IPv6 filtering

IPv6 filtering

[Jonathan Tripathy]

Hi Everyone,

We host VPSes using Xen to customers. We run iptables and ebtables on 
our Xen hosts to make sure that each VPS can only use the IP and MAC 
addresses assigned to them.

With IPv6, does anyone have any experience on how to do this? I know we 
can use ip6tables, but isn't there some trickery with NDP (Which 
replaces ARP)?

Thanks

Re: IPv6 filtering

[Guido Winkelmann]

On Tuesday 01 February 2011 22:38:49 you wrote:
> With IPv6, does anyone have any experience on how to do this? I know we
> can use ip6tables, but isn't there some trickery with NDP (Which
> replaces ARP)?

There shouldn't be, just as long as you only filter on the source address of 
outgoing packets, and not on the destination of incoming ones. The NDP request 
packets go to weird multicast addresses that depend on the address being 
requested. I haven't totally figured out the scheme yet (haven't really 
tried).
Answer packets for NDP always have a valid IPv6 address from the answering 
host as their source address. Also, they're IPv6 packets like any other and 
not a separate protocol as with ARP+IPv4.

Note that hosts using IPv6 will usually have at least two autoconfigured 
addresses, and it's sometimes hard to predict which one will be used as source 
address for outgoing packets, especially if the number of configured addresses 
grows. You must not block any of those.

Also see my message from yesterday on that subject, please. I'm having 
problems with filtering IPv6 from VPSes as well, and if you find a solution 
that works with large numbers of vpses, I would appreciate it if you could 
share it.

	Guido

Re: IPv6 filtering

[Jan Engelhardt]

On Wednesday 2011-02-02 00:00, Guido Winkelmann wrote:
>On Tuesday 01 February 2011 22:38:49 you wrote:
>
>>that each VPS can only use the IP and MAC addresses      
>>assigned to them.
>>With IPv6, does anyone have any experience on how to do this? I
>>know we can use ip6tables, but isn't there some trickery with NDP
>>(Which replaces ARP)?
>
>There shouldn't be, just as long as you only filter on the source 
>address of outgoing packets, and not on the destination of incoming 
>ones. The NDP request packets go to weird multicast addresses

That "weird multicast address" is just broadcast so to speak, there is 
nothing weird about it.

>Answer packets for NDP always have a valid IPv6 address from the answering 
>host as their source address. Also, they're IPv6 packets like any other and 
>not a separate protocol as with ARP+IPv4.

>Note that hosts using IPv6 will usually have at least two autoconfigured 
>addresses

Can you back up this statement?

Re: IPv6 filtering

[Guido Winkelmann]

Am Wednesday 02 February 2011 schrieben Sie:
> On Wednesday 2011-02-02 00:00, Guido Winkelmann wrote:
> >On Tuesday 01 February 2011 22:38:49 you wrote:
> >>that each VPS can only use the IP and MAC addresses
> >>assigned to them.
> >>With IPv6, does anyone have any experience on how to do this? I
> >>know we can use ip6tables, but isn't there some trickery with NDP
> >>(Which replaces ARP)?
> >
> >There shouldn't be, just as long as you only filter on the source
> >address of outgoing packets, and not on the destination of incoming
> >ones. The NDP request packets go to weird multicast addresses
> 
> That "weird multicast address" is just broadcast so to speak, there is
> nothing weird about it.

Well, from what I could gather in wireshark, it's a bunch of different dst 
addresses that are used for that, and which one is used appears to depend on the 
address being queried...

> >Answer packets for NDP always have a valid IPv6 address from the answering
> >host as their source address. Also, they're IPv6 packets like any other
> >and not a separate protocol as with ARP+IPv4.
> >
> >Note that hosts using IPv6 will usually have at least two autoconfigured
> >addresses
> 
> Can you back up this statement?

Well, as soon as you enable IPv6 on a host, all of its interface will generally 
immediately be assigned an autoconfigured link-local address calcaluted from the 
MAC address. As soon the host receives a router advertisement on one of its 
interfaces, it will auto-configure an additional address from the advertised 
prefix and its MAC.

Of course, if you don't have any IPv6 routers on the local net, or if they don't 
send router advertisements, then the second autoconfigured address will not 
exist, but then, if there is no IPv6 router, then saying the host is "using 
IPv6" is a bit far fetched, and having an IPv6 router on the local network that 
does not send any router advertisements is, as far as I can tell, a rare corner 
case.

	Guido

Re: IPv6 filtering

[Jan Engelhardt]

On Wednesday 2011-02-02 14:30, Guido Winkelmann wrote:
>>>
>>>There shouldn't be, just as long as you only filter on the source
>>>address of outgoing packets, and not on the destination of incoming
>>>ones. The NDP request packets go to weird multicast addresses
>> 
>>That "weird multicast address" is just broadcast so to speak, there is
>>nothing weird about it.
>
>Well, from what I could gather in wireshark, it's a bunch of different dst 
>addresses that are used for that, and which one is used appears to depend on the 
>address being queried...

Solicited-node MC. Nothing special really, works like a limited broadcast.

>Of course, if you don't have any IPv6 routers on the local net, or if they don't 
>send router advertisements, then the second autoconfigured address will not 
>exist, but then, if there is no IPv6 router, then saying the host is "using 
>IPv6" is a bit far fetched

Autoconfiguration is not a mandatory requirement for using IPv6.

