Fix critical bounds checking issues and add proper IPv6 extension header
support in XDP L3 forwarding program.
Issues fixed:
1. L4 Header Bounds Checking
- Previous code checked bounds for udphdr size (8 bytes) but then
accessed tcphdr struct (20+ bytes), causing potential out-of-bounds
reads and verifier rejection
- Now each protocol (TCP/UDP) has separate, proper bounds validation
before accessing headers
2. IPv6 Extension Header Parsing
- Added skip_ip6hdrext() function to parse IPv6 extension headers
(Hop-by-Hop, Routing, Fragment, Destination Options, AH, MH)
- Ensures accurate L4 protocol identification and flow tracking for
IPv6 packets with extension headers
- Supports up to 6 chained extension headers with fallback
3. PERCPU Map Performance
- Changed bpf_map_update_elem() flag from BPF_NOEXIST to BPF_ANY
- Eliminates unnecessary overhead since PERCPU maps have no
contention and lookup-update race window is negligible
4. L4 Offset Calculation
- Properly calculate L4 header offset separately for bounds checking
- Use offset-based addressing instead of pointer arithmetic for
verifier compliance
These fixes ensure the program passes BPF verifier checks, handles all
packet types correctly, and only records flow statistics for packets
that successfully pass FIB lookup and port validation.
Tested with: IPv4/IPv6 traffic, VLAN-tagged packets, IPv6 with extension
headers (fragmentation, routing headers), TCP/UDP flows.
