Subject: IPv6 Type 0 Routing Header issues

From: Jeroen Massar <[email-masked]>
Date: Tue, 24 Apr 2007 00:53:42 +0100

Just in case folks are missing out on this, find below a rather nasty
security issue.

Please use "IPv6 Ops list <[email-masked]>" for discussion,
see also: http://lists.cluenet.de/pipermail/ipv6-ops/

Greets,
 Jeroen

-------- Original Message --------
Subject: [dns-operations] IPv6 Type 0 Routing Header issues
Date: Mon, 23 Apr 2007 17:07:57 +0200
From: Nicolas FISCHBACH <[email-masked]>
To: [email-masked]

Very interesting presentation by Arnaud and Phil:

http://www.secdev.org/conf/IPv6_RH_security-csw07.pdf

If you only care about the DNS related bits, start on page 29.

Nico.
-- 
Nicolas FISCHBACH
Senior Manager - Network Engineering/Security - COLT Telecom
e:([email-masked]) w:<http://www.securite.org/nico/>

---

From: Jari Arkko <[email-masked]>
Date: Wed, 25 Apr 2007 00:46:28 +0300

> Just in case folks are missing out on this, find below a rather nasty

I cannot say that this is a big surprise, even if the specific attack
is news to me and it has a major impact. Some issues with Type 0
have been known for years; I think draft-savola-ipv6-rh-ha was the
first to report these. RFC 4294 warns of the issues and RFC 3775
design was based on the idea of avoiding Type 0 because it
was felt that at some point Type 0 would likely be filtered due
to its problems. Also, draft-ietf-v6ops-security-overview was recently
approved. It notes, among other things that "it may be desirable
to forbid or limit the processing of Type 0 Routing Headers
in hosts and some routers."

So I think we should take that advice and modify the stacks that
do not do the right thing today. A good first approximation is
to add a configuration knob for processing Type 0 headers
in both hosts and routers, with default set to off. Better
firewall support for doing this would also be needed (without
disabling use of Type 2, of course).

But we at the IETF also need to draw a conclusion about the
state of Type 0. This feature needs to be retired.

Jari

---

From: "George V. Neville-Neil" <[email-masked]>
Date: Wed, 25 Apr 2007 10:49:25 +0900

At Wed, 25 Apr 2007 00:46:28 +0300,
> disabling use of Type 2, of course).

FreeBSD has already committed patches disabling the processing of
route header option 0 by default in all 3 of the currently shipping
branches (HEAD, 6-STABLE and 5-STABLE).

> state of Type 0. This feature needs to be retired.

The sooner that decision is made the better.  Those of us working on
the stacks would like to remove this processing if the feature is
retired.

Best,
George Neville-Neil
(FreeBSD Security Team and Core Member)

---

From: Mohacsi Janos <[email-masked]>
Date: Wed, 25 Apr 2007 09:41:09 +0200 (CEST)

Hi All,

I think this is not a solution. The problems of routing header type 0 well 
know by the community since long time. This has been documented for more 
than 2-3 years know (raised 4 years ago). Are there any consensus, that 
type 0 routing header should be deprecated? Until that it is documented to
  be filtered if there is no need for it. The current patch provided by 
OpenBSD/FreeBSD makes *BSD IPv6 implemenation non-conformant to standard. 
I would rather focus on pf changes - allow filtering based on the routing 
header type. Currently you can filter based existence/non-existence of 
routing header type. This is currently clearly not enough....

Regards,

Janos Mohacsi
Network Engineer, Research Associate, Head of Network Planning and Projects
NIIF/HUNGARNET, HUNGARY
Key 70EF9882: DEC2 C685 1ED4 C95A 145F  4300 6F64 7B00 70EF 9882

On Wed, 25 Apr 2007, George V. Neville-Neil wrote:

> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [email-masked]
> Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------
>

---

From: Gert Doering <[email-masked]>
Date: Wed, 25 Apr 2007 10:24:08 +0200

Hi,

> OpenBSD/FreeBSD makes *BSD IPv6 implemenation non-conformant to standard. 

Well, one could argue that the standard isn't very well-written then - a 
machine that is a *host* should NEVER forward packets, period.

That's what we have routers for, and there is a well-defined way to 
change a *BSD machine from a "host" to a "router" (turn on ip6.forwarding).

> routing header type. This is currently clearly not enough....

Extending pf(4) accordingly would certainly be a good thing, as it could
help other machines behind a NetBSD firewall.

(BTW - what's pf(4) doing if a packet comes with with RH0?  Which address
does it use for ACL checking, and which address is used for state setup?)

Gert Doering
        -- NetMaster
-- 
Total number of prefixes smaller than registry allocations:  113403

SpaceNet AG                        Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
Tel: +49 (89) 32356-444            USt-IdNr.: DE813185279

---

From: David Malone <[email-masked]>
Date: Wed, 25 Apr 2007 09:31:12 +0100

On Wed, Apr 25, 2007 at 09:41:09AM +0200, Mohacsi Janos wrote:
> routing header type.

