ICMP6 Helper Segmentation Fault

fukawi2 commented 11 years ago

There is an upstream bug in ip6tables that causes segmentation faults. Refer http://bugzilla.netfilter.org/show_bug.cgi?id=766

There are certain protective rules commented in the helper at the moment.

They need to be uncommented when upstream fixes the issue.

fukawi2 commented 11 years ago

The issue appears to be resolved upstream, however there is also a workaround by reordering the modules in each rule (-p icmpv6 before -m hl).

fukawi2 commented 11 years ago

This appears to still be broken, but for a different reason. When the comment gets appended to the rule, netfilter barfs with Can't specify HL option twice.

Reversing the order of the hl and comment modules in the command line works though:

fw2 ~ # ip6tables -A INPUT -p icmpv6 --icmpv6-type redirect -m hl ! --hl-eq 255 -j DROP -m comment --comment "husk line 13"
ip6tables v1.4.7: Can't specify HL option twice
Try `ip6tables -h' or 'ip6tables --help' for more information.
fw2 ~ # ip6tables -A INPUT -p icmpv6 --icmpv6-type redirect -m comment --comment "husk line 13" -m hl ! --hl-eq 255 -j DROP
fw2 ~ #

Possibly fixed upstream here: http://comments.gmane.org/gmane.comp.security.firewalls.netfilter.devel/37138

Still broken on Debian 6 and CentOS 6 presently. Work around by adding no_ipv6_comments = 1 to husk.conf

fukawi2 commented 11 years ago

Appears to be resolved upstream according to the original netfilter bug report: http://bugzilla.netfilter.org/show_bug.cgi?id=766

Reported to CentOS for investigation of including upstream fixes: http://bugs.centos.org/view.php?id=6315

fukawi2 commented 11 years ago

Reported to RedHat for inclusion in RHEL6, in order for it to flow down to CentOS: https://bugzilla.redhat.com/show_bug.cgi?id=921403

fukawi2 commented 11 years ago

RedHat have closed bug report as "Can't Fix" so this will probably remain an issue for RHEL 6 and CentOS 6 users.

fukawi2 / husk

ICMP6 Helper Segmentation Fault #8