[ cc David Lebrun, author of the original code ]
On 1/31/21 6:08 AM, Suprit Japagal wrote:
> From: "Suprit.Japagal" <suprit.japa...@gmail.com>
>
> According to the standard IETF RFC 8754, section 4.3.1.1
> (https://tools.ietf.org/html/rfc8754#section-4.3.1.1)
> When the segments left in SRH equals to 0, proceed to process the
> next header in the packet, whose type is identified by the
> Next header field of the routing header.
>
> Signed-off-by: Suprit.Japagal <suprit.japa...@gmail.com>
> ---
> net/ipv6/seg6_local.c | 54
> +++++++++++++++++++++++++++++++++++++++++++++------
> 1 file changed, 48 insertions(+), 6 deletions(-)
>
> diff --git a/net/ipv6/seg6_local.c b/net/ipv6/seg6_local.c
> index b07f7c1..b17f9dc 100644
> --- a/net/ipv6/seg6_local.c
> +++ b/net/ipv6/seg6_local.c
> @@ -273,11 +273,25 @@ static int input_action_end(struct sk_buff *skb, struct
> seg6_local_lwt *slwt)
> {
> struct ipv6_sr_hdr *srh;
>
> - srh = get_and_validate_srh(skb);
> + srh = get_srh(skb);
> if (!srh)
> goto drop;
>
> - advance_nextseg(srh, &ipv6_hdr(skb)->daddr);
> +#ifdef CONFIG_IPV6_SEG6_HMAC
> + if (srh->segments_left > 0)
> + if (!seg6_hmac_validate_skb(skb))
> + goto drop;
> +#endif
> +
> + if (srh->segments_left == 0) {
> + if (!decap_and_validate(skb, srh->nexthdr))
> + goto drop;
> +
> + if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
> + goto drop;
> + } else {
> + advance_nextseg(srh, &ipv6_hdr(skb)->daddr);
> + }
>
> seg6_lookup_nexthop(skb, NULL, 0);
>
> @@ -293,11 +307,25 @@ static int input_action_end_x(struct sk_buff *skb,
> struct seg6_local_lwt *slwt)
> {
> struct ipv6_sr_hdr *srh;
>
> - srh = get_and_validate_srh(skb);
> + srh = get_srh(skb);
> if (!srh)
> goto drop;
>
> - advance_nextseg(srh, &ipv6_hdr(skb)->daddr);
> +#ifdef CONFIG_IPV6_SEG6_HMAC
> + if (srh->segments_left > 0)
> + if (!seg6_hmac_validate_skb(skb))
> + goto drop;
> +#endif
> +
> + if (srh->segments_left == 0) {
> + if (!decap_and_validate(skb, srh->nexthdr))
> + goto drop;
> +
> + if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
> + goto drop;
> + } else {
> + advance_nextseg(srh, &ipv6_hdr(skb)->daddr);
> + }
>
> seg6_lookup_nexthop(skb, &slwt->nh6, 0);
>
> @@ -312,11 +340,25 @@ static int input_action_end_t(struct sk_buff *skb,
> struct seg6_local_lwt *slwt)
> {
> struct ipv6_sr_hdr *srh;
>
> - srh = get_and_validate_srh(skb);
> + srh = get_srh(skb);
> if (!srh)
> goto drop;
>
> - advance_nextseg(srh, &ipv6_hdr(skb)->daddr);
> +#ifdef CONFIG_IPV6_SEG6_HMAC
> + if (srh->segments_left > 0)
> + if (!seg6_hmac_validate_skb(skb))
> + goto drop;
> +#endif
> +
> + if (srh->segments_left == 0) {
> + if (!decap_and_validate(skb, srh->nexthdr))
> + goto drop;
> +
> + if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
> + goto drop;
> + } else {
> + advance_nextseg(srh, &ipv6_hdr(skb)->daddr);
> + }
>
> seg6_lookup_nexthop(skb, NULL, slwt->table);
>
>