It seems to me that there are at least two questions here. One is,
"Should IPv6 nodes process type 0 routing headers by default?" The
second is, "should the network allow type 0 routing headers to pass?"

This is a bit like they choice you have for blocking a smurf attack.
You can block it by turning off directed broadcasts (on the edge)
or you can block it by blocking ICMP packets throughout the network.

I think it may actually be that we do not want nodes to process
type 0 routing headers by default, but the network should pass them.
The reason for this is that the type 0 headers have useful applications
which could be secured by end hosts without getting the network
involved at all. Then end hosts that want to use the routing header
can, and those that don't are secure by default.

I could easily be wrong though...

	David.

---

From: Gert Doering <[email-masked]>
Date: Wed, 25 Apr 2007 12:10:01 +0200

Hi,

On Wed, Apr 25, 2007 at 10:46:54AM +0200, Remi Denis-Courmont wrote:
> 
> On Wed, 25 Apr 2007 10:24:08 +0200, Gert Doering <[email-masked]> wrote:
> 
> That's a BSD bug, not a standard bug.
> 
> The IPv6 specification says host must process RT0. It does not say they must
> forward packets as if they were routers on the sole basis of RT0 presence.
> 
> By the current spec (as far as I understand), if a host receives a RT0, it
> must process it. Then it must apply the same rules to the "new" packet
> destination as it would do to any packet it receives; in particular, if the
> packet cannot be delivered locally, it is dropped. You do the exact same
> thing when you receive a packet from link-layer while you are not the
> destination at network-layer.

Thanks for the clarification.  Indeed, this explains the necessity to
process the RH0 header locally (it might point to a different address on the 
*same host*).

Gert Doering
        -- NetMaster

---

From: [email-masked] (Jun-ichiro itojun Hagino)
Date: Wed, 25 Apr 2007 22:03:20 +0900 (JST)

> > machine that is a *host* should NEVER forward packets, period.

	bzzzt.  with IPv6 spec NODE (host + router) has to handle routing
	header type 0 and forward *even if ip6.forwarding is 0.  that's the
	steve deering's last word before he left to Canada for retirement.

itojun

---

From: Rob Austein <[email-masked]>
Date: Wed, 25 Apr 2007 10:13:36 -0400

At Wed, 25 Apr 2007 09:41:09 +0200 (CEST), Mohacsi Janos wrote:
>
> The current patch provided by OpenBSD/FreeBSD makes *BSD IPv6
> implemenation non-conformant to standard.

Sometimes violating the standard is the only reasonable thing for an
implementor to do.  The (IPv4) stack I worked on back in the '90s
shipped with forwarding of directed broadcast disabled by default,
long before anybody had heard of a "smurf attack".  The stack had a
compile-time option to enable forwarding of directed broadcast; from
memory, the documentation for that option went something like this:

  "This option exists solely to allow this software to comply with RFC
  1812.  Directed broadcast is dangerous, no matter what RFC 1812
  says.  Never enable this option under any circumstances."

Eventually the IETF gathered the collective will to update the
standard, but as implementors we would have been derelict in our duty
to our customers had we waited for the IETF.

---

From: Ed Jankiewicz <[email-masked]>
Date: Wed, 25 Apr 2007 11:13:09 -0400

I am facing a similar dilemma.  Currently editing version 2.0 draft of 
the US DoD "DISR Product Profiles for IPv6" and considering adding a 
THOU SHALT NOT or at least "it would be a great idea if you didn't" 
forward based on RH0 due to this vulnerability.  At the very least I 
will note this risk, suggesting that vendors SHOULD provide a means of 
disabling RH0, and also consider disabling by default.

Especially interested in strong opinions from vendors about difficulty 
in complying if that were the case.  Cross posting to NAv6TF as well, 
but please reply directly to [email-masked] and avoid cluttering 
up the lists with specific objections and suggestions.  I will summarize 
back to the lists.

Thanks
Ed J.

-- 
Ed Jankiewicz - SRI International
Fort Monmouth Branch Office - IPv6 Research 
Supporting DISA Standards Engineering Branch
732-389-1003 or  [email-masked]

---

From: "Tony Hain" <[email-masked]>
Date: Thu, 26 Apr 2007 15:44:50 -0700

Before you kill this off too quickly, James Woodyatt's proxy redirection is
a perfect example of a use for Type 0 Routing Headers. He wants the firewall
to redirect traffic through a designated point (what this header was
designed to do), and the only hammer at his immediate disposal was IPv6/IPv6
nat. 

It is certainly reasonable to have a BCP that says 'these should be filtered
at policy boundaries unless there is a good reason to do otherwise', but
they are a tool to solve some very specific corner cases. 

Tony

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Ed Jankiewicz
> Sent: Wednesday, April 25, 2007 8:13 AM
> To: [email-masked]
> Cc: Rob Austein; [email-masked]; [email-masked];
> [email-masked]
> Subject: Re: IPv6 Type 0 Routing Header issues
>