[PATCH net-next v1 06/15] net/sched: act_mirred: don't send decrypted skbs from egress to ingress

[Todd Freed]

on transmit, skb->decrypted means the device must encrypt the packet.
For example, a packet of a ktls or psp offload socket, or, with the tc
psp action added later in this series, one which psp encap attached a
tx association to.

on receive, skb->decrypted means the device decrypted the packet.

a packet redirected or mirrored from egress to ingress is by definition
not going to the device that would encrypt it, and on ingress
skb->decrypted now (incorrectly, for this packet) indicates it was
decrypted by the device.

this is less of a problem with socket offloads, whose packets are by
definition originated locally; more of a problem with socket-less psp,
which can also apply to forwarded traffic.

mirred also drops the dst, which for socket-less psp carries the tx
association. clearing the bit instead would let the packet be forwarded
in clear text, so that wouldn't work.

don't send decrypted skbs from egress to ingress: a redirected one is
dropped, a mirrored one isn't copied.

Signed-off-by: Todd Freed <toddfreed@xxxxxxxx>
---
 net/sched/act_mirred.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index 1c98e4d81ebe..52c3eeab381a 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -285,6 +285,12 @@ static int tcf_mirred_to_dev(struct sk_buff *skb, struct tcf_mirred *m,
 		goto err_cant_do;
 	}
 
+	/* On transmit, decrypted asks the device to encrypt the packet. Sent
+	 * to ingress, the packet would read as decrypted by the device.
+	 */
+	if (unlikely(want_ingress && !at_ingress && skb_is_decrypted(skb)))
+		goto err_cant_do;
+
 	/* we could easily avoid the clone only if called by ingress and clsact;
 	 * since we can't easily detect the clsact caller, skip clone only for
 	 * ingress - that covers the TC S/W datapath.
-- 
2.53.0-Meta