[PATCH 4/6] ip_frag: drop IPv6 fragments with unexpected headers

[Konstantin Ananyev]

> DPDK version of IPv6 reassembly only handles a fragment header placed
> directly after the IPv6 header. With other extension headers in the
> unfragmentable part, ipv6_frag_reassemble() patches the wrong
> next-header field, miscomputes the payload length, and shifts the
> wrong bytes, corrupting the result.
> 
> Drop the fragment when l3_len covers more than the IPv6 and fragment
> headers. RFC 8200 allows a receiver to discard packets whose extension
> headers are not in the recommended order, and RFC 9099 recommends
> dropping non-conforming fragmented IPv6 packets, so dropping here is
> permitted rather than a deviation.
> 
> Fixes: 4f1a8f633862 ("ip_frag: add IPv6 reassembly")
> Cc: stable at dpdk.org
> 
> Signed-off-by: Stephen Hemminger <stephen at networkplumber.org>
> ---
>  lib/ip_frag/rte_ipv6_reassembly.c | 13 +++++++++++++
>  1 file changed, 13 insertions(+)
> 
> diff --git a/lib/ip_frag/rte_ipv6_reassembly.c b/lib/ip_frag/rte_ipv6_reassembly.c
> index 0e809a01e5..7c1659002b 100644
> --- a/lib/ip_frag/rte_ipv6_reassembly.c
> +++ b/lib/ip_frag/rte_ipv6_reassembly.c
> @@ -180,6 +180,19 @@ rte_ipv6_frag_reassemble_packet(struct rte_ip_frag_tbl
> *tbl,
>  		return NULL;
>  	}
> 
> +	/*
> +	 * Only a fragment header directly following the IPv6 header is
> +	 * supported. Other extension headers in the unfragmentable part are
> +	 * not handled: ipv6_frag_reassemble() assumes l3_len covers exactly
> +	 * the IPv6 and fragment headers when it patches the next-header field
> +	 * and removes the fragment header. Drop the fragment rather than
> +	 * produce a corrupt datagram.
> +	 */
> +	if (mb->l3_len != sizeof(struct rte_ipv6_hdr) + sizeof(*frag_hdr)) {
> +		IP_FRAG_MBUF2DR(dr, mb);
> +		return NULL;
> +	}
> +

Hmm, not sure this is a right thing.
Yes, we don't support properly ipv6 options that are *before* fragment hreader
(so called Per-Fragment  Headers), but AFAIR we do support ipv6 options
that come *after* fragment header (Extension headers). 

>  	if (unlikely(trim > 0))
>  		rte_pktmbuf_trim(mb, trim);
> 
> --
> 2.53.0