[PATCH net] xfrm: fix IPv6 first-fragment protocol decode
flat view
HOTtoday
From: Jérémy Jean <hidden>
Date: 2026-11-01 23:08:44
Also in:
lkml, stable
Subsystem:
networking [general], networking [ipsec], the rest · Maintainers:
"David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Steffen Klassert, Herbert Xu, Linus Torvalds
Commit 7a0207094f1b ("xfrm: policy: replace session decode with flow dissector") replaced XFRM session decoding with the flow dissector. While the old IPv6 decoder kept walking past an IPv6 Fragment extension header, the flow dissector stops unless the caller sets FLOW_DISSECTOR_F_PARSE_1ST_FRAG. For an atomic fragment followed by extension headers, inbound policy lookup can therefore see the header after Fragment instead of the actual upper-layer protocol and miss protocol selectors. Make the dissector continue through first IPv6 fragments. Keep GRE and ICMPv6 selector fields unset for fragmented packets, matching the old decoder's behavior. Fixes: 7a0207094f1b ("xfrm: policy: replace session decode with flow dissector") Cc: <redacted> Signed-off-by: Jérémy Jean <redacted> --- net/xfrm/xfrm_policy.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-)
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 9ea60c7717ff..c9c2370b07cc 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c@@ -3489,14 +3489,16 @@ decode_session6(const struct xfrm_flow_keys *flkeys, struct flowi *fl, bool reve fl6->fl6_dport = flkeys->ports.dst; } - switch (flkeys->basic.ip_proto) { - case IPPROTO_GRE: - fl6->fl6_gre_key = flkeys->gre.keyid; - break; - case IPPROTO_ICMPV6: - fl6->fl6_icmp_type = flkeys->icmp.type; - fl6->fl6_icmp_code = flkeys->icmp.code; - break; + if (!(flkeys->control.flags & FLOW_DIS_IS_FRAGMENT)) { + switch (flkeys->basic.ip_proto) { + case IPPROTO_GRE: + fl6->fl6_gre_key = flkeys->gre.keyid; + break; + case IPPROTO_ICMPV6: + fl6->fl6_icmp_type = flkeys->icmp.type; + fl6->fl6_icmp_code = flkeys->icmp.code; + break; + } } fl6->flowi6_proto = flkeys->basic.ip_proto;
@@ -3507,10 +3509,13 @@ int __xfrm_decode_session(struct net *net, struct sk_buff *skb, struct flowi *fl unsigned int family, int reverse) { struct xfrm_flow_keys flkeys; + unsigned int flags = FLOW_DISSECTOR_F_STOP_AT_ENCAP; memset(&flkeys, 0, sizeof(flkeys)); + if (family == AF_INET6) + flags |= FLOW_DISSECTOR_F_PARSE_1ST_FRAG; __skb_flow_dissect(net, skb, &xfrm_session_dissector, &flkeys, - NULL, 0, 0, 0, FLOW_DISSECTOR_F_STOP_AT_ENCAP); + NULL, 0, 0, 0, flags); switch (family) { case AF_INET:
--
2.47.3