[PATCH net-next v1 08/15] psp: only give time-wait sockets of psp connections a validator

[Todd Freed]

psp_twsk_init() sets tw_validate_xmit_skb on tcp time-wait sockets.
today, that becomes set whether or not the socket has psp offload, which
is not needed but is harmless. psp_validate_xmit() passes such packets.

but a validator makes a socket look like it has an encryption offload of
its own, and the tc psp action, added in the next patch, relies on that:
encap refuses the packets of such a socket, and sk_validate_xmit_skb()
drops a packet with a psp association whose socket has a validator.

set the validator only when the socket has a psp association.

Signed-off-by: Todd Freed <toddfreed@xxxxxxxx>
---
 net/psp/psp_sock.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/net/psp/psp_sock.c b/net/psp/psp_sock.c
index 609b06c7af65..664955bfb4fd 100644
--- a/net/psp/psp_sock.c
+++ b/net/psp/psp_sock.c
@@ -330,10 +330,14 @@ void psp_twsk_init(struct inet_timewait_sock *tw, const struct sock *sk)
 {
 	struct psp_assoc *pas = psp_sk_assoc(sk);
 
-	if (pas)
+	if (pas) {
 		refcount_inc(&pas->refcnt);
+		/* Only for PSP connections: a validator makes the socket
+		 * look like it has an encryption offload of its own
+		 */
+		tw->tw_validate_xmit_skb = psp_validate_xmit;
+	}
 	rcu_assign_pointer(tw->psp_assoc, pas);
-	tw->tw_validate_xmit_skb = psp_validate_xmit;
 }
 
 void psp_twsk_assoc_free(struct inet_timewait_sock *tw)
-- 
2.53.0-Meta