Libnet 1.1 IPv6 fixes and additions
Libnet is a cool packet crafting tool, used by Snort to send TCP reset packets and ICMP unreachable packets as part of active responses. Libnet 1.1 supports IPv6 which is what I needed for my work. After some reading and testing there were a few problems. First, while possible to send TCP reset packets, the packets didn’t have a correct checksum and debugging this with valgrind showed lots of memory errors. Second, ICMPv6 was only partly implemented. The libnet_build_* functions for it are missing. This is, by the way, quite a common picture. Many libraries and projects have some support for IPv6, but generally incomplete and less well tested.
For my work on a IPv6 enabled Snort_inline I’ve only fixed the checksum issue and added a libnet_build_icmpv6_unreach() function. The patch against libnet 1.1.3-RC-01 can be found here. It’s development was funded by the great people of NitroSecurity Inc., who are funding my work to bring IPv6 to Snort_inline. The work is not based on Sourcefire’s recent IPv6 implementation, so it will be interesting to see if and how those codebases can be used to improve each other. The changes to Snort_inline will be made available as well later, WhenItsDone(tm) 
Like with the support for NFQueue, NitroSecurity gives back to the community, which I really appreciate!
The patch: http://www.inliniac.net/files/libnet-1.1.3-RC-01-ipv6.diff.gz
Tags: icmpv6, IPv6, libnet, nitro security, Snort, Snort_inline
October 17th, 2007 at 2:31 am
I would like to second that thank you to Nitro. Without the support of Nitro and more specifically Dave Remien (great guy btw) snort_inline wouldn’t have things like support for NFQUEUE etc..
Thanx again,
Will
January 9th, 2008 at 5:41 pm
[...] unreachable packets you will need the libnet 1.1 patch I wrote a while ago. You can find that here. Get the latest Snort_inline by checking out [...]