Re: A problem with RFC 6465's Uniform Format for Extension Headers

[Brian E Carpenter <[e-mail]>]

On 04/02/2014 11:00, Hagen Paul Pfeifer wrote:
> * Brian E Carpenter | 2014-02-04 10:43:40 [+1300]:
> 
>> Either solution works, but the firewall implementors might
>> have a preference one way or the other. RFC 7045 says
>> "Therefore, it is important that forwarding
>> nodes that inspect IPv6 headers be able to parse all defined
>> extension headers and deal with them appropriately,..."
>> So the question is whether they would find a reserved
>> range or a subtype easier to parse.
> 
> In the appendix of draft-pfeifer-6man-exthdr-res-01 I provided a patch against
> Linux net-next-2.6 (see end of this email). In the end the compare do not
> matter that match because one additional cmp is used which is fast.

By the way, your code extract seems to show exactly the problem
that inspired RFC 7045: the list of nexthdrs needs to include
all of them as per the new registry at
http://www.iana.org/assignments/ipv6-parameters/ipv6-parameters.xhtml#extension-header

    Brian

> 
> 
> 
> diff --git a/net/ipv6/exthdrs_core.c b/net/ipv6/exthdrs_core.c
> index 14ed0a9..d7f2e97 100644
> --- a/net/ipv6/exthdrs_core.c
> +++ b/net/ipv6/exthdrs_core.c
> @@ -4,6 +4,9 @@
>   */
>  #include <net/ipv6.h>
> 
> +#define        IP6_EXTHDR_RESERVED_MIN 245
> +#define        IP6_EXTHDR_RESERVED_MAX 252
> +
>  /*
>   * find out if nxthdr is a well-known extension header or a protocol
>   */
> @@ -18,7 +21,8 @@ int ipv6_ext_hdr(u8 nexthdr)
>                  (nexthdr == NEXTHDR_FRAGMENT)  ||
>                  (nexthdr == NEXTHDR_AUTH)      ||
>                  (nexthdr == NEXTHDR_NONE)      ||
> -                (nexthdr == NEXTHDR_DEST);
> +                (nexthdr == NEXTHDR_DEST)      ||
> +                (nexthdr >= IP6_EXTHDR_RESERVED_MIN &&
> +                 nexthdr <= IP6_EXTHDR_RESERVED_MAX);
>  }