classify.m4: Forbid the v4-mapped and v4-compatible ranges.

[firewall] / classify.m4

diff --git a/classify.m4 b/classify.m4
index 79401f6..7c60407 100644 (file)
--- a/classify.m4
+++ b/classify.m4
@@ -45,8 +45,9 @@ m4_divert(40)m4_dnl
 ###
 ### The mangle chains are arranged as follows.
 ###
-### The PREROUTING hook simply invokes in-classify and out-classify chains as
-### subroutines.  These will tail-call appropriate classification chains.
+### The INPUT and FORWARD hooks simply invokes in-classify and out-classify
+### chains as subroutines.  These will tail-call appropriate classification
+### chains.
 ###
 ### The in-classify chain is responsible for both source address
 ### classification and verifying that the packet arrived from the correct
@@ -250,7 +251,7 @@ trace "alladdrs = $alladdrs"
 
 ## Populate the `out-classify' chain, matching networks.
 prepare_to () { mode=goto fail=mark-to-$net_class_default; }
-matchnets -d mark-from : prepare_to out-classify "" 0 $allnets
+matchnets -d mark-to : prepare_to out-classify "" 0 $allnets
 
 ## A `finish' hook for rejecting known address ranges arriving on a
 ## default-reachable interface.
@@ -319,7 +320,8 @@ for entry in $ifmap; do
 done
 
 ## Fill in the black holes in the network.  Some of these might actually be
-## known networks, so don't fill those in again.
+## known networks, so don't fill those in again.  See RFC5735 and RFC4291,
+## and their successors.
 for addr in \
        10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 \
        127.0.0.0/8 \
@@ -330,6 +332,7 @@ do
 done
 for addr in \
        fc00::/7 \
+       ::0:0/96 ::ffff:0:0/96 \
        2001:db8::/32
 do
   case $alladdrs in *!$addr!*) continue ;; esac
@@ -339,12 +342,16 @@ run ip46tables -t mangle -A in-default -g mark-from-$net_class_default
 
 m4_divert(92)m4_dnl
 ## Put the final default decision on the in-default chain, and attach the
-## classification chains to the PREROUTING hook.
+## classification chains to the INPUT and (maybe) FORWARD hooks.
 for iface in $defaultifaces; do
   run ip46tables -t mangle -A in-$iface -g in-default
 done
-run ip46tables -t mangle -A PREROUTING -j in-classify
-run ip46tables -t mangle -A PREROUTING -j out-classify
+chains="INPUT"
+case $forward in 1) chains="$chains FORWARD" ;; esac
+for c in $chains; do
+  run ip46tables -t mangle -A $c -j in-classify
+  run ip46tables -t mangle -A $c -j out-classify
+done
 
 ## Incoming stuff to or from a link-local address is OK.
 run ip46tables -t mangle -A INPUT \