feat(network.threat.manager): Update ipv6 flooding protection and fragment filtering

[pierantoniomerlino]

Note: We are using the Conventional Commits convention for our pull request titles. Please take a look at the PR title format document for the supported types and scopes.

This PR updates the org.eclipse.kura.network.threat.manager for IPv6 and chagne the way the TCP fragments are filtered.

Description of the solution adopted: The following rules are added for managing the flooding protection for IPv6 (see here):

"-A prerouting-kura -m conntrack --ctstate INVALID -j DROP",
"-A prerouting-kura -p tcp ! --syn -m conntrack --ctstate NEW -j DROP",
"-A prerouting-kura -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP",
"-A prerouting-kura -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP",
"-A prerouting-kura -p tcp --tcp-flags SYN,RST SYN,RST -j DROP",
"-A prerouting-kura -p tcp --tcp-flags FIN,RST FIN,RST -j DROP",
"-A prerouting-kura -p tcp --tcp-flags FIN,ACK FIN -j DROP",
"-A prerouting-kura -p tcp --tcp-flags ACK,URG URG -j DROP",
"-A prerouting-kura -p tcp --tcp-flags ACK,FIN FIN -j DROP",
"-A prerouting-kura -p tcp --tcp-flags ACK,PSH PSH -j DROP",
"-A prerouting-kura -p tcp --tcp-flags ALL ALL -j DROP",
"-A prerouting-kura -p tcp --tcp-flags ALL NONE -j DROP",
"-A prerouting-kura -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP",
"-A prerouting-kura -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j DROP",
"-A prerouting-kura -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP",
"-A prerouting-kura -p ipv6-icmp -m ipv6-icmp --icmpv6-type 128 -j DROP",
"-A prerouting-kura -p ipv6-icmp -m ipv6-icmp --icmpv6-type 129 -j DROP",
"-A prerouting-kura -m ipv6header --header dst --soft -j DROP",
"-A prerouting-kura -m ipv6header --header hop --soft -j DROP",
"-A prerouting-kura -m ipv6header --header route --soft -j DROP",
"-A prerouting-kura -m ipv6header --header frag --soft -j DROP",
"-A prerouting-kura -m ipv6header --header auth --soft -j DROP",
"-A prerouting-kura -m ipv6header --header esp --soft -j DROP",
"-A prerouting-kura -m ipv6header --header none --soft -j DROP",
"-A prerouting-kura -m rt --rt-type 0 -j DROP", "-A output-kura -m rt --rt-type 0 -j DROP"

Moreover, to properly filter the TCP fragments, the /proc/sys/net/ipv4/ipfrag_low_thresh, /proc/sys/net/ipv4/ipfrag_high_thresh, /proc/sys/net/netfilter/nf_conntrack_frag6_low_thresh and /proc/sys/net/netfilter/nf_conntrack_frag6_high_thresh are configured. See here, here and here for more details about fragment filtering.

[marcellorinaldo]

I think that the minimum version in org.eclipse.kura.security;version="[1.1,2.0)", should be changed to [1.2,2.0) to ensure that the imported package has the latest introduced methods getFloodingProtectionFilterRulesIPv6, getFloodingProtectionNatRulesIPv6, and getFloodingProtectionMangleRulesIPv6 which are implemented here.