Re: [PATCH net v2 1/2] psp: fix transport mode encap with ipv6 extension headers

[Todd Bert Freed]

> > - NEXTHDR_ROUTING. the tcp checksum covers the final destination, but
> >   drivers seed tso checksums from the daddr in the fixed hdr
> >   (mlx5e_psp_handle_tx_skb()), so this would produce bad checksums.
> >   could be supported with more work.
> >
>
> The stack should seed the tcp check correctly with the sk dst addr. If
> mlx5's lso implementation can't take that into account, I'm not sure a
> generic helper should be the one rejecting the skb.

Fair enough. In v3 I will fix the mlx5 bug, and accept routing headers, too.

Or if it's more suitable in a bugfix, to effect the narrower behavior change
e.g. drop, please let me know (ack that such a drop should be in the driver
though).

> > +             if (!ipv6_ext_hdr(type) || type == NEXTHDR_NONE ||
> > +                 type == NEXTHDR_FRAGMENT || type == NEXTHDR_ROUTING)
> > +                     return -1;
>
> return an error code instead of -1?

ack

> > +             rem = len - off;
> > +             if (rem < sizeof(*eh))
> > +                     return -1;
> > +
> > +             nh = off + offsetof(struct ipv6_opt_hdr, nexthdr);
> > +             if (type == NEXTHDR_AUTH)
> > +                     off += ipv6_authlen(eh);
>
> I was expecting auth header to be part of the reject list.

I will do more testing with auth header.

> > @@ -331,8 +375,23 @@ int psp_dev_rcv(struct sk_buff *skb, u16 dev_id, u8 generation, bool strip_icv)
> >                       return -EINVAL;
>
> If you send a v3, I think you should put the psp_dev_rcv() in a
> serparate patch.

Okay.

-Todd