Re: [v6ops] Extension Headers / Impact on Security Devices

[Mark ZZZ Smith <[e-mail]>]

So quickly, how have IPv4 options been handled? They too can vary the location of the TCP/UDP etc. headers in an IPv4 packet. How have the variety and variable number of TCP options been handled? They too can vary the location of the TCP segment payload.
IOW, I don't think is a new problem exclusive to IPv6, so I think the IPv4 methods used to overcome packet header location variations should be reviewed/considered for applicability to IPv6.
How are you going to handle encryption of payloads and techniques such as multipath TCP when trying to do host and application security in the network rather than on the hosts?
      From: Enno Rey <[e-mail]>
 To: [e-mail] 
 Sent: Friday, 15 May 2015, 21:37
 Subject: [v6ops] Extension Headers / Impact on Security Devices
   
All,

yesterday's IPv6 WG session at the RIPE meeting saw another debate on extension headers.
Pls allow to submit our contribution to v6ops as well. Let me know if you think that the 6man mailing list would be the more appropriate place.

Here's some material/sources we'd like to bring up:

- this is a paper laying out how we could circumvent some major (both commercial and FOSS) IDPS solutions in their at the time of testing latest versions, by various combinations of extension headers and fragmentation:
https://www.ernw.de/download/eu-14-Atlasis-Rey-Schaefer-briefings-Evasion-of-HighEnd-IPS-Devices-wp.pdf.

- here's some thoughts and preliminary results of tests performed to circumvent stateless ACLs:
http://www.insinuator.net/2015/01/evasion-of-cisco-acls-by-abusing-ipv6-discussion-of-mitigation-techniques/.
http://www.insinuator.net/2015/01/the-persistent-problem-of-state-in-ipv6-security/.

We have a (somewhat) ongoing research project looking more closely on the interaction of ACLs and extension headers. For the moment I can only state that it's not just Cisco who are "affected". More results will be available in some months.

As for the topic itself I'd like to summarize our position as follows:
- it has not happened in the past 17 yrs (since publication of RFC2460) that compelling, Internet-scale use cases of extension headers have been brought up.
- we're hence quite sceptical as for the "we might see cool use cases in 15-20 yrs" position someone expressed at the mic.
- from a security perspective they turn out to be a nightmare for (a number of) current security architectures and controls. it is hence understandable (and we actually advise to do so) that they are blocked at the _border_ of networks that have not yet managed to identify a compelling use case.
- looking at the "liberty" RFC2460 provides as for ext_hdrs (wrt to their number, order, options, fragmentable vs. unfragmentable part etc.) we do not expect that type of security issues to disappear soon (the main reason why we did not continue the IDPS research was that the involved student eventually delivered his thesis. one can probably find much more issues provided time & resources. following LANGSEC it might be impossible to "fix" all of them either).
Adding more parsing cycles & intelligence (read: silicon) is not an option, at least not for sth that doesn't have a use case.
- the results of this (blocking) approach have been observed and documented by Jen & Fernando and others (Tim Chown).
- now that "this vicious circle" has gained sufficient ground it will be even less incentivized to develop a compelling use case. which is why we do not expect to see one in the future.

===

Everybody have a great weekend

Best

Enno




-- 
Enno Rey

ERNW GmbH - Carl-Bosch-Str. 4 - 69115 Heidelberg - www.ernw.de
Tel. [phone] - Fax [phone] - Cell [phone] 

Handelsregister Mannheim: HRB 337135
Geschaeftsfuehrer: Enno Rey

=======================================================
Blog: www.insinuator.net || Conference: www.troopers.de
Twitter: @Enno_Insinuator
=======================================================

----- End forwarded message -----

-- 
Enno Rey

ERNW GmbH - Carl-Bosch-Str. 4 - 69115 Heidelberg - www.ernw.de
Tel. [phone] - Fax [phone] - Cell [phone] 

Handelsregister Mannheim: HRB 337135
Geschaeftsfuehrer: Enno Rey

=======================================================
Blog: www.insinuator.net || Conference: www.troopers.de
Twitter: @Enno_Insinuator
=======================================================

_______________________________________________
v6ops mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/v6ops