From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Fan Du <fan.du@windriver.com>
Cc: steffen.klassert@secunet.com, kaber@trash.net,
netdev@vger.kernel.org, netfilter-devel@vger.kernel.org
Subject: Re: [PATCH net-next] netfilter: add IPComp extension match support
Date: Sun, 8 Dec 2013 00:55:39 +0100 [thread overview]
Message-ID: <20131207235539.GA6693@localhost> (raw)
In-Reply-To: <52A19F39.3030702@windriver.com>
On Fri, Dec 06, 2013 at 05:56:09PM +0800, Fan Du wrote:
>
>
> On 2013年12月06日 02:34, Pablo Neira Ayuso wrote:
> >Hi,
> >
> >On Thu, Nov 28, 2013 at 10:53:24AM +0800, Fan Du wrote:
> >>With this plugin, user could specify IPComp tagged with certain
> >>CPI that host not interested will be DROPped or any other action.
> >>
> >>For example:
> >>iptables -A INPUT -p 108 -m ipcomp --ipcompspi 0x87 -j DROP
> >>
> >>Then input IPComp packet with CPI equates 0x87 will not reach
> >>upper layer anymore.
> >
> >I think that, with a little bit more work, you can add support for
> >IPv6 as well. From RFC 3173:
> >
> >"In the IPv6 context, IPComp is viewed as an end-to-end payload, and
> >MUST NOT apply to hop-by-hop, routing, and fragmentation extension
> >headers.
> >
> >You can perform that IPv6-specific handling to skip these extension
> >headers and reach the IPComp header by means of the ipv6_find_hdr()
> >helper function.
I just noted that you always have to use -p 108 to get this match
working, in that case the ip6_tables already sets par->thoff that you
can use to reach the transport header, so you can skip calling
ipv6_find_hdr(). So adding IPv6 support is even easier to make.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
prev parent reply other threads:[~2013-12-07 23:55 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-11-28 2:53 [PATCH net-next] netfilter: add IPComp extension match support Fan Du
2013-12-05 18:34 ` Pablo Neira Ayuso
2013-12-06 9:56 ` Fan Du
2013-12-07 23:55 ` Pablo Neira Ayuso [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20131207235539.GA6693@localhost \
--to=pablo@netfilter.org \
--cc=fan.du@windriver.com \
--cc=kaber@trash.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=steffen.klassert@secunet.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).