IETF Logo Mail Archive

Re: [tcpm] TCP-AO and ICMP attacks (was Re: comments on draft-ietf-tcpm-icmp-attacks-05)

Fernando Gont <fernando@gont.com.ar> Wed, 17 June 2009 01:00 UTC

Return-Path: <fernando.gont.netbook.win@gmail.com>
X-Original-To: tcpm@core3.amsl.com
Delivered-To: tcpm@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D7B903A6880 for <tcpm@core3.amsl.com>; Tue, 16 Jun 2009 18:00:56 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.188
X-Spam-Level:
X-Spam-Status: No, score=-2.188 tagged_above=-999 required=5 tests=[AWL=0.411, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nyHBI7P160ns for <tcpm@core3.amsl.com>; Tue, 16 Jun 2009 18:00:56 -0700 (PDT)
Received: from mail-yx0-f131.google.com (mail-yx0-f131.google.com [209.85.210.131]) by core3.amsl.com (Postfix) with ESMTP id 03A3E3A6C5A for <tcpm@ietf.org>; Tue, 16 Jun 2009 18:00:55 -0700 (PDT)
Received: by yxe37 with SMTP id 37so412978yxe.15 for <tcpm@ietf.org>; Tue, 16 Jun 2009 18:01:05 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:sender:message-id:date:from :user-agent:mime-version:to:cc:subject:references:in-reply-to :x-enigmail-version:openpgp:content-type:content-transfer-encoding; bh=1ot5MnJ9Xil8A6v6A+ATTpiGd8y5rdYhU01D/ST8Iq8=; b=vgumH/5u1Fni6EMCcM+B5TKjEs23nxYB1T1hOBC7davyaUlL5vjf0cc+Nkgbn/n+MQ +X4K4wTn18aYeRDykPLDmfsIhZEgfnr5nEM1dD4lYh2Ahouzym14vZ28jzxtbeESW42K UzWBiCApB6ks5u8FZBhg0c+umTStuEQYuicKM=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=sender:message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:x-enigmail-version:openpgp:content-type :content-transfer-encoding; b=PhCPfJvo3dhzRUhRsLSw4VpKxTZ2VQn5e8OFuWqfryW957O5k6zokHeSdt18gLVxXK A4m+apvQo2+11iE+esxp3dvJTU/qyhA8884xtD9/lLlq183cY+Xfbq8W90Qvx5ubbXbx EaW9okw0J65IpgnKkjU2K4aROlrtzMe1TGo28=
Received: by 10.90.70.15 with SMTP id s15mr3839849aga.60.1245199694152; Tue, 16 Jun 2009 17:48:14 -0700 (PDT)
Received: from ?190.48.255.49? ([190.48.255.49]) by mx.google.com with ESMTPS id 38sm678134aga.41.2009.06.16.17.48.09 (version=TLSv1/SSLv3 cipher=RC4-MD5); Tue, 16 Jun 2009 17:48:13 -0700 (PDT)
Sender: Fernando Gont <fernando.gont.netbook.win@gmail.com>
Message-ID: <4A383D44.4050103@gont.com.ar>
Date: Tue, 16 Jun 2009 21:48:04 -0300
From: Fernando Gont <fernando@gont.com.ar>
User-Agent: Thunderbird 2.0.0.21 (Windows/20090302)
MIME-Version: 1.0
To: Joe Touch <touch@ISI.EDU>
References: <C304DB494AC0C04C87C6A6E2FF5603DB221796D53C@NDJSSCC01.ndc.nasa.gov> <4A30BED6.3050308@gont.com.ar> <4A32BD5F.5030503@isi.edu> <4A379700.3070808@gont.com.ar> <4A37A551.60800@isi.edu> <4A37D6FC.4040005@gont.com.ar> <4A37E494.60904@isi.edu> <4A37EDEC.1030908@gont.com.ar> <4A38078F.2040703@isi.edu> <4A38191D.4010604@gont.com.ar> <4A382448.7080705@isi.edu> <4A382A08.1020302@gont.com.ar> <4A383539.3080403@isi.edu>
In-Reply-To: <4A383539.3080403@isi.edu>
X-Enigmail-Version: 0.95.7
OpenPGP: id=D076FFF1
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 7bit
Cc: "tcpm@ietf.org" <tcpm@ietf.org>, Fernando Gont <fernando.gont@gmail.com>
Subject: Re: [tcpm] TCP-AO and ICMP attacks (was Re: comments on draft-ietf-tcpm-icmp-attacks-05)
X-BeenThere: tcpm@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: TCP Maintenance and Minor Extensions Working Group <tcpm.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/tcpm>, <mailto:tcpm-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tcpm>
List-Post: <mailto:tcpm@ietf.org>
List-Help: <mailto:tcpm-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tcpm>, <mailto:tcpm-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 17 Jun 2009 01:00:56 -0000

Joe,

> I think we both agree that the text on ICMP handling should be moved out
> of the security considerations section and put it its own section.

Agreed.


> You prefer defaults, and are recommending ICMP handling similar to that
> in documents the WG has decided not to recommend for TCP not running AO.

Yes. Note that virtually all real implementations already do this for
connections that do not use TCP-AO. Nobody is going to change this for
non-TCP-AO, or even less abort TCP-AO connections in response to ICMP
error messages.



> I want to leave TCP-AO's handling of ICMPs the same as IPsec's - up to
> the user.

Just making my point clear: I think leaving unspecified what to do with
ICMP errore messages would be a bad decision. It might end up with
implementations honoring these error messages, which would mean that
TCP-AO would be (by default) useless for protecting TCP against
ICMP-based reset attacks.

Thanks,
-- 
Fernando Gont
e-mail: fernando@gont.com.ar || fgont@acm.org
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

v2.23.0 | Report a Bug | By Email