跳到主要内容

11. 安全考虑

本章讨论 SCTP 协议的安全问题, 潜在威胁以及相应的防护机制.

11.1. 安全目标​

SCTP 的主要安全目标包括:

11.1.1. 完整性保护​

校验和机制:

- Uses CRC32c checksum to protect entire SCTP packet
- Detects transmission errors and malicious tampering
- Stronger than TCP's 16-bit checksum

Verification Tag:

- Each SCTP packet contains 32-bit verification tag
- Prevents packet forgery and injection attacks
- Exchanged during association establishment

11.1.2. 可用性保护​

Cookie 机制:

- Prevents SYN flood attacks
- Server-side stateless
- Delays resource allocation

多宿主支持:

- Provides path redundancy
- Enhances denial-of-service resistance
- Automatic failover

11.1.3. 机密性​

注: SCTP 本身不提供数据加密.

建议:

  • 在 SCTP 上使用 TLS (RFC 3436)
  • 在 SCTP 上使用 DTLS
  • 使用 IPsec

11.2. SCTP 对潜在威胁的响应​

11.2.1. 冒充攻击​

威胁: 攻击者伪装成合法端点.

SCTP 防护:

1. Verification Tag Validation
   - Each packet must contain correct verification tag
   - Tag exchanged during association establishment
   - Packets with incorrect tag discarded

2. Four-way Handshake
   - INIT -> INIT ACK -> COOKIE ECHO -> COOKIE ACK
   - Validates peer's address
   - State Cookie contains encrypted information

State Cookie 内容:

- Peer's verification tag
- Peer's initial TSN
- Timestamp
- Lifetime
- HMAC signature

11.2.2. 重放攻击​

威胁: 攻击者捕获并重放有效的 SCTP 分组.

SCTP 防护:

1. TSN (Transmission Sequence Number)
   - Monotonically increasing
   - Detects duplicate packets
   - Window mechanism prevents old packets

2. Cookie Lifetime
   - State Cookie contains timestamp
   - Expired cookies rejected
   - Prevents INIT ACK replay

3. Verification Tag
   - Unique per association
   - Invalidated after association termination
   - Prevents cross-association replay

11.2.3. 拒绝服务攻击​

11.2.3.1. SYN Flood 类型攻击​

威胁: 攻击者发送大量 INIT chunk, 耗尽服务器资源.

SCTP 防护 - Cookie 机制:

1. Receive INIT
   - Do not allocate TCB
   - Do not allocate resources
   - Generate State Cookie

2. State Cookie
   - Contains all information needed to establish association
   - Protected by HMAC
   - Send INIT ACK (containing Cookie)

3. Receive COOKIE ECHO
   - Verify Cookie's HMAC
   - Check Cookie lifetime
   - Only then allocate TCB

Advantages:
- Server-side stateless
- Attacker must receive INIT ACK
- Difficult to perform source address spoofing

推荐的 Cookie 生成算法:

Cookie = HMAC(Secret, Peer-Address | Peer-Port | My-Tag |
               Peer-Tag | Timestamp | ...)

11.2.3.2. 分组洪泛攻击​

威胁: 攻击者发送大量分组, 耗尽带宽或处理能力.

SCTP 防护:

1. Verification Tag Filtering
   - Quickly discard packets with invalid tags
   - Minimize processing overhead

2. Checksum Verification
   - Early detection of corrupted or forged packets
   - Avoid subsequent processing

3. Congestion Control
   - Limits sending rate
   - Prevents network congestion

11.2.3.3. 多宿主利用攻击​

威胁: 攻击者滥用多宿主功能发起攻击.

场景: 攻击者在 INIT 中包含受害者地址, 导致服务器向受害者发送流量.

SCTP 防护 - 地址验证:

1. HEARTBEAT Verification
   - Send HEARTBEAT to new address
   - Wait for HEARTBEAT ACK
   - Only use new address after confirmation

2. Address Parameter Handling
   - Do not trust all addresses in INIT
   - Primarily use source address
   - Other addresses require verification

3. Implementation Recommendations
   - Limit number of addresses that can be added
   - Apply rate limits to unverified addresses
   - Log suspicious behavior

11.2.4. 窃听​

威胁: 攻击者监视 SCTP 通信, 窃取敏感信息.

SCTP 限制:

SCTP itself does not provide encryption
- Data transmitted in plaintext
- Requires additional security layer

推荐解决方案:

1. TLS over SCTP (RFC 3436)
   - Application layer encryption
   - Suitable for stream-oriented applications

2. DTLS over SCTP
   - Datagram encryption
   - Suitable for message-oriented applications

3. IPsec
   - Network layer encryption
   - Transparently protects all SCTP traffic
   - ESP mode provides confidentiality and integrity

11.2.5. 盲攻击​

威胁: 攻击者在无法监视流量的情况下发送伪造分组.

