Subject: [Ipsec] RFC 4301 and stateful fragment checking

From: Scott C Moonen <[email-masked]>
Date: Thu, 12 Apr 2007 12:56:21 -0600

In section 7.3, RFC 4301 indicates that "An implementation MAY support 
some form of stateful fragment checking for a tunnel mode SA with 
non-trivial port (or ICMP type/code or MH type) field values (not ANY or 
OPAQUE)."  Later, in section 7.4, the RFC indicates that "All 
implementations MUST support stateful fragment checking to accommodate 
BYPASS traffic for which a non-trivial port range is specified."

Section 7.4 justifies the MUST as follows:

<quote>The concern is that BYPASS of a cleartext, non-initial fragment 
arriving at an IPsec implementation could undermine the security afforded 
IPsec-protected traffic directed to the same destination.  For example, 
consider an IPsec implementation configured with an SPD entry that calls 
for IPsec protection of traffic between a specific source/destination 
address pair, and for a specific protocol and destination port, e.g., TCP 
traffic on port 23 (Telnet).  Assume that the implementation also allows 
BYPASS of traffic from the same source/destination address pair and 
protocol, but for a different destination port, e.g., port 119 (NNTP).  An 
attacker could send a non-initial fragment (with a forged source address) 
that, if bypassed, could overlap with IPsec-protected traffic from the 
same source and thus violate the integrity of the IPsec-protected traffic. 
 Requiring stateful fragment checking for BYPASS entries with non-trivial 
port ranges prevents attacks of this sort.  As noted above, in network 
configurations where fragments of a packet might be sent or received via 
different security gateways or BITW implementations, stateful strategies 
for tracking fragments may fail.</quote>

Given my understanding of the use of OPAQUE selectors, it seems to me that 
the concern here is unwarranted.  The non-initial fragments will not 
normally match either the TCP port 23 SPD entry or the TCP port 119 SPD 
entry, since their port value is indeterminate (per section 4.4.1.1: "If a 
port selector specifies a value other than ANY or OPAQUE, it cannot match 
packets that are non-initial fragments.").  Either stateful fragment 
checking may be performed to ensure that the fragments match the 
appropriate SPD entry, or an OPAQUE SPD entry may be configured to force 
equivalent IPsec protection for all fragments.

Because the fragments will not match the port-119 BYPASS rule, and because 
the use of OPAQUE selectors prevents the attacker from injecting fragments 
into the IPsec-protected traffic, it seems to me that the RFC's concern 
can be addressed without stateful fragment checking, and therefore the 
MUST above is unwarranted.  Can anyone comment on this?

Thanks in advance,

Scott Moonen ([email-masked])

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Tero Kivinen <[email-masked]>
Date: Fri, 13 Apr 2007 13:47:31 +0300

> MUST above is unwarranted.  Can anyone comment on this?

If that MUST is not followed then all fragmented packets using port
119 will be dropped, thus causing the BYPASS rule not work (note, that
packets might leave the sending host as one packet, and they might get
fragmented in the network, thus in the sending host it uses the BYPASS
rule, but on the receiving end it used BYPASS and non-first fragments
rule).

The RFC4301 tries to make solutions which allows fragmented packets to
be used, thus it enforces solutions which allows using fragments, not
solutions which prevent using them. Because of this there is this MUST
which makes sure fragmented bypassed traffic will work regardless what
other rules there are. 
-- 
[email-masked]

---

From: Scott C Moonen <[email-masked]>
Date: Fri, 13 Apr 2007 06:02:09 -0600

Thank you, Tero!  You've cut right to the heart of my misunderstanding.  I 
was thinking that with a suitably matched policy between sender and 
receiver everything would work fine.  I'm accustomed to the fact that IPv6 
fragmentation will not occur in the network, but it slipped my mind that 
IPv4 fragmentation may occur in the network without the knowledge of the 
sender.

Tero Kivinen <[email-masked]> 
04/13/2007 06:47 AM

To
Scott C Moonen/Raleigh/IBM@IBMUS
cc
[email-masked]
Subject
[Ipsec] RFC 4301 and stateful fragment checking