Re: [NETFILTER]: ip6_tables: Support MH match.

[Masahide NAKAMURA <nakam@linux-ipv6.org>]

Hi Jozsef,

# FYI, now I've subscribed the netfilter-devel list.

> > >> > > What happens if a node (including a non-Linux one) receives a MH packet
> > >> > > with a non-none next protocol? I might be wrong, but I would assume it
> > >> > > parses it, at least in some cases.
> >
> > The node will send ICMP parameter problem back with code depending on
> > whether the node supports MH or not.
> > If it supports, the code is 0 (erroneous header field) as RFC3775.
> > Otherwise, the code 1 (unrecognized Next Header).
> >
> >
> > >> > > If this is trye, this patch might introduce a trivial way to evade
> > >> > > firewall rules, as firewall admins will assume the next protocol is
> > >> > > none, while it might not be.
> > >> > >
> > >> > > Of course, I could be plain wrong, since I do not know MH.
> >
> > If the sender creates MH with nexthdr=TCP for example,
> > it may go through the firewall which is configured even MH=ACCEPT
> > TCP=DROP. However, the receiver cannot handle it as TCP.
> >
> > Can I add nexthdr check, or should I rewrite it as "-m" module
> > to treat MH as an extension header?
> 
> Personally, I'd prefer a check in the MH match that makes sure there is no 
> more header, simply because we cannot assume that the sender keeps the 
> rules.

Thanks for your comment.
OK, I'll write additional patch to check no more header.



-- 
Masahide NAKAMURA