Subject: [tcpm] Feedback/support from the FreeBSD community (Fwd: Re: Moving the ICMP attacks draft forward)

From: Fernando Gont <[email-masked]>
Date: Wed, 09 Nov 2005 17:38:23 -0800

Folks,

I'm forwarding an e-mail from FreeBSD's Andre Oppermann. FreeBSD implements 
all the counter-measures proposed in drft-gont-tcpm-icmp-attacks-05.txt, 
except for the one for the PMTUD, which they implement partialy. However, 
they are planning to implement it.

>Date: Tue, 08 Nov 2005 23:48:26 +0100
>From: Andre Oppermann <[email-masked]>
>X-Mailer: Mozilla 4.8 [en] (Windows NT 5.0; U)
>X-Accept-Language: en
>To: Fernando Gont <[email-masked]>
>Subject: Re: Moving the ICMP attacks draft forward
>
>Hi Fernando,
>
>FreeBSD has implemented the sequence number check for all ICMP messages
>that received in response to some TCP segment.  Source quench messages
>are ignored completely.  PMTU messages that have made it through the
>seqnum check are acted upon if the newly proposed MTU is greater or
>equal to 256 bytes.  For those without an MTU proposal we step down
>by one over a number of common MTUs with the lower bound of 256 bytes.
>This approach keeps a sufficient high segment overhead versus payload
>ratio.
>
>For the moment we think this is sufficient.  However in the longer
>term we want to implement the approach described in your draft.
>
>I hope this helps with your persuation of the TCPM WG to promote
>your draft to RFC status.
>
>And I want, on behalf of the FreeBSD team and personally, to thank
>you for raising, documenting and proposing workarounds to these TCP
>issues.
>
>Best regards
>--
>Andre

Kindest regards,

--
Fernando Gont
e-mail: [email-masked] || [email-masked]

_______________________________________________
tcpm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tcpm

---

From: Joe Touch <[email-masked]>
Date: Thu, 10 Nov 2005 08:53:45 -0800

These are the same ones who put in the RST mods - with a note that it
violates TCP specs - even though they don't help general users at all.
We're trying right now to undo that, and have the default be OFF at
least UNTIL the WG makes a decision on how to proceed.

Note - I have NOT asserted that the ICMP code is bad, just that the doc
is written in a misleading way. The fact that vendors are running
headlong to adopt it can be taken as evidence that this misleading
wording has had a "fire in a crowded room" effect.

Joe

Fernando Gont wrote:
> Folks,
> 
> I'm forwarding an e-mail from FreeBSD's Andre Oppermann. FreeBSD
> implements all the counter-measures proposed in
> drft-gont-tcpm-icmp-attacks-05.txt, except for the one for the PMTUD,
> which they implement partialy. However, they are planning to implement it.
> 
>