EXAMENSARBETE INOM TEKNIKOMRÅDET INFORMATIONSTEKNIK OCH HUVUDOMRÅDET INFORMATIONS- OCH KOMMUNIKATIONSTEKNIK, AVANCERAD NIVÅ, 30 HP STOCKHOLM, SVERIGE 2016 Security Evaluation of Multipath TCP Analyzing and fixing Multipath TCP vulnerabilities, contributing to the Linux Kernel implementation of the new version of the protocol FABRIZIO DEMARIA KTH SKOLAN FÖR INFORMATIONS- OCH KOMMUNIKATIONSTEKNIK KTH ROYAL INSTITUTE OF TECHNOLOGY Master of Science in Computer Engineering Master's Degree Thesis Security Evaluation of Multipath TCP Analyzing and fixing Multipath TCP vulnerabilities, contributing to the Linux Kernel implementation of the new version of the protocol Supervisor prof. Peter Sj¨odin Candidate Fabrizio Demaria Company tutors Intel Corporation Henrik Svensson Joakim Nordell Shujuan Chen March 2016 Summary Multipath TCP is a major extension for TCP that aims at unlocking multipath benefits in the network by splitting data transferring across multiple subflows, keeping into consideration funda- mental compatibility goals in order to achieve a seamless deployment of the new protocol on current systems and infrastructures. This thesis work is an extensive security evaluation of Multipath TCP, with an in-depth analysis of its major vulnerabilities: in particular, the ADD ADDR vulnerability affecting Multipath TCP version 0 is addressed in this document. After a preliminary partthat involves testing and studying the vulnerability itself, the core value of this thesis work concerns the development of a series of patches for the Linux Kernel implementation of Multipath TCP aimed at fixing the ADD ADDR vulnerability and marking the first step towards the new version of the protocol, Multipath TCP version 1. The paper contains an experimental evaluation of the various steps of the development phase, including a final performance analysis for the modified implemen- tation of Multipath TCP. In the process, contributions have been produced for the official RFC documentation containing the specifications for Multipath TCP, together with other minor code contributions for related open-source projects, like the famous packet analyzer Wireshark. The entire thesis work required strong interaction with important open-source communities, especially the Linux Kernel one. Multipath TCP is an ongoing project subjected to constant changes regard- ing the protocol and its implementations: this work is just a single step of the overall deployment process, with a main focus on security. iii Summary Multipath TCP ¨aren viktig ¨andringf¨orTCP, d¨arm˚alet¨aratt l˚asaupp f¨ordelarnamed mul- tipath in ett n¨atverk genom att dela upp data¨overf¨oring¨over subfl¨oden,och samtidigt f¨ors¨oka bibeh˚allabak˚atkompabilitet med nuvarande system och infrastruktur. Detta examensarbete ¨aren omfattande s¨akerhetsutv¨arderingav Multipath TCP med en djupg˚aendeanalys av dess fr¨amsta s˚arbarhetheter,speciellt s˚arbarhetenADD ADDR som p˚averkar version 0 av Multipath TCP. Efter en inledande fas best˚aendeav en unders¨okningoch testning av s˚arbarhetens˚abestod arbetet fr¨amst av utvecklingen av en rad fixar f¨ors˚arbarhetenADD ADDR. Dessa fixar gjordes f¨orLinuxk¨arnans implementation av Multipath TCP, i ett f¨orstasteg mot version 1 av protokollet. Denna rapport inneh˚alleren utv¨arderingbaserad p˚aexperiment f¨orvarje steg i utvecklingsfasen, samt en slutgiltig prestandaanalys f¨orden modifierade implementationen av Multipath TCP. I processen producer- ades dels ett f¨orb¨attringsf¨orslagtill det officiella RFC-dokumentet som inneh˚aller specifikationen f¨orMultipath TCP, och ¨aven mindre kod¨andningartill n¨arliggandeopen-source projekt, exem- pelvis packet-analyseraren Wireshark. Examensarbetet inneh¨ollmycket interaktion med viktiga open-source grupper, framf¨oralltgruppen f¨orLinuxk¨arnan. Multipath TCP ¨arett fortl¨opande projekt som ¨arunder st¨andigf¨or¨andring,b˚adekring protokollet och dess implementation. Detta arbete ¨arett steg i den ¨overgripande distributionsprocessen, med fokus p˚as¨akerhet. iv Acknowledgements This thesis work has been carried out at the Intel Corporation office of Lund (Sweden), during a period of six months from September 2015 to February 2016. Before starting this project I spent one year in Stockholm, studying at KTH Royal Institute of Technology as an Erasmus student originally from Torino, Italy. The first persons I would like to thank are my family and friends from Italy, who supported me from far away during my studies in Sweden and during the whole time dedicated to this thesis. I also would like to thank the people that supported me from a closer distance, in particular the Swedish family I have lived with during the six months of the thesis project, that was very friendly to me. I would like to thank all