[PATCH net 3/3] psp: only give time-wait sockets of PSP connections a validator

[Todd Freed]

psp_twsk_init() sets tw_validate_xmit_skb on TCP time-wait sockets.
Today, that becomes set whether or not the socket has PSP offload, which
is not needed but is harmless. psp_validate_xmit() passes such packets.

But a validator makes a socket look like it has an encryption offload of
its own. The tc psp action in the net-next series "psp: introduce
socket-less associations" relies on the presence of the validator to
determine whether the socket has an encryption offload.

Set the validator only when the socket has a PSP association with a Tx
key, as psp_sock_set_tx_key() does for full sockets.

Fixes: 6b46ca260e22 ("net: psp: add socket security association code")
Signed-off-by: Todd Freed <toddfreed@xxxxxxxx>
---
 net/psp/psp_sock.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/net/psp/psp_sock.c b/net/psp/psp_sock.c
index a6b1c42dd626..1df65505f1c6 100644
--- a/net/psp/psp_sock.c
+++ b/net/psp/psp_sock.c
@@ -314,10 +314,13 @@ void psp_twsk_init(struct inet_timewait_sock *tw, const struct sock *sk)
 {
 	struct psp_assoc *pas = psp_sk_assoc(sk);
 
-	if (pas)
+	if (pas) {
 		refcount_inc(&pas->refcnt);
+		/* like the full socket case in psp_sock_set_tx_key() */
+		if (pas->tx.spi)
+			tw->tw_validate_xmit_skb = psp_validate_xmit;
+	}
 	rcu_assign_pointer(tw->psp_assoc, pas);
-	tw->tw_validate_xmit_skb = psp_validate_xmit;
 }
 
 void psp_twsk_assoc_free(struct inet_timewait_sock *tw)
-- 
2.53.1-Meta