I'm a 20 years old french student in Network and Telecommunication interested by FreeBSD, security and open source in general. I use BSD systems for both server and workstation for about two years. For more informations about me or this project, feel free to contact me at MailTo(clem1@FreeBSD.org).

During this summer, I'll will work around IPv6 and its security. My submitted proposal can be reached [http://clem1.be/soc-ipv6 here]. My mentor is GeorgeNevilleNeil.

Briefly, this project would be split in two parts:

• build a powerful ipv6 compliant library.
• ipv6 stack vulnerabilities reviewing, code auditing, ipv6 stacks testing…

Libnet is a powerful C library for packet manipulation, it makes developper life easier, it's well documented with great example programs but it suffers of a poor ipv6 support.

The idea is to improve this support in adding more ipv6 APIs like extension headers manipulation, neighbor discovery… to be able to do the second part.

In parallel, I will also improve a python library for packet manipulation wrote by my mentor and begin some code auditing around the FreeBSD Kame ipv6 stack. This python library will be useful to do quick test.

In this very interesting part, I will :

• review last years worth ipv6 stack vulnerabilities.
• review last years ipv4 vulnerabilities in order to see if they were not present in ipv6 stacks.
  • Do you remember the windows ipv6 land attack ?
• port thc-ipv6-attacking-tools to libnet.
• create new ipv6-stressing-tools including icmpv6, ipv6 eh, dhcpv6 protcol fuzzers in order to find new ipv6 stack vulnerabilities/bugs.
• code a local ipv6 related syscall / libc-call fuzzer to find new local bugs or vulnerabilities.
• explore ipv6-stack changelogs to see if vulnerabilities were not “silently” patched.
• code an ipv6 stack fingerprinter.

At the end of this part, a report will be released.

• libnet code familiarisation and first improvement.
• python bpf wrapper in C.
• code auditing: userland ipv6 related tools.
• setsockopt() local fuzzer.
• ipv6 header fuzzer.

• pcs icmp6 support improvement with examples (ping6, neighbor cache poisoning).
• partial icmp6 support in libnet.
• futo - a command line parameters fuzzer.
• bugs found in KAME ping6.
• http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2006-016.txt.asc NetBSD-SA2006-016 vulnerability review.