ip6tables settings to block the ipv6 fragmentation - linux

Question

Is it possible to write ip6tables rules to block ipv6 fragmented packets which are malformed.
This is basically for the ipv6 certification of our appliance box. We are running at: rhel 5.5 and kernel : 2.6.18-238.1.1.el5
The tests we are failing currently are:
1) Fragment Reassembly -- Fragment ID mismatch should give error 2) Fragment Reassembly -- Source Addresses Differ Between Fragments 3) Fragment Reassembly -- Destination Address Differ Between Fragments
Any other ideas to solve this is also welcome :)

Answer 1

We can solve this via tools like snort. Below are the steps to install, configure and run in RHEL 5.5
INSTALL PREREQUISITES
For the SNORT we need to install the following:
flex byacc bison pcre-devel libdnet-devel zlib-devel
We can download the above from:
ftp://ftp.univie.ac.at/systems/linux/dag/redhat/el5/en/x86_64/buildtools/RPMS/flex-2.5.35-0.8.el5.rfb.x86_64.rpm
ftp://fr2.rpmfind.net/linux/centos/5.10/os/x86_64/CentOS/byacc-1.9-29.2.2.x86_64.rpm
http://vault.centos.org/5.5/os/x86_64/CentOS/zlib-devel-1.2.3-3.x86_64.rpm
http://vault.centos.org/5.5/os/x86_64/CentOS/bison-2.3-2.1.x86_64.rpm
http://vault.centos.org/5.5/os/x86_64/CentOS/pcre-devel-6.6-2.el5_1.7.x86_64.rpm
ftp://ftp.univie.ac.at/systems/linux/dag/redhat/el5/en/x86_64/dag/RPMS/libdnet-1.11-1.2.el5.rf.x86_64.rpm
http://apt.sw.be/redhat/el5/en/x86_64/rpmforge/RPMS/libdnet-devel-1.11-1.2.el5.rf.x86_64.rpm
* Install the above said rpm in the below order:
rpm -ivh flex-2.5.35-0.8.el5.rfb.x86_64.rpm
rpm -ivh byacc-1.9-29.2.2.x86_64.rpm
rpm -ivh zlib-devel-1.2.3-3.x86_64.rpm
rpm -ivh bison-2.3-2.1.x86_64.rpm
rpm -ivh pcre-devel-6.6-2.el5_1.7.x86_64.rpm
rpm -ivh libdnet-1.11-1.2.el5.rf.x86_64.rpm
rpm -ivh libdnet-devel-1.11-1.2.el5.rf.x86_64.rpm
DOWNLOAD THE REQUIRED SNORT & ALLIED LIBRARIES
http://www.tcpdump.org/release/libpcap-1.5.3.tar.gz
http://sourceforge.net/projects/snort.mirror/files/Snort%202.9.5.6/snort-2.9.5.6.tar.gz/download
http://sourceforge.net/projects/snort.mirror/files/Snort%202.9.5.6/daq-2.0.1.tar.gz/download
[ NOTE: The following assumes the above 3 are downloaded to the /opt/CSCOlumos/SNORT ]
INSTALL LIBPCAP
cd /opt/CSCOlumos/SNORT
tar -xf libpcap-1.5.3.tar.gz
mv libpcap-1.5.3 /usr/local/src/
cd /usr/local/src/libpcap-1.5.3
./configure --prefix=/usr
make
make install
/sbin/ldconfig
INSTALL DAQ AND SNORT
cd /opt/CSCOlumos/SNORT
tar -xf daq-2.0.1.tar.gz
cd daq-2.0.1
./configure
cd os-daq-modules
make
cd ..
make
make install
cd /opt/CSCOlumos/SNORT
tar -xf snort-2.9.5.6.tar.gz
cd snort-2.9.5.6
./configure
make
make install
FIXING THE libdnet LIBRARY ISSUES
cp -rp /usr/lib/vmware-tools/lib32/libdnet.so.1 /usr/local/lib/
/sbin/ldconfig
updated
mkdir -p /var/log/snort/
touch /var/log/snort/alert
TEST THE SNORT
snort --version
,,_ -> Snort! <-
o" )~ Version 2.9.5.6 GRE (Build 208)
'''' By Martin Roesch & The Snort Team: http://www.snort.org/snort/snort-team
Copyright (C) 1998-2013 Sourcefire, Inc., et al.
Using libpcap version 1.5.3
Using PCRE version: 6.6 06-Feb-2006
Using ZLIB version: 1.2.3
CONFIGURING THE IPV6 FILTER AND RUNNING
vi /opt/test/SNORT/SNORT.conf
preprocessor frag3_global: max_frags 65536
preprocessor frag3_engine: policy linux
bind_to 2001::99ed:d7c6:86f0:8e0a
detect_anomalies
preprocessor frag3_engine: policy linux detect_anomalies
Now run as:
snort -c /opt/test/SNORT/SNORT.conf
NOTE: here the 2001::99ed:d7c6:86f0:8e0a is the eth0 (communication interface) ipv6 address.