端端舝

IPv6本平亙伉氾奴
反元戶及珨餜
瞓憷湮悝湮ⅸ翩侗
https://en.wikipedia.org/wiki/File:Aldrin_Apollo_11.jpg

旯手屳手卅中磐�
? 陑�尹
每幻午氏升及�習反IPv4午劐歹日卅中
?L2眕狟午L4眕奻反(掛懂)劐歹日卅中
?L3互IPv4匹丐月仇午毛ゴ枑卞仄凶跪意釬曰煋心卞
卅勻化中卅仃木壬
?公丹﹜IPv4肮�及�習互匹五月灍蚾卅日...
每IPv6卅氏化妏勻化卅中反內午中丹蚐剿反𤚗
?悃反中仁日匹手嶱仃日木月
March 19, 2017 菴12隙靡嘉挌ロ�本平亙伉氾奴辭�頗 2

掛゜及囀⺍
? 奶件玄伕母弁扑亦件
? IPv6失玉伊旦极炵
? IPv6失玉伊旦午磊繚及偞隅
? IPv6午白奴伙正伉件弘
? 恚杅及IPv6失玉伊旦
? IPv6午IPv4及髦婓
? 邈愴夫欠中

旌仃凶中袨暿
http://www.itu.int/en/ITU-D/Regional-Presence/AsiaPacific
/Documents/s11-ipv6-securingtransitionmechanisms.pdf

IPv6午IPv4匹綃丹午仇欠
? IP失玉伊旦(32申永玄↙128申永玄)
每𣷣湮卅失玉伊旦諾嶲毛瞳蚚仄凶妏中𡃤化
每赻�偞隅源楊
每旦戊奈皿ㄗ伉件弁伕奈市伙失玉伊旦脹ㄘ
? 穴伙民平乓旦玄尺及甡湔僅
每皮伕奈玉平乓旦玄反椛砦

IPv6帤爀⻌及反內及伉件弁卞化

�尹化中凶手及
? IPv6由弗永玄
每伉件弁伕奈市伙失玉伊旦ㄗfe80::...ㄘ
每穴伙民平乓旦玄失玉伊旦ㄗff02::...ㄘ
? IPv6匹�毛仄方丹午仄化中月辻け互中月
每踏及午仇欠反杻卞�中仇午反卅今公丹
每仇木日卞�偞隅ロ�毛妘歹六月午...

IPv6匹蕉尹月屯五☆恚杅及ㄙㄙ★
? IP田奈斥亦件
? 伉件弁
? 旦戊奈皿
? 失玉伊旦
? 皿伊白奴弁旦
? 伙奈正(奻霜﹜伙奈正𣷣豢(RA))
? DHCPv6扔奈田/伉伊奈

IPv6失玉伊旦极炵

IPv6失玉伊旦 (1/2)
失玉伊旦�� 蚚芴
::/128 Unspecified Address
::1/128 Loopback Address
::ffff:0:0/96 IPv4-mapped Address
64:ff9b::/96 IPv4-IPv6 Translation
100::/64 Discard-Only Address Block
2000::/3 Global Unicast
2001::/23 IETF Protocol Assignments
2001::/32 TEREDO
2001:1::1/128 Port Control Protocol Anycast
2001:1::2/128 Traversal Using Relays around NAT Anycast
2001:2::/48 Benchmarking
[1] https://www.iana.org/assignments/ipv6-address-space/ipv6-address-space.xhtml
[2] https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml

IPv6失玉伊旦 (2/2)
失玉伊旦�� 蚚芴
2001:3::/32 AMT
2001:4:112::/48 AS112-v6
2001:5::/32 EID Space for LISP (Managed by RIPE NCC)
2001:10::/28 Deprecated (previously ORCHID)
2001:20::/28 ORCHIDv2
2001:db8::/32 Documentation
2002::/16 6to4
2620:4f:8000::/48 Direct Delegation AS112 Service
fc00::/7 Unique Local Unicast
fe80::/10 Linked-Scoped Unicast
ff00::/8 Multicast
[1] https://www.iana.org/assignments/ipv6-address-space/ipv6-address-space.xhtml
[2] https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml

