CN102594810B - The method and apparatus that a kind of IPv6 network prevents PMTU from attacking - Google Patents

Abstract

The invention discloses a method and a device for preventing PMTU attacks on an IPv6 network. The switch enables the safety function of the ICMPv6 message too large message, and configures a trusted port for the switch; receives the ICMPv6 message message message that is too large; and judges the ICMPv6 message message message Whether the receiving port of the message belongs to the configured trusted port, if so, it will be forwarded to the IPv6 host, if not, the message will be discarded. The adoption of the technical solution of the invention ensures the safe use of the ICMPv6 oversized message, prevents the forwarding of the malicious ICMPv6 oversized message, and ensures the normal operation of the network.

Description

A method and device for preventing PMTU attack in IPv6 network

technical field

The invention relates to the field of computer data communication, in particular to a method and device for preventing PMTU attacks on an IPv6 network.

Background technique

Since the IPv6 router does not fragment the forwarded data packet, the PathMaximum Transmission Unit (PMTU) discovery (Discovery) mechanism is used to notify the source node of the data packet to re-fragment reasonably with the sixth version of the Internet Control Message Protocol (ICMPv6) message. However, the current ICMPv6 protocol does not verify the reliability of the ICMP packet sent by the intermediate router. The attacker can forge the too small PMTU and send the PMTU message to the source node, so that the node will always send a small report to the destination address in the future. files, causing network performance to degrade. An attacker can also forge an oversized PMTU and send it to the sending node. The sending node adjusts the MTU value and sends an oversized message, causing the intermediate router to discard the message and causing the loss of the message. This is actually a denial of service ( Denial-of-Service) attack. Therefore, ensuring the legitimacy of ICMPv6 oversized messages and preventing malicious users from using ICMPv6 oversized messages to attack is an important factor to ensure the normal operation of an IPv6 network.

Contents of the invention

The purpose of the present invention is to propose a method and device for preventing PMTU attacks on an IPv6 network, to ensure the legitimacy of the ICMPv6 message too large message, and to prevent malicious attackers from using the ICMPv6 message too large message to implement a denial of service attack.

For reaching this purpose, the present invention adopts following technical scheme:

A kind of method that IPv6 network prevents PMTU attack, comprises the following steps:

A. The switch enables the function of preventing IPv6 network PMTU attacks, and configures trusted ports for the switch;

B. Receive an ICMPv6 packet too large message;

C, judge whether the receiving port of ICMPv6 message too big message message belongs to the trusted port of configuration, if belong to, then forward to IPv6 host computer, if not belong to, then discard this message;

D. The IPv6 host receives the forwarded ICMPv6 packet too large message, and adjusts the maximum transmission unit (MTU) value sent to the target device.

In step A, the configured trusted port is the Layer 2 port and/or aggregation port connected to the IPv6 router on the switch.

In step C, when the receiving port of the ICMPv6 too large message belongs to a trusted port, the MAC address table is queried, and the ICMPv6 too large message is forwarded from the port connected to the IPv6 host.

It includes a receiving module, a port configuration module, a processing module and a forwarding module, wherein the processing module is connected to the receiving module, the port configuration module and the forwarding module respectively;

The receiving module is configured to receive an ICMPv6 packet too large message;

The port configuration module is configured to configure a trusted port for a switch;

The processing module is used to read the receiving port information of the ICMPv6 message too large message message, and judge whether the receiving port of the ICMPv6 message message message belongs to the trusted port of configuration, and if it belongs, the The ICMPv6 packet is too large message message is sent to the forwarding module; if it does not belong, then the ICMPv6 message message message is discarded;

The forwarding module is configured to forward the ICMPv6 too large message sent by the processing module to the destination host of the ICMPv6 too large message.

The port configuration module is a trusted port configured by a switch, and is a layer 2 port and/or aggregation port connected to an IPv6 router on the switch.

