This doesn’t seem to affect Linux itself, wonder what crazy stuff Mikrotik are doing with IPv6 to introduce a vulnerability like this?
I didn’t think I was imagining it… but this definitely puts this into “very scary” territory. Especially if type 1, 2, 3, or 4 can trigger this.
Maybe this is just a case of bad values for some IPv6 sysctl parameters — e.g. memory exhaustion by the kernel because of a value set too large. It will be interesting to hear back from MikroTik support — next week, I guess.
Maybe it is connection tracking. That would explain why it also effects unreachable networks.
However, it does not really explain why it would be triggered by low volume traffic. Connection tracking
should survive moderate traffic. Of course pumping a gigabit of ICMP probes like those friendly programs
do will kill the router.
I added a “notrack” rule to ipv6 raw prerouting, and RouterOS still crashes.
I could understand if the router dropped packets because it does not have the CPU power to push them. But crashing is not a good engineering solution.
In the case of excessive traffic the device shouldn’t crash and reboot (verify with uptime). It’s acceptable and understable for any excess traffic to be dropped by the router when it’s reached it’s limits either in software or hardware.
[Ticket#2018041622003823] opened for the ICMPv6 transit crash.
Response from Maris:
You can exhaust resources of any device by simply sending large amount of data.
Set up ipv6 firewall to protect your router.
Best way is to limit amount of accepted icmpv6 packets in IPv6 RAW firewall.
I have asked them to reconsider, as this isn’t traffic destined for the router that crashes. Nor do I believe it affects ICMPv6 only.
I think all the emails back and forth were testing Maris’ patience, but I am so incredibly grateful that they have listened and we have understood each other.
“We will test this scenario.”
Excellent news - and good luck, MikroTik team!
Unfortunately problem is not resolved yet. I also can not give you any ETA for such fixes.
When problem will be resolved, then RouterOS release notes will include such fix description.
I guess we keep on waiting, and hoping…
Yup, I don’t have any plan to use MikroTik equipment in net new projects until I see more active IPv6 feature development. Speaking with the wallet is the most effective agent of change I have available.
Even UniFi has IPv6 support that is being actively brought up to snuff. For everything else I suppose I’ll have to give my money to Cisco.