IPv6失玉伊旦午旦戊奈皿
? 旦戊奈皿珨笊 (RFC 4291, 7346)
? 伉件弁伕奈市伙失玉伊旦互嗣蚚今木月
每 <address>%<zone_id> 及倛匹桶政
每 ☆扔奶玄堤諳★匹及袚聑?秶郘反祥褫夔
楓瘍靡ゴ
1 Interface-Local scope
2 Link-Local scope
3 Realm-Local scope
4 Admin-Local scope
5 Site-Local scope
8 Organization-Local scope
e Global scope

IPv6穴伙民平乓旦玄
? IPv6失玉伊旦
每ff0x::/8 (x反旦戊奈皿)
? MAC失玉伊旦
每33-33-xx-xx-xx-xx
(IPv6失玉伊旦及狟弇32申永玄)
? 冞陓氪秶郘
每L2辻け匹及Client separation
? 忳陓氪(Multicast Listener)秶郘
每L2辻け匹及MLD snooping

螿堤穴伙民平乓旦玄失玉伊旦
? ff02::1 (All Node)
? ff02::2 (All Router)
? ff02::16 (MLDv2)
? ff02::1:2 (All DHCPv6 server/relay)
? ff02::1:3 (Link-local Multicast Name
Resolution)
? ff02::1:ffxx:xxxx (Solicited Node)
? ff05::1:3 (All DHCPv6 server)

IPv6失玉伊旦諾嶲午馴𨬢騵俶
? IP失玉伊旦及�杅抻坰(brute force)卞反
卅井卅井甲永玄仄卅中
每伙奈正卞輪蕕抻坰今六月仇午卞卅曰﹜
磐擁�盡反奻互月ㄗDoS砩�反傖憩允月ㄘ
每㻢腔午肮珨伉件弁卞⻌勻化仄引尹壬
穴伙民平乓旦玄由弗永玄珨逃匹皺歹曰
每 RFC 7707卞丐月方丹卅忒楊匹抻坰講毛祅𦑩
? 馴𨬢氪�手IP失玉伊旦反嗣杅丐月
ㄗ剟手勾五溫觳ㄘ
每白奴伙正薜僅﹜巨件玄伉杅
?白奴伙正及赻�汜傖手窕中
?rate-limit仁日中仄井忒反卅今公丹分互�砓��及
羥ピ卅偞隅反褣仄公丹

IPv6失玉伊旦午磊繚及偞隅

IPv6失玉伊旦赻�偞隅1
? 旦氾奈玄伊旦倰
每ICMPv6 Router Advertisement (RFC 4862)
?皿伊白奴弁旦64申永玄午石旦玄赻旯互𢜪戶凶
64申永玄毛磐磁
?Privacy Extension (RFC 4941)卞方曰失玉伊旦杅
互壩木奻互月
?(Valid lifetime) / (Preferred lifetime)
?傷藺�井日及陔�戊生弁扑亦件卞反妏歹卅中互
渾忳失玉伊旦午仄化反衄�
?Neighbor cache手秏愐

RA丟永本奈斥及瞰1 (1/2)

RA卞方曰偞隅今木凶失玉伊旦

RA尺及馴𨬢
? 馴戶升仇欠
每掞匹手ㄗ焆〝�蚾仄化ㄘ冞陓匹五月
每詢�珂僅匹及冞陓
每Lifetime=0毛蚚中凶淏�RA及剠�趙
? �習
每RA Guard (RFC 6105, 7113)
?L2辻け匹及�習ㄗ昜燴禾奈玄毛癹隅ㄘ
每SEND (RFC 3971)
?做瘍腔汜傖失玉伊旦﹜RSA扰靡

IPv6失玉伊旦赻�偞隅2
? 旦氾奈玄白伙倰
每DHCPv6 (RFC 3315)
? 失玉伊旦賃絞及奪燴毛仄勻井曰俴中凶中
卅日DHCPv6匹﹜午晟中凶中午仇欠分互＃

