Subject: [tcpm] Comments on draft-ietf-tcpm-icmp-attacks-00.txt

From: Pyda Srisuresh <[email-masked]>
Date: Mon, 15 May 2006 06:13:18 -0700 (PDT)

Fernando,

Nice job overall on the draft. The draft is focussed as a laser beam on both
the vulnerabilities and the counter measures. I found the document easy to read
and understand. It is apparant, the document is well thought out. Thank you.
Below are my comments. 

1. Section 4.3 - Filtering ICMP error messages based on the ICMP payload

Below is text from section 4.3.

   "However, a more
   advanced packet filtering could be implemented in firewalls as a
   counter-measure.  Firewalls implementing such advanced filtering
   would look at the payload of the ICMP error messages, and would
   perform ingress and egress packet filtering based on the source IP
   address of the IP header contained in the payload of the ICMP error
   message."

I would suggest replacing the term "firewalls" with "middlebox devices such as
Firewalls and NATs" in the above text. I believe, the text is directly
applicable to NATs, because NATs are also intermediate stateful devices. NATs
can also lookup the ICMP error payload and determine if it has prior mapping
(i.e, NAT Session) for the payload and drop the packet when there is no prior
mapping.
 
2. Appendix C - This is useful information. Why not move this to the main body
in section 4?

Thanks.

regards,
suresh

_______________________________________________
tcpm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tcpm

---

From: Fernando Gont <[email-masked]>
Date: Wed, 17 May 2006 06:49:12 -0300

Pyda,

Thanks so much for your feedback!

You'll find my responses inline....

>(i.e, NAT Session) for the payload and drop the packet when there is no prior

Agreed. Will do.

>2. Appendix C - This is useful information. Why not move this to the main body

The idea of putting that text in an appendix was not because of it 
being "not that useful", but rather because of the fact that, given 
the current specifications, only the full IP header and the first 64 
bits of its payload are required in the payload of ICMP error messages.

Considering that it's not a requirement to have that information 
present, and attacker would not include it to perform the attacks.

Thanks!

Kindest regards,

--
Fernando Gont
e-mail: [email-masked] || [email-masked]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1