Re: [PATCH net v3 2/4] psp: support ipv6 extension headers in psp_dev_rcv() decap

[Todd Bert Freed]

> >> Before this patch, all of these packets were dropped at the is_udp check.
> >> Forwarding the decrypted skb itself looks blocked by
> >> sk_validate_xmit_skb() ("unencrypted skb with no associated socket -
> >> dropping"). That leaves the ICMP error path as the open channel.
> >
> > Agree with this finding.
> >
> > Ok, this puts me back in mind of the approach in v0 of this series ; just drop
> > packets with extension headers. Actual support for extension headers can be
> > done separately from this fix.
> >
> > pw-bot: cr
> >
> > -Todd
>
> Like Jakub points out, this equally could affect tls offload. We need to
> be careful with any features that can result in device-decrypted data
> being sent back onto the network. Another gap that exists currently is
> xdp tx or redirect. That would also affect both PSP and TLS offload. I
> think we should try and make these features work with crypto offload,
> rather than building up more and more defensive checks.

Adding the skb->decrypted check on the ICMP path makes sense to me, as
a fix for this specific case. I am a little wary of fixing the known issues, and
missing some unknowns though.

-Todd