RFC 6980 Implementations on Different Operating Systems

Transcription

1 RFC 6980 Implementatins n Different Operating Systems Jacky Hammer jhammer@ernw.de 1

2 Agenda Intrductin Setup Test Results Cnclusins 2

3 Intrductin Cncerning Ruters 3

4 Ruter Rle in IPv6? RFC 2461: Ruters advertise their presence tgether with varius link and Internet parameters either peridically, r in respnse t a Ruter Slicitatin message. In IPv6, a ruter is nt just a frwarding device but a prvisining system as well. 4

5 Neighbr Discvery is a fundamental part f IPv6 DNA. Abut Ruter Advertisements Ruter Advertisements are an integral part f that A lcal link is regarded trustwrthy in IPv6 wrld All ND (including RAs) unauthenticated by default Attacker interferes with ruter discvery Traffic redirectin by spfed RAs ERNW GmbH Breslauer Straße 28 D Heidelberg #5 5

6 6

7 The Lab Setup Basic Parameters and Envirnment 7

8 8

9 Tlkit Cisc Catalyst 3560 firmware versin 15.2(2)E4 TCPdump && Wireshark Chirn Fr injectin f fake RAs by Antnis Atlasis [ enp0s25 \ ra \ pr 2001:db8:10:50:: \ -pr-length 64 \ mtu 1400 \ s fe80::ee9a:74ff:fef5:a385 9

10 Executed Tests Baseline RA Plain RA, unfragmented, n Extensin Headers Unfragmented RA Destinatin Optin and/r HBH Headers Fragmented RAs Tw, three r fur fragments Hp By Hp, Destinatin Optins and/r Ruting Headers in fragmentable part Hp By Hp, Destinatin Optins and/r Ruting Headers in unfragmentable part 10

11 Test Results Initial Testing n Windws Server

12 First Test Windws Server 2016 Early 2017 By-prduct f general Windws IPv6 testing Very bad results -> wanted t lk farther 12

13 First Tests n Windws Server 2016 # Fragments Extensin Headers + 1 DestOpt + 1 HBH + 1 DestOpt + 1 DestOpt + 1 HBH Message Part 13

14 First Tests n Windws Server 2016 # Fragments Extensin Headers + 1 DestOpt + 1 HBH + 1 DestOpt + 1 HBH + 2 DestOpt + 1 DestOpt + 1 RtgHdr + 1 HBH Message Part U U U F F F 14

15 First Tests n Windws Server 2016 # Fragments Extensin Headers + 2 DestOpt + 2 DestOpt + 2 RtgHdr + 2 RtgHdr + 2 DestOpt + 2 RtgHdr + 2 DestOpt + 2 RtgHdr + 2 DestOpt Message Part F F F F F F 15

16 Anything we can d abut it? RFC 6105 prpses IPv6 Ruter Advertisement Guard RFC 7113 update n Implementatin Advice Mst current switching hardware supprts that mechanism Cisc: ipv6 nd raguard 16

17 First Tests n Windws Server 2016 # Fragments Extensin Headers + 1 DestOpt + 1 HBH + 1 DestOpt + 1 DestOpt + 1 HBH Message Part RA Guard enabled 17

18 First Tests n Windws Server 2016 # Fragments Extensin Headers + 1 DestOpt + 1 HBH + 1 DestOpt + 1 HBH + 2 DestOpt + 1 DestOpt + 1 RtgHdr + 1 HBH Message Part U U U F F F RA Guard enabled 18

19 First Tests n Windws Server 2016 # Fragments Extensin Headers + 2 DestOpt + 2 DestOpt + 2 RtgHdr + 2 RtgHdr + 2 DestOpt + 2 RtgHdr + 2 DestOpt + 2 RtgHdr + 2 DestOpt Message Part F F F F F F RA Guard enabled 19

20 Test Results In-depth Testing n Linux and FreeBSD Systems 20

21 Tested Systems (mid/late 2017) Arch Linux CentOS 7 Debian 9 FreeBSD 10.3 FreeBSD 11 OpenSUSE Leap 42.3 Ubuntu Server LTS Ubuntu Server

22 Detailed Testing n Linux and BSD (withut RA Guard with RA Guard) # Fragments Extensin Headers Message Part + 1 DestOpt + 1 HBH + 1 DestOpt + 1 DestOpt + 1 HBH Arch Linux CentOS 7 Debian 9 FreeBSD 10.3 FreeBSD 11.0 OpenSUSE 42.3 Ubuntu 16.04/

