Re: [tsvwg] sanity checking DTLS ICMP errors

[Michael Tuexen <[e-mail]>]

> On 22 Jan 2015, at 09:34, Yoshifumi Nishida <[e-mail]> wrote:
> 
> 
> On Mon, Jan 19, 2015 at 2:36 PM, Michael Tuexen <[e-mail]> wrote:
> > On 19 Jan 2015, at 20:43, 🔓Dan Wing <[e-mail]> wrote:
> >
> > To reduce the attack surface, TCP implementations have been validating ICMP error messages to be in-window (RFC5927).
> >
> > On a thread over on RTCWEB with Michael Tüxen, it seems DTLS-encrypted packets might benefit from a similar validation.
> Just to add some information:
> Dan was asking why we couldn't just process incoming ICMP packets indicating that a packet
> sent was too big by SCTP when running over DTLS. My point was that we can't the validation
> of the verification tag as we do normally for SCTP. That is why we use PMTUD as described
> in RFC4821 for
> http://tools.ietf.org/html/draft-ietf-tsvwg-sctp-dtls-encaps-08
> 
> Sorry if I miss something.. 
> I'm just curious after reading the following texts.
> 
>  Incoming ICMP or ICMPv6 messages can't be processed by the SCTP
>    layer, since there is no way to identify the corresponding
>    association. 
> 
> 
> If the socket used for UDP encap is connected and if only one SCTP association over DTLS is mapped to the socket, is it still impossible for SCTP layer to know if it receives ICMP errors?  
Please note that the ICMP processing of SCTP requires to check the verification tag. Since we use DTLS, this
is not present in cleartext in the ICMP message (if it is present at all).

Best regards
Michael
> 
> Thanks,
> --
> Yoshi