Subject: [OPSEC] I-D Action: draft-ietf-opsec-icmp-filtering-02.txt

From: [email-masked]
Date: Fri, 17 Feb 2012 07:57:54 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Operational Security Capabilities for IP Network Infrastructure Working Group of the IETF.

	Title           : Recommendations for filtering ICMP messages
	Author(s)       : Fernando Gont
                          Guillermo Gont
                          Carlos Pignataro
	Filename        : draft-ietf-opsec-icmp-filtering-02.txt
	Pages           : 49
	Date            : 2012-02-17

   This document document provides advice on the filtering of ICMPv4 and
   ICMPv6 messages.  Additionaly, it discusses the operational and
   interoperability implications of such filtering.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-opsec-icmp-filtering-02.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

This Internet-Draft can be retrieved at:
ftp://ftp.ietf.org/internet-drafts/draft-ietf-opsec-icmp-filtering-02.txt

---

From: "Panos Kampanakis" <[email-masked]>
Date: Tue, 21 Feb 2012 16:35:35 -0500

Hello,

Since this was revived (seems significantly changed with plenty of edits to
follow), here are my initial comments. 

- In "2.  Internet Control Message Protocol version 4 (ICMP)" maybe it would
be worth to clarify the table. That it refers to the actions devices need to
take when generating, forwarding or receive such traffic.
Also "Depr" keyword is not clear what it means. For traffic generated it
means you are not supposed to generate it. But when you are receiving, does
it mean you should not allow the packet?
Also I am not sure about the "ICMPv4-unreach", "ICMPv4-redirect" and
"ICMPv4-parameter" that are shown as N/A. The various codes for each are
covered in the sebsequenct options per ICMP type. So, they represent a
superset of the various options. So, I am not sure they need to be in the
table. Or maybe then can be in there just to group their options together.

- There is a difference between Router and Firewall traffic processing. It
seems the document mostly speaks about recommendations on how to process
ICMP with routers. Maybe you want to clarify if the document addresses just
routers of network devices in general. And if the scope includes firewalls,
the recommendations especially for ICMP generation will need to be
clarified.

- In "2.1.1.4.3.  Threats" it seems rate limiting doesn't address the
"connection-reset attacks". Maybe you want to make it clear or propose other
mitigations. 
You might also want to explicitly say that it should not be rate-limited or
blocked.

- In 2.1.1.5.4. maybe you want to mention the impact of breaking PMTU,
especially in VPN setups.

- In 2.1.1.7.3 and 2.1.1.9.3 don't you want to deny the deprecated message
and not rate-limit?

- In 2.1.1.10.3 and 2.1.1.11.3 "May reveal filtering policies" is not
mitigated. You may want to mention the deny for transient traffic.

- In 2.1.1.12.3 and 2.1.1.13.2 "May reveal routing policies" is not
mitigated. You may want to mention the deny for transient traffic.

- In most Threats section rate limiting is mentioned. But blocking transient
traffic is not mentioned to mitigate threats even though it is in the tables
as deny.

- 2.1.3.1.3, 2.1.3.2.3 and 2.1.3.3.3 don't discuss mitigations, rate
limiting or blocking

- Recommendations like inspection statefully or blocking broadcast
destinations (smurf) are not addressed in 2.2.1.1.3 and 3.2.1.2.3 (ICMPv6)

- 2.2.4.1 are deprecated messages. Should routers generate them or drop?
Depr in the table doesn't show if I receive an information echo request
wheat I should do as a router, for example.

- Rare ICMPv4 message types 30 and 31 (rfc1475) could be mentioned

- IPv6 threats sections don't mention mitigations as in ICMP for IPv4

- Many ICMPv6 messages are missing from the v6 section including ICMPv6 RS,
RA, NS, ND. A list is here http://www.iana.org/assignments/icmpv6-parameters

Rgs,
Panos

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
[email-masked]
Sent: Friday, February 17, 2012 10:58 AM
To: [email-masked]
Cc: [email-masked]
Subject: [OPSEC] I-D Action: draft-ietf-opsec-icmp-filtering-02.txt

A New Internet-Draft is available from the on-line Internet-Drafts
directories. This draft is a work item of the Operational Security
Capabilities for IP Network Infrastructure Working Group of the IETF.

_______________________________________________
OPSEC mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/opsec