Re: IPv6 filtering

[Jonathan Tripathy]

On 01/02/11 23:00, Guido Winkelmann wrote:
> On Tuesday 01 February 2011 22:38:49 you wrote:
>> With IPv6, does anyone have any experience on how to do this? I know we
>> can use ip6tables, but isn't there some trickery with NDP (Which
>> replaces ARP)?
> There shouldn't be, just as long as you only filter on the source address of
> outgoing packets, and not on the destination of incoming ones. The NDP request
> packets go to weird multicast addresses that depend on the address being
> requested. I haven't totally figured out the scheme yet (haven't really
> tried).
I really do need to filter by both the source and destination IP 
addresses. Amongst other things, I want to make sure that packets 
destined for another VPS never arrive at the wrong VPS. This can happen 
when the Linux bridge is "re-learning" the MAC Address mappings.

It is wise to allow *all icmpv6* traffic destined for the multicast 
address to the destined VPS?
> Answer packets for NDP always have a valid IPv6 address from the answering
> host as their source address. Also, they're IPv6 packets like any other and
> not a separate protocol as with ARP+IPv4.
Yes, however there is nothing currently like arptables for IPv6 that I 
know of. Even though the NDP answers may have a correct source IP, 
surely the payload could provide wrong (i.e. malicious) data...
> Note that hosts using IPv6 will usually have at least two autoconfigured
> addresses, and it's sometimes hard to predict which one will be used as source
> address for outgoing packets, especially if the number of configured addresses
> grows. You must not block any of those.
I'm willing to give up the auto-config features of IPv6. We can just 
manually put the address in the respective config file. It's no big deal 
really.
> Also see my message from yesterday on that subject, please. I'm having
> problems with filtering IPv6 from VPSes as well, and if you find a solution
> that works with large numbers of vpses, I would appreciate it if you could
> share it.
>
> 	Guido

Re: IPv6 filtering

[Jozsef Kadlecsik]

On Wed, 2 Feb 2011, Jonathan Tripathy wrote:

> On 01/02/11 23:00, Guido Winkelmann wrote:
> > On Tuesday 01 February 2011 22:38:49 you wrote:
> > > With IPv6, does anyone have any experience on how to do this? I know we
> > > can use ip6tables, but isn't there some trickery with NDP (Which
> > > replaces ARP)?
> > There shouldn't be, just as long as you only filter on the source address of
> > outgoing packets, and not on the destination of incoming ones. The NDP
> > request
> > packets go to weird multicast addresses that depend on the address being
> > requested. I haven't totally figured out the scheme yet (haven't really
> > tried).
> I really do need to filter by both the source and destination IP addresses.
> Amongst other things, I want to make sure that packets destined for another
> VPS never arrive at the wrong VPS. This can happen when the Linux bridge is
> "re-learning" the MAC Address mappings.
> 
> It is wise to allow *all icmpv6* traffic destined for the multicast address to
> the destined VPS?

There's an RFC on the subject: Recommendations for Filtering ICMPv6 
Messages in Firewalls, rfc4890. It's well worth reading it.

> > Answer packets for NDP always have a valid IPv6 address from the answering
> > host as their source address. Also, they're IPv6 packets like any other and
> > not a separate protocol as with ARP+IPv4.
> Yes, however there is nothing currently like arptables for IPv6 that I know
> of. 

There is no ARP in IPv6 - so there's no arptable for IPv6.

> Even though the NDP answers may have a correct source IP, surely the
> payload could provide wrong (i.e. malicious) data...

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlec@mail.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
          H-1525 Budapest 114, POB. 49, Hungary

Re: IPv6 filtering

[Guido Winkelmann]

Am Wednesday 02 February 2011 schrieben Sie:
> > Answer packets for NDP always have a valid IPv6 address from the
> > answering host as their source address. Also, they're IPv6 packets like
> > any other and not a separate protocol as with ARP+IPv4.
> 
> Yes, however there is nothing currently like arptables for IPv6 that I
> know of.

ip -6 neighbor show (Requires iproute2 to be installed)

> Even though the NDP answers may have a correct source IP,
> surely the payload could provide wrong (i.e. malicious) data...

As far as I know, as long the source address of the answer packet is one 
address, it cannot be used to advertise a different address. If you want 
certainty, read the respective RFC (4861 afaict), study the packets being sent 
with wireshark and/or experiment with sending faked packets yourself.
 
> > Note that hosts using IPv6 will usually have at least two autoconfigured
> > addresses, and it's sometimes hard to predict which one will be used as
> > source address for outgoing packets, especially if the number of
> > configured addresses grows. You must not block any of those.
> 
> I'm willing to give up the auto-config features of IPv6. We can just
> manually put the address in the respective config file. It's no big deal
> really.

As long as any of your VPSes still have it enabled (I wouldn't even know how to 
disable it, and I think disabling the autoconfigured link-local addresses may 
break things), they will end up using it as a source address sooner or later.

I don't see why you want to completely forego autoconfiguration, really. IMHO, 
it's a nice "it just works"-feature. It can be a bit harder to filter, because 
you need to predict how these addresses will look like before the fact, but once 
you understand the principle, it's easy enough:

Just take the network address as advertised by your router, or fe80:: for the 
link-local address, and replace the lowest 8 byte with modified EUID of the 
machine's NIC. That "modified EUID" in turn can be calculated by taking the 6-
byte MAC address of the NIC, inserting the two bytes 0xff and 0xfe between the 
third and the fourth byte and toggling the second bit of the most significant 
byte. (Note: Some guides on the Internet will tell you to unconditionally set 
that last bit to 1. That is wrong.)

	Guido