Subject: [quicwg/base-drafts] ICMP and ICMPv6 (Type: DestinationUnreachable) (#377)

From: Igor Lubashev <[email-masked]>
Date: Wed, 08 Mar 2017 21:40:07 -0800

This is related to #353.

What would we expect endpoints to do upon the receipt of ICMP (or ICMPv6) Type=DestinationUnreachable?  For IPv6, that message has a large chunk of the original packet, proving that a path element sent it. For IPv4, there is very little entropy there (just your src port).

Can this be as trusted as PUBLIC_RESET by Clients? For IPv4 the answer is likely to be "no". For ipv6, I am not that sure. But there are real implications for clients that cannot just fall back to tcp.

If you ignore ICMP and keep retrying the dead server, you are very likely missing an opportunity to switch the server (switch to another IP offered by DNS).

If you do not ignore ICMP (especially ICMPv4) and try reopening the connection (using a different server IP), you are allowing using your client in a highly amplified reflection DDOS attack against the sever. The attacker just needs to send you a slow stream of forged ICMP to get you to keep re-opening/re-negotiating connections and retrying expensive requests.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/377

---

From: Martin Thomson <[email-masked]>
Date: Wed, 08 Mar 2017 21:49:09 -0800

We really need to be careful not to conflate "path dead" signals like this (their authenticity aside), with "connection dead" signals like Public Reset.

We could use the same advice we have for PMTUD: treat these packets with a degree of suspicion.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/377#issuecomment-285260996

---

From: Igor Lubashev <[email-masked]>
Date: Wed, 08 Mar 2017 22:19:38 -0800

"ICMP(v6) Type=DestUnreach Op=PortUnreach" can mean "web sever application is restarting" vs PublicReset that can mean "web sever application just restarted". A dubious distinction.

Also, "treat these packets with a degree of suspicion" is hardly an actionable recommendation.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/377#issuecomment-285265632

---

From: Martin Thomson <[email-masked]>
Date: Wed, 08 Mar 2017 22:57:39 -0800

Read the section on PMTUD for a definition of what that suspicion might manifest as.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/377#issuecomment-285271220

---

From: Igor Lubashev <[email-masked]>
Date: Wed, 08 Mar 2017 23:29:21 -0800

Thank you. Yes, that section gives ipv4 risk mitigation recommendations that can apply here as well. It would be nice to spell it out. It is also important to address ICMPv6 vs PR question.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/377#issuecomment-285276025