IPv6 reassembly in the FORWARD HOOK in Netfilter

IPv6 reassembly in the FORWARD HOOK in Netfilter

[Pierre Rondou]

Hello,

I'm a student at the University of Liege currently developing a NAT64 
(see RFC 6146) module for Netfilter.

In order to make it compliant to the RFC specifications, the module 
needs to perform some sort of reassembly (in fact, accept out-of-order 
fragments arrival).
RFC says that the IPv6-IPv4 gateway can forward fragments as they 
arrive, but in the case the first fragment of a packet does not arrive 
first at the gateway, there will be a problem because it won't know how 
to translate the packet (don't know which IPv4 address to use).

So, the gateway needs to handle out of order fragments and maintain 
state for the following fragments.

Rather than creating many structures for that goal, I would have loved 
to use the kernel reassembly module, but it is limited to the INPUT hook.

Where this limitations may be understandable for router purpose (even 
though router admin could just kill it if they don't want it), it is a 
problem for the NAT64 module as the gateway has the reassemble 
fragmented paquet which are not destinated to it.

Is there a way to remove that specific limitation?

Regards,

Pierre Rondou