Hi Pablo, On Thu, Jan 8, 2015, at 21:53, Pablo Neira Ayuso wrote: > I'm afraid we cannot just get rid of that !ipv6_ext_hdr() check. The > ipv6_find_hdr() function is designed to return the transport protocol. > After the proposed change, it will return extension header numbers. > This will break existing ip6tables rulesets since the `-p' option > relies on this function to match the transport protocol. > > Note that the AH header is skipped (see code a bit below this > problematic fragmentation handling) so the follow up header after the > AH header is returned as the transport header. > > We can probably return the AH protocol number for non-1st fragments. > However, that would be something new to ip6tables since nobody has > ever seen packet matching `-p ah' rules. Thus, we restore control to > the user to allow this, but we would accept all kind of fragmented AH > traffic through the firewall since we cannot know what transport > protocol contains from non-1st fragments (unless I'm missing anything, > I need to have a closer look at this again tomorrow with fresher > mind). The code in question is guarded by (_frag_off != 0), so we are definitely processing a non-1st fragment currently. The -p match would happen at the time when the packet is reassembled and thus ipv6_find_hdr will find the real transport (final) header at this point (I hope I followed the code correctly here). The next proto field of the fragmentation header is copied from the first fragment, thus it may specify AH header but actually only in the original (unfragmented) packet an AH header is directly following the fragmentation header, thus the next proto chain is somewhat unstable if looking at the fragmented packets only. Bye, Hannes -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
