Re: [tsvwg] sanity checking DTLS ICMP errors

[Yoshifumi Nishida <[e-mail]>]

Hi Michael,

On Thu, Jan 22, 2015 at 12:03 PM, Michael Tuexen <
[e-mail]> wrote:

>
> > On 22 Jan 2015, at 09:34, Yoshifumi Nishida <[e-mail]>
> wrote:
> >
> >
> > On Mon, Jan 19, 2015 at 2:36 PM, Michael Tuexen <
> [e-mail]> wrote:
> > > On 19 Jan 2015, at 20:43, 🔓Dan Wing <[e-mail]> wrote:
> > >
> > > To reduce the attack surface, TCP implementations have been validating
> ICMP error messages to be in-window (RFC5927).
> > >
> > > On a thread over on RTCWEB with Michael Tüxen, it seems DTLS-encrypted
> packets might benefit from a similar validation.
> > Just to add some information:
> > Dan was asking why we couldn't just process incoming ICMP packets
> indicating that a packet
> > sent was too big by SCTP when running over DTLS. My point was that we
> can't the validation
> > of the verification tag as we do normally for SCTP. That is why we use
> PMTUD as described
> > in RFC4821 for
> > http://tools.ietf.org/html/draft-ietf-tsvwg-sctp-dtls-encaps-08
> >
> > Sorry if I miss something..
> > I'm just curious after reading the following texts.
> >
> >  Incoming ICMP or ICMPv6 messages can't be processed by the SCTP
> >    layer, since there is no way to identify the corresponding
> >    association.
> >
> >
> > If the socket used for UDP encap is connected and if only one SCTP
> association over DTLS is mapped to the socket, is it still impossible for
> SCTP layer to know if it receives ICMP errors?
> Please note that the ICMP processing of SCTP requires to check the
> verification tag. Since we use DTLS, this
> is not present in cleartext in the ICMP message (if it is present at all).
>

What I meant was that an SCTP association might be able to know if it
receives ICMP errors, even though it cannot examine it.
I just felt that the texts "there is no way to identify the corresponding
association" might be a bit ambiguous expression. Sorry for picking up a
minor point.

Thanks,
--
Yoshi