Subject: [Tsvwg] ICMP handling

From: Michael Tuexen <[email-masked]>
Date: Thu, 15 Sep 2005 15:48:37 +0200

Dear all,

the IG currently introduces a new appendix C which describes the
processing of ICMP messages.

 From a security point of view it is important that this processing
is done by every SCTP capable host to protect hosts that are not
SCTP capable.

So I would suggest to put some text also outside an appendix which
requires SCTP capable host to do the ICMP processing as described in
the new appendix.

Best regards
Michael

_______________________________________________
tsvwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tsvwg

---

From: Randall Stewart <[email-masked]>
Date: Thu, 15 Sep 2005 10:06:17 -0400

> requires SCTP capable host to do the ICMP processing as described in
Michael:

Thinking about this (and Wolfgang's previous statments) I think
you are correct. The point of taking care of the ICMP is
to prevent DOS attack's on NON-SCTP aware hosts. If we do
not require this, then an SCTP stack may not perform optimally
BUT non-SCTP stacks can get hammered like the 
draft-stewart-tsvwg-sctpthreat-xx.txt
draft outlines... Not sure if the draft is still there.. I
should check to make sure .. yep its at -03 and was
posted in June of 05 :-D

Anyway.. lets move back to the MUST's that I posted before and
I think we should have the I-G add a tie in, at the
security section like:
*****************************************************************
---------
Old text: Section 11.3
---------

    SCTP also provides no protection against attacks originating at or
    beyond the SCTP node and taking place within the context of an
    existing association.  Prevention of such attacks should be covered
    by appropriate security policies at the host site, as discussed in
    Section 11.2.1.

---------
New text: Section 11.3
---------

    SCTP also provides no protection against attacks originating at or
    beyond the SCTP node and taking place within the context of an
    existing association.  Prevention of such attacks should be covered
    by appropriate security policies at the host site, as discussed in
    Section 11.2.1.

11.4 Protection of non-SCTP capable hosts.

    In order to assure non-SCTP capable hosts are not sent large
    numbers of SCTP packets incorrectly all SCTP stacks MUST
    implement the ICMP handling described in Appendix C.

*****************************************************************

It is nice to be finally having the technical discussions that
we needed to on the draft.. even if its a bit late :-D

I will wait a few more days until I submit this since maybe
we will have a few other late comments.. and possibly
someone will want to comment on the above... wordsmithing
welcome :-D

R

-- 
Randall Stewart
803-345-0369 <or> 815-342-5222(cell)

---

From: Vlad Yasevich <[email-masked]>
Date: Thu, 15 Sep 2005 10:51:36 -0400

Randy

>    implement the ICMP handling described in Appendix C.

Is it OK to require so strongly an implementation of an Appendix?

-vlad

---

From: Michael Tuexen <[email-masked]>
Date: Thu, 15 Sep 2005 17:06:28 +0200

Hi Vlad,

I think from a security point of view, yes.

The CRC32C stuff is in appendix B.

We could it make it a new section 10, for example. But
I think that does not change anything.

Best regards
Michael

---

From: Randall Stewart <[email-masked]>
Date: Thu, 15 Sep 2005 13:49:36 -0400

Well.. I don't see why not..

The CRC32c algorithm is an appendix (and so
was the orginal Adler32).. and without any
of these you definetly will NOT be able
to get any packets accepted from a peer.

As to ICMP.. its not per.se. part of the
protocol.. so I don't see how it would fit
in any protocol section... So it seems an
ok fit to me :-D

R

---

From: "Brian F. G. Bidulock" <[email-masked]>
Date: Thu, 15 Sep 2005 11:56:09 -0600

Randall,

Works for me.

--brian

-- 
Brian F. G. Bidulock    ¦ The reasonable man adapts himself to the ¦
[email-masked]    ¦ world; the unreasonable one persists in  ¦
http://www.openss7.org/ ¦ trying  to adapt the  world  to himself. ¦
                        ¦ Therefore  all  progress  depends on the ¦
                        ¦ unreasonable man. -- George Bernard Shaw ¦

---

From: Janardhan Iyengar <[email-masked]>
Date: Mon, 19 Sep 2005 10:33:25 -0400 (EDT)

This mod looks fine to me. So does the rest of the IG.

regards,
jana

>>> Is it OK to require so strongly an implementation of an Appendix?

---------------------------------------------------------------
Janardhan R. Iyengar           http://www.cis.udel.edu/~iyengar
Protocol Engineering Lab  --   CIS   --  University Of Delaware
---------------------------------------------------------------