seg6_pop_srh() already fails when a Fragment or AH header comes before
the SRH with other headers in between, and the packet is dropped ("we
expect SRH before FRAG and AUTH" in the code). But when the SRH directly
follows the Fragment or AH header, it is removed:(a) IPv6 | FRAG/AH | DOPT | SRH | ... the packet is dropped (b) IPv6 | FRAG/AH | SRH | ... the SRH is removed In both packets the Fragment or AH header comes before the SRH. Align the two cases: check first whether a header is a Fragment or AH header, and only then look at its Next Header field. In this way, the packet is dropped also when the Fragment or AH header comes directly before the SRH. A Fragment or AH header before the SRH, with or without other headers in between, does not follow RFC 8200 and RFC 4302: a Fragment header must not come before the Routing header, as the Per-Fragment headers must include the Routing header [1], and AH should not come before the routing and fragmentation headers [2]. At the penultimate segment, End with the PSP flavor alone today drops (a) and forwards (b) with the SRH removed. Packets with the Fragment or AH header after the SRH are not affected: seg6_pop_srh() does not look at the headers after the SRH. Found by manual code inspection and reproduced in a VM without kernel changes or error injection, by sending to End with PSP the packets shown in the diagram, both with a Fragment header and with AH. With this change, the packets are dropped in both cases, all tests in srv6_end_flavors_test.sh pass, and KASAN reports no error. With the whole series, all the srv6_*.sh selftests pass. [1] - https://datatracker.ietf.org/doc/html/rfc8200#section-4.5 [2] - https://datatracker.ietf.org/doc/html/rfc4302#section-3.1.1 Fixes: bdf3c0b9c10b ("seg6: add PSP flavor support for SRv6 End behavior") Signed-off-by: Andrea Mayer <[email protected]> --- net/ipv6/seg6_local.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/net/ipv6/seg6_local.c b/net/ipv6/seg6_local.c index 0c3d1be7f129..da8225591fe3 100644 --- a/net/ipv6/seg6_local.c +++ b/net/ipv6/seg6_local.c @@ -796,11 +796,6 @@ static bool seg6_pop_srh(struct sk_buff *skb, int srhoff) if (unlikely(!hp)) return false; - if (hp->nexthdr == NEXTHDR_ROUTING) { - hp->nexthdr = srh_nexthdr; - break; - } - switch (nexthdr) { case NEXTHDR_FRAGMENT: fallthrough; @@ -812,6 +807,11 @@ static bool seg6_pop_srh(struct sk_buff *skb, int srhoff) break; } + if (hp->nexthdr == NEXTHDR_ROUTING) { + hp->nexthdr = srh_nexthdr; + break; + } + nexthdr = hp->nexthdr; } } -- 2.43.0
