Re: ip_conntrack_proto_sctp INIT_ACK messages dropped

[Patrick McHardy <kaber@trash.net>]

[-- Attachment #1: Type: text/plain, Size: 3149 bytes --]

Ariel Rosenblatt wrote:
> You are right about the conntrack being susceptible to fraudulent INIT
> messages. This holds true for INIT-ACKs as well as the first INIT send. 
> 
> Saving the verification tags harms more than it helps, because it makes the
> connection tracking vulnerable to dos attacks. While the goal is dumping
> invalid traffic, it could instead wind up discarding valid traffic. 
> 
> I thought about these issues and I don't see a way of using verification
> tags without making the connection tracking susceptible to this problems.
> Saving tie-tags for existing associations until the COOKIE-ECHO/ACK is
> processed could alleviate the problem. However, it will still take one
	> fraudulent message to launch an attack and cause the module to 
discard valid
> traffic or prevent the association from being established by overwriting the
> valid tie-tag. 

How can it be attacked with a single message ? I'm thinking of something
like this (based on RFC 2960 5.2.4.1):

Endpoint A                                          Endpoint Z
<-------------- Association is established---------------------->
Tag=Tag_A                                             Tag=Tag_Z
<--------------------------------------------------------------->
{A crashes and restarts}
{app sets up a association with Z}
(build TCB)
INIT [I-Tag=Tag_A'
       & other info]  --------\ <- conntrack lets this packet pass
(Start T1-init timer)         \
(Enter COOKIE-WAIT state)      \---> (find a existing TCB
                                       compose temp TCB and Cookie_Z
                                       with Tie-Tags to previous
                                       association)
                                 /--- INIT ACK [Veri Tag=Tag_A',
                                /               I-Tag=Tag_Z',
(Cancel T1-init timer) <------/                Cookie_Z[TieTags=
                                                Tag_A,Tag_Z
                                                 & other info]
                                      (destroy temp TCB,leave original
                                       in place)

Conntrack notes the Tie-Tags if they match the used tags and
lets this message pass.

COOKIE ECHO [Veri=Tag_Z',
              Cookie_Z
              Tie=Tag_A,
              Tag_Z]----------\
(Start T1-init timer)         \
(Enter COOKIE-ECHOED state)    \---> (Find existing association,
                                       Tie-Tags match old tags,
                                       Tags do not match i.e.
                                       case X X M M above,
                                       Announce Restart to ULP
                                       and reset association).

Conntrack verifies the tags match the saved tags and resets the
association.

So without a full exchange no data is changed.

> In the mean time I patched the module with the code below (please see a more
> robust patch at the end of the message) to solve the saved vtag problem for
> both directions.

Thanks. I applied this slightly different version (no new variable) and
I'm going to submit it later today.

Regards
Patrick

[-- Attachment #2: x --]
[-- Type: text/plain, Size: 1056 bytes --]

# This is a BitKeeper generated diff -Nru style patch.
#
# ChangeSet
#   2005/02/22 14:52:03+01:00 ariel@blueslice.com 
#   [NETFILTER]: Fix sctp association restart
#   
#   Signed-off-by: Patrick McHardy <kaber@trash.net>
# 
# net/ipv4/netfilter/ip_conntrack_proto_sctp.c
#   2005/02/22 14:51:54+01:00 ariel@blueslice.com +2 -2
#   [NETFILTER]: Fix sctp association restart
#   
#   Signed-off-by: Patrick McHardy <kaber@trash.net>
# 
diff -Nru a/net/ipv4/netfilter/ip_conntrack_proto_sctp.c b/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
--- a/net/ipv4/netfilter/ip_conntrack_proto_sctp.c	2005-02-22 14:54:35 +01:00
+++ b/net/ipv4/netfilter/ip_conntrack_proto_sctp.c	2005-02-22 14:54:35 +01:00
@@ -400,8 +400,8 @@
 					return -1;
 			}
 			DEBUGP("Setting vtag %x for dir %d\n", 
-					ih->init_tag, CTINFO2DIR(ctinfo));
-			conntrack->proto.sctp.vtag[IP_CT_DIR_ORIGINAL] = ih->init_tag;
+					ih->init_tag, !CTINFO2DIR(ctinfo));
+			conntrack->proto.sctp.vtag[!CTINFO2DIR(ctinfo)] = ih->init_tag;
 		}
 
 		conntrack->proto.sctp.state = newconntrack;