Re: [tcpm] Some comments on tcpsecure

[Joe Touch <[e-mail]>]

Fernando Gont wrote:
> At 05:36 p.m. 05/04/2008, Joe Touch wrote:
> 
>> As I said before:
>>
>>         TCP *has* an MSL requirement (RFC793)
>>                 this means that TCP segments should not live
>>                 in the network beyond approx 2 minutes
> 
> Yes, and this requirement cannot be met, as it is based on the 
> assumption that the IP TTL can be enforced. (Not to say that the MSL 
> sort of imposes a requirement on the TTL you set in IP packets. If you 
> set a TTL of say 240, then the TTL becomes 4 minutes, and 2*MSL becomes 
> eight minutes.
> 
> As a result, if anything, this is as incorrect as requiring ICMPs to be 
> in window. Well, unless you run TCP on anything other than IP....

If you want to win this part of the argument, then - as you note - 
window information is never useful within TCP. What's the point of this 
straw-man?

>>         ICMP does *not* have a requirement to respond with an MSL
>>                 so a TCP segment's header can exist inside
>>                 an ICMP packet long after the segment's MSL period
>>
>> As a result, it remains incorrect to validate a TCP segment inside the 
>> ICMP as needing to be "in window".
> 
> If there's an error, the the window won't advance, and in the event the 
> window does advance, then the error was not really "hard". And it would
> have been incorrect to abort the TCP connection. (see e.g., Clark's paper).

The ICMP error isn't "TCP failing to make progress" - if you want that 
one, please create a new ICMP error type. Whether you do or not, please 
stop trying to imply those semantics to the current ICMP errors.

>>> Your argument against (2) is that...mmm... that would be incorrect, 
>>> because it would assume that every packet is an attack. But you do 
>>> want to advocate ICMP filtering at firewalls.
>>
>> Correct. If an individual host or subnet wants to assume that ALL 
>> ICMPs are suspect, then that's its decision - and that already happens 
>> at some firewalls.
> 
> Welcome to the real world. We're suspicious by default.

Postel's rule applies; be conservative in what you do, be liberal in 
what you receive. You can be suspicious all you want - but unfounded 
suspicion isn't appropriate.

>> What "everyone implements" isn't the issue; that is covered in BCPs 
>> when the IETF agrees with it and things like RFC 2525 (Known TCP 
>> Implementation Problems) when the IETF does not feel it is appropriate 
>> to change the standard merely to align with what is deployed.
> 
> What "everyone implements" isn't the issue? ahem... "rough consensus and 
> running code".

It's rough consensus AND running code. Not 'running code trumps everything'.

> There's no code that runs what you're describing, Joe. Everybody is 
> doing what is described in the ICMP attacks draft.

Popular vote does not determine correctness. Part of the problem is that 
there are some people who've deployed prototype code and convinced 
everyone it's appropriate. That is NOT how protocol specifications are 
determined.

We've had this debate before. If there's nothing new to add, let's let 
others chime in.

Joe

_______________________________________________
tcpm mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/tcpm