the people from the office, who integrated me very well despite my poor skills in speaking Swedish. I would like to thank my manager Henrik Svensson for giving me the possibility of working on such an valuable and interesting project. Special thanks go to the two Intel engineers that closely followed my work at the Lund office: Joakim Nordell and Shujuan Chen. The work involved other major stakeholders, passionate about the Multipath TCP project, who supported me in the development process: in these regards, I'd like to thank Doru Gucea, Vlad Dogaru and Octavian Purdila. A special thank you goes to Christoph Paasch from Apple California, who directed the whole development process from the other side of the world, helping me in the process and finally accepting my contribution to the official Multipath TCP source code for the Linux Kernel. This work has been supported by both the Politecnico di Torino and Stockholm's KTH Royal Institute of Technology and I want to thank all the professors I encountered during my academic career, especially the ones that followed this very project from the start until the final discussion: Antonio Lioy from Torino and Peter Sj¨odinfrom Stockholm. It is impossible to mention all the enriching people that I met during my months abroad and all the inspiring experiences lived in this last phase of my academic career, but they all define the fundamental context that made this thesis work possible. Thank you. v Contents Summary iii Summary iv 1 Introduction 1 1.1 Motivation........................................1 1.1.1 Benefits of MPTCP...............................3 1.1.2 Multipathing solutions..............................4 1.2 Problem statement....................................5 1.3 Methodology.......................................6 1.3.1 Daily workflow..................................8 1.3.2 Document structure...............................8 2 Multipath TCP 10 2.1 Transmission Control Protocol (TCP)......................... 10 2.2 MPTCP design...................................... 13 2.2.1 Control plane................................... 15 2.2.2 Data plane.................................... 20 2.3 MPTCP deployment................................... 21 2.3.1 Middleboxes compatibility............................ 21 2.3.2 Deployment status................................ 23 3 MPTCP security 25 3.1 Threats analysis..................................... 25 3.1.1 Threats classifications.............................. 26 3.2 Minor threats....................................... 27 3.2.1 DoS attack on MP JOIN............................ 27 3.2.2 Keys eavesdrop.................................. 27 3.2.3 SYN/ACK attack................................ 29 3.3 ADD ADDR attack................................... 29 3.3.1 Concept...................................... 29 3.3.2 Procedure..................................... 30 3.3.3 Requirements................................... 31 vi 4 ADD ADDR attack simulation 33 4.1 Environment setup.................................... 33 4.2 Attack script....................................... 35 4.3 Reproducing the attack................................. 37 4.4 Conclusions........................................ 38 5 Fixing ADD ADDR 39 5.1 The ADD ADDR2 format................................ 39 5.2 Implementing ADD ADDR2............................... 40 5.2.1 MPTCP in Linux................................. 40 5.2.2 The hashing function............................... 41 5.2.3 Version control.................................. 46 5.2.4 Truncated HMAC in ADD ADDR....................... 48 5.2.5 Port advertisement................................ 52 5.2.6 IPv6 considerations............................... 54 5.3 Overall contributions................................... 55 5.4 Experimental evaluation................................. 57 6 Conclusions 66 6.1 Ethical and sustainability aspects............................ 66 6.2 Related work....................................... 67 6.3 Future work........................................ 68 A ADD ADDR attack capture 69 B MPTCP version 1 capture 72 Bibliography 76 vii Chapter 1 Introduction 1.1 Motivation The last few decades have seen the most pronounced technology evolution in history, in many different research areas and consumer markets: from robotics to smartphones, from medicine to the automotive industry, etc. One of the pillars upon which all these advancements have been made possible is the Internet, or more generally the entire set of networking technologies that allow software to communicate. The process towards interconnected devices saw a big leap forward in the early 1960s with the first research into packet switching as an alternative to the old circuit switching. But itis1981 the year of standardization