_______________________________________________
Ipsec mailing list
Ipsec <at> ietf.org
https://www1.ietf.org/mailman/listinfo/ipsec

_______________________________________________
Ipsec mailing list
Ipsec <at> ietf.org
https://www1.ietf.org/mailman/listinfo/ipsec

In section 7.3, RFC 4301 indicates that "An implementation MAY support some form of stateful fragment checking for a tunnel mode SA with non-trivial port (or ICMP type/code or MH type) field values (not ANY or OPAQUE)."  Later, in section 7.4, the RFC indicates that "All implementations MUST support stateful fragment checking to accommodate BYPASS traffic for which a non-trivial port range is specified."

Section 7.4 justifies the MUST as follows:

<quote>The concern is that BYPASS of a cleartext, non-initial fragment arriving at an IPsec implementation could undermine the security afforded IPsec-protected traffic directed to the same destination.  For example, consider an IPsec implementation configured with an SPD entry that calls for IPsec protection of traffic between a specific source/destination address pair, and for a specific protocol and destination port, e.g., TCP traffic on port 23 (Telnet).  Assume that the implementation also allows BYPASS of traffic from the same source/destination address pair and protocol, but for a different destination port, e.g., port 119 (NNTP).  An attacker could send a non-initial fragment (with a forged source address) that, if bypassed, could overlap with IPsec-protected traffic from the same source and thus violate the integrity of the IPsec-protected traffic.  Requiring stateful fragment checking for BYPASS entries with non-trivial port ranges prevents attacks of this sort.  As noted above, in network configurations where fragments of a packet might be sent or received via different security gateways or BITW implementations, stateful strategies for tracking fragments may fail.</quote>

Given my understanding of the use of OPAQUE selectors, it seems to me that the concern here is unwarranted.  The non-initial fragments will not normally match either the TCP port 23 SPD entry or the TCP port 119 SPD entry, since their port value is indeterminate (per section 4.4.1.1: "If a port selector specifies a value other than ANY or OPAQUE, it cannot match packets that are non-initial fragments.").  Either stateful fragment checking may be performed to ensure that the fragments match the appropriate SPD entry, or an OPAQUE SPD entry may be configured to force equivalent IPsec protection for all fragments.

Because the fragments will not match the port-119 BYPASS rule, and because the use of OPAQUE selectors prevents the attacker from injecting fragments into the IPsec-protected traffic, it seems to me that the RFC's concern can be addressed without stateful fragment checking, and therefore the MUST above is unwarranted.  Can anyone comment on this?

Thanks in advance,


Scott Moonen (smoonen <at> us.ibm.com)

_______________________________________________
Ipsec mailing list
Ipsec <at> ietf.org
https://www1.ietf.org/mailman/listinfo/ipsec

Thank you, Tero!  You've cut right to the heart of my misunderstanding.  I was thinking that with a suitably matched policy between sender and receiver everything would work fine.  I'm accustomed to the fact that IPv6 fragmentation will not occur in the network, but it slipped my mind that IPv4 fragmentation may occur in the network without the knowledge of the sender.


Scott Moonen (smoonen <at> us.ibm.com)

Tero Kivinen <kivinen <at> iki.fi> 04/13/2007 06:47 AM

To Scott C Moonen/Raleigh/IBM <at> IBMUS cc ipsec <at> ietf.org Subject [Ipsec] RFC 4301 and stateful fragment checking

Scott C Moonen writes:
> Because the fragments will not match the port-119 BYPASS rule, and because
> the use of OPAQUE selectors prevents the attacker from injecting fragments
> into the IPsec-protected traffic, it seems to me that the RFC's concern
> can be addressed without stateful fragment checking, and therefore the
> MUST above is unwarranted.  Can anyone comment on this?

If that MUST is not followed then all fragmented packets using port
119 will be dropped, thus causing the BYPASS rule not work (note, that
packets might leave the sending host as one packet, and they might get
fragmented in the network, thus in the sending host it uses the BYPASS
rule, but on the receiving end it used BYPASS and non-first fragments
rule).

The RFC4301 tries to make solutions which allows fragmented packets to
be used, thus it enforces solutions which allows using fragments, not
solutions which prevent using them. Because of this there is this MUST
which makes sure fragmented bypassed traffic will work regardless what
other rules there are.
--
kivinen <at> safenet-inc.com

_______________________________________________
Ipsec mailing list
Ipsec <at> ietf.org
https://www1.ietf.org/mailman/listinfo/ipsec