Re: [fw-wiz] Transparent proxies and PMTUD on the (WWW) serverside

From: Carson Gaspar (carson_at_taltos.org)
Date: 08/27/03

  • Next message: Barney Wolff: "Re: [fw-wiz] Re: Setting up H323 IP telephony etc - was Re: [fw-wiz] Apple's iSight and Firewalls" 
    To: firewall-wizards@honor.icsalabs.com
Date: Tue, 26 Aug 2003 19:49:16 -0400

    --On Wednesday, August 27, 2003 00:33:53 +0200 Mikael Olsson
    <mikael.olsson@clavister.com> wrote:

    >
    > "Marcus J. Ranum" wrote:
    >>
    >> > If an ALG supports transparent proxying, enables PMTUD, and does not
    >> > intercept ICMP must fragment, the ALG is broken. File a high priority
    >> > trouble ticket with your vendor.
    >>
    >> If an ALG understands PMTUD and ICMP it's not an ALG, it's a packet
    >> filter masquerading as a proxy. All that stuff is totally below
    >> application space.
    >
    > Um, no. I'll rephrase Carson's mail for him:
    >
    > "If an ALG-based firewall system that implements transparency on
    > the client side has PMTUd on in the underlying operating system,
    > and the transparency code doesn't handle ICMP 'must frag'
    > errors, the firewall system is b0rken."
    >
    > So, yeah, ok, the ALG itself shouldn't care about ICMP errors.
    > But the transparency function / packet filter that makes
    > the ALG transparent surely should. And it doesn't make
    > the firewall a packet filter in my book.

    Exactly.

    And Marcus, almost all ALGs "know" about PMTUD and ICMP, they just
    outsource it to the kernel (in a rare example of compartmentalized code ;-)
    ). Once transparency is involved, the outsourcing is no longer complete, as
    specific packet re-writing instructions must be communicated to the kernel.
    In the Sidewinder case, they signed a bad outsourcing agreement ;-) 

    -- 
Carson
_______________________________________________
firewall-wizards mailing list
firewall-wizards@honor.icsalabs.com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
  • Next message: Barney Wolff: "Re: [fw-wiz] Re: Setting up H323 IP telephony etc - was Re: [fw-wiz] Apple's iSight and Firewalls"

    Relevant Pages

    • Re: unexpected ICMP host unreachable - no worries?
      ... an attack?". ... You observed ICMP backscatter traffic. ... I'm guessing this packet is remote controlling command to distributed ... easily relate that outgoing scan or outbound flood packets after detect ...
      (comp.os.linux.security)
    • Re: Why some hosts in Internet not prefer to be traceroute-d ?
      ... i.e. not to send a TTL exceeded ICMP packet back to the host. ... This block may be not generating ICMP type 11 (most ... exceeded" reply associated with a UDP packet, ...
      (comp.os.linux.networking)
    • Re: Interesting fw log: "ICMP type 3 not embeddable"
      ... I've seen ICMP type 3 embedded TCP or UDP datagram but never seen ICMP ... REJECT incoming ICMP 3 packet) or is using ICMP mis-implementation OS ... is running BSD code based some router. ...
      (comp.os.linux.security)
    • FW: ICMP fragmentation required but DF set problems.
      ... ICMP fragmentation required but DF set problems. ... against some TCP/IP stack. ... Anyway the stack takes an hash table with the MTU of other ends. ... size of the quoted packet in the ICMP packet, ...
      (FreeBSD-Security)
    • Re: Interesting fw log: "ICMP type 3 not embeddable"
      ... I've seen ICMP type 3 embedded TCP or UDP datagram but never seen ICMP ... REJECT incoming ICMP 3 packet) or is using ICMP mis-implementation OS ... is running BSD code based some router. ...
      (comp.os.linux.security)