Re: [tcpm] Some comments on tcpsecure

[Fernando Gont <[e-mail]>]

At 02:17 p.m. 05/04/2008, Joe Touch wrote:

>>>>And, for what is worth, strictly speaking there's no such a thing 
>>>>as a TCP MSL, either. TCP's MSL is based on the assumption that 
>>>>the IP TTL is decremented at least once every second. And this is 
>>>>not warranted, either. There's not such enforcement as there is 
>>>>in, e.g., Delta-t.
>>>
>>>If there's no MSL, then that's even more reason not to use window 
>>>information to determine the validity of an ICMP.
>>And no reason to use sequence numbers at all, and no reason for 
>>TCP's quiet time, and no reason for TCP's TIME-WAIT state, etc., 
>>etc., etc. From that purist (??) point of view, TCP would not even work at all.
>
>Absolutely - that's the absurdity of *your* point about there being 
>no such thing as MSL. However, MSL is irrelevant to ICMP even if 
>(contrary to your point above) MSL is meaningful to TCP.

The ICMP attacks drafts used to propose (unfortunately, right now it 
only "documents") a number of mitigation techniques for ICMP-based 
attacks. Among these were:

1) Require ICMP messages to be in window.
2) Don't reset connections in the synchronized (>ESTABLISHED) states 
upno receipt of the so-called ICMP hard errors.

You argument against (1) is that there's not such a timing 
requirement for ICMP messages. If that's your argument, then please 
also propose to remove any sequence number checks and any other 
assumptions on the MSL (e.g., quiet time concept, TIME-WAIT state) 
that are based on timing assumptions of TCP segments (and hence IP 
datagrams) that are *not* required in the protocols, *either*. Or 
well, that at least cannot be enforced. (Again, if you want this, you 
want something like Delta-t).

Your argument against (2) is that...mmm... that would be incorrect, 
because it would assume that every packet is an attack. But you do 
want to advocate ICMP filtering at firewalls.

I'd love to get everybody who's everyday job is to work on the TCP 
code of real TCP stacks. But while I have been in contact with many 
of these people (both for the I-Ds I published at the IETF, and for 
other work), the general idea is that it is a waste of time to argue 
for years what everybody has already been doing for years now (not to 
say 20+ years).

The only real discussion here is how irrelevant we want the IETF specs to be.

Kind regards,

--
Fernando Gont
e-mail: [e-mail] || [e-mail]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1




_______________________________________________
tcpm mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/tcpm