ICMP attacks against TCP

ICMP attacks against TCP

[Fernando Gont]

Folks,

I'm the author of an IETF Internet Draft that discusses the use of ICMP to 
perform a number of attacks against TCP and other similar protocols. The 
draft can be found at: 
http://www.ietf.org/internet-drafts/draft-gont-tcpm-icmp-attacks-01.txt

The draft proposes some work-arounds that eliminate or minimize the impact 
of these attacks.

For example, one of the proposed work-arounds is to check the TCP sequence 
number that is included in the payload of ICMP error messages. While this 
check has been implemented in a number of TCP/IP stack implementations 
(including Linux), it has never been officially documented.

There are some other work-arounds (for example, ignoring ICMP Source Quench 
messages) are not implemented in Linux, though.

I'd appreciate any comments on the draft. Both for those work-arounds 
implemented by Linux, and for those that aren't. Thus, I'd be able to 
address your comments in the next revision of the draft, and will also 
sum-up your feedback and post it to the relevant IETF mailing list (that of 
the TCPM WG mailing-list).
In case there's consensus that the proposed fixes are the right way to go, 
it will probably help to move the draft forward, and thus maybe the 
proposed work-arounds will be adopted by other TCP/IP stack implementations.

Thanks!

--
Fernando Gont
e-mail: fernando@gont.com.ar || fgont@acm.org

Re: ICMP attacks against TCP

[David S. Miller]

On Sun, 12 Sep 2004 22:40:04 -0300
Fernando Gont <fernando@gont.com.ar> wrote:

> There are some other work-arounds (for example, ignoring ICMP Source Quench 
> messages) are not implemented in Linux, though.

I have no problem changing Linux to ignore these ICMP Source Quench
messages, I completely agree with the draft.  I've made the
change in both my 2.4.x and 2.6.x trees as follows:

# This is a BitKeeper generated diff -Nru style patch.
#
# ChangeSet
#   2004/09/13 15:43:14-07:00 davem@nuts.davemloft.net 
#   [TCP]: Just silently ignore ICMP Source Quench messages.
#   
#   Recommended by draft-gont-tcpm-icmp-attacks-01.txt
#   
#   Signed-off-by: David S. Miller <davem@davemloft.net>
# 
# net/ipv4/tcp_ipv4.c
#   2004/09/13 15:42:33-07:00 davem@nuts.davemloft.net +1 -5
#   [TCP]: Just silently ignore ICMP Source Quench messages.
# 
diff -Nru a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
--- a/net/ipv4/tcp_ipv4.c	2004-09-13 15:44:01 -07:00
+++ b/net/ipv4/tcp_ipv4.c	2004-09-13 15:44:01 -07:00
@@ -1033,11 +1033,7 @@
 
 	switch (type) {
 	case ICMP_SOURCE_QUENCH:
-		/* This is deprecated, but if someone generated it,
-		 * we have no reasons to ignore it.
-		 */
-		if (!sock_owned_by_user(sk))
-			tcp_enter_cwr(tp);
+		/* Just silently ignore these. */
 		goto out;
 	case ICMP_PARAMETERPROB:
 		err = EPROTO;

Re: ICMP attacks against TCP

[David S. Miller]

On Sun, 12 Sep 2004 22:40:04 -0300
Fernando Gont <fernando@gont.com.ar> wrote:

> I'd appreciate any comments on the draft. Both for those work-arounds 
> implemented by Linux, and for those that aren't.

Besides the Source Quench issue, which I just made comply with
your draft, which recommendations are still missing in Linux?

Re: ICMP attacks against TCP

[Fernando Gont]

At 16:01 13/09/2004 -0700, David S. Miller wrote:

> > There are some other work-arounds (for example, ignoring ICMP Source 
> Quench
> > messages) are not implemented in Linux, though.
>
>I have no problem changing Linux to ignore these ICMP Source Quench
>messages, I completely agree with the draft.  I've made the
>change in both my 2.4.x and 2.6.x trees as follows:

Great!

Thanks so much for your feedback!


--
Fernando Gont
e-mail: fernando@gont.com.ar || fgont@acm.org