Re: [tcpm] feedcback on tcp-secure-05: suggested text

At 21:07 18/07/2006, Ted Faber wrote:

>On Tue, Jul 18, 2006 at 08:32:01PM -0300, Fernando Gont wrote:
> > RFC 4301 never states that ICMP messages should be filtered. And its
> > clear from this last paragraph that a number of behaviours (including
> > "act on it with constraints") are among the possibilities.
>
>Fine.  Try the attached.
>
>I'm happy to add an explicit reference to the attacks draft if it can be
>phrased in such a way that it does not link the publication of the two.
>Feel free to send text.

I'd change the text to:

"Implementors should be aware that the attacks detailed in this
specification are not the only attacks available to an off-path attacker
and that the countermeasures described herein are not a comprehensive
defense against such attacks.

In particular, administrators should be aware that forged ICMP messages
provide off-path attackers the opportunity to disrupt connections or
degrade service.  Such packets may be subject to even less scrutiny than
those required for the TCP attacks addressed here, especially in 
stacks not tuned for
hostile environments.

This RFC details only part of a complete strategy to
prevent off-path attackers from disrupting services that use TCP.
Administrators and implementors should consider the other attack vectors
and determine appropriate mitigations in securing their systems.

[antispoof] provides a detailed discussion of TCP attacks based on 
forged TCP segments, along with
a discussion on the possible counter-measures.  [ICMP-attacks] 
provides a detailed discussion on TCP attacks based
on forged ICMP packets, along with the possible counter-measures."

Note that I basically removed text, and added references. And that 
the references are included in a way in which there's no "requirement".

Kindest regards,

--
Fernando Gont
e-mail: fernando@gont.com.ar || fgont@acm.org
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www1.ietf.org/mailman/listinfo/tcpm