Re: pf IPv6 hop-by-hop after fragment header

2016-11-18 Thread Alexander Bluhm
On Fri, Nov 18, 2016 at 09:43:43AM +0100, Alexandr Nedvedicky wrote: > Side Note: I did quick check to RFCs. It seems to me there is a 'bug' in > specification. RFC 2460 says: > >When more than one extension header is used in the same packet, it is >recommended that those h

Re: pf IPv6 hop-by-hop after fragment header

2016-11-18 Thread Alexandr Nedvedicky
Hello, > I found the link http://www.secfu.net/ in one of sthen@'s mails. > There the author mentions that we accept IPv6 hop-by-hop headers > after fragment headers. In fact this is a result of my pf fragment > reassembly, so add an extra check there. > > ok? I'm O.K. with it. Side No

pf IPv6 hop-by-hop after fragment header

2016-11-16 Thread Alexander Bluhm
Hi, I found the link http://www.secfu.net/ in one of sthen@'s mails. There the author mentions that we accept IPv6 hop-by-hop headers after fragment headers. In fact this is a result of my pf fragment reassembly, so add an extra check there. ok? bluhm Index: net/pf.c ==