[DragonFlyBSD - Bug #3342] [PF] urpf-failed doesn't work with IPv6

[sigttou]

Issue #3342 has been updated by sigttou.


Current-master tests pass the link-local/uRPF checks and routed IPv6 traffic.
This supports closing the uRPF-specific part of this issue, not every IPv6 issue
or the original provider environment.

Large pings exposed two separate PF problems:

* PF does not reassemble IPv6 fragments. It filters them as protocol 44, so
  ICMPv6 type and TCP/UDP port rules cannot match the inner protocol. A broad
  pass rule does not enforce those restrictions.
* The fragment length check mixes ip6_plen, which excludes the IPv6 header,
  with an offset that includes it. This rejects some short fragments and
  accepts some oversized ones. A proposed pf_normalize_ip6() patch corrects
  the length, bounds and non-final alignment checks. #3437 

Can we close the uRPF-specific part and track IPv6 reassembly separately?


----------------------------------------
Bug #3342: [PF] urpf-failed doesn't work with IPv6
http://bugs.dragonflybsd.org/issues/3342#change-14772

* Author: liweitianux
* Status: In Progress
* Priority: Normal
* Category: PF
* Target version: 6.6
* Start date: 2023-02-06
----------------------------------------
Years ago, i found @urpf-failed@ doesn't work with IPv6; significant packet loss if configured.

Many PF tutorials suggest a rule like:

<pre>
block in quick from { $broken urpf-failed no-route } to any
</pre>

But it turned out @urpf-failed@ can only be configured for IPv4, like:

<pre>
block in log quick inet from urpf-failed to any
</pre>

See: https://lists.dragonflybsd.org/pipermail/users/2017-August/313577.html



-- 
You have received this notification because you have either subscribed to it, or are involved in it.
To change your notification preferences, please click here: http://bugs.dragonflybsd.org/my/account