Subject: RE: [tcpm] Comments on draft-ietf-tcpm-icmp-attacks-00.txt

From: "Bora Akyol" <[email-masked]>
Date: Mon, 22 May 2006 11:16:12 -0700

Fernando, 

I don't think you put forth a single argument that
can stand on its own as to why ICMP payload parsing
in the firewalls is helping us in a significant way.

I think you should at least add a paragraph to section 4.3
explaining what the value is and why we should do this.

Regards,

Bora

> -----Original Message-----
> From: Fernando Gont [mailto:[email-masked]] 
> Sent: Friday, May 19, 2006 9:57 PM
> To: Bora Akyol; [email-masked]
> Subject: RE: [tcpm] Comments on draft-ietf-tcpm-icmp-attacks-00.txt
> 
> At 14:43 19/05/2006, Bora Akyol wrote:
> 
> >My point is that you assume that a firewall somewhere in the network 
> >has the information to decide what packets can originate 
> from where and 
> >filter it.
> >
> >The benefit of implementing this feature is minimal IMHO at a 
> >considerable complexity to hardware implementations.
> 
> Ingress/egress filtering of ICMP packets is included as 
> additional countermeasures that could be implemented.
> 
> The real fix for each attack is right after the corresponding 
> attack description.
> 
> 
> >Can you also document how this works with mobile IP and 
> other protocols
> >that use
> >a care of address (I believe some of the Wireless LAN tunneling does
> >this too).
> 
> Do you mean how simple ingress/egress filtering works with 
> mobile IP? ;-)
> 
> Well, in many cases it will probably be troublesome.
> 
> Kindest regards,
> 
> --
> Fernando Gont
> e-mail: [email-masked] || [email-masked]
> PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1
> 
> 
> 
> 
> 
> 
> 

_______________________________________________
tcpm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tcpm

---

From: Pekka Savola <[email-masked]>
Date: Tue, 23 May 2006 08:00:16 +0300 (EEST)

> explaining what the value is and why we should do this.

It *would* protect from external attackers reseting site-internal (or 
beyond the firewall at any point) sessions, similar to applying 
ingress filtering from the direction of the Internet does for TCP RST 
attacks.

Whether that's significant or not is in the eye of the beholder...

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

---

From: Fernando Gont <[email-masked]>
Date: Tue, 23 May 2006 02:12:34 -0300

>in the firewalls is helping us in a significant way.

The draft never gets into "how significant" the help is. The 
effectiveness of both this filtering and egress filtering based on 
the source IP address of an IP datagram depends on the deployment level.

You implement it in your firewall, and your users won't be able to 
perform ICMP-based attacks.

Now, if the same box implements NAT functionality (as it is usual), 
then you will *need* to not only inspect the inner packet (the one 
contained in the ICMP payload), but also modify it, according to the 
state information you have for that instance of communication.

If you don't inspect the inner packet, you won't know who you should 
forward the packet to.

If you forward the ICMP error message without modifying the inner 
packet, the receiving host will simply drop it.

>explaining what the value is and why we should do this.

Okay. Will do.

Does something like the above sound fine?

Kindest regards,

---

From: Fernando Gont <[email-masked]>
Date: Tue, 23 May 2006 02:12:34 -0300

Okay. Will do.

Kindest regards,

---

From: Fernando Gont <[email-masked]>
Date: Tue, 23 May 2006 02:12:34 -0300

Okay. Will do.

Kindest regards,