2.9 - networking broken on RHEL7.3 due to getaddrinfo/ipv6 changes

[dwendt]

Upgrading an RHEL environment to 2.9, this definition breaks getaddrinfo.

ossec-hids/src/os_net/os_net.h

Line 22 in ef46a72

#define AI_V4MAPPED 0x0800

It makes the addrinfo struct on line 52 have some options that make getaddrinfo fail. When the macro is undefined, it uses the other options which work perfectly fine. Not sure what those options are for (ipv6?) to begin with or I'd provide a patch suggestion....

Red Hat Enterprise Linux Server release 7.3 (Maipo)
Linux xxxxxxxxxxx 3.10.0-514.16.1.el7.x86_64 #1 SMP Wed Apr 12 10:03:19 PDT 2017 x86_64 x86_64 x86_64 GNU/Linux

This is an ipv4 server, to be clear. <remote> only contains <connection>secure</connection>.

[mkvocka]

I had a similar issue with RHEL 6 that had no IPV6 support - getaddrinfo did not work. In src/os_net/os_net.c I used hints.ai_family = AF_INET instead of AF_INET6 or AF_UNSPEC to get it working.

[ddpbsd]

Did you remove/disable ipv6 support?

[mkvocka]

If the question was to me - yes I did. OSSEC syscheckd is commonly used in environments where PCI DSS compliance must be met. PCI DSS also requires disabling unused services, IPv6 in this case.

[dwendt]

@ddpbsd welp, yep, ipv6 was disabled.

# sysctl -p
net.ipv6.conf.all.disable_ipv6 = 1

what would a good fix for this look like? if getaddrinfo fails for AF_INET6, attempt again with AF_INET?

[ddpbsd]

Does PCI DSS actually define IPv6 as a service? That's crazy.
If anyone has a suggestion on how to change things so that these niche systems can be better supported without hampering modern systems, I'm all ears.

[aquerubin]

Not specifically but it does say disable unused services. Security admins have been interpreting that to mean disable IPv6 if it hasn't been deployed. DSS also mandates the use of NAT. That's a non-starter if IPv6 is in use. The DSS has not really kept up with the times. I've been wondering that if instead of breaking the network stack by disabling IPv6 completely, just disable it on individual physical interfaces only. That reduces the attack surface until IPv6 is actually deployed. I've not had a chance to test how well this would work in practice. Tony

…

On Jul 15, 2017, at 09:49, Dan Parriott ***@***.***> wrote: Does PCI DSS actually define IPv6 as a service? That's crazy. If anyone has a suggestion on how to change things so that these niche systems can be better supported without hampering modern systems, I'm all ears. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or mute the thread.

[ddpbsd]

And that would make more sense to me, as well as possibly blocking IPv6 at the host's firewall.

I'm sure it's a complex debate, but from my perspective, general purpose software that doesn't run properly on a system without IPv6 support is broken. Especially if it ran fine previously.

I'm in a similar situation as above; though not PCI DSS, some of my environments are nonetheless required to disable IPv6. Blocking it at the host firewall or not configuring it at an interface level isn't good enough. The requirements are written with the specific and deliberate intent to disable IPv6 entirely, using any and all reasonably standard methods, to minimize vulnerability surface area and avoid accidental exposure due to improperly implemented partial solutions.

Taking RHEL6 as an example, that means:

• preventing the kernel module from loading at boot
• preventing the kernel module from even being able to be loaded at all
• setting the net.ipv6.conf.all.disable_ipv6 and net.ipv6.conf.default.disable_ipv6 kernel parameters to 1
• removing IPv6 entries from the hosts file
• disabling the ip6tables service
• explicitly setting AddressFamily inet in sshd_config

We are required to run frequent audits for all of those. Whether or not such requirements actually make sense is, unfortunately, irrelevant. We're still stuck with them.

It sure would be nice if I didn't have to maintain yet another package because of a patch that changes literally one line of code. :)

[ddpbsd]

And I personally think any system that can't handle a minimal IPv6ness is broken. But whatever, we'll look at removing ipv6 support in 3.1.

[ddpbsd]

I guess we could do something like:

diff --git a/src/os_net/os_net.c b/src/os_net/os_net.c
index 4f5682f8..79619e04 100644
--- a/src/os_net/os_net.c
+++ b/src/os_net/os_net.c
@@ -49,7 +49,11 @@ int OS_Bindport(char *_port, unsigned int _proto, const char *_ip)

     memset(&hints, 0, sizeof(struct addrinfo));
 #ifdef AI_V4MAPPED
+#ifdef LEGACY_V4
+    hints.ai_family = AF_INET
+#else
     hints.ai_family = AF_INET6;    /* Allow IPv4 and IPv6 */
+#endif
     hints.ai_flags = AI_PASSIVE | AI_ADDRCONFIG | AI_V4MAPPED;
 #else
     /* Certain *BSD OS (eg. OpenBSD) do not allow binding to a

Then allow a user to set LEGACY_V4. Thoughts?

[dwendt]

ossec should be functional on both systems without needing a recompile, why not attempt both and take the first successful one (this is the same behavior it currently implements with socket+bind, seen right after getaddrinfo)

[ddpbsd]

Like this?

diff --git src/os_net/os_net.c src/os_net/os_net.c
index 4f5682f8..7137581d 100644
--- src/os_net/os_net.c
+++ src/os_net/os_net.c
@@ -68,6 +68,10 @@ int OS_Bindport(char *_port, unsigned int _proto, const char *_ip)
     }

     s = getaddrinfo(_ip, _port, &hints, &result);
+    if(s == EAI_FAMILY) {
+        hints.ai_family = AF_INET;
+        s = getaddrinfo(_ip, _port, &hints, &result);
+    }
     if (s != 0) {
         verbose("getaddrinfo: %s", gai_strerror(s));
         return(OS_INVALID);

[aquerubin]

On Wed, 20 Sep 2017, Ditmar Wendt wrote: ossec should be functional on both systems without needing a recompile, why not attempt both and take the first successful one (this is the same behavior it currently implements with socket+bind, seen right after getaddrinfo)

Happy Eyeballs approach might be worth implementing. Will try to find some spare cycles.

…

-- Antonio Querubin e-mail: tony@lavanauts.org xmpp: antonioquerubin@gmail.com

[aquerubin]

On Wed, 20 Sep 2017, Dan Parriott wrote: Like this? ``` diff --git src/os_net/os_net.c src/os_net/os_net.c index 4f5682f8..7137581d 100644 --- src/os_net/os_net.c +++ src/os_net/os_net.c @@ -68,6 +68,10 @@ int OS_Bindport(char *_port, unsigned int _proto, const char *_ip) } s = getaddrinfo(_ip, _port, &hints, &result); + if(s == EAI_FAMILY) { + hints.ai_family = AF_INET; + s = getaddrinfo(_ip, _port, &hints, &result); + } if (s != 0) { verbose("getaddrinfo: %s", gai_strerror(s)); return(OS_INVALID); ```

That should work too.

…

-- Antonio Querubin e-mail: tony@lavanauts.org xmpp: antonioquerubin@gmail.com