Subject: RE: 2401bis Issue # 75 -- TOS (now ECN) copying in tunnel mode

From: [email-masked]
Date: Wed, 1 Oct 2003 19:29:40 -0400

Karen,

> Proposed approach:
> ==================
> 2401bis will be modified with text along the lines of:
> 
> "An IPsec implementation MAY be configurable re: how it processes the 
> DSCP field for tunnel mode for transmitted packets. For outbound 
> traffic, one configuration setting will operate as described in the 
> section on IPv4 and IPv6 header processing for IPsec tunnels. Another 
> will allow the field to be mapped to a fixed value, which MAY be 
> configured on a per SA basis. (The value might really be fixed for 
> all traffic outbound from a device, but per SA granularity allows 
> that as well.) This configuration option allows a local 
> administrators to decide whether the covert channel provided by 
> copying these bits outweighs the benefits of copying.

While it was clear from context that this issue is about
the outer header in tunnel mode, the above text should have
the magic words "in the outer IP header" added after "DSCP field"
for clarity.

Also, there's a security perimeter issue lurking here.  It is
not necessary that the DSCP field be set to a fixed value and
transmitted as such, but rather that the DSCP be set to a fixed
value at some point in the processing within the security
perimeter beyond which an adversary has no opportunity to add info.
The reason this distinction matters is that it is useful to allow
diffserv traffic conditioning after the DSCP is set to a fixed
value but before the packet is transmitted (e.g., drop precedence
for AF).  I would like to see the above text modified to allow
further traffic conditioning after the DSCP is set to a fixed value,
plus suitable additional wording to warn implementers to ensure
that such conditioning does not enable the information leakage
that the "set to a fixed value" step is intended to prevent. One
way to achieve the latter property is to have traffic exit the
security perimeter with a fixed DSCP value and perform additional
traffic conditioning outside the perimeter, but before transmission
in systems that have a notion of security perimeter.

Thanks,
--David
----------------------------------------------------
David L. Black, Senior Technologist
EMC Corporation, 176 South St., Hopkinton, MA  01748
+1 (508) 293-7953             FAX: +1 (508) 293-7786
[email-masked]        Mobile: +1 (978) 394-7754
----------------------------------------------------