Re: [tcpm] ICMP attacks draft

[Joe Touch <[e-mail]>]

Fernando Gont wrote:
> At 18:23 18/07/2006, Joe Touch wrote:
> 
> [(was Re: [tcpm] feedcback on tcp-secure-05)]
> 
>> > So, would you agree with the draft mentioning the ambiguity, and, as in
>> > the case of the other ICMP error codes, stating why it would make sense
>> > to treat them as soft errors, instead? (The "SHOULD" allows for that,
>> > after all).
>>
>> The specific reason and conditions for the SHOULD *must* (my must) be
>> addressed, IMO (presumably "connect established" at least, or making
>> forward progress at most - with caveats about change of behavior - for
>> better or worse - in certain multipath scenarios as already raised).
> 
> Okay.
> 
> So,
> 
> * The condition for all the so-called hard errors to be treated as soft
> errors is that the conenction must be in any of the synchronized states.
> * The reason for not honoring the SHOULD is that in hostile
> environments, its an attack vector that is easier to perform than
> others. (I will note the ambiguity in the case of port unreachables)
> * The good thing of the change is that it mitigates the above threat,
> and also improves TCP's robustness in the case of multipath scenarios.

I agree with these. It would also be useful to add - to the last one -
that this *changes* how TCP would behave in multipath scenarios and/or
path changes, which *may* make TCP less likely to _correctly_ rapidly
disconnect from a session when a routing change occurs that disconnects
endpoints.

(i.e., there are cases that this might not be the best choice; trading
robustness for reactiveness to failure is typical, but not always the
only choice).

Joe


> 
> Let me know if you agree with these and/or if I missed anything.
> 
> 
> 
>> > This assumes that:
>> > a) The system in question does not honor the "recommendation" in the
>> > ICMP attacks draft
>>
>> You're making recommendations about what the TCP should do regarding the
>> errors; that's not the same as what the application on top of TCP
>> would do.
> 
> I think this would be out of the scope of the document?
> 
> 
>> > b) ICMP error messages are passed to the application. In the Sockets
>> > API, they are passed only after a USER TIMEOUT.
>>
>> I don't recall anything in 1122 about how quickly soft errors must be
>> passed to the app, but they MUST be passed to the app. This implies that
>> soft errors aren't passed if a user timeout doesn't occur, which seems
>> like another violation that should be noted.
> 
> This seems out of scope, too.  We are not doing anything new wrt to
> whether TCP should handle ICMP errors to applications or not.
> 
> Kindest regards,
> 
> -- 
> Fernando Gont
> e-mail: [e-mail] || [e-mail]
> PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1
> 
> 
> 
> 
> 
> 
> _______________________________________________
> tcpm mailing list
> [e-mail]
> https://www1.ietf.org/mailman/listinfo/tcpm

_______________________________________________
tcpm mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/tcpm