Subject: latest ipfilter, IPv6 handling
To: None <darrenr@netbsd.org>
From: Jun-ichiro itojun Hagino <itojun@iijlab.net>
List: tech-net
Date: 03/27/2001 00:40:08
i have a couple of questions regarding to IPv6 processing in latest
ipfilter (3.4.16). could you clarify? i hope to supply with some
patches if necessary.
itojun
fil.c:fr_makefrip()
the initialization of variable "plen" is not consistent across IPv4 and
IPv6. for IPv4, it is the total packet length. for IPv6,
it is set to payload length (except IPv6 header).
ip6->ip6_plen can be 0 if the packet is IPv6 jumbogram, you will
want to do something about it.
fil.c:fr_check()
the initialization of variable "len" is not consistent across IPv4 and
IPv6. for IPv4, it is the total packet length. for IPv6,
it is set to payload length (except IPv6 header).
ip6->ip6_plen can be 0 if the packet is IPv6 jumbogram, you will
want to do something about it.
if both __sgi and USE_INET6 are true, hbuf is too short.
please do "(v == 4 && p == IPPROTO_ICMP)", as there will be no ICMPv4
traffic over IPv6.
> if ((p == IPPROTO_TCP || p == IPPROTO_UDP || p == IPPROTO_ICMP
># ifdef USE_INET6
> || (v == 6 && p == IPPROTO_ICMPV6)
># endif
> )) {
fil.c:fr_ifpaddr()
on KAME platforms, may need to take care of embedded scope identifiers.
in sin6.sin6_addr.s6_addr16[1].
ip_fil.c:send_ip()
why ip6_hlim is set to 127?
ip_fil.c:send_reset()
packet size may possibly overrun mbuf, on certain operating systems
(like MSIZE == 128 and sizeof(void *) == 8).