On 2/25/19 7:17 PM, Hangbin Liu wrote: > I also thought about this issue. Currently we didn't check the ipproto in both > IPv4 and IPv6. You can set icmp in ip6 rules or icmpv6 in ipv4 rules. > This looks don't make any serious problem. It's just a user mis-configuration, > the kernel check the proto number and won't match normal IP/IPv6 headers. > > But yes, we should make it more strict, do you think if I should add a new > rtm_getroute_parse_ip6_proto() function, or just add a family parameter > in previous function?
I see now. rtm_getroute_parse_ip_proto is used for ipv4 and ipv6. For v4 IPPROTO_ICMPV6 should not be allowed and for v6 IPPROTO_ICMP should fail. You could a version argument to rtm_getroute_parse_ip_proto and fail as needed.
