Last year Andrew Forgue pointed out that rad(8) does not respond to
Router Solicitations from
::. ( https://marc.info/?l=openbsd-bugs&m=157820352329054&w=2 )
They also pointed out that RFC 4861 4.1 allows solicitations from the
unspecified address:
Source Address
An IP address assigned to the sending interface, or
the unspecified address if no address is assigned
to the sending interface.
With the help of some colleagues I did a small survey.
These systems respond:
- my ISP's CPE
- dnsmasq
- unifi edgerouter
These do not respond:
- rad(8)
- rtadv on centos 7
- Juniper SRX 4200 with junos 15.1
If you have other interesting router advertisement daemons running this
scapy script can be used to test if they are responding.
Run
tcpdump -enlp -i $IF icmp6
in parallel:
09:49:20.235215 8e:c8:60:7b:f3:c3 33:33:ff:00:00:02 86dd 62: :: > ff02::2:
icmp6: router solicitation
09:49:20.240450 54:67:51:de:e7:ce 33:33:00:00:00:01 86dd 198:
fe80::5667:51ff:fede:e7ce > ff02::1: icmp6: router advertisement
----8<----8<----8<----8<----8<----
#!/usr/bin/env python3
import sys
from scapy.all import *
# link-local solicited-node multicast address
def nsma(a):
n = inet_pton(socket.AF_INET6, a)
return inet_ntop(socket.AF_INET6, in6_getnsma(n))
# ethernet multicast address of multicast address
def nsmac(a):
n = inet_pton(socket.AF_INET6, a)
return in6_getnsmac(n)
# ethernet multicast address of solicited-node multicast address
def nsmamac(a):
return nsmac(nsma(a))
if len(sys.argv) != 3:
print("rs.py INTERFACE MAC", file=sys.stderr)
sys.exit(1)
ip=IPv6(src="::", dst="ff02::2")/ICMPv6ND_RS()
eth=Ether(src=sys.argv[2], dst=nsmamac("ff02::2"))/ip
sendp(eth, iface=sys.argv[1])
----8<----8<----8<----8<----8<----
In any case, I don't see a benefit it blocking :: here.
OK?
diff --git engine.c engine.c
index 9a939830ea5..6021954f5d4 100644
--- engine.c
+++ engine.c
@@ -480,8 +480,9 @@ parse_rs(struct imsg_ra_rs *rs)
len = rs->len;
- if (!IN6_IS_ADDR_LINKLOCAL(&rs->from.sin6_addr)) {
- log_warnx("RA from non link local address %s on %s", hbuf,
+ if (!(IN6_IS_ADDR_LINKLOCAL(&rs->from.sin6_addr) ||
+ IN6_IS_ADDR_UNSPECIFIED(&rs->from.sin6_addr))) {
+ log_warnx("RA from invalid address %s on %s", hbuf,
if_indextoname(rs->if_index, ifnamebuf));
return;
}
--
I'm not entirely sure you are real.
