Update

vendor/tailscale.com/net/packet/packet.go

@@ -1,4 +1,4 @@
-// Copyright (c) Tailscale Inc & AUTHORS
+// Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
 package packet
@@ -17,8 +17,23 @@ import (
 const unknown = ipproto.Unknown
 
 // RFC1858: prevent overlapping fragment attacks.
+//
+// The bound is sized for IPv4 (max IPv4 header + basic TCP header) but is
+// intentionally reused by decode6 for IPv6 fragments. It is conservative for
+// IPv6, whose fragments carry no per-fragment IP header, so it only ever
+// rejects more later fragments as Unknown, never fewer.
 const minFragBlks = (60 + 20) / 8 // max IPv4 header + basic TCP header in fragment blocks (8 bytes each)
 
+// ip6FragHeader is the IANA protocol number for the IPv6 Fragment extension
+// header ("IPv6-Frag"). It appears as the base header's Next Header value on a
+// fragmented packet; decode6 steps over it to reach the real sub-protocol.
+// This is distinct from ipproto.Fragment (0xFF), our internal sentinel for a
+// non-first fragment whose sub-protocol header is not present.
+const ip6FragHeader ipproto.Proto = 44
+
+// ip6FragHeaderLength is the length of the IPv6 Fragment extension header.
+const ip6FragHeaderLength = 8
+
 type TCPFlag uint8
 
 const (
@@ -134,12 +149,15 @@ func (q *Parsed) decode4(b []byte) {
 	q.Src = withIP(q.Src, netaddr.IPv4(b[12], b[13], b[14], b[15]))
 	q.Dst = withIP(q.Dst, netaddr.IPv4(b[16], b[17], b[18], b[19]))
 
-	q.subofs = int((b[0] & 0x0F) << 2)
-	if q.subofs > q.length {
+	// subofs is only committed to q after validation, so a rejected
+	// packet can't leave it pointing past the end of the buffer.
+	subofs := int((b[0] & 0x0F) << 2)
+	if subofs > q.length {
 		// next-proto starts beyond end of packet.
 		q.IPProto = unknown
 		return
 	}
+	q.subofs = subofs
 	sub := b[q.subofs:]
 	sub = sub[:len(sub):len(sub)] // help the compiler do bounds check elimination
 
@@ -272,19 +290,25 @@ func (q *Parsed) decode6(b []byte) {
 	q.Src = withIP(q.Src, srcIP)
 	q.Dst = withIP(q.Dst, dstIP)
 
-	// We don't support any IPv6 extension headers. Don't try to
-	// be clever. Therefore, the IP subprotocol always starts at
-	// byte 40.
+	// The IP subprotocol normally begins right after the 40-byte IPv6
+	// header. The one extension header we parse is the Fragment header
+	// (Next Header 44): a host source-fragmenting a datagram larger than
+	// the tun MTU emits these, and RFC 8200 section 4.5 requires the
+	// receiver to reassemble them, so we must let them through. For the
+	// first fragment we step over the fragment header and read the real
+	// sub-protocol's ports exactly as decode4 does; later fragments are
+	// marked ipproto.Fragment and passed through by the filter.
 	//
-	// Note that this means we don't support fragmentation in
-	// IPv6. This is fine, because IPv6 strongly mandates that you
-	// should not fragment, which makes fragmentation on the open
-	// internet extremely uncommon.
-	//
-	// This also means we don't support IPSec headers (AH/ESP), or
-	// IPv6 jumbo frames. Those will get marked Unknown and
-	// dropped.
+	// We still don't parse any other extension headers (hop-by-hop,
+	// routing, destination options) or IPSec headers (AH/ESP), nor a
+	// Fragment header that isn't the base header's immediate Next Header.
+	// Those get marked Unknown and dropped.
 	q.subofs = 40
+	if q.IPProto == ip6FragHeader {
+		if !q.decode6Fragment(b) {
+			return
+		}
+	}
 	sub := b[q.subofs:]
 	sub = sub[:len(sub):len(sub)] // help the compiler do bounds check elimination
 
@@ -341,6 +365,49 @@ func (q *Parsed) decode6(b []byte) {
 	}
 }
 
+// decode6Fragment parses the IPv6 Fragment extension header at q.subofs in b
+// (q.subofs is the 40-byte base header length when called). It reports whether
+// decode6 should continue into the sub-protocol switch: true only for the
+// first fragment, where q.subofs and q.IPProto have been advanced to the real
+// transport header so its ports get parsed like an unfragmented packet. For
+// later or malformed fragments it sets q.IPProto itself (ipproto.Fragment to
+// pass through, or unknown to drop) and returns false.
+func (q *Parsed) decode6Fragment(b []byte) (continueDecode bool) {
+	// The fragment header is 8 bytes: Next Header, Reserved, a 13-bit
+	// Fragment Offset (in 8-byte blocks) plus a More-Fragments flag, and a
+	// 32-bit Identification.
+	if len(b) < q.subofs+ip6FragHeaderLength {
+		q.IPProto = unknown
+		return false
+	}
+	frag := b[q.subofs:]
+	nextHdr := ipproto.Proto(frag[0])
+	fragOfs := binary.BigEndian.Uint16(frag[2:4]) >> 3
+
+	// Step over the fragment header. The real sub-protocol (first fragment)
+	// or the continued payload (later fragments) begins here.
+	q.subofs += ip6FragHeaderLength
+
+	if fragOfs == 0 {
+		// First fragment: decode the real sub-protocol's header so the
+		// filter can match on its ports. The switch in decode6 performs
+		// the per-protocol bounds checks, including rejecting a first
+		// fragment too short to hold the transport header.
+		q.IPProto = nextHdr
+		return true
+	}
+
+	// Later fragment: there's no sub-protocol header to read. Reject offsets
+	// small enough to overlap the transport header (RFC 1858, same guard as
+	// decode4); otherwise pass it through as a fragment.
+	if fragOfs < minFragBlks {
+		q.IPProto = unknown
+		return false
+	}
+	q.IPProto = ipproto.Fragment
+	return false
+}
+
 func (q *Parsed) IP4Header() IP4Header {
 	if q.IPVersion != 4 {
 		panic("IP4Header called on non-IPv4 Parsed")
@@ -401,7 +468,10 @@ func (q *Parsed) Buffer() []byte {
 // This is a read-only view; that is, q retains the ownership of the buffer.
 func (q *Parsed) Payload() []byte {
 	// If the packet is truncated, return nothing instead of crashing.
-	if q.length > len(q.b) || q.dataofs > len(q.b) {
+	// dataofs can also land past length rather than past len(b): the IP
+	// header can declare a total length that stops before the end of the
+	// sub-protocol header, which would invert the slice bounds below.
+	if q.length > len(q.b) || q.dataofs > len(q.b) || q.dataofs > q.length {
 		return nil
 	}
 
@@ -411,6 +481,10 @@ func (q *Parsed) Payload() []byte {
 // Transport returns the transport header and payload (IP subprotocol, such as TCP or UDP).
 // This is a read-only view; that is, p retains the ownership of the buffer.
 func (p *Parsed) Transport() []byte {
+	if p.subofs > len(p.b) {
+		// defensive check, should not survive decode4 or decode6 (first line)
+		return nil
+	}
 	return p.b[p.subofs:]
 }