Re: [tcpm] ICMP attacks draft (issue 3): TCP SEQ check

Fernando Gont wrote:
> Folks,
> 
> Issue 3: The draft proposes to check the TCP sequence number contained
> in the payload of the ICMP messages.
> The idea is that errors should be caused by segments that have been
> sent, but not yet acknowledged.
> 
> This is a general check, which check for the staleness of the error
> messages. We are performing the same check for TCP segments, so why not
> perform the same check for errors that are supposed to have been
> elicited by the connection?

TCP checks the checksum AND MD5 option (if the latter exists) first; if
you do these checks first, then it is OK to check the SEQNUM. If not
enough of the segment exists to do so, then it is incorrect to interpret
any of the rest of the fields.

> Linux has been performing this check for years. OpenBSD has been
> performing this check for more than a year. FreeBSD and NetBSD have been
> performing this check for several months now.

The fact that many people implemented TCP bugs incorrectly warranted a
document on why what they did was incorrect, not a document to validate
it - regardless of the lack of noted errors. The statement above is not
germane to this dicussion.

Joe

Re: [tcpm] ICMP attacks draft (issue 3): TCP SEQ check

Attachment: signature.asc