Re: [PATCH net v3 3/4] psp: support ipv6 extension headers in psp_dev_encapsulate()

[sashiko-bot@kernel.org]

> psp_dev_encapsulate() inserts the udp and psp headers and rewrites the
> l3 next header to udp.
> 
> if the packet is an ipv6 packet with extension headers, the transport
> header comes after them, so rewriting the next header of the ipv6 fixed
> header produces a malformed packet.
> 
> a psp tcp socket emits such packets if certain socket options are set on
> it (e.g. IPV6_DSTOPTS). with mlx5, these packets also go out
> unencrypted.
> 
> fix by walking the extension header chain to rewrite the nexthdr on the
> last one in the chain instead. the walk also rejects packets with
> extension headers that aren't supported in transport mode,
> 
> - NEXTHDR_FRAGMENT. this could work, but udp+psp would need to come
>   before it, which is different than how the other option types are
>   handled. for now, keep fragments unsupported for transport mode.
> 
> - NEXTHDR_AUTH. changing what follows would break the AH ICV. Also, AH
>   adds little incremental value when used with psp, whose ICV already
>   authenticates the payload. AH remains unsupported for psp transport
>   mode.
> 
> note that the stack doesn't fragment ipv6 tcp packets, so a psp socket
> won't be able to exercise the tx fragment path.
> 
> Suggested-by: Daniel Zahka <daniel.zahka@gmail.com>
> Fixes: fc724515741a ("psp: provide encapsulation helper for drivers")
> Signed-off-by: Todd Freed <toddfreed@meta.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261023234640.1459291-1-toddfreed@meta.com?part=3