[tcpm] TCP-AO and ICMP attacks (was Re: comments on draft-ietf-tcpm-icmp-attacks-05)

[Fernando Gont <[e-mail]>]

Joe Touch wrote:

>>> 5) (general) Section 5.1, last paragraph, it
>>> seems like we should be mentioning TCP-AO as
>>> well here, though I don't think it changes any
>>> part of the claim.
>> Agreed. Maybe this is also an indication that TCP-AO *should* change
>> something in this respect!
> 
> TCP-AO already addresses ICMP attacks in the security considerations
> section, and requires there to be a way to disable reaction to ICMPs.
> Like IPsec, though, we don't make a-priori assessments as to whether
> ICMPs should be blocked or not on connections on which TCP-AO (or IPsec)
> is used.

What's the point of enabling TCP-AO, if you are not going to disable (or
hard errors -> soft errors)?

I think that for the sake of the "principle of least surprise", ICMP
hard errors SHOULD NOT abort connections for which TCP AO has been enabled.

What to do with "frag needed" might vary. Although one could argue that
you SHOULD implement PLPMTUD.

Thanks,
-- 
Fernando Gont
e-mail: [e-mail] || [e-mail]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1