Received: with ECARTIS (v1.0.0; list netdev); Sun, 02 Jan 2005 04:07:47 -0800 (PST) Received: from smtp2.aerasec.de (gromit.aerasec.de [195.226.187.57]) by oss.sgi.com (8.13.0/8.13.0) with ESMTP id j02C7FRF014929 for ; Sun, 2 Jan 2005 04:07:35 -0800 Received: from localhost (localhost [127.0.0.1]) by smtp2.aerasec.de (Postfix) with SMTP id CD4AA137F1; Sun, 2 Jan 2005 13:15:48 +0100 (CET) X-AV-Checked: Sun Jan 2 13:15:48 2005 smtp2.aerasec.de Received: from [192.168.1.2] (pD9E4EFC7.dip.t-dialin.net [217.228.239.199]) (using TLSv1 with cipher EDH-RSA-DES-CBC3-SHA (168/168 bits)) (Client did not present a certificate) by smtp2.aerasec.de (Postfix) with ESMTP id D52BA137EA; Sun, 2 Jan 2005 13:15:45 +0100 (CET) Date: Sun, 02 Jan 2005 13:15:42 +0100 From: Peter Bieringer To: Patrick McHardy Cc: USAGI core , Maillist netdev , Harald Welte , Netfilter development mailing list Subject: Re: ip6tables: accept of IPv6 transport esp packages not possible - no rule matches Message-ID: In-Reply-To: <41D7DE3E.2090304@trash.net> References: <019064D0423CE6C823CBF476@t1mobil.muc.aerasec.de> <5F6ACA5CEF52DBFBF11FBF94@t1mobil.muc.aerasec.de> <41CD8B4F.6010402@trash.net> <85346B5DA83795C08812E782@worker.muc.bieringer.de> <41D7DE3E.2090304@trash.net> X-Mailer: Mulberry/3.1.6 (Linux/x86) X-URL: http://www.bieringer.de/pb/ X-OS: Linux MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Content-Disposition: inline X-Virus-Scanned: ClamAV 0.80/645/Mon Dec 27 14:56:20 2004 clamav-milter version 0.80j on 127.0.0.1 X-Virus-Status: Clean X-archive-position: 13334 X-ecartis-version: Ecartis v1.0.0 Sender: netdev-bounce@oss.sgi.com Errors-to: netdev-bounce@oss.sgi.com X-original-sender: pb@bieringer.de Precedence: bulk X-list: netdev --On Sunday, January 02, 2005 12:42:54 PM +0100 Patrick McHardy wrote: >> But I wonder a little bit because of the result of the OUTPUT chain: >> >> 0 0 ACCEPT icmpv6 * * ::/0 ::/0 >> ipv6-icmp type 129 >> 1 104 ACCEPT icmpv6 * * ::/0 ::/0 >> ipv6-icmp type 128 >> 0 0 ACCEPT esp * * local/128 remote/128 >> 0 0 ACCEPT all * * local/128 remote/128 >> >> >> Here, the ICMPv6 rule matches. >> >> This means for me that the traffic goes like this: >> >> OUTPUT: ping6 -> netfilter -> encryption -> ESP >> INPUT : ESP -> netfilter -> decryption -> ping6 > > More specific, with transport mode it goes: > > OUTPUT: ping6 -> LOCAL_OUT -> encryption -> POST_ROUTING > INPUT: ESP -> PRE_ROUTING -> LOCAL_IN -> decryption -> ping6 > > Filtering for IPv6 happens on LOCAL_IN/LOCAL_OUT (and FORWARD). > >> Is this logical? > > Not very. Patches to improve this for IPv4 will be submitted > next week, but IPv6 still needs some work. > >> >> BTW: how to filter incoming traffic after decryption? > > Use tunnel-mode. The decrypted packets will hit PRE_ROUTING > and LOCAL_IN again. Ok, confirmed working in tunnel mode, ping6 packet was counted twice in different rules (esp and icmpv6) But for outgoing ping6 packets, this won't work, packet is only counted (and accepted) by the icmpv6 rule, esp rule got no match, also not the "all" rule. Looks like at the moment, outgoing packet is passing netfilter only one time, even if encryption is in tunnel mode. By design / bug / missing feature? Peter -- Dr. Peter Bieringer http://www.bieringer.de/pb/ GPG/PGP Key 0x958F422D mailto: pb at bieringer dot de Deep Space 6 Co-Founder and Core Member http://www.deepspace6.net/