Subject: RE: [tcpm] draft-bonica and TCP segmentation

From: "Caitlin Bestler" <[email-masked]>
Date: Fri, 24 Mar 2006 14:02:36 -0800

Joe Touch wrote:
> Anantha Ramaiah (ananth) wrote:
>> It is well known that TCP segments containing the TCP MD5 option (as
>> it is today) will work on a purely end-to-end principle and cannot be
>> subject to any further segmentation/proxying at the transport layer
>> by in-between proxies. Simply because the proxies don't have the
>> keys to regenerate the TCP segments. By proxies what I mean here is
>> the "trusted middleboxes" OR NAT's which can rewrite the IP headers
>> and not the "attacker".
> 
> Any modification of an IP packet in flight - excepting
> fragmentation of IPv4, or IP forwarding processing - is
> equivalent to (and should be treated as) an attack.
> 
>> But the TCP MD5 option (and the further revisions that are proposed
>> in draft-bonica and draft-weis) are mainly for the routing
>> applications and these connections never find themselves behind a
>> NAT/firewall or a proxy device which modifies the TCP segment or the
>> psuedo-header used for the MD5/new auth option in any manner
>> whatsoever. 
> 
> If these 'trusted middleboxes' can be placed anywhere, and if
> they are intended to operate transparently to the ends of a
> connection, then this assumption is invalid. While it's
> reasonable to assume that NATs shouldn't be placed on a
> routing path, other "performance enhancing proxies" (PEPs)
> can be, and they are the worry.
> 

That assumption should be documented in the draft, along with
noting that this implies that TCP-AUTH is NOT applicable for
applications other than router-to-router communication.

_______________________________________________
tcpm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tcpm

---

From: Joe Touch <[email-masked]>
Date: Fri, 24 Mar 2006 14:28:55 -0800

> Joe Touch wrote:
...
> applications other than router-to-router communication.

Actually, it applies more as a limitation of PEPs in general, that they
do not work where they would alter protected contents, and so MUST NOT
modify those sorts of packets.

The issue is whether *they* are compliant, rather than TCP-AUTH (or
TCP/MD5), because this limitation (of PEPs) applies to any transport or
network layer protection mechanism.

Joe