Subject: Security implications of IPv6 extension headers ??

From: Gyan Mishra <[email-masked]>
Date: Fri, 11 Oct 2019 22:53:32 -0400

Hi Fernando & 6MAN 

I was researching security implications of extended headers and found this really good article you had written related to impact on security Router infrastructure ACLs and stateful firewall packet filtering.

I designed and deployed IPv6 to Verizon’s very large worldwide internal network between many business units and have hundreds of applications on IPv6 and we have never run into issues with extension headers I guess a good real world use case.  On all of our ISP links I developed a custom filter based on best practices about 10 years ago that blocked routing header type 0 which is depricated but did not block destoptions or hbh  headers but have never run into any issues.  Internally since hosts are trusted we don’t have any router infrastructure ACLs.

So what you are saying is that when extension headers are employed with any EH type they firewalls and other security appliances are looking for the upper layer next header right after the IPv6 header and if does not see it in cases where EH headers are in payload that the firewalls will do pass-all default and bypass the firewall rules.  Also you mentioned with fragmentation the problem gets much worse in that prior to RFC 7112 that all headers were not included in the first fragment and so since the upper layer is unfortunately at the end of the header chain and if fragmentation happens then the upper layer could be lost and that would be a security hole pass-all is a firewall or router infrastructure acl.

I wonder why IPv6 specification did not put the upper layer right after the IPv6 header and then sequence the order of headers based on headers processed on every hop with remaining headers processed at the destination put at the end.

So do you know if with firewalls and security appliances today if they have issue with processing extension headers and could have a security hole.

Is it safe to maybe not allow extension headers on the network until all security appliances support them.  I see the draft below talks about recommendations for operators to drop hbh and routing header type 0 and permit the rest.

We just recently a year years ago I came up with a design strategy to deploy jumbo frames enterprise wide for IPv6 and other technologies like SRv6 that have large payloads.  So we have 9100 at the customer edge and our mpls core is 9216 so I think if we did have usage of extension headers at least maybe the packets won’t get fragmented.

https://searchsecurity.techtarget.com/tip/IPv6-extension-headers-and-security-Analyzing-the-risk

Also this well written draft on eh filtering 

https://tools.ietf.org/html/draft-ietf-opsec-ipv6-eh-filtering-06

Regards,

Gyan Mishra
Verizon Communications 
Cell 301 502-1247

Sent from my iPhone

---

From: Warren Kumari <[email-masked]>
Date: Sat, 12 Oct 2019 17:20:58 +0200

> https://tools.ietf.org/html/draft-ietf-opsec-ipv6-eh-filtering-06

Thanks for your comment on this document.  A quick note:  there was
significant drama / controversy around this document during IETF LC;
some of the mails were related to the document, but a large number of
them strayed very far off-topic. The plan is that Fernando will be
submitting a new version with the relevant points addressed - then,
because it's been so long I'll be asking OPSEC to do another WGLC, and
then it will have another IETF LC.

It will be helpful if you (and others) can review and provide feedback
during the WGLC and IETF LC.

W

>
> Regards,
>
> Gyan Mishra
> Verizon Communications
> Cell 301 502-1247
>
> Sent from my iPhone
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [email-masked]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------

-- 
I don't think the execution is relevant when it was obviously a bad
idea in the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair
of pants.
   ---maf