Re: [NETFILTER]: ip6_tables: Support MH match.

["Rémi Denis-Courmont" <rdenis@simphalempin.com>]

[-- Attachment #1: Type: text/plain, Size: 1283 bytes --]

	Hello,

Le vendredi 26 janvier 2007 11:53, Yasuyuki KOZAKAI a écrit :
> MH is defined as extention header in RFC3775, but this patch handles
> it as layer 4 protocol header like ICMPv6 header.
>
> The reasons are
> - The reason why it's defined as extentin header is mainly for
>   'piggy back'. But that feature was not specified in RFC3775 after
> all. - No header follow MH. RFC3775 says
> 	Implementations conforming to this specification SHOULD set
> 	the payload protocol type to IPPROTO_NONE (59 decimal).

What happens if a node (including a non-Linux one) receives a MH packet 
with a non-none next protocol? I might be wrong, but I would assume it 
parses it, at least in some cases.

If this is trye, this patch might introduce a trivial way to evade 
firewall rules, as firewall admins will assume the next protocol is 
none, while it might not be.

Of course, I could be plain wrong, since I do not know MH.

> - Many parts in RFCs assume that it's like layer 4 protocol header.
> - Actually Linux IPv6 stack, XFRM, setkey, iproute2... handle it as
> if it's layer4 protocol.

Slightly off-topic, but anyway, what about socket() syscall - can you 
create a IPPROTO_MH raw socket with it?

-- 
Rémi Denis-Courmont
http://www.remlab.net/

[-- Attachment #2: Type: application/pgp-signature, Size: 197 bytes --]