Verifying RFC 6980 Implementations on varying Operating Systems. Jacky

Transcription

1 Verifying RFC 6980 Implementatins n varying Operating Systems Jacky Hammer, 1

2 Agenda Intrductin Setup Test Results Cnclusins 2

3 Intrductin What s this abut, anyway? 3

4 What is a Ruter in IPv6? RFC 2461: Ruters advertise their presence tgether with varius link and Internet parameters either peridically, r in respnse t a Ruter Slicitatin message. At the end f the day, an IPv6 a ruter is nt just a frwarding device but a prvisining system as well. 4

5 Ruter advertisements are a fundamental part f IPv6 DNA. The Rgue Ruter Advertisement Prblem Mdifying this behavir is a severe deviatin frm default and as such peratinally expensive A lcal link is regarded trustwrthy in IPv6 wrld All ND (including RAs) unauthenticated by default Attacker interferes with ruter discvery Traffic redirectin by spfed RAs ERNW GmbH Breslauer Straße 28 D Heidelberg #5 5

6 IPv4 Header IPv6 Header Versin IHL Time t Live Identificatin Type f Service Prtcl Ttal Length Flags Offset Header Checksum Versin Traffic Class Paylad Length Next Header Flw Label Hp Limit Surce Address Destinatin Address Optins Padding Surce Address Destinatin Address 6

7 The Extensin Header Prblem IPv6 header TCP header + data Next Header = TCP IPv6 header Ruting header TCP header + data Next Header = Next Header = Ruting TCP IPv6 header Ruting header Fragment header fragment f TCP header + data Next Header = Next Header = Next Header = Ruting Fragment TCP

8 Interesting Extensin Headers RFC 2460 The Hp-by-Hp Optins header is used t carry ptinal infrmatin that must be examined by every nde alng a packet s delivery path. The Ruting Header is used by an IPv6 surce t list ne r mre intermediate ndes t be visited n the way t a packet s destinatin. The Destinatin Optins header is used t carry ptinal infrmatin that need be examined nly by a packet s destinatin nde(s) 8

9 Neighbr Discvery (ND) 1. Neighbr Discvery / Address Reslutin 2. Ruter Discvery 3. Prefix Discvery 4. Parameter Discvery 5. Address Autcnfiguratin 6. Next-Hp Determinatin 7. Neighbr Unreachability Detectin 8. Duplicate Address Detectin 9. Redirects 9

10 RFC

11 The Lab Setup What did we d - and why? 11

12 12

13 Tlkit Cisc Catalyst 3560 firmware versin 15.2(2)E4 TCPdump && Wireshark Chirn Fr injectin f fake RAs by Antnis Atlasis [ enp0s25 \ ra \ pr 2001:db8:10:50:: \ -pr-length 64 \ mtu 1400 \ s fe80::ee9a:74ff:fef5:a385 13

14 Executed Tests Baseline RA Plain RA, unfragmented, n Extensin Headers Unfragmented RA Destinatin Optin and/r HBH Headers Fragmented RAs Tw, three r fur fragments HBH, DestOpt and/r RutingHdr in unfragmentable part HBH, DestOpt and/r RutingHdr in fragmentable part 14

15 Tested Systems Arch Linux CentOS 7 Debian 9 FreeBSD 10.3 FreeBSD 11 OpenSUSE Leap 42.3 Ubuntu Server LTS Ubuntu Server Windws Server 2016 (preceeding wrk) 15

16 Test Results Let s see hw that lks 16

17 First Tests 17

18 Let s get creative! 18

19 Detailed Wireshark Observatins (FreeBSD Example) All packets can be bserved n bth ends Cnfirming successful transmissin and receptin RAs where the Hp-by-Hp header is placed after a Destinatin Optin are discarded as f RFC 2460 HBH header must be first in chain Destinatin Optins in fragmented RAs are evaluated by sme f the Operating Systems RFC 6980 seemingly nt implemented crrectly 19

20 Anything we can d abut it? RFC 6105 prpses IPv6 Ruter Advertisement Guard RFC 7113 update n Implementatin Advice Mst current switching hardware supprts that mechanism Cisc: ipv6 nd raguard 20

21 Test Results with RA guard 21

22 But what s that? 22

23 Detailed Wireshark Observatins (FreeBSD Example) Tests with cmplete r fragmented RAs and Extensin Headers in unfragmentable part: N packet can be captured in Wireshark All fragments are drpped Tests where Extensin Headers are placed in fragmentable part: All fragments (but n RA) can be bserved in Wireshark Only the main RA (first packet) is drpped These shuldn t be, but bviusly are evaluated in sme cases 23

24 Cnclusin What cannt be unseen 24

25 Cnclusins 1/2 D the varius Operating Systems implement RFC 6980 crrectly? Sme f them d (r at least seem t) Debian, OpenSUSE, Ubuntu Sme f them clearly dn t ArchLinux, CentOS, FreeBSD, Windws 25

26 Cnclusins 2/2 Cmpliance with standards nt nly depends largely n perating system, but bviusly varies even between versins and kernels All IPv6 related behavir must be carefully evaluated and tested in each specific envirnment Security mechanisms like RA guard can be evaded and will by design f IPv6 prbably never be bulletprf Strict implementatins f specificatins like RFC 6980 cnflicts with the Rbustness Principle: Be cnservative in what yu d, be liberal in what yu accept frm thers. (Jn Pstel, RFC 761) 26

27 Fllw Ups Cming sn n insinuatr.net 27

28 Thank yu fr yur attentin! Any questins? 28