Re: [PATCH net-next v3] erspan: drop packets with an unknown ERSPAN version

[Haishuang Yan]

On Mon, Nov 09, 2026 at 11:37:40AM +0000, netdev-bot+sashiko@xxxxxxxxxx wrote:
> Can some type I packets still get through this check on IPv6?

[ ... ]

> For a 4-byte-GRE ETH_P_ERSPAN packet, ver is the high nibble of the
> first byte of the inner Ethernet destination MAC. If that nibble is 1
> or 2:

[ ... ]

> In v3, the IPv4 side was brought in line with gre_parse_header() by
> checking tpi->proto in is_erspan_type1(). Would ip6erspan_rcv() need a
> matching change? It could reject packets where tpi->proto ==
> htons(ETH_P_ERSPAN) && gre_hdr_len == 4, since ip6erspan_tap_validate()
> only allows versions 1 and 2 for IPv6 ERSPAN devices.

Yes. In my reply to v2 I said ip6_gre is not affected because it has no
type I path, but that is exactly the problem: such a packet has no
ERSPAN header, and ip6erspan_rcv() reads the version from the inner
frame. With a collect_md ip6erspan device, an inner destination MAC
starting with 0x1 or 0x2 gets 8 or 12 bytes of the inner frame stripped.

I'll reject these packets in ip6erspan_rcv() as suggested and send a v4.

pw-bot: cr