Hi David, On Mon, Feb 25, 2019 at 07:23:33PM -0700, David Ahern wrote: > On 2/25/19 7:17 PM, Hangbin Liu wrote: > > I also thought about this issue. Currently we didn't check the ipproto in > > both > > IPv4 and IPv6. You can set icmp in ip6 rules or icmpv6 in ipv4 rules. > > This looks don't make any serious problem. It's just a user > > mis-configuration, > > the kernel check the proto number and won't match normal IP/IPv6 headers. > > > > But yes, we should make it more strict, do you think if I should add a new > > rtm_getroute_parse_ip6_proto() function, or just add a family parameter > > in previous function? > > I see now. rtm_getroute_parse_ip_proto is used for ipv4 and ipv6. For v4 > IPPROTO_ICMPV6 should not be allowed and for v6 IPPROTO_ICMP should > fail. You could a version argument to rtm_getroute_parse_ip_proto and > fail as needed.
Sorry I didn't get here. Do you mean add an IPv6 version of rtm_getroute_parse_ip_proto? Thanks Hangbin
