[PATCH net-next 0/5] seg6: fixes for the PSP flavor of SRv6 End

[Andrea Mayer]

This series addresses three related issues of the PSP flavor in the
SRv6 End behavior, all present since commit bdf3c0b9c10b ("seg6: add PSP
flavor support for SRv6 End behavior"). The three fixes build on each
other.

The main one is a route with both the NEXT-C-SID and PSP flavors.
RFC 9800 says that the PSP flavor is unchanged when combined with
NEXT-C-SID (NEXT-CSID in the RFC) [1]. Currently, a packet with a zero
Argument (i.e. when the IPv6 DA carries no further C-SID) is processed
as End without flavors, and PSP is not applied. With this series, such
a packet is processed as End with PSP.

The other two are:

 - A consumed SRH (Segments Left 0) before the SRH to process. This is
   a corner case, e.g. when the seg6 inline mode inserts an SRH in front
   of the one already in the packet, and a later End behavior consumes
   the inserted SRH. End without flavors skips the consumed SRH, while
   End with the PSP flavor alone drops the packet. With this series, End
   with PSP skips the consumed SRH as well.

 - A Fragment or AH header before the SRH. This order does not follow
   RFC 8200 [2] for the Fragment header and RFC 4302 [3] for AH. At the
   penultimate segment, End with the PSP flavor alone handles it
   inconsistently: it drops the packet when other headers come between
   the Fragment or AH header and the SRH, but removes the SRH when
   nothing comes between them. With this series, End with PSP drops the
   packet in both cases. Packets with the Fragment or AH header after
   the SRH are not affected by patch 1/5.

The series is organized as follows:

 - Patch 1/5 fixes the Fragment or AH header case.
 - Patch 2/5 fixes the consumed SRH case. It relies on patch 1/5.
 - Patch 3/5 fixes the NEXT-C-SID and PSP route. It relies on patch 2/5.
 - Patch 4/5 adds the selftests for PSP together with NEXT-C-SID.
 - Patch 5/5 adds the selftests for PSP with a consumed SRH.

The series targets net-next because the three issues have been there
since PSP was added.

Tested on net-next with the srv6_*.sh selftests, including the new tests
of patches 4/5 and 5/5. The ping traffic of srv6_end_flavors_test.sh has
no Fragment or AH header before the SRH. For this reason, patch 1/5 was
also tested with crafted packets. KASAN reports no error.

[1] - https://datatracker.ietf.org/doc/html/rfc9800#section-4.1.7
[2] - https://datatracker.ietf.org/doc/html/rfc8200#section-4.5
[3] - https://datatracker.ietf.org/doc/html/rfc4302#section-3.1.1

Thanks,
Andrea

Andrea Mayer (5):
  seg6: handle a Fragment or AH header before the SRH consistently in
    PSP
  seg6: handle a consumed SRH in SRv6 End with the PSP flavor
  seg6: apply the PSP flavor together with NEXT-C-SID in SRv6 End
  selftests: seg6: add tests for PSP together with NEXT-C-SID
  selftests: seg6: add tests for PSP with a consumed SRH

 net/ipv6/seg6_local.c                         |  87 +++-
 .../selftests/net/srv6_end_flavors_test.sh    | 373 +++++++++++++++++-
 2 files changed, 444 insertions(+), 16 deletions(-)

-- 
2.43.0