Re: [tcpm] TCP-AO and ICMP attacks (was Re: comments on draft-ietf-tcpm-icmp-attacks-05)

[Fernando Gont <[e-mail]>]

Joe Touch wrote:

>> I think that for the sake of the "principle of least surprise", ICMP
>> hard errors SHOULD NOT abort connections for which TCP AO has been enabled.
> 
> Please explain why you think that TCP-AO needs more strict advice in
> this regard than IPsec.

Because TCP-AO is TCP-specific. IPsec is not. The term "TCP" is almost
not even mentioned in RFC 4301. So it wouldn't make sense for RFC 4301
to get into the details of how a specific transport protocol (TCP) would
react to specific ICMP error messages.

In the case of TCP-AO, it's TCP specific, and thus I believe it should
provide stricter advice wrt how TCP should react to ICMP error messages
when they are received for connections that employ TCP-AO.



>> What to do with "frag needed" might vary. Although one could argue that
>> you SHOULD implement PLPMTUD.
> 
> ---
> 
> We could add that TCP-AO, like IPsec (text copied from 4301):
> 
>    ...A compliant TCP-AO
>    implementation MUST permit a local administrator to configure an
>    IPsec implementation to accept or reject unauthenticated ICMP
>    traffic.  This control MUST be at the granularity of ICMP type and
>    MAY be at the granularity of ICMP type and code.  Additionally, an
>    implementation SHOULD incorporate mechanisms and parameters for
>    dealing with such traffic.  For example, there could be the ability
>    to establish a minimum PMTU for traffic (on a per destination basis),
>    to prevent receipt of an unauthenticated ICMP from setting the PMTU
>    to a trivial size.

Makes sense to me. Although, again, I believe there should be (safe)
defaults for this.


> We can add a discussion of PLPMTUD, but rfc4821 doesn't have any
> particular recommendations of implementation. We would need to be
> careful to not tie TCP-AO to PLPMTUD in a way that impedes TCP-AO
> deployment.

I believe it could/should be suggested that PLPMTUD be implemented
without support for ICMP frag needed (i.e., ignore them). (FWIW, RFC4821
leaves it open as to whether PMTUD should only be implemented for
dealing with ICMP blackholes, or as an ICMP-free version of PMTUD).

Thanks!

Kind regards,
-- 
Fernando Gont
e-mail: [e-mail] || [e-mail]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1