On Apr 3, 7:49am, 6b...@6bone.informatik.uni-leipzig.de (6b...@6bone.informatik.uni-leipzig.de) wrote: -- Subject: Re: npf bug(?)
| On Sun, 2 Apr 2017, Christos Zoulas wrote: | | > | > I am trying to understand the use case here: | > 1. you want to have V4 DNS and 6to4 service that can generate V4 fragments | > 2. you want V4 fragments dropped. | > 3. you can't put V4 rules in your firewall to restrict traffic to only | > those services. | > | > Is that correct? | | That is not completely right. I want to filter IPv6 with npf. IPv4 should | not be filtered. After the activation of npf the statistics shows: | | Fragmentation: | 1296 fragments | 1104 reassembled | 7160 failed reassembly | | Since IPv6 is no longer reassambling, it must be IPv4 packets. I want to | make sure that the reassembly errors do not lead to packet losses, | especially at 6to4. Here's a rough patch that kills v4 processing. christos Index: npf.h =================================================================== RCS file: /cvsroot/src/sys/net/npf/npf.h,v retrieving revision 1.54 diff -u -u -r1.54 npf.h --- npf.h 29 Jan 2017 00:15:54 -0000 1.54 +++ npf.h 3 Apr 2017 15:08:08 -0000 @@ -142,6 +142,7 @@ #define NPC_ICMP_ID 0x80 /* ICMP with query ID. */ #define NPC_ALG_EXEC 0x100 /* ALG execution. */ +#define NPC_IGNORE 0x200 /* Don't process */ #define NPC_IP46 (NPC_IP4|NPC_IP6) Index: npf_handler.c =================================================================== RCS file: /cvsroot/src/sys/net/npf/npf_handler.c,v retrieving revision 1.37 diff -u -u -r1.37 npf_handler.c --- npf_handler.c 19 Feb 2017 20:27:22 -0000 1.37 +++ npf_handler.c 3 Apr 2017 15:08:08 -0000 @@ -156,6 +156,10 @@ /* Cache everything. Determine whether it is an IP fragment. */ flags = npf_cache_all(&npc); + + if (__predict_false(flags & NPC_IGNORE)) + return 0; + if (__predict_false(flags & NPC_IPFRAG)) { /* * We pass IPv6 fragments unconditionally Index: npf_inet.c =================================================================== RCS file: /cvsroot/src/sys/net/npf/npf_inet.c,v retrieving revision 1.37 diff -u -u -r1.37 npf_inet.c --- npf_inet.c 19 Feb 2017 20:27:22 -0000 1.37 +++ npf_inet.c 3 Apr 2017 15:08:08 -0000 @@ -324,6 +324,7 @@ switch (ver >> 4) { case IPVERSION: { +#if 0 struct ip *ip; ip = nbuf_ensure_contig(nbuf, sizeof(struct ip)); @@ -349,6 +350,9 @@ npc->npc_ip.v4 = ip; flags |= NPC_IP4; +#else + flags |= NPC_IGNORE; +#endif break; }