When the processing module determines that the receiving port of the ICMPv6 too large message belongs to a trusted port, the forwarding module queries the MAC address table, and forwards the ICMPv6 too large message from the port connected to the IPv6 host.

The adoption of the technical solution of the invention ensures the safe use of the ICMPv6 oversized message, prevents the forwarding of the malicious ICMPv6 oversized message, and ensures the normal operation of the network.

Description of drawings

FIG. 1 is a schematic flowchart of a method for preventing PMTU attacks in an IPv6 network provided by a specific embodiment of the present invention.

FIG. 2 is a schematic diagram of network device connections in the method for preventing PMTU attacks on an IPv6 network provided by a specific embodiment of the present invention.

FIG. 3 is a schematic structural diagram of a device for preventing PMTU attacks on an IPv6 network provided by a specific embodiment of the present invention.

detailed description

The technical solutions of the present invention will be further described below in conjunction with the accompanying drawings and through specific implementation methods.

FIG. 1 is a schematic flowchart of a method for preventing PMTU attacks in an IPv6 network provided by a specific embodiment of the present invention. As shown in Figure 1, the method includes the following steps:

In step S101, the switch enables the function of preventing PMTU attacks on the IPv6 network, and configures trusted ports for the switch.

After the switch enables the function of preventing PMTU attacks on the IPv6 network, the rules for redirecting ICMPv6 oversized messages to the CPU are sent to the switch chip so that when the switch chip receives an ICMPv6 oversized message, it forwards the message to the CPU. Redirect to the CPU of the switch, and the CPU performs software analysis and forwarding.

The characteristics of the ICMPv6 packet too large message are: the ether type of the 17th and 18th bytes of the Ethernet header is 0x86dd; the nexthdr of the 6th byte of the ipv6 header is 58; the icmpv6 type of the 41st byte of the ipv6 header is 2.

The trusted port configured for the switch is a Layer 2 port and/or aggregation port connected to an IPv6 router on the switch.

Generally, the number of ports used to connect routers on a switch is less than the number of ports used to connect host nodes, and secure ICMPv6 message packets are too large from routers, and non-secure ICMPv6 message packets are often from malicious host node. Therefore, when configuring the trusted port for the switch, the Layer 2 port and/or aggregation port connected to the IPv6 router on the switch is usually configured as a trusted port, and other unconfigured ports are all defaulted as untrusted ports. In this way, fewer ports need to be configured, which is convenient for users to operate and change port configurations.

Step S102, receiving an ICMPv6 packet too large message packet.

After the function of preventing PMTU attacks on the IPv6 network is enabled, the rule for redirecting ICMPv6 oversized messages to the CPU takes effect. After reaching the switch port, the ICMPv6 oversized messages are sent to the switch CPU by the switch chip for processing.

Step S103, judging whether the receiving port of the ICMPv6 oversized message belongs to the configured trusted port, if so, forwards the message to the IPv6 host, and if not, discards the message.

The ICMPv6 packet is too large message packet is redirected to the CPU of the switch, and the CPU performs software analysis and forwarding. In the software running on the CPU, each message is pointed to by a software structure, which contains a field indicating the receiving port. After the switching chip sends the message to the CPU, the packet receiving driver reads the port number from the register of the chip and writes it into the port field of the software structure of the message. The software running in CPU reads the port information in this field, and matches with the trusted port information configured in step S101; if it belongs to the trusted port, the ICMPv6 packet received by the port is forwarded to The target IPv6 host of the message; if it does not belong to the trusted port, the ICMPv6 message is too large message message is directly discarded. In this way, the illegal ICMPv6 packet too large message message sent by the malicious host node cannot reach its target IPv6 host, which ensures the safe use of the ICMPv6 message too large message.

Step S104, the IPv6 host receives the forwarded ICMPv6 packet too large message, adjusts the corresponding MTU value according to the ICMPv6 packet too large message, and when sending the packet again, the packet will be smoothly forwarded to the destination node by the router .

