Re: [NETFILTER]: ip6_tables: Support MH match.

[Masahide NAKAMURA <nakam@linux-ipv6.org>]

Hi,

> > > >> > > What happens if a node (including a non-Linux one) receives a MH packet
> > > >> > > with a non-none next protocol? I might be wrong, but I would assume it
> > > >> > > parses it, at least in some cases.
> > >
> > > The node will send ICMP parameter problem back with code depending on
> > > whether the node supports MH or not.
> > > If it supports, the code is 0 (erroneous header field) as RFC3775.
> > > Otherwise, the code 1 (unrecognized Next Header).
> > >
> > >
> > > >> > > If this is trye, this patch might introduce a trivial way to evade
> > > >> > > firewall rules, as firewall admins will assume the next protocol is
> > > >> > > none, while it might not be.
> > > >> > >
> > > >> > > Of course, I could be plain wrong, since I do not know MH.
> > >
> > > If the sender creates MH with nexthdr=TCP for example,
> > > it may go through the firewall which is configured even MH=ACCEPT
> > > TCP=DROP. However, the receiver cannot handle it as TCP.
> > >
> > > Can I add nexthdr check, or should I rewrite it as "-m" module
> > > to treat MH as an extension header?
> > 
> > Personally, I'd prefer a check in the MH match that makes sure there is no 
> > more header, simply because we cannot assume that the sender keeps the 
> > rules.
> 
> Thanks for your comment.
> OK, I'll write additional patch to check no more header.
> 

Please find my patch (can be applied for net-2.6 tree) below.

Thanks,

-- 
Masahide NAKAMURA


From 457af7826fc1f3ae7e0c7b554b61a002e702a4cb Mon Sep 17 00:00:00 2001
From: Masahide NAKAMURA <nakam@linux-ipv6.org>
Date: Sat, 10 Feb 2007 14:46:05 +0900
Subject: [PATCH] [NETFILTER]: ip6_tables: Drop piggyback payload packet on MH.

Regarding RFC3775, MH payload proto field should be IPPROTO_NONE. Otherwise
it must be discarded (and the receiver should send ICMP error).

We assume filter should drop such piggyback everytime to disallow slipping through
firewall rules, even the final receiver will discard it.

Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
---
 net/ipv6/netfilter/ip6t_mh.c |    7 +++++++
 1 files changed, 7 insertions(+), 0 deletions(-)

diff --git a/net/ipv6/netfilter/ip6t_mh.c b/net/ipv6/netfilter/ip6t_mh.c
index 2c7efc6..c2a9098 100644
--- a/net/ipv6/netfilter/ip6t_mh.c
+++ b/net/ipv6/netfilter/ip6t_mh.c
@@ -66,6 +66,13 @@ match(const struct sk_buff *skb,
 		return 0;
 	}
 
+	if (mh->ip6mh_proto != IPPROTO_NONE) {
+		duprintf("Dropping invalid MH Payload Proto: %u\n",
+			 mh->ip6mh_proto);
+		*hotdrop = 1;
+		return 0;
+	}
+
 	return type_match(mhinfo->types[0], mhinfo->types[1], mh->ip6mh_type,
 			  !!(mhinfo->invflags & IP6T_MH_INV_TYPE));
 }
-- 
1.4.2