DHCPv6手伎〝�觳互
? 皿伕玄戊伙腔卅�觳
每RA午及窣觓猁ㄗ卅仁化手�仁井手↗1分互ㄘ
?磊繚偞隅反DHCPv6匹反今木卅中↗2
?RA矛奈旦及失玉伊旦賃絞毛旌仃月方丹卞偞隅猁
每MAC失玉伊旦午及�𡛟互歹井日卅中
?蔃中堤仄失玉伊旦午�𡛟葆仃日木月及反DUID
? 灍蚾奻及�觳
每Android午Windows
每��摽扴
↗1: RFC 4862 ∫5.5.2
↗2: draft-ietf-mif-dhcpv6-route-option-05 (expired)

DHCPv6毛桯嶱仄凶生永玄伐奈弁瞰
240b:251:c080:16::/64
240b:251:c080:14::/64
PC
Router & DHCPv6 Server
Catalyst 3560
Router & DHCPv6 Relay
Wireless AP
Client PC
(Windows 10)

RA矛奈旦及失玉伊旦賃絞眚秶 (1/2)
? radvd.conf (Linux PC伙奈正)
interface enp0s2
{
AdvSendAdvert on;
AdvManagedFlag on;
AdvOtherConfigFlag on;
prefix 240b:251:c080:14::/64
{
AdvOnLink on;
AdvAutonomous off;
AdvRouterAddr off;
AdvValidLifetime 3600;
AdvPreferredLifetime 1800;
};
};

RA矛奈旦及失玉伊旦賃絞眚秶 (2/2)
? Cisco IOS
interface GigabitEthernet0/10
no ip address
ipv6 enable
ipv6 nd ra suppress all
interface Vlan6
no ip address
ipv6 address 240B:251:C080:16::1/64
ipv6 enable
ipv6 nd prefix default 3600 1800 no-autoconfig no-rtr-address
ipv6 nd managed-config-flag
ipv6 nd other-config-flag
ipv6 nd ra lifetime 3600
ipv6 dhcp relay destination 240B:251:C080:14::1

DHCPv6卞方月失玉伊旦賃絞
? dhcpd.conf (ISC DHCPd)
subnet6 240b:251:c080:14::/64 {
range6 240b:251:c080:14::1000:0 240b:251:c080:14::1000:20;
}
subnet6 240b:251:c080:16::/64 {
range6 240b:251:c080:16::1000:0 240b:251:c080:16::1000:1000;
option dhcp6.name-servers 2001:4860:4860::8888;
}

DHCPv6丟永本奈斥及瞰

DHCPv6卞方曰偞隅今木凶失玉伊旦

IPv6失玉伊旦午MAC失玉伊旦及憂葆仃
? Neighbor cache
每ip -6 neighbor
每netsh interface ipv6 show neighbors
每show ipv6 neighbors
? DHCP扔奈田匹及�嶕
每DHCP(v4)匹反MAC失玉伊旦午IPv4失玉伊旦
每DHCPv6匹反DUID午IPv6失玉伊旦
? DUID午MAC失玉伊旦及憂勿仃
每DHCP relay埣仄匹反�𡛟葆仃互褣仄中

DHCPv6灍蚾及�觳
? Android
每公手公手DHCPv6互灍蚾今木化中卅中
每http://www.techrepublic.com/article/android
s-lack-of-dhcpv6-support-poses-security-
and-ipv6-deployment-issues/
? Windows 10
每Renew卞囮㷍允月
每忒� ipconfig /renew6 窣湖卞方曰𤊄隅��I
每https://social.technet.microsoft.com/Forums
/windows/en-US/4d167816-bc56-4003-
bc97-232b9dbcc1ca/

DHCPv6尺及馴𨬢
? 馴戶升仇欠
每穴伙民平乓旦玄弘伙奈皿卞掞匹手JOIN褫夔
? �習
每L2辻け匹及昜燴禾奈玄癹隅
每DHCPv6 Shield (RFC 7610)卞方月目永母
民尼永弁
每Delayed Authenticationㄗ綈晊庲偩ㄘ及爀⻌
?扔奈田午弁仿奶失件玄及嶲匹贈躇潬毛僕衄
?Dibbler DHCPv6匹反灍蚾今木化中月耀�

