Commit 7a0207094f1b ("xfrm: policy: replace session decode with flow dissector") replaced XFRM session decoding with the flow dissector. While the old IPv6 decoder kept walking past an IPv6 Fragment extension header, the flow dissector stops unless the caller sets FLOW_DISSECTOR_F_PARSE_1ST_FRAG. For an atomic fragment followed by extension headers, inbound policy lookup can therefore see the header after Fragment instead of the actual upper-layer protocol and miss protocol selectors. Make the dissector continue through first IPv6 fragments. Keep the port, ICMPv6 and GRE selector fields zero for all fragments, as the old decoder did. This also keeps the result the same when a BPF flow dissector fills ports for a first fragment. Fixes: 7a0207094f1b ("xfrm: policy: replace session decode with flow dissector") Cc: stable@vger.kernel.org Signed-off-by: Jérémy Jean --- net/xfrm/xfrm_policy.c | 35 ++++++++++++++++++++++------------- 1 file changed, 22 insertions(+), 13 deletions(-) diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index 9ea60c7717ff8..bda5100c9fdbf 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -3480,23 +3480,29 @@ decode_session6(const struct xfrm_flow_keys *flkeys, struct flowi *fl, bool reve if (reverse) { fl6->saddr = flkeys->addrs.ipv6.dst; fl6->daddr = flkeys->addrs.ipv6.src; - fl6->fl6_sport = flkeys->ports.dst; - fl6->fl6_dport = flkeys->ports.src; } else { fl6->saddr = flkeys->addrs.ipv6.src; fl6->daddr = flkeys->addrs.ipv6.dst; - fl6->fl6_sport = flkeys->ports.src; - fl6->fl6_dport = flkeys->ports.dst; } - switch (flkeys->basic.ip_proto) { - case IPPROTO_GRE: - fl6->fl6_gre_key = flkeys->gre.keyid; - break; - case IPPROTO_ICMPV6: - fl6->fl6_icmp_type = flkeys->icmp.type; - fl6->fl6_icmp_code = flkeys->icmp.code; - break; + if (!(flkeys->control.flags & FLOW_DIS_IS_FRAGMENT)) { + if (reverse) { + fl6->fl6_sport = flkeys->ports.dst; + fl6->fl6_dport = flkeys->ports.src; + } else { + fl6->fl6_sport = flkeys->ports.src; + fl6->fl6_dport = flkeys->ports.dst; + } + + switch (flkeys->basic.ip_proto) { + case IPPROTO_GRE: + fl6->fl6_gre_key = flkeys->gre.keyid; + break; + case IPPROTO_ICMPV6: + fl6->fl6_icmp_type = flkeys->icmp.type; + fl6->fl6_icmp_code = flkeys->icmp.code; + break; + } } fl6->flowi6_proto = flkeys->basic.ip_proto; @@ -3507,10 +3513,13 @@ int __xfrm_decode_session(struct net *net, struct sk_buff *skb, struct flowi *fl unsigned int family, int reverse) { struct xfrm_flow_keys flkeys; + unsigned int flags = FLOW_DISSECTOR_F_STOP_AT_ENCAP; memset(&flkeys, 0, sizeof(flkeys)); + if (family == AF_INET6) + flags |= FLOW_DISSECTOR_F_PARSE_1ST_FRAG; __skb_flow_dissect(net, skb, &xfrm_session_dissector, &flkeys, - NULL, 0, 0, 0, FLOW_DISSECTOR_F_STOP_AT_ENCAP); + NULL, 0, 0, 0, flags); switch (family) { case AF_INET: -- 2.47.3