d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Introduce two new sysctls:

Browse Source 
net.inet.ipsec.test_replay - When set to 1, IPsec will send packets with
	the same sequence number. This allows to verify if the other side
	has proper replay attacks detection.

net.inet.ipsec.test_integrity - When set 1, IPsec will send packets with
	corrupted HMAC. This allows to verify if the other side properly
	detects modified packets.

I used the first one to discover that we don't have proper replay attacks
detection in ESP (in fast_ipsec(4)).
This commit is contained in:
Pawel Jakub Dawidek 2006-04-09 19:11:45 +00:00
parent 2320ec8b73
commit dfa9422b4a
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=157613
4 changed files with 54 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
sys/netipsec/ipsec.c
View File

@ -148,6 +148,21 @@ SYSCTL_INT(_net_inet_ipsec, OID_AUTO,
SYSCTL_STRUCT(_net_inet_ipsec, OID_AUTO,
ipsecstats, CTLFLAG_RD, &newipsecstat, newipsecstat, "");
/*
* When set to 1, IPsec will send packets with the same sequence number.
* This allows to verify if the other side has proper replay attacks detection.
*/
int ipsec_replay = 0;
SYSCTL_INT(_net_inet_ipsec, OID_AUTO, test_replay, CTLFLAG_RW, &ipsec_replay, 0,
"Emulate replay attack");
/*
* When set 1, IPsec will send packets with corrupted HMAC.
* This allows to verify if the other side properly detects modified packets.
*/
int ipsec_integrity = 0;
SYSCTL_INT(_net_inet_ipsec, OID_AUTO, test_integrity, CTLFLAG_RW,
&ipsec_integrity, 0, "Emulate man-in-the-middle attack");
#ifdef INET6
int ip6_esp_trans_deflev = IPSEC_LEVEL_USE;
int ip6_esp_net_deflev = IPSEC_LEVEL_USE;

2
sys/netipsec/ipsec.h
View File

@ -330,6 +330,8 @@ struct ipsec_history {
};
extern int ipsec_debug;
extern int ipsec_replay;
extern int ipsec_integrity;
extern struct newipsecstat newipsecstat;
extern struct secpolicy ip4_def_policy;

16
sys/netipsec/xform_ah.c
View File

@ -998,7 +998,9 @@ ah_output(
error = EINVAL;
goto bad;
}
sav->replay->count++;
/* Emulate replay attack when ipsec_replay is TRUE. */
if (!ipsec_replay)
sav->replay->count++;
ah->ah_seq = htonl(sav->replay->count);
}
@ -1178,6 +1180,18 @@ ah_output_cb(struct cryptop *crp)
free(tc, M_XDATA);
crypto_freereq(crp);
/* Emulate man-in-the-middle attack when ipsec_integrity is TRUE. */
if (ipsec_integrity) {
int alen;
/*
* Corrupt HMAC if we want to test integrity verification of
* the other side.
*/
alen = AUTHSIZE(sav);
m_copyback(m, m->m_pkthdr.len - alen, alen, ipseczeroes);
}
/* NB: m is reclaimed by ipsec_process_done. */
err = ipsec_process_done(m, isr);
KEY_FREESAV(&sav);

23
sys/netipsec/xform_esp.c
View File

@ -759,7 +759,12 @@ esp_output(
/* Initialize ESP header. */
bcopy((caddr_t) &sav->spi, mtod(mo, caddr_t) + roff, sizeof(u_int32_t));
if (sav->replay) {
u_int32_t replay = htonl(++(sav->replay->count));
u_int32_t replay;
/* Emulate replay attack when ipsec_replay is TRUE. */
if (!ipsec_replay)
sav->replay->count++;
replay = htonl(sav->replay->count);
bcopy((caddr_t) &replay,
mtod(mo, caddr_t) + roff + sizeof(u_int32_t),
sizeof(u_int32_t));
@ -942,6 +947,22 @@ esp_output_cb(struct cryptop *crp)
free(tc, M_XDATA);
crypto_freereq(crp);
/* Emulate man-in-the-middle attack when ipsec_integrity is TRUE. */
if (ipsec_integrity) {
static unsigned char ipseczeroes[AH_HMAC_HASHLEN];
struct auth_hash *esph;
/*
* Corrupt HMAC if we want to test integrity verification of
* the other side.
*/
esph = sav->tdb_authalgxform;
if (esph != NULL) {
m_copyback(m, m->m_pkthdr.len - AH_HMAC_HASHLEN,
AH_HMAC_HASHLEN, ipseczeroes);
}
}
/* NB: m is reclaimed by ipsec_process_done. */
err = ipsec_process_done(m, isr);
KEY_FREESAV(&sav);