Subject: [tcpm] [Fwd: New Version Notification for draft-ietf-tcpm-icmp-attacks-10]

From: Fernando Gont <[email-masked]>
Date: Sun, 31 Jan 2010 03:46:21 -0300

(CC to [email-masked])

Lars,

I have posted a revision of the ICMP attacks I-D. Please let me know if
it addresses all the issues you have raised (I hope it does).

Thanks!

Kind regards,
Fernando

-------- Original Message --------
Subject: New Version Notification for draft-ietf-tcpm-icmp-attacks-10
Date: Sat, 30 Jan 2010 22:43:44 -0800 (PST)
From: IETF I-D Submission Tool <[email-masked]>
To: [email-masked]

A new version of I-D, draft-ietf-tcpm-icmp-attacks-10.txt has been
successfuly submitted by Fernando Gont and posted to the IETF repository.

Filename:	 draft-ietf-tcpm-icmp-attacks
Revision:	 10
Title:		 ICMP attacks against TCP
Creation_date:	 2010-01-30
WG ID:		 tcpm
Number_of_pages: 40

Abstract:
This document discusses the use of the Internet Control Message
Protocol (ICMP) to perform a variety of attacks against the
Transmission Control Protocol (TCP).  Additionally, describes a
number of widely implemented modifications to TCP's handling of ICMP
error messages that help to mitigate these issues.

The IETF Secretariat.

-- 
Fernando Gont
e-mail: [email-masked] || [email-masked]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

---

From: Joe Touch <[email-masked]>
Date: Sat, 30 Jan 2010 23:15:20 -0800

Fernando,

The text has the paragraph you proposed and I had issues with:

   We note that the counter-measures discussed in this document are not
   part of standard TCP behavior and this document does not change that
   state of affairs.  The consensus of the TCPM WG (TCP Maintenance and
   Minor Extensions Working Group) was to document this widespread
   implementation of nonstandard TCP behavior but to not change the TCP
   standard.

I had preferred something that included Wes's view that:

	As mentioned above, I think if the section's content is hedged
	correctly as describing the implementation that exists, rather
	than a WG-proposed behavior, then we'll be within consensus.

I would appreciate if the text indicated not only that the WG did not
decide to change the standard but that it also didn't decide to
recommend it. That can be accomplished by changing the (first paragraph)
above to:

   We note that the counter-measures discussed in this document are not
   part of standard TCP behavior and this document does not change that
   state of affairs.  The consensus of the TCPM WG (TCP Maintenance and
   Minor Extensions Working Group) was to document this widespread
   implementation of nonstandard TCP behavior and neither to change
   the TCP standard nor to recommend implementation of this behavior.

Sorry that this didn't make it before your update; I hadn't though you
would submit it so quickly.

Joe

---

From: Fernando Gont <[email-masked]>
Date: Sun, 31 Jan 2010 06:49:34 -0300

Hello, Joe,

>    implementation of nonstandard TCP behavior but to not change the TCP

I submitted this rev so that people could have a look at my working copy.

> recommend it. 

Isn't this the same thing? If we're not changing the standard, so why
would we be supposed to be recommending this? Or could we be
recommending this without changing the specs???

> That can be accomplished by changing the (first paragraph)
> above to:
> 

Strictly speaking, this text (and the one I proposed) is not 100%
correct. e.g., the pmtud fix is within the specs. (one my argue that
hard -> soft might or might not be within the specs... as the spec is
ambiguous: there's one SHOULD, and one MUST for the very same requirement).

But I'll just let others (and Lars in particular) weigh in. As far as I
am concerned, I want to get this I-D done. And if this alternative text
is supposed to make a difference, I will have no problem with
recommending it.

But, hey, let's get over it. IMHO, this is being way too paranoid about
the sacred RFCs. It's an informational RFC. We're even including a
complete paragraph saying that this does not change the spec, and we're
still hair-splitting....

> would submit it so quickly.

Take this rev as an iteration to converge to an "acceptable" I-D.

Thanks,

---

From: Joe Touch <[email-masked]>
Date: Sun, 31 Jan 2010 10:50:18 -0800

Hi, Fernando

> Hello, Joe,
...
> I submitted this rev so that people could have a look at my working copy.

AOK - thanks!

...
> recommending this without changing the specs???

We do various things, including:
	- changing the standard
	- making recommendations that are consistent with the standard

The second case is "making a recommendation without changing the specs".
That's the other thing we didn't have consensus on.

> correct. e.g., the pmtud fix is within the specs. 

Agreed. Here's a modified version:

    the TCP standard nor to make any new recommendations herein.

Joe

---

From: Fernando Gont <[email-masked]>
Date: Sun, 31 Jan 2010 18:11:33 -0300

Joe Touch wrote:

> implementation of nonstandard TCP behavior and neither to change the
> TCP standard nor to make any new recommendations herein.

"nonstandard TCP behavior" still seems misleading.

How about:

> implementation of TCP behavior and neither to change the
> TCP standard nor to make any new recommendations herein.

?

Kind regards,

---

From: Joe Touch <[email-masked]>
Date: Sun, 31 Jan 2010 13:33:26 -0800

> "nonstandard TCP behavior" still seems misleading.

I only really added "nor to make any new recommendations herein" and
change the phrasing (changed 'but' to a 'neither'/'nor' pair).

The 'nonstandard' part was from your original text (below, from v10),
and I think it's still needed, i.e., I think the above text is preferable.

Joe

(from v10:
)

---

From: Fernando Gont <[email-masked]>
Date: Sun, 31 Jan 2010 18:41:31 -0300

> and I think it's still needed, i.e., I think the above text is preferable.

Yes and in retrospective I had said (days ago) that the text might be
misleading. (e.g. the pmtud fix is not part of the standard, but does
not violate it, either)

Can anybody else weigh in, please?

Thanks,

---

From: "Eddy, Wesley M. (GRC-MS00)[ASRC AEROSPACE CORP]" <[email-masked]>
Date: Sun, 31 Jan 2010 19:00:23 -0600

I think it's okay to leave the "nonstandard" word out, as it seems that there's sufficient other text that's clear about the status of the behavior described.

That said, I don't feel strongly about it, but am just throwing 2 cents in.

________________________________________
From: [email-masked] [[email-masked]] On Behalf Of Fernando Gont [[email-masked]]
Sent: Sunday, January 31, 2010 4:41 PM
To: Joe Touch
Cc: [email-masked]
Subject: Re: [tcpm] [Fwd: New Version   Notification    for     draft-ietf-tcpm-icmp-attacks-10]

Thanks,

_______________________________________________
tcpm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/tcpm