Subject: [OPSEC] Working on a revision of the ICMP filtering draft

From: Fernando Gont <[email-masked]>
Date: Tue, 05 Aug 2008 07:13:16 -0300

Hello, folks,

We're currently working on a revision of the icmp filtering draft 
(http://tools.ietf.org/id/draft-gont-opsec-icmp-filtering-00.txt). 
We're planning to publish a revised version of the doc (as 
draft-ietf) sometime next week.

If you have any feedback on the doc, and proposed text in particular 
;-), please send it to me or post it on the list, so that your 
feedback/text makes it into the next revision of the doc.

Thanks so much!

Kind regards,

--
Fernando Gont
e-mail: [email-masked] || [email-masked]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

_______________________________________________
OPSEC mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/opsec

---

From: [email-masked]
Date: Tue, 5 Aug 2008 23:20:05 -0400 (EDT)

> feedback/text makes it into the next revision of the doc.

Many of the ICMPv6 message types are not defined in 4443 but in other
documents. See http://www.iana.org/assignments/icmpv6-parameters for a
complete list. The entire list should be at least mentioned.

Some perhaps relevant work on this has been done in v6ops, right?

---

From: "Steinthor Bjarnason (sbjarnas)" <[email-masked]>
Date: Thu, 14 Aug 2008 13:38:00 +0200

Hi Fernando,

Sorry about the late feedback but here are some comments on the 2.1.1
ICMP Destination Unreachable:

For all code types (0->15) there is an risk that an attacker might
bombard the device with faked packets, forcing the device to create lots
of ICMP destination unreachable packets.  This is already being used as
an attack vector as this can very quickly lead to resource starvation as
ICMP unreachable processing must happen in slow path (usually central
route processor), risking CPU exhaustion as the line card ASIC's can't
help in these cases.

The approach used to fix this is either block ICMP Destination
Unreachable messages (which is of course a bad thing to do) or to
configure the device so that it will rate limit how many ICMP
Unreachables it generates per second.  (For further info on how Cisco
does this see:
http://www.cisco.com/en/US/docs/ios/12_4t/12_4t2/hticmpun.html#wp1063689
)

I would suggest you add to bottom of section 2.1.1. the following text:

An attacker can potentially perform a Denial of Service (DoS) attack
against the router by forcing it to generate a high volume of ICMP
Destination Unreachable messages.  This can be done by flooding the
router with packets which the attacker knows will result in the router
spending resources in generating a high volume of ICMP messages.

This can be mitigated by rate limiting the rate of IMCP messages
generated.  For rate limiting ICMPv6 messages see RFC 4443, section
2.4.f.

Regards
  Steinthor 

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> On Behalf Of Fernando Gont
> Sent: 5. august 2008 12:13
> To: [email-masked]
> Subject: [OPSEC] Working on a revision of the ICMP filtering draft
> 
> Hello, folks,
> 
> If you have any feedback on the doc, and proposed text in 
> particular ;-), please send it to me or post it on the list, 
> so that your feedback/text makes it into the next revision of the doc.
> 
> Thanks so much!
> 
> Kind regards,
> 
> --
> Fernando Gont
> e-mail: [email-masked] || [email-masked] PGP 
> Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1
> 
> 
> 
>