Subject: Re: [tcpm] DISCUSS: draft-ietf-tcpm-tcp-soft-errors

From: Jari Arkko <[email-masked]>
Date: Wed, 13 Aug 2008 11:04:28 +0300

Fernando,

>> Section 2.1 says:
>>
>> When receiving an ICMP error message that indicates a hard error
>> condition, TCP will simply abort the corresponding connection,
>> regardless of the connection state.
>>
>> Question. I was under the impression that recent specifications have
>> started to say to not blindly believe ICMP errors due to denial-
>> of-service concerns? If this is not the case, then no problem.
>
> I'm the author of the TCPM WG's "ICMP attacks against TCP draft". 
> While that draft was initially meant for the informational track, it 
> is now aims at "Informational". So, even when virtually all current 
> implementations behave as you describe, the IETF specifications remain 
> unchanged.

Ok. Perhaps it would be useful to state something about reality as well 
-- even if you do not recommend something else, I think you should 
acknowledge the fact that virtually all implementations behave differently.

>> Section 3.2 says:
>>
>> In scenarios where a node has no default routers and Neighbor
>> Unreachability Detection (NUD) [RFC4861] fails for destinations
>> assumed to be on-link, or where firewalls or other systems that
>> enforce scope boundaries send ICMPv6 errors, the sending node will be
>> signaled of the unreachability problem. However, as discussed in
>> Section 2.2, standard TCP implementations will not abort connections
>> when receiving ICMP error messages that indicate soft errors.
>>
>> Clarity. This is somewhat misleading. When the node has no default
>> routers it also has no prefixes, no global addresses and it will not
>> even try to use IPv6 towards other global addresses.
>
> Why not? What if a Router Advertisement has a "Router Lifetime" of 0? 
> Am I missing something?

Ah, I didn't think of this case. I'll leave it up to you if you want to 
edit the text to clarify what you mean. (I don't require you to and I'm 
not certain that it is needed.)

Jari

_______________________________________________
tcpm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/tcpm

---

From: Fernando Gont <[email-masked]>
Date: Wed, 13 Aug 2008 05:44:10 -0300

At 05:04 a.m. 13/08/2008, Jari Arkko wrote:

>>While that draft was initially meant for the informational track, 
>>it is now aims at "Informational". So, even when virtually all 
>>current implementations behave as you describe, the IETF 
>>specifications remain unchanged.
>
>Ok. Perhaps it would be useful to state something about reality as 
>well -- even if you do not recommend something else, I think you 
>should acknowledge the fact that virtually all implementations 
>behave differently.

I'd be more than pleased to do it. The only reason for which I didn't 
is that we had very heated debates on the ICMP attacks stuff on the 
TCPM WG mailing-list, and thus I didn't want to start the debate over 
again in the context of this draft. I will prepare some text, and ask 
for comments. Does it sound reasonable?

>>Why not? What if a Router Advertisement has a "Router Lifetime" of 
>>0? Am I missing something?
>
>Ah, I didn't think of this case. I'll leave it up to you if you want 
>to edit the text to clarify what you mean. (I don't require you to 
>and I'm not certain that it is needed.)

Same here. Will come back to you asap with some proposed text.

Thanks!

--
Fernando Gont
e-mail: [email-masked] || [email-masked]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1