Subject: [BEHAVE] TURN traffic amplification?

From: Rémi Denis-Courmont <[email-masked]>
Date: Wed, 23 Jan 2008 09:39:53 +0200

Hello,

Following the discussion on preserving the TOS bits, I had been wondering 
whether TURN should also preserve the TTL. The case for this would mostly be 
to reduce the risk of loops. I have considered this a bit more, and I am now 
wondering if TURN won't provide a similar traffic amplification attack as the 
IPv6-RH0 one.

In one case, the client would create many TURN allocations between two 
servers, recursively, i.e. making each new allocation through the previous 
allocation, and so on.

With the current 4-bytes framing and the typical 1500 MTU, this allows 
bouncing a single packet around 375 times on the path! In theory, if we do 
allow fragmentation, the amplification factor could go as high as 16000. I am 
willing to believe the IP reassembly buffers on the TURN servers would 
explode way before this happens. But we may need to reconsider this issue 
when TCP comes...

If we specify that TURN servers must "decrement the TTL", the factor goes down 
to (255 - distance_to_server) / distance_between_servers < 255. This is still 
not quite good if the servers are very close, but a lot better anyway. As 
such, I would think it's a good idea. Anyone?

-- 
Rémi Denis-Courmont

_______________________________________________
Behave mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/behave

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 23 Jan 2008 06:51:34 -0800

At Wed, 23 Jan 2008 09:39:53 +0200,
> such, I would think it's a good idea. Anyone?

This seems to be of extremely marginal value. 

I'm also not sure it can be implemented. A quick look at FreeBSD's 
man pages doesn't show any way to configure TTL on a per-socket level.

-Ekr

---

From: "Saikat Guha" <[email-masked]>
Date: Wed, 23 Jan 2008 19:01:46 -0500

> > wondering if TURN won't provide a similar traffic amplification attack as the

One difference with RH0 is that for TURN one cannot fire the packet at
any odd TURN server --- only to servers that allows the attacker to
create an allocation on the server. The attack surface is much
smaller.

> man pages doesn't show any way to configure TTL on a per-socket level.

The IP_HDRINCL socket option allows the app to provide per-socket IP
header bits; (supposed to) work for both UDP and TCP sockets IIRC.
Doesn't work under Windows for TCP sockets though last I checked.

-- 
Saikat

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 23 Jan 2008 16:48:35 -0800

At Wed, 23 Jan 2008 19:01:46 -0500,
> Doesn't work under Windows for TCP sockets though last I checked.

Here's what the man page says about that:

     IP_HDRINCL indicates the complete IP header is included with the data and
     may be used only with the SOCK_RAW type.

That seems problematic.

-Ekr

---

From: "Saikat Guha" <[email-masked]>
Date: Wed, 23 Jan 2008 20:15:39 -0500

>      may be used only with the SOCK_RAW type.

Oops, yes, you are right. There is another option then, IP_TTL maybe?
I am pretty sure I have successfully set the TTL under Linux at some point.

-- 
Saikat

---

From: Rémi Denis-Courmont <[email-masked]>
Date: Thu, 24 Jan 2008 09:16:45 +0200

> man pages doesn't show any way to configure TTL on a per-socket level.

I doubt anything with "BSD" in its name would lack the ability to do 
traceroute or send multicast traffic beyond the local subnet.

-- 
Rémi Denis-Courmont

---

From: Rémi Denis-Courmont <[email-masked]>
Date: Thu, 24 Jan 2008 09:20:39 +0200

Le Wednesday 23 January 2008 20:43:23 ext Dan Wing, vous avez écrit :
> The TURN client which is doing this traffic amplification would
> need to be an authorized user on both of those TURN servers, right?

Yes. However some TURN servers may have a very low entry barrier. Imagine 
Gtalk, AIM or MSN providing VoIP service with TURN to their users for 
instance.

-- 
Rémi Denis-Courmont

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Thu, 24 Jan 2008 13:58:38 +0100

On Thu, Jan 24, 2008 at 09:16:45AM +0200,
 Rémi Denis-Courmont <[email-masked]> wrote 

> traceroute or send multicast traffic beyond the local subnet.

Yes, but may be only with raw sockets, meaning you need to be root,
which is certainly a problem.

---

From: Rémi Denis-Courmont <[email-masked]>
Date: Thu, 24 Jan 2008 15:25:00 +0200

Le Thursday 24 January 2008 14:58:38 ext Stephane Bortzmeyer, vous avez 
> which is certainly a problem.

Needing root to send multicast packets, that would be seriously brain 
damaged...

-- 
Rémi Denis-Courmont