On 31/08/15 at 16:33, Andreas Herz wrote: > On 31/08/15 at 14:03, Andreas Herz wrote: > > While playing around with the IPv6 extension headers i found a strange > > behaviour when it comes to the IPv6 fragmentation header. First i used the > > thc-ipv6 toolkit with that i could trigger the issue below in the first place. > > > > [...] > > > > Does anyone have an idea why this happens and where i might need to look for > > this issue? > > Florian Westphal pointed out that it might be conntrack defrag and yes, > on systems without it i see the frag header in iptables. > So if defrag is on i have no chance to filter specific fragmentations i > guess and just hope that the defrag process sorts every messed up stuff > out ;) To be more precise it only defrags valid fragmentation. When i used thc-ipv6 implementation6 test i get: > ip6tables -t raw -I PREROUTING -j LOG -m ipv6header --soft --header frag Test 11: correct fragmentation PASSED - we got a reply Test 12: one-shot fragmentation PASSED - we got a reply => won't match the rule, they are done in conntrack defrag Test 13: overlap-first-zero fragmentation FAILED - no reply Test 14: overlap-last-zero fragmentation FAILED - no reply Test 15: overlap-first-dst fragmentation FAILED - no reply Test 16: overlap-last-dst fragmentation FAILED - no reply => match the rule and they pass the conntrack defrag So is my assumption correct that it would be fine to filter all traffic with header frag set when i use conntrack_defrag_ipv6 at the same time? -- Andreas Herz -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
