From c3b99c6982324a4c7c3b84b7a1626d30de59c182 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Tue, 23 Jun 2026 14:58:36 +0200 Subject: [PATCH] ip-packet: Properly skip IPv6 fragment headers Only skip the header, the `ip6e_len` field is reserved in these headers and does not represent the length (I guess it's usually 0, but still). Fixes: bdcaca76c570 ("ip-packet: Correctly determine protocol in fragmented IPv6 packets") --- src/libipsec/ip_packet.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/libipsec/ip_packet.c b/src/libipsec/ip_packet.c index 08a42111b..1f1999310 100644 --- a/src/libipsec/ip_packet.c +++ b/src/libipsec/ip_packet.c @@ -247,7 +247,10 @@ static bool parse_transport_header_v6(struct ip6_hdr *ip, chunk_t packet, { case 44: /* Fragment Header */ fragment = TRUE; - /* skip the header */ + ext = (struct ip6_ext*)payload->ptr; + *proto = ext->ip6e_nxt; + *payload = chunk_skip(*payload, 8); + continue; case 0: /* Hop-by-Hop Options Header */ case 43: /* Routing Header */ case 60: /* Destination Options Header */