Re: [PATCH net 1/3] net/sched: act_mirred: don't send decrypted skbs from egress to ingress

[Jamal Hadi Salim]

On Fri, Nov 13, 2026 at 1:56 PM Todd Freed <toddfreed@xxxxxxxx> wrote:
>
> On transmit, skb->decrypted means that the device must encrypt the
> packet, e.g. a packet of a kTLS or PSP device offload socket.
>
> On receive, skb->decrypted means that the device decrypted the packet,
> and kTLS device offload trusts it as such (tls_device_decrypted()).
>
> A packet which mirred redirects or mirrors from egress to ingress keeps
> the bit. On ingress, it then claims to have been decrypted by the device,
> although it was never encrypted, and its payload, which was to be
> encrypted before leaving the host, could then be forwarded in cleartext.
>
> Clearing skb->decrypted would not work, because that is what indicates
> intent to encrypt the packet.
>
> Don't send decrypted skbs from egress to ingress: a redirected one is
> dropped, a mirrored one isn't copied.
>
> Fixes: 414776621d10 ("net/tls: prevent skb_orphan() from leaking TLS plain text with offload")
> Signed-off-by: Todd Freed <toddfreed@xxxxxxxx>

Missing Cc: stable other than that:
Reviewed-by: Jamal Hadi Salim <jhs@xxxxxxxxxxxx>

unrelated - are you sure patch 3 belongs in net? Feels more like net-next.
psp_reply_set_decrypted() only sets the bit when the association has a
Tx key (which you are testing here).

cheers,
jamal

PS:- on your question regarding sashiko-nipa reviews: They show up on
the mailing list - but sometimes its unreliable so an alternative is
to visit the website: https://netdev-ai.bots.linux.dev/sashiko
> ---
>  net/sched/act_mirred.c | 6 ++++++
>  1 file changed, 6 insertions(+)
>
> diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
> index 1c98e4d81ebe..52c3eeab381a 100644
> --- a/net/sched/act_mirred.c
> +++ b/net/sched/act_mirred.c
> @@ -285,6 +285,12 @@ static int tcf_mirred_to_dev(struct sk_buff *skb, struct tcf_mirred *m,
>                 goto err_cant_do;
>         }
>
> +       /* On transmit, decrypted asks the device to encrypt the packet. Sent
> +        * to ingress, the packet would read as decrypted by the device.
> +        */
> +       if (unlikely(want_ingress && !at_ingress && skb_is_decrypted(skb)))
> +               goto err_cant_do;
> +
>         /* we could easily avoid the clone only if called by ingress and clsact;
>          * since we can't easily detect the clsact caller, skip clone only for
>          * ingress - that covers the TC S/W datapath.
> --
> 2.53.1-Meta
>