In some email I received from Martin Stiemerling, sie wrote: > Hi, > > fr_info_t is defined in ip_fil.h. The member fin_dp points to the data > behind the IP Header: > char *fin_dp; /* start of data past IP Header */ > > For IPv4 it points behind the IP header, but how about IPv6? Is the > pointer behind the last IP header of a possible header chain or direkt > after the first IP header (the actual header)?
At present, IPFilter does not (deliberately) walk the chain of IPv6 extension headers until it runs out or arrives at the last one (ie a TCP or UDP header.) This is mainly because I haven't yet implemented a mechanism to filter on the IPv6 extension headers which I want to have in place before I add code to skip over them. I believe there are potential security issues in just skipping over them that I want to be able to address first. Darren
