Re: [tcpm] TCPM and draft-ietf-tcpm-icmp-attacks

[Joe Touch <[e-mail]>]

Hi, Jari,

Jari Arkko wrote:
> Hi,
> 
> This document was recently in IESG review. My opinion is that the
> document should be approved as an RFC. Thanks for writing it.
> 
> However, I would like to note the following text from the document:
> 
> The consensus of the TCPM WG (TCP Maintenance and
> Minor Extensions Working Group) was to document this widespread
> implementation of nonstandard TCP behavior but to not change the TCP
> standard.
> 
> This would seem to imply that the TCPM WG has decided to deviate from
> the old IETF operating principle of "rough consensus and running code".
> For at least some of the techniques described in this draft, they are
> generally accepted and widely implemented on key implementations. I ask
> what the reason is for divorcing IETF standards from established best
> practices and actual running code? TCP RFCs are not sacred documents,
> they should reflect what we want our implementations to do. But maybe
> there are important use cases for the actual standard TCP behavior in
> this space, just that I don't know about them. Please educate me about
> the background for this decision.

The issue, from my view, in TCPM has been a penchant for trying to
upturn a long history of "be liberal in what you receive" to react to a
number of specific recent threats to TCP.

Much of this "rush to react" has led to a perspective that any incoming
packet that isn't expected is an indication of *attack*. That could
easily lead to changes to TCP that make it inappropriately complex and
fragile, at the expense of protecting every home computer from attacks
that are typically waged only at routers or other core network components.

I agree with Wes that the role of ICMP in the Internet needs to be
re-examined, and some changes made. However, I also believe that many of
the current TCPM "rush to react" changes (including tcpsecure, some of
the ICMP checks, some parts of the TCP cookie transactions proposal) are
a poor substitute for the use of true security (IPsec, TCP-AO), which
may also need to include more widely-deployable variants with different
levels of protection (e.g., BTNS).

Yes, I have been the most vocal proponent of this view on TCPM, and
perhaps in TSV. I do not believe I represent only myself, however - if
that's the "rough consensus", there are mechanisms to override me
anyway. It's also useful to note that some of the most vocal proponents
of "it's deployed, so let's change the standard" were involved in their
deployment.

TCP, IMO, ought to be treated with a lot more careful consideration than
that.

Joe