Whonix-Gateway wrongly accepts IPv6 router advertisement

Development
1 
Possibly critical issue found by GLM-5.3. accept_ra is 2 in Gateway. Run in Gateway: grep -H . /proc/sys/net/ipv6/conf/*/accept_ra. 
Get /proc/sys/net/ipv6/conf/eth0/accept_ra:2.

Whonix version | Non-Qubes-Whonix. 
Affected component(s) or functionality | Gateway
Steps to reproduce the behavior | Boot normally
Expected behavior | accept_ra is 0 everywhere
Actual behavior | accept_ra is 2 in eth0
Context | AI search inspired by https://forums.whonix.org/t/whonix-ai-security-usage/23555
Relevant Documentation that was consulted | code comments


security-misc tries to prevent:
https://github.com/Kicksecure/security-misc/blob/master/usr/lib/sysctl.d/990-security-misc.conf%23security-misc-shared#L566-L576
## Do not accept IPv6 router advertisements (RAs) and solicitations.
## RAs are unsecured and unauthenticated and any device on the local link can send and accept them without verification.
## Malicious RAs can activate IPv6 connectivity on dormant hosts leading to unauthorized access.
## Flooding the network with malicious RAs can lead to denial-of-service attacks.
## Rogue RAs can lead to interception of all network traffic by setting the attacker's system as the default gateway.
##
## https://datatracker.ietf.org/doc/html/rfc6104
## https://datatracker.ietf.org/doc/html/rfc6105
## https://archive.conference.hitb.org/hitbsecconf2012kul/materials/D1T2%20-%20Marc%20Heuse%20-%20IPv6%20Insecurity%20Revolutions.pdf
##
net.ipv6.conf.*.accept_ra=0

But, is possibly re-enabled in whonix-gw-network-conf:
https://github.com/Whonix/whonix-gw-network-conf/blob/master/etc/network/interfaces.d/30_non-qubes-whonix#L52-L53
## IPv6 autoconfiguration does not appear to require DHCP.
iface eth0 inet6 auto

auto option sets accept_ra to 2:
https://sources.debian.org/src/ifupdown/0.8.44+deb13u1/inet6.defn/#L26
  options
    privext int            -- Privacy extensions (RFC4941) (0=off, 1=assign, 2=prefer)
    accept_ra int          -- Accept router advertisements (0=off, 1=on, 2=on+forwarding) [2]
...
    -sysctl -q -e -w net.ipv6.conf.%iface/.//%.accept_ra=%accept_ra%


security-misc comments suggest at least high severity.

You say it is unconfirmed @Patrick . You could not do the grep? It worked for me.

2

This is by design. Whonix runs in virtual machines where malicious router advertisements are very unlikely to occur unless the host is compromised (which is game over). Whonix depends on IPv6 router advertisements to get IPv6 connectivity under KVM (and I think also VirtualBox), and whonix-firewall intentionally permits router advertisement packets through for this reason. See:

IPv6 router advertisements should be disabled on Kicksecure when running on baremetal. It isn’t catastrophic if this isn’t done, but would be something we would likely want to correct if it was determined that wasn’t happening.

1 Like
3

But, there is a wiki page supporting bare metal Whonix? Build Documentation: Physical Isolation

Could that be a problem?

4

Physical isolation isn’t truly supported. As mentioned at the end of Build Documentation: Physical Isolation

… the supported platforms table will continue to list physical isolation’s security status as “experimental”.

Even in that situation, IPv6 router advertisements aren’t much of a problem for Whonix. All traffic goes over Tor, so interception of all network traffic by an attacker is fine. Indeed, using Tor already means all your network traffic is potentially being intercepted by a malicious relay. Tor’s design prevents this from being a security or privacy concern for the most part. Whonix-Gateways are not dormant hosts either. Not accepting IPv6 RAs will often break IPv6 connectivity, so there isn’t really a better solution than to allow it.

I somewhat doubt if this particular part of security-misc should even be kept.

1 Like