Re: [tcpm] comments on draft-ietf-tcpm-icmp-attacks-05

[Fernando Gont <[e-mail]>]

Joe Touch wrote:

>>> 5) (general) Section 5.1, last paragraph, it
>>> seems like we should be mentioning TCP-AO as
>>> well here, though I don't think it changes any
>>> part of the claim.
>> Agreed. Maybe this is also an indication that TCP-AO *should* change
>> something in this respect!
> 
> TCP-AO already addresses ICMP attacks in the security considerations
> section, and requires there to be a way to disable reaction to ICMPs.
> Like IPsec, though, we don't make a-priori assessments as to whether
> ICMPs should be blocked or not on connections on which TCP-AO (or IPsec)
> is used.

IIRC, the motivation for the TCP MD5 option was to mitigate RST-based
reset attacks. Does it make any sense to have the option and still even
consider reacting to ICMP error messages?

Reaction to ICMP "frag needed" is probably a little more difficult to
assess (for obvious reasons), but reaction to ICMP hard errors is, IMO,
a no-brainer, and I believe should default to "SHOULD NOT abort
connections".

Kind regards,
-- 
Fernando Gont
e-mail: [e-mail] || [e-mail]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1