Re: [PATCH net v3 2/4] psp: support ipv6 extension headers in psp_dev_rcv() decap

[Björn Töpel]

Jakub Kicinski <kuba@xxxxxxxxxx> writes:

> On Mon, 26 Oct 2026 15:05:42 -0700 Todd Bert Freed wrote:
>> > The PSP ICV doesn't cover the outer IPv6 header or its extension headers.
>> > An on-path attacker could take a captured PSP packet, insert one of these
>> > headers, and set saddr to an address they control. This assumes the
>> > device authenticates such packets, which this patch's premise implies.
>> >
>> > Several of those handlers reply with an ICMPv6 error that quotes the
>> > packet. With default sysctls, this happens for an unrecognized routing
>> > header type (type 0, for example) with segments_left != 0:
>> >
>> > Before this patch, all of these packets were dropped at the is_udp check.
>> > Forwarding the decrypted skb itself looks blocked by
>> > sk_validate_xmit_skb() ("unencrypted skb with no associated socket -
>> > dropping"). That leaves the ICMP error path as the open channel.  
>> 
>> Agree with this finding.
>
> If we're leaking cleartext in ICMP responses that's also a problem
> for TLS offload. We should fix that, based on skb->decrypt. right?

Ugh, interesting. Drop ICMP (no, on v6...), or just include up to, but
not including transport headers?