Subject: [Ietf-behave] ICMP Behave draft

From: Pyda Srisuresh <[email-masked]>
Date: Wed, 8 Mar 2006 13:31:30 -0800 (PST)

Folks,

New rev of the ICMP behave draft (draft-srisuresh-behave-nat-icmp-01.txt) is
now available for review. Please give this a read and provide your feedback.
One key objective is to understand if there is interest in pursuing the ICMP
work in this draft as a WG item. We also requested for a slot in the upcoming
WG meeting for this draft. Thanks.

The ICMP draft lists 5 requirements and do not conflict with the ICMP
requirements listed in the UDP draft (or the TCP draft). The ICMP requirements
in the UDP draft require NATs to a) forward ICMP detination unreachable
messages,  and, b) be able to generate "Fragementation needed and DF set"
messages. Both are covered by the requirements listed in the ICMP draft.

Thanks.

regards,
suresh

---

From: Fernando Gont <[email-masked]>
Date: Fri, 10 Mar 2006 11:10:47 -0800 (PST)

At 06:31 p.m. 08/03/2006, Pyda Srisuresh wrote:

New rev of the ICMP behave draft (draft-srisuresh-behave-nat-icmp-01.txt) is
now available for review. Please give this a read and provide your feedback.
One key objective is to understand if there is interest in pursuing the ICMP
work in this draft as a WG item. We also requested for a slot in the upcoming
WG meeting for this draft. Thanks.
Have a look at the Appendix in 
http://www.ietf.org/internet-drafts/draft-ietf-tcpm-icmp-attacks-00.txt 
about "Additional checks". The IP checksum of the ICMP payload should 
be checked. If possible, so should the TCP checksum contained in the 
ICMP payload, etc.

Kindest regards,

--
Fernando Gont
e-mail: fernando@xxxxxxxxxxx || fgont@xxxxxxx

---

From: Pyda Srisuresh <[email-masked]>
Date: Fri, 10 Mar 2006 17:17:03 -0800 (PST)

Hi Fernando,

You are right about checking and updating the IP and UDP checksums of the
embedded IP packet. However, checking the TCP checksum would not work, as the
ICMP error message include just 8 bytes of TCP header. The TCP checksum is past
8 bytes.

regards,
suresh

---

From: Fernando Gont <[email-masked]>
Date: Mon, 13 Mar 2006 16:29:12 -0800 (PST)

At 10:17 p.m. 10/03/2006, Pyda Srisuresh wrote:

You are right about checking and updating the IP and UDP checksums of the
embedded IP packet. However, checking the TCP checksum would not work, as the
ICMP error message include just 8 bytes of TCP header. The TCP 
checksum is past
8 bytes.
Need not be the case. The original ICMP spec stated that the first 8 
octets of the transport protocol header should be included. RFC 1122 
states that more information MAY be included. And RFC 1812 states 
that more information SHOULD be included.

Section 3 of 
http://www.gont.com.ar/drafts/draft-ietf-tcpm-icmp-attacks-00.txt has 
a sum up of the relevant stuff.

That said, in the event you got a full TCP segment, you should check 
the TCP checksum. Also, if you get the TCP timestamp, you should check it

Kindest regards,