皿伊白奴弁旦賃絞 (1/2)
? 巨件玉扔奶玄互皿伕田奶母井日腕月
㻢𨃨腔卅失玉伊旦諾嶲反/56
每https://www.nic.ad.jp/doc/jpnic-01167.html
每湮悝午井及�耀匹丐木壬/48及�磁手
?http://w4a.sinet.ad.jp/service/network/l3/ipv6/as
signment/
? 1伉件弁反㻢𨃨腔卞/64
? 扔奶玄囀及失玉伊旦(皿伊白奴弁旦)賃絞
每摩廣仄支允今毛蕉𩬅卞⻌木月斛猁衄

皿伊白奴弁旦賃絞 (2/2)
? �腔賃絞皿伕玄戊伙
每DHCPv6-PD (RFC 3633)
? 磊繚秶郘
每RIPng (RFC 2080)
每OSPFv3 (RFC 5340)

玄件生伙丐木仇木
? IP in IP﹜GRE
? 6to4﹜6rd
? Teredo
? ISATAP
? MPLS
? 公及坻黃赻源宒及玄件生伙
? 軑ヽ仄卅中奻霜尺及㠙仃悃反中仁日匹手
釬木月

IPv6午白奴伙正伉件弘

霜⻌白奴伙正
? uRPF (unicast Reverse Path Forwarding)
每RFC 3704 (BCP 84)
240b:251:c080:16::/64
240b:251:c080:14::/64
Router
Router
Wireless AP
Client PC
℅
Src=/240b:251:c080:16::xxxx
Strict uRPF及瞰

ICMPv6
? IPv4匹反ICMP毛埻�t砦戶化仄引丹綅蚚互
嗣仁卅今木化中月
每IPv6匹手肮�及綅蚚毛仄井友卅中
? ICMP尺及甡湔僅?丟永本奈斥及意�反
IPv4方曰�仄化中月
每失玉伊旦賃絞
每失玉伊旦賤𢜪ㄗ輪蕕抻坰﹜ARP眈絞ㄘ
每伙奈正抻坰
每穴伙民平乓旦玄弘伙奈皿奪燴ㄗIGMP眈絞ㄘ

輪蕕抻坰 (RFC 4861)
? ICMPv6
每Neighbor Solicitation (Type 135)
?冞陓啋ㄩ冞陓啋IF卞葆今木凶失玉伊旦衱反 ::
?剄珂ㄩ正奈必永玄及失玉伊旦衱反 �𡛟允月
猁�用奈玉穴伙民平乓旦玄失玉伊旦
每Neighbor Advertisement (Type 136)
?冞陓啋ㄩ冞陓啋IF卞葆今木凶失玉伊旦
?剄珂ㄩ�𡛟允月NS及冞陓啋失玉伊旦
?NS及冞陓啋互::及�磁反ff02::1尺

ICMPv6丟永本奈斥及白奴伙正伉件弘
? 左旦旦丟及支曰源互RFC 4890卞
每皮伉永斥倰午伙奈正倰及跪FW
每伉件弁伕奈市伙午弘伕奈田伙
每ip6tables匹及撿极腔卅偞隅源楊及葆嶕葆五

恚杅及IPv6失玉伊旦

恚杅及IPv6失玉伊旦
? �〝及籵陓卞云中化冞陓啋?剄珂午仄化
升木毛妏丹井𢜪戶卅仃木壬卅日卅中
? getaddrinfo()卞賡⻌
每冞陓啋失玉伊旦腢亼
每剄珂失玉伊旦腢亼
每㻢𨃨腔卅腢亼價𨃨ㄩRFC 6724

冞陓啋失玉伊旦腢亼
? 垀迵及剄珂(D)卞�允月冞陓啋(S)毛珨勾呾堤
1. S=D匹丐月S毛�珂
2. 羥ピ卅旦戊奈皿匹丐月S毛�珂
3. 椛砦今木凶失玉伊旦匹丐月S毛隙旌
4. 石奈丞失玉伊旦匹丐月S毛�珂
5. 冞堤奶件正白尼奈旦卞葆今木凶S毛�珂
5. 棒石永皿井日𣷣豢今木凶皿伊白奴弁旦及S毛�珂
6. S午D及仿矛伙互珨祡允月S毛�珂
7. 珨媆失玉伊旦匹丐月S毛�珂
8. S午D及皿伊白奴弁旦珨祡互郔墿及S毛�珂

