Re: [tcpm] Some comments on tcpsecure

At 05:36 p.m. 05/04/2008, Joe Touch wrote:

>As I said before:
>
>         TCP *has* an MSL requirement (RFC793)
>                 this means that TCP segments should not live
>                 in the network beyond approx 2 minutes

Yes, and this requirement cannot be met, as it is based on the 
assumption that the IP TTL can be enforced. (Not to say that the MSL 
sort of imposes a requirement on the TTL you set in IP packets. If 
you set a TTL of say 240, then the TTL becomes 4 minutes, and 2*MSL 
becomes eight minutes.

As a result, if anything, this is as incorrect as requiring ICMPs to 
be in window. Well, unless you run TCP on anything other than IP....

>         ICMP does *not* have a requirement to respond with an MSL
>                 so a TCP segment's header can exist inside
>                 an ICMP packet long after the segment's MSL period
>
>As a result, it remains incorrect to validate a TCP segment inside 
>the ICMP as needing to be "in window".

If there's an error, the the window won't advance, and in the event 
the window does advance, then the error was not really "hard". And it 
would have been incorrect to abort the TCP connection. (see e.g., 
Clark's paper).

>>Your argument against (2) is that...mmm... that would be incorrect, 
>>because it would assume that every packet is an attack. But you do 
>>want to advocate ICMP filtering at firewalls.
>
>Correct. If an individual host or subnet wants to assume that ALL 
>ICMPs are suspect, then that's its decision - and that already 
>happens at some firewalls.

Welcome to the real world. We're suspicious by default.

>What "everyone implements" isn't the issue; that is covered in BCPs 
>when the IETF agrees with it and things like RFC 2525 (Known TCP 
>Implementation Problems) when the IETF does not feel it is 
>appropriate to change the standard merely to align with what is deployed.

What "everyone implements" isn't the issue? ahem... "rough consensus 
and running code".

There's no code that runs what you're describing, Joe. Everybody is 
doing what is described in the ICMP attacks draft.

Kind regards,

--
Fernando Gont
e-mail: fernando@gont.com.ar || fgont@acm.org
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www.ietf.org/mailman/listinfo/tcpm