This series addresses three related issues of the PSP flavor in the
SRv6 End behavior, all present since commit bdf3c0b9c10b ("seg6: add PSP
flavor support for SRv6 End behavior"). The three fixes build on each
other.The main one is a route with both the NEXT-C-SID and PSP flavors. RFC 9800 says that the PSP flavor is unchanged when combined with NEXT-C-SID (NEXT-CSID in the RFC) [1]. Currently, a packet with a zero Argument (i.e. when the IPv6 DA carries no further C-SID) is processed as End without flavors, and PSP is not applied. With this series, such a packet is processed as End with PSP. The other two are: - A consumed SRH (Segments Left 0) before the SRH to process. This is a corner case, e.g. when the seg6 inline mode inserts an SRH in front of the one already in the packet, and a later End behavior consumes the inserted SRH. End without flavors skips the consumed SRH, while End with the PSP flavor alone drops the packet. With this series, End with PSP skips the consumed SRH as well. - A Fragment or AH header before the SRH. This order does not follow RFC 8200 [2] for the Fragment header and RFC 4302 [3] for AH. At the penultimate segment, End with the PSP flavor alone handles it inconsistently: it drops the packet when other headers come between the Fragment or AH header and the SRH, but removes the SRH when nothing comes between them. With this series, End with PSP drops the packet in both cases. Packets with the Fragment or AH header after the SRH are not affected by patch 1/5. The series is organized as follows: - Patch 1/5 fixes the Fragment or AH header case. - Patch 2/5 fixes the consumed SRH case. It relies on patch 1/5. - Patch 3/5 fixes the NEXT-C-SID and PSP route. It relies on patch 2/5. - Patch 4/5 adds the selftests for PSP together with NEXT-C-SID. - Patch 5/5 adds the selftests for PSP with a consumed SRH. The series targets net-next because the three issues have been there since PSP was added. Tested on net-next with the srv6_*.sh selftests, including the new tests of patches 4/5 and 5/5. The ping traffic of srv6_end_flavors_test.sh has no Fragment or AH header before the SRH. For this reason, patch 1/5 was also tested with crafted packets. KASAN reports no error. [1] - https://datatracker.ietf.org/doc/html/rfc9800#section-4.1.7 [2] - https://datatracker.ietf.org/doc/html/rfc8200#section-4.5 [3] - https://datatracker.ietf.org/doc/html/rfc4302#section-3.1.1 Thanks, Andrea Andrea Mayer (5): seg6: handle a Fragment or AH header before the SRH consistently in PSP seg6: handle a consumed SRH in SRv6 End with the PSP flavor seg6: apply the PSP flavor together with NEXT-C-SID in SRv6 End selftests: seg6: add tests for PSP together with NEXT-C-SID selftests: seg6: add tests for PSP with a consumed SRH net/ipv6/seg6_local.c | 87 +++- .../selftests/net/srv6_end_flavors_test.sh | 373 +++++++++++++++++- 2 files changed, 444 insertions(+), 16 deletions(-) -- 2.43.0