As shown in Figure 2, adopted the IPv6 network that the specific embodiment of the present invention provides to prevent the method for PMTU attack, the IPv6 host computer as source node sends message with initial MTU value, when message forwards through router, router finds that message is larger than sending The MTU value of the interface. When the router sends an ICMPv6 too large message message to the source node IPv6 host, when the message reaches the switch, it is redirected to the switch CPU for processing. The switch judges that the ICMPv6 message is too large. If the port of the connected router receives it, and this port is set as a trusted port, the ICMPv6 message is too large and the message is safely forwarded to the IPv6 host as the source node. The IPv6 host of the source node adjusts the ICMPv6 message according to the message Corresponding MTU value, when the source node sends a packet again, the sent packet will be smoothly forwarded to the destination node by the router.

However, the malicious host node forges the ICMPv6 packet too large message packet and sends it to the IPv6 host of the source node. When the packet reaches the switch, it matches the rule that the ICMPv6 packet is too large message packet is redirected to the switch CPU, and is sent to the switch CPU. After the switch judges that the receiving port is an untrusted port, the ICMPv6 message is discarded and will not be sent to the source node IPv6 host, which ensures that the source node is free from malicious forged ICMPv6 message messages text attack.

FIG. 3 is a schematic structural diagram of a device for preventing PMTU attacks on an IPv6 network provided by a specific embodiment of the present invention. As shown in Figure 3, the device includes a receiving module 301, a port configuration module 302, a processing module 303 and a forwarding module 304, wherein the processing module is connected to the receiving module, the port configuration module and the forwarding module respectively;

The receiving module 301 is configured to receive an ICMPv6 packet too large message;

The port configuration module 302 is configured to configure a trusted port for a switch;

The processing module 303 is used to read the receiving port information of the ICMPv6 message too large message message, and judge whether the receiving port of the ICMPv6 message message message belongs to the trusted port of configuration, and if it belongs to, then the The ICMPv6 message is too large and the message message is sent to the forwarding module; if it does not belong, the ICMPv6 message is too large message message is discarded;

The forwarding module 304 is configured to forward the ICMPv6 too large message sent by the processing module to the destination host of the ICMPv6 too large message.

After the switch enables the function of preventing PMTU attacks on the IPv6 network, the rule of redirecting the ICMPv6 too large message message to the CPU is issued to the switching chip, and when the switching chip receives the ICMPv6 message too large message message , redirect the packet to the CPU, and the CPU performs software parsing and forwarding.

The ICMPv6 packet is too large message packet is redirected to the CPU of the switch, and the software system running on the CPU parses and forwards it. In the software running on the CPU, each message is pointed to by a software structure, which contains a field indicating the receiving port. After the switching chip sends the message to the CPU, the packet receiving driver reads the port number from the register of the chip and writes it into the port field of the software structure of the message. The receiving module running in the software system of the CPU receives the ICMPv6 packet too large message message of the software structure, and sends it to the processing module. The processing module reads the port information of the port field in the software structure, and matches with the trusted port configured by the port configuration module; if it belongs to the trusted port, the ICMPv6 packet is too large message is sent to the forwarding module, The ICMPv6 too large message is forwarded to the destination host by the forwarding module; if it does not belong to the trusted port, the ICMPv6 too large message is directly discarded. In this way, the illegal ICMPv6 packet too large message sent by the malicious host node cannot reach its destination IPv6 host, which ensures the safe use of the ICMPv6 message too large message.

The port configuration module is a trusted port configured by a switch, and is a layer 2 port and/or aggregation port connected to an IPv6 router on the switch.

When configuring the trusted port for the switch, the Layer 2 port and/or aggregation port connected to the IPv6 router on the switch is usually configured as a trusted port, and other unconfigured ports are defaulted as untrusted ports. In this way, fewer ports need to be configured, which is convenient for users to operate and change port configurations.

When the processing module judges that the receiving port of the ICMPv6 message too large message belongs to the trusted port configured by the port module, the forwarding module queries the MAC address table, and forwards the ICMPv6 message too large message from the port connected to the IPv6 host .

