Re: [PATCH net v3 2/4] psp: support ipv6 extension headers in psp_dev_rcv() decap

[Jakub Kicinski]

On Mon, 26 Oct 2026 15:05:42 -0700 Todd Bert Freed wrote:
> > The PSP ICV doesn't cover the outer IPv6 header or its extension headers.
> > An on-path attacker could take a captured PSP packet, insert one of these
> > headers, and set saddr to an address they control. This assumes the
> > device authenticates such packets, which this patch's premise implies.
> >
> > Several of those handlers reply with an ICMPv6 error that quotes the
> > packet. With default sysctls, this happens for an unrecognized routing
> > header type (type 0, for example) with segments_left != 0:
> >
> > Before this patch, all of these packets were dropped at the is_udp check.
> > Forwarding the decrypted skb itself looks blocked by
> > sk_validate_xmit_skb() ("unencrypted skb with no associated socket -
> > dropping"). That leaves the ICMP error path as the open channel.  
> 
> Agree with this finding.

If we're leaking cleartext in ICMP responses that's also a problem
for TLS offload. We should fix that, based on skb->decrypt. right?

BTW I haven't looked closely but is there no existing helper that
would give you the ability to walk the extension headers?