Re: [PATCH net-next 1/5] seg6: handle a Fragment or AH header before the SRH consistently in PSP

[Hangbin Liu]

On Sun, Oct 11, 2026 at 09:23:06PM +0200, Andrea Mayer wrote:
> seg6_pop_srh() already fails when a Fragment or AH header comes before
> the SRH with other headers in between, and the packet is dropped ("we
> expect SRH before FRAG and AUTH" in the code). But when the SRH directly
> follows the Fragment or AH header, it is removed:
> 
>   (a) IPv6 | FRAG/AH | DOPT | SRH | ...   the packet is dropped
>   (b) IPv6 | FRAG/AH | SRH | ...          the SRH is removed
> 
> In both packets the Fragment or AH header comes before the SRH.
> 
> Align the two cases: check first whether a header is a Fragment or AH
> header, and only then look at its Next Header field. In this way, the
> packet is dropped also when the Fragment or AH header comes directly
> before the SRH. A Fragment or AH header before the SRH, with or without
> other headers in between, does not follow RFC 8200 and RFC 4302: a
> Fragment header must not come before the Routing header, as the
> Per-Fragment headers must include the Routing header [1], and AH should
> not come before the routing and fragmentation headers [2].
> 
> At the penultimate segment, End with the PSP flavor alone today drops
> (a) and forwards (b) with the SRH removed. Packets with the Fragment or
> AH header after the SRH are not affected: seg6_pop_srh() does not look
> at the headers after the SRH.
> 
> Found by manual code inspection and reproduced in a VM without kernel
> changes or error injection, by sending to End with PSP the packets
> shown in the diagram, both with a Fragment header and with AH. With this
> change, the packets are dropped in both cases, all tests in
> srv6_end_flavors_test.sh pass, and KASAN reports no error. With the
> whole series, all the srv6_*.sh selftests pass.
> 
> [1] - https://datatracker.ietf.org/doc/html/rfc8200#section-4.5
> [2] - https://datatracker.ietf.org/doc/html/rfc4302#section-3.1.1
> 
> Fixes: bdf3c0b9c10b ("seg6: add PSP flavor support for SRv6 End behavior")
> Signed-off-by: Andrea Mayer <andrea.mayer@xxxxxxxxxxx>
> ---
>  net/ipv6/seg6_local.c | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/net/ipv6/seg6_local.c b/net/ipv6/seg6_local.c
> index 0c3d1be7f129..da8225591fe3 100644
> --- a/net/ipv6/seg6_local.c
> +++ b/net/ipv6/seg6_local.c
> @@ -796,11 +796,6 @@ static bool seg6_pop_srh(struct sk_buff *skb, int srhoff)
>  			if (unlikely(!hp))
>  				return false;
>  
> -			if (hp->nexthdr == NEXTHDR_ROUTING) {
> -				hp->nexthdr = srh_nexthdr;
> -				break;
> -			}
> -
>  			switch (nexthdr) {
>  			case NEXTHDR_FRAGMENT:
>  				fallthrough;
> @@ -812,6 +807,11 @@ static bool seg6_pop_srh(struct sk_buff *skb, int srhoff)
>  				break;
>  			}
>  
> +			if (hp->nexthdr == NEXTHDR_ROUTING) {
> +				hp->nexthdr = srh_nexthdr;
> +				break;
> +			}
> +
>  			nexthdr = hp->nexthdr;
>  		}
>  	}
> -- 
> 2.43.0
> 

After changing the order, we can check the FRAG/AH header first and
return false and drop the pkt.

Reviewed-by: Hangbin Liu <liuhangbin@xxxxxxxxxx>