netdev - Re: net/ipv6: broken handling of ICMPv6 redirects since Linux 4.18-rc1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <17674516-5e6b-5222-4925-2af73b91f84e@gmail.com>
Date:   Thu, 5 Aug 2021 08:04:17 -0600
From:   David Ahern <dsahern@...il.com>
To:     Ondřej Caletka <Ondrej.Caletka@...e.net>,
        "David S. Miller" <davem@...emloft.net>, netdev@...r.kernel.org
Cc:     Michal Kubecek <mkubecek@...e.cz>
Subject: Re: net/ipv6: broken handling of ICMPv6 redirects since Linux
 4.18-rc1

On 8/5/21 6:50 AM, Ondřej Caletka wrote:
> 
> Dear maintainers,
> 
> I think I discovered a bug introduced in 4.18-rc1 and still present in
> 5.14-rc4. The problem is that Linux does not react on received ICMPv6
> redirect - the nexthop visible in the output of "ip -6 route get <dest>"
> does not get changed and the data are still sent to the nexthop of the
> default gateway. This used to work in kernels up to and including 4.17.19.
> 
> Steps to reproduce:
> -------------------
> 
> I am reproducing the issue in a VM running Ubuntu 20.04 running three
> LXD containers. I use tool `redir6` from
> [THC-IPv6](https://github.com/vanhauser-thc/thc-ipv6) to perform the
> redirect attack. I am testing using vanilla kernels, compiled following
> this guide: https://wiki.ubuntu.com/KernelTeam/GitKernelBuild
> 
>  1. Download and run [the
> VM](https://github.com/RIPE-NCC/ipv6-security-lab)
>  2. on hostA, check that an arbitrary IPv6 address is routed through the
> default gateway:
> 
>     root@...tA:~# ip -6 rou get 2001:db8:bad:dad::1
>     2001:db8:bad:dad::1 from :: via fe80::216:3eff:feee:1 dev eth0 proto
> ra src 2001:db8:f:1:216:3eff:feee:a metric 100 mtu 1500 pref medium
> 
>  3. on hostC, perform the redirect attack and sniff the incoming traffic
> 
>     root@...tC:~# redir6 eth0 2001:db8:f:1:216:3eff:feee:a
> 2001:db8:bad:dad::1 fe80::216:3eff:feee:1 fe80::216:3eff:feee:c
>     Sent ICMPv6 redirect for 2001:db8:bad:dad::1
>     root@...tC:~# tcpdump -nei eth0 dst host 2001:db8:bad:dad::1
> 
>  4. on hostA, check the route again and try to send an echo request to
> that address:
> 
>     root@...tA:~# ip -6 rou get 2001:db8:bad:dad::1
>     2001:db8:bad:dad::1 from :: via fe80::216:3eff:feee:1 dev eth0 proto
> ra src 2001:db8:f:1:216:3eff:feee:a metric 100 mtu 1500 pref medium
>     root@...tA:~# ping -c 1 2001:db8:bad:dad::1
>     PING 2001:db8:bad:dad::1(2001:db8:bad:dad::1) 56 data bytes
>     From 2001:db8:f:1::1 icmp_seq=1 Destination unreachable: No route
> 

how does your test differ from:

https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/tree/tools/testing/selftests/net/icmp_redirect.sh

Can you create a similar script for your test setup?