Re: DHCPv6 source port

Phil Whineray <[email protected]>
Newsgroups gmane.comp.security.firewalls.firehol.user
Message-ID <[email protected]>
Hi Mihai

On Thu, Jul 24, 2014 at 04:19:51AM -0700, Mihai Hanor wrote:
> I have encountered a situation with Firehol and the dhcpv6 service.
> Apparently, the standard that defines how DHCPv6 works, doesn't specify
> what source port, a request or a response, must have. Firehol doesn't
> handle this situation, with the current definition of the dhcpv6 service.
> I'm currently using dibbler-server as a DHCPv6 server, instead of
> wide-dhcpv6-server, because wide-dhcpv6-server responds to requests,
> from a random UDP port. See here my initial attempt to resolve the issue
> with the wide-dhcpv6-server, which got an answer
> today: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=751407 

Seems fairly clear-cut. I originally took the DHCPv6 service from the 
DHCP one in FireHOL but a close reading of the RFC shows that the
source ports are not fixed in DHCPv6 as they were originally.

I have updated the FireHOL service definition and I would be grateful if
you could give it a go from the latest build:
   http://firehol.org/download/unsigned/master/

and let me know how you get on.

Thanks
Phil
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.