When the IPv6 host connected to the switch receives the forwarded ICMPv6 packet too large message, it adjusts the corresponding MTU value according to the ICMPv6 packet too large message, and when sending the packet again, the sent packet will be smoothly forwarded by the router to the destination node.

Adopting the above technical solution of the specific implementation mode of the present invention ensures the safe use of the ICMPv6 oversized message, prevents the forwarding of the malicious ICMPv6 oversized message, and ensures the normal operation of the network.

The above is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person familiar with the technology can easily think of changes or replacements within the technical scope disclosed in the present invention. , should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be determined by the protection scope of the claims.

Claims (6)

1. a kind of method that IPv6 network prevents path maximum transmission unit PMTU to attack, it is characterized in that, may further comprise the steps: A. The switch enables the function of preventing IPv6 network PMTU attacks, and configures trusted ports for the switch; B. Receive the Internet Control Message Protocol Version 6 ICMPv6 message too large message; C. Determine whether the receiving port of the ICMPv6 packet is too large message belongs to the configured trusted port, If it belongs, forward it to the IPv6 host, if it does not belong, then discard the message; where, The ICMPv6 message is too large and the message is redirected to the CPU of the switch. Each message is pointed to by a software structure in the software running on the CPU; after the switch chip sends the message to the CPU, the receiving packet is driven by the register of the chip Read port number in, write in the port field of the software structure of this message; Run the port information in this field in the software reading of CPU, match with the trusted port information configured in step S101; D. The IPv6 host receives the forwarded ICMPv6 packet too large message, and adjusts the maximum transmission unit (MTU) value sent to the destination node. 2. the method that IPv6 network prevents PMTU attack according to claim 1, it is characterized in that, in step A, the trusted port of configuration is the two-layer port and/or aggregation port that connects IPv6 router on the switchboard. 3. according to the method for claim 1 or 2 described IPv6 network prevents PMTU attack, it is characterized in that, in the step C, when the receiving port of ICMPv6 message too big message message belongs to trusted port, query MAC address table, from The port connected to the IPv6 host forwards the ICMPv6 packet too large message. 4. a kind of device that IPv6 network prevents PMTU from attacking, it is characterized in that, comprise receiving module, port configuration module, processing module and forwarding module, wherein processing module is connected with receiving module, port configuration module and forwarding module respectively; The receiving module is configured to receive an ICMPv6 packet too large message; The port configuration module is configured to configure a trusted port for a switch; The processing module is used to read the receiving port information of the ICMPv6 message too large message message, and judge whether the receiving port of the ICMPv6 message message message belongs to the trusted port of configuration, and if it belongs, the The ICMPv6 message is too large and the message is sent to the forwarding module; if it does not belong, the ICMPv6 message is too large; the ICMPv6 message is too large and the message is redirected to the CPU of the switch, running on the CPU In the software, each message is pointed by a software structure. After the switch chip sends the message to the CPU, the receiving driver reads the port number from the register of the chip and writes it into the port field of the software structure of the message. The receiving module that runs in the software system of CPU receives the ICMPv6 message message message of described software structure, sends it to processing module; Described processing module reads the port information of port field in the software structure, and port The trusted port configured by the configuration module is matched; The forwarding module is configured to forward the ICMPv6 too large message sent by the processing module to the destination host of the ICMPv6 too large message. 5. the device that IPv6 network prevents PMTU attack according to claim 4, it is characterized in that, described port configuration module is the trusted port that switch configures, is the two-layer port and/or aggregation port that connects IPv6 router on switch. 6. according to the device of claim 4 or 5 described IPv6 network prevents PMTU attack, it is characterized in that, when the receiving port of described processing module judges that ICMPv6 message is too large message message belongs to trusted port, forwarding module queries MAC address table , forward the ICMPv6 packet too large message from the port connected to the IPv6 host.