Subject: [tcpm] Some feedback on draft-bonica-tcp-auth-04.txt

From: Fernando Gont <[email-masked]>
Date: Thu, 11 May 2006 19:11:44 -0300

Ron,

Going through draft-bonica-tcp-auth-04.txt, I see that the issue of 
ICMP-based attacks is left open (as is the case with the TCP MD5 option).

I'd suggest to either completely ignore ICMP error messages when your 
strategy is implemented, or make the implementation of the 
counter-measures described in the ICMP attacks draft mandatory.

If not, even when you would be protecting TCP from TCP-based reset 
attacks, for example, ICMP-based ones might still work.

Kindest regards,

--
Fernando Gont
e-mail: [email-masked] || [email-masked]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

_______________________________________________
tcpm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tcpm

---

From: Joe Touch <[email-masked]>
Date: Thu, 11 May 2006 17:06:32 -0700

> attacks, for example, ICMP-based ones might still work.

It's worth noting that TCP and IPsec protection don't address ICMP
issues, except that IPsec recommends dropping certain kinds of ICMP
messages. It'd be useful to cite 4301 in that regard, IMO.

(FWIW, the ICMP attacks draft is very weak on its citation of 2401/4301
in this regard; those docs, as Kent points out, already note that
certain ICMP messages should be dropped in an IPsec'd environment).

Joe

---

From: Fernando Gont <[email-masked]>
Date: Fri, 12 May 2006 00:03:42 -0300

>certain ICMP messages should be dropped in an IPsec'd environment).

IIRC, at least 2401 was not specific  on which messages to drop. And 
even 4301 says that there should be a system toggle to define what to 
do. For instance, I think the spec does not say what this toggle 
should default to.

As mentioned by Pekka in RFC 4459, IPSec protection from ICMP 
attacks, if any, is based on a number of assumptions from the reader.

Anyway, will go through 4301, and try to make its citation better, if possible.

Kindest regards,