Subject: [tcpm] ICMP attacks draft (issue 3): TCP SEQ check

From: Fernando Gont <[email-masked]>
Date: Fri, 23 Sep 2005 08:08:03 -0300

Folks,

Issue 3: The draft proposes to check the TCP sequence number contained in 
the payload of the ICMP messages.
The idea is that errors should be caused by segments that have been sent, 
but not yet acknowledged.

This is a general check, which check for the staleness of the error 
messages. We are performing the same check for TCP segments, so why not 
perform the same check for errors that are supposed to have been elicited 
by the connection?

If an error message does not pass tis check, it means that either the error 
is old (and thus it's okay to discard it), or that there's still a path to 
get to the destination system (and thus, for the sake of TCP's robustness, 
we should not honor the error message).

Even then, ICMP is unreliable. Dropping a legitimate ICMP error message 
can't hurt you, anyway.

Comments?

Linux has been performing this check for years. OpenBSD has been performing 
this check for more than a year. FreeBSD and NetBSD have been performing 
this check for several months now.

Kindest regards,

--
Fernando Gont
e-mail: [email-masked] || [email-masked]

_______________________________________________
tcpm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tcpm

---

From: Joe Touch <[email-masked]>
Date: Fri, 23 Sep 2005 07:28:49 -0700

Fernando Gont wrote:
> Folks,
> 
> Issue 3: The draft proposes to check the TCP sequence number contained
> in the payload of the ICMP messages.
> The idea is that errors should be caused by segments that have been
> sent, but not yet acknowledged.
> 
> perform the same check for errors that are supposed to have been
> elicited by the connection?

TCP checks the checksum AND MD5 option (if the latter exists) first; if
you do these checks first, then it is OK to check the SEQNUM. If not
enough of the segment exists to do so, then it is incorrect to interpret
any of the rest of the fields.

> Linux has been performing this check for years. OpenBSD has been
> performing this check for more than a year. FreeBSD and NetBSD have been
> performing this check for several months now.

The fact that many people implemented TCP bugs incorrectly warranted a
document on why what they did was incorrect, not a document to validate
it - regardless of the lack of noted errors. The statement above is not
germane to this dicussion.

Joe

---

From: Fernando Gont <[email-masked]>
Date: Fri, 23 Sep 2005 12:59:58 -0300

>any of the rest of the fields.

Then why would you abort a connection, then???

You don't want to perform checks, but do want to abort your connections, 
anyway?

That doesn't make sense to me....

---

From: Joe Touch <[email-masked]>
Date: Fri, 23 Sep 2005 10:00:45 -0700

> Then why would you abort a connection, then???

I don't see where I would have.  I would have silently dropped the ICMP
in those cases where the checksum or MD5 fail.

> You don't want to perform checks, but do want to abort your connections,

No, I do want to perform checks- for validity and staleness, but not to
infer anything about an attack from those.

Joe