难度因素:

1. Must Guess
   - Correct verification tag (32 bits)
   - Correct source and destination ports
   - Correct TSN range

2. Success Probability
   - Verification tag: 1/2^32
   - Plus TSN verification: even lower

3. SCTP Response
   - Incorrect packets silently discarded
   - No feedback provided to attacker
   - Difficult to perform brute force attack

特殊防护 - ABORT 和 SHUTDOWN COMPLETE:

These chunks can set T bit:
- T=1: Use verification tag from received packet
- Allows response to "Out of the Blue" packets
- But strictly limited to prevent abuse

11.3. SCTP 与防火墙的交互​

11.3.1. 防火墙挑战​

状态跟踪:

Firewalls need to understand SCTP state machine:
- CLOSED
- COOKIE-WAIT
- COOKIE-ECHOED
- ESTABLISHED
- SHUTDOWN-PENDING
- SHUTDOWN-SENT
- SHUTDOWN-RECEIVED
- SHUTDOWN-ACK-SENT

多宿主处理:

Challenges:
- Single association may use multiple IP addresses
- Traffic may come from different source addresses
- Dynamic address addition/removal

Solutions:
- Track associations rather than individual connections
- Identify verification tag pairs
- Allow address changes within association

11.3.2. 防火墙建议​

基本过滤规则:

1. Verify SCTP Checksum
   - Discard packets with checksum errors
   - Mitigate certain attacks

2. State Tracking
   - Only allow valid state transitions
   - Reject invalid chunk combinations

3. INIT Handling
   - May require rate limiting
   - Prevent INIT floods

4. Multihoming Support
   - Allow ASCONF chunks (if supporting dynamic addressing)
   - Verify HEARTBEAT exchanges

推荐配置:

Allow Outbound:
- INIT, COOKIE ECHO, DATA, SACK, HEARTBEAT, SHUTDOWN
- Other control chunks

Allow Inbound:
- INIT ACK, COOKIE ACK, DATA, SACK, HEARTBEAT ACK, SHUTDOWN ACK
- Chunks responding to established associations

Block:
- Invalid state transitions
- Unsolicited INIT ACK
- Packets with incorrect verification tags

11.3.3. NAT 考虑​

NAT 问题:

SCTP contains IP address information:
- Address parameters in INIT and INIT ACK
- Addresses in ASCONF chunks
- NAT needs to understand and rewrite these

Challenges:
- Requires Application Layer Gateway (ALG)
- Increases NAT complexity
- May affect multihoming functionality

建议:

1. Avoid including private addresses in INIT
2. Use public addresses or NAT traversal techniques
3. Consider using SCTP-aware NAT/ALG

11.4. 对不支持 SCTP 的主机的保护​

11.4.1. 问题​

场景: 攻击者使用 SCTP INIT 攻击不支持 SCTP 的主机.

影响:

- Target host may not understand SCTP
- May send ICMP error responses
- Attacker may exploit this for amplification attacks

11.4.2. SCTP 行为​

接收 ICMP 错误:

SCTP endpoints should:
1. Log ICMP errors
2. May mark path as unreachable
3. Should not immediately abort association
4. Continue trying other paths (if multihomed)

速率限制:

SCTP implementations should:
- Limit INIT sending rate to single destination
- Avoid participating in amplification attacks
- Implement exponential backoff

11.4.3. 网络保护​

建议:

1. Ingress Filtering
   - Prevent source address spoofing
   - BCP 38 (RFC 2827)

2. Egress Filtering
   - Limit SCTP traffic to non-SCTP ports
   - Protect legacy systems

3. Host Firewalls
   - Discard packets of unsupported protocols
   - Do not send ICMP responses (or rate limit)

总结​

SCTP 安全机制:

  1. Verification Tag: 防止伪造和盲攻击
  2. Cookie 机制: 防止 SYN flood 类型攻击
  3. CRC32c Checksum: 检测篡改和错误
  4. 地址验证: 防止多宿主滥用
  5. 四次握手: 增强认证

安全限制:

  • 不提供加密 (需要 TLS/DTLS/IPsec)
  • 不提供源认证 (需要上层机制)

最佳实践:

  • 使用加密层保护敏感数据
  • 实现速率限制和监测
  • 正确配置防火墙和 NAT
  • 遵循安全编码实践
  • 及时应用安全更新
最后于 更新