[tcpm] ICMP attacks draft (issue 3): TCP SEQ check

Folks,

Issue 3: The draft proposes to check the TCP sequence number contained in 
the payload of the ICMP messages.
The idea is that errors should be caused by segments that have been sent, 
but not yet acknowledged.

This is a general check, which check for the staleness of the error 
messages. We are performing the same check for TCP segments, so why not 
perform the same check for errors that are supposed to have been elicited 
by the connection?

If an error message does not pass tis check, it means that either the error 
is old (and thus it's okay to discard it), or that there's still a path to 
get to the destination system (and thus, for the sake of TCP's robustness, 
we should not honor the error message).

Even then, ICMP is unreliable. Dropping a legitimate ICMP error message 
can't hurt you, anyway.

Comments?

Linux has been performing this check for years. OpenBSD has been performing 
this check for more than a year. FreeBSD and NetBSD have been performing 
this check for several months now.

Kindest regards,

--
Fernando Gont
e-mail: fernando@gont.com.ar || fgont@acm.org

_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www1.ietf.org/mailman/listinfo/tcpm