Re: [Tsvwg] SCTP and ICMP Protocol Unreachable

[Stephane Chazelas <[e-mail]>]

On Thu, Sep 21, 2006 at 03:07:25PM -0400, Randall Stewart wrote:
[...]
> >>If you instead remove the ICMP message treated as an ABORT
> >>you loose the ability to penalize attackers..
> >But what harm could the attacker do?
> Go take a look at the bombing attacks listed
> in the threats draft...

Hi Randall,

Maybe I'm not reading it correctly, but for some of those
bombing attacks, there's more of a justification to drop the
Protocol Unreachable.

http://www.ietf.org/internet-drafts/draft-ietf-tsvwg-sctpthreat-01.txt

5) is taken care of by the change to the RFC that every address
must be confirmed first. So that only heartbeats are sent to the
victims

6) the attacker will be able to resend its cookie quickly because
the server considers the ICMP DUPrU as an ABORT. If it didn't it
would have to close the association first.

8,9) unrelated.

So it looks like an attacker can always have a server send a
burst of heartbeats to victims whether or not the ICMP DUPrU is
considered as an ABORT or not.

[...]
> >I can see firewalls send "port unreachables" when filtering on
> >TCP services, that's a host level ICMP message as well.
> 
> Port unreachable is even a stretch IMO.. but announcing
> that a host does not support a protocol is way over
> the top.. and is just plain broken.
[...]

Given that firewalls work at transport level, it may be
considered legitimate that they inpersonate the destination. A
firewall is a bit of a hack anyway. The problem is that IP
doesn't provide them with tools to do their job, so they have to
use hacks/work around. There's no ICMP to say "sorry, no TCP
telnet on that path", so they have to fake a DUPoU from the
destination instead. Similarly, there's no way to tell "sorry,
no SCTP on that path", so they use the ICMP DUPrU.

I'm not trying to push in either direction, I'm just pointing
out that potential issue. The behavior of SCTP (considering the
ICMP DUPrU as an abort) conflicts with that behavior of some
firewalls. Now, we may question ourselves whether that bahavior
is necessary. Maybe the right approach is to come up with new
ICMP codes for usage by the firewalls.

Best regards,
Stephane