Re: [PATCH nf] netfilter: ip6tables: set hotdrop for malformed extension header matches

Hi Phil,

Thanks a lot for the review.

> There is another candidate for hotdrop in there, e.g. the "Packet
> smaller than it's length field" check in line 76. Or is this a
> legitimate non-match?

This should already be covered in the current nf/net tree by the previous
IPv6 extension header hotdrop fix, but I will double-check the base before
sending v2.

> Given the many common blocks, maybe introduce a 'hotdrop' goto label to
> jump to instead of break/return?

That makes sense to me for the repeated hbh error paths. I will look at
the flow again and use a hotdrop label where it keeps the code clearer.

> I think the 'srh->segments_left > srh->first_segment' case is also a
> candidate:

I will revisit this one and check it against RFC8200/RFC8754. My current
understanding is that this looks more like malformed input than a normal
rule mismatch, so I will account for it in v2 if the check fits cleanly.

Thanks,
Zhixing