Re: [PATCH net-next 0/2] netfilter: IPv4/v6 IPcomp match support

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

On Fri, Dec 20, 2013 at 05:21:05PM +0800, Fan Du wrote:
[...]
> >AH is not the last header, so we still have to use ipv6_find_hdr() to
> >find the good header instead of par->thoff. Note that the ip6_tables
> >sets par->thoff to the last IPv6 extension header.
> 
> I'm quite new to the internal of netfiler, especially about this part.
> I will take a look at the code later.
> 
> >This rises some concerns regarding your ipcomp, I think that if you
> >use this with ah and esp, the ordering of the headers is
> >ah+ipcomp+esp, right?
> 
> This depends on the user land configuration of encapsulation order.
> It can be one of the three types only(ah, esp, ipcomp), the most commonly
> used is ah(outer)+esp(inner).
> 
> I barely see ipcomp used in production, but I remember RFC says ipcomp
> should be done first before esp, because after encryption in esp, the data
> is polluted, i.e., not suitable for compressed anymore(I'm not sure the
> details theory behind this statement.)

In that case we have to use ipv6_find_hdr(..., IPPROTO_IPCOMP, ...),
since par->thoff will point to the last header which is esp. After
this change, the ipcomp ipv6 match will look very similar to what you
have in ah_mt6(...) in net/ipv6/netfilter/ip6t_ah.c. Please, rework
that in your ipcomp match patch and resend. Thanks.