Re: [tcpm] Some comments on tcpsecure

On Fri, Apr 04, 2008 at 01:21:27PM -0700, Joe Touch wrote:
> 
> 
> Fernando Gont wrote:
> >At 04:55 p.m. 04/04/2008, Joe Touch wrote:
> >
> >>>The first one is the ICMP attacks draft 
> >>>(draft-ietf-tcpm-icmp-attacks). While tcpsecure mentions the security 
> >>>implications of ICMP on TCP conenctions, it does not reference the 
> >>>I-D. IIRC, this had already been pointed out by Joe (?). As far as 
> >>>the specifications are concerned, you shouldn't bother to fix 
> >>>TCP-based reset attacks if you don't fix the the ICMP-based ones.
> >>
> >>Agreed; should this doc recommend filtering out ICMPs as a result? 
> >>(there's no in-window checks that are meaningful, since ICMPs are not 
> >>guaranteed to be timely) I.e., something stronger than "there's 
> >>nothing we can do", which is what is implied in the current security 
> >>considerations.
> >
> >Ha... So we have been arguing about the ICMP stuff for almost four years 
> >on the idea that it is too aggressive to require ICMP error messages to 
> >be in-window, and now we're going to propose to filter them out? 
> 
> ICMPs are already filtered out for security reasons at firewalls. The 
> key here is whether to recommend that action or not.

And, IMHO, hat off, we're not.  Not here anyway.

This document has generated enough controversy on its own.  Hitching it
to another controversial document guarantees even slower progress.
Point off to the other documents that discuss the ICMP problem and move
on.  Yes there's a huge hole that someone's network architect needs to
plug, but the purpose of this document is not to be that architect; the
purpose of this document is to specify a standard protocol extension to
address the problem of off-path TCP control message spoofing.  Pointing
off to documents that discuss other problems in detail is helpful and
useful.

IMHO.

-- 
Ted Faber
http://www.isi.edu/~faber           PGP: http://www.isi.edu/~faber/pubkeys.asc
Unexpected attachment on this mail? See http://www.isi.edu/~faber/FAQ.html#SIG