Re: [tcpm] TCPM and draft-ietf-tcpm-icmp-attacks

[Joe Touch <[e-mail]>]

Fernando Gont wrote:
> Joe Touch wrote:
> 
>>> This would seem to imply that the TCPM WG has decided to deviate from
>>> the old IETF operating principle of "rough consensus and running code".
>> The short answer is that there wasn't rough consensus for these changes
>> in the WG, as explained in the note in the text.
> 
> I believe that the short answer is that *you* have done everything that
> was available to stop this document (and others) from moving forward.

The doc contains many items, some of which continue to be completely
inappropriate and incorrect (checking TCP sequence numbers), where
others are somewhat reasonable (port randomization).

One problem is that we never agreed on exactly what to focus on
recommending, as well as that TCP isn't the only protocol affected by
ICMP issues.

Another problem is that some of the responses may be appropriate when
under attack, but the overall tone of the document is that if a message
is "unexpected" it is malicious. That's the antithesis of "be liberal in
what you accept".

> It is interesting to note that one of the issues with with you have
> trashed this I-D is that it used vocabulary that could be taken as the
> draft "recommending" the described counter-measures. Yet, as the editor
> of the last version of the (close to infamous) TCP A-O effort, you have
> crafted this text:
> 
> "  There are other mechanisms proposed to reduce the impact
>    of ICMP attacks by further validating ICMP contents and changing the
>    effect of some messages based on TCP state"
> 
> Note the use of the term "proposed". (that's specifically what I'm
> referring to).

Yes, please do note it. "proposed" doesn't mean recommended.

The full text is:

   There are other mechanisms proposed to reduce the impact of ICMP
   attacks by further validating ICMP contents and changing the effect
   of some messages based on TCP state, but these do not provide the
   level of authentication for ICMP that TCP-AO provides for TCP [Go09].

It goes on to include SOME of the recommendations in this doc (but
notably not others, even though widely deployed). Note that these latter
changes were included because of *your* input *after* last call.

Joe