ICMPV6 param problem with new error code 3 for first fragment not having valid upper layer header

[Preethi Ramachandra]

As per is_ineligible implementation in net/ipv6/icmp.c. If the incoming icmp is 
an error or is truncated, responses will not be sent out.
RFC8200 and RFC 7112 states the following:

        “If the first fragment does not include all headers through an
         Upper-Layer header, then that fragment should be discarded and
         an ICMP Parameter Problem, Code 3, message should be sent to
         the source of the fragment, with the Pointer field set to zero.”

In IPV6 TC’s derived from latest RFC 8200 
https://www.ipv6ready.org/docs/Core_Conformance_5_0_0.pdf - TC 1.3.6, there is 
a possibility of next header set to 58(NEXTHDR_ICMP) but there is no ICMP 
header in first fragment. Second fragment has ICMP header. In this case RFC 
expects to discard the first fragment and send ICMPV6 param problem with new 
error code 3. I don’t see this being implemented in latest linux upstream code. 
Is it ok to change is_ineligible in linux for this specific case?

Linux source code:

/*
* Figure out, may we reply to this packet with icmp error.
*
* We do not reply, if:
*              - it was icmp error message.
*              - it is truncated, so that it is known, that protocol is ICMPV6
*                (i.e. in the middle of some exthdr)
*
*              --ANK (980726)
*/

static bool is_ineligible(const struct sk_buff *skb)
{
                int ptr = (u8 *)(ipv6_hdr(skb) + 1) - skb->data;
                int len = skb->len - ptr;
                __u8 nexthdr = ipv6_hdr(skb)->nexthdr;
                __be16 frag_off;

                if (len < 0)
                                return true;

                ptr = ipv6_skip_exthdr(skb, ptr, &nexthdr, &frag_off);
                if (ptr < 0)
                                return false;
                if (nexthdr == IPPROTO_ICMPV6) {
                                u8 _type, *tp;
                                tp = skb_header_pointer(skb,
                                                ptr+offsetof(struct icmp6hdr, 
icmp6_type),
                                                sizeof(_type), &_type);
                                if (!tp || !(*tp & ICMPV6_INFOMSG_MASK))
                                                return true;
                }
                return false;
}

Thanks,
Preethi



Juniper Business Use Only