Joe Touch wrote:
>>>
>>>>> The first one is the ICMP attacks draft 
>>>>> (draft-ietf-tcpm-icmp-attacks). While tcpsecure mentions the security 
>>>>> implications of ICMP on TCP conenctions, it does not reference the 
>>>>> I-D. IIRC, this had already been pointed out by Joe (?). As far as 
>>>>> the specifications are concerned, you shouldn't bother to fix 
>>>>> TCP-based reset attacks if you don't fix the the ICMP-based ones.
>>>> Agreed; should this doc recommend filtering out ICMPs as a result? 
>>>> (there's no in-window checks that are meaningful, since ICMPs are not 
>>>> guaranteed to be timely) I.e., something stronger than "there's 
>>>> nothing we can do", which is what is implied in the current security 
>>>> considerations.
>>> Ha... So we have been arguing about the ICMP stuff for almost four years 
>>> on the idea that it is too aggressive to require ICMP error messages to 
>>> be in-window, and now we're going to propose to filter them out? 
>> ICMPs are already filtered out for security reasons at firewalls. The 
>> key here is whether to recommend that action or not.
> 
> And, IMHO, hat off, we're not.  Not here anyway.

If that's the case, then what's the point of protecting TCP this way?

If ICMPs aren't filtered out, then they remain a simpler attack vector, 
and thus the protections afforded are moot.

Joe

_______________________________________________
tcpm mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/tcpm