剄珂失玉伊旦腢亼
? 剄珂伉旦玄及�K屯杸尹
1. 善絻祥夔卅D支D卞�𡛟允月S互帤隅膽卅手及
毛隙旌
2. S午D及旦戊奈皿互珨祡允月手及毛�珂
3. S互椛砦今木凶失玉伊旦午卅月手及毛隙旌
4. S互石奈丞失玉伊旦午卅月手及毛�珂
5. S午D及仿矛伙互珨祡允月手及毛�珂
6. �珂僅及詢中D毛�珂
7. 生奶氾奴皮玄仿件旦禾奈玄及手及毛�珂
8. 旦戊奈皿及苤今中D毛�珂
9. S午D及皿伊白奴弁旦珨祡互郔墿及手及毛�珂
10. 啋及�楓毛劐尹卅中

仿矛伙午�珂僅
? 偞隅劐載褫夔
每Linux: /etc/gai.conf
每 Windows: netsh interface ipv6 show prefixpolicies
伙奈皿田永弁
公及坻
IPv4扞荌失玉伊旦
6to4
TEREDO
交瓦奈弁伕奈市伙
扔奶玄伕奈市伙(椛砦)
6bone(椛砦)
IPv4誑𡥼失玉伊旦(椛砦)

IPv6午IPv4及髦婓

Happy Eyeballs
? 醴腔ㄩIPv4白巧奈伙田永弁及媆嶲毛傻仁
? �廣ㄩRFC 6555
每 IPv4及SYN午IPv6及SYN毛�I源芘仆月
?屾仄分仃IPv6毛�珂允月
? 跪SYN反150-250ms嶲路ㄗ芢𠾴�ㄘ
?IPv6匹及諉適傖瘁毛珨隅ヽ嶲��
?A/AAAA互恚杅丐月�磁﹜狟��珂�
1. 郔�珂及IPv6失玉伊旦
2. IPv4失玉伊旦
3. 公及坻及IP失玉伊旦
每珂卞SYN+ACK互殿勻化五凶源毛妏丹
每失皿伉弗奈扑亦件匹及灍蚾互扑件皿伙
?OS匹及灍蚾及�磁﹜RFC6724午猁捼淕

邈愴夫欠中

馴𨬢(卞手妏尹月)汁奈伙
? THC-IPV6
每https://www.thc.org/thc-ipv6/
每http://tools.kali.org/information-
gathering/thc-ipv6
? SI6 Networks＊ IPv6 Toolkit
每https://www.si6networks.com/tools/ipv6tool
kit/
? scapy
每http://www.idsv6.de/Downloads/IPv6Packet
CreationWithScapy.pdf

云歹曰卞
? IPv6毛𠸎卞𨩆仃方丹
每跪石旦玄匹反IPv6�𡛟仄凶白央奶失它巧奈
伙末白玄毛⻌木月
?IPv6憝窣及偞隅毛婬僅復庲允月
每犯白巧伙玄公及引引及綅蚚反湮悃井手
?�籵仄支�邈午仄卞卅勻化中月褫夔俶
? 今勻今午native IPv6毛爀⻌仄化仄引丹及
互灍反本平亙失趙及婌耋井手仄木卅中
每伉件弁毛�\龰日木月ゴ卞珂忒毛湖勻化淕�

統蕉恅瓬
? Philip Smith, ``IPv6 Security,＊＊
ITU/APNIC/MICT IPv6 Security Workshop,
May 2016.
? 祩泬秷日, ``穴旦正伉件弘TCP/IP IPv6�
菴2唳,＊＊左奈丞扦, 2013.
? Scott Hogg, et al., ``IPv6 Security,＊＊ Cisco
Press, 2009.

端端舝

梆捩措6本平亙伉氾奴﹛反元戶及珨餜

More Related Content

梆捩措6本平亙伉氾奴﹛反元戶及珨餜