Hello,
I have a question about how the ipfw2 implementation performs stateful
operation for (IPv4/IPv6) fragmented packets. Is it possible to make
a state for a flow and match that state against fragmented packets?
As far as I can see from the source code (sys/netinet/ip_fw2.c) it
seems impossible because a state matching done in
lookup_dyn_rule_locked() only compares src/dst address/ports.
I'm also not sure whether the routine that follows IPv6 extension headers
in ipfw_chk() is correct. It continues the processing after seeing a
fragment header regardless of the offset value, but it should be
meaningless except the first fragment (which has 0 offset).
If I miss something, could anyone point it out?
Thanks,
JINMEI, Tatuya
Communication Platform Lab.
Corporate R&D Center, Toshiba Corp.
[EMAIL PROTECTED]
_______________________________________________
freebsd-net@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
