Re: [Full-disclosure] HP A-series switches are affected, too. [WAS: More on IPv6 RA-Guard evasion (IPv6 security)]

[Dan Luedtke <maildanrl@xxxxxxxxxxxxxx>]

Hello Fernando,

On Thu, Sep 1, 2011 at 12:10 PM, Fernando Gont <fgont@xxxxxxxxxxxxxxx> wrote:
>> Based on Marc's ideas I tested the mentioned attack on Hewlett
>> Packard's A-series switches, and I have to say that these attacks were
>> successful. That stopped us from implementing IPv6 for a while in our
>> network.
>
> Do they ship with "RA-Guard"? -- Note that "hosts being vulnerable to
> RA-based attacks" does not imply a vulnerable RA-Guard implementation.
> The layer-2 might simply not ship with RA-Guard, it could ship with it
> but not be enabled, etc.
I have to admit, I was a little bit sloppy about the term RA-Guard.
Every vendors has another name for the feature that *should* provide
protection from faked Router Advertisements, technically it is
sometimes like RA-Guard, in reality it is often a simple ACL wrapped
in a shiny new command. HP tried to implement it in their "Neighbor
Discovery Detection" feature of Comware, and they succeeded partly.
One has to craft some nasty packets to circumvent their protection,
but one still is able to do so.


> Anyway... I'd bet that every implementation that "followed" the spec is
> vulnerable....
Unfortunately :(

>> By the way, I don't think it is a good idea to disallow any Extension
>> Headers in ND-Messages,
>
> Consensus at the relevant IETF working-group (6man) seems to be to only
> ban the Fragment Header (when SEND is not employed).
I'd like to discuss this further, there are many options and I really
like to read other's opinions on that. Disallowing Fragmentation
Headers might break some stack implementations (but hopefully only in
some situations). On the other hand, (virtually) reassembling IPv6
packets on a layer2 device is expensive.

I'll have a look on ipv6-hackers as soon as I am back from vacation.

> Yep... will post something right now, and see if that triggers discussion.
Thanks!

regards,
   danrl
-- 
danrl / Dan Luedtke
http://www.danrl.de