[PATCH net 1/2] psp: drop transport mode packets with extension headers

[Todd Freed <toddfreed@meta.com>]

psp_dev_encapsulate() inserts the udp and psp headers and rewrites the
l3 next header to udp.

if the packet is an ipv6 packet with extension headers, the transport
header comes after them, so rewriting the next header of the ipv6 fixed
header is wrong.

a psp tcp socket emits such packets if certain socket options are set on
it (e.g. IPV6_DSTOPTS). with mlx5, these packets also go out
unencrypted.

drop such packets on egress rather than them send malformed.

note that a tcp socket which has such options set stops making progress.
its packets are dropped (SKB_DROP_REASON_PSP_OUTPUT) until the
connection times out.

refusing the combination on the control path, when the options or the tx
association are set, would be helpful but is not implemented here.
extension headers can also come from a route, so the datapath check is
needed either way.

Fixes: fc724515741a ("psp: provide encapsulation helper for drivers")

Signed-off-by: Todd Freed <toddfreed@meta.com>
---
 net/psp/psp_main.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/net/psp/psp_main.c b/net/psp/psp_main.c
index c9c1a8826b7f..0d276e2aceff 100644
--- a/net/psp/psp_main.c
+++ b/net/psp/psp_main.c
@@ -243,7 +243,7 @@ static void psp_write_headers(struct net *net, struct sk_buff *skb, __be32 spi,
 }
 
 /* Encapsulate a TCP packet with PSP by adding the UDP+PSP headers and filling
- * them in.
+ * them in. IPv6 packets with extension headers are rejected.
  */
 bool psp_dev_encapsulate(struct net *net, struct sk_buff *skb, __be32 spi,
 			 u8 ver, __be16 sport)
@@ -256,6 +256,11 @@ bool psp_dev_encapsulate(struct net *net, struct sk_buff *skb, __be32 spi,
 	    skb->protocol != htons(ETH_P_IPV6))
 		return false;
 
+	/* extension headers not supported */
+	if (skb->protocol == htons(ETH_P_IPV6) &&
+	    network_len != sizeof(struct ipv6hdr))
+		return false;
+
 	if (skb_cow_head(skb, PSP_ENCAP_HLEN))
 		return false;
 
-- 
2.53.0-Meta