Using u32 together with extension headers (how to jump over them?)
- by bortzmeyer
I'm trying to filter on some parts of the payload, for an IPv6 packet
with extension headers (for instance Destination Options).
ip6tables works fine with conditions like --proto udp or --dport
109, even when the packet has extension headers. Netfilter clearly knows how to jump over Destination Options to
find the UDP header.
Now, I would like to use the u32 module to match a byte in the
payload (say "I want the third byte of the payload to be 42). If the packet has no extension headers something like --u32
"48&0x0000ff00=0x2800"` (48 = 40 bytes for the IPv6 header + 8 for the UDP header) works fine, If the packet has a Destination Options, it no
longer matches. I would like to write a rule that will work whether
the packet has Destination Options or not.
I do not find a way to tell Netfilter to parse until the UDP header
(something that it is able to do, otherwise --dport
109 would not work) then to leave u32 parse the rest.
I'm looking for a simple way, otherwise, as BatchyX mentions, I could write a kernel module doing what I want.
