keep-state rules inadequately handles big UDP packets or fragmented IP packets?

[Luigi Rizzo]

On Tue, Mar 17, 2009 at 03:54:42PM +0100, Paolo Pisati wrote:
> Alex Dupre wrote:
> >Luigi Rizzo ha scritto:
> >>it is not related to dynamic rules, but to the fact that
> >>that the firewall is called before reassembling packets.
> >>The info (port numbers especially) is not available
> >>in the fragments so the firewall cannot do anything.
> >>The only solution would be to call the firewall
> >>after reassembly. I am not sure if there is any work in progress
> >>for that.
> >
> >FWIW pf has "traffic normalization" feature ("scrub" keyword), that 
> >reassembles packets before inspection. Unfortunately, it works with 
> >IPv4 packets, but lacks IPv6 support.
> >
> FYI i have a patch for ipfw nat that reassemble a packet before nat[*], 
> but if the idea of an explicit packet reassembly action sounds good, i 
> could move the code over there.
> 
> [*] actually the patch is really simple, it's just a call to ip_reass() 
> with some glue code, but nonetheless it could be used more globally.

Thinking more about it, i believe that calling reass as an explicit
firewall action is useless, because if ip_reass fails due to lack of
all fragments you are back to square one:
	what do I do with this fragment ?
And the answer can only be the same that you would implement
without the mechanism: unconditionally accept all fragments past
the first one, and do the actual filtering on the first fragment.
If you drop the fragments, you would be unable to rebuild the
full packet.

The only thing that would actually make a difference, i believe,
is the ability to call the firewall after ip_reass() instead
of just before (of course you'd need some microinstruction to
check who is calling you, and make different decisions in
the various cases).

	cheers
	luigi