23 Detailed Testing n Linux and BSD (withut RA Guard with RA Guard) # Fragments Extensin Headers + 1 DestOpt + 1 HBH + 1 DestOpt + 1 HBH + 2 DestOpt + 1 DestOpt + 1 RtgHdr + 1 HBH Message Part U U U F F F Arch Linux CentOS 7 Debian 9 FreeBSD 10.3 FreeBSD 11.0 OpenSUSE 42.3 Ubuntu 16.04/

24 Detailed Testing n Linux and BSD (withut RA Guard with RA Guard) # Fragments Extensin Headers + 2 DestOpt + 2 DestOpt + 2 RtgHdr + 2 RtgHdr + 2 DestOpt + 2 RtgHdr + 2 DestOpt + 2 RtgHdr + 2 DestOpt Message Part F F F F F F Arch Linux CentOS 7 Debian 9 FreeBSD 10.3 FreeBSD 11.0 OpenSUSE 42.3 Ubuntu 16.04/

25 Detailed Wireshark Observatins Withut RA Guard, all RAs are crrectly transmitted and received With RA Guard enabled, cmplete RAs r fragmented RAs with EHs in unfragmentable part are drpped With RA Guard and Extensin Headers placed in fragmentable part: All fragments (but n RA) can be bserved in Wireshark Only the main RA (first packet) is drpped Shuld nt be - but bviusly are - evaluated in sme cases! 25

26 First Discussins What happened afterwards 26

27 Outcmes frm DENOG9 Presentatin FreeBSD Bug Summary: [patch] RFC 6980 requires t drp fragmented IPv6 neighbur discvery Status: Clsed FIXED Versin: 11.1-STABLE Special thanks t Lutz! 27

28 Further Implicatins & Discussin High impact targets vs lw-hanging fruits Data Centers are high impact but mre cntrlled envirnments Client netwrks are the lw-hanging fruits, thus attractive targets With RA guard evasin pssible, nt even ffice nets are secure Mre targeted research n cmmn perating systems fr clients Windws 10, MacOS X? Research n behavir f IT devices and mbile phnes necessary 28

29 Test Results Latest Tests n Cmmn Client Operating Systems 29

30 Tested Systems (recent) Arch Linux ( ) Debian Buster ( ) FreeBSD 11.1 Mac OS X Sierra ( ) OpenSUSE Tumbleweed ( ) Ubuntu Desktp Windws 10 Pr (1709) 30

31 Recent Testing n Cmmn Client Operating Systems # Fragments Extensin Headers + 1 DestOpt + 1 HBH + 1 DestOpt + 1 DestOpt + 1 HBH Message Part Arch Linux Debian Buster FreeBSD 11.1 Mac OS X Sierra OpenSUSE Ubuntu Windws 10 Pr Windws 10 IT Cre 31

32 Recent Testing n Cmmn Client Operating Systems # Fragments Extensin Headers + 1 DestOpt + 1 HBH + 1 HBH + 1 DestOpt + 1 RtgHdr + 1 DestOpt + 2 DestOpt + 1 HBH Message Part U U U F F F Arch Linux Debian Buster FreeBSD 11.1 Mac OS X Sierra OpenSUSE Ubuntu Windws 10 Pr Windws 10 IT Cre 32

33 Recent Testing n Cmmn Client Operating Systems # Fragments RtgHdr + 2 RtgHdr + 2 RtgHdr Extensin Headers + 2 DestOpt + 2 DestOpt + 2 RtgHdr + 2 DestOpt + 2 DestOpt + 2 DestOpt Message Part F F F F F F Arch Linux Debian Buster FreeBSD 11.1 Mac OS X Sierra OpenSUSE Ubuntu Windws 10 Pr Windws 10 IT Cre 33

34 Cnclusin What cannt be unseen 34

35 Cnclusins Behavir depends nt nly n OS, but als n versins and kernels Shuld be carefully evaluated and tested in each specific envirnment Security mechanisms can be evaded By design f IPv6 prbably impssible t be bulletprf Strict implementatins f standards cnflicts with Rbustness Principle: Be cnservative in what yu d, be liberal in what yu accept frm thers. (Jn Pstel, RFC 761) 35

36 Implicatins Users are vulnerable t rgue RAs and thus t traffic interceptin n the lcal link This applies t any public, hme and even ffice netwrk We MUST NOT rely n transprt layer security mechanisms like RA guard Detailed datagram analysis is nt pssible n cmmn netwrk hardware RFC cmpliance MUST be tested mre thrughly by vendrs and ur cmmunity Even if standards may seem like frmalities, they may have cnsiderable security impacts and MUST NOT be underestimated 36

37 Thank yu fr yur attentin! Any questins? 37