OpenThread's NAT64 translator assumed a fixed IPv4 header length of 20
bytes, which caused incorrect parsing and translation of IPv4 packets
containing options (IHL > 5).
Specifically, if an IPv4 packet with options was received:
1. The transport header was read from a fixed 20-byte offset, leading
to corruption of transport layer fields (e.g., UDP ports).
2. Only 20 bytes were removed from the message, leaving the IPv4
options at the beginning of the translated IPv6 payload.
3. Mandatory security checks for source route options were bypassed.
This commit fixes these issues by:
- Updating Ip4::Header to validate IHL and provide the actual header
length.
- Using the actual header length for transport header parsing and
IPv4 header removal in the NAT64 translator.
- Implementing a check to discard packets with LSRR or SSRR options
as required by RFC 7915.
A new Nexus regression test is added to verify the fix.
This commit introduces several cleanups and smaller improvements to
the IPv4 types.
- Optimizes `Cidr::ToString(StringWriter&)` by writing the address
directly to the provided writer, avoiding the allocation of a
temporary `String` object.
- Moves the IPv4 header field offset constants from the public
`ip4_types.hpp` header into the unit test file, as this was their
only place of use. This cleans up the `Ip4::Header` public API.
- Replaces hardcoded values for address and string sizes with the
corresponding `OT_IP4_*` definitions for consistency.
- Corrects the format specifier in `Address::ToString()` from `%d` to
`%u` to properly print unsigned octet values.
This commit refactors the code to eliminate the use of `using` for
`BigEndian` or `LittleEndian` functions like `HostSwap` and `ReadUint`.
As these functions are frequently used in header files, using the
direct namespace enhances code safety by mitigating potential conflicts
arising from the order of included headers in the absence of explicit
`using` declarations. Generally, avoiding the `using` keyword in headers
is considered a recommended practice.
Additionally, this commit removes the `Encoding` namespace to shorten
the full function names.
With NAT64, we need to handle the IPv4 packets inside the border
router functions in OpenThread core.
This commit introduces a few new classes for NAT64:
- Add `Ip4::Cidr` (for specifying CIDR block of translated packets)
- Updated Ip4 address format -- use a union of (m8[4], m16[2], m32)
instead of 4 bytes.
- Extend `Checksum` for supporting ICMP in Ip4 (and TCP4 / UDP4) and
IPv4 header.
Jonathan Hui