denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

receiver: Add per-IP cookie threshold

Browse Source 
Because the global cookie threshold is higher than the per-IP block
threshold, it was previously possible for an attacker to block a legitimate
user by sending spoofed IKE_SA_INIT packets from that user's IP.

The timespan for requiring cookies is now also not extended anymore with
every IKE_SA_INIT received during the calm down period.  Because this
allowed an attacker, after initially triggering the global cookie threshold,
to force cookies for all clients by sending just a single spoofed
IKE_SA_INIT every 10 seconds.

We keep track of reaching the per-IP threshold in segments of the hashed
IP addresses, so only a (random, due to chunk_hash()'s random key) subset
of clients will receive cookies, if single IPs are targeted.

The default global threshold is increased a bit.
This commit is contained in:
Tobias Brunner
2022-04-14 15:28:07 +02:00
parent 902fbd16e8
commit d8104b7c69
2 changed files with 98 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
conf/options/charon.opt
+5 -1
View File
@@ -69,9 +69,13 @@ charon.cisco_unity = no
charon.close_ike_on_child_failure = no
Close the IKE_SA if setup of the CHILD_SA along with IKE_AUTH failed.
charon.cookie_threshold = 10
charon.cookie_threshold = 30
Number of half-open IKE_SAs that activate the cookie mechanism.
charon.cookie_threshold_ip = 3
Number of half-open IKE_SAs for a single peer IP that activate the cookie
mechanism.
charon.crypto_test.bench = no
Benchmark crypto algorithms and order them by efficiency.