Re: Should CPE allow all IPsec through? Was: Re: CPEs

[Iljitsch van Beijnum <iljitsch@muada.com>]

On 9 jan 2008, at 2:07, Fred Baker wrote:

> It seems to me that there is an excellent attack in this. If I know  
> that a given address (perhaps found in the envelope of an email I  
> have observed) is populated and attempt to open an IPsec session, I  
> consume some amount of computing resource. If I do that a lot, I can  
> consume a large quantity of computing resource. I can obviously also  
> consume other resources including bandwidth of various kinds.
Bandwidth is not an issue: under normal circumstances, the bandwidth  
between the ISP and the CPE is the bottleneck, so filtering by the CPE  
doesn't help against an attacker trying to fill up the available  
bandwidth.
I suppose it's possible that an attacker gets to use up CPU resources  
on the receiving system, but only if that system has an IPsec  
implementation that doesn't have any protection against that. There  
are two types of IPsec packets (well, three really): the UDP port 500  
IKE/ISAKMP protocol for setting up security associations and the data  
packets that are signed and/or encrypted (ESP or AH). If there has  
been no SA negotation and no SAs have been created through some other  
mechanism, the SPI in the ESP or AH packets won't match existing state  
so the packets will be rejected without much work on the receiver's  
part. So the only avenue of attack is IKE/ISAKMP. I'm not intimately  
familiar with that, but it seems to me that a non-server host would  
know who it wants to communicate with in advance, and reject any SA  
establishment attempts from entities that present identities that  
don't match those that are expected.
The spam analogy doesn't apply here for several reasons. First of all,  
spam goes to servers. If you are sitting at a random IPv6 address, the  
chances of a spammer contacting you to deliver spam are incredibly  
tiny. (I don't even think they bother to scan the IPv4 address space  
for places to deliver spam.) Apart from that, the reason that spam  
exists is that it gets seen by people and leads to separation of a  
user from his money in one way or another in a small percentage of all  
cases. Spurious IPsec packets don't do that.
The reason to not want IPsec to go through stateful firewalls can be  
either:
1. DoS risks
2. Penetration risks

I can't definitively say that those two risks round down to zero, but  
I am fairly confident that if there is a single protocol that we can  
allow through safely, IPsec is that protocol. It would be helpful to  
hear from IPsec experts and vendors of OSes with IPsec, though.