[secdir] Topic for our SecDir lunch: The PTB-PTS ICMP-based Attack against IPsec Gateways

[Vincent Roca <[e-mail]>]

Hi everybody,

There’s a subject I’d like to discuss with you tomorrow during our SecDir lunch if we have time for that.
It’s about a DoS on IPsec we have found with my previous PhD student, Ludovic. It’s described here:

	« Too Big or Too Small? The PTB-PTS ICMP-based Attack against IPsec Gateways », GLOBECOM’14.
	PDF is freely available at:	https://hal.inria.fr/hal-01052994/en/

The study has limits since it only focusses on IPv4 and a single OS (stable Squeeze Debian distribution).
That being said, we have an exploit using default IPsec configuration, either preventing end-hosts to open
new TCP connections (when relying on PMTUd) or creating large initial delay/performance penalties
(when relying on PLPMTUd). And UDP connexions will be affected too…
The only thing an attacker needs is to be on the IPsec tunnel path with the ability to eavesdrop encrypted
traffic and send back a forged packet (e.g., a non encrypted Wifi network should be sufficient, I see many
of them available at IETF ;-)

So we’d like to have your feedback in particular on the following two points:

- Is there an appropriate way to manage Path MTUs in presence of IPsec tunnels when we are already
at the minimum PMTU size?

- Is there an appropriate way to make the end-host (in the « red » protected LAN) and its IPsec gateway
understand each other when we are already at the minimum PMTU?

This is clearly a tricky situation that may not be well addressed today. Is it described somewhere in an RFC
so that implementers have clear guidelines? We didn’t find anything, but it does not mean there’s nothing.
And may the problem be extended to other tunneling technologies that perform encapsulation?

Your feedback is welcome.
Thanks,

  Ludovic and Vincent

--
   Vincent Roca, PhD/HDR, Inria research institute, France
   http://privatics.inrialpes.fr/~roca