Re: [PATCH net v2] seg6: fix HMAC validation when an extension header precedes the SRH

[Andrea Mayer <andrea.mayer@uniroma2.it>]

On Sat, 26 Sep 2026 20:19:27 +0900
Yuya Kusakabe <yuya.kusakabe@gmail.com> wrote:

> seg6_hmac_validate_skb() derived the SRH from skb_transport_header().
> That only holds while the two coincide, which is not true on the
> seg6_local input path.
> 
> ip6_rcv_core() leaves the transport header just past the IPv6 header.
> A Hop-by-Hop options header is consumed before the route lookup and
> advances it, but a Destination Options header is not: the seg6_local
> lwtunnel is entered through an input redirect from the route lookup,
> which bypasses the extension header handlers. The transport header
> then still points at the Destination Options header while
> seg6_get_srh() has located the real SRH further down the chain.
> 
> The HMAC is therefore computed over the Destination Options header,
> and a packet carrying a valid HMAC TLV is dropped when
> seg6_require_hmac is set. Such a packet is legitimate: RFC 8200 allows
> Destination Options before a routing header, and get_srh() has walked
> the header chain since commit 5829d70b0b6c ("ipv6: sr: fix get_srh() to
> comply with IPv6 standard "RFC 8200"").
> 
> With a Fragment or an Authentication header in front of the SRH, the
> same mistake also reads past the data pulled by seg6_get_srh(). This
> happens before seg6_require_hmac is read, so the default configuration
> is affected.
> 
> Reproduce by giving a node a seg6local End SID with
> net.ipv6.conf.<dev>.seg6_require_hmac=1 and a key installed with
> "ip sr hmac set <keyid> sha1", then sending
> 
>   IPv6 -> Destination Options -> SRH (carrying a valid HMAC TLV) -> payload
> 
> to that SID: it is dropped, while the same packet without the
> Destination Options header passes.
> 
> Fixes: 5829d70b0b6c ("ipv6: sr: fix get_srh() to comply with IPv6 standard "RFC 8200"")
> Assisted-by: LLM
> Signed-off-by: Yuya Kusakabe <yuya.kusakabe@gmail.com>
> ---
> Changes in v2:
> - Describe the out-of-bounds read reachable with a Fragment or an
>   Authentication header before the SRH (Andrea)
> - Link to v1: https://patch.msgid.link/20260923-b4-seg6-hmac-transport-header-v1-1-3ae85dc0fdb9@gmail.com
> ---
>  include/net/seg6_hmac.h | 3 ++-
>  net/ipv6/exthdrs.c      | 2 +-
>  net/ipv6/seg6_hmac.c    | 5 +----
>  net/ipv6/seg6_local.c   | 6 +++---
>  4 files changed, 7 insertions(+), 9 deletions(-)

Thanks for the v2, and for addressing the v1 comment.

The code looks good to me.

For the record, the v1 Sashiko review noted another effect of the same
bug. A captured HMAC can be reused in a Destination Options header in
front of a forged SRH with no HMAC. With seg6_require_hmac=1 that forged
SRH was accepted before this patch. After the patch the HMAC check runs
on the SRH the behavior uses, not on the header in front of it.

Reviewed-by: Andrea Mayer <andrea.mayer@uniroma2.it>

Ciao,
Andrea