Re: [PATCH net v2] seg6: fix HMAC validation when an extension header precedes the SRH

[Paolo Abeni]

On 9/26/26 13:19, Yuya Kusakabe wrote:
> seg6_hmac_validate_skb() derived the SRH from skb_transport_header().
> That only holds while the two coincide, which is not true on the
> seg6_local input path.
>
> ip6_rcv_core() leaves the transport header just past the IPv6 header.
> A Hop-by-Hop options header is consumed before the route lookup and
> advances it, but a Destination Options header is not: the seg6_local
> lwtunnel is entered through an input redirect from the route lookup,
> which bypasses the extension header handlers. The transport header
> then still points at the Destination Options header while
> seg6_get_srh() has located the real SRH further down the chain.
>
> The HMAC is therefore computed over the Destination Options header,
> and a packet carrying a valid HMAC TLV is dropped when
> seg6_require_hmac is set. Such a packet is legitimate: RFC 8200 allows
> Destination Options before a routing header, and get_srh() has walked
> the header chain since commit 5829d70b0b6c ("ipv6: sr: fix get_srh() to
> comply with IPv6 standard "RFC 8200"").
>
> With a Fragment or an Authentication header in front of the SRH, the
> same mistake also reads past the data pulled by seg6_get_srh(). This
> happens before seg6_require_hmac is read, so the default configuration
> is affected.
>
> Reproduce by giving a node a seg6local End SID with
> net.ipv6.conf.<dev>.seg6_require_hmac=1 and a key installed with
> "ip sr hmac set <keyid> sha1", then sending
>
>    IPv6 -> Destination Options -> SRH (carrying a valid HMAC TLV) -> payload
>
> to that SID: it is dropped, while the same packet without the
> Destination Options header passes.
>
> Fixes: 5829d70b0b6c ("ipv6: sr: fix get_srh() to comply with IPv6 standard "RFC 8200"")
> Assisted-by: LLM
> Signed-off-by: Yuya Kusakabe <yuya.kusakabe@xxxxxxxxx>
FTR applying this to net-next, as it looks really an always broken
corner-case, and Linus is asking for really critical fixes only at
this point of the cycle.

/P